920 questions total · 13pages · All types, answers revealed
Tunnel mode encrypts the entire IP packet and adds a new header.
Why this answer
In tunnel mode, the entire original IP packet is encapsulated and encrypted, with a new IP header added, suitable for site-to-site VPNs.
A company deploys a new web application and wants to ensure that session tokens are not vulnerable to session hijacking. Which of the following controls is most effective?
Secure flag forces HTTPS; HttpOnly prevents script access, mitigating XSS-based theft.
Why this answer
Setting the Secure and HttpOnly flags ensures cookies are only sent over HTTPS and not accessible via JavaScript, preventing interception and XSS-based theft. Option A (bind to IP) can cause issues with mobility; Option B (short timeout) helps reduce exposure but does not prevent hijacking; Option C (encrypt token) is redundant if HTTPS is used; Option D (regenerate after each request) is impractical and not necessary.
You are a security consultant for a hospital that is deploying a new IoT medical device system. The devices wirelessly transmit patient vital signs to a central server. The hospital is subject to HIPAA. The devices were developed by a startup and are not widely field-tested. The IT department wants to connect the devices to the existing network for real-time monitoring. The risk management team has identified potential threats including data interception, device tampering, and denial of service. They have no prior experience with IoT security. Which of the following risk treatment strategies is MOST appropriate given the high uncertainty?
Avoidance is justified when risks are not well understood and potential impact is high.
Why this answer
The high uncertainty surrounding the startup's untested IoT devices, combined with the criticality of patient safety and HIPAA compliance, makes avoidance the most prudent strategy. Delaying deployment allows for a thorough risk assessment and independent security testing to identify vulnerabilities before exposing the hospital network to potential data interception, device tampering, or denial-of-service attacks. This approach directly addresses the risk management team's lack of IoT security experience by preventing exposure until the threat landscape is better understood.
Exam trap
The trap here is that candidates often choose mitigation (Option D) because it seems proactive and technically sound, but they overlook the principle that mitigation is only appropriate when the risk is well-understood and the controls are proven effective—neither of which applies to untested IoT devices with unknown vulnerabilities.
How to eliminate wrong answers
Option A is wrong because accepting risk without understanding the specific vulnerabilities of untested IoT devices could lead to HIPAA violations and patient harm, as the devices transmit protected health information (PHI) over wireless links susceptible to interception. Option B is wrong because cyber insurance transfers financial risk but does not reduce the likelihood or impact of a security incident; it also does not address the immediate technical threats like device tampering or denial of service that could disrupt patient monitoring. Option D is wrong because while VLAN segmentation and encryption (e.g., using TLS 1.3 or IPsec) are valid mitigation techniques, they are insufficient when the devices themselves may have undisclosed backdoors, weak cryptographic implementations, or unpatched firmware flaws that could be exploited despite network controls.
Which TWO of the following are considered key components of a disaster recovery plan?
RPO defines the maximum acceptable data loss in terms of time.
Why this answer
RPO and RTO are fundamental metrics in a disaster recovery plan. RPO defines the maximum acceptable data loss measured in time, dictating the frequency of backups. RTO defines the maximum acceptable downtime after a disaster, setting the target for system restoration.
Both directly drive the technical design of replication, backup schedules, and failover procedures.
Exam trap
ISC2 often tests the distinction between DR plan components (RPO/RTO) and broader business continuity concepts (BCP) or contractual metrics (SLA), leading candidates to confuse SLA with RTO or think BCP is part of the DR plan itself.
An analyst detects outbound traffic from a workstation to a known malicious IP address. The workstation is a developer machine with local admin rights. Which containment action should be taken first?
Stops all malicious outbound traffic and lateral movement.
Why this answer
The first step is to isolate the workstation from the network (Option B) to prevent further communication with the malicious IP and lateral movement. Blocking only the IP (Option A) is insufficient because the malware may use other IPs. Shutting down (Option C) may lose volatile evidence.
Disabling the user's account (Option D) does not stop network traffic from the workstation.
Which TWO factors are most critical when selecting a cryptographic algorithm for a government application?
Key length directly affects security strength.
Why this answer
For government applications, regulatory compliance (e.g., FIPS 140-2) is critical because it mandates that cryptographic modules meet specific security standards for protecting sensitive data. Key length is equally critical because it directly determines the algorithm's resistance to brute-force attacks; insufficient key length can render encryption ineffective regardless of other factors.
Exam trap
ISC2 often tests the misconception that speed or popularity are primary selection criteria, when in fact government applications are driven by regulatory mandates and cryptographic strength (key length) as defined by standards like FIPS.
A security engineer is designing a system to store passwords securely. Which of the following is the most robust approach for password storage?
bcrypt is slow and includes a salt, making it resistant to brute-force and rainbow tables.
Why this answer
Bcrypt is the most robust option because it incorporates a salt to defend against rainbow table attacks and uses a configurable cost factor to deliberately slow down the hashing process, making brute-force attacks computationally expensive. Unlike general-purpose hashes like SHA-256, bcrypt is designed specifically for password storage and resists GPU-accelerated attacks by requiring significant memory and time per attempt.
Exam trap
ISC2 often tests the misconception that encryption (AES) is equivalent to hashing for password storage, but the trap is that encryption is reversible and introduces key management risks, whereas a proper password storage mechanism must be one-way and computationally expensive.
How to eliminate wrong answers
Option A is wrong because SHA-256 is a fast, general-purpose cryptographic hash that lacks a built-in salt and is vulnerable to rainbow table and brute-force attacks when used alone for password storage. Option B is wrong because Base64 is an encoding scheme, not a cryptographic operation; it provides no security and can be trivially reversed to recover the original password. Option C is wrong because encrypting passwords with AES-256 introduces key management complexity, and if the encryption key is compromised, all stored passwords can be decrypted; encryption is reversible by design, whereas password storage requires a one-way, irreversible function.
A security engineer is designing a DMZ to host public-facing services. Which two security best practices should be applied? (Choose two.)
A screened subnet (DMZ) between two firewalls provides defense in depth for public services.
Why this answer
A screened subnet with two firewalls creates a buffer zone, and allowing inbound traffic only on required ports minimizes exposure. Placing web servers on the internal network would expose them, sharing rules with the internal network increases risk, and full mesh connectivity between DMZ hosts facilitates lateral movement.
A security analyst notices that a user's account was used to access sensitive files after the user had left the company. Which access control principle was most likely violated?
Accountability requires that activities can be traced to individuals; an active account of a former employee undermines this.
Why this answer
Accountability requires that actions be traced to individuals. If an account is not disabled promptly, actions cannot be reliably attributed.
During a physical security audit, it is discovered that employees often prop open the mantrap door to allow easier access. What is the BEST control to address this?
Correct. This discourages propping and alerts security.
Why this answer
A time-delay alarm is the best control because it directly addresses the root cause—employees propping the door open—by alerting security or triggering a response if the door remains open beyond a preset interval (e.g., 10–30 seconds). This maintains the integrity of the mantrap, which is designed to prevent tailgating and unauthorized access by ensuring only one person enters at a time. Unlike passive measures, the alarm provides immediate feedback and deterrence against the unsafe behavior.
Exam trap
In SSCP, candidates often confuse detective controls (like CCTV) with preventive/deterrent controls (like time-delay alarms). CCTV monitors but does not actively prevent the unsafe behavior of propping the door open; an alarm provides immediate feedback and deters the action.
How to eliminate wrong answers
Option A is wrong because a clean desk policy addresses information security (e.g., preventing sensitive documents from being left out), not physical access control or the mantrap door being propped open. Option C is wrong because installing a CCTV camera only provides passive monitoring and retrospective evidence; it does not actively prevent or deter employees from propping the door open in real time. Option D is wrong because biometric readers on both doors enhance authentication but do not solve the behavioral issue of holding the door open; the mantrap's function still fails if a door is physically propped.
A system administrator needs to securely transfer log files from a Linux server to a central log collector. Which protocol should be used to ensure confidentiality and integrity?
SSH provides secure encrypted file transfer via SCP or SFTP.
Why this answer
SSH (Secure Shell) provides encrypted tunnels for data transfer, ensuring both confidentiality and integrity of log files in transit. It uses strong cryptographic algorithms (e.g., AES, ChaCha20) and HMAC-based integrity checks, making it the correct choice for secure file transfer over untrusted networks.
How to eliminate wrong answers
Option B (SMTP) is wrong because SMTP is a mail transfer protocol that does not natively encrypt payloads or provide integrity verification; it relies on optional STARTTLS extensions for confidentiality, which are not always enforced. Option C (NFS) is wrong because NFS is a network file system protocol designed for shared access, not secure transfer; it lacks built-in encryption and integrity guarantees (unless using NFSv4 with Kerberos, which is not the default). Option D (FTP) is wrong because FTP transmits data and credentials in cleartext, offering no confidentiality or integrity; even FTPS (FTP over SSL/TLS) is not the standard FTP protocol referenced here.
A small business needs basic protection against malware. Which solution is MOST cost-effective and provides real-time protection?
Provides real-time protection and includes multiple security layers.
Why this answer
An endpoint protection platform (EPP) provides real-time antivirus, anti-malware, and often additional features like firewall and web protection, offering continuous protection against malware. Option A is wrong because scheduling weekly scans leaves gaps where new threats can infect the system before the next scan. Option C is wrong because a host-based firewall controls network traffic but does not detect or remove malware.
Option D is wrong because email encryption only protects the confidentiality of email content and does not prevent malware from being delivered via other vectors such as web downloads or USB drives.
Which TWO of the following are best practices for securing an application programming interface (API)?
Rate limiting mitigates brute-force and DoS attacks.
Why this answer
Options A and B are correct. Rate limiting prevents abuse and denial-of-service attacks, while input validation and sanitization prevent injection attacks. Option C (returning detailed error messages) can leak sensitive information to attackers.
Option D (disabling encryption) exposes data in transit. Option E (using HTTP Basic Authentication without HTTPS) transmits credentials in plaintext.
A system administrator is configuring a Linux server to ensure that only authorized users can execute commands with superuser privileges. Which file should be edited to control sudo access?
Controls sudo permissions.
Why this answer
The /etc/sudoers file defines which users can run commands with elevated privileges.
A user reports they cannot access the internet. The network administrator verifies that the user's workstation has an IP address of 192.168.1.100/24 and a default gateway of 192.168.1.1. The administrator can ping the default gateway but cannot ping 8.8.8.8. What is the most likely cause?
Local connectivity works, external fails, indicating routing issue.
Why this answer
The administrator can ping the default gateway (192.168.1.1) but cannot ping 8.8.8.8. This indicates that Layer 2 and Layer 3 connectivity within the local subnet is working, but traffic cannot reach the internet. The most likely cause is that the default gateway does not have a route to the internet, meaning it cannot forward packets beyond its local interface to an upstream router or ISP.
How to eliminate wrong answers
Option A is wrong because port 53 is used for DNS, not for ICMP ping traffic; a firewall blocking outbound port 53 would not prevent a ping to 8.8.8.8. Option B is wrong because DNS resolution is not required to ping an IP address directly; the issue is with IP connectivity, not name resolution. Option D is wrong because the workstation's subnet mask of /24 (255.255.255.0) is correct for the 192.168.1.0/24 network, and an incorrect mask would typically cause local connectivity issues, not prevent internet access while still reaching the gateway.
Option E is wrong because a faulty network cable would prevent the workstation from communicating with the default gateway, but the administrator can successfully ping the gateway.
A company uses a Cloud Workload Protection Platform (CWPP) to secure IaaS workloads. They discover that a virtual machine (VM) is communicating with a known command-and-control server. What is the FIRST action the security team should take?
Containment is the first priority to stop active threat.
Why this answer
The first priority is to stop the malicious communication and prevent lateral movement. Isolating the VM immediately contains the threat. Option B (run antivirus) is not the first action because the infection is already active; scanning can be done after isolation.
Option C (terminate VM) is too aggressive and may cause data loss without forensic investigation. Option D (analyze logs) is important but should follow containment.
A company is deploying a new mobile application that handles sensitive customer data. Which practice BEST ensures data confidentiality on the device?
Encryption at rest ensures data is unreadable without the key.
Why this answer
Encrypting sensitive data with a key derived from the user's passcode ensures that even if the device is lost or stolen, the data remains unreadable without the passcode. This approach leverages the user's secret to protect confidentiality at rest, which is a fundamental principle of mobile data protection. Technologies like iOS Data Protection and Android File-Based Encryption use similar key derivation from the lock screen credential to encrypt app-specific data.
Exam trap
ISC2 often tests the distinction between access control (screen lock) and data protection (encryption), leading candidates to choose a strong passcode as the best practice for confidentiality, when encryption with a derived key is the actual requirement.
How to eliminate wrong answers
Option A is wrong because a strong screen lock passcode only prevents unauthorized access to the device interface but does not protect data if the device is compromised via other means (e.g., forensic extraction or jailbreak). Option B is wrong because disabling cloud backups prevents data from being stored off-device but does not address confidentiality of data already on the device; backups themselves can be encrypted separately. Option D is wrong because app sandboxing isolates app data from other apps to prevent unauthorized inter-app access, but it does not protect against physical device access or OS-level attacks that bypass sandboxing.
A system administrator is hardening a Linux server. After installing the OS, which of the following steps should be taken to ensure that only authorized users can execute commands with elevated privileges?
Restricting sudo access ensures only authorized users can elevate privileges.
Why this answer
The /etc/sudoers file controls which users can run commands as root via sudo. Proper configuration is essential for privilege escalation control.
A Linux server is being hardened. The security team wants to enforce mandatory access control policies that confine processes to limited access to files and resources. Which technology should be implemented?
SELinux provides mandatory access control.
Why this answer
SELinux enforces mandatory access control (MAC) policies, confining processes.
A change request to update a critical database server has been approved by the Change Advisory Board (CAB). During testing, a major compatibility issue is discovered. What is the best course of action?
Proper change management requires CAB approval for revised changes.
Why this answer
The change should be halted and the CAB reconvened to reassess the change given the new information.
DNS uses UDP 53.
The DROP rule for tcp dpt:22 with state NEW explicitly drops new SSH connection attempts, explaining the inability to SSH.
Why this answer
The firewall drops all new TCP connections to port 22 (SSH) using the state NEW module, which prevents users from establishing new SSH sessions. Option D correctly identifies this configuration. Option A describes the rule's behavior but includes the irrelevant point about established sessions, making it less direct.
Option B is incorrect because the INPUT chain policy being ACCEPT does not override the specific drop rule for new SSH traffic. Option C is incorrect because the rule does not block all traffic on port 22, only new connections.
During a qualitative risk analysis, an organization assesses a threat of a data breach due to weak encryption. The likelihood is rated as 'Medium' and the impact as 'High'. According to a standard 3x3 risk matrix, what is the overall risk rating?
Medium likelihood and High impact typically map to High risk.
Why this answer
In a typical 3x3 risk matrix, a combination of Medium likelihood and High impact results in a High risk rating.
An organization implements RBAC to enforce separation of duties. Which of the following is a key benefit of using role-based access control in this context?
Correct. RBAC helps enforce separation of duties.
Why this answer
RBAC naturally supports separation of duties by assigning permissions to roles and ensuring that conflicting roles (e.g., approving and executing payments) are not assigned to the same user. This reduces fraud risk.
A military system uses mandatory access control with classifications Unclassified, Confidential, Secret, and Top Secret. A user with Secret clearance attempts to read a file labeled Top Secret. What will occur?
MAC enforces that a subject can only read objects with a classification equal to or lower than their clearance (no read up).
Why this answer
In a mandatory access control (MAC) system, access decisions are based on comparing the subject's clearance level with the object's classification label. Since the user has a Secret clearance and the file is classified Top Secret, the subject's clearance is lower than the object's classification, so read access is denied per the Bell-LaPadula model's Simple Security Property (no read up).
Exam trap
The trap here is that candidates often confuse mandatory access control with discretionary access control, assuming that ownership or need-to-know can override classification labels, but in MAC, clearance level is the primary and non-negotiable gate for read access.
How to eliminate wrong answers
Option B is wrong because write permission is irrelevant in a MAC read operation; the Bell-LaPadula model enforces the *-property (no write down) for write, but read access is governed solely by clearance vs. classification. Option C is wrong because MAC overrides discretionary ownership; even if the user owns the file, the system enforces the classification label, so ownership does not grant read access when clearance is insufficient. Option D is wrong because need-to-know is a separate discretionary control (e.g., via compartments or roles) and does not override the mandatory clearance requirement; without the proper clearance level, need-to-know cannot grant access.
An organization uses mandatory access control (MAC) with the Bell-LaPadula model. A subject has a clearance of 'Secret' and an object has a classification of 'Top Secret'. What is the result if the subject attempts to read the object?
The subject's clearance is lower than the object's classification, so read is denied under the simple security property.
Why this answer
In the Bell-LaPadula model, the Simple Security Property (no read up) prohibits a subject from reading an object with a higher classification. Since the subject has a clearance of 'Secret' and the object is classified as 'Top Secret', the read attempt is denied. This enforces mandatory access control (MAC) by preventing information flow from higher to lower security levels.
Exam trap
The trap here is that candidates often confuse the Bell-LaPadula model with the Biba model (which focuses on integrity) or misapply the *-property to read operations, leading them to incorrectly select 'Read allowed' or 'Write allowed' when the actual rule is 'no read up'.
How to eliminate wrong answers
Option A is wrong because the operation in question is a read, not a write, and the Bell-LaPadula model's *-property (no write down) applies to write operations, not reads. Option B is wrong because write operations are not being attempted, and even if they were, a write from a Secret subject to a Top Secret object would be allowed under the *-property (write up), but the question asks about a read. Option D is wrong because the Simple Security Property explicitly forbids reading an object with a higher classification (Top Secret) than the subject's clearance (Secret), so read allowed is incorrect.
An organization is required to maintain audit logs for at least one year for compliance purposes. Which log management practice best ensures the integrity of these logs?
This prevents tampering and ensures non-repudiation.
Why this answer
Write-once storage (e.g., WORM media or append-only filesystems) prevents any modification or deletion of log entries after they are written. Digitally signing each log entry ensures that any tampering can be detected by verifying the signature against the log data. Together, these provide non-repudiation and integrity, meeting compliance requirements for immutable audit logs.
Exam trap
The trap here is that candidates often choose restricted permissions (Option C) thinking access control is sufficient, but the SSCP exam emphasizes that integrity requires cryptographic proof and immutability, not just authorization.
How to eliminate wrong answers
Option A is wrong because encrypting logs only during transmission protects confidentiality in transit but does nothing to prevent alteration or deletion once the logs are stored. Option B is wrong because compressing logs reduces storage space but provides no integrity protection; compressed logs can still be modified or deleted. Option C is wrong because storing logs on a standard file server with restricted permissions relies on access controls, which can be bypassed by compromised accounts or insider threats, and does not guarantee immutability or detect tampering.
An organization uses OAuth 2.0 for delegated access to a cloud storage API. A third-party application requests an access token to read user files. What is the primary purpose of the access token in OAuth?
Correct. The access token conveys authorization.
Why this answer
The access token represents the authorized scope of access granted by the resource owner (user). It is used by the client to access the protected resource (e.g., API) without exposing user credentials.
An organization's security policy prohibits employees from sharing passwords. What type of policy is this?
Correct. AUP defines acceptable and unacceptable use of organizational resources, including password sharing.
Why this answer
The Acceptable Use Policy (AUP) defines the rules and guidelines for using an organization's IT resources, including prohibited behaviors like password sharing. This policy sets the overall acceptable behavior framework, whereas a Password Policy specifically governs password creation, complexity, and rotation rules, not the act of sharing. Therefore, a prohibition on sharing passwords falls under the AUP because it addresses user conduct rather than technical password parameters.
Exam trap
This exam often tests the distinction between a Password Policy (technical rules for password creation) and an Acceptable Use Policy (behavioral rules for password usage), leading candidates to mistakenly choose Password Policy when the question focuses on prohibited conduct rather than technical specifications.
How to eliminate wrong answers
Option A is wrong because a Data Handling Policy governs how data is classified, stored, transmitted, and disposed of, not user authentication behaviors like password sharing. Option B is wrong because a Password Policy specifies technical requirements such as minimum length, complexity, and expiration intervals (e.g., NIST SP 800-63B guidelines), but does not typically address the behavioral prohibition of sharing passwords. Option C is wrong because a Remote Access Policy controls the methods and conditions for connecting to the network from external locations (e.g., VPN protocols, multi-factor authentication), not the internal conduct of password sharing.
An IT auditor reports that firewall logs are not being reviewed regularly. Which control should be implemented to address this finding?
SIEM automates log monitoring and alerting.
Why this answer
A SIEM system automates log collection, correlation, and alerting, ensuring that firewall logs are monitored and reviewed in a timely manner. Option A is incorrect; archiving logs to read-only medium preserves logs but does not enforce review. Option B is incorrect; disabling low-priority logging reduces data but does not address the lack of review.
Option C is incorrect; increasing retention extends storage but still requires manual review, which is the root problem.
A vulnerability scan identifies a critical vulnerability on a web server with a CVSS score of 9.8. The server hosts a public-facing application. However, the patch would require a reboot that would cause downtime during business hours. What should the security administrator do FIRST?
Perform risk assessment to determine if the vulnerability can be mitigated via other controls (e.g., WAF) or if downtime is necessary.
Why this answer
The first step is to assess the risk and prioritise based on exploitability and asset criticality. A CVSS 9.8 vulnerability is critical, so immediate action is needed, but the administrator should evaluate compensating controls before applying the patch.
A forensic investigator is collecting evidence from a compromised Windows server. According to the order of volatility, which THREE pieces of evidence should be collected FIRST? (Select THREE)
Current network state is volatile and can change rapidly.
Why this answer
Network connections and open ports (C) are highly volatile because they can change rapidly and are lost when the system is disconnected from the network. Capturing this data first preserves evidence of active remote connections, which is critical for identifying the attacker's point of entry and ongoing malicious activity. Tools like netstat -anob or CurrPorts can be used to collect this information before any other forensic steps.
Exam trap
ISC2 SSCP often tests the misconception that event logs are volatile because they are 'system state' data, but logs are written to disk and persist; the trap is confusing 'important' with 'volatile'.
Refer to the exhibit. The security analyst sees this event from a user workstation. What is the most likely conclusion?
The net localgroup command is often used for privilege escalation.
Why this answer
The event shows a user account (likely a standard user) attempting to add itself to a privileged group such as the local Administrators group. This action requires administrative rights, and the attempt by a non-admin user to modify group membership is a classic privilege escalation technique. The security analyst should recognize this as an unauthorized attempt to gain higher access, not a normal administrative action.
Exam trap
ISC2 often tests the distinction between a legitimate administrative action and a privilege escalation attempt by hiding the user context — the trap here is assuming that any group addition is benign, when the key detail is that the action was performed from a non-privileged account.
How to eliminate wrong answers
Option A is wrong because the event describes a single user account modification, not the lateral movement or file propagation characteristic of malware spreading. Option B is wrong because a legitimate administrator would typically use a dedicated admin account or a tool like 'net localgroup Administrators /add' with proper elevation, not from a standard user workstation without evidence of administrative context. Option D is wrong because the event shows a successful addition of a user to a group, not a failed authentication attempt (which would generate Event ID 4625, not 4732 or similar group membership events).
A company wants to implement multi-factor authentication (MFA) for remote access. Which THREE of the following are examples of different authentication factors? (Choose THREE.)
This combines a hardware token (possession) and a fingerprint (inherence) - two different factors, so it is correct.
Why this answer
Multi-factor authentication requires two or more distinct factors from different categories: knowledge, possession, and inherence. Option A combines a hardware token (possession) and a fingerprint (inherence) - two different factors. Option C combines a smart card (possession) and a PIN (knowledge) - two different factors.
Option E combines a password (knowledge) and a one-time passcode from a token (possession) - also two different factors. Options B and D each use factors from the same category: B uses two inherence factors, and D uses two knowledge factors. Therefore, the three correct answers are A, C, and E.
An employee reports that they cannot access a shared folder on the network. The security administrator checks the permission and finds that the user is in the correct group, but the 'Deny' entry for a different group is blocking access. What is the MOST likely cause?
Deny takes precedence over Allow in NTFS permissions.
Why this answer
In Windows NTFS permissions, a Deny Access Control Entry (ACE) explicitly overrides any Allow ACE, regardless of group membership order. Since the user is in the correct group but a Deny entry on a different group blocks access, the most likely cause is that a Deny ACE is explicitly applied to the user's group (or a group the user belongs to), which takes precedence over Allow permissions. This is a core principle of the Windows discretionary access control model.
Exam trap
ISC2 often tests the misconception that group membership order or inheritance determines permission precedence, when in fact an explicit Deny ACE always overrides any Allow ACE, regardless of the group hierarchy.
How to eliminate wrong answers
Option A is wrong because EFS encryption affects file content access at the file system level, not network share permissions; it does not cause a Deny ACE to block access. Option C is wrong because inherited permissions from the parent folder would not introduce a Deny ACE that overrides the user's explicit Allow unless the Deny is also inherited, but the scenario states the Deny is for a different group, not a conflict of inheritance. Option D is wrong because the user is already confirmed to be in the correct group; the issue is a conflicting Deny ACE, not group membership.
Which protocol and port combination is commonly used for secure remote administration of a server?
SSH is the standard secure remote administration protocol.
An organization uses AWS IAM to manage access. Which best practice ensures least privilege?
Individual users with minimal permissions enforce least privilege.
Why this answer
Creating individual users with only necessary permissions enforces least privilege. Using root account is dangerous. Shared accounts violate accountability.
Granting full S3 access is excessive.
HTTPS uses TCP port 443 by default.
Why this answer
How to eliminate wrong answers
Option A is wrong because UDP port 80 is used for HTTP (not HTTPS) and UDP is not the transport protocol for standard web traffic; HTTP uses TCP. Option B is wrong because UDP port 443 is not a standard protocol; HTTPS uses TCP, not UDP, for reliable delivery. Option D is wrong because TCP port 80 is used for unencrypted HTTP traffic, not HTTPS.
During a security audit, it is found that several employees have written their passwords on sticky notes attached to their monitors. Which policy is being violated?
Requires clearing desks of sensitive items.
Why this answer
A clean desk policy requires that sensitive information, including passwords, be secured and not left visible.
A university IT department manages a lab of 50 computers running Windows 10 that are used by students for coursework. The computers are joined to a domain and have Group Policy applied to restrict administrative access. Recently, several students were able to install unauthorized software by using the built-in Administrator account, which had the same password on all lab computers. The IT department wants to prevent this without affecting the students' ability to run required academic software. Which of the following is the most effective solution?
Assigning a unique, random password to the local Administrator account on each computer prevents students from using a common password to gain administrative access, thereby stopping unauthorized software installations.
Why this answer
Assigning a unique, random password to the local Administrator account on each computer prevents unauthorized use of that account without impacting normal user operations. Option A is incorrect because configuring computers to only allow standard user accounts would prevent students from installing unauthorized software, but it might also block required academic software that needs administrative privileges, and it does not address the vulnerability of the shared Administrator account. Option B is incorrect because disabling the local Administrator account could break legitimate administrative tasks or require alternative methods, and it does not prevent students from using other accounts with admin privileges.
Option D is incorrect because Software Restriction Policies can block unauthorized executables, but they do not prevent students from directly using the Administrator account to bypass restrictions.
A security administrator is tasked with ensuring that only authorized software can run on company workstations. Which security control should be implemented?
Whitelisting ensures only approved software can run, directly meeting the requirement.
Why this answer
Application whitelisting is the correct control because it explicitly defines a list of approved software that is allowed to execute on workstations. This prevents unauthorized or malicious software from running, even if it bypasses other defenses, by enforcing a default-deny policy at the operating system level (e.g., via Windows AppLocker or Software Restriction Policies). Unlike antivirus, which relies on signatures to detect known threats, whitelisting blocks unknown or unapproved executables by default.
Exam trap
The trap here is that candidates often confuse 'preventing unauthorized software' with 'detecting malware,' leading them to choose antivirus software, but the question specifically asks for a control that ensures only authorized software can run, which requires a default-deny approach like application whitelisting rather than a detection-based tool.
How to eliminate wrong answers
Option A is wrong because antivirus software uses signature-based or heuristic detection to identify known malware, but it cannot prevent execution of unauthorized or custom-coded software that is not yet in its database. Option B is wrong because patch management ensures software is up-to-date with security fixes, but it does not control which applications are allowed to run; it only addresses vulnerabilities in already-installed software. Option C is wrong because a host-based firewall controls network traffic to and from the workstation based on ports and protocols, but it does not restrict which applications can execute locally on the system.
A company detects ransomware on a file server. The ransomware is currently encrypting files. Which containment strategy should be implemented FIRST?
Network isolation prevents lateral movement and further encryption.
Why this answer
The immediate priority in ransomware containment is to isolate the compromised server from the network to prevent the encryption process from spreading to other systems. Disconnecting the network cable or disabling the network interface stops the ransomware from communicating with command-and-control servers and blocks lateral movement via SMB or other protocols. This containment step must occur before any remediation like antivirus scans or file restoration.
Exam trap
The trap here is that candidates often choose to run antivirus first, thinking removal stops the attack, but the SSCP exam emphasizes that containment (stopping the spread) must precede eradication (removing the malware).
How to eliminate wrong answers
Option A is wrong because running antivirus on an actively encrypting server may trigger the ransomware to accelerate encryption or delete files, and removal does not stop the ongoing encryption process. Option B is wrong because notifying users to change passwords is a post-containment or post-incident step; it does not halt the active encryption or network propagation of the ransomware. Option D is wrong because restoring files from backup should only be performed after the ransomware is fully contained and removed; attempting restoration while the ransomware is active will result in immediate re-encryption of restored files.
A company deploys a web application and wants to protect against SQL injection and XSS attacks. Which security control is specifically designed to inspect HTTP traffic and block such attacks?
WAF inspects application-layer traffic and blocks malicious requests.
Based on the exhibit, what is the most appropriate immediate action?
Immediate action needed to mitigate critical RCE vulnerability on critical system.
Why this answer
The exhibit shows a critical remote code execution vulnerability with a CVSS score of 9.8, which poses an immediate threat to the host. Applying the vendor patch as soon as possible is the most appropriate action because it directly eliminates the risk without delay, aligning with the principle of timely remediation for high-severity vulnerabilities.
Exam trap
The trap here is that candidates may choose to rescan or delay patching due to change management policies, failing to recognize that critical remote code execution vulnerabilities require immediate out-of-cycle patching to prevent imminent compromise.
How to eliminate wrong answers
Option A is wrong because scheduling patching in 30 days for a critical remote code execution vulnerability (CVSS 9.8) leaves the host exposed to active exploitation, which violates the immediate response required for such high-risk findings. Option C is wrong because running another vulnerability scan would only reconfirm the already validated finding, wasting time that could be used for remediation; the scan result is assumed accurate based on the exhibit. Option D is wrong because ignoring the vulnerability as a false positive is dangerous given the critical severity and known exploitability of the CVE; false positives are rare for such well-documented remote code execution vulnerabilities.
Refer to the exhibit. An AWS S3 bucket policy is defined as shown. Which statement about this policy is TRUE?
Principal '*' and Action 's3:GetObject' allows public read access.
Why this answer
The policy includes an Allow statement that grants the s3:GetObject action to principal "*" on the company-public bucket, making objects publicly readable. The Deny statement only applies to the company-private bucket, not to company-public. Therefore, any user can read objects in company-public.
Option A is incorrect because the policy does make the company-public bucket objects publicly accessible. Option B is incorrect because the Deny statement only denies access to company-private, not all access to both buckets. Option D is incorrect because the policy specifies resource ARNs for particular buckets, not all buckets.
A company has a policy requiring segregation of duties (SoD) for financial transactions. Which scenario represents a violation of this principle?
This combines authorization with verification, a SoD violation.
Why this answer
It violates segregation of duties: the same person both approves invoices (authorization) and reconciles bank statements (review/monitoring), combining incompatible duties that could allow fraud or error to go undetected. Option A is not a violation because backup and audit log review are separate functions typically performed by different roles. Option C is not a violation; requiring two approvals for large expenditures is a control to enforce dual authorization, not a violation of SoD.
Option D maintains separation because the purchasing manager creates orders (initiation) and the accounts payable clerk processes payments (execution), with oversight.
An organization uses a SIEM to correlate events. The SIEM receives Windows Security Event ID 4625 (failed login) and 4776 (credential validation). An analyst wants to detect a brute-force attack against a service account. Which correlation rule is most effective?
Detects distributed brute force against a single account.
Why this answer
A brute-force attack against a service account typically involves multiple failed login attempts from different source IPs, as attackers often distribute their attempts to evade IP-based blocking. Correlating Event ID 4625 (failed login) and 4776 (credential validation) across multiple source IPs for the same account within a short time window (e.g., 10 minutes) directly identifies this distributed brute-force pattern, which a single-IP threshold would miss.
Exam trap
The trap here is that candidates often fixate on a single IP threshold (Option A) because it seems intuitive, but the SSCP exam tests the understanding that modern brute-force attacks distribute across many IPs, making account-based correlation across source IPs the correct detection method.
How to eliminate wrong answers
Option A is wrong because alerting on more than 10 failed logins from a single IP in 5 minutes is too narrow; attackers can easily rotate IPs (e.g., using a botnet or proxy chain) to stay under the threshold, missing distributed brute-force attacks. Option B is wrong because alerting on successful logins after multiple failures is a post-compromise indicator, not a detection of the brute-force attempt itself; it may also generate false positives from legitimate password resets or user errors. Option D is wrong because setting severity high on every Event ID 4625 or 4776 would overwhelm analysts with noise from routine failed logins (e.g., mistyped passwords, expired credentials) and lacks the correlation needed to distinguish a brute-force attack from normal activity.
A change request to update a firewall rule has been submitted. After impact assessment, the change is approved by the Change Advisory Board (CAB). What is the NEXT step in the change management process?
Testing in a non-production environment helps identify issues before deployment.
Why this answer
After CAB approval, the next step is to test the change in a staging environment that mirrors production. This validates the firewall rule change does not introduce security gaps or performance issues before deployment. Testing in staging ensures the rule syntax, order, and interaction with existing rules are correct, preventing unintended access or denial of service.
Exam trap
The trap here is that candidates confuse the order of steps, thinking CAB approval immediately leads to production implementation, but the correct sequence requires testing in a staging environment first to validate the change.
How to eliminate wrong answers
Option A is wrong because a post-implementation review occurs after the change is deployed, not before implementation. Option B is wrong because developing a rollback plan is part of the planning phase, typically done before CAB approval, not after. Option C is wrong because implementing directly in production without prior testing in a staging environment violates change management best practices and could cause network outages or security breaches.
Match each vulnerability assessment tool to its use.
Drag a concept onto its matching description — or click a concept then click the description.
Network scanning and port discovery
Vulnerability scanning
Exploitation framework
Packet analysis
Why these pairings
Correct matches: Nmap for network mapping, Nessus for vulnerability scanning, Wireshark for packet analysis, Metasploit for exploitation testing. Common confusions include swapping Nmap with Nessus or confusing packet analysis with vulnerability scanning.
A company wants to deploy a network IDS that can analyze traffic patterns and detect anomalies. Where should the IDS sensor be placed to monitor all traffic on a network segment without introducing latency?
SPAN port copies traffic for monitoring without affecting flow.
Why this answer
A passive tap or SPAN port allows the IDS to monitor traffic without being inline, avoiding latency.
Which of the following best describes the difference between HMAC and a simple hash function like SHA-256 when used for message authentication?
Correct: HMAC uses a key for authentication.
Why this answer
HMAC incorporates a secret key into the hash process, providing authentication that a simple hash cannot.
During a post-incident review, the incident response team identifies several areas for improvement. According to NIST SP 800-61, which THREE activities are typically part of the post-incident activity phase?
The plan should be updated to incorporate lessons learned.
Why this answer
NIST SP 800-61 explicitly states that the post-incident activity phase includes updating the incident response plan based on lessons learned and findings from the incident. This ensures the plan evolves to address gaps and improve future response effectiveness.
Exam trap
The trap here is confusing operational recovery actions (like patching or hardware replacement) with the analytical and improvement-focused activities that define the post-incident phase per NIST SP 800-61.
An organization experiences a ransomware attack that encrypts file servers. The annualized loss expectancy (ALE) for this risk is calculated as $150,000. The single loss expectancy (SLE) is $30,000. What is the annualized rate of occurrence (ARO)?
ARO = ALE / SLE = 150,000 / 30,000 = 5.
Why this answer
The annualized rate of occurrence (ARO) is calculated by dividing the annualized loss expectancy (ALE) by the single loss expectancy (SLE): ARO = ALE / SLE = $150,000 / $30,000 = 5. This means the ransomware attack is expected to occur five times per year, which is a key metric in quantitative risk analysis for prioritizing security controls.
Exam trap
The trap here is that candidates often confuse the formula and divide SLE by ALE instead of ALE by SLE, leading to the incorrect fractional answer (0.2) rather than the correct integer (5).
How to eliminate wrong answers
Option A (0.2) is wrong because it incorrectly inverts the formula, dividing SLE by ALE (30,000 / 150,000 = 0.2), which would imply the event occurs once every five years, not five times per year. Option B (4.5) is wrong because it likely results from a miscalculation, such as subtracting or misplacing a decimal, and does not correspond to any correct risk formula. Option C (0.5) is wrong because it represents half an occurrence per year, which would require an ALE of $15,000 (SLE × 0.5), not the given $150,000.
An attacker sends a gratuitous ARP reply associating the attacker's MAC address with the default gateway's IP address. Which attack is being performed, and what is the primary risk?
The attacker positions themselves between the victim and gateway.
An organization deploys a firewall that examines the entire packet, including application-layer data, and can block specific commands or content. Which type of firewall is this?
Application proxy firewalls terminate and inspect application-layer protocols, allowing granular control.
During a risk assessment, a team identifies that the annualized loss expectancy (ALE) for a critical asset is $50,000. A proposed control costs $15,000 per year and will reduce the annualized rate of occurrence (ARO) from 5 to 1. The single loss expectancy (SLE) is unchanged at $10,000. What is the net benefit of implementing the control?
ALE reduction minus control cost equals net benefit.
Why this answer
The current ALE is $50,000 (ARO of 5 × SLE of $10,000). With the control, ARO drops to 1, so the new ALE is $10,000 (1 × $10,000). The reduction in ALE is $40,000.
Subtracting the annual control cost of $15,000 gives a net benefit of $25,000. This aligns with the formula: Net Benefit = (Old ALE – New ALE) – Annual Control Cost.
Exam trap
The trap here is that candidates often forget to subtract the annual control cost from the risk reduction (ALE reduction), mistakenly selecting the risk reduction amount ($40,000) as the net benefit.
How to eliminate wrong answers
Option A is wrong because $40,000 is the reduction in ALE (the risk reduction), not the net benefit after subtracting the $15,000 annual control cost. Option B is wrong because $10,000 is the new ALE after the control, not the net benefit. Option C is wrong because $35,000 would result from incorrectly subtracting the control cost from the old ALE ($50,000 – $15,000) without accounting for the reduced ALE.
A company's log management solution is overwhelmed by high-volume logs from network devices, causing storage and analysis delays. Which strategy would best improve the efficiency of the log management process?
Filtering reduces volume and focuses on important events.
Why this answer
Implementing log filtering and prioritization rules (Option C) directly addresses the root cause of the problem by reducing the volume of irrelevant or low-priority logs before they are stored or analyzed. This improves both storage efficiency and analysis speed, as the log management system processes only meaningful events, such as those matching security or performance thresholds, rather than being overwhelmed by high-frequency noise like repeated informational syslog messages.
Exam trap
ISC2 often tests the misconception that adding more resources (storage or processing frequency) is the solution to data overload, when in fact the correct approach is to reduce the data volume through intelligent filtering and prioritization.
How to eliminate wrong answers
Option A is wrong because simply increasing storage capacity does not solve the analysis delay; it only postpones the storage issue while the system continues to process and store the same high volume of logs, potentially worsening performance. Option B is wrong because increasing the frequency of log analysis cycles would further strain the already overwhelmed system, leading to greater delays and resource contention, not efficiency. Option D is wrong because reducing the number of devices sending logs is a drastic measure that compromises network visibility and security monitoring, and it does not address the underlying problem of inefficient log handling from the remaining devices.
A company wants to ensure that employees understand the proper use of corporate email and internet. Which policy should they implement?
Defines acceptable use of IT resources.
Why this answer
An Acceptable Use Policy (AUP) defines the rules and guidelines for using corporate IT resources, including email and internet. It specifies permitted and prohibited activities, such as personal browsing, sending sensitive data, or accessing inappropriate content, ensuring employees understand their responsibilities. This policy directly addresses the company's goal of educating employees on proper usage, unlike other policies that focus on data classification, remote connectivity, or authentication.
Exam trap
The SSCP exam often tests the distinction between policies that are broad (like AUP) versus those that are narrowly focused on specific technical controls (like password or remote access), leading candidates to confuse a general usage guideline with a security control policy.
How to eliminate wrong answers
Option A is wrong because a Data Handling Policy governs how data is classified, stored, transmitted, and disposed of, not the general use of email and internet by employees. Option B is wrong because a Remote Access Policy specifies requirements for connecting to the corporate network from external locations (e.g., VPN protocols, multi-factor authentication), not day-to-day email and internet usage. Option D is wrong because a Password Policy defines password complexity, rotation, and management rules, not acceptable behaviors for email and internet use.
A security engineer is designing a federated identity solution for cross-domain authentication. Which THREE of the following technologies are commonly used?
OIDC is an authentication layer on top of OAuth 2.0 for federated identity.
Why this answer
Federated identity relies on standards like SAML, OAuth/OIDC, and Active Directory forest trusts to enable authentication across domains.
What is the primary purpose of a baseline configuration in configuration management?
Correct. Baselines ensure systems are hardened and consistent.
Why this answer
A baseline configuration in configuration management defines a known, secure, and consistent state for a system at a specific point in time. This baseline serves as the foundation for all subsequent changes, ensuring that systems are deployed with hardened settings and that any deviations can be detected and remediated. It directly supports security operations by enforcing minimum security standards and simplifying compliance auditing.
Exam trap
ISC2 often tests the distinction between a baseline configuration (the desired secure state) and the CMDB (the database that stores configuration items), so candidates mistakenly select the CMDB option because they confuse the repository with the purpose of the baseline itself.
How to eliminate wrong answers
Option B is wrong because storing configuration items in the CMDB is a function of the Configuration Management Database, not the purpose of a baseline configuration; a baseline is a snapshot of configuration items, not the storage repository itself. Option C is wrong because detecting malware infections is the role of antivirus or endpoint detection and response (EDR) tools, not a baseline configuration; while a baseline can help identify unauthorized changes that may indicate malware, its primary purpose is not detection. Option D is wrong because tracking software licenses is a function of license management or asset management tools, not the primary purpose of a baseline configuration; baselines focus on system settings and security posture, not license compliance.
Which of the following is the primary purpose of a chain of custody form in digital forensics?
Correct. Chain of custody ensures evidence integrity and admissibility.
Why this answer
Chain of custody documents who handled the evidence, when, and why, ensuring it remains admissible in court.
A company wants to deploy a firewall that can track the state of active connections and make decisions based on the context of traffic flows. Which firewall type should they choose?
Stateful firewalls track connection state for context-aware filtering.
Why this answer
Stateful firewalls maintain a state table and track the state of connections, allowing them to make more intelligent filtering decisions compared to stateless packet filters.
A security administrator is configuring a system to enforce separation of duties. In which access control model is this principle most directly implemented?
RBAC enforces separation of duties through role constraints.
Why this answer
RBAC commonly enforces separation of duties by ensuring that conflicting roles are not assigned to the same user.
A small business wants to protect its data from ransomware. Which backup strategy provides the BEST protection against an attack where the backup files are also encrypted?
Offline tapes are physically disconnected and cannot be encrypted by ransomware.
Why this answer
An offline (air-gapped) backup is not accessible from the network, preventing ransomware from encrypting it. Option A is wrong because a NAS device is network-attached, so ransomware can encrypt it if the network is compromised. Option B is wrong because cloud backups are also accessible from the network and can be encrypted by ransomware if credentials are compromised.
Option C is wrong because an external hard drive connected via USB, when attached to the system, is accessible to ransomware and can be encrypted.
During a post-incident review, the incident response team identifies that the mean time to detect (MTTD) was 14 days. Which improvement would most directly reduce MTTD?
Correct. Enhanced detection tools reduce MTTD.
Why this answer
Deploying additional EDR sensors with automated alerting directly reduces the time between an incident's occurrence and its detection by providing continuous monitoring and immediate notification of suspicious activities. This shortens the MTTD because automated alerts eliminate the delay inherent in manual log review or periodic checks, enabling the incident response team to react within minutes rather than days.
Exam trap
The trap here is that candidates often confuse detection speed (MTTD) with prevention or recovery metrics, mistakenly thinking that improving backups (Option D) or access controls (Option A) will help detect incidents faster, when in fact they address different phases of the incident response lifecycle.
How to eliminate wrong answers
Option A is wrong because stricter access control policies primarily reduce the likelihood of an incident (prevention) or limit the blast radius, but they do not improve detection speed; MTTD is a detection metric, not a prevention or containment metric. Option B is wrong because tabletop exercises improve team preparedness and response procedures, but they do not directly affect the speed of detecting real incidents; they focus on reaction and coordination after detection, not on reducing detection latency. Option D is wrong because increasing the frequency of full system backups improves data recovery capabilities and reduces recovery time objectives (RTO), but backups do not provide real-time visibility into ongoing malicious activity and thus have no direct impact on MTTD.
Refer to the exhibit. A network administrator implements this ACL on a border router. What is the effect?
The permit rule applies to any source destined to that host on port 22.
Why this answer
The ACL explicitly permits TCP traffic sourced from any IP address destined to 192.168.1.100 on port 22, which is the default port for SSH. Since the ACL is applied inbound on the border router's external interface, it allows SSH connections from any external source to reach the internal host 192.168.1.100, while implicitly denying all other traffic.
Exam trap
ISC2 often tests the implicit deny all at the end of an ACL, leading candidates to mistakenly think that only explicitly denied traffic is blocked, when in fact all traffic not explicitly permitted is denied.
How to eliminate wrong answers
Option B is wrong because the ACL does not block SSH; it explicitly permits SSH to 192.168.1.100, so SSH is not completely blocked. Option C is wrong because the ACL only permits TCP port 22 (SSH) to 192.168.1.100; all other traffic to that IP is implicitly denied by the implicit deny all at the end of the ACL. Option D is wrong because the ACL permits SSH from any source, including external networks, so SSH from external networks is not blocked; it is allowed.
An attacker sends a flood of DHCP request packets with spoofed MAC addresses to exhaust the DHCP server's IP address pool, preventing legitimate clients from obtaining IP addresses. This attack is known as:
Correct description of the attack.
Why this answer
DHCP starvation exhausts the IP pool by sending many fake DHCP requests, leading to denial of service.
Which wireless security standard introduced the Simultaneous Authentication of Equals (SAE) handshake to replace the pre-shared key (PSK) method?
WPA3 introduces SAE (a variant of Dragonfly) for secure key exchange.
Which THREE of the following are best practices for securely managing cryptographic keys in an enterprise environment?
Key escrow ensures that encrypted data can be recovered if keys are lost or unavailable.
Why this answer
The correct answers are C, D, and E. Option C: Key escrow enables recovery of encrypted data when keys are lost, which is a best practice for enterprise environments. Option D: Regular key rotation limits the impact of a key compromise and is a fundamental security practice.
Option E: Storing keys in an HSM provides tamper-resistant hardware protection. Option A is incorrect because using the same key for both encryption and signing violates key separation principles. Option B is incorrect because email is not a secure channel for sharing keys; encrypted email is still vulnerable to interception or misconfiguration.
A Linux administrator needs to configure access controls so that a specific user can run certain commands with root privileges without entering a password. Which configuration file should be modified?
sudoers defines sudo permissions.
Why this answer
The /etc/sudoers file controls sudo permissions. By adding an appropriate entry, the administrator can grant passwordless sudo access to specific commands.
An organization wants to prevent unauthorized persons from entering a secure server room. Which control is the MOST effective?
Biometrics provide strong authentication specific to the individual.
Why this answer
Biometric authentication (fingerprint or retina scan) is the most effective control because it verifies the unique physiological characteristics of an individual, making it extremely difficult to bypass, share, or forge. Unlike knowledge-based (keypad code) or possession-based (key card) factors, biometrics provide strong, non-repudiable proof of identity, which is critical for high-security areas like a server room.
Exam trap
The trap here is that candidates often choose a keypad with a unique code (Option D) thinking it is 'unique per employee' and therefore secure, but they overlook that codes can be easily shared or stolen via shoulder surfing, whereas biometrics are inherently tied to the individual and cannot be transferred.
How to eliminate wrong answers
Option A is wrong because a CCTV camera is a detective control that only records events; it does not prevent unauthorized entry, as it cannot stop a person from walking through the door. Option C is wrong because a security guard is a physical control that can be effective but is limited to business hours, leaving the server room vulnerable during off-hours, and guards can be distracted or bypassed. Option D is wrong because a keypad with a unique code relies on a knowledge factor that can be shared, observed (shoulder surfing), or guessed, and codes can be forgotten or written down, compromising security.
An analyst reviews a Windows security log. Given the event, what is the MOST likely cause of the lockout?
Logon Type 10 (RemoteInteractive) is RDP, and a lockout indicates multiple failed attempts.
Why this answer
A Remote Desktop (RDP) session using Logon Type 10 with multiple failed attempts from the same source is indicative of a brute-force attack, which commonly causes account lockouts. Option A is incorrect because using an old password after a password change would typically result in a single failure, not a lockout. Option B is incorrect because expired cached credentials would not trigger a lockout; they would simply prevent authentication.
Option D is incorrect because a single wrong password entry at the physical console would not cause a lockout unless the account lockout threshold is set to 1, which is uncommon; moreover, the logon type for physical console is Logon Type 2, not the RemoteInteractive type mentioned in the scenario.
An organization wants to ensure that only authorized devices can connect to its internal network. Which of the following should be implemented?
NAC authenticates devices before network access.
Why this answer
Network Access Control (NAC) is the correct choice because it enforces security policy by evaluating the identity, posture, and compliance of devices before granting network access. NAC solutions (e.g., Cisco ISE, Aruba ClearPass) can authenticate devices via 802.1X, check for antivirus updates or patch levels, and quarantine non-compliant endpoints, ensuring only authorized and healthy devices connect to the internal network.
Exam trap
The trap here is that candidates often confuse Port Security (a Layer 2 MAC-based control) with NAC, but Port Security lacks the authentication, posture assessment, and dynamic policy enforcement that NAC provides, making it insufficient for ensuring only authorized devices connect.
How to eliminate wrong answers
Option A is wrong because an Intrusion Detection System (IDS) monitors network traffic for malicious activity but does not control which devices can connect; it only alerts on threats after they appear. Option B is wrong because Port Security on switches limits MAC addresses per port but is a Layer 2 control that can be bypassed by MAC spoofing and does not authenticate device identity or check compliance. Option D is wrong because a Virtual Private Network (VPN) encrypts traffic between remote users and the network but does not restrict which devices can connect to the internal LAN; it assumes the device is already authorized or uses separate authentication.
An organization is experiencing VM sprawl, with many unmanaged virtual machines running in the environment. Which of the following is the most significant security risk associated with VM sprawl?
Unmanaged VMs are often forgotten, leading to security gaps.
Why this answer
Unmanaged VMs often lack proper patching and configuration management, leading to unpatched vulnerabilities that can be exploited.
An e-commerce company runs its web application on a Windows Server 2019 with IIS 10. The security team runs a vulnerability scan and discovers that the server supports TLS 1.0 and several CBC-mode cipher suites, which are prohibited by the company's security policy. The policy requires disabling all versions of TLS below 1.2 and all cipher suites that do not use GCM mode. The administrator needs to implement the required changes without affecting the application's functionality, as it still needs to support a small number of legacy clients that require TLS 1.2 but not CBC. Which action should the administrator take?
This directly implements the policy and only affects prohibited protocols and ciphers.
Why this answer
The administrator can disable TLS 1.0 via the Windows registry (e.g., by creating the 'Enabled' DWORD under 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' and setting it to 0) and then configure the cipher suite order in IIS using the 'SchUseStrongCrypto' registry key or the 'Cipher Suites' group policy to prioritize GCM-based ciphers (e.g., TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256). This directly enforces the policy—disabling TLS below 1.2 and non-GCM ciphers—while still allowing legacy clients that support TLS 1.2 with GCM to connect without breaking functionality.
Exam trap
The trap here is that candidates may assume a reverse proxy or an OS upgrade is required to enforce strong TLS settings, when in fact Windows Server 2019 fully supports disabling TLS 1.0 and configuring cipher suites natively through registry and IIS settings without additional hardware or software.
How to eliminate wrong answers
Option A is wrong because upgrading to Windows Server 2022 does not automatically disable TLS 1.0; it only changes default settings, and TLS 1.0 can still be enabled unless explicitly disabled via registry or group policy. Option B is wrong because implementing a reverse proxy adds unnecessary complexity and a potential single point of failure; the policy can be met directly on the IIS server without an additional component, and the question asks for an action the administrator should take, not a workaround. Option D is wrong because there is no Microsoft hotfix that removes TLS 1.0 support; TLS 1.0 is a protocol supported by the Schannel security package and is disabled only through registry configuration, not a hotfix.
Practice SSCP by domain
Target a specific domain to shore up weak areas.