Courseiva

Systems Security Certified Practitioner SSCP (SSCP) — Questions 1–75

920 questions total · 13pages · All types, answers revealed

Take a mock examExam hub

Page 1 of 13

Page 2
1
MCQeasy

An organization wants to prevent unauthorized devices from connecting to its wired network. Which security control should be implemented?

A.Port security with sticky MAC
B.MAC address filtering
C.VLAN segmentation
D.IEEE 802.1X port-based authentication
AnswerD

802.1X authenticates devices at the port level before allowing network access.

Why this answer

IEEE 802.1X port-based authentication is the correct control because it authenticates each device at the network edge before granting access to the wired LAN. It uses an authentication server (e.g., RADIUS) to verify credentials or certificates, effectively preventing unauthorized devices from connecting. Unlike MAC-based controls, 802.1X provides dynamic, per-session authentication that cannot be easily spoofed.

Exam trap

ISC2 often tests the misconception that MAC-based controls (port security or MAC filtering) provide strong authentication, when in fact they are easily bypassed by MAC spoofing, whereas 802.1X uses cryptographic credentials or certificates for true device authentication.

How to eliminate wrong answers

Option A is wrong because port security with sticky MAC only learns and limits MAC addresses on a switch port, but it does not authenticate the device; an attacker can spoof a learned MAC address to bypass the control. Option B is wrong because MAC address filtering is a static, easily spoofed control that only checks the source MAC at Layer 2, offering no authentication or encryption. Option C is wrong because VLAN segmentation separates traffic logically but does not prevent unauthorized devices from physically connecting to the network; it only limits their broadcast domain.

Full explanation →
2
MCQhard

An organization has implemented a SIEM solution and wants to reduce false positives. Which of the following is the most effective approach?

A.Tune correlation rules to exclude known benign activities
B.Increase the number of log sources feeding the SIEM
C.Raise the threshold for each correlation rule to reduce alerts
D.Assign more analysts to manually review all alerts
AnswerA

Tuning allows the SIEM to ignore patterns that are known to be non-malicious.

Why this answer

The most effective because tuning correlation rules to exclude known benign activities directly reduces false positives by filtering out events that are known to be non-threatening. Option B is not effective because adding more log sources can increase the volume of data and potentially introduce more noise, exacerbating the false positive problem. Option C (raising thresholds) may reduce alerts but can also cause true threats to be missed, and it does not target known false positive patterns.

Option D is inefficient and does not reduce false positives; it only addresses the symptoms by requiring more manual review.

Full explanation →
3
MCQhard

During a forensic investigation, you find that the attacker used a legitimate Windows tool to exfiltrate data. Which tool is commonly abused for this purpose?

A.Telnet
B.Netcat
C.PowerShell
D.FTP
AnswerC

PowerShell is native to Windows and frequently used for file exfiltration due to its flexibility.

Why this answer

PowerShell is a legitimate Windows administrative tool that attackers commonly abuse for data exfiltration because it provides native access to network protocols (e.g., HTTP, HTTPS, FTP, SMB) and can download/upload files directly from the command line without additional binaries. Its deep integration with the Windows operating system allows scripts to run in memory, bypassing traditional file-based detection mechanisms, making it a favored tool for post-exploitation data theft.

Exam trap

The trap here is that candidates often associate Netcat (a classic hacking tool) with data exfiltration, but the question specifically requires a 'legitimate Windows tool,' and PowerShell is the correct answer because it is built-in and widely abused, whereas Netcat is not native to Windows.

How to eliminate wrong answers

Option A is wrong because Telnet is an unencrypted remote terminal protocol (RFC 854) that lacks native file transfer capabilities; while it can be used to send data manually, it is not commonly abused for automated or stealthy exfiltration due to its lack of encryption and limited scripting support. Option B is wrong because Netcat is a third-party network utility (not a legitimate Windows built-in tool) that can be used for data exfiltration, but the question specifies a 'legitimate Windows tool,' and Netcat is not included by default in Windows. Option D is wrong because FTP is a file transfer protocol that can be used for exfiltration, but the built-in Windows FTP client (ftp.exe) is deprecated and less commonly abused compared to PowerShell, which offers more flexibility and is present on all modern Windows systems.

Full explanation →
4
MCQmedium

An incident responder needs to create a forensic image of a suspect hard drive. What is the correct procedure to ensure evidence integrity?

A.Use a write blocker, create a bit-for-bit image, and compute SHA-256 hash before and after imaging.
B.Boot the suspect system and use imaging software to copy data.
C.Remove the drive and place it in anti-static bag, then ship to lab.
D.Connect the drive directly to forensic workstation, copy all files, and compute MD5 hash of copy.
AnswerA

Correct. Write blocker prevents writes, and hash verification ensures integrity.

Why this answer

Forensic imaging requires a write blocker to prevent any modification to the original evidence, a bit-for-bit (sector-level) copy to capture all data including slack space and deleted files, and cryptographic hashing (SHA-256) both before and after imaging to verify that the image is an exact, unaltered duplicate of the source. This process ensures the integrity and admissibility of digital evidence in legal proceedings.

Exam trap

The trap here is that candidates may think booting the system or simply copying files is sufficient, but the SSCP exam emphasizes that any write activity to the original evidence breaks the chain of custody and invalidates the forensic integrity.

How to eliminate wrong answers

Option B is wrong because booting the suspect system alters the system state (e.g., writes temporary files, updates logs, changes timestamps), which modifies evidence and violates forensic best practices. Option C is wrong because simply placing the drive in an anti-static bag and shipping it does not create a forensic image; imaging must be performed to preserve the data, and the procedure omits write-blocking and hashing. Option D is wrong because connecting the drive directly without a write blocker risks accidental writes to the source, and copying files (rather than creating a bit-for-bit image) loses metadata, slack space, and deleted data; MD5 is also less collision-resistant than SHA-256 for modern forensic standards.

Full explanation →
5
Multi-Selectmedium

A security team is implementing a PKI for a large enterprise. Which TWO of the following are commonly used methods for certificate revocation checking? (Select TWO.)

Select 2 answers
A.Certificate Signing Request (CSR)
B.Online Certificate Status Protocol (OCSP)
C.Certificate Revocation List (CRL)
D.Key Escrow
E.Digital Signature Algorithm (DSA)
AnswersB, C

OCSP provides real-time status.

Why this answer

CRL (Certificate Revocation List) and OCSP (Online Certificate Status Protocol) are the two primary methods.

Full explanation →
6
MCQmedium

A security administrator discovers that a web application is vulnerable to SQL injection. Which of the following is the most effective mitigation to implement at the application layer?

A.Implement input validation using a blacklist of SQL keywords.
B.Encrypt the database connection using TLS.
C.Use parameterized queries or prepared statements.
D.Encode all output sent to the browser.
E.Deploy a web application firewall (WAF) in front of the server.
AnswerC

Parameterized queries separate SQL logic from data, preventing injection.

Why this answer

(parameterized queries or prepared statements) is the most effective mitigation at the application layer because it ensures user input is treated as data, not executable SQL code, thus preventing SQL injection. Option A (input validation via blacklist) can be bypassed by attackers using encoding or alternative characters. Option B (encrypting the database connection with TLS) protects data in transit but does not prevent SQL injection.

Option D (output encoding) addresses cross-site scripting (XSS), not SQL injection. Option E (deploying a WAF) operates at the network layer and can be circumvented; it is not an application-layer control.

Full explanation →
7
MCQeasy

Which protocol is used to automatically assign IP addresses to devices on a network?

A.ARP
B.DNS
C.ICMP
D.DHCP
AnswerD

DHCP dynamically assigns IP addresses.

Why this answer

DHCP (Dynamic Host Configuration Protocol) is the correct answer because it is specifically designed to automatically assign IP addresses and other network configuration parameters (such as subnet mask, default gateway, and DNS servers) to devices on a network. This eliminates the need for manual IP configuration and reduces the risk of address conflicts.

Exam trap

The trap here is that candidates often confuse ARP's role in network communication (mapping IP to MAC) with IP address assignment, but ARP has no mechanism for leasing or configuring IP addresses.

How to eliminate wrong answers

Option A (ARP) is wrong because ARP (Address Resolution Protocol) is used to map a known IP address to a MAC address on a local network, not to assign IP addresses. Option B (DNS) is wrong because DNS (Domain Name System) translates domain names to IP addresses, not assign them. Option C (ICMP) is wrong because ICMP (Internet Control Message Protocol) is used for error reporting and diagnostic functions (e.g., ping), not for IP address assignment.

Full explanation →
8
Matchingmedium

Match each incident response phase to its activity.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Train staff and establish policies

Identify potential incidents

Isolate affected systems

Restore normal operations

Why these pairings

The incident response phases include Preparation, Detection & Analysis, Containment, Eradication & Recovery, and Post-Incident Activity. Common confusions are mixing preparation with containment and detection with recovery.

Full explanation →
9
MCQmedium

A cloud security team wants to continuously monitor for misconfigured cloud resources that could expose data. Which tool category is specifically designed for this purpose?

A.Cloud Workload Protection Platform (CWPP)
B.Identity and Access Management (IAM)
C.Cloud Security Posture Management (CSPM)
D.Web Application Firewall (WAF)
AnswerC

CSPM automatically identifies cloud misconfigurations.

Why this answer

CSPM (Cloud Security Posture Management) tools detect misconfigurations like open storage buckets or overly permissive IAM roles. CWPP focuses on runtime workload protection. WAF protects web apps.

IAM manages identities, not configuration monitoring.

Full explanation →
10
MCQeasy

In which access control model does the owner of a resource have full discretion over who can access it and with what permissions?

A.Attribute-Based Access Control (ABAC)
B.Discretionary Access Control (DAC)
C.Role-Based Access Control (RBAC)
D.Mandatory Access Control (MAC)
AnswerB

DAC allows data owners to grant or deny access based on their discretion, making it the correct model.

Why this answer

Discretionary Access Control (DAC) is the model where the resource owner has full authority to grant or deny access to other subjects and to set the permissions (e.g., read, write, execute) on the object. This is typically implemented through Access Control Lists (ACLs) on files or objects, as seen in Windows NTFS or Linux file permissions, where the owner can change permissions using commands like `chmod` or through GUI properties.

Exam trap

The trap here is that candidates often confuse DAC with RBAC because both involve user-based permissions, but the key distinction is that DAC gives the resource owner full discretion, whereas RBAC enforces access based on organizational roles, not individual owner decisions.

How to eliminate wrong answers

Option A (ABAC) is wrong because ABAC evaluates access based on attributes of the subject, object, and environment (e.g., time of day, location) using policy rules, not by owner discretion. Option C (RBAC) is wrong because RBAC assigns permissions based on predefined roles within an organization, and the owner does not have full discretion; access is determined by role membership, not individual owner decisions. Option D (MAC) is wrong because MAC enforces access decisions based on system-wide security labels (e.g., classification levels like Top Secret) and the owner cannot override these; labels are set by the system or security administrator, not the resource owner.

Full explanation →
11
Multi-Selecthard

A security analyst is reviewing network device logs and finds multiple failed SSH login attempts from a single external IP. Which three actions should the analyst take to mitigate this brute-force attack? (Choose three.)

Select 3 answers
A.Increase the SSH login timeout.
B.Disable password-based authentication for SSH.
C.Implement an ACL to block the offending IP.
D.Enable SSH public key authentication only.
E.Change the SSH port to a non-standard port.
AnswersB, C, D

Eliminates the credential guessing attack.

Why this answer

Disabling password-based authentication for SSH (Option B) eliminates the primary vector for brute-force attacks, as attackers cannot guess passwords. This forces the use of cryptographic key pairs, which are computationally infeasible to brute-force. Combined with an ACL to block the offending IP (Option C) and enabling only public key authentication (Option D), these three actions directly mitigate the ongoing and future brute-force attempts.

Exam trap

The trap here is that candidates often choose 'Change the SSH port to a non-standard port' (Option E) thinking it provides real security, but the SSCP exam expects you to recognize that security by obscurity is not a valid mitigation for an active brute-force attack.

Full explanation →
12
MCQeasy

A user reports that their computer is displaying a fake antivirus warning that demands payment. This is an example of which type of attack?

A.Social engineering
B.Ransomware
C.Phishing
D.Scareware
AnswerD

Scareware presents fake security warnings to coerce payment.

Why this answer

Scareware is a type of malware that uses social engineering to trick users into believing their system is infected, then demands payment for a fake removal tool. The fake antivirus warning is a classic scareware tactic, as it creates urgency and fear to coerce payment, unlike ransomware which encrypts files and demands a ransom for decryption.

Exam trap

The trap here is that candidates confuse scareware with ransomware because both demand payment, but scareware does not encrypt files or lock the system—it only displays a fake warning, which is a key distinction tested on the SSCP exam.

How to eliminate wrong answers

Option A is wrong because social engineering is a broad manipulation technique that can be used in many attacks, but the specific attack described (fake antivirus demanding payment) is a form of scareware, not a standalone social engineering attack. Option B is wrong because ransomware typically encrypts files or locks the system and demands payment for decryption or access, whereas scareware only displays a fake warning without actually encrypting data. Option C is wrong because phishing is a social engineering attack that uses deceptive emails or websites to steal credentials or sensitive information, not to display fake antivirus warnings demanding payment.

Full explanation →
13
MCQeasy

A security professional is implementing a solution to verify the authenticity of a digital certificate. Which component of a PKI is responsible for issuing and revoking certificates?

A.Online Certificate Status Protocol (OCSP) responder
B.Certificate Authority (CA)
C.Certificate Revocation List (CRL)
D.Registration Authority (RA)
AnswerB

The CA issues and revokes digital certificates.

Why this answer

The Certificate Authority (CA) is the core component of a Public Key Infrastructure (PKI) responsible for issuing digital certificates and, crucially, for revoking them when they are no longer trusted. While other components support certificate status checking or verification, only the CA has the authority to sign and publish certificates or revocation information.

Exam trap

The trap here is that candidates confuse the OCSP responder or CRL as the entity that performs revocation, when in fact they are merely mechanisms to check or distribute revocation status, while only the CA has the authority to issue or revoke a certificate.

How to eliminate wrong answers

Option A is wrong because an OCSP responder is a service that provides real-time certificate status (valid, revoked, or unknown) by querying the CA's database, but it does not issue or revoke certificates. Option C is wrong because a Certificate Revocation List (CRL) is a published list of revoked certificates maintained by the CA, but it is a data structure, not the entity that performs the revocation action. Option D is wrong because a Registration Authority (RA) is an optional component that verifies the identity of certificate requestors and forwards requests to the CA, but it does not have the authority to issue or revoke certificates itself.

Full explanation →
14
MCQhard

A large financial institution has deployed a new web application for customer account management. The application uses role-based access control (RBAC) with roles such as Customer, Teller, Manager, and Admin. Recently, an audit revealed that a Teller was able to view and modify account details belonging to customers outside their assigned branch. The application authenticates users via the corporate Active Directory and uses AD groups for role mapping. The Teller's AD group membership was verified to be correct. The security team suspects a flaw in the authorization logic. Which of the following is the MOST likely root cause?

A.The application's role-to-permission mapping is based on group SID rather than group name.
B.The application does not perform proper session management.
C.The application fails to validate the user's branch attribute after authentication.
D.The application uses a horizontal privilege escalation vulnerability.
AnswerC

The application likely uses the Teller role correctly but does not check the user's branch attribute to restrict access to only customers from the same branch, allowing cross-branch access.

Why this answer

The Teller's AD group membership was verified correct, so the role mapping (RBAC) is functioning. However, the Teller could access accounts outside their assigned branch, indicating the application lacks a post-authentication check of the user's branch attribute. This is a classic failure of attribute-based access control (ABAC) within an RBAC framework, where the application must validate the user's branch (e.g., from an AD attribute like 'physicalDeliveryOfficeName' or a custom attribute) against the account's branch before allowing read/write operations.

Exam trap

The trap here is that candidates confuse the symptom (horizontal privilege escalation) with the root cause (missing attribute validation), or they incorrectly assume that correct AD group membership guarantees proper authorization without considering contextual attributes like branch.

How to eliminate wrong answers

Option A is wrong because group SID and group name are both unique identifiers; using either would not cause a branch-level authorization failure if the group membership is correct. Option B is wrong because session management issues (e.g., session fixation, hijacking) would allow unauthorized access across users, not specifically to accounts in other branches while maintaining the correct role. Option D is wrong because horizontal privilege escalation refers to accessing another user's data at the same privilege level, which is exactly what happened, but it is a symptom, not the root cause; the root cause is the missing branch validation.

Full explanation →
15
MCQhard

During a penetration test, an attacker was able to bypass input validation and execute commands on a web server. The server runs a PHP application. Which of the following is the MOST likely root cause?

A.The application uses unsanitized input in SQL queries.
B.The application reflects user input in HTTP responses without escaping.
C.The application passes user input to a shell command via exec() or system() functions.
D.The application uses hidden form fields to store session tokens.
AnswerC

Command injection allows arbitrary command execution on the server.

Why this answer

The scenario describes command execution on the web server, which is a direct consequence of OS command injection. In PHP, passing unsanitized user input to functions like exec() or system() allows an attacker to execute arbitrary shell commands, bypassing input validation. This is the most likely root cause as it directly enables command execution, unlike other vulnerabilities that lead to different impacts.

Exam trap

The trap here is that candidates may confuse command injection with SQL injection or XSS, but the key differentiator is the ability to execute OS-level commands on the server, which only occurs through shell execution functions like exec() or system().

How to eliminate wrong answers

Option A is wrong because unsanitized input in SQL queries causes SQL injection, which manipulates the database, not executes OS commands on the server. Option B is wrong because reflecting user input in HTTP responses without escaping leads to cross-site scripting (XSS), which executes in the browser, not on the server. Option D is wrong because hidden form fields storing session tokens is a session management weakness, not a mechanism for command execution.

Full explanation →
16
MCQhard

A security engineer is configuring a site-to-site VPN between two branch offices using IPsec in tunnel mode. Which protocol provides both authentication and encryption of the entire original IP packet?

A.IKEv2 in transport mode
B.ESP (Encapsulating Security Payload) in tunnel mode
C.L2TP in tunnel mode
D.AH (Authentication Header) in tunnel mode
AnswerB

ESP provides both encryption and authentication, encapsulating the entire original packet.

Why this answer

ESP in tunnel mode encrypts and authenticates the entire original IP packet, while AH only authenticates.

Full explanation →
17
MCQhard

An organization uses smart cards with PKI certificates for authentication. Users must insert the card and enter a PIN. This is an example of which authentication method?

A.Three-factor authentication
B.Single-factor authentication
C.Two-factor authentication
D.Biometric authentication
AnswerC

Card (possession) and PIN (knowledge) are two factors.

Why this answer

Something you have (smart card) and something you know (PIN) constitute multi-factor authentication (MFA).

Full explanation →
18
MCQeasy

A vulnerability scanner identifies a high-severity vulnerability in a web server that is exposed to the internet. According to common remediation SLAs, what is the typical timeframe to remediate a critical vulnerability?

A.90 days
B.24-72 hours
C.7 days
D.30 days
AnswerB

Correct: Critical vulnerabilities typically have a 24-72 hour SLA.

Why this answer

Critical vulnerabilities in internet-exposed systems typically require remediation within 24–72 hours under common SLAs (e.g., PCI DSS, NIST, or organizational security policies). This timeframe reflects the high risk of remote exploitation, where an attacker can compromise the server before a longer window expires.

Exam trap

The exam often tests the distinction between critical (24–72 hours), high (7 days), and medium (30 days) SLAs, and the trap here is that candidates confuse 'high' with 'critical' and select 7 days instead of the shorter window.

How to eliminate wrong answers

Option A is wrong because 90 days is far too long for a critical vulnerability on an internet-facing web server; such a window is more typical for low-severity or non-exploitable issues. Option C is wrong because 7 days is a common SLA for high-severity vulnerabilities, not critical ones, which demand faster action due to immediate exploitation risk. Option D is wrong because 30 days is a typical remediation timeframe for medium-severity vulnerabilities, not critical ones, and would leave the server exposed to active attacks.

Full explanation →
19
Multi-Selecthard

A security analyst is reviewing a TLS 1.3 deployment. Which THREE of the following are features of TLS 1.3?

Select 3 answers
A.Use of static RSA key exchange
B.Mandatory forward secrecy
C.Support for 0-RTT handshake
D.Removal of cipher suites like RC4 and DES
E.Support for SSL 3.0 compatibility
AnswersB, C, D

TLS 1.3 requires forward secrecy.

Why this answer

TLS 1.3 removed vulnerable cipher suites, mandates forward secrecy, and supports 0-RTT for faster handshakes.

Full explanation →
20
MCQmedium

A network administrator notices that wireless users are experiencing intermittent connectivity. The controller shows excessive deauthentication frames. What is the most likely cause?

A.Rogue access point performing a deauthentication attack
B.Channel interference
C.Power save mode
D.DHCP server exhaustion
E.Weak encryption
AnswerA

Rogue APs send deauth frames to disconnect clients.

Why this answer

Excessive deauthentication frames are a hallmark of a deauthentication attack, where a rogue access point sends forged 802.11 management frames to disconnect clients. This causes intermittent connectivity as clients repeatedly lose association and attempt to reconnect. The controller logs these frames as a clear indicator of an active attack.

Exam trap

ISC2 often tests the distinction between deauthentication attacks and other wireless issues like channel interference or DHCP exhaustion, trapping candidates who confuse symptoms of a DoS attack with normal network problems.

How to eliminate wrong answers

Option B is wrong because channel interference typically causes packet loss, retransmissions, and low signal quality, not a flood of deauthentication frames. Option C is wrong because power save mode reduces client power consumption by periodically sleeping, which may cause brief latency but does not generate deauthentication frames. Option D is wrong because DHCP server exhaustion prevents clients from obtaining IP addresses, leading to connectivity failure but not excessive deauthentication frames.

Option E is wrong because weak encryption (e.g., WEP or TKIP) makes the network vulnerable to decryption attacks but does not directly cause a flood of deauthentication frames; deauthentication attacks exploit unprotected management frames regardless of encryption strength.

Full explanation →
21
MCQmedium

An analyst runs the netstat command on a web server. Based on the output, which connection is the MOST suspicious?

A.The connection from 203.0.113.5:8080
B.The connection from 192.168.1.10:54321
C.The connection from 10.0.2.50:44350
D.The listening on 0.0.0.0:80
AnswerA

Correct. The external IP from the documentation range connecting on port 8080 is unusual and potentially malicious, suggesting proxy or tunneling activity.

Why this answer

203.0.113.5 is from the documentation IP range (RFC 5737), which should not appear in real network traffic. This indicates potential spoofing or malicious activity. Options B and C are internal private IPs, which are expected.

Option D is the normal HTTP listening service.

Full explanation →
22
Multi-Selecthard

Which THREE types of evidence are MOST important to collect from a compromised Linux server during forensic acquisition?

Select 3 answers
A.List of running processes
B.Full disk image
C.Network packet captures
D.Contents of RAM (memory dump)
E.System log files
AnswersA, D, E

Processes show malicious activity.

Why this answer

A is correct because capturing a list of running processes from a compromised Linux server preserves volatile evidence of active malicious processes, such as reverse shells or cryptominers, that would be lost on shutdown. This aligns with the order of volatility (RFC 3227), which prioritizes capturing volatile data like process lists before acquiring less volatile evidence like disk images.

Exam trap

The trap here is that candidates often prioritize a full disk image (Option B) as the most critical evidence, overlooking that volatile data (processes, memory, logs) must be collected first to preserve evidence that disappears on shutdown, as per the order of volatility.

Full explanation →
23
MCQeasy

A small company with 50 employees uses a local file server for sharing documents. Each employee has a username and password for authentication. The company wants to implement an additional layer of security to protect sensitive data without incurring high costs. They are considering using smart cards or biometric scanners. However, the budget is limited, and employees often work remotely. Which of the following is the most cost-effective and practical approach to strengthen authentication?

A.Implement a one-time password (OTP) system via a mobile app.
B.Increase password complexity requirements and enforce periodic changes.
C.Issue USB tokens to all employees.
D.Use Windows Hello facial recognition on company laptops.
AnswerA

OTP via mobile app is a low-cost, easy-to-deploy second factor that works with employees' own smartphones, regardless of location.

Why this answer

One-time password (OTP) via a mobile app is low-cost, does not require additional hardware, and works well for remote employees by providing a second factor without relying on location-specific devices. Smart cards or USB tokens require hardware purchase and distribution. Biometrics like Windows Hello require compatible hardware and may not be available on all remote devices.

Increasing password complexity is not multi-factor authentication and does not add a second factor.

Full explanation →
24
Multi-Selecteasy

Which THREE of the following are common types of malware?

Select 3 answers
A.Trojan horse
B.Virus
C.Worm
D.Firewall
E.Patch
AnswersA, B, C

A trojan disguises itself as legitimate software.

Why this answer

Options A, B, and C are correct. Trojan horse, virus, and worm are common types of malware. Option D (firewall) is a security device or software, not malware.

Option E (patch) is a security update, not malware.

Full explanation →
25
MCQhard

A BYOD policy allows personal devices to access corporate email. What is the best control to enforce device encryption and remote wipe?

A.Network Access Control (NAC)
B.Mobile Device Management (MDM) profile
C.Containerization app
D.Mandatory VPN connection
AnswerB

MDM can enforce encryption and remote wipe policies.

Why this answer

Mobile Device Management (MDM) can enforce encryption and remote wipe policies. VPN encrypts data in transit but not the device. Containerization isolates corporate data but may not enforce full device encryption.

NAC controls network access, not device settings.

Full explanation →
26
MCQmedium

Refer to the exhibit. An administrator implements this firewall rule. What is the intended effect?

A.It blocks all inbound and outbound traffic on port 445.
B.It prevents inbound SMB connections from other domain computers.
C.It prevents this computer from initiating SMB connections to other computers.
D.It applies to all network profiles (Domain, Private, Public).
AnswerC

Outbound block on port 445 stops this machine from connecting to others via SMB.

Why this answer

The firewall rule shown is an outbound rule that blocks TCP port 445, which is used by SMB (Server Message Block). By blocking outbound traffic on this port, the computer is prevented from initiating SMB connections to other computers, while still allowing inbound SMB connections. This is a common security measure to prevent a compromised machine from spreading malware or accessing file shares on other systems.

Exam trap

The trap here is that candidates often confuse outbound and inbound rules, assuming a rule blocking port 445 affects all traffic on that port, when in fact it only blocks traffic in one direction.

How to eliminate wrong answers

Option A is wrong because the rule only blocks outbound traffic on port 445, not inbound traffic; inbound SMB connections are still permitted. Option B is wrong because the rule does not affect inbound SMB connections; it only blocks outbound SMB traffic, so other domain computers can still initiate SMB connections to this computer. Option D is wrong because the rule is explicitly scoped to the Domain profile only, as indicated by the 'Domain' profile selection in the rule; it does not apply to Private or Public profiles.

Full explanation →
27
MCQhard

During a wireless penetration test, an attacker captures the four-way handshake of a WPA2-PSK network and attempts to crack the passphrase offline. Which attack is the attacker likely using?

A.WPS PIN attack
B.KRACK attack
C.Evil twin attack
D.PMKID attack
AnswerC

Evil twin is a rogue AP that tricks users into connecting.

Why this answer

In the given scenario, the attacker captures the four-way handshake of a WPA2-PSK network. The most likely method to capture such a handshake is an evil twin attack, where the attacker sets up a rogue access point impersonating a legitimate network. Once a client connects to the rogue AP, the attacker captures the handshake and can then attempt to crack the passphrase offline using dictionary or brute-force attacks.

Exam trap

Students often confuse the PMKID attack with the traditional handshake cracking attack. The PMKID attack does not require a full handshake capture; it uses the PMKID from beacon frames. The scenario describes capturing the full four-way handshake, which is typically done via an evil twin attack.

Full explanation →
28
MCQmedium

An attacker sends a forged ARP reply associating the attacker's MAC address with the IP address of the default gateway. What type of attack is this?

A.ARP spoofing
B.MAC flooding
C.DHCP starvation
D.DNS poisoning
AnswerA

This is the classic ARP spoofing attack, where the attacker sends fake ARP messages to intercept traffic.

Why this answer

ARP spoofing involves sending gratuitous ARP replies to associate the attacker's MAC with another IP address, enabling man-in-the-middle attacks at Layer 2.

Full explanation →
29
MCQmedium

Refer to the exhibit. A network engineer is configuring an IPsec VPN. Which protocol does this configuration apply to?

A.HTTPS
B.SSH
C.SSL/TLS
D.IKE (Internet Key Exchange)
AnswerD

ISAKMP is the framework for IKE, used in IPsec VPNs.

Why this answer

The configuration shown in the exhibit is for an IPsec VPN, which relies on IKE (Internet Key Exchange) to establish security associations and negotiate cryptographic keys. IKE (RFC 7296) is the mandatory key management protocol for IPsec, handling authentication and key exchange over UDP ports 500 and 4500. Without IKE, IPsec cannot dynamically negotiate the encryption and hashing parameters required for secure tunnel establishment.

Exam trap

The trap here is that candidates often confuse SSL/TLS with IPsec because both are used for VPNs, but SSL/TLS VPNs operate at the transport layer (e.g., OpenVPN) while IPsec VPNs require IKE for key exchange at the network layer.

How to eliminate wrong answers

Option A is wrong because HTTPS is an application-layer protocol (HTTP over TLS) used for secure web browsing, not for negotiating IPsec security associations. Option B is wrong because SSH is a protocol for secure remote login and command execution, operating at the application layer, and does not handle IPsec key management. Option C is wrong because SSL/TLS operates at the transport layer to secure TCP connections (e.g., HTTPS, FTPS) and is not used for IPsec VPN key exchange; IPsec uses IKE for this purpose.

Full explanation →
30
MCQeasy

Which TCP port is commonly used for secure web traffic (HTTPS) and is often allowed through firewalls for web browsing?

A.22
B.443
C.80
D.3389
AnswerB

Port 443 is the standard port for HTTPS.

Why this answer

HTTPS operates over TCP port 443, which is commonly open for secure web traffic.

Full explanation →
31
MCQeasy

A company is implementing application whitelisting on all endpoints. Which of the following is a primary consideration for maintaining operational efficiency?

A.Ensuring that all users have local administrator rights
B.Deploying a host-based firewall on each endpoint
C.Establishing a process to add approved applications to the whitelist
D.Disabling Windows Defender Antivirus to reduce resource usage
AnswerC

A change management process ensures new applications can be whitelisted without delay.

Why this answer

Application whitelisting requires a process for updating the whitelist when new legitimate software is needed; otherwise, users may be blocked from necessary applications.

Full explanation →
32
MCQeasy

A medium-sized company recently experienced a phishing attack where an employee downloaded a malicious attachment, leading to a data breach. The incident response team has identified the affected user and the malware. However, the team is unsure whether the attacker has established persistence. The security analyst must recommend the next step. The company has a standard incident response plan that includes detection, containment, eradication, recovery, and lessons learned. The malware sample has been isolated for analysis. The user's account has been disabled temporarily. The network team has quarantined the user's workstation. The analyst needs to ensure the attacker cannot regain access after the initial cleanup. What should the analyst recommend next?

A.Check system logs for unauthorized registry modifications, scheduled tasks, or startup entries.
B.Perform a full malware analysis of the file to understand its capabilities.
C.Notify affected customers immediately as required by data breach notification laws.
D.Reimage the user's workstation from a known good backup.
AnswerA

Correct: This directly checks for common persistence mechanisms used by attackers.

Why this answer

The immediate priority after containment is to identify and remove any persistence mechanisms the attacker may have established. Checking system logs for unauthorized registry modifications (e.g., Run keys), scheduled tasks (e.g., schtasks), and startup entries (e.g., Startup folder or services) directly addresses the uncertainty about persistence. This step ensures the attacker cannot regain access after cleanup, aligning with the eradication phase of the incident response plan.

Exam trap

The trap here is that candidates may jump to reimaging (Option D) as a quick fix, but without first verifying and removing persistence, the attacker could have established footholds on other systems or in the backup itself, making reimaging ineffective.

How to eliminate wrong answers

Option B is wrong because performing a full malware analysis is a secondary step that can occur in parallel or after eradication; it does not directly address the immediate need to check for persistence mechanisms. Option C is wrong because notifying affected customers is part of the lessons learned or legal compliance phase, which occurs after containment, eradication, and recovery, not before ensuring the attacker cannot regain access. Option D is wrong because reimaging the workstation from a known good backup is a recovery step that assumes persistence has been checked and removed; if the backup itself is compromised or persistence exists elsewhere, reimaging alone may not prevent re-infection.

Full explanation →
33
MCQmedium

A company is implementing a Single Sign-On (SSO) solution that uses XML-based assertions to exchange authentication and authorization data between an identity provider and a service provider. Which protocol is being used?

A.Kerberos
B.SAML
C.OAuth 2.0
D.OpenID Connect
AnswerB

SAML uses XML assertions for federated identity.

Why this answer

SAML (Security Assertion Markup Language) is an XML-based standard for exchanging authentication and authorization data between an Identity Provider (IdP) and a Service Provider (SP).

Full explanation →
34
Multi-Selecteasy

Which TWO of the following are common indicators of a ransomware attack?

Select 2 answers
A.Files with .encrypted extension appearing in directories.
B.Unusual outbound network traffic to unknown IPs.
C.Decreased network latency.
D.A ransom note text file in each affected folder.
E.System log entries showing failed login attempts.
AnswersA, D

Ransomware often appends a custom extension to encrypted files.

Why this answer

Options A and D are correct. Encrypted files with a new extension and the presence of a ransom note are classic signs of ransomware. Option B is incorrect because unusual outbound traffic may indicate command-and-control communication but is not specific to ransomware.

Option C is incorrect because network latency typically increases during an attack, not decreases. Option E is incorrect because failed login attempts suggest brute-force, not ransomware.

Full explanation →
35
MCQmedium

An organization wants to ensure that only authorized devices can connect to the corporate wired network. Which technology should they implement to enforce this?

A.Network Access Control (NAC) with 802.1X
B.VLAN segmentation
C.MAC address filtering
D.Firewall rules
AnswerA

NAC with 802.1X authenticates and authorizes devices on the network.

Why this answer

Network Access Control (NAC) with 802.1X authenticates devices before granting network access, enforcing compliance and authorization.

Full explanation →
36
MCQeasy

An organization uses Infrastructure as a Service (IaaS) in the public cloud. Which of the following security responsibilities is the customer responsible for?

A.Network infrastructure security
B.Hypervisor security and patching
C.Operating system security and patch management
D.Physical security of the data center
AnswerC

In IaaS, the customer manages the OS, including patching and hardening.

Why this answer

In the IaaS shared responsibility model, the cloud provider manages the physical infrastructure, while the customer is responsible for securing the operating system, applications, and data.

Full explanation →
37
MCQhard

A medium-sized company with 200 employees has a single office with a flat network topology. Recently, the IT team noticed that network performance has degraded significantly during peak hours. A network analysis reveals excessive broadcast traffic and a high number of ARP requests. Additionally, the security team is concerned about the lack of segmentation, as a workstation infected with malware was able to spread rapidly to other systems. The company uses a single /24 subnet (192.168.1.0/24) and all devices are connected to a layer 2 switch. The IT manager wants to improve both performance and security without purchasing new hardware. The existing switch is a managed layer 2 switch that supports VLANs, but the router is a basic home-grade device that does not support VLAN routing. The company's internet connection is provided by a cable modem. What is the BEST course of action to address both performance and security concerns?

A.Divide the network into multiple subnets and connect each to a separate port on the cable modem.
B.Upgrade the router to a business-grade model that supports VLAN routing and keep the network flat.
C.Implement VLANs to separate departments and use a router-on-a-stick configuration with a capable router.
D.Replace the switch with a layer 3 switch to route between VLANs without a router.
AnswerC

VLANs reduce broadcast traffic and contain threats; router-on-a-stick enables inter-VLAN routing.

Why this answer

Implementing VLANs segments the flat network into smaller broadcast domains, reducing ARP and broadcast traffic, which improves performance. A router-on-a-stick configuration using a capable router that supports VLAN routing (802.1Q trunking) allows inter-VLAN communication without requiring a new switch, addressing both performance and security concerns without purchasing new hardware.

Exam trap

ISC2 often tests the misconception that a layer 3 switch is required for inter-VLAN routing, but in this scenario, a router-on-a-stick with a capable router is the correct solution given the constraint of no new hardware purchases.

How to eliminate wrong answers

Option A is wrong because cable modems typically provide only a single WAN IP and do not support multiple subnets or routing between them; connecting separate subnets to different ports on a cable modem would not work as the modem lacks routing capabilities. Option B is wrong because upgrading the router to a business-grade model that supports VLAN routing but keeping the network flat does not address the excessive broadcast traffic or lack of segmentation; VLANs must be implemented to create separate broadcast domains. Option D is wrong because replacing the switch with a layer 3 switch would require purchasing new hardware, which contradicts the requirement to not purchase new hardware; the existing managed layer 2 switch can support VLANs, and a router-on-a-stick with a capable router is the cost-effective solution.

Full explanation →
38
Multi-Selectmedium

A security analyst is reviewing SIEM alerts and wants to identify potential data exfiltration. Which TWO of the following indicators are most relevant?

Select 2 answers
A.Successful logins during business hours
B.Large outbound data transfers to an external IP
C.A user connecting to a known command-and-control server
D.Multiple failed login attempts
E.Elevated CPU usage on a database server
AnswersB, C

Directly indicates potential data exfiltration.

Why this answer

Large outbound data transfers to an external IP are a classic indicator of data exfiltration, where an attacker moves stolen data outside the network. SIEM tools can detect this by monitoring traffic volume anomalies, such as a sudden spike in outbound bytes to a single external destination, which deviates from baseline behavior. This directly aligns with the risk of unauthorized data leakage.

Exam trap

The trap here is that candidates confuse indicators of compromise (like failed logins or CPU spikes) with exfiltration-specific signs, failing to focus on outbound data movement as the core criterion.

Full explanation →
39
MCQhard

A security administrator is implementing change management for a critical financial system. Which of the following is the MOST important control to prevent unauthorized changes?

A.Implement a staging environment to test all changes
B.Enforce a formal approval process via a change advisory board
C.Notify all users before the change window
D.Require a documented backout plan for every change
AnswerB

A CAB provides review and approval, preventing unauthorized changes.

Why this answer

A formal approval process via a change advisory board (CAB) ensures that all changes are reviewed and authorized before implementation, which is the most important preventive control. Option A is wrong because a staging environment, while useful for testing, does not prevent unauthorized changes. Option C is wrong because notifying users is a communication step, not a preventive control.

Option D is wrong because a documented backout plan is important for recovery, but it does not prevent unauthorized changes.

Full explanation →
40
MCQmedium

A company is deploying a VPN using IPsec. They want to ensure that even if the private key of the server is compromised, past session keys cannot be derived. Which key exchange method should they use?

A.Pre-shared key (PSK)
B.RSA key exchange
C.Ephemeral Diffie-Hellman (DHE or ECDHE)
D.Diffie-Hellman with static keys
AnswerC

Ephemeral key exchange ensures that session keys are temporary and not linked to long-term keys.

Why this answer

Ephemeral Diffie-Hellman (DHE or ECDHE) provides perfect forward secrecy (PFS) because it generates a unique, temporary session key for each session using ephemeral key pairs. Even if the server's long-term private key is compromised, past session keys cannot be derived because they were created from ephemeral keys that are discarded after each session. This ensures that historical encrypted traffic remains secure.

Exam trap

The trap here is that candidates confuse authentication with key exchange, assuming that RSA or static DH provides PFS because they involve public-key cryptography, but only ephemeral DH ensures that session keys are not derived from long-term secrets.

How to eliminate wrong answers

Option A is wrong because pre-shared keys (PSK) are static and do not provide PFS; if the PSK is compromised, all past session keys can be derived. Option B is wrong because RSA key exchange uses the server's static private key to encrypt the session key, so compromising that private key allows decryption of all past session keys. Option D is wrong because Diffie-Hellman with static keys uses long-term Diffie-Hellman keys that do not change per session, so compromising the static private key enables recovery of all past session keys.

Full explanation →
41
MCQmedium

An organization's backup policy states: 'Maintain three copies of data on two different media types, with one copy stored offsite.' This is known as:

A.Incremental backup strategy
B.Grandfather-father-son rotation
C.3-2-1 rule
D.Disaster recovery plan
AnswerC

Correct. This matches the description.

Why this answer

The 3-2-1 rule is a foundational data backup strategy that mandates maintaining three total copies of data, stored on two different types of media (e.g., disk and tape), with one copy located offsite to protect against site-level disasters. This directly matches the policy described, making option C correct.

Exam trap

The trap here is that candidates confuse the 3-2-1 rule with backup rotation schemes like GFS or incremental strategies, because all involve 'backup' and 'copies,' but only the 3-2-1 rule explicitly defines the count, media diversity, and offsite requirement.

How to eliminate wrong answers

Option A is wrong because an incremental backup strategy refers to a backup method that only copies data changed since the last full or incremental backup, not a rule about the number of copies, media diversity, or offsite storage. Option B is wrong because the grandfather-father-son (GFS) rotation is a tape rotation scheme that manages backup retention cycles (daily, weekly, monthly), not a specification for three copies on two media types with one offsite. Option D is wrong because a disaster recovery plan (DRP) is a comprehensive document outlining procedures for recovering IT infrastructure after a disaster, not a specific backup copy and media rule.

Full explanation →
42
Multi-Selecteasy

Which TWO of the following are examples of physical security controls? (Select TWO)

Select 2 answers
A.Firewall
B.CCTV
C.Intrusion detection system (IDS)
D.Biometric reader
E.Encryption
AnswersB, D

CCTV cameras are physical security controls for surveillance.

Why this answer

CCTV (Closed-Circuit Television) is a physical security control because it involves cameras and recording equipment that monitor and deter physical access to facilities. It is a detective and deterrent control that operates in the physical domain, not the logical or network domain.

Exam trap

The trap here is that candidates confuse 'security control' with 'security technology' and fail to distinguish between physical (tangible) and logical (digital) controls, leading them to select IDS or firewall as physical controls.

Full explanation →
43
MCQmedium

An organization is migrating from 3DES to AES-256 for encrypting data at rest. Which mode of AES is recommended for authenticated encryption?

A.ECB
B.GCM
C.CBC
D.CTR
AnswerB

GCM combines CTR mode with authentication tags, providing both confidentiality and integrity.

Why this answer

GCM (Galois/Counter Mode) is the correct choice because it provides both confidentiality and authenticity in a single, efficient mode. For data at rest, authenticated encryption ensures that encrypted data cannot be tampered with undetected, which is critical for integrity. AES-256-GCM is widely recommended and standardized (NIST SP 800-38D) for this purpose.

Exam trap

ISC2 SSCP often tests the misconception that any mode providing confidentiality (like CBC or CTR) is sufficient for secure encryption, but the trap here is that authenticated encryption specifically requires a mode that also guarantees integrity, which only GCM (or CCM) provides among the listed options.

How to eliminate wrong answers

Option A is wrong because ECB (Electronic Codebook) mode encrypts each block independently, producing identical ciphertext for identical plaintext blocks, which leaks patterns and provides no authentication. Option C is wrong because CBC (Cipher Block Chaining) mode provides only confidentiality, not authentication; it requires a separate MAC (e.g., HMAC) to achieve authenticated encryption, and it is vulnerable to padding oracle attacks if not implemented carefully. Option D is wrong because CTR (Counter) mode provides only confidentiality and no integrity protection; it is a stream cipher mode that can be combined with a MAC but does not itself offer authenticated encryption.

Full explanation →
44
MCQeasy

A company is developing an incident response plan. Which of the following stakeholders should be included in the initial planning phase?

A.External legal counsel
B.Internal audit
C.Only IT staff
D.Business unit leaders
AnswerD

They provide critical insight into business processes and priorities.

Why this answer

Business unit leaders (Option D) are essential in the initial planning phase because they define the critical assets, operational priorities, and recovery time objectives (RTOs) that shape the incident response strategy. Without their input, the plan may fail to align with business continuity requirements, leading to ineffective resource allocation during an actual incident.

Exam trap

The trap here is that candidates often assume incident response is purely a technical function, leading them to choose 'Only IT staff' (Option C), but the SSCP exam emphasizes that effective planning requires input from business stakeholders to ensure the plan supports organizational resilience, not just technical recovery.

How to eliminate wrong answers

Option A is wrong because external legal counsel is typically consulted during the later stages of plan development or during an actual incident to address regulatory compliance and liability, not during the initial planning phase where internal stakeholders define scope and priorities. Option B is wrong because internal audit provides oversight and compliance validation after the plan is drafted, not during initial planning; their role is to test controls, not to define incident response strategy. Option C is wrong because limiting planning to only IT staff ignores the cross-functional impact of incidents—business units, legal, HR, and PR must be involved to ensure the plan addresses communication, data classification, and operational continuity beyond technical remediation.

Full explanation →
45
MCQmedium

A network administrator is tasked with segmenting the network to isolate a DMZ containing public-facing web servers from the internal corporate network. Which device should be placed between the DMZ and internal network, and what type of traffic should it allow?

A.Router; allow all traffic but use NAT.
B.IDS; monitor traffic but do not block.
C.Firewall; allow only specific traffic from internal to DMZ and block DMZ-initiated connections to internal.
D.Switch; allow all traffic between DMZ and internal network.
AnswerC

A firewall can enforce least privilege between segments.

Why this answer

A firewall should be used to control traffic; it should allow only necessary inbound and outbound traffic while blocking direct access from DMZ to internal network.

Full explanation →
46
Multi-Selecthard

Which THREE of the following are valid risk treatment options according to ISO 31000? (Select three.)

Select 3 answers
A.Risk retention
B.Risk elimination
C.Risk duplication
D.Risk reduction
E.Risk transfer
AnswersA, D, E

Formal acceptance of residual risk.

Why this answer

Risk retention (A) is a valid risk treatment option under ISO 31000 because it involves accepting the current level of risk, often when the cost of mitigation exceeds the potential impact or when the risk is within the organization's risk appetite. This is a deliberate decision to bear the risk, typically documented in a risk register and monitored for changes.

Exam trap

ISC2 often tests the distinction between ISO 31000's formal terminology and common business jargon, so candidates mistakenly select 'risk elimination' instead of 'risk avoidance' or confuse 'risk duplication' with 'risk transfer' or 'redundancy' as a control measure.

Full explanation →
47
MCQeasy

If the web server is compromised, which of the following is a likely immediate risk?

A.Direct compromise of the database server
B.Loss of web application data
C.Denial of service to the web server
D.Compromise of user credentials
AnswerA

The lack of internal firewall allows the attacker to pivot to the database.

Why this answer

When a web server is compromised, the immediate risk is direct compromise of the database server because the web server typically holds the database credentials (e.g., in a configuration file like wp-config.php or appsettings.json) and has a trusted network path to the database. An attacker can pivot from the web server to the database server using those credentials, often over port 3306 (MySQL) or 1433 (MSSQL), without needing to bypass additional authentication.

Exam trap

ISC2 often tests the concept that a compromised web server is a pivot point to the database, and the trap here is that candidates mistakenly think 'loss of web application data' or 'compromise of user credentials' is immediate, when in fact those require additional steps after the initial foothold.

How to eliminate wrong answers

Option B is wrong because loss of web application data is a consequence, not an immediate risk; the attacker must first access the database or file system to delete or corrupt data, which is a later step after compromise. Option C is wrong because denial of service to the web server is an attack vector, not a risk that follows from the web server already being compromised; once compromised, the attacker controls the server and can maintain availability for their own purposes. Option D is wrong because compromise of user credentials is a potential outcome, but it is not immediate; the attacker must first extract credentials from the web server's memory, logs, or database, which requires additional steps like dumping process memory or querying the database.

Full explanation →
48
MCQmedium

A security analyst detects unusual outbound traffic from a server that normally communicates only with internal systems. The firewall logs show connections to an external IP address on port 443/tcp. Which incident response step should the analyst perform FIRST?

A.Run a full antivirus scan on the server.
B.Isolate the server from the network.
C.Immediately shut down the server.
D.Disconnect the entire network segment.
AnswerB

Containment stops the threat from causing further damage.

Why this answer

The unusual outbound traffic to an external IP on port 443/tcp from a server that normally only communicates internally indicates a potential compromise, such as a command-and-control (C2) channel. The first priority in incident response is containment to prevent further data exfiltration or lateral movement, and isolating the server from the network achieves this without destroying volatile evidence. Shutting down the server or running an antivirus scan could destroy memory-resident malware or forensic artifacts, violating the order of volatility.

Exam trap

ISC2 often tests the misconception that immediate shutdown or antivirus scanning is the correct first step, but the trap here is that containment (isolation) must precede any destructive or investigative actions to preserve evidence and limit damage.

How to eliminate wrong answers

Option A is wrong because running a full antivirus scan on the server may alter volatile data (e.g., running processes, network connections) and could trigger the malware to wipe evidence or escalate its behavior, violating the principle of preserving forensic integrity. Option C is wrong because immediately shutting down the server destroys volatile evidence in memory (e.g., active C2 sessions, encryption keys) and may cause the malware to activate a kill switch, whereas isolation preserves the system state for analysis. Option D is wrong because disconnecting the entire network segment is overly disruptive and may impact critical business operations unnecessarily; the correct containment step is to isolate only the compromised server to minimize collateral damage.

Full explanation →
49
Multi-Selectmedium

A network administrator is troubleshooting a DNS poisoning attack. Which TWO countermeasures can help prevent such attacks? (Select two)

Select 2 answers
A.Implement DNSSEC to validate DNS responses
B.Configure firewall rules to block UDP port 53
C.Disable DNS recursion on authoritative servers
D.Use secure DNS resolvers that enforce DNSSEC validation
E.Enable DHCP snooping on switches
AnswersA, D

DNSSEC adds cryptographic signatures to DNS records.

Why this answer

DNSSEC validates DNS responses to prevent spoofing, and using secure DNS resolvers (like Quad9 or Cloudflare) can filter malicious domains. Disabling recursion is a best practice but not a direct countermeasure against poisoning. DHCP snooping is for DHCP attacks.

Firewalls don't prevent DNS poisoning.

Full explanation →
50
MCQmedium

An organization uses a central syslog server to collect logs from firewalls, servers, and network devices. Recently, the security team noticed that some critical events from the firewall are missing from the syslog server. The firewall configuration sends syslog messages using UDP to the syslog server. The syslog server administrator reports that the server is receiving a high volume of logs and occasionally drops packets due to buffer overflow. The team needs to ensure reliable delivery of all syslog messages without losing any. Which solution should the team implement?

A.Switch to TCP-based syslog with TLS.
B.Increase the UDP buffer size on the syslog server.
C.Implement log aggregation at each network segment.
D.Use a load balancer for syslog receivers.
AnswerA

TCP ensures all messages are received and acknowledged, eliminating drops.

Why this answer

Switching to TCP-based syslog with TLS provides a reliable, connection-oriented transport that guarantees delivery, and TLS adds encryption for security. Option B is incorrect because increasing the UDP buffer size may reduce packet drops due to buffer overflow but does not guarantee reliable delivery since UDP is connectionless and can still lose packets. Option C is incorrect because log aggregation at each network segment changes the architecture but does not solve the underlying transport reliability issue; it may still rely on UDP.

Option D is incorrect because a load balancer distributes incoming syslog messages across multiple receivers but does not prevent UPD packet loss if UDP is still used; it only helps with load distribution, not reliability.

Full explanation →
51
MCQhard

A company implements a password policy requiring a minimum length of 12 characters, including uppercase, lowercase, digits, and special characters. Passwords must be changed every 90 days, and the last 10 passwords cannot be reused. After a brute-force attack, several accounts were compromised despite the policy. Which additional control would most effectively mitigate such attacks?

A.Use a password blacklist
B.Increase minimum password length to 16 characters
C.Implement account lockout after 5 failed attempts
D.Require password change every 30 days
AnswerC

Lockout thwarts brute-force by blocking further attempts.

Why this answer

Account lockout after a number of failed attempts prevents brute-force attacks by limiting the number of guesses an attacker can make.

Full explanation →
52
Multi-Selecthard

During forensic analysis, which THREE pieces of evidence should be preserved in original form?

Select 3 answers
A.Network traffic capture
B.Screenshots of malware dialogs
C.System event logs exported to CSV
D.RAM dump
E.Hard drive image
AnswersA, D, E

PCAP files preserve network evidence.

Why this answer

Network traffic captures (e.g., PCAP files) are raw, bit-for-bit recordings of network packets. They preserve the original timing, headers, and payloads without any transformation, which is critical for accurate forensic reconstruction and chain of custody. Any conversion or export (like CSV) would strip metadata and alter the original evidence.

Exam trap

ISC2 often tests the distinction between original/volatile evidence and derivative/converted evidence, trapping candidates who think exported logs or screenshots are acceptable substitutes for the raw, unaltered source.

Full explanation →
53
MCQmedium

A company is developing a DR plan for a critical database. The maximum acceptable downtime is 2 hours, and the maximum data loss is 1 hour. What are the RTO and RPO?

A.RTO = 2 hours, RPO = 1 hour
B.RTO = 1 hour, RPO = 1 hour
C.RTO = 1 hour, RPO = 2 hours
D.RTO = 2 hours, RPO = 2 hours
AnswerA

Correct. RTO is recovery time, RPO is data loss tolerance.

Why this answer

The Recovery Time Objective (RTO) is the maximum acceptable downtime, which is 2 hours. The Recovery Point Objective (RPO) is the maximum acceptable data loss, which is 1 hour. Therefore, option A correctly identifies RTO = 2 hours and RPO = 1 hour.

Exam trap

The trap here is confusing RTO (time to recover) with RPO (data loss tolerance), leading candidates to swap the two values or assume they must be equal.

How to eliminate wrong answers

Option B is wrong because it swaps the RTO and RPO values, incorrectly setting RTO to 1 hour (the maximum data loss) and RPO to 1 hour (the maximum downtime). Option C is wrong because it inverts the definitions, setting RTO to 1 hour (data loss) and RPO to 2 hours (downtime). Option D is wrong because it sets both RTO and RPO to 2 hours, ignoring the specified 1-hour maximum data loss constraint.

Full explanation →
54
MCQmedium

During the detection and analysis phase, an analyst receives a user report of unusual system behavior. The analyst reviews logs and finds several failed login attempts followed by a successful login from an unusual IP address. What is the next step?

A.Immediately disconnect the user's workstation from the network.
B.Rebuild the user's workstation from a known-good image.
C.Classify the incident and determine if escalation is needed.
D.Ignore the event as it may be a false positive.
AnswerC

Correct. Classification and escalation are part of detection and analysis.

Why this answer

During the detection and analysis phase of incident response, the primary goal is to assess the validity and scope of a potential security event before taking action. The analyst has observed indicators of a possible brute-force attack (failed logins followed by a successful login from an unusual IP), which requires classification to determine if it meets the criteria for a security incident. Escalation may be needed to involve a higher-tier incident response team or to initiate formal containment procedures, as per NIST SP 800-61 guidelines.

Exam trap

The trap here is that candidates often confuse the detection and analysis phase with the containment phase in the SSCP incident response lifecycle, leading them to choose immediate disconnection (Option A) instead of first classifying the incident and determining the need for escalation.

How to eliminate wrong answers

Option A is wrong because immediately disconnecting the user's workstation from the network is a premature containment action that should only occur after the incident has been confirmed and classified; doing so could disrupt business operations and destroy volatile evidence (e.g., active network connections, memory contents). Option B is wrong because rebuilding the workstation from a known-good image is a recovery step that occurs after containment, eradication, and evidence preservation; skipping analysis could result in losing forensic data needed to identify the root cause and prevent recurrence. Option D is wrong because ignoring the event as a false positive is negligent; the combination of multiple failed logins followed by a successful login from an unusual IP address is a classic indicator of a successful password-guessing attack and warrants investigation, not dismissal.

Full explanation →
55
Matchingmedium

Match each security control to its type (administrative, technical, physical).

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Administrative

Technical

Physical

Technical

Why these pairings

Firewall, security policy, and biometric lock are correctly matched to technical, administrative, and physical controls respectively. Common confusions include misclassifying firewalls as physical controls or security policies as technical controls.

Full explanation →
56
Multi-Selecteasy

Which TWO of the following are key components of a data classification policy? (Select the two best answers.)

Select 2 answers
A.Encryption algorithm selection
B.Firewall rules
C.Classification labels
D.Data custodian responsibilities
E.Backup schedules
AnswersC, D

Labels define the sensitivity levels.

Full explanation →
57
MCQhard

An organization implements a hybrid encryption scheme to secure sensitive emails. The email body is encrypted with AES-256, and the AES key is encrypted with RSA-2048. What is the primary advantage of this approach?

A.Ensures forward secrecy
B.Simplifies key management by using a single key
C.Combines performance of symmetric with secure key distribution of asymmetric
D.Provides non-repudiation for the email
AnswerC

AES is fast for large data; RSA securely encrypts the key.

Why this answer

Hybrid encryption combines the speed of symmetric encryption (AES-256) for bulk data with the secure key distribution of asymmetric encryption (RSA-2048). The symmetric key encrypts the email body efficiently, while the asymmetric key encrypts only the symmetric key, solving the key distribution problem without sacrificing performance.

Exam trap

The trap here is that candidates confuse hybrid encryption with forward secrecy or non-repudiation, but hybrid encryption specifically addresses the performance vs. key distribution trade-off, not security properties like forward secrecy or authentication.

How to eliminate wrong answers

Option A is wrong because forward secrecy requires ephemeral key exchange (e.g., Diffie-Hellman) where compromise of a long-term key does not expose past sessions; RSA-2048 alone does not provide forward secrecy. Option B is wrong because hybrid encryption actually increases key management complexity by requiring both a symmetric key and an asymmetric key pair, not simplifying to a single key. Option D is wrong because non-repudiation is provided by digital signatures (e.g., using RSA or DSA), not by encryption; encrypting the AES key with RSA does not prove the sender's identity.

Full explanation →
58
MCQeasy

A security administrator needs to set file permissions on a shared folder so that only members of the 'Finance' group can read and write to it. All existing permissions should be removed. Which command should the administrator use?

A.cacls shared_folder /E /P Finance:RW
B.icacls shared_folder /grant Finance:(F) /inheritance:r
C.icacls shared_folder /grant Finance:(M) /inheritance:r
D.icacls shared_folder /grant Finance:(RW)
AnswerC

Modify includes read and write, and /inheritance:r removes inherited permissions.

Why this answer

'icacls shared_folder /grant Finance:(M) /inheritance:r' grants Modify (which includes read and write) and removes inheritance, effectively replacing all existing permissions. Option A is wrong because 'cacls' is deprecated and the syntax '/E /P' is incorrect for this requirement. Option B is wrong because Full Control (F) grants more than read and write.

Option D is wrong because (RW) is not a valid icacls permission mask; the correct mask for read/write is (M) for Modify.

Full explanation →
59
Multi-Selecteasy

A security operations team is developing an incident response plan. Which TWO steps are part of the 'containment, eradication, and recovery' phase? (Choose two.)

Select 2 answers
A.Conducting a lessons learned meeting
B.Restoring systems from known good backups
C.Identifying the root cause of the incident
D.Preserving forensic evidence
E.Isolating affected systems from the network
AnswersB, E

This is part of recovery after eradication.

Why this answer

Options B and E are correct. Isolating affected systems (E) is a containment action, and restoring systems from known good backups (B) is part of recovery. Option A (lessons learned) occurs after the incident.

Option C (root cause) is part of identification and analysis, not containment/eradication/recovery. Option D (preserving forensic evidence) is important but typically done during identification and analysis, not as part of containment/eradication/recovery.

Full explanation →
60
MCQhard

A multinational corporation is migrating its on-premises applications to a cloud provider. The identity management infrastructure must support single sign-on (SSO) across multiple cloud services and maintain on-premises Active Directory as the authoritative identity source. The security team is concerned about credential stuffing attacks and password spray attacks. They want to implement a risk-based access policy that requires additional verification when logins originate from unusual locations or devices. Additionally, they need to ensure that user accounts are provisioned and deprovisioned in the cloud in near real-time based on AD changes. Which of the following solutions BEST meets these requirements?

A.Deploy a VPN that requires smart card authentication for all cloud access.
B.Implement a SAML-based federation with AD FS and integrate with Azure AD Conditional Access policies.
C.Use OAuth 2.0 with client credentials grant for all applications.
D.Set up a separate cloud identity store and synchronize passwords using a directory sync tool.
AnswerB

AD FS federates on-premises AD with Azure AD, enabling SSO. Azure AD Conditional Access provides risk-based policies. Azure AD Connect synchronizes directory changes near real-time.

Why this answer

SAML-based federation with AD FS and Azure AD Conditional Access provides SSO, risk-based policies (Conditional Access uses real-time signals like location and device), and near-real-time provisioning via Azure AD Connect. VPN with smart cards does not provide SSO or risk-based policies. OAuth 2.0 with client credentials is not for user authentication.

A separate cloud identity store with password sync introduces delays and does not support risk-based access.

Full explanation →
61
MCQhard

An organization uses ABAC to control access to a document. Which attribute combination would be used to allow access only during business hours from a managed device?

A.User department and document creation date
B.User identity, time of day, and device compliance status
C.User role and document classification
D.Document owner and file size
AnswerB

These attributes (subject, environment, subject) can enforce the policy.

Why this answer

ABAC policies can combine subject (user), object (document), and environment (time, device management status) attributes to make access decisions.

Full explanation →
62
MCQeasy

Which type of IDS uses a database of known attack patterns to identify malicious activity?

A.Behavior-based IDS
B.Network-based IDS
C.Anomaly-based IDS
D.Signature-based IDS
AnswerD

Signature-based matches known attack signatures.

Why this answer

Signature-based IDS (D) is correct because it relies on a pre-defined database of known attack patterns, or signatures, to match against network traffic or system activity. When a packet or event matches a signature, the IDS generates an alert. This is the traditional method used by systems like Snort, which compares traffic against rule sets containing specific byte sequences or protocol anomalies.

Exam trap

The trap here is confusing the detection method (signature-based) with the deployment type (network-based), leading candidates to pick 'Network-based IDS' because they associate it with monitoring network traffic, even though the question specifically asks about the detection methodology using known attack patterns.

How to eliminate wrong answers

Option A is wrong because behavior-based IDS (also known as anomaly-based) establishes a baseline of normal activity and flags deviations, not known attack patterns. Option B is wrong because network-based IDS describes the deployment location (monitoring network traffic) rather than the detection methodology; a network-based IDS can be either signature-based or anomaly-based. Option C is wrong because anomaly-based IDS uses statistical models or machine learning to detect deviations from a baseline of normal behavior, not a database of known attack signatures.

Full explanation →
63
MCQhard

During a security assessment, a penetration tester discovers that a web application allows users to upload files without proper validation. The tester successfully uploads a PHP web shell. Which control would have MOST effectively prevented this exploitation?

A.Disable PHP execution in the upload directory.
B.Implement a WAF rule to block common webshell patterns.
C.Enable audit logging for file uploads.
D.Validate file extension and content type on the server side.
AnswerD

Proper validation blocks malicious files at upload.

Why this answer

Server-side validation of both file extension and content type (e.g., MIME type magic bytes) is the most effective control to prevent uploading executable files like a PHP web shell. Without this validation, an attacker can bypass client-side checks and upload a malicious script that the server will execute. Disabling PHP execution in the upload directory (Option A) is a compensating control but does not prevent the upload itself, and a WAF rule (Option B) can be evaded with obfuscation or encoding.

Exam trap

The trap here is that candidates often choose Option A (disabling PHP execution) because it seems like a direct fix, but the SSCP exam tests the principle that preventing the upload of malicious files (input validation) is more fundamental than mitigating execution after the fact.

How to eliminate wrong answers

Option A is wrong because disabling PHP execution in the upload directory only prevents the uploaded shell from running, but the file is still stored on the server and could be exploited via other means (e.g., include attacks or bypassing execution restrictions). Option B is wrong because a WAF rule that blocks common webshell patterns relies on signature-based detection, which can be evaded with obfuscation, encoding, or polymorphic code, and does not address the root cause of missing input validation. Option C is wrong because audit logging only records the upload event after it occurs; it does not prevent the exploitation and is a detective, not a preventive, control.

Full explanation →
64
MCQhard

In RSA, the public exponent e is often chosen as 65537. What is the primary reason for this choice?

A.It ensures that the private key d is small
B.It prevents side-channel attacks
C.It provides the highest security level
D.It offers a balance between security and performance due to low Hamming weight
AnswerD

Few 1 bits speed up modular exponentiation.

Why this answer

65537 (0x10001) has a low Hamming weight of only 2 bits set, which makes modular exponentiation significantly faster than using a random large exponent, while still providing strong security. This choice balances computational efficiency with cryptographic strength, as a larger exponent would slow down encryption without proportional security gains.

Exam trap

ISC2 often tests the misconception that a larger exponent always means higher security, when in fact the exponent's size has negligible impact on security compared to the modulus length, and the real benefit of 65537 is performance due to its low Hamming weight.

How to eliminate wrong answers

Option A is wrong because a small public exponent e does not ensure a small private key d; in fact, d is typically large and unpredictable due to the modular inverse calculation. Option B is wrong because 65537 does not inherently prevent side-channel attacks; those require specific countermeasures like blinding or constant-time algorithms. Option C is wrong because 65537 does not provide the highest security level; security in RSA depends on key size (e.g., 2048-bit modulus), not on the exponent value, and larger exponents do not increase security.

Full explanation →
65
Multi-Selectmedium

Which TWO of the following are examples of technical threat sources that should be considered during risk identification?

Select 2 answers
A.Earthquake
B.Hardware failure
C.Unauthorized access by employee
D.Software bug
E.Social engineering
AnswersB, D

Technical threat.

Why this answer

Hardware failure (B) is a technical threat source because it involves the physical degradation or malfunction of IT infrastructure components such as hard drives, power supplies, or network interfaces. During risk identification, hardware failures are considered technical threats as they can directly cause data loss, service disruption, or system unavailability, requiring specific controls like redundancy and monitoring.

Exam trap

The trap here is that candidates confuse threat categories, mistakenly classifying human-based threats like social engineering or insider actions as technical threat sources, when the SSCP exam strictly separates technical threats (hardware/software failures) from human and environmental threats.

Full explanation →
66
MCQmedium

A user reports that they cannot access a network share. The administrator checks the share permissions and NTFS permissions. The share permission allows Everyone: Read, and the NTFS permission allows the user: Full Control. What is the user's effective access?

A.Read
B.Full Control
C.No access
D.Modify
AnswerA

The effective permission is the most restrictive: share Read vs NTFS Full Control, so Read.

Why this answer

When accessing a network share, the effective permissions are the most restrictive of the share permissions and the NTFS permissions. Here, the share permission is Read and the NTFS permission is Full Control. The most restrictive permission is Read, so the user's effective access is Read.

Exam trap

The trap here is that candidates often assume the user gets the higher of the two permissions (Full Control) rather than the most restrictive, leading them to incorrectly select Full Control.

How to eliminate wrong answers

Option B is wrong because Full Control is not the effective access; the share permission restricts it to Read, as the effective permission is the most restrictive of the two sets. Option C is wrong because the user does have access—specifically Read access—since neither permission denies access outright. Option D is wrong because Modify is a higher permission than Read and is not granted; the share permission explicitly limits access to Read only.

Full explanation →
67
MCQmedium

During a quarterly risk review, a hospital's security team identifies that legacy medical devices cannot be patched and run outdated operating systems. Which risk treatment strategy is most appropriate for these devices?

A.Remediate by applying vendor patches
B.Implement compensating controls such as network segmentation and strict access control
C.Retire and replace all devices immediately
D.Transfer the risk by purchasing cyber insurance
AnswerB

Compensating controls mitigate the risk without changing the device itself.

Why this answer

Since the legacy medical devices cannot be patched due to vendor obsolescence, the most appropriate risk treatment strategy is to implement compensating controls. Network segmentation (e.g., VLANs or firewalls) isolates the devices from the main hospital network, while strict access control (e.g., 802.1X or MAC-based filtering) limits exposure to threats. This reduces the likelihood of exploitation without relying on patching the outdated operating systems.

Exam trap

ISC2 often tests the misconception that 'remediate' always means patching, but for legacy systems where patching is impossible, compensating controls are the correct risk treatment strategy, not immediate replacement or insurance.

How to eliminate wrong answers

Option A is wrong because applying vendor patches is not feasible for legacy devices that are no longer supported or have no available patches, making remediation impossible. Option C is wrong because retiring and replacing all devices immediately is often impractical due to cost, downtime, and regulatory approval processes, and is not the most appropriate first step in risk treatment. Option D is wrong because transferring risk via cyber insurance does not reduce the actual vulnerability or likelihood of exploitation; it only provides financial compensation after an incident, which is insufficient for protecting patient safety and data.

Full explanation →
68
MCQmedium

An organization's web application experienced a data breach due to a SQL injection vulnerability. During the risk analysis phase, the security team calculated the SLE as $25,000 and the ARO as 0.5. What is the ALE?

A.$50,000
B.$25,000
C.$6,250
D.$12,500
AnswerD

Correct: ALE = SLE × ARO = $25,000 × 0.5 = $12,500.

Why this answer

The Annualized Loss Expectancy (ALE) is calculated by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). Given an SLE of $25,000 and an ARO of 0.5, the ALE is $25,000 × 0.5 = $12,500. This quantifies the expected annual financial loss from the SQL injection vulnerability.

Exam trap

The trap here is that candidates often confuse multiplication with division or forget to apply the ARO, selecting the SLE value directly instead of computing the product.

How to eliminate wrong answers

Option A is wrong because $50,000 results from incorrectly dividing SLE by ARO (i.e., $25,000 / 0.5) rather than multiplying. Option B is wrong because $25,000 equals the SLE itself, ignoring the ARO factor entirely. Option C is wrong because $6,250 comes from dividing SLE by 4 or multiplying by 0.25, which does not correspond to any standard risk calculation formula.

Full explanation →
69
Multi-Selecteasy

A system administrator is applying CIS Benchmarks to a Windows server. Which TWO hardening measures are typically recommended by CIS? (Select TWO.)

Select 2 answers
A.Enable all Windows features by default
B.Disable audit logging
C.Enforce strong password policies
D.Disable unused services
E.Allow anonymous enumeration of SAM accounts
AnswersC, D

Password complexity and length.

Why this answer

CIS benchmarks recommend disabling unnecessary services and enforcing password policies.

Full explanation →
70
MCQmedium

An organization wants to identify risks related to a new cloud-based customer relationship management (CRM) system. Which approach would best identify threats and vulnerabilities specific to this system?

A.Run a vulnerability scan on the CRM
B.Execute a business impact analysis (BIA)
C.Perform a threat modeling exercise such as STRIDE
D.Conduct a qualitative risk assessment using a generic framework
AnswerC

Threat modeling is tailored to the system's architecture and identifies relevant threats.

Why this answer

Threat modeling with STRIDE is the best approach because it systematically identifies threats (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) specific to the CRM's architecture, data flows, and trust boundaries. Unlike generic scans or assessments, STRIDE focuses on the unique attack surface of a cloud-based system, such as API endpoints, multi-tenancy risks, and shared responsibility model gaps.

Exam trap

The trap here is that candidates confuse vulnerability scanning (Option A) with threat modeling, assuming that scanning for known flaws is sufficient, when in fact threat modeling is required to identify design-level and cloud-specific threats that scanners cannot detect.

How to eliminate wrong answers

Option A is wrong because a vulnerability scan only identifies known software flaws (e.g., CVEs) but does not uncover design-level threats, business logic flaws, or cloud-specific risks like misconfigured IAM roles or insecure API endpoints. Option B is wrong because a business impact analysis (BIA) prioritizes criticality and recovery objectives (RTO/RPO) but does not identify threats or vulnerabilities; it assumes risks are already known. Option D is wrong because a qualitative risk assessment using a generic framework lacks the structured, system-specific decomposition needed to uncover threats unique to the CRM's cloud architecture, such as tenant isolation failures or data leakage via shared storage.

Full explanation →
71
MCQmedium

Which security control can prevent a rogue DHCP server from assigning incorrect gateway addresses to clients?

A.IP source guard
B.Dynamic ARP inspection
C.Port security
D.DHCP snooping
AnswerD

DHCP snooping allows only authorized DHCP servers to respond to client requests.

Why this answer

DHCP snooping is a switch feature that filters DHCP messages based on trusted ports, blocking rogue DHCP servers.

Full explanation →
72
MCQhard

Refer to the exhibit. A security analyst reviews these iptables rules and expects SSH access to be blocked, but it is still allowed. What is the MOST likely reason?

A.The DROP rule does not apply to SSH.
B.The DROP rule is misconfigured with wrong source.
C.The ACCEPT rule matches before the DROP rule.
D.The default policy allows traffic, overriding the DROP rule.
AnswerC

iptables processes rules in order; the first match wins.

Why this answer

C is correct because iptables processes rules in sequential order, and the first matching rule determines the packet's fate. In this scenario, the ACCEPT rule for SSH (typically matching on port 22) appears before the DROP rule in the chain, so incoming SSH packets match the ACCEPT rule first and are permitted, never reaching the subsequent DROP rule. This is a classic ordering issue where a more specific allow rule precedes a general deny rule.

Exam trap

The trap here is that candidates often assume iptables evaluates all rules and applies the most restrictive one, but in reality, iptables uses first-match logic, so rule order is critical.

How to eliminate wrong answers

Option A is wrong because the DROP rule likely does apply to SSH if it matches on the SSH port (22) or protocol (TCP), but the rule order prevents it from being evaluated. Option B is wrong because the DROP rule's source address is irrelevant if the rule is never reached due to a preceding ACCEPT rule; a misconfigured source would cause a different behavior (e.g., blocking wrong traffic), not allow SSH when it should be blocked. Option D is wrong because the default policy (typically ACCEPT or DROP) only applies to packets that do not match any explicit rule; here, an explicit ACCEPT rule matches SSH, so the default policy is never consulted.

Full explanation →
73
MCQeasy

Refer to the exhibit. A web server at 10.0.0.50 received the payload shown. What is the MOST likely impact if the web application is vulnerable?

A.Directory traversal to read sensitive files.
B.Remote code execution on the web server.
C.Authentication bypass via SQL injection.
D.Cross-site scripting (XSS) attack leading to session theft.
AnswerC

The payload modifies SQL query to always return true.

Why this answer

The payload shown is a classic SQL injection attempt, specifically targeting authentication logic by injecting a tautology (e.g., ' OR '1'='1) into a login field. If the web application is vulnerable, this bypasses authentication by making the SQL query always return true, granting unauthorized access without valid credentials.

Exam trap

ISC2 often tests the distinction between injection types by embedding payload syntax that mimics SQL (e.g., single quotes and OR clauses) to mislead candidates into choosing XSS or directory traversal, which use different characters and contexts.

How to eliminate wrong answers

Option A is wrong because directory traversal exploits path manipulation (e.g., ../) to read files outside the web root, not SQL injection syntax. Option B is wrong because remote code execution requires command injection or deserialization flaws, not SQL tautology injection. Option D is wrong because cross-site scripting (XSS) injects client-side scripts (e.g., JavaScript) into web pages, not SQL statements that alter database queries.

Full explanation →
74
MCQhard

During a forensic investigation, an examiner needs to preserve volatile evidence. Which of the following lists the correct order of collection for volatile data?

A.Hard drive image, network connections, running processes, RAM
B.Running processes, RAM, hard drive image, network connections
C.RAM, network connections, running processes, hard drive image
D.Network connections, hard drive image, RAM, running processes
AnswerC

Correct. RAM is most volatile, then network state, then processes, then disk.

Why this answer

Volatile data must be collected in order of decreasing volatility to prevent loss of critical evidence. RAM is the most volatile (lost on power-off), followed by network connections (state changes rapidly), then running processes (persist slightly longer), and finally the hard drive image (non-volatile). This order follows the RFC 3227 guidelines for evidence collection.

Exam trap

The SSCP exam often tests the 'order of volatility' principle, and the trap here is that candidates mistakenly prioritize network connections or running processes over RAM, not realizing that RAM is the most volatile and must be captured first to preserve evidence like encryption keys or active malware payloads.

How to eliminate wrong answers

Option A is wrong because it starts with a hard drive image, which is non-volatile and should be collected last, not first, risking loss of volatile data like RAM. Option B is wrong because it places running processes before RAM, but RAM contains process data and is more volatile, so RAM must be collected first. Option D is wrong because it places network connections before RAM, but network connection state can change rapidly and is less volatile than RAM, which holds active memory contents.

Full explanation →
75
Multi-Selecthard

A security administrator is tasked with managing user access. Which THREE of the following are principles of least privilege? (Choose three.)

Select 3 answers
A.Implement mandatory access control.
B.Require manager approval for privilege escalation.
C.Grant users the minimum rights needed to perform their job.
D.Use separate accounts for administrative tasks.
E.Remove access when no longer required.
AnswersC, D, E

This is the core of least privilege.

Why this answer

The principle of least privilege dictates that users should be granted only the minimum permissions necessary to perform their job functions. This minimizes the attack surface and limits potential damage from accidental or malicious actions. It is a foundational access control concept enforced through role-based access control (RBAC) or attribute-based access control (ABAC) policies.

Exam trap

The trap here is that candidates confuse security principles (like least privilege) with security mechanisms (like MAC) or administrative processes (like approval workflows), leading them to select options that are related but not direct statements of the principle itself.

Full explanation →

Page 1 of 13

Page 2

All pages

12345678910111213

Practice SSCP by domain

Target a specific domain to shore up weak areas.

Access ControlsRisk Identification, Monitoring, and AnalysisIncident Response and RecoverySecurity Operations and AdministrationCryptographyNetwork and Communications SecuritySystems and Application Security
See all domains with question counts →