SSCP Security Operations and Administration Practice Test 7 — 15 Questions

Question 1

A security administrator needs to ensure that only authorized devices can connect to the corporate wireless network. Which of the following should be implemented to meet this requirement?

Accepted Answer

WPA2-Enterprise with 802.1X. WPA2-Enterprise with 802.1X authenticates each device or user individually, typically against a RADIUS server, before granting network access. This ensures that only authorized devices can connect. MAC filtering, PSK, and SSID hiding are either weak or do not provide per-device authorization.

Answer

MAC address filtering

Answer

SSID broadcasting disabled

Answer

Pre-shared key (PSK) authentication

Question 2

A security administrator is implementing a new system that will process credit card payments. The organization must comply with PCI DSS. Which of the following controls is specifically required by PCI DSS to protect stored cardholder data?

Accepted Answer

Encrypting cardholder data at rest using strong cryptography. PCI DSS requires that stored cardholder data be protected by rendering it unreadable, commonly through strong encryption. This directly addresses the risk of data exposure from compromised storage. A WAF, ASV scans, and password policies are required or recommended for other aspects of PCI DSS but do not fulfill the specific stored-data protection requirement.

Answer

Implementing a web application firewall (WAF) in front of the payment application

Answer

Conducting quarterly external network scans by an Approved Scanning Vendor (ASV)

Answer

Enforcing a minimum password length of eight characters for all users

Question 3

A security administrator is implementing a defense-in-depth strategy for a new data center. Which of the following BEST describes the role of security awareness training within this strategy?

Accepted Answer

It reduces the likelihood of successful social engineering attacks by educating users.. Security awareness training is an administrative control that educates users on recognizing and avoiding social engineering attacks, thereby reducing the likelihood of successful phishing or pretexting attempts. It complements technical controls like firewalls and antivirus, forming a layer of defense that addresses the human element.

Answer

It enforces mandatory vacation policies to detect fraud.

Answer

It encrypts sensitive data at rest and in transit.

Answer

It provides a technical control that blocks malware from executing on endpoints.

Question 4

A financial services firm must demonstrate to auditors that access to its core banking platform follows least privilege and is reviewed regularly. Which TWO practices BEST support this objective? (Choose two.)

Accepted Answer

Implement role-based access control with entitlements mapped to documented job functions.. Least privilege is sustained through two complementary mechanisms: a design that grants only role-appropriate entitlements, and a recurring review that confirms those grants remain justified. Role-based access control structures the grants, while owner certification validates them over time. Together they produce both the control and the evidence auditors expect.

Answer

Grant permanent elevated access to any user who requests it to reduce help desk tickets.

Answer

Assign all platform administrators a shared emergency account for routine maintenance.

Answer

Disable audit logging on the platform to improve performance during peak transaction periods.

Question 5

A security administrator needs to ensure that a terminated employee loses access to all systems immediately upon departure. Which action best accomplishes this?

Accepted Answer

Disable the user account in the central directory and revoke active sessions and tokens.. Immediate access removal requires disabling the identity in the central directory and revoking any active sessions or tokens. Directory disablement blocks new logins across connected systems, and session revocation closes the gap for already-authenticated connections. Password changes, payroll-only removal, or delayed deletion all leave exploitable access in place.

Answer

Remove the employee from the payroll system only.

Answer

Schedule the account for deletion at the next quarterly access review.

Answer

Change the employee's password and notify the manager of the new credential.

Question 6

A security administrator is implementing a solution to detect unauthorized changes to critical system files on a server. Which of the following technologies is BEST suited for this purpose?

Accepted Answer

File integrity monitoring (FIM). File integrity monitoring is specifically designed to detect unauthorized changes to files by comparing current hashes to known good baselines. It provides alerts when critical system files are modified, making it the best choice for this requirement.

Answer

Security information and event management (SIEM)

Answer

Intrusion detection system (IDS)

Answer

Data loss prevention (DLP)

Question 7

A security administrator is drafting a data handling standard for a retail company that processes payment cards. The standard must state how long transaction records may be retained and how they must be destroyed. Which source should PRIMARILY drive these retention and destruction requirements?

Accepted Answer

Legal, regulatory, and contractual requirements applicable to payment card data.. Data retention and destruction standards must be anchored in the obligations that apply to the data. For payment card information, those obligations come from laws, the payment card industry standard, and acquiring bank contracts. Operational factors such as storage capacity or analytics desires inform implementation but cannot define the retention period or destruction method.

Answer

The storage capacity available in the primary transaction database.

Answer

The vendor's default configuration settings for the point-of-sale system.

Answer

The preferences of the marketing department for customer analytics.

Question 8

A security administrator must verify that a third-party service provider meets the organization's security requirements before signing a contract. The provider will process regulated customer data. Which action provides the most reliable assurance?

Accepted Answer

Obtain and review an independent third-party audit report covering the provider's relevant controls.. Independent third-party audit reports give the most reliable assurance because an external auditor examines the provider's controls against recognized criteria and reports scope, period, and exceptions. Self-signed questionnaires, marketing claims, and verbal confirmations are unverified and unsuitable as primary evidence when regulated customer data is involved.

Answer

Ask the provider to confirm verbally during a call that it follows industry best practices.

Answer

Rely on the provider's marketing materials describing its security program.

Answer

Accept the provider's completed security questionnaire signed by its sales director.

Question 9

A healthcare organization's security team is reviewing a third-party cloud provider that will store electronic protected health information. The provider's SOC 2 Type II report is two years old, and the provider has since migrated to a new data center. Which action should the security administrator take FIRST to determine whether the provider still meets the organization's security requirements?

Accepted Answer

Request the provider's current SOC 2 Type II report or bridge letter covering the new data center period.. A SOC 2 Type II report is point-in-time evidence covering a defined audit period and specific systems. Because the provider migrated to a new data center after the report was issued, the prior opinion does not cover the current environment. Requesting an updated report or a bridge letter is the correct first action because it provides current, independent assurance before the organization makes contractual or technical decisions.

Answer

Immediately terminate the contract and select a new cloud provider with a current SOC 2 report.

Answer

Accept the existing SOC 2 Type II report because it demonstrates the provider has a mature security program.

Answer

Perform a full penetration test of the provider's new data center without notifying the provider.

Question 10

A security administrator is reviewing the organization's account management process. The policy states that user accounts must be reviewed at least quarterly to ensure that only authorized individuals retain access. During an audit, it is discovered that several former employees still have active accounts. Which of the following is the MOST appropriate action to address this finding?

Accepted Answer

Immediately disable the accounts and then review the account management process to identify why the accounts were not removed.. The most critical step is to immediately disable the accounts to eliminate the unauthorized access. Then, the administrator should investigate why the accounts were not removed to prevent similar issues. Deleting accounts can destroy evidence and is not best practice; resetting passwords does not revoke access; and delaying action increases risk. Thus, disabling and then reviewing the process is the correct approach.

Answer

Delete the accounts and then perform a full audit of all user accounts to ensure no other former employees have access.

Answer

Document the finding in the audit report and schedule the account removals for the next quarterly review cycle.

Answer

Reset the passwords on the accounts and notify the former employees' managers to confirm whether access is still needed.

Question 11

A security administrator is reviewing the organization's backup strategy for a database server that must meet a recovery point objective (RPO) of 15 minutes. The server currently uses a full backup every Sunday and differential backups every night. The administrator finds that the current strategy cannot meet the RPO. Which backup method should the administrator implement to meet the RPO while minimizing backup storage consumption?

Accepted Answer

Transaction log backups every 15 minutes. Transaction log backups capture every committed transaction since the previous log backup, so a 15-minute schedule delivers an RPO of 15 minutes. They are also far more storage-efficient than full or differential backups because they contain only log records. This combination of frequent recovery points and low storage overhead makes them the correct choice for meeting the stated RPO.

Answer

Differential backups every 15 minutes

Answer

Full backups every 15 minutes

Answer

Snapshot backups every 15 minutes

Question 12

A financial services firm is implementing role-based access control for its trading platform. An auditor finds that several traders can approve their own trades in addition to executing them. Which principle is being violated, and which control should the security administrator implement to remediate the finding?

Accepted Answer

Separation of duties; enforce distinct roles so the trade executor cannot also approve the same transaction.. The auditor observed that the same individual can execute and approve a trade, which is a classic separation of duties violation. Separation of duties ensures that critical tasks are divided among multiple people so that no single person can complete a sensitive transaction alone. Implementing mutually exclusive roles that separate execution from approval directly remediates the finding.

Answer

Need to know; restrict traders from viewing market data unrelated to their assigned portfolios.

Answer

Least privilege; implement just-in-time privileged access with approval workflows.

Answer

Mandatory access control; classify trades by sensitivity and apply system-enforced labels.

Question 13

A security administrator is implementing a new file integrity monitoring (FIM) solution on critical servers. The administrator needs to ensure that the solution can detect unauthorized changes to system binaries and configuration files. Which of the following should the administrator configure to establish a trusted baseline for the FIM solution?

Accepted Answer

Generate cryptographic hashes of the files and store them in a secure, offline location.. To establish a trusted baseline for FIM, the administrator must capture the current state of critical files, typically by generating cryptographic hashes. Storing these hashes securely offline prevents tampering. File access auditing, backups, and registry monitoring do not provide a file content baseline. Therefore, the correct action is to generate and securely store file hashes.

Answer

Schedule a daily full backup of the critical servers and store the backups on a separate network share.

Answer

Configure the FIM solution to monitor the Windows Registry for changes to critical keys.

Answer

Enable auditing of file access events in the operating system's security log.

Question 14

A security administrator is tasked with implementing a formal process for managing user access rights. The organization requires that access be granted based on job roles and that users receive only the permissions necessary to perform their duties. Which of the following should the administrator implement?

Accepted Answer

Role-based access control (RBAC). Role-based access control (RBAC) is designed to assign permissions to roles and then assign users to those roles, ensuring that users have only the access required for their job functions. This satisfies the requirement for role-based provisioning and least privilege. Other models like MAC, DAC, or ABAC do not align as directly with the stated need.

Answer

Discretionary access control (DAC)

Answer

Mandatory access control (MAC)

Answer

Attribute-based access control (ABAC)

Question 15

A security administrator is reviewing the organization's account management procedures. The administrator discovers that user accounts for terminated employees remain active for up to 30 days after departure. Which account management control should the administrator implement to address this risk?

Accepted Answer

Implement an automated account deprovisioning process tied to HR termination records. An automated deprovisioning process linked to HR termination records disables accounts immediately upon termination, eliminating the 30-day window of exposure. Manual or periodic controls cannot match this timeliness. This is the most direct and effective control for ensuring departed employees lose access promptly.

Answer

Enforce a password expiration policy of 30 days

Answer

Conduct quarterly access reviews of all user accounts

Answer

Require multi-factor authentication for all user accounts