Courseiva

Systems Security Certified Practitioner SSCP (SSCP) — Questions 751–825

920 questions total · 13pages · All types, answers revealed

Take a mock examExam hub
Page 10

Page 11 of 13

Page 12
751
MCQmedium

A security analyst is troubleshooting a network issue where users on VLAN 10 cannot reach a server on VLAN 20. The router has an ACL applied to the interface connected to VLAN 10. Which step should the analyst take first to isolate the problem?

A.Review the ACL configuration on the router interface
B.Run a traceroute from a user machine to the server
C.Check the ARP table for the server's MAC address
D.Verify the VLAN configuration on the switch
AnswerA

The ACL on the router interface can block traffic between VLANs; this is the first logical step.

Why this answer

The ACL applied to the router interface connected to VLAN 10 is the most likely cause of the connectivity issue, as it can explicitly permit or deny traffic from VLAN 10 to VLAN 20. Reviewing the ACL configuration first allows the analyst to quickly determine if the traffic is being blocked by a deny statement or missing permit entry, which is a common and immediate cause of such inter-VLAN routing failures. This step is the most efficient because it directly addresses the access control mechanism at the routing boundary.

Exam trap

ISC2 often tests the principle of starting with the most likely cause at the Layer 3/4 boundary (the ACL) rather than jumping to lower-layer troubleshooting like ARP or VLAN verification, which would be premature when an ACL is explicitly present.

How to eliminate wrong answers

Option B is wrong because running a traceroute from a user machine to the server would show where packets are dropped, but it does not identify the specific ACL rule causing the drop; it only confirms the symptom, not the root cause. Option C is wrong because checking the ARP table for the server's MAC address is irrelevant to ACL filtering; ARP resolves IP to MAC addresses at Layer 2, while ACLs operate at Layer 3/4 on the router. Option D is wrong because verifying the VLAN configuration on the switch would only confirm that VLANs 10 and 20 exist and are correctly assigned to ports, but it does not address the router's ACL, which is the explicit access control mechanism applied to the routed interface.

Full explanation →
752
MCQeasy

A security team identifies a vulnerability in a web application that allows SQL injection. Which risk response strategy involves implementing input validation and parameterized queries to reduce the risk to an acceptable level?

A.Risk transfer
B.Risk mitigation
C.Risk acceptance
D.Risk avoidance
AnswerB

Mitigation applies controls to reduce risk.

Why this answer

Risk mitigation involves applying controls to reduce the likelihood or impact of a risk to an acceptable level. Implementing input validation and parameterized queries directly addresses the SQL injection vulnerability by preventing malicious SQL from being executed, thereby reducing the risk without eliminating the application's functionality.

Exam trap

The SSCP exam often tests the distinction between risk mitigation (applying controls to reduce risk) and risk avoidance (eliminating the activity entirely), tricking candidates who think input validation removes the risk completely rather than reducing it to an acceptable level.

How to eliminate wrong answers

Option A is wrong because risk transfer shifts the financial burden of a loss to a third party (e.g., insurance), not the technical control of the vulnerability. Option C is wrong because risk acceptance means acknowledging the risk without taking action, which contradicts the active implementation of security controls. Option D is wrong because risk avoidance would require removing the vulnerable web application entirely or disabling the feature that allows user input, which is not the same as applying input validation and parameterized queries.

Full explanation →
753
MCQmedium

During incident response, a team member uses a tool to capture memory from a compromised Windows system. Which of the following best describes the order of volatility?

A.Network connections, memory, disk
B.Disk, memory, network
C.Memory, network, disk
D.Memory, disk, network connections
AnswerA

Network connections change rapidly, memory is less volatile, disk is most persistent.

Why this answer

The order of volatility dictates that the most volatile data (network connections) should be captured first, followed by memory, and finally disk. Network connections change constantly and are lost when the system is powered off, while memory (RAM) persists until power loss, and disk is the least volatile as it retains data even after shutdown. This sequence ensures critical evidence is preserved before it disappears.

Exam trap

The trap here is that candidates often confuse volatility with importance, assuming disk (which contains persistent data) is more critical to capture first, when in fact the most volatile data (network connections) must be prioritized to prevent loss.

How to eliminate wrong answers

Option B is wrong because it places disk before memory, but disk is less volatile than memory and should be captured last; capturing disk first risks losing transient network and memory data. Option C is wrong because it places memory before network connections, but network connections are more volatile than memory and must be captured first to avoid losing active session data. Option D is wrong because it places disk before network connections, ignoring that network connections are the most volatile and must be captured before both memory and disk.

Full explanation →
754
MCQmedium

An organization uses Kerberos for SSO. A user reports that after entering their password, they receive a 'ticket expired' error when trying to access a network share. The system administrator checks the Kerberos configuration. Which ticket is most likely expired?

A.Session key
B.Ticket-Granting Ticket (TGT)
C.Service ticket
D.Authentication Server (AS) reply
AnswerB

TGT expiration requires the user to re-authenticate to the KDC to obtain a new TGT.

Why this answer

The Ticket-Granting Ticket (TGT) has a limited lifetime (typically 8-10 hours). When it expires, the user must re-authenticate to get a new TGT.

Full explanation →
755
MCQeasy

Which of the following is the primary purpose of a risk register?

A.To record all security incidents after they occur
B.To track changes made to system configurations
C.To document and track identified risks and their treatment
D.To automatically detect vulnerabilities in the network
AnswerC

Correct purpose of a risk register.

Why this answer

The primary purpose of a risk register is to document and track identified risks along with their treatment plans, including risk owners, likelihood, impact, and mitigation status. This aligns with the Risk Identification, Monitoring and Analysis domain, where the risk register serves as a central repository for risk management activities throughout the system development life cycle.

Exam trap

The trap here is that candidates confuse the risk register with an incident log or vulnerability scanner output, but the risk register is specifically a forward-looking planning document for managing identified risks, not a reactive or automated detection tool.

How to eliminate wrong answers

Option A is wrong because a risk register is a proactive tool for documenting potential risks before they occur, not a reactive log for recording security incidents after they happen (incident response logs serve that purpose). Option B is wrong because tracking changes to system configurations is the function of a change management system or configuration management database (CMDB), not a risk register. Option D is wrong because automatic vulnerability detection is performed by vulnerability scanners (e.g., Nessus, OpenVAS) or SIEM tools, not by a risk register, which is a manual or semi-automated documentation and tracking artifact.

Full explanation →
756
MCQmedium

A security analyst notices that a service account has been granted domain administrator privileges. Which principle of access control is being violated?

A.Need-to-know
B.Separation of duties
C.Least privilege
D.Accountability
AnswerC

Service accounts should have minimal permissions.

Why this answer

Least privilege means users and accounts should have only the minimum permissions necessary. Service accounts rarely need domain admin rights.

Full explanation →
757
MCQhard

An organization is implementing a password policy that requires passwords to be at least 12 characters, include uppercase, lowercase, digits, and special characters, and be changed every 90 days. Additionally, users cannot reuse any of the last 10 passwords. Which password policy element does the last requirement address?

A.Password expiry
B.Password length
C.Password history
D.Password complexity
AnswerC

Password history prevents reuse of previous passwords.

Why this answer

Password history prevents users from reusing previous passwords, enforcing password uniqueness over time.

Full explanation →
758
MCQhard

A security engineer needs to select a hashing algorithm for storing user passwords in a database. Which of the following is the most secure choice?

A.SHA-256
B.MD5
C.bcrypt
D.SHA-1
E.PBKDF2
AnswerC

bcrypt is correct: it includes a salt and adaptive cost, making it resistant to brute-force and rainbow table attacks.

Why this answer

(bcrypt) is correct because bcrypt is specifically designed for password hashing with a cost factor to resist brute-force attacks. Option A (SHA-256) is fast and suitable for data integrity, not password storage. Option B (MD5) is cryptographically broken and susceptible to collision attacks.

Option D (SHA-1) is also weak and deprecated for security use. Option E (PBKDF2) is a good password hashing function, but bcrypt is often preferred due to its built-in salt and adaptive cost factor.

Full explanation →
759
Multi-Selectmedium

A security auditor is reviewing the configuration of a remote access VPN. Which TWO features are considered best practices for securing the VPN connection?

Select 2 answers
A.Using IKEv2 with pre-shared keys only
B.Disabling encryption to reduce latency
C.Implementing multi-factor authentication (MFA)
D.Enabling split tunneling for all traffic to improve performance
E.Using TLS 1.3 with mandatory forward secrecy
AnswersC, E

MFA adds an extra layer of security beyond passwords.

Why this answer

Multi-factor authentication (MFA) adds an extra layer of security beyond passwords, reducing the risk of unauthorized access. TLS 1.3 with mandatory forward secrecy ensures that session keys are not compromised even if the server's private key is later exposed, providing strong encryption. Both are established best practices for securing remote access VPNs.

Full explanation →
760
MCQmedium

A user claims to be 'jsmith' and provides a password. What is the term for the step where the system verifies that the password matches the one on file for 'jsmith'?

A.Authorization
B.Identification
C.Authentication
D.Accountability
AnswerC

Authentication verifies the identity claim.

Why this answer

Authentication is the process of verifying the identity claimed by a user. Identification is the claim (e.g., username), and authentication is the verification (e.g., password).

Full explanation →
761
Multi-Selectmedium

Which TWO of the following are characteristics of mandatory access control (MAC)?

Select 2 answers
A.The system enforces access decisions based on policies
B.Security labels are assigned to subjects and objects
C.Access decisions are based on the user’s discretion
D.It is commonly used in commercial environments
E.Users can grant access to other users
AnswersA, B

MAC is system-enforced, not user-controlled.

Why this answer

Mandatory access control (MAC) enforces access decisions based on centrally defined policies, not at the discretion of individual users. The system compares security labels assigned to subjects (e.g., users, processes) and objects (e.g., files, resources) to determine if access is allowed. This ensures that even the owner of an object cannot override the policy, which is a core characteristic of MAC.

Exam trap

The trap here is that candidates often confuse MAC with DAC, mistakenly thinking that MAC allows users to set permissions or that it is common in commercial environments, when in fact MAC is policy-driven and used in high-security contexts.

Full explanation →
762
MCQmedium

Refer to the exhibit. A security analyst reviews the firewall configuration for a Windows workstation on a private network. What is the MOST significant weakness?

A.Inbound connections are set to Block by default
B.Default outbound connections are set to Allow, potentially allowing malware to communicate out
C.The rule 'RDP (UDP-In)' is set to Block and enabled, which blocks legitimate RDP traffic
D.The rule 'File and Printer Sharing (Echo Req)' is disabled, preventing network discovery
AnswerB

Allowing all outbound by default is a security weakness.

Why this answer

The most significant weakness is that the firewall configuration allows all outbound connections by default. While blocking inbound traffic by default is a secure baseline, permitting unrestricted outbound traffic enables malware or unauthorized software to communicate with external command-and-control servers or exfiltrate data without restrictions. The other options are less impactful: default inbound block (A) is a security best practice; blocking RDP UDP-In traffic (C) is often intentional to prevent vulnerabilities; disabling File and Printer Sharing (D) actually reduces the attack surface.

Therefore, the default outbound allow (B) poses the greatest risk.

Exam trap

Trap: Candidates often focus on inbound rules or specific blocked ports, overlooking the broader risk of unrestricted outbound connections, which is a common weakness in default firewall configurations.

Full explanation →
763
MCQhard

An organization uses role-based access control (RBAC). After a merger, a user account from the acquired company is migrated into the parent company's domain. The user is assigned to multiple roles, but is unable to access a critical application that requires a specific role. The administrator verified that the user's account is enabled and the application server is reachable. What is the MOST likely cause?

A.The user's group memberships are conflicting with the required role.
B.The user's account was not assigned the required role.
C.There is a firewall rule blocking traffic from the user's IP range.
D.The application's session timeout is set too low.
AnswerB

Without the role, the user lacks the necessary permissions.

Why this answer

In RBAC, access is granted based on the roles explicitly assigned to a user account. Since the administrator confirmed the account is enabled and the application server is reachable, the most likely cause is that the required role was not assigned to the migrated user. Without that role assignment, the user lacks the necessary permissions to access the critical application, regardless of other roles held.

Exam trap

The trap here is that candidates may assume group membership conflicts (Option A) cause access denial in RBAC, but RBAC roles are independent and additive—conflicts do not occur; the real issue is the missing role assignment.

How to eliminate wrong answers

Option A is wrong because RBAC does not have conflicting group memberships; roles are additive and do not conflict with each other—if the required role were assigned, access would be granted. Option C is wrong because the administrator verified the application server is reachable, which implies network connectivity is not blocked; a firewall rule would prevent reachability, not just application access. Option D is wrong because a low session timeout would cause the user to be logged out after inactivity, not prevent initial access to the application.

Full explanation →
764
MCQhard

An organization implements a policy that the same individual cannot both create a purchase order and approve it in the financial system. Which security principle does this control primarily enforce?

A.Job rotation
B.Least privilege
C.Need-to-know
D.Separation of duties
AnswerD

Separation of duties divides critical functions among multiple users to prevent fraud and errors.

Why this answer

Separation of duties (SoD) is the security principle that prevents a single individual from performing conflicting tasks, such as creating and approving a purchase order. By splitting these responsibilities, the organization reduces the risk of fraud, errors, and unauthorized transactions, ensuring that no single person has unchecked control over a critical financial process.

Exam trap

The trap here is that candidates confuse separation of duties with least privilege, but least privilege only limits permissions to the minimum needed, whereas separation of duties specifically prevents a single user from executing two conflicting functions that could enable fraud or error.

How to eliminate wrong answers

Option A is wrong because job rotation is a practice where employees periodically switch roles to cross-train and reduce monotony, not a control that enforces dual-authority over a single transaction. Option B is wrong because least privilege limits users to only the permissions necessary for their job, but it does not inherently prevent the same person from both creating and approving a purchase order if both actions fall within their role. Option C is wrong because need-to-know restricts access to information based on job necessity, not the segregation of conflicting duties within a process.

Full explanation →
765
MCQmedium

A vulnerability scan identifies a critical flaw in a web server. The server is currently in production and cannot be patched immediately due to compatibility issues. The risk response chosen is to implement a web application firewall (WAF) rule to block exploitation attempts. This is an example of which risk response?

A.Risk acceptance
B.Risk avoidance
C.Risk transfer
D.Risk mitigation
AnswerD

Applying a WAF rule reduces the risk without eliminating it entirely.

Why this answer

Implementing a WAF rule to block exploitation attempts reduces the likelihood or impact of the vulnerability without removing the flaw itself. This is a classic risk mitigation technique, as it applies a compensating control to lower residual risk while the server remains unpatched. Risk mitigation involves taking action to reduce risk to an acceptable level, which is exactly what deploying a WAF signature achieves.

Exam trap

ISC2 often tests the distinction between risk mitigation and risk avoidance, where candidates mistakenly think that blocking exploitation attempts 'avoids' the risk, but avoidance requires eliminating the vulnerability entirely (e.g., removing the server), not just reducing its exploitability.

How to eliminate wrong answers

Option A is wrong because risk acceptance means acknowledging the risk and taking no action to reduce it, whereas a WAF rule is an active control. Option B is wrong because risk avoidance would require removing the vulnerable server from production or disabling the affected service entirely, not just blocking exploit attempts. Option C is wrong because risk transfer involves shifting the financial impact of a loss to a third party (e.g., insurance or outsourcing), not implementing a technical control like a WAF.

Full explanation →
766
MCQhard

A security administrator is configuring a web server to use TLS. They want to optimize performance while maintaining strong security. Which cipher suite should they prioritize?

A.TLS_DHE_RSA_WITH_AES_128_CBC_SHA
B.TLS_RSA_WITH_AES_128_CBC_SHA256
C.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
D.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
AnswerD

This suite offers forward secrecy, strong authentication with ECDSA, and efficient authenticated encryption.

Why this answer

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 uses Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) for perfect forward secrecy, ECDSA for efficient authentication, AES-256 in GCM mode for authenticated encryption, and SHA-384 for integrity. This combination provides the strongest security with modern, optimized algorithms, making it the best choice for performance and security on a TLS web server.

Exam trap

The trap here is that candidates often choose option C (ECDHE_RSA) because it uses ECDHE and GCM, but they overlook that ECDSA with AES-256 and SHA-384 provides stronger security and better performance than RSA-based authentication, especially in modern TLS configurations.

How to eliminate wrong answers

Option A is wrong because TLS_DHE_RSA_WITH_AES_128_CBC_SHA uses DHE (which is slower than ECDHE due to larger key sizes) and CBC mode (which is vulnerable to padding oracle attacks like POODLE) with SHA-1 (deprecated due to collision attacks). Option B is wrong because TLS_RSA_WITH_AES_128_CBC_SHA256 uses RSA key exchange (no perfect forward secrecy, as the private key can decrypt all past sessions if compromised) and CBC mode (still susceptible to timing attacks). Option C is wrong because TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 uses RSA for authentication (larger keys, slower than ECDSA) and AES-128 (weaker than AES-256 for long-term security), while the question asks to prioritize the strongest combination; ECDSA with AES-256 and SHA-384 is superior.

Full explanation →
767
Multi-Selectmedium

An organization has suffered a ransomware attack that encrypted files on several file servers. The incident response team is planning recovery. Which TWO actions should be performed to verify that the restored systems are clean before returning them to production? (Select TWO)

Select 2 answers
A.Restore the systems from the most recent backup
B.Change all user passwords associated with the systems
C.Run a full antivirus and anti-malware scan on the restored systems
D.Apply all security patches to the operating system
E.Monitor the systems for any signs of reinfection or anomalous behavior for a period of time
AnswersC, E

Scanning ensures no malware remains in the restored data.

Why this answer

Running a full antivirus and anti-malware scan on the restored systems ensures that no remnants of the ransomware (e.g., dormant payloads, modified registry keys, or backdoor executables) remain in the restored data. Even if the backup was taken before the infection, the restore process could reintroduce malware if the backup itself was compromised or if the ransomware had persisted in the system state. A thorough scan validates that the restored environment is free of known malicious signatures and behavioral indicators.

Exam trap

The trap here is that candidates often assume restoring from a clean backup (Option A) is sufficient to guarantee a clean system, but the SSCP exam emphasizes that backups must be verified as malware-free and that additional validation steps (scanning and monitoring) are required before returning systems to production.

Full explanation →
768
MCQeasy

Which of the following is the PRIMARY purpose of implementing a clean desk policy?

A.To lower office cleaning costs
B.To comply with fire safety regulations
C.To reduce the risk of data breaches
D.To improve employee productivity
AnswerC

Clean desk policies prevent unauthorized access to sensitive information left on desks.

Why this answer

A clean desk policy is a physical security control designed to prevent unauthorized access to sensitive information by ensuring that documents, devices, and media are securely stored when not in use. By reducing the visibility of confidential data, it directly mitigates the risk of data breaches from shoulder surfing, theft, or accidental exposure. This aligns with the principle of least exposure and supports compliance with data protection frameworks like GDPR or HIPAA.

Exam trap

The trap here is that candidates confuse a clean desk policy with general workplace organization or fire safety, overlooking its core role as a physical security control to protect confidential data from unauthorized access.

How to eliminate wrong answers

Option A is wrong because a clean desk policy does not target cleaning costs; it is a security measure, not a housekeeping budget control. Option B is wrong because while a clean desk may indirectly reduce fire hazards by clearing clutter, fire safety regulations are primarily addressed by fire codes, extinguisher placement, and egress paths, not by a policy focused on information security. Option D is wrong because although a tidy workspace can boost morale, the primary purpose of a clean desk policy is security, not productivity improvement.

Full explanation →
769
MCQhard

A security engineer is configuring a firewall to block all inbound traffic except for specific services. Which of the following design principles is being applied?

A.Separation of duties
B.Default deny
C.Defense in depth
D.Least privilege
AnswerD

Least privilege ensures entities have only the access needed to perform their functions.

Why this answer

Least Privilege, because the security engineer is configuring the firewall to block all inbound traffic except for specific services. This aligns with the principle of least privilege, which dictates that only the minimum necessary access should be granted—in this case, only allowing specific services through while denying everything else by default. The firewall rule set explicitly permits only required ports (e.g., TCP/443 for HTTPS) and implicitly denies all other traffic, ensuring that no unnecessary access is permitted.

Exam trap

The trap here is that candidates confuse the 'default deny' mechanism (a firewall policy stance) with the 'least privilege' design principle, but the question asks for the overarching principle, not the specific implementation method.

How to eliminate wrong answers

Option A is wrong because separation of duties is a control designed to prevent fraud or error by requiring multiple individuals to complete a sensitive task (e.g., one person configures the firewall, another audits the rules), not a principle about traffic filtering. Option B is wrong because default deny is a specific firewall policy stance (deny all traffic unless explicitly allowed), not a design principle; the question asks for the principle being applied, and default deny is a mechanism that implements least privilege. Option C is wrong because defense in depth is a layered security strategy using multiple controls (e.g., firewall, IDS, antivirus), not a single firewall configuration that blocks all inbound traffic except specific services.

Full explanation →
770
MCQmedium

A security analyst notices that a web application is vulnerable to SQL injection. The application uses parameterized queries for most inputs but concatenates user input directly into a query for a legacy module. Which is the BEST immediate remediation?

A.Disable the legacy module until a full rewrite is completed.
B.Rewrite the legacy module to use parameterized queries.
C.Deploy a web application firewall (WAF) to block SQL injection patterns.
D.Implement input validation to reject special characters.
AnswerB

Parameterized queries prevent SQL injection by separating code from data.

Why this answer

Parameterized queries (prepared statements) are the definitive defense against SQL injection, as they separate SQL logic from user data by design. Rewriting the legacy module to use parameterized queries eliminates the root cause of the vulnerability at the code level, ensuring that user input is never concatenated into the SQL statement. This is the most secure and permanent fix, as it directly addresses the injection point in the application layer.

Exam trap

ISC2 often tests the misconception that a WAF or input validation is sufficient to prevent SQL injection, but the trap here is that only parameterized queries (or stored procedures with parameterized calls) eliminate the vulnerability at the code level, making them the best immediate remediation over compensating controls.

How to eliminate wrong answers

Option A is wrong because disabling the legacy module is a reactive, temporary workaround that disrupts business functionality and does not fix the underlying insecure coding practice; it should only be considered if the module cannot be secured immediately, but the question asks for the 'best immediate remediation,' which is a permanent code fix. Option C is wrong because a WAF is a compensating control that can be bypassed with advanced SQL injection techniques (e.g., encoding, out-of-band attacks) and does not address the root cause; it should be used as a defense-in-depth layer, not as a primary remediation. Option D is wrong because input validation (e.g., rejecting special characters) is unreliable and can be circumvented by attackers using alternative injection vectors (e.g., numeric fields, second-order injection) and may break legitimate input; it is not a substitute for parameterized queries.

Full explanation →
771
MCQmedium

A security analyst reviews the exhibit. The internal IP 10.0.0.1 is a web server, and 203.0.113.5 is an external IP. What is the most likely issue?

A.The web server may be exfiltrating data to an external host
B.The external IP is scanning the web server for vulnerabilities
C.The web server is experiencing a DDoS attack from the external IP
D.An internal user is browsing a malicious website
AnswerA

Increasing outgoing data to a single external host is suspicious of data exfiltration.

Why this answer

The exhibit shows a high volume of outbound traffic from internal IP 10.0.0.1 (the web server) to external IP 203.0.113.5 on port 443 (HTTPS). This pattern is consistent with data exfiltration, where a compromised web server sends sensitive data to an external command-and-control (C2) server. The traffic is initiated by the internal server, not inbound, which rules out scanning or DDoS attacks.

Exam trap

The trap here is that candidates confuse the direction of traffic—assuming any external IP communicating with a web server must be an attacker scanning or attacking, rather than recognizing that the server itself may be the compromised source of outbound data.

How to eliminate wrong answers

Option B is wrong because vulnerability scanning typically involves inbound probes (e.g., SYN scans) from the external IP to the web server, not sustained outbound data flows. Option C is wrong because a DDoS attack would show a flood of inbound traffic from many sources, not a single external IP sending or receiving a steady outbound stream. Option D is wrong because an internal user browsing a malicious website would generate outbound traffic from a client workstation, not from a web server IP like 10.0.0.1.

Full explanation →
772
MCQeasy

A company has 200 employees using a Windows Active Directory environment. The security administrator receives multiple alerts that user accounts are being locked out every 15 minutes. The help desk confirms that users who report the issue are able to log in successfully after unlocking their accounts, but they get locked out again shortly after. The administrator checks the domain controller security logs and sees many failed logon attempts with a specific service account name 'svc_backup' from multiple workstations. The svc_backup account is used for a backup application that runs scheduled tasks. What should the administrator do to resolve the issue?

A.Disable the svc_backup account until the backup vendor releases a patch
B.Change the password for svc_backup and update the backup application with the new password
C.Create a new service account with a different name and grant it the same permissions
D.Increase the account lockout threshold to prevent lockouts
AnswerB

This resolves the root cause - the service account's password is likely stale or incorrect, causing repeated authentication failures.

Why this answer

The repeated lockouts are caused by a service account (svc_backup) being used with an incorrect or expired password. The most effective solution is to reset the password for that account and update it in the backup application. Disabling the account or increasing the lockout threshold does not fix the root cause.

Creating a new account without addressing the password mismatch will not stop the current account from being used.

Full explanation →
773
Multi-Selectmedium

An organization is designing network segmentation to protect sensitive data. Which TWO of the following are effective methods for implementing network segmentation?

Select 2 answers
A.Honeypots
B.NAT
C.Firewalls
D.Port security
E.VLANs
AnswersC, E

Firewalls enforce policies between segments.

Why this answer

VLANs segment traffic at Layer 2, and firewalls control traffic between segments at Layer 3+.

Full explanation →
774
Drag & Dropmedium

Drag and drop the steps for a typical TLS 1.3 handshake into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

TLS 1.3 reduces round trips: ClientHello, ServerHello, EncryptedExtensions, Finished from server, Finished from client.

Full explanation →
775
MCQhard

An organization wants to implement a cryptographic solution that ensures forward secrecy for its internal communications. Which key exchange method should be used?

A.RSA key exchange
B.Elliptic Curve Diffie-Hellman (ECDH)
C.Diffie-Hellman Ephemeral (DHE)
D.Static Diffie-Hellman
AnswerC

DHE generates temporary keys each session, so compromise of long-term keys does not expose past sessions.

Why this answer

DHE (Diffie-Hellman Ephemeral) generates a fresh, temporary key pair for each session and never reuses the private key, ensuring that compromise of a long-term key does not expose past session keys. This provides forward secrecy because the ephemeral keys are destroyed after the session ends, making it computationally infeasible to decrypt recorded traffic even if the server's static key is later compromised.

Exam trap

ISC2 often tests the distinction between 'Diffie-Hellman' (which can be static) and 'Diffie-Hellman Ephemeral' (DHE) — the trap is that candidates see 'Diffie-Hellman' and assume forward secrecy, forgetting that only the ephemeral variant provides it.

How to eliminate wrong answers

Option A is wrong because RSA key exchange uses the server's static private key to decrypt the premaster secret; if that private key is later compromised, all past sessions can be decrypted, so it does not provide forward secrecy. Option B is wrong because Elliptic Curve Diffie-Hellman (ECDH) alone is a static-static or static-ephemeral variant unless the ephemeral (ECDHE) version is specified; the question asks for a method that ensures forward secrecy, and standard ECDH without the 'E' does not guarantee ephemeral keys. Option D is wrong because Static Diffie-Hellman uses fixed, long-term keys for both parties, meaning compromise of either static private key allows decryption of all past and future sessions, thus providing no forward secrecy.

Full explanation →
776
Multi-Selectmedium

Which TWO of the following are essential components of a secure configuration baseline for a new server deployment?

Select 2 answers
A.Disable all unnecessary services and ports
B.Apply the latest security patches to the operating system
C.Enable only error logging, not audit logging
D.Assign the same strong password to all local accounts
E.Use default passwords for all service accounts
AnswersA, B

Reduces attack surface.

Why this answer

Options A and B are correct. Disabling unnecessary services and ports reduces the attack surface, and applying the latest security patches closes known vulnerabilities. Option C is incorrect because audit logging is essential for monitoring and forensic analysis; enabling only error logging is insufficient.

Option D is incorrect because using the same password for all local accounts violates the principle of least privilege and increases the impact of a credential compromise. Option E is incorrect because default passwords are well-known and insecure; they must be changed before deployment.

Full explanation →
777
MCQeasy

Which of the following is the correct order of the access control process?

A.Identification, authentication, authorization, accountability
B.Identification, authorization, authentication, accountability
C.Authorization, authentication, identification, accountability
D.Authentication, identification, authorization, accountability
AnswerA

Correct. This is the logical order.

Why this answer

The sequence is: identification (user claims identity), authentication (verifies claim), authorization (determines access rights), and accountability (tracks actions).

Full explanation →
778
MCQhard

Refer to the exhibit. User bob, a member of the projectdev group, attempts to create a new file in /data/project but gets 'Permission denied'. What is the most likely reason?

A.The group permission (r-x) and the mask (rwx) combine to limit bob to read and execute only
B.Bob is not the owner of the directory
C.Bob's effective permissions are limited by the user:alice entry
D.The 'other' permission is '---', blocking all access for users not in the file's user or group
AnswerA

The effective group permission is determined by the ACL group entry (r-x) and the mask (rwx) – the more restrictive is applied, resulting in r-x, which lacks write.

Why this answer

The directory /data/project has group permissions set to r-x (read and execute) for the projectdev group, and the umask is set to rwx (000), meaning no bits are masked. However, the group permission explicitly denies write access. Since bob is a member of projectdev, his effective permissions are limited to read and execute, preventing file creation.

Exam trap

ISC2 often tests the misconception that the 'other' permission applies to group members, when in fact group permissions take precedence for users in the group, and the umask only affects newly created files, not the directory's existing permissions.

How to eliminate wrong answers

Option B is wrong because ownership of the directory is irrelevant; bob's group membership grants him group-level permissions, which are the limiting factor. Option C is wrong because the user:alice entry is an ACL that applies specifically to user alice, not to bob, and does not affect bob's permissions. Option D is wrong because the 'other' permission applies only to users who are not the owner and not in the group; bob is in the projectdev group, so group permissions apply, not 'other'.

Full explanation →
779
Multi-Selectmedium

A cloud security team is implementing CSPM (Cloud Security Posture Management) for their IaaS environment. Which THREE issues is CSPM MOST likely to detect? (Select THREE.)

Select 3 answers
A.IAM roles with overly permissive policies
B.Open security groups allowing unrestricted inbound access
C.Outdated OS patches on cloud VMs
D.Unencrypted S3 buckets
E.Runtime malware in a virtual machine
AnswersA, B, D

CSPM identifies privilege risks.

Why this answer

CSPM detects misconfigurations such as open security groups, unencrypted storage, and excessive IAM permissions.

Full explanation →
780
MCQhard

An organization's risk register shows a high risk for phishing attacks. Which controls are considered detective controls for this risk?

A.Security awareness training.
B.Email filtering.
C.User reporting mechanism.
D.Multi-factor authentication.
AnswerC

User reporting detects phishing attacks that have reached users, enabling response.

Why this answer

A user reporting mechanism is a detective control because it enables users to identify and report suspected phishing emails after they have been received, allowing the security team to investigate and respond. Unlike preventive controls that block attacks, detective controls discover incidents that have already occurred, such as a user recognizing a malicious link or attachment in their inbox.

Exam trap

ISC2 often tests the distinction between preventive and detective controls, and the trap here is that candidates confuse 'user reporting' as a reactive or corrective control rather than recognizing it as a detective control that identifies an ongoing or past incident.

How to eliminate wrong answers

Option A is wrong because security awareness training is a preventive/deterrent control that educates users to avoid falling for phishing, not a control that detects attacks after they occur. Option B is wrong because email filtering is a preventive control that blocks phishing emails before they reach the user's inbox, not a detective measure that identifies incidents post-delivery. Option D is wrong because multi-factor authentication is a preventive control that protects accounts even if credentials are compromised, not a detective control that identifies phishing attempts or compromises.

Full explanation →
781
MCQhard

A company runs a critical web application on an internal server that authenticates users against a Microsoft SQL Server database. The application was developed by a vendor that is no longer in business, and the source code is unavailable. The current authentication process stores user passwords using reversible encryption. The security team has identified this as a high-risk vulnerability. They propose implementing a database-level trigger that hashes the password column during INSERT and UPDATE operations, and modifying the application's stored procedures to compare hashed values during login. However, after implementation, users report that they cannot log in. The authentication logs show that the password comparison always fails. The database administrator confirms that the trigger is working and that new user registrations store the SHA-256 hash. What is the most likely cause of the login failures?

A.The trigger does not hash the password during UPDATE operations that are performed by the same user.
B.The application is using a different hashing algorithm than the trigger.
C.The stored procedure for login is still comparing the plain-text password with the hash.
D.The trigger hashes the password only if the password column is part of a specific set of columns.
AnswerC

The stored procedure likely was not modified to hash the input before comparison, resulting in failure.

Why this answer

The stored procedure for login likely still expects a plain-text password and compares it directly to the stored hash, causing failure. Option A is incorrect because the trigger should fire on all updates, including those by the same user. Option B is incorrect because the trigger uses SHA-256 and the stored procedure should use the same algorithm.

Option D is incorrect because the trigger should be defined on the password column.

Full explanation →
782
Multi-Selecthard

A SIEM correlation rule triggers when an administrative account logs in after hours and subsequently performs a bulk export of a customer database. Which THREE threat types does this scenario most likely indicate?

Select 3 answers
A.Malware infection
B.Denial of service
C.Privilege escalation
D.Data exfiltration
E.Insider threat
AnswersC, D, E

After-hours admin login may indicate escalation or misuse.

Why this answer

The scenario describes an administrative account performing actions (after-hours login and bulk database export) that exceed its normal privileges or intended use, which is the essence of privilege escalation. The SIEM rule detects this by correlating the account's elevated access with anomalous behavior, indicating the account may have been compromised or misused to gain unauthorized capabilities.

Exam trap

The trap here is that candidates may confuse 'insider threat' (Option E) with 'privilege escalation' (Option C), but the question asks for three threat types, and both are distinct: privilege escalation focuses on the abuse of elevated access, while insider threat is the broader category of malicious or negligent actions by authorized users.

Full explanation →
783
MCQeasy

A network technician needs to ensure that only authorized DHCP servers can assign IP addresses on the network. Which switch feature should be enabled?

A.DHCP snooping
B.Dynamic ARP Inspection
C.Port security
D.BPDU guard
AnswerA

DHCP snooping blocks unauthorized DHCP server responses.

Why this answer

DHCP snooping is a security feature that filters untrusted DHCP messages and builds a DHCP snooping binding database by monitoring DHCP traffic on untrusted ports. By enabling DHCP snooping on the switch, only DHCP servers connected to trusted ports can assign IP addresses, preventing rogue DHCP server attacks.

Exam trap

ISC2 often tests DHCP snooping by confusing it with Dynamic ARP Inspection, but the key distinction is that DHCP snooping directly controls DHCP server messages, while DAI relies on the snooping database to validate ARP traffic.

How to eliminate wrong answers

Option B (Dynamic ARP Inspection) is wrong because it validates ARP packets using the DHCP snooping binding table to prevent ARP spoofing, not to control which DHCP servers can assign IP addresses. Option C (Port security) is wrong because it limits the number of MAC addresses allowed on a switch port to prevent MAC flooding, not to authorize DHCP servers. Option D (BPDU guard) is wrong because it protects spanning tree protocol by disabling ports that receive BPDUs, which is unrelated to DHCP server authorization.

Full explanation →
784
MCQmedium

A security analyst is reviewing security events on a Linux server and needs to ensure that all authentication attempts, including both successful and failed logins, are logged. Which configuration should be used?

A.Use PAM to log authentication events to /var/log/secure
B.Enable and configure auditd with rules to capture login events
C.Set up SELinux to audit login attempts
D.Configure syslog to monitor /var/log/auth.log
AnswerB

auditd is the Linux audit daemon; rules can be added to log all login attempts.

Why this answer

The auditd service is used for auditing in Linux, including authentication events. Configuring auditd rules for logins captures all attempts.

Full explanation →
785
MCQhard

Refer to the exhibit. A systems administrator configures this Group Policy setting. What is the direct consequence?

A.Members of Backup Operators cannot connect to the server using Remote Desktop.
B.Members of Backup Operators are prohibited from local console logon.
C.Members of Backup Operators can connect via Remote Desktop.
D.Members of Backup Operators are prevented from using any remote access method.
AnswerA

The deny setting explicitly blocks RDP access for that group.

Why this answer

The 'Deny log on through Remote Desktop Services' policy explicitly prevents members of Backup Operators from using Remote Desktop. Therefore, they cannot connect via RDP, making Option A correct. Option B is incorrect because the policy only affects Remote Desktop, not local console logon.

Option C is incorrect because the policy denies, not allows. Option D is incorrect because it does not affect other remote access methods like SSH unless specifically configured.

Full explanation →
786
MCQmedium

Which access control model allows the owner of a resource to determine who can access it and what permissions they have?

A.Mandatory Access Control (MAC)
B.Discretionary Access Control (DAC)
C.Attribute-Based Access Control (ABAC)
D.Role-Based Access Control (RBAC)
AnswerB

DAC allows owners to set permissions.

Why this answer

Discretionary Access Control (DAC) gives resource owners discretion to grant or deny access to others.

Full explanation →
787
MCQmedium

A system administrator is configuring a file encryption solution for a shared network drive. The solution must allow multiple users to read the files without sharing a single symmetric key. Which approach should be used?

A.Use a different symmetric key for each user and re-encrypt the file for each user
B.Encrypt the file with each user's public key directly
C.Encrypt the file with a symmetric key, then encrypt that key with each authorized user's public key
D.Encrypt the file with a single symmetric key and share that key securely with all users
AnswerC

This is a hybrid encryption approach that scales well and maintains security.

Why this answer

Describes hybrid encryption, which is the correct approach for this scenario. The file is encrypted with a random symmetric key (session key) for efficiency, and that symmetric key is then encrypted with each authorized user's public key. This allows multiple users to decrypt the symmetric key with their private key and then decrypt the file, without sharing a single symmetric key.

Exam trap

The trap here is that candidates may choose Option B (direct public key encryption) because they understand asymmetric encryption but overlook the performance and practical limitations of encrypting large files with public key algorithms, which are designed for small data like keys.

How to eliminate wrong answers

Option A is wrong because re-encrypting the entire file for each user with a different symmetric key is computationally expensive and does not scale; it also requires managing multiple encrypted copies. Option B is wrong because directly encrypting the file with each user's public key would require encrypting the entire file multiple times, which is inefficient for large files and does not leverage symmetric key performance. Option D is wrong because sharing a single symmetric key with all users violates the requirement of not sharing a single symmetric key and introduces a single point of compromise.

Full explanation →
788
MCQmedium

A company implements mandatory access control (MAC) on its classified document system. A user with a security clearance of Secret attempts to read a document labeled Top Secret. What happens?

A.The user is prompted to request a temporary upgrade
B.The access is denied by the system
C.The document is downgraded to Secret for the user
D.The user can read the document because they have a valid clearance
AnswerB

MAC denies any access that violates the lattice.

Why this answer

In a mandatory access control (MAC) system, access decisions are based on comparing the user's security clearance (Secret) with the document's classification label (Top Secret). Since the clearance level is lower than the document's classification, the system automatically denies the read operation. This is a fundamental property of MAC, where the system enforces the Bell-LaPadula model's simple security property (no read up).

Exam trap

The trap here is that candidates confuse MAC with discretionary access control (DAC), where a user might be able to request temporary access or have permissions changed by the owner, but in MAC, all access decisions are system-enforced and cannot be overridden by users.

How to eliminate wrong answers

Option A is wrong because MAC does not support user-initiated temporary upgrades; clearance changes require administrative action and are not prompted by the system. Option C is wrong because MAC never automatically downgrades a document's classification label to match a user's clearance; labels are immutable and set by the security administrator. Option D is wrong because having a valid clearance is insufficient; the clearance must equal or exceed the document's classification level for read access.

Full explanation →
789
MCQhard

A security professional is designing a key management system and needs to ensure that keys are generated using a truly random source. Which of the following is the most appropriate method for generating cryptographic keys?

A.Hardware random number generator
B.Cryptographically secure PRNG seeded with a static password
C.Pseudorandom number generator (PRNG) seeded with current timestamp
D.User-memorized passphrase
AnswerA

Hardware RNG provides true randomness.

Why this answer

Hardware random number generators (HRNGs) provide true randomness, while CSPRNGs are deterministic. For key generation, a hardware RNG is best.

Full explanation →
790
Multi-Selectmedium

Which TWO of the following are primary purposes of a risk register?

Select 2 answers
A.Track the status of risk treatment plans
B.Document identified risks and their characteristics
C.Record network traffic logs
D.Store vulnerability scan results
E.Provide a checklist for compliance audits
AnswersA, B

The risk register tracks mitigation actions and their progress.

Why this answer

A risk register is a living document used to track the status of risk treatment plans, including whether controls have been implemented, are in progress, or are overdue. This ensures that risk owners are accountable and that residual risk is managed over time. Option B is correct because the primary function of a risk register is to document identified risks along with their characteristics, such as probability, impact, risk score, and owner.

These two functions are core to the risk management process as defined by frameworks like NIST SP 800-37 and ISO 31000.

Exam trap

The trap here is that candidates confuse the risk register with operational security tools like vulnerability scanners or log management systems, leading them to select options that describe technical data storage rather than the risk management documentation and tracking functions.

Full explanation →
791
MCQeasy

An organization wants to allow secure remote access for employees. Which protocol is most appropriate for a site-to-site VPN?

A.PPTP
B.SSL/TLS
C.IPsec
D.SSH
E.L2TP
AnswerC

IPsec provides strong encryption and authentication for site-to-site VPNs.

Why this answer

IPsec is the correct choice for a site-to-site VPN because it operates at the network layer (Layer 3), providing encryption and authentication for all IP traffic between two entire networks. It supports both tunnel and transport modes, and uses protocols like ESP (Encapsulating Security Payload) and AH (Authentication Header) to ensure confidentiality, integrity, and origin authentication, making it the standard for permanent site-to-site connections.

Exam trap

The trap here is that candidates often confuse SSL/TLS with site-to-site VPNs because of its common use in remote access VPNs (e.g., AnyConnect), but SSL/TLS is a transport-layer protocol designed for client-to-server connections, not for routing entire network segments.

How to eliminate wrong answers

Option A (PPTP) is wrong because it uses outdated MPPE encryption and relies on PPP authentication, which has known security vulnerabilities (e.g., MS-CHAPv2 cracking) and is not suitable for secure site-to-site VPNs. Option B (SSL/TLS) is wrong because it operates at the transport layer (Layer 4) and is designed for client-to-site remote access VPNs (e.g., OpenVPN or AnyConnect), not for routing traffic between two entire networks. Option D (SSH) is wrong because it is a protocol for secure remote command-line access and port forwarding (tunneling individual TCP connections), not for encapsulating entire IP networks.

Option E (L2TP) is wrong because it is a tunneling protocol that provides no encryption by itself (RFC 2661); it is typically paired with IPsec (L2TP/IPsec) for security, but alone it is not appropriate for a secure site-to-site VPN.

Full explanation →
792
Multi-Selectmedium

A network administrator is configuring a VPN using IPsec. Which two protocols are used within IPsec to ensure data integrity and confidentiality? (Choose two.)

Select 2 answers
A.SSL (Secure Sockets Layer)
B.L2TP (Layer 2 Tunneling Protocol)
C.ESP (Encapsulating Security Payload)
D.IKE (Internet Key Exchange)
E.AH (Authentication Header)
AnswersC, E

ESP provides both confidentiality and integrity, making it essential for data security in IPsec.

Why this answer

C is correct because ESP (Encapsulating Security Payload) provides both data confidentiality (via encryption) and data integrity (via authentication), making it the primary IPsec protocol for securing payloads. E is correct because AH (Authentication Header) ensures data integrity and origin authentication but does not provide confidentiality, as it does not encrypt the payload. Together, ESP and AH are the two core IPsec protocols that handle integrity and confidentiality, though ESP alone is typically used in modern deployments.

Exam trap

The trap here is that candidates often confuse IKE as a protocol that provides data integrity or confidentiality, when in fact it only handles key exchange and SA negotiation, not the actual data protection.

Full explanation →
793
Multi-Selecthard

A security analyst is reviewing a web application for OWASP Top 10 vulnerabilities. Which THREE of the following are examples of injection flaws?

Select 3 answers
A.SQL injection
B.LDAP injection
C.Broken authentication
D.OS command injection
E.Cross-Site Scripting (XSS)
AnswersA, B, D

SQL injection is a type of injection flaw.

Why this answer

Injection flaws occur when untrusted data is sent to an interpreter. SQL, OS command, and LDAP injection are classic examples.

Full explanation →
794
MCQmedium

A company deploys a guest Wi-Fi network that must be isolated from the internal network. The network team uses VLANs and a firewall. Which configuration best ensures isolation?

A.Configure the same SSID for both guest and internal networks but use different passwords.
B.Create a separate VLAN for guest traffic with a firewall rule blocking access to internal subnets.
C.Use WPA2 encryption with a pre-shared key and disable SSID broadcast.
D.Assign guest devices to the same subnet as internal devices but enforce MAC filtering.
AnswerB

This provides both VLAN segmentation and firewall enforcement.

Why this answer

Creating a separate VLAN for guest traffic logically segments the network at Layer 2, and adding a firewall rule that explicitly blocks access to internal subnets enforces isolation at Layer 3/4. This ensures guest devices cannot reach internal resources, even if they are on the same physical infrastructure.

Exam trap

The trap here is that candidates often confuse security features like encryption (WPA2) or hiding the SSID with network isolation, failing to recognize that VLANs and firewall rules are required for true Layer 2/3 separation.

How to eliminate wrong answers

Option A is wrong because using the same SSID for both guest and internal networks does not provide any logical separation; devices would still be on the same broadcast domain unless VLANs are used, and different passwords alone do not prevent traffic from crossing between networks. Option C is wrong because disabling SSID broadcast (hidden SSID) is a weak security measure that does not isolate traffic; it only hides the network name, and WPA2 with a PSK does not prevent guest devices from accessing internal subnets if they are on the same VLAN. Option D is wrong because assigning guest devices to the same subnet as internal devices eliminates any Layer 3 separation, and MAC filtering is an access control mechanism that can be easily spoofed and does not block traffic between devices on the same subnet.

Full explanation →
795
MCQeasy

Which backup type copies all data that has changed since the last full backup, regardless of any incremental backups?

A.Synthetic full backup
B.Full backup
C.Differential backup
D.Incremental backup
AnswerC

Correct. Differential copies changes since last full backup.

Why this answer

A differential backup copies all data that has changed since the last full backup, regardless of any intermediate incremental backups. This means each differential backup grows in size as it accumulates all changes made after the last full backup, making it distinct from incremental backups which only capture changes since the last backup of any type.

Exam trap

The trap here is that candidates often confuse differential backups with incremental backups, but the key differentiator is the reference point: differential backs up all changes since the last full backup, while incremental backs up changes since the last backup of any type.

How to eliminate wrong answers

Option A is wrong because a synthetic full backup is a logical reconstruction of a full backup from previous full and incremental backups, not a backup type that copies changed data since the last full backup. Option B is wrong because a full backup copies all data, not just the data that has changed since the last full backup. Option D is wrong because an incremental backup copies only data that has changed since the last backup (which could be full, differential, or incremental), not specifically since the last full backup.

Full explanation →
796
MCQhard

A security analyst is configuring a SIEM to detect data exfiltration. Which of the following correlation rules would best identify potential data exfiltration via DNS tunneling?

A.Correlate high outbound DNS query volume with requests to newly registered or suspicious domains
B.Correlate multiple failed logins from a single IP
C.Alert on any single failed login attempt
D.Alert when a user accesses a file share after hours
AnswerA

This pattern matches DNS tunneling behavior.

Why this answer

DNS tunneling encodes data in DNS queries and responses, often generating a high volume of outbound queries to domains that are newly registered or otherwise suspicious. Correlating these two indicators—unusual query volume and suspicious domain characteristics—directly targets the behavior of DNS tunneling, making it the most effective rule for detecting this exfiltration technique.

Exam trap

The trap here is that candidates often confuse general anomaly detection (like failed logins or after-hours access) with the specific network-layer indicators of DNS tunneling, failing to recognize that DNS tunneling is characterized by unusual DNS query patterns to suspicious domains, not by authentication or file access events.

How to eliminate wrong answers

Option B is wrong because multiple failed logins from a single IP indicate a brute-force or credential-stuffing attack, not data exfiltration via DNS tunneling. Option C is wrong because alerting on any single failed login attempt would generate excessive false positives and does not correlate with DNS tunneling behavior. Option D is wrong because after-hours file access may indicate insider threat or policy violation but is unrelated to the network-level anomaly of DNS tunneling.

Full explanation →
797
MCQhard

Refer to the exhibit. An analyst reviews the sshd log. What should be the immediate response?

A.Block the source IP 203.0.113.5 on the firewall
B.Disable SSH service on the server
C.Inform the server administrator of the suspicious activity
D.Change the root password and disable root SSH login
AnswerD

Immediately revoke access for the compromised account and prevent further use.

Why this answer

The sshd log shows repeated failed root login attempts from IP 203.0.113.5, indicating a brute-force attack targeting the root account. The immediate response is to change the root password and disable root SSH login (e.g., set `PermitRootLogin no` in `/etc/ssh/sshd_config`), as this directly mitigates the attack vector by removing the ability to authenticate as root via SSH. This aligns with the principle of least privilege and is a standard first step in SSH security hardening.

Exam trap

The trap here is that candidates often choose to block the source IP (Option A) because it seems like a quick fix, but they overlook that the root account remains exposed and the attacker can simply switch IPs, making the password change and disabling root login the correct immediate response.

How to eliminate wrong answers

Option A is wrong because blocking the source IP 203.0.113.5 on the firewall is a reactive measure that only addresses this specific attacker; the root account remains vulnerable to future attacks from other IPs, and the underlying misconfiguration (root SSH login enabled) is not fixed. Option B is wrong because disabling the SSH service on the server would deny legitimate administrative access entirely, causing unnecessary disruption; the goal is to secure SSH, not disable it. Option C is wrong because informing the server administrator of the suspicious activity is a notification step, not an immediate response; it delays action while the attack continues, and the administrator would still need to perform the corrective steps (change password, disable root login).

Full explanation →
798
MCQhard

A large data center uses a three-tier architecture with core, aggregation, and access switches. The security team detects anomalous traffic patterns: every night at 2:00 AM, a single server (IP 10.10.10.50) sends large ICMP Echo requests to multiple external IPs, followed by a flood of TCP SYN packets from those external IPs back to the server. The server is a critical database server that should not initiate outbound connections. The team suspects the server is compromised. The network team wants to contain the threat without taking the server offline immediately. Which action should they take first?

A.Apply an access control list (ACL) on the switch port to block outbound ICMP and non-essential TCP traffic from the server.
B.Add a firewall rule to block all traffic to and from the server's IP.
C.Move the server to a quarantine VLAN with no route to the internet.
D.Shut down the switch port to disconnect the server immediately.
AnswerA

This restricts the server's outbound traffic without fully disconnecting it.

Why this answer

Applying an ACL on the switch port to block outbound ICMP and non-essential TCP traffic from the server immediately stops the anomalous traffic (ICMP Echo requests and TCP SYN flood responses) without taking the critical database server offline. This containment approach preserves server availability for legitimate database operations while preventing further malicious outbound activity, aligning with the goal of containing the threat without immediate downtime.

Exam trap

The trap here is that candidates often choose a more drastic action like shutting down the port or blocking all traffic, failing to recognize that a granular ACL on the switch port can surgically stop the malicious traffic while keeping the server online for its primary role.

How to eliminate wrong answers

Option B is wrong because adding a firewall rule to block all traffic to and from the server's IP would completely isolate the server, taking it offline and violating the requirement to not take the server offline immediately. Option C is wrong because moving the server to a quarantine VLAN with no route to the internet would require reconfiguring the network and potentially disrupting connectivity, which is more invasive and time-consuming than a simple ACL on the switch port; it also does not address the immediate need to stop the ongoing traffic. Option D is wrong because shutting down the switch port disconnects the server entirely, taking it offline and failing the condition to contain the threat without immediate downtime.

Full explanation →
799
Multi-Selectmedium

A system administrator is hardening a Windows server. Which two of the following are effective hardening measures? (Choose two.)

Select 2 answers
A.Disable unnecessary services
B.Set file permissions to Everyone: Full Control
C.Remove administrative shares
D.Enable guest account with strong password
E.Use Telnet for remote management
AnswersA, C

Reduces potential attack vectors.

Why this answer

Disabling unnecessary services reduces the attack surface by removing potential entry points for malware or unauthorized access. On Windows Server, services like Print Spooler or Windows Search may be disabled if not needed, as they have historically been exploited (e.g., PrintNightmare). This aligns with the principle of least functionality.

Exam trap

The trap here is that candidates may think removing administrative shares breaks legitimate management tasks, but in reality, modern tools like PowerShell Remoting or Group Policy do not rely on hidden shares, making this a safe and effective hardening step.

Full explanation →
800
Multi-Selectmedium

An organization has detected a ransomware infection on a critical file server. The incident response team has been activated. Which TWO actions should be performed FIRST during the initial response phase?

Select 2 answers
A.Determine the type of ransomware variant
B.Immediately disconnect the file server from the network
C.Reimage the file server using a known good backup
D.Identify all affected systems and scope of infection
E.Notify law enforcement authorities
AnswersB, D

Correct: Immediate containment prevents further encryption or lateral movement.

Why this answer

Immediately disconnecting the file server from the network is a critical containment action that stops the ransomware from encrypting additional files on the server and prevents lateral movement to other systems. This aligns with the first priority in incident response: containment before eradication or recovery. Disconnecting at the switch port or disabling the network interface card (NIC) is preferred over a graceful shutdown to avoid triggering any persistence mechanisms.

Exam trap

ISC2 often tests the misconception that identifying the ransomware variant (Option A) is the first step, but in the SSCP framework, containment (disconnection) and scoping (identifying affected systems) are the immediate priorities during the initial response phase.

Full explanation →
801
Multi-Selectmedium

An organization is implementing a digital signature solution to ensure non-repudiation and integrity of documents. Which three of the following are true regarding digital signatures?

Select 3 answers
A.The receiver uses the sender's private key to verify the signature.
B.The receiver verifies the signature using the sender's public key.
C.The sender encrypts the entire document with their public key to create a signature.
D.Digital signatures provide non-repudiation because the private key is kept secret by the sender.
E.The sender signs the message hash with their private key.
AnswersB, D, E

Verification involves decrypting the signature with the sender's public key and comparing the hash.

Why this answer

Digital signatures involve signing the hash of the message with the sender's private key. They provide non-repudiation because only the sender has the private key. Verification uses the sender's public key.

Full explanation →
802
MCQmedium

A company needs to ensure that when an employee leaves the organization, their accounts are disabled promptly to prevent unauthorized access. Which approach is MOST effective for timely account deactivation?

A.Conduct quarterly access reviews to identify and disable unused accounts.
B.Require managers to report departures via a ticketing system.
C.Implement a self-service password reset system to empower users.
D.Automatically synchronize with the HR system to disable accounts upon termination.
AnswerD

Automated synchronization with HR ensures near-instant deactivation when HR records a termination, significantly reducing the window of unauthorized access.

Why this answer

Automatically synchronizing with the HR system ensures that account deactivation occurs immediately upon termination, eliminating human delay or error. This approach leverages identity lifecycle management (ILM) to enforce the principle of least privilege and prevent unauthorized access through orphaned accounts.

Exam trap

The trap here is that candidates may choose option B because it seems proactive, but they overlook the inherent delay and unreliability of manual reporting compared to automated synchronization, which is the only option guaranteeing timely deactivation.

How to eliminate wrong answers

Option A is wrong because quarterly reviews are too infrequent to meet the requirement for timely deactivation, leaving accounts active for up to 90 days after departure. Option B is wrong because relying on managers to report departures via a ticketing system introduces manual latency and the risk of forgotten or delayed reports, which fails to guarantee prompt deactivation. Option C is wrong because a self-service password reset system does not disable accounts; it only allows users to reset their own passwords, which is irrelevant to deactivating a terminated employee's account.

Full explanation →
803
Multi-Selectmedium

A security analyst is investigating a potential ARP spoofing attack on a local network segment. Which TWO network security controls would be most effective in preventing or detecting such an attack at Layer 2?

Select 2 answers
A.Configure DHCP snooping on switches
B.Use IPsec transport mode between hosts
C.Implement Port Security with MAC address binding
D.Deploy a network-based IDS monitoring ARP traffic
E.Enable Dynamic ARP Inspection (DAI) on switches
AnswersC, E

Port Security limits MAC addresses per port, making it harder for an attacker to spoof multiple IPs.

Why this answer

Dynamic ARP Inspection (DAI) validates ARP packets on trusted ports and drops invalid ones. Port Security with MAC address binding limits the number of MAC addresses per port, reducing the effectiveness of ARP spoofing.

Full explanation →
804
MCQhard

In a federated identity environment using SAML, what is the role of the Identity Provider (IdP) when a user requests access to a service provider (SP)?

A.The IdP hosts the application and enforces access control policies
B.The IdP validates the user's OTP token
C.The IdP generates a Kerberos ticket for the user
D.The IdP authenticates the user and issues a SAML assertion to the SP
AnswerD

Correct. The IdP provides authentication and assertion.

Why this answer

The IdP authenticates the user and issues a SAML assertion containing identity attributes and authorization claims. The SP trusts this assertion to grant access without re-authenticating the user.

Full explanation →
805
MCQmedium

A security administrator is reviewing Linux audit logs to detect unauthorized file access. Which Linux component is primarily responsible for generating these security audit logs?

A.systemd-journald
B.SELinux
C.PAM
D.auditd
AnswerD

auditd is the audit daemon that logs security events.

Why this answer

auditd is the userspace component of the Linux Audit system that writes audit records to disk.

Full explanation →
806
MCQmedium

A security team is conducting a qualitative risk assessment for a new cloud application. They want to prioritize risks based on likelihood and impact. Which method should they use to combine these factors?

A.Risk matrix (heat map)
B.SWOT analysis
C.Annualized loss expectancy (ALE)
D.Business Impact Analysis (BIA)
AnswerA

A qualitative risk matrix uses ordinal scales for likelihood and impact to produce risk ratings.

Why this answer

A risk matrix (heat map) is the correct method because it combines qualitative assessments of likelihood and impact into a single visual grid, allowing the team to prioritize risks by their position in the matrix. This approach is standard for qualitative risk assessments where numerical data is unavailable, as it maps ordinal ratings (e.g., low, medium, high) to a color-coded priority level.

Exam trap

The trap here is that candidates often confuse qualitative risk assessment with quantitative methods like ALE, assuming any combination of likelihood and impact requires numerical calculation, but the question explicitly states 'qualitative', which directly points to a risk matrix.

How to eliminate wrong answers

Option B is wrong because SWOT analysis (Strengths, Weaknesses, Opportunities, Threats) is a strategic planning tool used to identify internal and external factors, not a method for combining likelihood and impact to prioritize risks. Option C is wrong because Annualized Loss Expectancy (ALE) is a quantitative metric (SLE × ARO) that requires numerical values for asset value and frequency, making it unsuitable for a purely qualitative assessment. Option D is wrong because Business Impact Analysis (BIA) focuses on identifying critical business functions and recovery priorities, not on combining likelihood and impact for risk prioritization.

Full explanation →
807
MCQmedium

During a change management process, the Change Advisory Board (CAB) has approved a change to update a critical database server. After implementation, a rollback is necessary due to unforeseen performance issues. What should the change manager do next?

A.Execute the rollback plan and schedule a post-implementation review
B.Leave the server in its current state and escalate to the CAB for a decision
C.Patch the server with the latest updates to resolve the performance issue
D.Submit a new change request for the rollback and await CAB approval
AnswerA

Executing the pre-approved rollback plan is the correct immediate action, followed by a post-implementation review to learn from the failure.

Why this answer

The change was already approved by the CAB, and the rollback plan is a pre-approved contingency within the original change request. Executing the rollback immediately restores service stability, and scheduling a post-implementation review (PIR) captures lessons learned and ensures compliance with the change management policy. This aligns with ITIL best practices, where rollback is part of the implementation plan and does not require a new change request.

Exam trap

The trap here is that candidates mistakenly think any rollback requires a new change request, but the rollback plan is already part of the approved change, so immediate execution is permitted without further CAB approval.

How to eliminate wrong answers

Option B is wrong because leaving the server in a degraded state violates the principle of restoring service as quickly as possible, and escalating to the CAB for a decision introduces unnecessary delay when a pre-approved rollback plan exists. Option C is wrong because patching the server with latest updates is an unapproved change that bypasses the change management process and could introduce further instability or security issues. Option D is wrong because submitting a new change request for the rollback is redundant and inefficient; the rollback plan was already approved as part of the original change, so immediate execution is authorized without additional CAB approval.

Full explanation →
808
Multi-Selecthard

An organization is designing an access control policy for a new system. Which THREE of the following are fundamental principles that should be incorporated? (Choose THREE.)

Select 3 answers
A.Fail-open
B.Least privilege
C.Need-to-know
D.Separation of duties
E.Defense in depth
AnswersB, C, D

Users get minimum necessary permissions.

Why this answer

Least privilege, separation of duties, and need-to-know are core access control principles. Defense in depth is a security strategy, not a principle of access control itself.

Full explanation →
809
MCQhard

A company implements a new policy requiring all privileged access requests to be approved by a manager. However, after deployment, analysts report that they cannot perform emergency changes outside business hours. What is the best solution?

A.Extend manager on-call hours to cover all times.
B.Implement a break-glass procedure for emergency access.
C.Remove the approval requirement for privileged access.
D.Require analysts to call a manager for approval each time.
AnswerB

Break-glass allows temporary privileged access with post-event review, balancing security and availability.

Why this answer

A break-glass procedure provides a predefined, auditable method for granting emergency privileged access without requiring real-time manager approval. This balances security with operational continuity, allowing analysts to perform critical changes outside business hours while maintaining accountability through post-event review and logging.

Exam trap

The trap here is that candidates may choose option A (extending on-call hours) thinking it solves the availability issue, but they fail to recognize that it does not address the fundamental need for immediate, unattended access during emergencies, which is the core purpose of a break-glass procedure.

How to eliminate wrong answers

Option A is wrong because extending manager on-call hours does not eliminate the approval bottleneck; it only shifts the coverage window, potentially leading to delays or burnout without a guaranteed response. Option C is wrong because removing the approval requirement for privileged access eliminates necessary oversight, violating the principle of least privilege and increasing the risk of unauthorized changes. Option D is wrong because requiring analysts to call a manager for approval each time outside business hours creates a single point of failure and introduces unacceptable delays for emergency changes, undermining operational resilience.

Full explanation →
810
MCQeasy

A small company uses a single firewall at the network perimeter. The security team receives alerts from an IDS but cannot correlate them with firewall logs because logs are stored on separate servers with different timestamps. The CEO wants to reduce false positives and improve incident response. What should the security team do first?

A.Increase the IDS sensitivity to catch more threats.
B.Replace the IDS with a next-generation firewall.
C.Implement a SIEM to aggregate and correlate logs from multiple sources.
D.Manually align timestamps on each server daily.
AnswerC

A SIEM centralizes logs and normalizes timestamps, enabling correlation and reducing false positives.

Why this answer

A SIEM (Security Information and Event Management) system aggregates logs from multiple sources, normalizes timestamps, and correlates events to reduce false positives and improve incident response. This directly addresses the core problem of disparate log sources with unsynchronized timestamps, enabling effective correlation between IDS alerts and firewall logs without replacing existing infrastructure.

Exam trap

The trap here is that candidates may think a next-generation firewall (NGFW) replaces the need for log correlation, but NGFWs still generate logs that require aggregation and correlation with other sources to reduce false positives and enable effective incident response.

How to eliminate wrong answers

Option A is wrong because increasing IDS sensitivity would generate more alerts, exacerbating the false positive problem and making correlation harder without fixing the timestamp mismatch. Option B is wrong because replacing the IDS with a next-generation firewall (NGFW) does not solve the log correlation issue; NGFWs still generate logs that need to be correlated with other sources, and the underlying timestamp synchronization problem remains. Option D is wrong because manually aligning timestamps daily is impractical, error-prone, and does not scale; it also fails to provide automated correlation or reduce false positives in real time.

Full explanation →
811
MCQhard

A security analyst discovers that an internal host is sending traffic to an external IP address known to be a command-and-control server. The analyst wants to block only that specific traffic without affecting other traffic. Which firewall rule should be implemented?

A.Deny all traffic from the internal host.
B.Deny all traffic to the external IP.
C.Deny traffic on the specific port used.
D.Deny traffic from the internal host to the external IP.
AnswerD

This provides a targeted block without affecting other traffic.

Why this answer

It creates a specific deny rule that matches only the source IP of the internal host and the destination IP of the command-and-control server, blocking that exact traffic flow while allowing all other traffic to and from both hosts. This is the most precise and least disruptive approach, adhering to the principle of least privilege in firewall rule design.

Exam trap

The trap here is that candidates often choose a broad deny rule (like denying all traffic to the external IP) because they focus on the malicious destination, forgetting that such a rule would block all traffic to that IP from any source, potentially impacting other hosts or services.

How to eliminate wrong answers

Option A is wrong because denying all traffic from the internal host would block all outbound communications from that host, including legitimate traffic to other destinations, causing unnecessary disruption. Option B is wrong because denying all traffic to the external IP would block all inbound and outbound traffic to that IP from any host, potentially affecting other internal hosts that may need to communicate with that IP for legitimate reasons (though unlikely in this scenario, it is overly broad). Option C is wrong because denying traffic on the specific port used would block all traffic on that port to any destination, not just the command-and-control server, which could disrupt other services using the same port.

Full explanation →
812
Multi-Selectmedium

Which TWO of the following are key components of the 3-2-1 backup rule? (Select TWO)

Select 2 answers
A.One copy in the cloud
B.Daily full backups
C.All copies on the same media
D.Two different media types
E.Three copies of the data
AnswersD, E

The '2' in 3-2-1: use two different media types (e.g., disk and tape).

Why this answer

The 3-2-1 backup rule requires three copies of the data (one primary and two backups), stored on two different media types (e.g., disk and tape, or local disk and cloud storage), with one copy kept offsite. Option D is correct because using two different media types ensures that a failure or vulnerability affecting one medium (e.g., ransomware encrypting a disk array) does not compromise the other copy. This diversity is a core principle of the rule, reducing the risk of simultaneous data loss.

Exam trap

The SSCP exam often tests the misconception that the '2' in 3-2-1 refers to two copies of the data rather than two different media types, leading candidates to incorrectly select options like 'All copies on the same media' or to overlook the requirement for media diversity.

Full explanation →
813
MCQmedium

An organization uses a SIEM to alert when a server's configuration changes from its hardened baseline. This is an example of:

A.Deviation detection
B.Patch management
C.Vulnerability scanning
D.Asset management
AnswerA

Correct. Monitoring for changes from baseline is deviation detection.

Why this answer

SIEM alerts on configuration changes from baseline are a form of deviation detection, which is part of configuration management.

Full explanation →
814
Multi-Selectmedium

Which TWO of the following are key components of a security awareness program?

Select 2 answers
A.User training on password policies
B.Regular phishing simulations
C.Incident response drills
D.Quarterly vulnerability scans
E.Annual penetration testing
AnswersA, B

Training users on strong password creation and management is a core awareness component.

Why this answer

A security awareness program focuses on educating users about security policies and threats. Phishing simulations test user vigilance, and password policy training reinforces good practices. Vulnerability scans and penetration tests are technical controls, not awareness components.

Incident response drills involve technical teams, not general user awareness.

Full explanation →
815
MCQmedium

An organization decides to implement CIS Benchmarks on all Windows servers. They choose Level 1 settings. What does Level 1 represent?

A.Maximum security with high operational impact
B.Equivalent to DISA STIGs
C.Only applicable to critical systems
D.Basic security hygiene with minimal impact
AnswerD

Level 1 is intended to be broadly applicable with low disruption.

Why this answer

CIS Benchmarks define Level 1 as a set of configuration settings intended to provide basic security hygiene with minimal impact on business operations. These settings are designed to be easily implemented without causing significant performance degradation or service disruption, making them suitable for most systems. Level 1 focuses on essential security controls that address common vulnerabilities while maintaining system usability.

Exam trap

The trap here is that candidates often confuse Level 1 with 'maximum security' or assume it is only for critical systems, when in fact Level 1 is the baseline recommended for all systems to achieve a practical security posture without disrupting operations.

How to eliminate wrong answers

Option A is wrong because Level 1 is not about maximum security; maximum security with high operational impact is characteristic of Level 2 settings, which may disable features or enforce stricter policies that can affect performance. Option B is wrong because CIS Benchmarks and DISA STIGs are separate frameworks; while they may overlap in some controls, STIGs are typically more restrictive and aligned with U.S. Department of Defense requirements, not equivalent to CIS Level 1.

Option C is wrong because Level 1 is explicitly designed for general-purpose systems, not only critical systems; critical systems often require Level 2 or additional custom hardening.

Full explanation →
816
MCQmedium

A security analyst receives an alert that a user account has been locked out multiple times within 10 minutes. The analyst checks the account and finds it is a service account used for automated backups. What is the most likely cause?

A.The service account's certificate has expired.
B.A brute force attack is targeting the service account.
C.The account password has expired and needs to be reset.
D.The service is using cached credentials that are out of sync with the domain controller.
AnswerD

Service accounts often cache credentials; if the password changes or becomes out of sync, repeated lockouts occur.

Why this answer

Service accounts used for automated backups typically run as services that cache their credentials locally. When the password is changed on the domain controller, the cached credentials in the service's logon session become out of sync. The service repeatedly attempts to authenticate with the stale cached password, causing rapid lockout events within a short window.

Exam trap

The trap here is that candidates confuse a service account lockout with a brute force attack, but the pattern of rapid lockouts from the same source with no external IP variation points to cached credential mismatch, not an active attack.

How to eliminate wrong answers

Option A is wrong because certificate expiration would cause authentication failures, but not repeated lockouts; the service would fail to authenticate silently without triggering account lockout policy. Option B is wrong because a brute force attack would show multiple failed attempts from different IPs or sources, not a single service account locking out repeatedly from the same host. Option C is wrong because password expiration prevents the account from logging in at all, but the service would not repeatedly attempt authentication; it would fail once and stop, not generate multiple lockouts.

Full explanation →
817
MCQmedium

An organization uses a PKI with a root CA that issues certificates to intermediate CAs, which then issue end-entity certificates. A client receives an end-entity certificate signed by an intermediate CA. During validation, which certificates are required to build the chain of trust?

A.Only the root CA certificate
B.End-entity certificate, intermediate CA certificate, and root CA certificate
C.Only the end-entity certificate and the root CA certificate
D.Only the end-entity certificate and the intermediate CA certificate
AnswerB

All three are required to validate the chain from end-entity to the trusted root.

Why this answer

In a PKI hierarchy, the chain of trust requires each certificate in the path to be validated up to a trusted root. The client must have the end-entity certificate, the intermediate CA certificate (to verify the end-entity's signature), and the root CA certificate (to verify the intermediate CA's signature). Without the intermediate CA certificate, the client cannot cryptographically link the end-entity to the root, breaking the chain.

Exam trap

The trap here is that candidates often assume the root CA directly signs all certificates, forgetting that intermediate CAs are used in practice, so they incorrectly select Option C or D, missing the need for the full chain.

How to eliminate wrong answers

Option A is wrong because the root CA certificate alone cannot verify the end-entity certificate's signature, which was issued by the intermediate CA, not the root. Option C is wrong because omitting the intermediate CA certificate leaves a gap in the chain; the client cannot validate the intermediate CA's signature on the end-entity certificate. Option D is wrong because without the root CA certificate, the client cannot verify the intermediate CA certificate's signature, so the chain of trust cannot be anchored to a trusted root.

Full explanation →
818
Multi-Selectmedium

An organization uses Linux servers and wants to implement mandatory access control (MAC) to enhance security. Which TWO technologies can be used? (Select TWO.)

Select 2 answers
A.SELinux
B.iptables
C.AppArmor
D.auditd
E.PAM (Pluggable Authentication Modules)
AnswersA, C

SELinux enforces MAC policies based on labels.

Why this answer

SELinux and AppArmor are Linux security modules that provide MAC. iptables is a firewall, not MAC. PAM is for authentication. auditd is for auditing.

Full explanation →
819
MCQhard

A Windows workstation is unable to authenticate to a Kerberos-based application. The time on the workstation is 5 minutes ahead of the domain controller. What is the impact?

A.The user would be prompted for credentials but authentication would proceed
B.Authentication will fail because the time difference exceeds the default Kerberos clock skew limit
C.Only NTLM authentication would be affected
D.No impact; Kerberos can tolerate up to 10 minutes of skew
AnswerB

Kerberos allows a maximum skew of 5 minutes by default; a 5-minute difference may cause rejection or succeed only if within tolerance.

Why this answer

Kerberos authentication relies on timestamps to prevent replay attacks. The default maximum clock skew allowed between a client and a domain controller is 5 minutes (as defined in RFC 4120). Since the workstation is exactly 5 minutes ahead, it meets the threshold, but any additional delay or network latency can cause the timestamp to exceed the limit, resulting in authentication failure.

Therefore, the user will be unable to authenticate.

Exam trap

The trap here is that candidates often assume the default clock skew is 10 minutes (as in some older implementations) or that a 5-minute difference is acceptable, but the SSCP exam expects you to know the exact default value of 5 minutes and that reaching that limit causes authentication to fail.

How to eliminate wrong answers

Option A is wrong because Kerberos does not prompt for credentials and proceed when the clock skew exceeds the limit; it returns a KRB_AP_ERR_SKEW error and authentication fails. Option C is wrong because the question specifies a Kerberos-based application, and NTLM is a separate protocol that is not directly affected by Kerberos clock skew; the impact is on Kerberos, not NTLM. Option D is wrong because the default Kerberos clock skew limit is 5 minutes, not 10 minutes; a skew of exactly 5 minutes is at the boundary and typically causes failure, especially with real-world network delays.

Full explanation →
820
MCQmedium

A system administrator receives a report that a critical server is running low on disk space. After investigation, it is determined that the log files are not being rotated properly. Which of the following is the BEST solution to prevent this issue in the future?

A.Configure log rotation based on size and age.
B.Increase the maximum log file size.
C.Redirect logs to a different partition.
D.Enable compression on the log folder.
AnswerA

Log rotation automatically archives and deletes old logs.

Why this answer

Implementing log rotation policies ensures logs are archived and space is managed. Option B only adjusts size limit but doesn't rotate. Option C is for applications, not system logs.

Option D does not reduce space usage.

Full explanation →
821
MCQmedium

A security team discovers that an employee's credentials were used to access the HR database from an unrecognized IP address in a foreign country. The employee is currently in the office. Which risk identification technique is most directly responsible for detecting this anomaly?

A.User and entity behavior analytics (UEBA)
B.Manual log review
C.Vulnerability scanning
D.Threat intelligence feeds
AnswerA

UEBA detects deviations from normal behavior, such as login from unusual location.

Why this answer

UEBA is the correct answer because it uses machine learning and statistical models to establish a baseline of normal user behavior (e.g., typical login times, geolocations, and access patterns). When the employee's credentials are used from a foreign IP address while the employee is physically in the office, UEBA detects this as an anomalous deviation from the baseline, triggering an alert. This technique is specifically designed for real-time anomaly detection in user and entity activities, making it the most direct method for identifying this type of credential misuse.

Exam trap

The trap here is that candidates may confuse threat intelligence feeds (Option D) with anomaly detection, assuming that an unrecognized foreign IP would be flagged by a threat feed, but UEBA is the only technique that directly detects behavioral anomalies without relying on known-bad indicators.

How to eliminate wrong answers

Option B (Manual log review) is wrong because it is a reactive, labor-intensive process that relies on human analysts to sift through logs after an incident, making it inefficient for real-time anomaly detection; it would not directly detect the anomaly without prior suspicion or automated correlation. Option C (Vulnerability scanning) is wrong because it focuses on identifying known security weaknesses in systems (e.g., unpatched software, misconfigurations) rather than monitoring user behavior or detecting anomalous access patterns. Option D (Threat intelligence feeds) is wrong because they provide information about known malicious IPs, domains, or indicators of compromise (IOCs) from external sources, but they do not establish a baseline of normal user behavior; an unrecognized IP from a foreign country may not be in any threat feed, so the anomaly would be missed without behavioral analysis.

Full explanation →
822
MCQeasy

During a qualitative risk analysis, an organization rates the likelihood of a flood as 'Low' and the impact as 'High'. Using a standard 3x3 risk matrix, what is the overall risk rating?

A.High
B.Critical
C.Medium
D.Low
AnswerC

Low likelihood and High impact map to Medium risk in most qualitative matrices.

Why this answer

In a standard 3x3 risk matrix, the overall risk rating is derived by combining the likelihood and impact ratings. With likelihood rated as 'Low' and impact as 'High', the intersection in the matrix typically yields a 'Medium' risk rating. This is because the matrix is designed to balance low probability events with high consequences, resulting in a moderate overall risk level.

Exam trap

The trap here is that candidates may incorrectly assume that a 'High' impact automatically results in a 'High' overall risk, ignoring the moderating effect of a 'Low' likelihood in a standard 3x3 matrix.

How to eliminate wrong answers

Option A is wrong because 'High' would require both likelihood and impact to be rated as 'High', or at least one to be 'High' with the other 'Medium' in some matrices, but here likelihood is 'Low'. Option B is wrong because 'Critical' is not a standard rating in a 3x3 risk matrix; such matrices typically use Low, Medium, and High. Option D is wrong because 'Low' would require both likelihood and impact to be 'Low', or likelihood 'Low' with impact 'Low' or 'Medium', but impact is 'High', which elevates the risk above 'Low'.

Full explanation →
823
MCQhard

A company's IDS generated an alert for a suspicious outbound connection to a known C2 server. The incident team discovers the host has been communicating for 2 weeks. Which containment strategy is most appropriate?

A.Perform memory forensics before disconnecting
B.Block the C2 IP at the perimeter
C.Shut down the host
D.Disconnect the host from the network immediately
AnswerA

Memory capture preserves evidence of running processes and network connections.

Why this answer

Performing memory forensics before disconnecting (A) is the most appropriate containment strategy because the host has been compromised for two weeks, meaning the attacker may have deployed rootkits, injected malicious code into system processes, or established persistence mechanisms that reside only in volatile memory. Disconnecting or shutting down the host immediately would destroy this volatile evidence, hindering the incident response team's ability to identify the full scope of the compromise, including the specific malware variant, C2 communication methods, and any lateral movement artifacts. Memory forensics allows the team to capture running processes, network connections, and loaded kernel modules, which are critical for understanding the attacker's tactics and preventing future incidents.

Exam trap

The trap here is that candidates often choose immediate disconnection (D) or IP blocking (B) as a quick containment action, failing to recognize that preserving volatile evidence is a higher priority in a long-term compromise to ensure a complete forensic analysis and effective remediation.

How to eliminate wrong answers

Option B is wrong because simply blocking the C2 IP at the perimeter is a reactive network-level control that does not address the already compromised host; the attacker may have multiple fallback C2 domains or IPs, and the host could still be used for lateral movement or data exfiltration via other channels. Option C is wrong because shutting down the host destroys volatile memory evidence and may trigger anti-forensic mechanisms that wipe logs or encrypt data, while also potentially alerting the attacker that their presence is known. Option D is wrong because disconnecting the host immediately without first performing memory forensics loses critical volatile data such as active network connections, encryption keys in memory, and running malicious processes, which are essential for a thorough investigation and attribution.

Full explanation →
824
MCQeasy

Which metric is used to measure the potential loss from a single occurrence of a risk?

A.Exposure Factor (EF)
B.Annualized Loss Expectancy (ALE)
C.Annualized Rate of Occurrence (ARO)
D.Single Loss Expectancy (SLE)
AnswerD

SLE is the monetary loss from a single occurrence.

Why this answer

The Single Loss Expectancy (SLE) is the metric used to measure the potential loss from a single occurrence of a risk. It is calculated as Asset Value (AV) multiplied by the Exposure Factor (EF), providing a dollar value for one incident. This directly answers the question of loss per single event.

Exam trap

ISC2 often tests the distinction between SLE and ALE, trapping candidates who confuse a single-event loss with an annualized figure, especially when the question explicitly asks for 'single occurrence' but the answer options include ALE as a distractor.

How to eliminate wrong answers

Option A is wrong because Exposure Factor (EF) is a percentage representing the proportion of asset value lost per incident, not a direct monetary loss measure. Option B is wrong because Annualized Loss Expectancy (ALE) measures the expected loss per year, calculated as SLE × ARO, not per single occurrence. Option C is wrong because Annualized Rate of Occurrence (ARO) is a frequency metric (events per year), not a loss measurement.

Full explanation →
825
MCQhard

A security administrator is prioritizing patches for a vulnerability with a CVSS score of 9.8 that is being actively exploited in the wild. The affected server has a low criticality classification. What should the administrator do?

A.Apply the patch immediately without change management
B.Ignore the patch because the server is low criticality
C.Wait for the next scheduled patch cycle
D.Prioritize patching via the change management process
AnswerD

Correct. The high severity and exploitation warrant prioritization even for low criticality assets.

Why this answer

Even though the asset criticality is low, the high CVSS score and active exploitation increase the risk. The patch should be prioritized and deployed through the change management process.

Full explanation →
Page 10

Page 11 of 13

Page 12

All pages

12345678910111213

Practice SSCP by domain

Target a specific domain to shore up weak areas.

Access ControlsRisk Identification, Monitoring, and AnalysisIncident Response and RecoverySecurity Operations and AdministrationCryptographyNetwork and Communications SecuritySystems and Application Security
See all domains with question counts →