Systems Security Certified Practitioner SSCP (SSCP) — Questions 751–825

SSL/TLS VPN tunnels over TCP 443, so it traverses existing firewall rules without opening extra ports, satisfying that constraint. It supports strong encryption and mutual authentication through client certificates, letting the organisation verify both user and server identities during the remote access session.

A ping sweep involves sending ICMP echo requests to multiple IP addresses to determine which hosts are active. This is a common reconnaissance technique used to map a network. The scenario describes ICMP echo requests from a single source to multiple destinations, which is characteristic of a ping sweep. Thus, it is the most likely attack.

EDR network isolation severs the workstation's connections while preserving the agent's management channel and volatile evidence, halting command-and-control traffic and potential lateral movement. This contains the confirmed compromise immediately, before the still-logged-in user or malware can cause further damage.

RPO defines the maximum tolerable data loss measured in time, so four hours means the recovery point may lose up to four hours of transactions. RTO defines the maximum acceptable downtime, so the database must be operational again within 24 hours of disruption.

Network flow logs record byte and packet counts per connection, exposing volumetric anomalies such as unusually large outbound transfers that endpoint or application logs would miss. This directly satisfies the SIEM's requirement to detect data exfiltration by revealing the volume and destination of traffic leaving the network, independent of payload content.

The IdP authenticates users against the corporate Active Directory and issues signed SAML assertions to the SaaS relying party, satisfying the requirement that existing credentials be reused. Without it, no trusted authority exists to vouch for user identity, so federation cannot occur.

Differential backups capture everything changed since the last full backup, so restoration must begin with that full backup as the base. Sunday's full backup is the correct starting point; Tuesday's differential is then applied on top to reach Wednesday's state.

This is the no read up rule, a core principle of MAC for confidentiality. It ensures that a subject cannot access information above their clearance level, preventing unauthorized disclosure. The auditor must confirm this is enforced, as it is fundamental to MAC's confidentiality model and directly supports the no read up requirement.

SELinux enforces mandatory access control through type enforcement, role-based access control and multi-level security, applying kernel-level policy labels that constrain every process and file regardless of user discretion. AppArmor and standard permissions do not provide the same comprehensive MAC model on Linux.

A post-implementation review closes the change management lifecycle by verifying the change achieved its intended outcome and identifying any unanticipated effects. It is a recognised procedural step, distinct from implementation itself, and satisfies the stem's requirement for a valid change process stage.

SNMPv1 authenticates requests solely via community strings, which travel unencrypted across the wire. Any packet capture exposes them, granting read or read-write access to device MIBs. This cleartext exposure, absent in SNMPv3's authentication and encryption, is the primary concern for the legacy monitoring setup.

DSA is a FIPS-approved asymmetric algorithm designed solely for digital signatures, relying on the discrete logarithm problem over finite fields. It satisfies the stem's requirement directly, generating signatures through a per-message random value k rather than supporting encryption.

Checking change management records and on-call schedules provides context to determine if the access was planned or expected. This is a non-intrusive first step that can quickly validate or refute the need for further investigation. It preserves evidence and avoids disrupting operations prematurely.

Setting a seven-year retention with automatic purge directly enforces the documented policy and limits unnecessary data exposure. It satisfies legal hold requirements during the retention window while reducing storage and breach impact afterward. This is the corrective action that brings technical controls in line with the approved data retention policy.

The home domain authenticates the user and issues the assertions the partner domain consumes, so it acts as the Identity Provider (IdP). The partner domain is the relying party or service provider that trusts those assertions.

Retina scan is a biometric trait.

Risk acceptance is the deliberate decision to retain a risk because the cost of mitigation outweighs the benefit and the exposure is within the organization's risk tolerance. Documenting the rationale, the approving authority, and a review date keeps the decision auditable and ensures it is revisited if conditions change.

WPA2-Enterprise with 802.1X provides strong, certificate-based or credential-based authentication for each device or user before network access is granted. It ensures that only authorized devices with valid credentials can connect, and it supports dynamic key management. This meets the requirement for strict device authorization.

DNS queries and responses use UDP port 53, whose connectionless datagram model avoids handshake overhead and suits the short request-response exchanges typical of name resolution. This satisfies the requirement for a fast transport matching DNS's small, self-contained message pattern.

Just-in-time provisioning grants elevated privileges only for the duration of a specific task, then automatically revokes them. This directly satisfies the PAM requirement for temporary, task-scoped access, eliminating standing privileges that attackers could exploit. Microsoft Entra ID Privileged Identity Management implements this through time-bound role activation, requiring justification and approval before elevation.

A hardware interlock is a physical control that couples system operation to the presence of a specific object, so the workstation runs only with the approved device inserted and stops the moment it is withdrawn. This directly satisfies both halves of the policy without relying on software that could be bypassed.

A Network IDS (NIDS) passively inspects packets traversing a network segment, matching them against signatures to identify malicious patterns. This placement and packet-analysis capability is exactly what the stem describes, distinguishing it from host-based monitoring.

The parameter contains SQL syntax designed to drop a table, which is characteristic of a SQL injection attack.

SAML exchanges XML-based assertions between identity and service providers, enabling browser-based single sign-on across security domains. It directly satisfies the stem's requirement for federated authentication using corporate credentials at a partner's cloud application, with the identity provider issuing signed assertions the partner's application validates and trusts.

Requesting a replacement certificate from the same trusted CA before expiry maintains an unbroken chain of trust, since the root remains trusted and the new certificate is issued under it. Allowing expiry would break code-signing validation for newly signed software.

RADIUS clients and servers authenticate each other using a shared secret. If the shared secret on the VPN concentrator does not match the one configured on the RADIUS server, authentication requests will be rejected. The logs indicating a shared secret mismatch point directly to this configuration error on the new device.

Classification labels data by sensitivity, so controls such as encryption, access restrictions and handling rules can be applied proportionately. This directly satisfies the objective of identifying which assets are sensitive and protecting them, rather than treating all data with identical, costly controls.

Click rate on simulated phishing links directly measures whether employees apply the training, since clicking is the behaviour the programme targets. It satisfies the stem's effectiveness requirement by quantifying real susceptibility rather than completion or awareness, which do not prove reduced phishing success.

Resetting the password immediately invalidates the stolen credentials, cutting off the attacker's authenticated access before they can pivot or exfiltrate further. This directly satisfies the containment phase's goal of limiting damage while the phishing incident is still active.

CSPM continuously assesses cloud configuration against benchmarks and compliance baselines, detecting misconfigured storage, network and logging settings. It satisfies the stem's design requirement by addressing the misconfiguration risk inherent to public cloud, where provider-managed infrastructure removes traditional perimeter controls.

A CMDB provides the authoritative repository for hardware assets, recording serial numbers, locations and configuration items with their relationships. It directly satisfies the requirement to track all hardware assets, unlike an asset inventory limited to listing, because the CMDB maintains configuration item attributes and interdependencies across the IT estate.

UBA baselines each user's normal activity, then flags statistically significant deviations such as unusual access times, volumes or data transfers. This satisfies the requirement to identify abnormal user behaviour indicative of insider threat, which signature-based tools cannot detect.

Preparation is the first phase, involving planning and training.

WPA2-Enterprise implements IEEE 802.1X, which uses a supplicant on the client, an authenticator (the access point), and an authentication server (typically RADIUS). This allows for centralized authentication and per-user or per-device credentials, ensuring that only authorized devices can connect. It meets the requirement of using the three-party model and provides strong security for enterprise wireless networks.

Risk registers become unreliable when controls are recorded but their effect is never measured. Reassessing likelihood and impact with the control operating provides an evidence-based residual rating, confirms whether the treatment achieved its objective, and keeps decisions aligned with actual exposure. This is the core feedback loop of risk monitoring and analysis.

Input validation and parameterised queries remove the injection vector, so the SQL injection risk is reduced rather than transferred, avoided or accepted. Mitigation lowers likelihood or impact to a tolerable level, matching the stem's requirement to reduce risk to an acceptable level.

Least privilege requires that an account hold only the access needed for current job duties. Since the employee remains with the company but changed roles, the existing identity should be retained and its entitlements adjusted by adding payroll access and removing accounts payable access. This keeps the account lifecycle accurate and prevents accumulation of unnecessary privileges.

Isolating the infected workstation from the network is the immediate priority in the containment phase to prevent the ransomware from spreading to shared drives and other systems. Disconnecting the network stops lateral movement and further encryption of network resources, while preserving the local state for later forensic analysis. This aligns with NIST SP 800-61 guidance to limit the scope and magnitude of the incident before proceeding with eradication and recovery.

Scheduled collection and review of audit logs from critical systems is a core continuous monitoring activity because it provides evidence that controls are operating and reveals deviations such as failed logins, privilege changes, and configuration edits. Without a defined review cadence, logs accumulate unread and incidents go unnoticed. This activity directly supports both security detection and compliance evidence requirements.

The Ticket-Granting Ticket is obtained at initial authentication and used to request service tickets. If it expires, subsequent access to the network share fails with a ticket expired error, matching the stem's symptom after password entry.

A risk register records each identified risk, its owner, score and chosen treatment, providing an auditable trail that supports tracking through to closure or acceptance. It is not a control catalogue or incident log; its purpose is documenting and monitoring risk treatment decisions over time.

Least privilege requires granting only the access needed to perform a role's duties. A service account holding domain administrator rights far exceeds its operational requirements, so the excessive privilege violates that principle, regardless of authentication or separation-of-duties controls.

Password history enforces the no-reuse constraint by storing hashes of prior passwords and rejecting any new one matching the last 10 entries. This directly satisfies the stem's requirement that users cannot reuse recent passwords, distinct from complexity, length, or expiry settings.

A Smurf attack involves sending ICMP echo requests to a broadcast address with a spoofed source IP (the victim's IP). All hosts on the subnet respond to the victim, amplifying the traffic and causing a denial of service. This matches the scenario exactly.

Multi-factor authentication satisfies the auditor's requirement by adding a second verification factor beyond the password, defeating credential-stuffing and stolen-password attacks against the VPN gateway. Even if an attacker captures valid domain credentials, the missing second factor blocks authentication. Microsoft Entra ID Conditional Access can enforce MFA specifically for VPN sign-ins.

Authentication is the process of verifying a claimed identity by checking the supplied credential against the stored one. Here, the system compares the password against the record for 'jsmith', confirming the user is who they claim to be. This directly satisfies the stem's requirement to verify the password matches the one on file.

MAC decisions are enforced by the operating system against a central policy, not by object owners' discretion. The stem's policy-based enforcement is the defining characteristic: subjects cannot override or delegate access, distinguishing MAC from discretionary models.

Allowing all outbound traffic by default lets malware establish command-and-control channels and exfiltrate data without being blocked, since the firewall only inspects inbound connections. Restricting outbound to required destinations satisfies the least-permission constraint for egress.

RBAC grants access solely through role membership, not account state or connectivity. Since the account is enabled and the server reachable, the missing required role assignment is the only remaining cause of the access denial.

Separation of duties splits a sensitive transaction across different people so no single individual controls it end to end. Preventing the same person from creating and approving a purchase order enforces exactly this, directly satisfying the stem's described policy control.

Deploying a WAF rule reduces the likelihood or impact of exploitation while the underlying flaw remains unpatched, so the risk is lowered rather than transferred, avoided or accepted. This directly satisfies the stem's constraint that patching is blocked by production compatibility issues.

Scanning restored systems with current antivirus and anti-malware signatures detects any residual malware, backdoors or dormant payloads the ransomware may have left behind. This directly satisfies the stem's requirement to verify systems are clean before returning them to production.

Unattended documents, unlocked screens and exposed media let anyone with physical access copy or photograph sensitive data. A clean desk policy removes that opportunistic exposure, directly lowering the likelihood of a data breach rather than merely improving tidiness or audit compliance.

Internal RFC 1918 address 10.0.0.1 initiating outbound sessions to public 203.0.113.5 indicates a web server communicating with an external host, consistent with command-and-control or data exfiltration traffic crossing the perimeter. The private-to-public direction satisfies the stem's internal/external constraint, making exfiltration the most likely issue.

The svc_backup account's stored password no longer matches the domain, so the backup application's scheduled tasks repeatedly authenticate with stale credentials, triggering lockouts. Updating the password and reconfiguring the application restores successful authentication and stops the failed logon attempts.

Egress filtering from the DMZ prevents a compromised host from freely reaching internal systems, so an attacker cannot pivot broadly. By allowing only the specific internal destinations and ports that the service legitimately needs, the administrator contains the blast radius. This is a core principle of DMZ design and directly limits lateral movement.

Capturing volatile data like memory and logs while the systems are still running preserves critical evidence about the attacker's tools, credentials, and network connections. Isolating the servers prevents further damage without destroying evidence. This approach aligns with incident response best practices by balancing containment and forensic preservation, enabling the team to determine initial access and exfiltration methods before restoring from backups.

Firewalls enforce segmentation by inspecting traffic and permitting or denying flows between network zones according to rule sets, so sensitive-data segments stay isolated from untrusted areas. They satisfy the stem's requirement for an effective segmentation method by providing policy-based control at zone boundaries.

Disabling unnecessary services and ports reduces the attack surface by removing exploitable daemons and listening sockets from the new server. This satisfies the stem's requirement for an essential secure configuration baseline component, since unused services are a primary initial-access vector.

Access control proceeds by first claiming an identity, then proving it, then granting rights, then logging activity. Accountability depends on the prior identification and authentication steps, so this sequence reflects the actual dependency chain rather than any reordering of the four stages.

Perfect forward secrecy is achieved when each session key is derived from a fresh Diffie-Hellman exchange rather than from a long-term key. In IKEv2, using a DH group for the IKE SA and a distinct DH group for the CHILD_SA ensures that compromise of the IKE SA key does not compromise the IPsec session keys. This provides the required PFS.

ABAC evaluates attributes of the subject, object, action, and environment, which maps directly to department, data classification, time of day, and patient admission status. Policies written as boolean rules can require all conditions to be true before granting access, delivering the fine-grained, context-aware decisions this scenario demands. This makes ABAC the appropriate model for combining multiple dynamic factors into one authorization decision.

A user reporting mechanism detects phishing attempts when recipients flag suspicious emails, enabling the security team to investigate and respond. It satisfies the scenario's need for a detective control by identifying incidents that bypass preventive filters, rather than blocking them outright. Reporting provides the visibility required to confirm an active phishing campaign.

Disabling DTP prevents an attacker from negotiating a trunk on an access port, and moving unused ports out of the default VLAN removes a common double-tagging target. This preserves legitimate trunks on trusted links while closing the two main VLAN hopping vectors: switch spoofing and double tagging against the native VLAN.

DHCP snooping classifies switch ports as trusted or untrusted, permitting DHCP server replies only via trusted ports. Rogue or unauthorised DHCP servers on untrusted ports are blocked, satisfying the requirement that only authorised servers assign addresses.

The Group Policy setting "Deny log on through Remote Desktop Services" explicitly removes the Remote Desktop logon right from the named accounts or groups. Adding Backup Operators to this policy therefore blocks those members from establishing RDP sessions, directly satisfying the exhibit's configured restriction.

DAC grants the resource owner discretion over access decisions, so they assign permissions directly to other subjects. This owner-controlled permission assignment is precisely the mechanism the stem requires, distinguishing DAC from mandatory and role-based models where policy or roles dictate access.

RADIUS accounting logs record session start and stop times, as well as the network access server and assigned IP address. Reviewing these logs first can reveal whether two simultaneous sessions were actually established and from which devices. This directly addresses whether the logins are concurrent and helps distinguish a legitimate session from credential theft.

Hybrid encryption solves the multi-user key distribution constraint: the file's symmetric key is wrapped individually with each authorised user's public key, so any of them can unwrap it with their private key. No shared symmetric secret is required, preserving confidentiality and access control.

Risk transference shifts the financial impact of a risk to a third party, typically through insurance or contractual agreements. By purchasing cyber insurance, the firm transfers the monetary loss from a breach to the insurer while still retaining the operational and reputational risk. This matches the scenario precisely, as the firm is not reducing the likelihood but is offsetting the financial burden.

Under mandatory access control, the system compares the document's classification label with the user's clearance and enforces the no-read-up rule. Secret clearance cannot read Top Secret, so the reference monitor denies access regardless of the user's need or intent.

A hardware random number generator derives entropy from physical phenomena, producing non-deterministic output. Software generators are deterministic algorithms, so only a hardware source satisfies the requirement for a truly random seed for cryptographic key generation.

Beyond initial documentation, the register is maintained to track each risk treatment plan's progress, status and residual risk. This ongoing tracking satisfies the stem's requirement, ensuring treatments are actioned and monitored rather than merely listed.