SSCP Timed Practice Test 4 — 10 Questions

Question 1

Which TWO of the following are common weaknesses in cryptographic implementations that an SSCP should be aware of? (Select exactly 2.)

Accepted Answer

Weak random number generation. Weak random number generation is a critical flaw because cryptographic keys, nonces, and initialization vectors rely on unpredictability. If an attacker can predict or reproduce the random values (e.g., due to a low-entropy source or a flawed PRNG like a linear congruential generator), they can derive secret keys or break session security. This undermines the entire cryptographic system regardless of the algorithm strength.

Answer

Frequent rekeying

Answer

Using proven encryption algorithms like AES

Answer

Following NIST guidelines

Question 2

Refer to the exhibit. A network administrator implements this ACL on a border router. What is the effect?

Accepted Answer

SSH to 192.168.1.100 is permitted from any source. Option A is correct because the ACL explicitly permits TCP traffic sourced from any IP address destined to 192.168.1.100 on port 22, which is the default port for SSH. Since the ACL is applied inbound on the border router's external interface, it allows SSH connections from any external source to reach the internal host 192.168.1.100, while implicitly denying all other traffic.

Answer

SSH is completely blocked

Answer

All traffic to 192.168.1.100 is permitted

Answer

Only SSH from external networks is blocked

Question 3

During a penetration test, an attacker was able to bypass input validation and execute commands on a web server. The server runs a PHP application. Which of the following is the MOST likely root cause?

Accepted Answer

The application passes user input to a shell command via exec() or system() functions.. Option C is correct because the scenario describes command execution on the web server, which is a direct consequence of OS command injection. In PHP, passing unsanitized user input to functions like exec() or system() allows an attacker to execute arbitrary shell commands, bypassing input validation. This is the most likely root cause as it directly enables command execution, unlike other vulnerabilities that lead to different impacts.

Answer

The application uses unsanitized input in SQL queries.

Answer

The application reflects user input in HTTP responses without escaping.

Answer

The application uses hidden form fields to store session tokens.

Question 4

A system administrator needs to ensure that a Linux server is hardened against common attacks. Which configuration change is MOST effective in preventing privilege escalation via SUID binaries?

Accepted Answer

Mount the /tmp and /var partitions with the 'nosuid' option.. Mounting partitions like /tmp and /var with the 'nosuid' option prevents SUID and SGID bits from taking effect on files stored there. Since attackers often place malicious SUID binaries in world-writable directories to escalate privileges, this configuration blocks the execution of such binaries regardless of their permissions. This is more effective than logging or removing all SUID binaries, as it proactively neutralizes a common attack vector without breaking system functionality.

Answer

Enable auditd to log all SUID executions.

Answer

Set the umask to 077 for all users.

Answer

Remove all SUID binaries from the system.

Question 5

Based on the exhibit, which security threat is likely being attempted?

Accepted Answer

Brute-force attack. The exhibit shows a large number of failed login attempts (e.g., 'Login failed' or 'Authentication error') from a single source IP within a short time window, which is the classic signature of a brute-force attack. This attack systematically tries multiple username/password combinations to gain unauthorized access, and the repeated failure messages in the logs confirm the attempt.

Answer

DNS poisoning

Answer

Man-in-the-middle attack

Answer

SQL injection

Question 6

During an incident, the IR team needs to collect volatile data. Which order should they follow?

Accepted Answer

Memory, running processes, network connections, hard disk. Option D is correct because volatile data must be collected in order of decreasing volatility to minimize data loss. Memory (RAM) is the most volatile, followed by running processes, network connections, and finally the hard disk, which is non-volatile. This order ensures that transient evidence (e.g., encryption keys, active network sessions) is captured before it disappears.

Answer

Hard disk, memory, network connections, running processes

Answer

Network connections, running processes, memory, hard disk

Answer

Running processes, memory, network connections, hard disk

Question 7

Refer to the exhibit. The security analyst sees this event from a user workstation. What is the most likely conclusion?

Accepted Answer

A user is trying to escalate privileges. The event shows a user account (likely a standard user) attempting to add itself to a privileged group such as the local Administrators group. This action requires administrative rights, and the attempt by a non-admin user to modify group membership is a classic privilege escalation technique. The security analyst should recognize this as an unauthorized attempt to gain higher access, not a normal administrative action.

Answer

A malware is spreading

Answer

A legitimate administrator added a user

Answer

A failed login attempt

Question 8

An analyst notices unusual outbound traffic from a workstation to an external IP on port 445. Which protocol is likely being used?

Accepted Answer

SMB. Port 445 is the default port for Microsoft-DS (Direct Hosting of SMB over TCP/IP), which is used by the Server Message Block (SMB) protocol for file and printer sharing. Unusual outbound traffic on this port often indicates SMB activity, such as a workstation attempting to connect to a remote share or, in a security context, potential data exfiltration or lateral movement using SMB.

Answer

HTTP

Answer

FTP

Answer

DNS

Question 9

Refer to the exhibit. The security group is attached to a database server. Which hosts can connect to the database?

Accepted Answer

Only hosts in the 10.0.0.0/8 range. The security group rule allows inbound traffic on the database port from the 10.0.0.0/8 range. Since the database server is in a private subnet with no public IP, only hosts within that RFC 1918 address space can reach it. Option D is correct because the rule explicitly permits only 10.0.0.0/8, which includes internal hosts in that range.

Answer

No hosts can connect to the database

Answer

Both internet hosts and internal hosts

Answer

Any host on the internet

Question 10

A company's log management solution is overwhelmed by high-volume logs from network devices, causing storage and analysis delays. Which strategy would best improve the efficiency of the log management process?

Accepted Answer

Implement log filtering and prioritization rules. Implementing log filtering and prioritization rules (Option C) directly addresses the root cause of the problem by reducing the volume of irrelevant or low-priority logs before they are stored or analyzed. This improves both storage efficiency and analysis speed, as the log management system processes only meaningful events, such as those matching security or performance thresholds, rather than being overwhelmed by high-frequency noise like repeated informational syslog messages.

Answer

Increase the storage capacity of the log server

Answer

Increase the frequency of log analysis cycles

Answer

Reduce the number of devices sending logs