Systems Security Certified Practitioner SSCP (SSCP) — Questions 901–975

Exposure Factor (EF) is a core quantitative metric representing the percentage of asset value lost when a specific threat occurs. It is used in quantitative risk analysis to calculate Single Loss Expectancy (SLE = AV × EF) and Annualized Loss Expectancy (ALE = SLE × ARO), enabling numerical risk prioritization.

The correct answer is D because the scenario describes reading arbitrary files from the server, which is the hallmark of a Local File Inclusion (LFI) vulnerability. In a PHP application using include statements, an attacker can manipulate a file path parameter (e.g., `?page=../../etc/passwd`) to include and read local files, exploiting the server's filesystem access. Apache with mod_php is particularly susceptible to LFI when user input is not sanitized before being passed to functions like `include()` or `require()`.

The TGT is obtained from the Authentication Server (AS) and is used to request service tickets from the Ticket Granting Server (TGS) without re-entering credentials, enabling SSO.

sudoers file controls which users can run commands with sudo and limits commands. PAM handles authentication, not command authorization. SELinux policies control MAC, not sudo. chmod sets file permissions but does not grant specific command execution.

AppLocker can be configured via Group Policy to allow or deny applications based on rules, preventing unauthorized software installation.

Rule 10 allows SSH (TCP/22) from any source (0.0.0.0/0) to the internal server, which exposes the management interface to the entire internet. Restricting the source to specific administrative IPs reduces the attack surface by limiting who can initiate SSH connections, mitigating brute-force and unauthorized access risks. This aligns with the principle of least privilege and is a fundamental access control recommendation.

The Incident Manager (C) is the central coordinator who manages the incident response process, ensures communication among stakeholders, and makes strategic decisions during an incident. The Forensic Analyst (D) is responsible for collecting, preserving, and analyzing digital evidence in a forensically sound manner, often using tools like FTK Imager or EnCase to maintain chain of custody. Both roles are essential for a structured and legally defensible incident response.

Accountability ensures that actions can be traced back to a specific user, typically through logging and audit trails. This relies on identification and authentication to uniquely identify users.

Encryption is a preventive control because it renders data unreadable to unauthorized parties, thereby preventing data leakage even if the data is intercepted or accessed without authorization. By transforming plaintext into ciphertext using algorithms like AES-256, encryption ensures that only entities with the correct decryption key can access the original data, effectively blocking data exfiltration at rest or in transit.

A change request must include a rollback plan to ensure that if the change fails or causes unexpected issues, the system can be safely restored to its previous state. Without a documented rollback procedure, the change introduces unacceptable operational risk, making it a valid reason for the CAB to deny approval.

The scenario describes multiple internal hosts sharing a single inside global IP address but using different port numbers. This is the defining behavior of Port Address Translation (PAT), also known as NAT overload. PAT maps multiple private IP addresses to one public IP by differentiating sessions based on the transport-layer port number (TCP/UDP), allowing many hosts to share a single public address.

WDAC is a whitelisting technology that only allows approved applications to execute, effectively blocking malware and unauthorized software by default.

TOTP (Time-based One-Time Password) is defined in RFC 6238 and generates codes based on the current time. It is commonly used with authenticator apps or hardware tokens.

Asset identification (B) is a key component because you cannot assess risk without knowing what assets need protection. Threat identification (E) is also essential because risk is defined as the likelihood of a threat exploiting a vulnerability to cause harm to an asset. Together, asset and threat identification form the foundational inputs for calculating risk.

The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Here, SLE = $5,000 and ARO = 0.2, so ALE = $5,000 × 0.2 = $1,000. This represents the expected annual financial loss from the server risk.

WPA2-Enterprise uses IEEE 802.1X authentication with a RADIUS server, requiring unique credentials per user rather than a shared pre-shared key (PSK). This eliminates the risk of PSK compromise and provides centralized authentication, making it highly resistant to unauthorized access. It is the recommended method for securing wireless networks in enterprise environments.

Least privilege ensures users have only the permissions needed (nurse view, doctor view/update). Separation of duties prevents a single user from performing conflicting actions (order and approve).

SSH (Secure Shell) is the correct answer because it provides encrypted remote shell access and command execution, replacing the insecure Telnet protocol which transmits data in cleartext. SSH uses public-key cryptography for authentication and symmetric encryption (e.g., AES, ChaCha20) for session confidentiality, as defined in RFC 4251.

PAM includes password vaulting, session recording, and just-in-time provisioning to secure privileged accounts.

MAC address filtering is a weak access control because MAC addresses are transmitted in plaintext over the air and can be easily captured using a wireless sniffer (e.g., Wireshark). An attacker can then change their network interface's MAC address to match an allowed client via MAC spoofing, thereby bypassing the filter and gaining access to the network. This attack directly defeats the filtering mechanism without needing to crack encryption keys or impersonate the access point.

Using a write blocker is essential because it ensures that no data can be written to the suspect hard drive during the imaging process, preserving the original evidence in a forensically sound state. Without a write blocker, any operating system or imaging tool could inadvertently modify metadata (e.g., access timestamps) or the file system, which would compromise the integrity and admissibility of the evidence in legal proceedings.

Segmenting the devices into a separate, highly restricted network segment limits the blast radius and prevents lateral movement. Option A is already proposed; B is best practice; C is acceptable but not sufficient; D is reactive.

Blowfish is a symmetric block cipher that supports variable key lengths (32–448 bits), making it suitable for encrypting data at rest on a file server. It is designed for fast encryption in software and has been widely used for file and disk encryption, though it is now considered less secure than modern alternatives like AES.

A configuration management database (CMDB) is a centralized repository that stores information about configuration items (CIs) and their relationships. Its primary purpose is to provide a single source of truth for managing IT assets, dependencies, and their interconnections, which is foundational for change management, incident management, and impact analysis.

A false positive occurs when the IDS incorrectly classifies legitimate traffic as malicious, generating an alert for benign activity. This is a common issue after deploying a new IDS with default or overly sensitive signature sets, leading to alert fatigue. The core reasoning is that the IDS's detection logic (e.g., pattern matching or anomaly thresholds) misidentifies normal behavior as an attack.

A parallel test runs the disaster recovery (DR) systems in a live, non-disruptive manner alongside the production environment. This allows the organization to validate that the DR systems can process transactions and handle workloads correctly without affecting the primary production operations, making it the correct choice for verifying functionality without impact.

Provisioning is the access control process that includes creating, modifying, and disabling user accounts and their associated privileges. When a terminated employee's account remains active, the de-provisioning step—specifically account revocation—was likely skipped, leaving the account enabled and accessible.

IMAPS (Internet Message Access Protocol over SSL/TLS) encrypts email retrieval by wrapping IMAP traffic in TLS, typically on port 993. This ensures that email messages and credentials are protected from eavesdropping while in transit between the client and the mail server.

The chain of custody is a documented chronological record of evidence handling, which is essential to demonstrate that the hard drive has not been altered, damaged, or substituted since seizure. Without this unbroken record, the evidence could be challenged as inadmissible in court under rules like the Federal Rules of Evidence (FRE) 901, which require authentication. This is the primary reason because legal admissibility hinges on proving integrity and continuity of custody.

ListBucket allows listing objects, GetObject allows reading objects. It does not allow write or delete. The resource is specific to example-bucket.

Port 445 is the default port for Microsoft-DS (Direct Hosting of SMB over TCP/IP), which is used by the Server Message Block (SMB) protocol for file and printer sharing. Unusual outbound traffic on this port often indicates SMB activity, such as a workstation attempting to connect to a remote share or, in a security context, potential data exfiltration or lateral movement using SMB.

ARP spoofing (or ARP poisoning) sends gratuitous ARP replies to redirect traffic, enabling man-in-the-middle attacks.

Physical destruction (e.g., shredding, crushing) ensures that the storage media is no longer usable and data recovery is virtually impossible. Degaussing may destroy magnetic media but is less effective on SSDs. Overwriting requires multiple passes and may not be effective on all media types.

B is correct because `setfacl` is used to modify Access Control Lists (ACLs) on a file or directory, which are an extended mechanism for setting permissions beyond the standard owner/group/others model. E is correct because `chmod` is the standard command for changing the read, write, and execute permissions for the file owner, group, and others using symbolic or octal notation.

RPO (Recovery Point Objective) defines the maximum acceptable data loss. If the backup is 12 hours old and RPO is 4 hours, the organization has lost 8 hours of data, exceeding the objective.

During the containment phase of incident response, the primary goal is to stop the incident from spreading and to limit damage. Isolating the affected system from the network (Option C) immediately prevents lateral movement of the threat and further data exfiltration. Blocking malicious IP addresses at the firewall (Option D) is another containment action that cuts off communication with known command-and-control servers or attack sources, effectively containing the network-level impact.

BGP is correct because it supports dynamic routing and can be configured with multiple paths to provide automatic failover for VPN connections in a hub-and-spoke topology. When the central site's firewall is upgraded, BGP can reroute traffic through alternate paths without manual intervention, ensuring link redundancy. This is achieved through BGP's path selection algorithm and the ability to advertise multiple routes via different VPN tunnels.

Windows Defender Application Control (WDAC) and AppLocker are used for application whitelisting. WDAC provides more robust control.

Biometric readers are a physical security control that authenticates individuals based on unique biological traits (e.g., fingerprints, iris patterns). They prevent unauthorized access by ensuring only enrolled personnel can enter the data center, directly controlling physical entry points.

Regular key rotation limits exposure in case of compromise. All other options are important but rotation is most critical for long-term security.

DAC (Discretionary Access Control) lets the owner control access permissions. Other models have different control mechanisms.

Digital signatures using RSA or ECDSA provide non-repudiation of data origin because they bind the signer's identity to the data through a private key that only the signer possesses. The recipient can verify the signature with the corresponding public key, and the signer cannot later deny having signed the data, as the private key is uniquely under their control. This meets the legal and technical requirement for non-repudiation, unlike symmetric or hash-only methods.

The need-to-know principle restricts data access to only the information necessary for a user to perform their job duties. In this case, the user retrieved all customer records, but their role only requires access to their own assigned customers, meaning they accessed data beyond what is necessary. This directly violates the need-to-know concept, which is a subset of access control that limits access to specific data elements rather than entire datasets.

MAC uses labels for subjects and objects, and access decisions are based on clearance and classification. Users cannot change permissions.

A specific allow rule for HTTPS (port 443) combined with a default block rule ensures only HTTPS is allowed. The default block rule enforces the principle of least privilege.

This policy enforces separation of duties by ensuring that no single individual has the authority to both approve a purchase order and receive the goods. This control prevents fraud and errors by requiring two different people to complete related but conflicting tasks, which is a fundamental access control principle in financial and operational systems.

DHCP starvation exhausts the IP pool, forcing clients to accept offers from a rogue DHCP server. The rogue server provides malicious gateway and DNS, enabling traffic interception and redirection.

Just-in-time (JIT) provisioning provides temporary elevated privileges that expire after use, reducing the attack surface.

Snapshots may contain outdated, unpatched software, reintroducing vulnerabilities when reverted.

Option D is correct because the user at 10.0.0.1 cannot reach 203.0.113.5:443, which indicates that outbound traffic to that destination is not permitted. Firewalls by default block all traffic unless explicitly allowed; if no rule permits outbound HTTPS (TCP/443) traffic, the connection will be dropped. The symptom (inability to access an external web server) points to a missing outbound rule, not an inbound rule issue.

An application proxy firewall can examine application layer content, such as HTTP requests, to enforce URL filtering.

The most likely cause is a VLAN hopping attack via double tagging. In this attack, an attacker on the HR VLAN sends a frame with two 802.1Q tags: the outer tag matches the native VLAN of the trunk (often VLAN 1), and the inner tag is the target VLAN (Finance). When the switch receives the frame on an access port, it strips the outer tag (as it is the native VLAN) and forwards the frame with the inner tag over the trunk, allowing the traffic to bypass the ACLs and reach the Finance VLAN.

Isolating affected systems by disconnecting them from the network is the immediate priority because it physically or logically severs the attacker's ability to propagate laterally via SMB, RDP, or other network protocols. This containment step stops the spread without destroying forensic evidence, which would be lost if systems were reimaged or powered off prematurely.

The scenario describes a direct violation of separation of duties (SoD), a core access control principle that requires critical tasks to be divided among multiple individuals to prevent fraud or error. In this case, the developer both writes code and has direct access to production databases, bypassing the required review and deployment by a separate team. SoD ensures no single person has end-to-end control over a sensitive process, which is essential for maintaining integrity and accountability in production environments.

The PMKID attack allows offline brute-forcing of the WPA2-PSK passphrase by computing the PMKID locally and comparing it to the captured value.

Anomaly-based detection establishes a baseline of normal user behavior and flags deviations, such as a sudden spike in failed logins from a single IP across multiple accounts. This pattern—a brute-force attack—does not match a known signature, so anomaly detection is the most effective SIEM method for identifying it.

Adjusting the rule threshold (Option D) is the best approach because it fine-tunes the sensitivity of the IDS rule to reduce false positives without completely disabling detection. By raising the threshold (e.g., increasing the number of matching packets or the time window), the SIEM will only generate an alert when the rule's criteria are met more persistently, filtering out noise while still capturing genuine threats. This maintains the rule's detection capability for actual attacks that exceed the adjusted threshold.

ABAC (Attribute-Based Access Control) is designed for fine-grained policies using multiple attributes. RBAC can also be extended with constraints (e.g., time-of-day, location) to achieve similar results, though ABAC is more flexible. MAC is too rigid, DAC is too coarse, and non-discretionary is a broad term.

SAML uses XML assertions to exchange authentication and authorization data between an identity provider and a service provider.

Testing the patch in a non-production environment ensures it does not break functionality before deployment. Immediate deployment risks downtime. Disabling the application or notifying users are reactive steps, not the first.

Volume shadow copies (VSS) are snapshots of the file system at a point in time, stored separately from the active logs. Even if an attacker clears logs by writing null bytes (e.g., using `fsutil` or `wevtutil cl`), VSS may retain a previous version of the logs, making them a critical artifact for forensic recovery.

Security logs (A) are correct because they record authentication events, privilege use, and policy violations, which are essential for detecting unauthorized access and compliance auditing in a SIEM. These logs typically come from operating systems, firewalls, and IDS/IPS, providing critical data for incident detection and forensic analysis.

Annualized Loss Expectancy (ALE) is the most commonly used quantitative metric for calculating risk because it combines the expected financial loss from a single event (Single Loss Expectancy) with the annual frequency of that event (Annualized Rate of Occurrence). This produces a dollar-value risk figure that organizations can directly compare against security control costs and budget decisions for a cloud application.

SSH (Secure Shell) uses TCP port 22 for encrypted remote administration, replacing insecure Telnet.

SQL injection is a classic injection; Cross-Site Scripting (XSS) is also a form of injection (script injection).