Systems Security Certified Practitioner SSCP (SSCP) — Questions 751–825

Option C is correct because the initialization vector (IV) in CBC mode ensures that each encryption of the same plaintext with the same key produces a different ciphertext. The IV is XORed with the first plaintext block before encryption, introducing randomness that prevents patterns from being exposed in the ciphertext, which is critical for semantic security.

SAML uses XML assertions to exchange authentication and authorization data between an IdP and an SP.

Documenting all actions taken (Option A) is a fundamental principle of digital forensics, as it creates a verifiable chain of custody and ensures the integrity of evidence. This documentation includes timestamps, tools used, and any changes made to the system, which is critical for admissibility in legal proceedings. Without proper documentation, the evidence may be challenged as tampered or unreliable.

According to the NIST incident response lifecycle, the first priority is containment. Isolating the workstation from the network stops communication with the command-and-control server while preserving volatile data (e.g., memory, running processes, network connections) for forensic analysis. Powering off would destroy this critical evidence, and running a scan or waiting for instructions delays containment and risks further compromise.

Password complexity and account lockout are standard best practices. Storing passwords in plaintext and reusing passwords are poor practices.

B is correct because salting ensures that each password hash is unique even if two users have the same password, preventing precomputed rainbow table attacks. A salt is a random value concatenated with the password before hashing, and it must be stored alongside the hash for verification.

SYN cookies avoid resource exhaustion by not allocating memory until the handshake completes, and increasing the backlog queue allows more half-open connections before reaching capacity.

Privilege creep occurs when users accumulate more permissions over time than they need for their current role, often through group memberships. In this scenario, the user was added to a new group that granted read/write access to a shared drive, resulting in unintended elevated access. This is a classic example of privilege creep because the user's access rights expanded beyond what was originally authorized, violating the principle of least privilege.

Failure to test patches in a staging environment can lead to instability when deployed to production.

SSL/TLS VPNs (e.g., Cisco AnyConnect) operate over port 443 (HTTPS), which is commonly allowed through firewalls, and provide strong encryption and authentication.

The first priority is to contain the incident by isolating the endpoint to prevent further communication. EDR agents often have a feature to isolate the host from the network immediately.

Implementing multi-factor authentication (MFA) on the CEO's account prevents attackers from using stolen credentials to send phishing emails. Option A is training, which is important but does not stop the current vector; B is a long-term policy; D is a technical control but does not prevent the initial account compromise.

Option A is correct because RPO (Recovery Point Objective) defines the maximum acceptable data loss measured in time, meaning up to 4 hours of transactions could be lost. RTO (Recovery Time Objective) defines the maximum acceptable downtime, meaning the database must be fully operational within 24 hours after a disaster.

Network flow logs (e.g., NetFlow) are critical because they provide metadata about all network conversations, including source/destination IPs, ports, protocols, and byte counts. By analyzing flow records, a SIEM can detect anomalous spikes in outbound traffic volume or connections to unusual external hosts, which are strong indicators of data exfiltration. NetFlow does not inspect packet payloads, but its aggregated traffic patterns make it ideal for identifying large-scale transfers.

SAML federation requires an Identity Provider (IdP), a Service Provider (SP), and trust between them. The IdP authenticates the user and sends an assertion to the SP via an HTTP redirect.

The correct restoration order is to first restore the Sunday full backup, because differential backups contain all changes since the last full backup. Without the full backup as a base, the differential backups cannot be applied. After restoring the full backup, you would then apply the most recent differential backup (Wednesday) to bring the data to the point just before the attack.

SELinux and AppArmor are Linux security modules that implement mandatory access control policies beyond traditional discretionary access control.

A post-implementation review is a valid step in the change management process because it evaluates whether the change met its objectives, identifies any issues, and captures lessons learned. This review typically occurs after the change has been implemented and verified, ensuring that the change was successful and that any unintended consequences are documented.

ESP in tunnel mode encrypts and authenticates the entire original IP packet, providing confidentiality, integrity, and authentication for the entire payload. It also includes sequence numbers to protect against replay attacks, making it the correct choice for a secure WAN link between two offices.

SNMPv1 transmits community strings (effectively passwords) in cleartext over the network. An attacker capturing network traffic can directly read the community string and gain unauthorized access to SNMP-managed devices. This lack of confidentiality is the primary security concern because it exposes the entire monitoring infrastructure to compromise.

RSA, ECDSA, and DSA are all capable of digital signatures. AES is symmetric and not for signatures; SHA-256 is a hash function.

In federated identity, the Identity Provider (IdP) is the home domain that authenticates the user and issues assertions. The Service Provider (SP) trusts the IdP's authentication.

In Kerberos, the Authentication Service (AS) within the Key Distribution Center (KDC) authenticates users and issues TGTs. The Ticket Granting Service (TGS) issues service tickets later.

Retina scan is a biometric authentication method because it uses unique physiological characteristics of the eye's retinal blood vessel pattern to verify identity. Biometric authentication relies on measurable biological traits, and the retina's pattern is highly distinctive and difficult to replicate, making it a strong form of authentication.

The 3-2-1 backup rule mandates at least three copies of the data (one primary and two backups) to ensure redundancy against failures. Option D directly states this requirement, which is the '3' in the rule.

Option A is correct because high-severity vulnerabilities typically require remediation within 30 days to balance risk reduction with operational feasibility. This aligns with common industry frameworks like PCI DSS and NIST SP 800-53, which recommend 30-day SLAs for high-risk findings to prevent exploitation while allowing time for patching cycles.

DNS primarily uses UDP for its fast, low-overhead queries. TCP is used for zone transfers or when responses exceed 512 bytes.

Windows Firewall: create inbound rule for port 3389, allow connection, select profiles, name it.

Option D is correct because both A and C represent typical web browsing sessions: A uses HTTP on port 80, and C uses DNS on port 53, which is essential for resolving domain names before a web request can be made. Web browsing inherently involves DNS queries to translate hostnames to IP addresses, making both sessions part of the browsing activity.

Just-in-time (JIT) provisioning grants temporary privileges as needed, reducing the risk of standing privileges.

A Network Intrusion Detection System (NIDS) is specifically designed to monitor traffic on a network segment, capturing packets in real time and analyzing them for known attack signatures or anomalous patterns. Unlike host-based systems, NIDS operates at the network layer, inspecting headers and payloads to detect malicious activity such as port scans, DoS attacks, or exploit attempts.

SAML uses XML-based assertions to exchange authentication and authorization data between an identity provider and a service provider.

Mean time to remediate (MTTR) critical vulnerabilities directly measures how quickly the organization closes the window of exposure for the highest-risk flaws. This KPI reflects the efficiency of the remediation workflow—from detection through patching or compensating control deployment—and is a standard metric in frameworks like NIST SP 800-40 and the CVSS scoring system. A lower MTTR indicates a more effective vulnerability management process because it reduces the time attackers have to exploit known weaknesses.

The correct procedure is to request a new certificate from the same trusted root CA before the current certificate expires. This ensures that the new certificate is signed by the same trusted root, maintaining the chain of trust without interruption. Continuing to use an expired certificate would break trust validation, as clients and operating systems reject expired code-signing certificates to prevent execution of untrusted code.

Kerberos uses tickets for SSO, SAML provides federated SSO with XML assertions, and OAuth 2.0 is an authorization framework often used for SSO. Biometrics and PKI are not SSO technologies themselves.

Data classification is a foundational security control that directly supports the identification and protection of sensitive information. By categorizing data based on its sensitivity and criticality, organizations can apply appropriate security controls, such as access controls and encryption, to safeguard confidential data from unauthorized disclosure or modification.

The primary goal is to reduce user susceptibility, so tracking the number of employees who click on simulated phishing links directly measures behavior change.

IAM roles control permissions for cloud resources. CSPM detects misconfigurations. CWPP provides runtime protection for workloads.

A Configuration Management Database (CMDB) stores details about hardware assets and their relationships.

User Behavior Analytics (UBA) is specifically designed to detect insider threats by establishing a baseline of normal user activity and then identifying anomalous deviations, such as unusual login times, abnormal data access patterns, or atypical file transfers. Unlike other security tools that rely on known signatures or network traffic patterns, UBA applies machine learning and statistical modeling to user-centric data (e.g., authentication logs, file system events, and endpoint activity) to uncover subtle, non-signature-based indicators of malicious insider behavior.

Option C is correct because the two-person rule requires two authorized individuals to perform a critical change, ensuring that no single person has both the authority and the ability to execute a high-risk action. This directly enforces separation of duties by dividing the task into two distinct roles, such as one person approving and another implementing the change, which prevents fraud or errors from a single compromised account.

Option A is correct because Preparation is the foundational phase of the incident response lifecycle, as defined by NIST SP 800-61 Rev. 2. This phase involves establishing policies, creating incident response plans, forming a CSIRT, and provisioning tools (e.g., SIEM, forensic workstations) before any incident occurs. Without proper preparation, all subsequent phases are significantly less effective.

These are common examples of security control categories.

The three categories are something you know, something you have, and something you are. Fingerprint (something you are) and smart card (something you have) are valid factors.

The ACL applied to the router interface connected to VLAN 10 is the most likely cause of the connectivity issue, as it can explicitly permit or deny traffic from VLAN 10 to VLAN 20. Reviewing the ACL configuration first allows the analyst to quickly determine if the traffic is being blocked by a deny statement or missing permit entry, which is a common and immediate cause of such inter-VLAN routing failures. This step is the most efficient because it directly addresses the access control mechanism at the routing boundary.

Option B is correct because risk mitigation involves applying controls to reduce the likelihood or impact of a risk to an acceptable level. Implementing input validation and parameterized queries directly addresses the SQL injection vulnerability by preventing malicious SQL from being executed, thereby reducing the risk without eliminating the application's functionality.

Option A is correct because the order of volatility dictates that the most volatile data (network connections) should be captured first, followed by memory, and finally disk. Network connections change constantly and are lost when the system is powered off, while memory (RAM) persists until power loss, and disk is the least volatile as it retains data even after shutdown. This sequence ensures critical evidence is preserved before it disappears.

The Ticket-Granting Ticket (TGT) has a limited lifetime (typically 8-10 hours). When it expires, the user must re-authenticate to get a new TGT.

The primary purpose of a risk register is to document and track identified risks along with their treatment plans, including risk owners, likelihood, impact, and mitigation status. This aligns with the Risk Identification, Monitoring and Analysis domain, where the risk register serves as a central repository for risk management activities throughout the system development life cycle.

Least privilege means users and accounts should have only the minimum permissions necessary. Service accounts rarely need domain admin rights.

Password history prevents users from reusing previous passwords, enforcing password uniqueness over time.

Option D is correct because bcrypt is specifically designed for password hashing with a cost factor to resist brute-force. Option A (MD5) is broken; B (SHA-1) is weak; C (SHA-256) is fast and suitable for integrity, not passwords; E (PBKDF2) is also good, but bcrypt is often preferred due to built-in salt and adaptive cost.

Using TLS 1.3 (which mandates forward secrecy) and enforcing split tunneling only for trusted networks are security best practices.

Authentication is the process of verifying the identity claimed by a user. Identification is the claim (e.g., username), and authentication is the verification (e.g., password).

Mandatory access control (MAC) enforces access decisions based on centrally defined policies, not at the discretion of individual users. The system compares security labels assigned to subjects (e.g., users, processes) and objects (e.g., files, resources) to determine if access is allowed. This ensures that even the owner of an object cannot override the policy, which is a core characteristic of MAC.

In RBAC, access is granted based on the roles explicitly assigned to a user account. Since the administrator confirmed the account is enabled and the application server is reachable, the most likely cause is that the required role was not assigned to the migrated user. Without that role assignment, the user lacks the necessary permissions to access the critical application, regardless of other roles held.

Separation of duties (SoD) is the security principle that prevents a single individual from performing conflicting tasks, such as creating and approving a purchase order. By splitting these responsibilities, the organization reduces the risk of fraud, errors, and unauthorized transactions, ensuring that no single person has unchecked control over a critical financial process.

Implementing a WAF rule to block exploitation attempts reduces the likelihood or impact of the vulnerability without removing the flaw itself. This is a classic risk mitigation technique, as it applies a compensating control to lower residual risk while the server remains unpatched. Risk mitigation involves taking action to reduce risk to an acceptable level, which is exactly what deploying a WAF signature achieves.

Option D is correct because TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 uses Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) for perfect forward secrecy, ECDSA for efficient authentication, AES-256 in GCM mode for authenticated encryption, and SHA-384 for integrity. This combination provides the strongest security with modern, optimized algorithms, making it the best choice for performance and security on a TLS web server.

Option C is correct because running a full antivirus and anti-malware scan on the restored systems ensures that no remnants of the ransomware (e.g., dormant payloads, modified registry keys, or backdoor executables) remain in the restored data. Even if the backup was taken before the infection, the restore process could reintroduce malware if the backup itself was compromised or if the ransomware had persisted in the system state. A thorough scan validates that the restored environment is free of known malicious signatures and behavioral indicators.

A clean desk policy is a physical security control designed to prevent unauthorized access to sensitive information by ensuring that documents, devices, and media are securely stored when not in use. By reducing the visibility of confidential data, it directly mitigates the risk of data breaches from shoulder surfing, theft, or accidental exposure. This aligns with the principle of least exposure and supports compliance with data protection frameworks like GDPR or HIPAA.

The correct answer is D, Least Privilege, because the security engineer is configuring the firewall to block all inbound traffic except for specific services. This aligns with the principle of least privilege, which dictates that only the minimum necessary access should be granted—in this case, only allowing specific services through while denying everything else by default. The firewall rule set explicitly permits only required ports (e.g., TCP/443 for HTTPS) and implicitly denies all other traffic, ensuring that no unnecessary access is permitted.

Option B is correct because parameterized queries (prepared statements) are the definitive defense against SQL injection, as they separate SQL logic from user data by design. Rewriting the legacy module to use parameterized queries eliminates the root cause of the vulnerability at the code level, ensuring that user input is never concatenated into the SQL statement. This is the most secure and permanent fix, as it directly addresses the injection point in the application layer.

The exhibit shows a high volume of outbound traffic from internal IP 10.0.0.1 (the web server) to external IP 203.0.113.5 on port 443 (HTTPS). This pattern is consistent with data exfiltration, where a compromised web server sends sensitive data to an external command-and-control (C2) server. The traffic is initiated by the internal server, not inbound, which rules out scanning or DDoS attacks.

VLANs segment traffic at Layer 2, and firewalls control traffic between segments at Layer 3+.

DHE (Diffie-Hellman Ephemeral) generates a fresh, temporary key pair for each session and never reuses the private key, ensuring that compromise of a long-term key does not expose past session keys. This provides forward secrecy because the ephemeral keys are destroyed after the session ends, making it computationally infeasible to decrypt recorded traffic even if the server's static key is later compromised.