SSCP Timed Practice Test 1 — 10 Questions

Question 1

A security administrator needs to choose an encryption algorithm for a high-speed network where data is encrypted at the link layer. Which algorithm is most appropriate?

Accepted Answer

AES. AES (Advanced Encryption Standard) is the most appropriate choice for link-layer encryption in high-speed networks because it is a symmetric block cipher designed for efficient hardware and software implementation, offering high throughput with low latency. Unlike asymmetric algorithms, AES operates with a single shared key, making it ideal for encrypting bulk data at the data link layer where speed and minimal overhead are critical.

Answer

RSA

Answer

Diffie-Hellman

Answer

SHA-256

Question 2

Which THREE of the following are common use cases for public key infrastructure (PKI)? (Select exactly three.)

Accepted Answer

Digital signatures. Digital signatures are a core use case for PKI because they rely on asymmetric cryptography where a private key signs data and the corresponding public key, bound to an identity via a digital certificate issued by a Certificate Authority (CA), verifies the signature. This ensures authenticity, integrity, and non-repudiation of the signed message or document.

Answer

Password hashing

Answer

Symmetric key exchange

Question 3

When implementing a digital signature, which key is used to create the signature?

Accepted Answer

Sender's private key. In a digital signature scheme, the sender uses their own private key to create the signature. This ensures non-repudiation because only the sender possesses that private key, and the corresponding public key can verify the signature. The process involves encrypting a hash of the message with the sender's private key, as specified in standards like PKCS#1 and RFC 8017.

Answer

Receiver's private key

Answer

Sender's public key

Answer

Receiver's public key

Question 4

A security administrator is configuring a wireless network for a branch office. The office has legacy devices that only support WPA2-PSK. The administrator wants to provide the highest level of security while maintaining compatibility. Which configuration should be used?

Accepted Answer

WPA2-PSK with AES (CCMP). WPA2-PSK with AES (CCMP) is correct because it provides the highest security level compatible with legacy devices that only support WPA2-PSK. AES-CCMP is the mandatory encryption protocol for WPA2, offering strong data confidentiality and integrity, whereas TKIP is deprecated due to known vulnerabilities. This configuration avoids the need for a RADIUS server (required by WPA2-Enterprise) and does not force an upgrade to WPA3, which legacy devices cannot support.

Answer

WPA2-Enterprise with RADIUS

Answer

WPA3-SAE only

Answer

WPA2-PSK with TKIP

Question 5

Which TWO of the following are functions of a network firewall?

Accepted Answer

Filtering traffic based on IP addresses and ports. Option B is correct because a network firewall's primary function is to enforce access control policies by filtering traffic based on Layer 3 (IP addresses) and Layer 4 (ports) information. This stateless or stateful inspection allows the firewall to permit or deny packets according to rules, such as allowing HTTP traffic (TCP port 80) from a specific source IP. This is a core security mechanism to segment networks and block unauthorized access.

Answer

Resolving domain names to IP addresses

Answer

Encrypting data at rest

Answer

Assigning IP addresses to hosts

Question 6

A network engineer is designing a secure WAN link between two offices using IPsec VPN. The company requires encryption of all traffic, authentication of both endpoints, and protection against replay attacks. Which combination of IPsec protocols and modes should be used?

Accepted Answer

ESP in tunnel mode. ESP in tunnel mode encrypts and authenticates the entire original IP packet, providing confidentiality, integrity, and authentication for the entire payload. It also includes sequence numbers to protect against replay attacks, making it the correct choice for a secure WAN link between two offices.

Answer

AH in tunnel mode

Answer

AH in transport mode

Answer

ESP in transport mode

Question 7

A company's internal network uses a /24 subnet and has a single firewall connecting to the internet. Employees report that they cannot access an external web server at 203.0.113.50. The firewall has a rule that allows outbound HTTP. What is the most likely cause?

Accepted Answer

NAT is not configured for outbound traffic.. The firewall rule allows outbound HTTP, but without NAT configured, the internal hosts' private IP addresses (e.g., 192.168.1.x) are used as source addresses in packets sent to the external web server. The web server at 203.0.113.50 will see these private addresses as the source and attempt to reply to them, but private addresses are not routable on the public internet, so the return traffic never reaches the internal hosts. NAT (specifically source NAT or PAT) translates the private source IP to the firewall's public IP, enabling two-way communication.

Answer

The default gateway on the internal hosts is incorrect.

Answer

DNS resolution is failing for the server name.

Answer

An ACL is blocking the destination IP.

Question 8

A security analyst notices unusual outbound traffic from a server in the DMZ to an external IP address on port 4444. The server runs a web application. Which action should the analyst take first?

Accepted Answer

Check the server's running processes and established connections.. Option C is correct because the first step in incident response is to gather forensic evidence and understand the scope of the compromise. Checking running processes and established connections allows the analyst to identify the malicious process, its parent, and the active command-and-control (C2) channel on port 4444, which is commonly associated with reverse shells or backdoor traffic. This data is volatile and must be captured before any disruptive action like disconnection or reboot, which would destroy evidence.

Answer

Disconnect the server from the network.

Answer

Reboot the server to clear any malware.

Answer

Block the outbound traffic at the firewall.

Question 9

Which TWO of the following are best practices for securing a wireless network?

Accepted Answer

Using WPA2-Enterprise with 802.1X. WPA2-Enterprise with 802.1X is a best practice because it provides strong encryption (AES-CCMP) and per-user authentication via a RADIUS server, eliminating the vulnerabilities of pre-shared keys. The 802.1X framework ensures that each user must authenticate individually, preventing unauthorized access even if a single credential is compromised. This is the gold standard for enterprise wireless security.

Answer

Enabling MAC address filtering

Answer

Using WEP encryption

Answer

Leaving the default administrator password

Question 10

An organization wants to implement an access control model where data owners decide who can access resources. Which model should they choose?

Accepted Answer

Discretionary Access Control (DAC). Discretionary Access Control (DAC) is the correct model because it allows data owners (the users who create or own the resource) to decide who can access their resources. In DAC, the owner sets permissions (e.g., read, write, execute) on objects like files or directories, typically using Access Control Lists (ACLs). This directly matches the requirement where data owners control access decisions.

Answer

Attribute-Based Access Control (ABAC)

Answer

Mandatory Access Control (MAC)

Answer

Role-Based Access Control (RBAC)