SSCP Security Operations and Administration Practice Test 5 — 15 Questions

Question 1

A vulnerability scan identifies a critical vulnerability on a web server with a CVSS score of 9.8. The server hosts a public-facing application. However, the patch would require a reboot that would cause downtime during business hours. What should the security administrator do FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assess the risk and implement compensating controls if possible. Assessing the risk and implementing compensating controls if possible is the first step because it balances the need to address the critical vulnerability with the business impact of downtime. This approach follows risk management principles: evaluate the severity, exploitability, and potential impact, then apply mitigations such as virtual patching, network segmentation, or increased monitoring until a patch can be safely applied. It is not prudent to ignore or immediately disrupt business operations without analysis.

Answer

Schedule the patch for the next maintenance window without further analysis

Answer

Apply the patch immediately during business hours

Answer

Document the exception and ignore the vulnerability

Question 2

An employee is leaving the company. As part of the offboarding process, which action should be taken regarding the hardware assigned to the employee?

Accepted Answer

Sanitise the hard drive and then dispose or reassign. Sanitising the hard drive before disposal or reassignment is the correct action because it ensures all sensitive company and employee data is securely removed, preventing data leakage. This aligns with data remanence best practices and regulatory requirements for media sanitisation. Reassigning or disposing without sanitisation exposes the organization to data breach risks.

Answer

Keep the hardware in storage indefinitely

Answer

Recycle the hardware without any data removal

Answer

Reassign the hardware to a new employee without wiping

Question 3

Which of the following is the BEST definition of Recovery Point Objective (RPO)?

Accepted Answer

The maximum acceptable data loss in terms of time. Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time, indicating how far back in time the data must be restored to resume operations after a disaster. It directly drives backup frequency and replication intervals, such as setting a 15-minute RPO requiring transaction log backups every 15 minutes in SQL Server or continuous data replication in a SAN environment.

Answer

The cost of data recovery

Answer

The time it takes to recover data after a disaster

Answer

The number of backup copies stored

Question 4

A security administrator is reviewing log files and notices that a user logged in at 3:00 AM from an IP address in a foreign country. The user's manager confirms the user is not authorized for remote access. Which type of policy has likely been violated?

Accepted Answer

Remote access policy. The scenario describes a user logging in from an unauthorized location (foreign country) at an unusual time (3:00 AM) without remote access authorization. This directly violates the remote access policy, which defines who can connect remotely, from where, and under what conditions. The policy typically specifies allowed authentication methods (e.g., VPN with multi-factor authentication), permitted IP ranges, and time-of-day restrictions to prevent unauthorized external connections.

Answer

Data handling policy

Answer

Password policy

Answer

Acceptable use policy (AUP)

Question 5

During a post-implementation review of a change, it is discovered that the change introduced a configuration deviation from the baseline. The deviation was not detected during testing. What is the BEST way to prevent this in the future?

Accepted Answer

Implement automated configuration scanning in the staging environment. Automated configuration scanning in the staging environment detects deviations from the baseline before production, catching issues that manual testing missed. This provides continuous, repeatable verification against the approved configuration baseline, which is the most reliable preventive control.

Answer

Increase the number of testers

Answer

Require CAB approval for all future changes

Answer

Use a different change management process

Question 6

An organization wants to ensure that sensitive data on laptops is protected in case of loss or theft. Which control is MOST effective?

Accepted Answer

Full disk encryption. Full disk encryption (FDE) is the most effective control because it renders data unreadable at rest on the entire drive, including the operating system, swap files, and temporary files. Without the decryption key (e.g., a pre-boot PIN or TPM-bound key), an attacker cannot access any data even if the laptop is physically removed. This directly addresses the threat of data exposure from loss or theft, unlike controls that only limit access or track the device.

Answer

Strong password policy

Answer

Asset tracking software

Answer

Remote wiping capability

Question 7

Which THREE of the following are valid steps in the change management process? (Select THREE)

Accepted Answer

Post-implementation review. Option E (Change request submission) is correct because the change management process formally begins when a Request for Change (RFC) is submitted and logged, often via a ticketing or ITSM system, so the change can be reviewed and authorized. Option D (Impact assessment) is correct because after the RFC is raised, the change advisory board or reviewers evaluate risk, scope, affected systems, and potential downtime to decide whether the change should be approved. Option A (Post-implementation review) is correct because after the change is deployed, the process includes verifying that it achieved its objective, did not cause unintended issues, and capturing lessons learned for future changes. Option B (Vulnerability scanning) is not a change management step; it is a security assessment activity typically performed under vulnerability management, even though its findings may trigger an RFC. Option C (Baseline configuration update) is not a step in the change management process itself; updating the configuration baseline is a configuration management activity that occurs after an approved change is implemented.

Answer

Vulnerability scanning

Answer

Baseline configuration update

Question 8

Which TWO of the following are examples of physical security controls? (Select TWO)

Accepted Answer

CCTV. B (CCTV) is correct because closed-circuit television cameras are a physical security control that monitors and records activity in a facility to deter and detect intrusions. D (Biometric reader) is correct because it is a physical access control device that authenticates individuals via fingerprints, iris, or facial recognition to restrict entry to a protected area. A (Firewall) is incorrect because it is a logical/network security control that filters traffic based on rules, not a physical barrier. C (Intrusion detection system) is incorrect because an IDS is a logical monitoring control that analyzes network or host activity for malicious behavior. E (Encryption) is incorrect because it is a cryptographic/logical control that protects data confidentiality, not a physical control.

Answer

Firewall

Answer

Intrusion detection system (IDS)

Answer

Encryption

Question 9

Which THREE of the following are critical elements of a patch management policy? (Select THREE)

Accepted Answer

Patch prioritization based on CVSS score and asset criticality. Option A is correct because a sound patch management policy must rank patches by risk, combining the CVSS base score (e.g., 9.8 Critical) with the business criticality of the affected asset so that the most dangerous exposures on the most important systems are remediated first. Option D is correct because you cannot patch what you have not found; regular authenticated vulnerability scanning (e.g., credentialed scans with Nessus or Qualys) is the mechanism that identifies missing patches and misconfigurations and feeds the remediation workflow. Option E is correct because patches should be validated in a staging or test environment that mirrors production before broad rollout, catching application compatibility and regression issues while still meeting the policy's remediation deadlines. Option B is not part of a policy because deploying every patch immediately with no testing risks outages and is the opposite of a controlled, risk-based process. Option C is not adequate because reviewing patch status only annually leaves systems exposed for months; effective policies require continuous or at least monthly monitoring and reporting of patch compliance.

Answer

Immediate deployment of all patches without testing

Answer

Annual review of patch status

Question 10

Which TWO of the following are key components of a configuration management database (CMDB)? (Select TWO)

Accepted Answer

Relationships between configuration items. Option C is correct because a CMDB's defining feature is storing configuration items (CIs) together with their dependencies and relationships, which enables impact analysis and service mapping. Option E is correct because CIs include hardware assets and their attributes, such as serial numbers, model, and location, which are core inventory data held in the CMDB. Options A, B, and D are not CMDB components: password hashes belong to credential/identity stores such as Active Directory or a secrets vault, change request approvals belong to a change management/workflow system (e.g., ITIL change records), and incident tickets belong to an incident management or ITSM ticketing system, even though these tools may integrate with the CMDB.

Answer

Password hashes

Answer

Change request approvals

Answer

Incident tickets

Question 11

A security awareness training program aims to reduce successful phishing attacks. Which metric is most appropriate for measuring the effectiveness of this training?

Accepted Answer

Percentage of employees who click simulated phishing links. The percentage of employees who click simulated phishing links is the most appropriate metric because it directly measures the behavior the training aims to change—whether employees can recognize and avoid phishing attempts. A decrease in click rate over time indicates improved awareness and reduced susceptibility. This is a direct, outcome-based measure of training effectiveness, unlike completion rates which only show participation.

Answer

Training completion rate

Answer

Number of reported phishing emails

Answer

Number of security incidents caused by phishing

Question 12

What is the primary purpose of a baseline configuration in configuration management?

Accepted Answer

To provide a consistent, secure starting point for systems. A baseline configuration in configuration management defines a known, secure, and consistent state for a system at a specific point in time. This baseline serves as the foundation for all subsequent changes, ensuring that systems are deployed with hardened settings and that any deviations can be detected and remediated. It directly supports security operations by enforcing minimum security standards and simplifying compliance auditing.

Answer

To store configuration items in the CMDB

Answer

To detect malware infections

Answer

To track software licenses

Question 13

An organization uses a SIEM to alert when a server's configuration changes from its hardened baseline. This is an example of:

Accepted Answer

Deviation detection. SIEM alerts on configuration changes from baseline are a form of deviation detection, which is part of configuration management.

Answer

Patch management

Answer

Vulnerability scanning

Answer

Asset management

Question 14

Which backup type copies all data that has changed since the last full backup, regardless of any incremental backups?

Accepted Answer

Differential backup. A differential backup copies all data that has changed since the last full backup, regardless of any intermediate incremental backups. This means each differential backup grows in size as it accumulates all changes made after the last full backup, making it distinct from incremental backups which only capture changes since the last backup of any type.

Answer

Synthetic full backup

Answer

Full backup

Answer

Incremental backup

Question 15

An organization needs to recover data from a backup after a ransomware attack. The backup was taken 12 hours ago, and the RPO is 4 hours. What is the impact?

Accepted Answer

The RPO is violated because more than 4 hours of data may be lost. RPO (Recovery Point Objective) defines the maximum acceptable data loss. If the backup is 12 hours old and RPO is 4 hours, the organization has lost 8 hours of data, exceeding the objective.

Answer

The RPO is met because data can be recovered

Answer

The RTO is exceeded

Answer

The 3-2-1 rule is violated