Courseiva

Systems Security Certified Practitioner SSCP (SSCP) — Questions 76150

920 questions total · 13pages · All types, answers revealed

Page 1

Page 2 of 13

Page 3
76
MCQmedium

During the eradication phase of incident response, which of the following actions is MOST critical to ensure the threat is completely removed from a compromised system?

A.Reimaging the system from a verified clean image
B.Resetting compromised user credentials
C.Removing malicious files and cleaning registry persistence
D.Patching the exploited vulnerability
AnswerC

Attackers often establish persistence; failing to remove it can lead to recompromise.

Why this answer

During the eradication phase, the primary goal is to ensure that no remnants of the attacker's presence remain on the system. Option C directly addresses this by removing malicious files and cleaning registry persistence, which eliminates backdoors, scheduled tasks, and other persistence mechanisms that could allow the threat to survive a reboot or evade detection. Without this step, even after patching or credential resets, the attacker could regain access through hidden persistence points.

Exam trap

A common mistake in the SSCP exam is confusing the eradication phase with the recovery phase. Candidates may select patching or reimaging because those actions seem thorough, but the key during eradication is removing all artifacts of the compromise, including persistence mechanisms, before recovering the system to production.

How to eliminate wrong answers

Option A is wrong because reimaging from a clean image is a valid recovery step, but it is not the most critical action during eradication; it is typically performed after eradication is complete to restore the system to a known good state, and it does not involve analyzing or removing the threat's artifacts. Option B is wrong because resetting compromised user credentials is a containment and recovery action that prevents further unauthorized access, but it does not remove the threat itself—malicious files and persistence mechanisms remain active. Option D is wrong because patching the exploited vulnerability is a preventive measure that closes the initial attack vector, but it does not remove existing malware or persistence; the threat may still be present and active on the system.

77
Multi-Selectmedium

An organization is implementing multi-factor authentication (MFA). Which TWO of the following are examples of something you have?

Select 2 answers
A.Smart card
B.PIN
C.Retina scan
D.Hardware token (e.g., YubiKey)
E.Fingerprint
AnswersA, D

A smart card is a physical device, thus something you have.

Why this answer

Something you have includes physical tokens like smart cards and hardware tokens. Biometrics are something you are, and passwords are something you know.

78
MCQeasy

An organization requires that all laptops used by employees be encrypted. Which type of encryption should be used to protect the entire hard drive?

A.File-level encryption
B.Full disk encryption (FDE)
C.Transport encryption (TLS)
D.Application-level encryption
E.Folder-level encryption
AnswerB

FDE encrypts the entire drive, ensuring all data is protected at rest.

Why this answer

Full disk encryption (FDE) encrypts the entire hard drive, including the operating system and all files, providing the strongest protection for data at rest on lost or stolen laptops. File-level encryption only encrypts individual files, leaving metadata and other files exposed. Folder-level encryption is similar but at the folder level.

Transport encryption (TLS) protects data in transit, not at rest. Application-level encryption encrypts data within a specific application, not the entire drive. Therefore, full disk encryption (Option B) is the correct choice for protecting the entire hard drive.

79
Multi-Selecthard

During an access control audit, you find that a user has been assigned to two mutually exclusive roles. Which TWO principles are most likely violated?

Select 2 answers
A.Role hierarchy
B.Least privilege
C.Separation of duties
D.Mandatory access control
E.Accountability
AnswersB, C

Assigning roles that are not needed violates least privilege.

Why this answer

Separation of duties is violated when a user has roles that could allow fraud; least privilege is violated if the user has more permissions than necessary.

80
MCQhard

An organization detects that an attacker is performing a MAC flooding attack on a switch. What is the primary goal of this attack?

A.To change the MAC address of the switch
B.To cause a denial of service on the network
C.To force the switch to act like a hub and allow packet sniffing
D.To bypass 802.1X authentication
AnswerC

Filling the CAM table causes the switch to flood frames out all ports.

Why this answer

MAC flooding attacks exploit the limited size of a switch's Content Addressable Memory (CAM) table. By sending thousands of fake source MAC addresses, the attacker fills the CAM table, causing the switch to fail open and flood all incoming frames out all ports, effectively behaving like a hub. This allows the attacker to sniff traffic that would normally be isolated to specific switch ports.

Exam trap

The trap here is that candidates often confuse the primary goal of MAC flooding (sniffing traffic) with a denial of service, but Cisco tests that the attacker's intent is to bypass port-level isolation to eavesdrop, not simply to crash the switch.

How to eliminate wrong answers

Option A is wrong because MAC flooding does not change the MAC address of the switch itself; it floods the switch's CAM table with fake MAC addresses, not the switch's own burned-in MAC address. Option B is wrong because while a MAC flooding attack can cause network degradation, its primary goal is not denial of service but rather to enable packet sniffing by forcing the switch into hub-like behavior; a true DoS attack would aim to disrupt all traffic, whereas MAC flooding aims to capture it. Option D is wrong because MAC flooding targets Layer 2 switching behavior and does not directly interact with 802.1X authentication, which operates at the port level using EAPoL (Extensible Authentication Protocol over LAN) to control access.

81
MCQhard

You are the security analyst for a mid-sized e-commerce company that processes credit card payments. The company uses a legacy payment application on a Windows Server 2012 R2 system, which is scheduled for decommission in six months. The server is isolated in a separate VLAN with strict firewall rules allowing only outbound HTTPS to the payment processor and inbound management from a jump box on a different subnet. During a routine vulnerability scan, you discover that the server is missing over 50 critical patches, including one for a remote code execution vulnerability (CVE-2023-XXXX) that is being actively exploited in the wild. The server cannot be patched because the vendor stopped support and patches are not available. The company's risk appetite is low due to PCI DSS requirements. You need to recommend a course of action that balances risk reduction with business continuity. What should you do?

A.Implement additional compensating controls such as an application-layer firewall, disable all unnecessary services, restrict outbound traffic to only the payment processor IP, enable detailed logging, and accelerate the migration
B.Immediately decommission the server and migrate to the new payment system, accepting a temporary outage
C.Apply the vendor's hotfix from an unofficial source to patch the vulnerability
D.Accept the risk and purchase additional cyber insurance to cover potential losses
AnswerA

Compensating controls reduce risk while allowing continued operation until decommission.

Why this answer

It implements compensating controls to reduce the risk of the unpatched remote code execution vulnerability while maintaining business continuity. By deploying an application-layer firewall (e.g., a WAF or host-based IPS), disabling unnecessary services, restricting outbound traffic to only the payment processor's IP via strict egress ACLs, enabling detailed logging for monitoring, and accelerating the migration to a supported system, you align with PCI DSS Requirement 6.2 (timely patching) and Requirement 11.5 (change detection) without causing an outage. This layered defense mitigates the active exploit risk until the legacy server can be decommissioned in six months.

Exam trap

The trap here is that candidates may choose Option B (immediate decommission) thinking it eliminates risk, but they overlook the business continuity requirement and the fact that PCI DSS allows compensating controls for legacy systems with a documented migration plan.

How to eliminate wrong answers

Option B is wrong because immediately decommissioning the server would cause a business outage, which is unacceptable for a mid-sized e-commerce company processing credit card payments; PCI DSS requires maintaining business continuity, and a temporary outage could lead to revenue loss and compliance issues. Option C is wrong because applying a vendor hotfix from an unofficial source introduces significant risk of malware, system instability, or violation of PCI DSS Requirement 6.1 (use only vendor-supplied patches), and it could void any remaining support or insurance. Option D is wrong because accepting the risk and purchasing cyber insurance does not address the active exploitation of CVE-2023-XXXX; PCI DSS requires compensating controls or patching, and insurance only covers financial loss after a breach, not the immediate security risk to cardholder data.

82
MCQhard

A company has a backup policy that performs a full backup every Sunday and incremental backups on other days. On Wednesday, a server fails. How many backup sets are needed to restore the server to its state on Tuesday night?

A.One
B.Two
C.Four
D.Three
AnswerD

You need Sunday's full backup, Monday's incremental, and Tuesday's incremental to restore to Tuesday night.

Why this answer

To restore the server to its state on Tuesday night, you need the full backup from Sunday and the incremental backups from Monday and Tuesday. Incremental backups only capture changes since the last backup (full or incremental), so you must restore them in sequence: full backup first, then Monday's incremental, then Tuesday's incremental. This requires three backup sets total, making option D correct.

Exam trap

The trap here is confusing incremental backups with differential backups; candidates often think two sets are enough (full + latest incremental) or mistakenly count the days incorrectly, leading them to choose option B or C instead of recognizing the sequential dependency of incremental chains.

How to eliminate wrong answers

Option A is wrong because a single backup set cannot restore the state after multiple days of changes; only the full backup alone would restore Sunday's state, not Tuesday's. Option B is wrong because two backup sets would only cover the full backup and one incremental, missing the changes from the other day (e.g., full + Monday would miss Tuesday's changes). Option C is wrong because four backup sets would be needed only if the policy used differential backups (which accumulate all changes since the last full backup) or if there were additional days; with incremental backups, the number of sets equals the number of days since the last full backup plus one (the full), which is three for Tuesday.

83
MCQmedium

After a ransomware incident, an organization decides to restore data from backups. The RPO (Recovery Point Objective) is 4 hours. What does this RPO indicate?

A.Backups must be taken at least every 4 hours to ensure data loss does not exceed 4 hours
B.The organization can tolerate 4 hours of downtime
C.The system must be restored within 4 hours of the incident
D.The recovery process will take a maximum of 4 hours
AnswerA

Correct. RPO drives backup frequency to limit data loss.

Why this answer

The Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time. An RPO of 4 hours means the organization can tolerate losing up to 4 hours of data, so backups must be taken at least every 4 hours to ensure that in the worst case, no more than 4 hours of data is lost. This directly dictates the backup frequency, not the recovery time or downtime.

Exam trap

The trap here is confusing RPO (data loss tolerance) with RTO (downtime tolerance), leading candidates to select options that describe recovery time or downtime instead of backup frequency.

How to eliminate wrong answers

Option B is wrong because it describes the Recovery Time Objective (RTO), which is the maximum acceptable downtime, not the RPO. Option C is wrong because it also describes the RTO (time to restore service), not the RPO which is about data loss tolerance. Option D is wrong because it describes the actual recovery time, which is a metric of the restoration process, not the RPO's definition of acceptable data loss.

84
MCQmedium

A security analyst notices repeated failed login attempts from a single IP address targeting a domain controller. The SIEM alerts after 10 failed attempts within 5 minutes. Which detection type is most likely used?

A.Anomaly-based detection
B.Signature-based detection
C.Rule-based detection
D.Behavior-based detection
AnswerC

Rule-based detection is correct because it uses a predefined rule (10 failed attempts in 5 minutes) to trigger an alert without adaptation.

Why this answer

The alert is triggered by a static threshold (10 failed attempts in 5 minutes) with no baseline learning. This is characteristic of rule-based detection, which uses predefined conditions (e.g., 'if count > 10 then alert'). Anomaly-based detection would require establishing a baseline of normal behavior and detecting deviations from that baseline.

Therefore, rule-based detection is the most likely type used.

Exam trap

Candidates may assume any threshold-based alert is anomaly-based, but a fixed, static threshold is a hallmark of rule-based detection. Anomaly-based detection derives thresholds from historical baselines.

How to eliminate wrong answers

Option A is wrong because anomaly-based detection relies on statistical baselines and deviations from normal behavior, not a fixed threshold like 10 attempts in 5 minutes. Option B is wrong because signature-based detection matches known attack patterns (e.g., specific payloads or exploit signatures), not volumetric thresholds. Option D is wrong because behavior-based detection analyzes patterns of user or entity behavior over time (e.g., UEBA), not a simple count of failed logins from a single IP.

85
MCQhard

In IPsec VPNs, which protocol provides authentication and encryption of the entire IP packet, including the IP header, in tunnel mode?

A.L2TP
B.IKE
C.ESP
D.AH
AnswerC

ESP provides both authentication and encryption, and in tunnel mode protects the entire original packet.

Why this answer

ESP (Encapsulating Security Payload) in tunnel mode encrypts and authenticates the entire original IP packet, adding a new IP header. AH (Authentication Header) does not provide encryption.

86
MCQeasy

An organization experiences a ransomware attack that encrypts critical data. The incident response team isolates affected systems. What is the NEXT step?

A.Reimage systems
B.Notify law enforcement
C.Identify the root cause
D.Restore from backup
AnswerC

After containment, the team must analyze to determine the cause before proceeding to eradication.

Why this answer

After isolating affected systems to contain the ransomware, the next step is to identify the root cause (e.g., how the ransomware entered, which vulnerability was exploited, or which user account was compromised). This aligns with the NIST SP 800-61 incident response lifecycle, where identification and analysis precede eradication and recovery. Without determining the root cause, reimaging or restoring from backup risks reinfection or missing a persistent backdoor.

Exam trap

The trap here is that candidates often jump to 'Restore from backup' (Option D) as the immediate next step, but the SSCP exam emphasizes that containment and root cause analysis must precede recovery to prevent reinfection and ensure the backup is clean.

How to eliminate wrong answers

Option A is wrong because reimaging systems before identifying the root cause may destroy forensic evidence and fail to address the initial infection vector, potentially allowing the attack to recur. Option B is wrong because notifying law enforcement is a legal or compliance step that typically occurs after containment and root cause analysis, and it is not a technical incident response step. Option D is wrong because restoring from backup before understanding the root cause could restore encrypted or compromised data, and the backup itself might be infected or the same vulnerability could be exploited again.

87
MCQmedium

Which of the following protocols is used to securely transfer files over SSH and is considered a replacement for FTP?

A.IPsec
B.HTTPS
C.SFTP
D.SMTPS
AnswerC

SFTP is correct.

Why this answer

SFTP (SSH File Transfer Protocol) provides secure file transfer over SSH.

88
MCQhard

An organization is calculating the Annualized Loss Expectancy (ALE) for a server. The Asset Value (AV) is $50,000, the Exposure Factor (EF) is 40%, and the Annualized Rate of Occurrence (ARO) is 0.5. What is the Single Loss Expectancy (SLE) and ALE?

A.SLE = $20,000, ALE = $10,000
B.SLE = $50,000, ALE = $25,000
C.SLE = $10,000, ALE = $5,000
D.SLE = $20,000, ALE = $40,000
AnswerA

Correct calculation: SLE = $50,000 * 0.4 = $20,000; ALE = $20,000 * 0.5 = $10,000.

Why this answer

The Single Loss Expectancy (SLE) is calculated as Asset Value (AV) × Exposure Factor (EF) = $50,000 × 0.40 = $20,000. The Annualized Loss Expectancy (ALE) is then SLE × Annualized Rate of Occurrence (ARO) = $20,000 × 0.5 = $10,000. This matches option A exactly.

Exam trap

The trap here is that candidates may forget to apply the EF to the AV when calculating SLE, or they may invert the ARO (e.g., using 2 instead of 0.5) when computing ALE.

How to eliminate wrong answers

Option B is wrong because it incorrectly uses the full AV as the SLE ($50,000) instead of applying the EF, and then multiplies by ARO to get $25,000, which is not the correct ALE. Option C is wrong because it mistakenly halves the AV to get SLE = $10,000 (perhaps confusing EF with ARO) and then multiplies by ARO to get ALE = $5,000, misapplying both formulas. Option D is wrong because it correctly calculates SLE = $20,000 but then multiplies by the reciprocal of ARO (2) instead of ARO (0.5), yielding ALE = $40,000 instead of $10,000.

89
MCQhard

You are the security administrator for a mid-sized financial company that processes credit card transactions. The company has a mix of on-premises servers and cloud-based services. Recently, the company experienced a data breach where an attacker exfiltrated customer data from a database server. The investigation reveals that the attacker used compromised credentials of a database administrator (DBA) account. The DBA account had been used by multiple administrators without proper auditing. The company wants to implement a solution to prevent such incidents in the future. The solution must: 1) ensure that each administrator has a unique account for database access, 2) require approval for privileged actions, 3) provide a full audit trail of all privileged activities, and 4) be cost-effective. Which of the following is the best course of action?

A.Enforce the use of a shared DBA account with a complex password that is changed monthly.
B.Implement a privileged access management (PAM) solution that provides just-in-time access and session recording.
C.Require multi-factor authentication for all database access without any additional controls.
D.Install a database activity monitoring (DAM) solution that logs all SQL queries.
AnswerB

PAM addresses all requirements: unique accounts (via vault), approval workflows, and full audit trails.

Why this answer

A privileged access management (PAM) solution provides just-in-time access, approval workflows, and session recording, meeting all requirements. Shared accounts violate uniqueness; MFA alone doesn't provide approval or audit; database auditing software logs activities but does not enforce approval.

90
MCQhard

An organization using PaaS (Platform as a Service) for application hosting wants to ensure the application code is secure. Which of the following is the customer's responsibility under the shared responsibility model?

A.Physical security of the data center
B.Patching the web server runtime
C.Patching the underlying operating system
D.Securing the application code from SQL injection
AnswerD

Application-level security is the customer's responsibility.

Why this answer

In PaaS, the provider manages the platform (OS, runtime), and the customer is responsible for the application code and data. Patching the runtime is the provider's duty. Database backup may be partially shared, but application code security is always the customer's.

91
MCQhard

Which of the following best describes the function of SYN cookies in mitigating SYN flood attacks?

A.They block all incoming SYN packets from suspicious sources.
B.They encode connection state in the SYN-ACK sequence number, allowing the server to avoid storing state until the ACK is received.
C.They increase the backlog queue size to accommodate more half-open connections.
D.They require clients to solve a computational puzzle before completing the handshake.
AnswerB

This is the correct description of SYN cookies.

Why this answer

SYN cookies allow the server to avoid allocating resources for half-open connections until the handshake completes, preventing resource exhaustion.

92
MCQeasy

Which backup type copies all data that has changed since the last full backup, regardless of subsequent backups?

A.Incremental backup
B.Snapshot backup
C.Differential backup
D.Full backup
AnswerC

Copies changes since the last full backup.

Why this answer

A differential backup copies all data that has changed since the last full backup, regardless of any intermediate backups. This means each differential backup grows in size as it accumulates all changes made since the last full backup, making it distinct from incremental backups which only capture changes since the last backup of any type.

Exam trap

ISC2 often tests the distinction that differential backups grow over time because they accumulate all changes since the last full backup, while incremental backups are smaller but require a chain of backups for restoration.

How to eliminate wrong answers

Option A is wrong because an incremental backup copies only data that has changed since the last backup (whether full or incremental), not since the last full backup. Option B is wrong because a snapshot backup captures the state of a system at a point in time using copy-on-write technology, not by tracking changes since a full backup. Option D is wrong because a full backup copies all selected data regardless of change status, not just data that has changed since a previous backup.

93
MCQhard

An organization is migrating a legacy application to a PaaS cloud environment. According to the shared responsibility model, which security control is the organization still responsible for?

A.Configuring the network firewall at the cloud perimeter
B.Securing the application code against SQL injection
C.Patching the underlying operating system
D.Managing the hypervisor and virtualization layer
AnswerB

Application security, including code vulnerabilities, is the customer's responsibility.

Why this answer

In PaaS, the provider manages the runtime, middleware, and OS; the customer is responsible for application-level security, including code and data.

94
MCQmedium

An organization is implementing a digital signature solution to ensure non-repudiation of documents. Which combination of keys is used during the signing process?

A.Recipient's public key to sign, recipient's private key to verify
B.Sender's private key to sign, sender's public key to verify
C.Sender's public key to sign, recipient's private key to verify
D.A shared symmetric key for both signing and verification
AnswerB

The private key creates the signature, and the corresponding public key verifies it.

Why this answer

Digital signatures use asymmetric cryptography where the sender creates a signature with their private key, and the recipient verifies it with the sender's public key. This ensures non-repudiation because only the sender possesses their private key, so they cannot deny having signed the document. The process typically involves hashing the document and encrypting the hash with the sender's private key.

Exam trap

ISC2 SSCP often tests the misconception that signing uses a public key or that verification uses a private key, leading candidates to confuse the roles of keys in encryption versus signing.

How to eliminate wrong answers

Option A is wrong because the recipient's public key is used for encrypting messages to the recipient, not for signing; signing requires the sender's private key, and verification uses the sender's public key, not the recipient's private key. Option C is wrong because the sender's public key cannot sign (signing requires a private key), and the recipient's private key is never used for verification of a sender's signature. Option D is wrong because symmetric keys do not provide non-repudiation; they are shared secrets and cannot uniquely tie a signature to a single sender, as both parties possess the same key.

95
MCQeasy

Which attack sends a flood of forged ICMP echo requests to a network's broadcast address to overwhelm a target?

A.Ping of death
B.Smurf attack
C.SYN flood
D.DNS amplification
AnswerB

Smurf attack leverages broadcast amplification.

Why this answer

A Smurf attack sends ICMP echo requests with the victim's spoofed source IP to the broadcast address, causing all hosts to reply to the victim, amplifying traffic.

96
MCQhard

A certificate authority (CA) issues a certificate with the extended key usage (EKU) extension specifying 'serverAuth'. Which of the following is this certificate allowed to do?

A.Encrypt email
B.Authenticate a TLS server
C.Sign code
D.Issue subordinate CA certificates
AnswerB

The serverAuth EKU is specifically for TLS server authentication.

Why this answer

The Extended Key Usage (EKU) extension specifies the intended purpose of a certificate. The 'serverAuth' OID (1.3.6.1.5.5.7.3.1) explicitly permits the certificate to be used for authenticating a TLS server during the SSL/TLS handshake, such as in HTTPS. This is defined in RFC 5280 and is enforced by TLS clients to ensure the certificate is used only for its designated purpose.

Exam trap

A common pitfall is assuming that a certificate with 'serverAuth' can also be used for client authentication or other purposes, but the EKU extension strictly limits usage. Candidates often confuse 'serverAuth' with other EKUs like 'clientAuth' or 'emailProtection'.

How to eliminate wrong answers

Option A is wrong because encrypting email requires the 'emailProtection' EKU (1.3.6.1.5.5.7.3.4), not 'serverAuth'. Option C is wrong because signing code requires the 'codeSigning' EKU (1.3.6.1.5.5.7.3.3), which is a separate purpose. Option D is wrong because issuing subordinate CA certificates requires the 'keyCertSign' key usage extension and often the 'CA:TRUE' basic constraint, not the 'serverAuth' EKU; 'serverAuth' is for end-entity certificates, not for CA certificates.

97
MCQhard

A company's risk management policy states that all risks with a residual risk score of 8 or higher (on a scale of 1-10) must be treated. A risk is identified with an inherent risk score of 9, and after applying controls, the residual risk score is 7. What is the appropriate action?

A.Formally accept the residual risk
B.Apply additional controls to reduce the risk further
C.Purchase cyber insurance to transfer the risk
D.Reassess the inherent risk score
AnswerA

Since residual risk is 7 (<8), it can be accepted.

Why this answer

The residual risk score of 7 is below the policy threshold of 8, so formal acceptance is appropriate. Option B is wrong because additional controls are not required since the risk is already at an acceptable level. Option C is wrong because risk transfer (insurance) is a treatment option but not necessary when residual risk is within acceptable limits.

Option D is wrong because the inherent risk score was already assessed; reassessment is not needed.

98
MCQmedium

An organization's help desk receives multiple reports of employees unable to access a critical internal application. The IT team confirms the application server is running. What is the FIRST step in the incident response process?

A.Verify the reports and confirm the scope of the issue
B.Restore the application from the latest backup
C.Remove any malicious software from the server
D.Isolate the affected systems from the network
AnswerA

The incident response process begins with identification and verification.

Why this answer

The initial step in incident response is to identify and verify the incident. Option B is wrong because containment comes after identification. Option C is wrong because eradication follows containment.

Option D is wrong because recovery is performed after eradication.

99
MCQhard

A company's disaster recovery plan specifies an RTO of 4 hours for its customer relationship management (CRM) system. Which of the following DR site types is MOST appropriate to meet this RTO?

A.Warm site
B.Mobile site
C.Hot site
D.Cold site
AnswerC

Correct. A hot site is fully equipped with live data replication and can achieve failover within the 4-hour RTO.

Why this answer

A hot site is fully configured with hardware, software, and live data replication, enabling recovery within minutes to a few hours. Since the RTO is 4 hours, a hot site can meet this requirement by allowing immediate failover without the need for extensive setup or data restoration.

Exam trap

The trap here is that candidates often confuse a warm site (which has hardware but not live data) as sufficient for a 4-hour RTO, underestimating the time needed to restore and validate backups, which can easily exceed 4 hours for a CRM system with large databases.

How to eliminate wrong answers

Option A is wrong because a warm site has pre-installed hardware but may lack up-to-date data and require several hours to days to restore from backups, making it unsuitable for a 4-hour RTO. Option B is wrong because a mobile site is a portable unit that must be transported and configured on-site, typically taking days to become operational, far exceeding the 4-hour RTO. Option D is wrong because a cold site provides only physical infrastructure (power, cooling, space) with no IT equipment or data, requiring weeks to procure and install systems, which cannot meet a 4-hour RTO.

100
MCQmedium

An organization's incident response plan is tested annually. After a real incident, the team finds that the plan did not address cloud-based assets. What is the BEST action?

A.Migrate all cloud assets back on-premises
B.Retrain the IR team on cloud incident response
C.Create a separate cloud incident response plan
D.Update the incident response plan to include cloud scenarios
AnswerD

The plan must be revised based on lessons learned.

Why this answer

The plan should be updated to include cloud assets. Option D is correct. Option A only addresses the symptom; Option B may be unnecessary; Option C adds complexity.

101
MCQmedium

A security analyst notices multiple failed login attempts on a critical server followed by a successful login from an unusual IP address. Which metric would BEST capture this event?

A.Patch compliance
B.Training completion
C.Mean time to detect (MTTD)
D.Incident count
AnswerD

The failed and successful login attempts from an unusual IP indicate a potential security incident.

Why this answer

The incident count metric directly captures the occurrence of a security event—multiple failed logins followed by a successful login from an unusual IP—as a discrete security incident. This metric is used to track the number of such events over time, enabling trend analysis and resource allocation for incident response. It is the most appropriate measure for logging and reporting this specific sequence of authentication anomalies.

Exam trap

The trap here is that candidates confuse 'incident count' with 'mean time to detect' (MTTD), thinking MTTD captures the event itself, when in fact MTTD is a performance metric for detection speed, not a count of occurrences.

How to eliminate wrong answers

Option A is wrong because patch compliance measures the percentage of systems with up-to-date security patches, which does not capture real-time authentication events like failed or successful logins. Option B is wrong because training completion tracks whether users have finished security awareness courses, not the detection or occurrence of login anomalies. Option C is wrong because mean time to detect (MTTD) measures the average time between an incident's start and its discovery, not the event itself; it would be used after the incident is identified, not to capture the initial occurrence.

102
Multi-Selecteasy

Which TWO are components of the AAA framework? (Choose two.)

Select 2 answers
A.Authorization
B.Auditing
C.Accounting
D.Administration
E.Authentication
AnswersA, E

Authorization determines access rights.

Why this answer

Authorization (A) and Authentication (E) are two of the three core components of the AAA framework, as defined by Cisco and the IETF in RFC 2903 and RFC 2904. Authentication verifies the identity of a user or device (e.g., using RADIUS or TACACS+), while Authorization determines what resources or actions that authenticated entity is permitted to access. Together with Accounting, these three form the AAA triad used in network access control and security policy enforcement.

Exam trap

ISC2 often tests the AAA framework by including 'Auditing' as a distractor, leading candidates to confuse it with 'Accounting' because both involve logging, but Accounting is the correct term for tracking resource consumption in AAA.

103
Multi-Selectmedium

A vulnerability management team is scanning a network. Which THREE factors should be considered to minimize false positives?

Select 3 answers
A.Scanning only during peak hours
B.Using default scan profiles
C.Tuning the scanner based on the environment
D.Performing authenticated scans
E.Manually verifying results
AnswersC, D, E

Correct: Tuning reduces false positives by adjusting to the environment.

Why this answer

Tuning the scanner to the specific environment (e.g., adjusting port ranges, timing, and service detection patterns) reduces the likelihood of misidentifying benign traffic or non-vulnerable services as vulnerabilities. Untuned scanners often flag default banner responses or open ports that are actually part of normal operations, leading to false positives.

Exam trap

A common misconception is that scanning during peak hours yields more accurate results, when in fact it degrades scan reliability and increases false positives due to network load and timeouts.

104
Matchingmedium

Match each disaster recovery site type to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Fully operational, real-time replication

Partially configured, ready in hours

Empty facility, setup required

Portable unit with equipment

Why these pairings

Disaster recovery site types vary in readiness and equipment. Hot sites are fully operational, warm sites are partially equipped, cold sites provide only infrastructure, and mobile sites are portable units. Common confusions include mixing the definitions of hot and cold sites, or mistaking mobile sites for cold sites.

105
MCQhard

A vulnerability scan identifies a critical vulnerability with a CVSS score of 9.8. According to standard remediation SLAs, within what timeframe should this vulnerability typically be remediated?

A.30 days
B.24-72 hours
C.7 days
D.90 days
AnswerB

Critical vulnerabilities require immediate attention.

Why this answer

A CVSS score of 9.8 falls into the 'Critical' severity range (9.0–10.0). Standard remediation SLAs for critical vulnerabilities typically require action within 24–72 hours because such vulnerabilities often allow remote code execution or complete compromise without authentication, posing an immediate and severe risk to the organization.

Exam trap

The trap here is that candidates may confuse the CVSS severity categories with the typical SLA timeframes, often assuming that all 'critical' vulnerabilities have a 7-day window, when in fact the most severe (9.0–10.0) require remediation within 24–72 hours per standard industry frameworks like PCI DSS or NIST.

How to eliminate wrong answers

Option A is wrong because 30 days is the typical SLA for high-severity vulnerabilities (CVSS 7.0–8.9), not critical ones. Option C is wrong because 7 days is a common SLA for medium-severity vulnerabilities (CVSS 4.0–6.9) or for high-severity in some frameworks, but it is too long for a critical 9.8 score. Option D is wrong because 90 days is the typical SLA for low-severity vulnerabilities (CVSS 0.1–3.9) or for informational findings, and would be dangerously negligent for a critical vulnerability.

106
MCQhard

A financial firm is implementing a new access control system for its critical trading application. The application currently uses local accounts and password authentication. The security team wants to enforce multi-factor authentication (MFA) and centralized user management. The firm has an existing Active Directory (AD) infrastructure and a certificate authority (CA). However, the trading application only supports smart card authentication via PKI and does not support integration with AD directly. The IT team must design a solution that meets security requirements while minimizing changes to the application. Which approach should the team take?

A.Modify the application code to support SAML-based federation
B.Continue using local accounts but require a strong password policy and regular changes
C.Deploy a RADIUS server that forwards authentication to AD and use smart card emulation for the application
D.Set up a separate LDAP directory for the application and sync with AD
AnswerC

RADIUS can translate AD credentials to smart card authentication the app expects, without modifying the app.

Why this answer

The correct approach is to deploy a RADIUS server that authenticates against Active Directory and uses smart card emulation for the trading application. This solution centralizes user management via AD, enforces MFA through PKI-based smart cards, and requires no changes to the application code. Option A (SAML federation) would necessitate significant application modifications and is not inherently MFA-capable without additional setup.

Option B (local accounts with strong passwords) ignores MFA and centralized management. Option D (separate LDAP synced with AD) adds complexity and does not support smart card authentication for the application.

107
Multi-Selecteasy

Which TWO of the following are effective measures to prevent buffer overflow attacks in a custom-developed application?

Select 2 answers
A.Input validation
B.Using unpatched third-party libraries
C.Running the application with least privilege
D.Disabling ASLR
E.Stack canaries
AnswersA, E

Validating input length and content can prevent buffer overflows by rejecting oversized or malformed data.

Why this answer

Input validation helps ensure data fits within buffer limits, and stack canaries detect and prevent stack-based buffer overflows. Using unpatched libraries increases vulnerability; disabling ASLR makes exploitation easier; running with least privilege limits damage but does not prevent the overflow itself.

108
MCQhard

Refer to the exhibit. An administrator runs an OpenSSL s_client command and receives the output shown. What is the most likely cause of the 'unable to get local issuer certificate' error?

A.The server's private key is missing.
B.The client does not trust the issuing CA.
C.The server certificate is self-signed.
D.The server certificate has expired.
AnswerB

The 'unable to get local issuer certificate' error means the CA is not trusted.

Why this answer

The 'unable to get local issuer certificate' error from OpenSSL s_client indicates that the client (the machine running the command) does not have the issuing Certificate Authority (CA) certificate in its trust store. This means the client cannot verify the server certificate's chain of trust. Option B is correct because the error specifically points to a missing or untrusted CA certificate on the client side, not a problem with the server's private key, self-signing, or expiration.

Exam trap

The trap here is that candidates confuse 'unable to get local issuer certificate' with a server-side certificate issue (like expiration or self-signing), when it actually points to a client-side trust store problem.

How to eliminate wrong answers

Option A is wrong because a missing server private key would cause a different error, such as 'unable to load private key' or a TLS handshake failure, not an issuer certificate validation error. Option C is wrong because a self-signed certificate would produce an 'unable to verify the first certificate' or 'self-signed certificate in chain' error, not specifically 'unable to get local issuer certificate' (which implies a missing CA in the trust store, not a self-signed root). Option D is wrong because an expired server certificate would generate an 'certificate has expired' error during validation, not an issuer certificate lookup failure.

109
MCQmedium

A multinational company has a headquarters (HQ) and several branch offices connected via site-to-site IPsec VPN tunnels. The branch offices use a single internet connection and a VPN concentrator at HQ. Recently, users in the Asia branch report intermittent connectivity to the HQ file server, with high latency and occasional packet loss. The network team runs a traceroute from Asia branch to the HQ server; it shows the path goes through multiple hops with high latency at the second hop, which is the ISP router. The VPN tunnel status shows 'up' but with increasing rekey failures. The team has verified that the local internet link is stable and there are no bandwidth saturation issues. Which action should the team take first?

A.Upgrade the internet bandwidth at the Asia branch.
B.Change the tunnel to use a different encryption algorithm like AES-256.
C.Review and adjust the IPsec tunnel lifetime and rekeying thresholds.
D.Contact the ISP to check for routing issues.
AnswerC

Rekey failures indicate mismatch or too short lifetimes.

Why this answer

The symptoms—intermittent connectivity, high latency at the ISP router, and increasing rekey failures with the tunnel status 'up'—point to IPsec tunnel rekeying issues. Adjusting the IPsec tunnel lifetime and rekeying thresholds (Option C) directly addresses the root cause: the tunnel is attempting to renegotiate security associations (SAs) but failing, likely due to mismatched lifetimes or network delays during rekey. This is the first logical step before escalating to the ISP or changing encryption algorithms.

Exam trap

The trap here is that candidates see high latency at the ISP router and immediately blame the ISP (Option D) or bandwidth (Option A), overlooking the IPsec rekey failure logs and the fact that the tunnel is 'up' but failing to rekey, which is a classic IPsec misconfiguration symptom.

How to eliminate wrong answers

Option A is wrong because the local internet link is verified as stable with no bandwidth saturation, so upgrading bandwidth would not fix rekey failures or high latency at the ISP hop. Option B is wrong because changing the encryption algorithm (e.g., to AES-256) does not resolve rekey failures; it only changes the cipher used for data encryption, not the SA lifetime or rekeying process. Option D is wrong because the traceroute shows high latency at the ISP router, but the VPN tunnel is up and the issue is specific to rekey failures; contacting the ISP prematurely ignores the clear IPsec configuration problem.

110
MCQmedium

An organization wants to implement a key exchange mechanism that provides forward secrecy. Which of the following should be used?

A.Pre-shared key
B.Ephemeral Diffie-Hellman
C.RSA key exchange
D.Static Diffie-Hellman
AnswerB

Ephemeral DH provides forward secrecy.

Why this answer

Ephemeral Diffie-Hellman (DHE or ECDHE) provides forward secrecy because the session keys are ephemeral and not derived from long-term keys.

111
Multi-Selectmedium

Which TWO of the following are best practices for securing a wireless network?

Select 2 answers
A.Enabling MAC address filtering
B.Using WEP encryption
C.Leaving the default administrator password
D.Using WPA2-Enterprise with 802.1X
E.Disabling SSID broadcast
AnswersD, E

Provides strong authentication and encryption.

Why this answer

WPA2-Enterprise with 802.1X is a best practice because it provides strong encryption (AES-CCMP) and per-user authentication via a RADIUS server, eliminating the vulnerabilities of pre-shared keys. The 802.1X framework ensures that each user must authenticate individually, preventing unauthorized access even if a single credential is compromised. This is the gold standard for enterprise wireless security.

Exam trap

The trap here is that candidates often confuse 'disabling SSID broadcast' (option E) as a security measure, but it is a best practice for reducing network visibility in low-risk environments, even though it is not a strong security control; the SSCP exam expects you to recognize it as a valid defense-in-depth practice, not a primary security mechanism.

112
MCQeasy

Which access control model allows the owner of a resource to grant permissions to others?

A.Discretionary Access Control (DAC)
B.Attribute-Based Access Control (ABAC)
C.Mandatory Access Control (MAC)
D.Role-Based Access Control (RBAC)
AnswerA

DAC enables the resource owner to grant access to others.

Why this answer

DAC (Discretionary Access Control) allows the resource owner to decide who can access the resource and with what permissions.

113
MCQhard

A cloud security team is using Cloud Security Posture Management (CSPM) to identify misconfigurations. Which of the following scenarios is MOST likely to be detected by CSPM?

A.An application running on a cloud VM has a memory leak causing performance degradation
B.A cloud storage bucket is configured with public read access
C.A cloud-based database is experiencing slow query response times
D.An employee's credentials were used from an unusual geographic location
AnswerB

Publicly accessible buckets are a common misconfiguration detected by CSPM.

Why this answer

CSPM tools scan cloud environments for misconfigurations like publicly accessible storage buckets, excessive permissions, etc. An open S3 bucket is a classic misconfiguration.

114
MCQmedium

A security team is implementing a risk treatment plan for a high-risk vulnerability. The cost to fix the vulnerability is $100,000, but the expected loss if exploited is $1,000,000. The annual likelihood of exploitation is 2%. Which risk treatment strategy is most appropriate?

A.Avoid the risk by decommissioning the asset
B.Remediate the vulnerability immediately
C.Accept the risk and monitor for changes
D.Transfer the risk by purchasing cyber insurance
AnswerC

Expected loss is lower than remediation cost.

Why this answer

The annualized loss expectancy (ALE) is $20,000 (2% × $1,000,000), which is less than the $100,000 remediation cost. Since the cost to fix exceeds the expected loss, accepting the risk and monitoring for changes is the most cost-effective strategy. This aligns with the risk management principle that treatment should be proportional to the risk exposure.

Exam trap

ISC2 often tests the misconception that any high-severity vulnerability must be immediately remediated, ignoring the quantitative cost-benefit analysis that shows accepting risk can be the most appropriate strategy when the annualized loss is lower than the fix cost.

How to eliminate wrong answers

Option A is wrong because decommissioning the asset would eliminate all business value from it, which is an extreme measure not justified when the annual expected loss ($20,000) is far lower than the remediation cost ($100,000). Option B is wrong because immediate remediation would cost $100,000 to prevent a $20,000 annual expected loss, violating the cost-benefit principle of risk management. Option D is wrong because transferring the risk via cyber insurance would still involve premiums and deductibles that likely exceed the $20,000 ALE, and insurance does not reduce the technical vulnerability itself.

115
MCQhard

What does this log entry most likely indicate?

A.The SSH service is misconfigured
B.A user mistyped their password
C.An attacker is attempting to gain access by guessing usernames
D.The user account 'admin' has been disabled
AnswerC

The presence of an invalid username suggests reconnaissance or brute-force activity.

Why this answer

The log shows a failed SSH authentication for an 'invalid user' (i.e., a username that does not exist on the system). This is typical of a brute-force or reconnaissance attack where the attacker tries common usernames. Option C correctly identifies this as an attacker attempting to guess usernames.

Option A is incorrect because the log does not indicate misconfiguration. Option B is incorrect because it is not a mistyped password for a valid user; the user does not exist. Option D is incorrect because the user 'admin' does not exist, not just disabled.

116
Multi-Selecteasy

Which THREE of the following are common methods to identify risks in an organization?

Select 3 answers
A.Brainstorming.
B.Hash verification.
C.Fault tree analysis.
D.Delphi technique.
E.SWOT analysis.
AnswersA, D, E

Structured brainstorming sessions are a common qualitative risk identification technique.

Why this answer

Brainstorming is a common method for risk identification because it leverages group creativity to surface potential threats, vulnerabilities, and impacts that might not be captured by automated tools. In an organizational context, structured brainstorming sessions (e.g., using nominal group technique) help elicit a wide range of risks from diverse stakeholders, ensuring coverage across technical, operational, and strategic domains.

Exam trap

ISC2 often tests the distinction between risk identification methods (qualitative, human-driven) and risk analysis or control techniques (quantitative, automated), so candidates may incorrectly select hash verification or fault tree analysis because they sound technical or security-related, but they are not used for identifying new risks in an organizational context.

117
MCQhard

An organization uses an ABAC system to control access to documents. Policies are defined using attributes such as user department, document classification, and time of day. Which of the following is an example of an ABAC policy rule?

A.The owner of a document can grant read access to any other user.
B.Users in the 'HR' role can read documents classified as 'Confidential'.
C.All users with security clearance 'Secret' can read documents labeled 'Secret'.
D.If user.department == 'HR' AND doc.classification == 'Confidential' AND time.business_hours == true then permit read.
AnswerD

This uses subject attribute (department), object attribute (classification), and environment attribute (time).

Why this answer

ABAC policies use conditions based on subject, object, and environment attributes. The rule combines department, classification, and time.

118
MCQhard

An organization is configuring a VPN using IPsec. To ensure forward secrecy, which key exchange method should be used?

A.Ephemeral Diffie-Hellman (DHE or ECDHE)
B.RSA key exchange
C.Pre-shared key (PSK)
D.Static Diffie-Hellman
AnswerA

Ephemeral DH generates new key pairs for each session, so compromise of long-term keys does not expose past session keys.

Why this answer

Ephemeral Diffie-Hellman (DHE or ECDHE) provides forward secrecy because it generates a temporary, one-time key pair for each session. If the long-term private key is compromised, past session keys cannot be derived, as the ephemeral keys are discarded after use. This ensures that even if an attacker records encrypted traffic and later obtains the private key, they cannot decrypt past sessions.

Exam trap

The trap here is that candidates often confuse 'Diffie-Hellman' in general with forward secrecy, not realizing that only the ephemeral variant (DHE/ECDHE) provides it, while static Diffie-Hellman does not.

How to eliminate wrong answers

Option B (RSA key exchange) is wrong because RSA uses the server's static private key to encrypt the pre-master secret; if the private key is later compromised, all past session keys can be decrypted, providing no forward secrecy. Option C (Pre-shared key (PSK)) is wrong because PSK relies on a static shared secret that does not change per session; if the PSK is compromised, all past and future sessions can be decrypted. Option D (Static Diffie-Hellman) is wrong because it uses fixed, long-term Diffie-Hellman keys that do not change per session; compromise of the static private key allows an attacker to derive all past session keys, violating forward secrecy.

119
MCQhard

During a security audit, it is discovered that several employees have access to shared network drives containing sensitive HR data. The HR manager states that these employees no longer need access. What is the most efficient way to revoke access?

A.Remove the users from the security group that grants access to the drives.
B.Delete the user accounts of the affected employees.
C.Reconfigure the shared drive to deny access to all users except HR.
D.Manually remove each user's permissions on the shared drive.
AnswerA

Group-based management allows efficient revocation by modifying group membership.

Why this answer

The most efficient way to revoke access is to remove the users from the security group that grants access to the drives. In Windows environments, shared drive permissions are typically assigned to Active Directory security groups rather than individual users. By removing the users from the group, their permissions are revoked immediately across all resources that group has access to, without needing to touch each resource individually.

Exam trap

The trap here is that candidates may think manually removing permissions (Option D) is more precise, but they overlook that group-based management is the most efficient and scalable method in enterprise environments, and that deleting accounts (Option B) is a disproportionate response that violates operational continuity.

How to eliminate wrong answers

Option B is wrong because deleting user accounts is an extreme and irreversible action that disrupts all other services and access the employees may need, and it is not a targeted revocation of drive access. Option C is wrong because reconfiguring the shared drive to deny all users except HR would affect all other employees who might legitimately need access, and it does not address the specific users who should lose access without impacting others. Option D is wrong because manually removing each user's permissions on the shared drive is inefficient and error-prone, especially in large environments, and does not leverage group-based access control which is the standard for scalable permission management.

120
MCQmedium

A security administrator is evaluating backup strategies for a critical database with a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 1 hour. Which backup approach best meets these requirements?

A.Weekly full backups and daily differential backups
B.Weekly full backups and hourly incremental backups
C.Monthly full backups and weekly incremental backups
D.Daily full backups with no incremental backups
AnswerB

Hourly incremental backups meet the 1-hour RPO, and the weekly full backup ensures a baseline for recovery within the 4-hour RTO.

Why this answer

Hourly incremental backups ensure that data loss is limited to at most one hour (meeting the 1-hour RPO), while the weekly full backup combined with the incremental chain allows restoration within the 4-hour RTO, assuming the restore process is optimized. Incremental backups capture only changes since the last backup, reducing storage and backup time, which is critical for meeting tight RPOs.

Exam trap

The trap here is that candidates often confuse differential backups (which capture all changes since the last full backup) with incremental backups (which capture changes since the last backup of any type), leading them to choose daily differentials without realizing the RPO would be 24 hours, not 1 hour.

How to eliminate wrong answers

Option A is wrong because daily differential backups grow in size each day and, combined with a weekly full, the restore time can exceed 4 hours if the last differential is large, and the RPO is up to 24 hours (not 1 hour). Option C is wrong because monthly full backups with weekly incremental backups result in an RPO of up to 7 days, far exceeding the 1-hour requirement, and restore time would be excessive due to the long incremental chain. Option D is wrong because daily full backups provide an RPO of up to 24 hours, which violates the 1-hour RPO, and the backup window and storage overhead are impractical for a critical database.

121
MCQmedium

An employee is leaving the company. As part of the offboarding process, which action should be taken regarding the hardware assigned to the employee?

A.Keep the hardware in storage indefinitely
B.Sanitise the hard drive and then dispose or reassign
C.Recycle the hardware without any data removal
D.Reassign the hardware to a new employee without wiping
AnswerB

Sanitisation ensures data is irretrievably removed before reuse or disposal.

Why this answer

Media handling policies require that portable media be sanitised before disposal to prevent data leakage. Hard drives should be wiped or destroyed.

122
MCQmedium

A company's policy requires that all data at rest be encrypted. Which of the following is the most effective method to encrypt files on a laptop?

A.Encrypt only the user's home folder.
B.Encrypt individual files using a symmetric key.
C.Implement full disk encryption (FDE).
D.Use a self-extracting encrypted archive.
AnswerC

FDE provides blanket encryption for the entire drive.

Why this answer

Full disk encryption (FDE) encrypts the entire storage volume, including the operating system, swap files, temporary files, and all user data. This ensures that if the laptop is lost or stolen, all data at rest is protected without relying on the user to selectively encrypt files or folders, which can leave sensitive data exposed in unencrypted system areas.

Exam trap

The trap here is that candidates often choose encrypting only the home folder or individual files because they think it is sufficient, but they overlook that system areas like swap, temp, and hibernation files can contain sensitive data in plaintext, making full disk encryption the only comprehensive solution for data at rest on a laptop.

How to eliminate wrong answers

Option A is wrong because encrypting only the user's home folder leaves the operating system, swap files, temporary files, and other system areas unencrypted, which can contain cached or residual copies of sensitive data. Option B is wrong because encrypting individual files with a symmetric key requires manual selection and management of each file, increasing the risk of human error and leaving metadata, temporary copies, and swap space unencrypted. Option D is wrong because a self-extracting encrypted archive only protects the specific files placed inside it, leaving the rest of the filesystem and system areas unencrypted, and it requires user interaction to create and extract, making it impractical for comprehensive data-at-rest protection.

123
MCQhard

An organization uses a cloud-based file synchronization service to share project files with external partners. The security team discovers that an unauthorized third party accessed sensitive documents by guessing weak passwords. Which additional control would most effectively mitigate this risk?

A.Enforcing multi-factor authentication for all external users.
B.Requiring all file transfers to use SFTP instead of HTTPS.
C.Implementing file-level encryption with keys stored on-premises.
D.Configuring the service to use a custom domain certificate.
AnswerA

MFA prevents login even if passwords are guessed, reducing the risk of unauthorized access.

Why this answer

Multi-factor authentication directly addresses credential guessing by requiring a second factor. Option B is incorrect because SFTP does not inherently provide stronger authentication than HTTPS. Option C is incorrect because file-level encryption with on-premises keys does not prevent unauthorized access if the attacker already has valid credentials.

Option D is incorrect because a custom domain certificate does not affect authentication strength.

124
Multi-Selectmedium

Which three of the following are best practices for securing a wireless network? (Choose three.)

Select 3 answers
A.Use MAC address filtering
B.Set a weak passphrase for guest network
C.Disable SSID broadcast
D.Enable WPA3-Enterprise
E.Implement rogue AP detection
AnswersC, D, E

Hiding the SSID reduces casual detection.

Why this answer

Disabling SSID broadcast prevents the access point from including its network name in beacon frames, making the network less visible to casual scanning tools. While this does not provide true security (as the SSID can still be discovered via passive monitoring of probe responses or association frames), it reduces the attack surface by hiding the network from non-malicious users and automated discovery scripts.

Exam trap

ISC2 often tests the misconception that disabling SSID broadcast is a strong security measure, when in reality it is only a minor obscurity technique that does not protect against determined attackers using passive sniffing tools like Wireshark or airodump-ng.

125
MCQhard

A security awareness program is being developed. Which topic is MOST critical for all employees to understand to reduce the risk of social engineering?

A.The risks of posting on social media
B.The proper use of mobile devices
C.How to recognize and report phishing attempts and other suspicious communications
D.How to create strong passwords
AnswerC

Social engineering often uses phishing or pretexting; reporting is vital.

Why this answer

Social engineering attacks, such as phishing, vishing, and smishing, exploit human psychology rather than technical vulnerabilities. The most critical defense for all employees is the ability to recognize indicators of these attacks (e.g., spoofed sender addresses, urgent language, mismatched URLs) and follow the proper reporting procedure to enable rapid incident response. Without this skill, even the strongest technical controls can be bypassed by a single successful click.

Exam trap

ISC2 often tests the distinction between general security best practices (like strong passwords) and the specific, human-focused defense against social engineering, where recognition and reporting are paramount.

How to eliminate wrong answers

Option A is wrong because while social media risks are relevant, they are a subset of social engineering vectors and not the most immediate, universal threat; the primary attack vector is email-based phishing. Option B is wrong because mobile device usage policies (e.g., MDM, encryption) address device security but do not directly train employees to identify deceptive communications. Option D is wrong because strong passwords mitigate credential-guessing attacks, but social engineering bypasses passwords entirely by tricking users into revealing them or executing actions without authentication.

126
Multi-Selecthard

Which THREE of the following are valid considerations when deploying a remote access VPN using SSL/TLS? (Select THREE)

Select 3 answers
A.Typically uses UDP port 500
B.Supports endpoint security posture checks
C.Can be configured for split tunneling
D.Can traverse firewalls more easily than IPsec
E.Requires pre-shared keys for authentication
AnswersB, C, D

Many SSL VPNs can check for antivirus, updates, etc., before connecting.

Why this answer

SSL/TLS VPNs use standard ports (often 443) to bypass firewalls, can perform endpoint posture checks, and allow split tunneling for performance.

127
MCQeasy

Which of the following is a method to check the revocation status of a digital certificate in real-time without the client downloading a full list?

A.Certificate Revocation List (CRL)
B.Self-signed certificate validation
C.Online Certificate Status Protocol (OCSP)
D.Certificate Transparency (CT)
AnswerC

OCSP provides real-time revocation status for individual certificates.

Why this answer

OCSP allows querying the CA's responder for the status of a specific certificate in real-time.

128
Multi-Selectmedium

An organization is reviewing its account lifecycle management process. Which TWO activities are part of the provisioning phase? (Select TWO.)

Select 2 answers
A.Creating user accounts in the identity store
B.Modifying user roles due to job change
C.Archiving user data for compliance
D.Assigning initial role memberships and permissions
E.Disabling accounts upon termination
AnswersA, D

This is the core of provisioning new users.

Why this answer

Provisioning involves creating accounts and assigning initial roles/permissions upon onboarding. Modifying roles is a change, not initial provisioning. Disabling is deprovisioning.

129
MCQmedium

A company uses a SIEM to detect anomalies. An alert indicates a user logged in from two geographically distant locations within 5 minutes. What is the most likely indication?

A.Insider threat
B.Time synchronization issue
C.Credential theft and reuse
D.Misconfigured VPN
AnswerC

This is a classic sign of stolen credentials being used by an attacker.

Why this answer

A scenario where a user logs in from two geographically distant locations within a short time frame is a classic indicator of credential theft and reuse. An attacker likely obtained the user's credentials and is using them from a different location. Option A (Insider threat) is less likely because an insider would not typically need to log in from two distant locations simultaneously.

Option B (Time synchronization issue) would cause log timestamps to be off, but not the pattern of two logins from different locations. Option D (Misconfigured VPN) could mask the actual location but would not typically produce two distinct distant locations. Therefore, option C is the most likely indication.

130
MCQmedium

An organization wants to ensure that sensitive data on laptops is protected in case of loss or theft. Which control is MOST effective?

A.Full disk encryption
B.Strong password policy
C.Asset tracking software
D.Remote wiping capability
AnswerA

Encryption renders data inaccessible without the key, protecting against physical theft.

Why this answer

Full disk encryption (FDE) is the most effective control because it renders data unreadable at rest on the entire drive, including the operating system, swap files, and temporary files. Without the decryption key (e.g., a pre-boot PIN or TPM-bound key), an attacker cannot access any data even if the laptop is physically removed. This directly addresses the threat of data exposure from loss or theft, unlike controls that only limit access or track the device.

Exam trap

The trap here is that candidates often choose remote wiping (D) because it seems proactive, but they overlook the critical requirement that the device must be online and powered on to execute the wipe, whereas full disk encryption protects data even if the device is never turned on again.

How to eliminate wrong answers

Option B (Strong password policy) is wrong because it only protects against unauthorized login attempts; if the attacker bypasses the OS (e.g., by booting from a live USB or removing the hard drive), the data is fully accessible without decryption. Option C (Asset tracking software) is wrong because it only helps locate or recover the laptop after loss, but does not prevent data exposure if the device is stolen and the hard drive is removed or imaged. Option D (Remote wiping capability) is wrong because it relies on the laptop being powered on and connected to a network to receive the wipe command; if the thief immediately disconnects the device or removes the drive, the data remains intact and accessible.

131
MCQeasy

A company wants to ensure that employees connecting from home use a secure tunnel to access internal resources. Which protocol should be implemented?

A.SFTP
B.Telnet
C.SSH
D.SSL/TLS VPN
AnswerD

A SSL/TLS VPN creates an encrypted tunnel for remote users to access internal resources securely.

Why this answer

An SSL/TLS VPN creates an encrypted tunnel over HTTPS (port 443) between the remote user's browser or client and the corporate VPN gateway, securing all traffic to internal resources. This is the standard solution for remote access VPNs because it uses ubiquitous SSL/TLS protocols, avoids the need for IPsec client software, and can traverse firewalls and NAT devices easily.

Exam trap

ISC2 often tests the distinction between SSH (a secure remote administration tool) and SSL/TLS VPN (a full remote access VPN solution), leading candidates to mistakenly choose SSH because they know it provides encryption, without realizing it does not create a comprehensive network tunnel for all internal resource access.

How to eliminate wrong answers

Option A is wrong because SFTP (SSH File Transfer Protocol) is designed only for secure file transfer, not for creating a full network tunnel to access multiple internal resources. Option B is wrong because Telnet transmits all data, including credentials, in cleartext and provides no encryption or security whatsoever. Option C is wrong because SSH creates a secure shell session or port forwarding tunnel, but it is not designed as a full VPN solution for all internal resource access; it requires manual port forwarding and does not natively support routing all client traffic through the tunnel.

132
MCQeasy

Which Windows feature provides mandatory integrity controls and helps prevent unauthorized changes to system settings by requiring administrator approval?

A.Windows Defender Application Control
B.Security Audit Policy
C.User Account Control (UAC)
D.Group Policy
AnswerC

UAC prompts for approval for administrative actions.

Why this answer

User Account Control (UAC) prompts for consent or credentials before allowing actions that require administrative privileges, helping to prevent unauthorized changes.

133
Multi-Selectmedium

A company is migrating from 3DES to a modern encryption algorithm. Which of the following are acceptable choices? (Select TWO)

Select 2 answers
A.DES
B.ChaCha20
C.AES
D.RC4
E.Blowfish
AnswersB, C

ChaCha20 is a modern stream cipher, considered secure and efficient.

Why this answer

AES and ChaCha20 are modern symmetric ciphers considered secure. RC4 is broken, Blowfish is older (64-bit block), and DES is obsolete.

134
MCQmedium

During a security assessment, a penetration tester discovers that the network uses WPA2-PSK. Which attack could be used to recover the pre-shared key without interacting with the access point after capturing a single handshake?

A.Deauthentication attack
B.KRACK attack
C.Evil twin attack
D.PMKID attack
AnswerD

The PMKID is included in the first EAPOL frame and can be used to crack the PSK offline.

Why this answer

The PMKID attack allows offline cracking of the PSK using information from the first frame of the 4-way handshake, even without a full handshake.

135
MCQhard

A security analyst is reviewing traffic logs and sees that a host is sending ICMP echo requests to multiple external IPs. This behavior is most likely indicative of:

A.Normal network monitoring
B.A DDoS attack
C.A DNS amplification attack
D.A ping sweep reconnaissance
AnswerD

Ping sweeps are used to identify active hosts.

Why this answer

ICMP echo requests (ping) sent to multiple external IPs from a single host is characteristic of a ping sweep, which is a reconnaissance technique used to map live hosts on a network. Unlike a DDoS or amplification attack, this activity originates from one host and targets many destinations to identify which IPs are responsive, aiding an attacker in planning further exploitation.

Exam trap

ISC2 often tests the distinction between reconnaissance and attack phases, so the trap here is confusing a single-source sweep (reconnaissance) with a multi-source flood (DDoS), leading candidates to incorrectly select the DDoS option.

How to eliminate wrong answers

Option A is wrong because normal network monitoring typically uses SNMP, NetFlow, or passive traffic analysis, not active ICMP echo requests to multiple external IPs, which would be noisy and unnecessary for routine monitoring. Option B is wrong because a DDoS attack involves many sources overwhelming a single target, whereas this scenario shows one host sending to many targets, which is the reverse traffic pattern. Option C is wrong because a DNS amplification attack uses spoofed source IPs with DNS queries to amplify traffic toward a victim, not ICMP echo requests from a single host to multiple IPs.

136
MCQhard

A security analyst notices that a Linux server has an unusual number of failed login attempts for the root account. To strengthen authentication security while preserving administrative access, which of the following configurations would be most effective?

A.Configure SELinux to enforce mandatory access control on the /etc/shadow file
B.Implement account lockout via PAM module pam_tally2
C.Change the root password every 30 days
D.Disable root login entirely and require sudo for all administrative tasks
AnswerB

pam_tally2 locks the account after a configurable number of failed attempts, directly addressing brute-force attacks.

Why this answer

PAM (Pluggable Authentication Modules) can enforce account lockout after a number of failed attempts. This mitigates brute-force attacks while allowing legitimate administrators to unlock accounts if needed.

137
MCQmedium

Which wireless security protocol uses the Simultaneous Authentication of Equals (SAE) handshake to replace the Pre-Shared Key (PSK) method and provides stronger protection against offline dictionary attacks?

A.WPA2
B.WPA
C.WPA3
D.WEP
AnswerC

WPA3 uses SAE to replace PSK.

Why this answer

WPA3 uses SAE for secure key exchange, replacing WPA2's PSK.

138
MCQhard

An organization is implementing 802.1X authentication for wired network access. Which server is required to authenticate users?

A.DHCP server
B.TACACS+ server
C.Kerberos server
D.RADIUS server
AnswerD

RADIUS is the standard authentication server for 802.1X, handling user credentials and policy enforcement.

Why this answer

802.1X is a port-based network access control protocol that uses the Extensible Authentication Protocol (EAP) to authenticate devices before granting network access. The authentication server in an 802.1X deployment must be a RADIUS server, as defined in IEEE 802.1X-2020, because it acts as the backend that validates credentials and communicates with the authenticator (switch) via RADIUS (RFC 2865).

Exam trap

The trap here is that candidates often confuse TACACS+ with RADIUS because both are AAA protocols, but 802.1X specifically mandates RADIUS for EAP transport, whereas TACACS+ encrypts the entire packet and is used for device administration, not port-based network access control.

How to eliminate wrong answers

Option A is wrong because a DHCP server dynamically assigns IP addresses and does not perform authentication; it operates after network access is granted. Option B is wrong because TACACS+ is a Cisco-proprietary protocol that separates authentication, authorization, and accounting (AAA) but is not used in 802.1X; 802.1X requires RADIUS for EAP encapsulation and port-based control. Option C is wrong because a Kerberos server provides ticket-based authentication for network services (e.g., Active Directory) but does not support the EAP-over-RADIUS exchange required by 802.1X; it is not designed for port-based access control.

139
Multi-Selectmedium

Which TWO of the following are essential components of a disaster recovery plan (DRP)?

Select 2 answers
A.Recovery Time Objective (RTO)
B.Recovery Point Objective (RPO)
C.Business Continuity Plan (BCP)
D.A RACI matrix for incident response
E.Results of a penetration test
AnswersA, B

RTO is a key metric in DRP.

Why this answer

Options A and B are correct. Recovery Time Objective (RTO) defines the maximum acceptable downtime, and Recovery Point Objective (RPO) defines the maximum acceptable data loss. Option C (Business Continuity Plan) is related but broader and not specifically a DRP component.

Option D (RACI matrix) is for responsibility assignment, not a core DRP component. Option E (penetration test results) is a security assessment, not a DRP component.

140
MCQeasy

Which of the following is a connectionless transport layer protocol primarily used for services like DNS and DHCP?

A.UDP
B.IP
C.TCP
D.ICMP
AnswerA

UDP is connectionless and used by DNS and DHCP.

Why this answer

UDP is connectionless and used by DNS (port 53) and DHCP (ports 67-68).

141
MCQmedium

In a Kerberos environment, what is the primary function of the Ticket Granting Ticket (TGT)?

A.To store the user's password hash securely
B.To request service tickets from the Ticket Granting Service (TGS)
C.To provide a session key for encrypting communications
D.To authenticate the user to the Key Distribution Center (KDC)
AnswerB

The TGT is presented to the TGS to obtain service tickets for resources.

Why this answer

The TGT is obtained after initial authentication and is used to request service tickets for various resources without re-authenticating.

142
MCQmedium

A government contractor is required to comply with the Federal Information Security Management Act (FISMA). The security officer must implement a continuous monitoring program for all information systems. The contractor uses a mix of on-premises servers and cloud services. The contractor has a SIEM tool that collects logs from all systems. However, the SIEM generates a high number of alerts, many of which are false positives, overwhelming the security team. The team wants to improve the effectiveness of the monitoring program without increasing staff. Which of the following actions would MOST effectively address the issue?

A.Disable alerts for low-severity events
B.Hire additional security analysts to review all alerts
C.Increase the frequency of log collection to every minute
D.Tune the SIEM correlation rules and create custom filters to reduce false positive alerts
AnswerD

This directly reduces alert fatigue and improves efficiency.

Why this answer

Tuning the SIEM correlation rules and creating custom filters directly reduces false positives, making alerts more actionable and allowing the team to focus on real incidents without adding staff. Option A (disabling low-severity alerts) is too blunt and may miss important events. Option B (hiring analysts) is costly and doesn't address the root cause.

Option C (increasing log collection frequency) would generate even more alerts, worsening the problem.

143
Multi-Selectmedium

A security administrator is implementing a change management process. Which TWO of the following are essential components of a change management policy? (Choose two.)

Select 2 answers
A.Vulnerability scanning results
B.A rollback plan
C.Emergency change procedures
D.Automated patch deployment schedule
E.Approval from the change advisory board (CAB)
AnswersB, E

A rollback plan ensures changes can be reversed if needed.

Why this answer

The essential components of a change management policy include a rollback plan (to revert changes if issues arise) and approval from the change advisory board (CAB) to ensure proper oversight. Vulnerability scanning results and automated patch deployment schedules are not policy components; they are operational activities. Emergency change procedures are a specific type of change, not a fundamental component of the policy itself.

144
MCQeasy

A remote employee needs secure access to corporate resources over the internet. Which protocol is considered best practice for site-to-site VPN?

A.IPsec with IKEv2
B.PPTP (Point-to-Point Tunneling Protocol)
C.SSL VPN (Secure Sockets Layer VPN)
D.L2TP (Layer 2 Tunneling Protocol) without IPsec
AnswerA

IPsec/IKEv2 is a secure standard for site-to-site VPNs.

Why this answer

IPsec with IKEv2 (Internet Key Exchange version 2) is the best practice for site-to-site VPNs because it provides strong authentication, encryption, and integrity checking for all traffic between two fixed endpoints. IKEv2 offers built-in mobility, faster rekeying, and resistance to Denial-of-Service attacks compared to IKEv1, making it the recommended choice for secure, persistent site-to-site connections over the internet.

Exam trap

The trap here is that candidates often confuse SSL VPN (which is for remote access) with site-to-site VPN requirements, or they mistakenly think L2TP alone provides security, when in fact L2TP must be paired with IPsec to be secure.

How to eliminate wrong answers

Option B (PPTP) is wrong because it uses MPPE encryption which is based on RC4, a stream cipher that is cryptographically broken and susceptible to dictionary attacks; PPTP also lacks strong authentication and integrity verification. Option C (SSL VPN) is wrong because it is designed for client-to-site (remote access) VPNs, not for site-to-site VPNs; SSL VPNs operate at the application layer and are not optimized for routing entire network segments between two sites. Option D (L2TP without IPsec) is wrong because L2TP provides only tunneling and no encryption or authentication by itself, leaving all traffic transmitted in cleartext and vulnerable to interception.

145
MCQeasy

A security policy requires that all access to sensitive data be logged. Which access control function does this support?

A.Authentication
B.Authorization
C.Accounting
D.Provisioning
AnswerC

Accounting tracks and logs user actions for auditing.

Why this answer

The requirement to log all access to sensitive data directly supports the Accounting (auditing) function of access controls. Accounting tracks user activities and resource usage, providing an audit trail that can be reviewed for compliance, security incidents, and policy enforcement. This is distinct from Authentication (verifying identity) and Authorization (granting permissions), which do not inherently produce logs of access events.

Exam trap

The trap here is that candidates confuse Authorization (which controls access) with Accounting (which records access), mistakenly thinking that setting permissions automatically logs access, when in fact logging requires a separate audit configuration.

How to eliminate wrong answers

Option A is wrong because Authentication is the process of verifying a user's identity (e.g., via passwords, biometrics, or certificates) and does not inherently generate logs of access to sensitive data; logging is an Accounting function. Option B is wrong because Authorization determines what an authenticated user is allowed to do (e.g., via ACLs or RBAC) but does not itself record access events; that recording is the role of Accounting. Option D is wrong because Provisioning refers to the creation, modification, or removal of user accounts and access rights (e.g., via identity management systems) and does not include logging of access to data.

146
MCQmedium

A company uses virtualization extensively. The security team discovers that developers have created many unmanaged virtual machines that are not tracked in the configuration management database (CMDB). Which risk is MOST directly associated with this situation?

A.VM escape
B.VM sprawl
C.Snapshot vulnerability reintroduction
D.Insecure hypervisor configuration
AnswerB

Unmanaged VMs accumulating is known as VM sprawl.

Why this answer

VM sprawl refers to the proliferation of unmanaged VMs, increasing attack surface and management complexity.

147
Multi-Selectmedium

Which TWO of the following cryptographic algorithms are considered secure for modern use?

Select 2 answers
A.MD5 (Message Digest 5)
B.ChaCha20
C.AES-256 (Advanced Encryption Standard with 256-bit key)
D.RC4 (Rivest Cipher 4)
E.DES (Data Encryption Standard)
AnswersB, C

ChaCha20 is a secure stream cipher, commonly used in TLS.

Why this answer

ChaCha20 (option B) and AES-256 (option C) are considered secure for modern use. DES, RC4, and MD5 are broken or deprecated.

148
MCQmedium

Based on the exhibit, which type of attack is most likely occurring?

A.Brute force attack
B.Man-in-the-middle attack
C.Denial of service attack
D.Social engineering attack
AnswerA

Repeated failed password attempts from same IP is classic brute force.

Why this answer

A brute force attack is most likely occurring because the exhibit shows repeated login attempts with different passwords for the same username, which is the hallmark of an automated password guessing attack. The rapid succession of failed authentication events indicates a systematic trial of credentials, not a single intercepted session or resource exhaustion.

Exam trap

The trap here is that candidates may confuse a brute force attack with a denial of service attack because both can generate high volumes of traffic, but the key differentiator is the repeated authentication failure pattern versus resource exhaustion.

How to eliminate wrong answers

Option B is wrong because a man-in-the-middle attack involves intercepting and potentially altering communications between two parties, which would show evidence of ARP spoofing, SSL stripping, or session hijacking, not repeated login attempts. Option C is wrong because a denial of service attack aims to overwhelm a system with traffic or requests to cause resource exhaustion, not to guess passwords through multiple authentication failures. Option D is wrong because social engineering attacks rely on manipulating human behavior through deception or impersonation, not on automated password guessing against a system.

149
MCQhard

Based on the exhibit, what is the most critical observation?

A.A root user is opening RDP to the world.
B.A user is modifying a security group.
C.The event is from EC2 service.
D.The source IP is internal.
AnswerA

Root access combined with an open RDP rule to 0.0.0.0/0 poses a severe security risk.

Why this answer

The most critical observation is that a root user is opening RDP (TCP/3389) to the world (0.0.0.0/0). This creates an extreme security risk because it exposes the administrative interface to the entire internet, allowing any attacker to attempt brute-force or exploit RDP vulnerabilities. In AWS CloudTrail, this event indicates a direct violation of the principle of least privilege and is a common vector for compromise.

Exam trap

The trap here is that candidates focus on the user or service name (e.g., 'root user' or 'EC2') rather than the actual security impact of opening RDP to the world, which is the most critical observation in this scenario.

How to eliminate wrong answers

Option B is wrong because modifying a security group is a normal administrative action and not inherently critical; the risk depends on what is being modified (e.g., opening RDP to the world). Option C is wrong because the event originating from the EC2 service is irrelevant; the criticality is determined by the action (root user opening RDP to the world), not the source service. Option D is wrong because the source IP being internal is not the critical observation; the critical issue is the destination (0.0.0.0/0) and the user (root), not the source address.

150
MCQmedium

An administrator configures a Kerberos authentication system. After implementation, users are able to authenticate but cannot access network resources. The administrator verifies that the client time is synchronized with the KDC. What is the most likely cause?

A.The service principal name (SPN) is not registered
B.The user’s password is expired
C.The firewall blocks port 88
D.The TGT lifetime has expired
AnswerA

Without a proper SPN, the KDC cannot issue a service ticket.

Why this answer

The most likely cause is that the service principal name (SPN) is not registered. In Kerberos, the SPN uniquely identifies a network service instance and is required for the KDC to issue a service ticket. Even though users can authenticate (obtain a TGT), without a properly registered SPN, the KDC cannot grant a ticket for the target service, preventing access to network resources.

Exam trap

ISC2 often tests the distinction between authentication (TGT acquisition) and authorization (service ticket issuance), leading candidates to incorrectly focus on firewall rules or password expiration instead of the missing SPN.

How to eliminate wrong answers

Option B is wrong because an expired user password would prevent initial authentication (TGT acquisition), but the scenario states users can authenticate. Option C is wrong because port 88 is used for Kerberos authentication traffic; if it were blocked, users would not be able to authenticate at all. Option D is wrong because an expired TGT lifetime would prevent access only after the TGT expires, but users are currently able to authenticate and the issue is immediate access to network resources.

Page 1

Page 2 of 13

Page 3