Courseiva

Systems Security Certified Practitioner SSCP (SSCP) — Questions 226–300

920 questions total · 13pages · All types, answers revealed

Take a mock examExam hub
Page 3

Page 4 of 13

Page 5
226
MCQmedium

A company uses a backup strategy that backs up all data every Sunday and backs up only data that has changed since the last full backup on other days. This is an example of which backup type?

A.Full backup
B.Differential backup
C.Copy backup
D.Incremental backup
AnswerB

Differential backs up changes since the last full backup.

Why this answer

The described strategy backs up all data on Sunday (a full backup) and then on other days backs up only data that has changed since the last full backup. This is the defining characteristic of a differential backup: it always references the most recent full backup, not the previous day's backup. Unlike incremental backups, differential backups do not reset the archive bit after each run, so each differential backup grows in size until the next full backup.

Exam trap

The trap here is confusing 'changed since the last full backup' (differential) with 'changed since the last backup' (incremental), causing candidates to mistakenly select incremental backup when the key phrase 'since the last full backup' clearly indicates differential.

How to eliminate wrong answers

Option A is wrong because a full backup backs up all data every time, not just on Sundays with changes-only on other days. Option C is wrong because a copy backup backs up selected files without clearing the archive bit, but it does not follow a schedule of full-then-changes-only; it is a one-off copy. Option D is wrong because an incremental backup backs up only data changed since the last backup (full or incremental), not since the last full backup; it resets the archive bit after each run, resulting in smaller daily backups that require all previous incrementals to restore.

Full explanation →
227
Multi-Selectmedium

Which TWO actions are part of the containment phase of incident response?

Select 2 answers
A.Restoring from backups
B.Analyzing root cause
C.Applying temporary patches
D.Isolating affected systems
E.Preserving evidence
AnswersC, D

Temporary patches can contain the vulnerability while permanent fixes are developed.

Why this answer

During the containment phase of incident response, the immediate priority is to stop the incident from spreading or causing further damage. Applying temporary patches (C) can quickly close a vulnerability that is being exploited, while isolating affected systems (D) prevents lateral movement and further compromise. Both actions are short-term measures to contain the threat before eradication and recovery begin.

Exam trap

ISC2 often tests the distinction between containment actions (immediate stop-gap measures) and recovery or analysis actions, so candidates mistakenly select 'restoring from backups' or 'analyzing root cause' as containment steps.

Full explanation →
228
MCQmedium

A security analyst is reviewing access controls for a database server. The database administrator has granted all users in the 'sales' role SELECT, INSERT, UPDATE, and DELETE permissions on the 'orders' table. Which access control principle is being violated?

A.Accountability
B.Separation of duties
C.Need to know
D.Least privilege
AnswerD

Granting DELETE to all sales users gives more privilege than necessary.

Why this answer

Least privilege means users should have only the minimum permissions necessary to perform their job. Sales staff likely need to read and perhaps insert orders, but not delete them.

Full explanation →
229
Multi-Selectmedium

A security administrator is selecting security metrics for the organization. Which TWO metrics are most useful for measuring the effectiveness of patching? (Select TWO)

Select 2 answers
A.Help desk ticket volume
B.Number of security incidents
C.Average time to patch critical vulnerabilities
D.Number of users trained
E.Patch compliance rate
AnswersC, E

Measures speed of remediation.

Why this answer

Average time to patch critical vulnerabilities (Mean Time to Patch, MTTP) directly measures the speed of remediation, which is a key indicator of patching effectiveness. Patch compliance rate quantifies the percentage of systems that have the required patches installed, reflecting coverage and adherence to policy. Both metrics provide actionable data on the patching process's efficiency and completeness.

Exam trap

The trap here is that candidates often confuse 'number of security incidents' (a reactive, outcome-based metric) with a proactive patching metric, or they mistakenly think 'help desk ticket volume' reflects patching problems rather than user support load.

Full explanation →
230
Multi-Selectmedium

Which THREE of the following are valid methods for authenticating users in a web application? (Choose three.)

Select 3 answers
A.IP address whitelisting
B.SAML
C.OAuth 2.0
D.HTTP Basic Authentication
E.LDAP
AnswersB, C, D

SAML enables single sign-on across domains.

Why this answer

SAML (Security Assertion Markup Language) is a valid method for authenticating users in a web application because it is an XML-based open standard for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP). It enables single sign-on (SSO) by allowing the SP to trust the IdP's assertion of the user's identity, making it a widely adopted federated authentication protocol.

Exam trap

ISC2 often tests the distinction between authentication and authorization or access control, leading candidates to mistakenly select IP whitelisting (a network-layer access control) as an authentication method, or LDAP (a directory protocol) as a direct authentication protocol rather than a backend service.

Full explanation →
231
Multi-Selectmedium

A company is designing a network with multiple security zones. Which TWO of the following are best practices for network segmentation? (Select TWO)

Select 2 answers
A.Place a firewall between each security zone to enforce traffic filtering.
B.Use a single flat network to reduce complexity.
C.Implement VLANs to logically separate traffic within a switch.
D.Disable logging on inter-zone firewalls to improve performance.
E.Place all servers in the same broadcast domain for easier management.
AnswersA, C

Firewalls enforce policies between zones.

Why this answer

Placing firewalls between zones and using VLANs for logical separation are key segmentation practices. DMZ is a specific zone, not a universal practice.

Full explanation →
232
MCQeasy

Which of the following is the correct order of steps in the change management process?

A.Change request, impact assessment, CAB approval, testing, implementation, post-implementation review
B.Change request, CAB approval, impact assessment, testing, implementation, post-implementation review
C.Impact assessment, change request, CAB approval, testing, implementation, post-implementation review
D.Change request, testing, impact assessment, CAB approval, implementation, post-implementation review
AnswerA

This sequence follows the typical change management workflow.

Why this answer

The standard change management process begins with submitting a change request, followed by impact assessment, CAB approval, testing, implementation, and finally post-implementation review.

Full explanation →
233
MCQeasy

During which phase of the NIST SP 800-61 incident response lifecycle are lessons learned meetings conducted and metrics such as MTTD and MTTR tracked?

A.Containment, Eradication, and Recovery
B.Preparation
C.Detection and Analysis
D.Post-Incident Activity
AnswerD

Correct. Lessons learned and metrics tracking are key parts of post-incident activity.

Why this answer

The Post-Incident Activity phase (D) is where lessons learned meetings are conducted and metrics such as Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) are tracked. This phase focuses on reviewing the incident response process, identifying improvements, and documenting findings to enhance future response efforts, as defined in NIST SP 800-61 Revision 2.

Exam trap

ISC2 often tests the misconception that metrics like MTTD and MTTR are tracked during Detection and Analysis or Containment phases, but they are actually reviewed and analyzed only after the incident is resolved in the Post-Incident Activity phase.

How to eliminate wrong answers

Option A is wrong because Containment, Eradication, and Recovery focuses on stopping the incident, removing threats, and restoring operations, not on post-incident analysis or metric tracking. Option B is wrong because Preparation involves establishing policies, tools, and training before an incident occurs, not conducting lessons learned or tracking MTTD/MTTR after an incident. Option C is wrong because Detection and Analysis is the phase where incidents are identified and analyzed, but it does not include the retrospective review or metric collection that occurs in the Post-Incident Activity phase.

Full explanation →
234
MCQhard

A large e-commerce company has a disaster recovery (DR) plan that requires Recovery Time Objective (RTO) of 4 hours and Recovery Point Objective (RPO) of 1 hour for its customer database. The database runs on a clustered SQL server with synchronous replication to a standby server in a different data center. During a recent test, the IT team found that failover took 3 hours, but due to a replication lag of 45 minutes, some transactions were lost. The team needs to meet both RTO and RPO. Which of the following changes should the team implement FIRST?

A.Implement asynchronous replication to a third site
B.Increase the bandwidth between data centers
C.Shorten the synchronization interval from 45 minutes to 15 minutes
D.Automate the failover process with orchestration scripts to reduce manual steps
AnswerC

Shortening the synchronization interval from 45 minutes to 15 minutes directly reduces the maximum data loss to 15 minutes, ensuring the RPO of 1 hour is consistently met.

Why this answer

The primary issue is that the database has a Recovery Point Objective (RPO) of 1 hour, but the current replication lag of 45 minutes puts the organization at risk of losing up to 45 minutes of transactions. Shortening the synchronization interval to 15 minutes reduces the maximum potential data loss to 15 minutes, well within the RPO requirement. While automating failover (option D) could improve the Recovery Time Objective (RTO), the RTO is already being met (3 hours < 4 hours), so the immediate priority is addressing the RPO gap.

Options A (asynchronous replication) would increase data loss, and B (increased bandwidth) may not directly reduce the lag if it is due to batch processing intervals rather than network constraints. Therefore, option C is the first change to implement.

Exam trap

Candidates often focus on failover automation (RTO) when the actual failure is the data loss window (RPO) not being met. In this scenario, RTO is already within limits, so the priority is reducing the synchronization interval.

Full explanation →
235
MCQmedium

A company is implementing a PKI for internal use. What is the primary purpose of a Certificate Revocation List (CRL)?

A.To validate certificate chains
B.To encrypt certificate requests
C.To store all issued certificates
D.To publish revoked certificates
AnswerD

CRLs list certificates that have been revoked and should no longer be trusted.

Why this answer

The primary purpose of a Certificate Revocation List (CRL) is to publish a list of certificates that have been revoked by the Certificate Authority (CA) before their scheduled expiration. This allows relying parties to verify that a certificate is still valid and has not been compromised, ensuring trust in the PKI.

Exam trap

The trap here is that candidates confuse the CRL's purpose with certificate validation or storage, mistakenly thinking it validates chains or stores all certificates, when in fact it only publishes revoked certificates for status checking.

How to eliminate wrong answers

Option A is wrong because validating certificate chains is performed using the CA's public key and checking signatures, not by consulting a CRL; CRLs are used only to check revocation status. Option B is wrong because encrypting certificate requests is the role of protocols like PKCS#10 or CMP, not the CRL, which is a signed list of revoked certificates. Option C is wrong because storing all issued certificates is the function of a certificate repository or database, whereas a CRL only contains certificates that have been revoked, not all issued ones.

Full explanation →
236
MCQeasy

A security analyst is reviewing vulnerability scan results and finds a critical vulnerability on a web server. The patch is available but requires a reboot. What should the analyst do first?

A.Apply the patch immediately to reduce risk
B.Assess the exploitability and impact to determine remediation priority
C.Re-scan the server to confirm the vulnerability
D.Ignore the vulnerability because the patch is available
AnswerB

Risk assessment ensures proper prioritization.

Why this answer

The first step in vulnerability management is to assess the exploitability and business impact of the vulnerability before taking action. Even though a patch is available, the analyst must determine if the vulnerability is actively exploitable in the current environment and what the potential impact would be, as a reboot may cause service disruption. This aligns with the risk-based prioritization approach required by frameworks like NIST SP 800-40 and the SSCP's focus on balancing security with operational continuity.

Exam trap

ISC2 often tests the misconception that a critical vulnerability must be patched immediately regardless of operational impact, tempting candidates to choose 'apply the patch immediately' without considering the risk assessment and change management steps required by the SSCP's risk identification domain.

How to eliminate wrong answers

Option A is wrong because applying the patch immediately without assessing impact could cause unnecessary downtime or break dependencies, especially if the web server hosts critical applications; patching should follow a change management process. Option C is wrong because re-scanning to confirm the vulnerability is redundant—the scan already identified it, and the priority is to evaluate risk, not re-validate the scanner's findings. Option D is wrong because ignoring a critical vulnerability simply because a patch exists is negligent; the patch's availability is a reason to act, not to ignore, but action must be prioritized based on risk.

Full explanation →
237
MCQeasy

A small business uses a single Windows Server 2016 machine that also acts as a domain controller, file server, and runs a custom application for inventory management. The server recently exhibited slow performance and frequent crashes. The system administrator runs antivirus and finds no malware. The event log shows several 'Event ID 7000' errors from the Service Control Manager, indicating certain services failed to start. The administrator also notices that the server has not been restarted in 180 days and has several pending updates. What is the most likely cause of the performance issues?

A.A rootkit infection that the antivirus failed to detect.
B.The server has not been restarted for an extended period and has pending updates.
C.A heavily fragmented hard drive.
D.A memory leak in the custom application.
AnswerB

Lack of restarts can lead to resource exhaustion, and pending updates may address performance bugs.

Why this answer

The server has not been restarted for 180 days and has pending updates. Over time, system resource exhaustion can occur, and pending updates often include critical fixes and performance improvements. The Event ID 7000 errors indicate services failing to start, which can result from resource constraints or the need for updates.

A reboot is required to apply updates and clear temporary issues. Option A is incorrect because antivirus found no malware and there is no evidence of a rootkit. Option C is incorrect because a fragmented hard drive would not cause service start failures.

Option D is incorrect because while a memory leak is possible, the evidence points to the lack of maintenance and updates as the most likely cause.

Full explanation →
238
MCQhard

A security architect is reviewing cloud security for a SaaS application used by the company. According to the shared responsibility model, which security controls are PRIMARILY the customer's responsibility?

A.Data classification and user access management
B.Network infrastructure security
C.Physical security of data centers
D.Operating system patching
AnswerA

Customer manages data and who accesses it.

Why this answer

In SaaS, the customer is responsible for data classification and managing user access (IAM).

Full explanation →
239
MCQeasy

A security analyst is reviewing logs and notices that an application log shows an error message indicating 'unhandled exception' followed by a stack trace. This log is most likely categorized as which type?

A.System log
B.Security log
C.Audit log
D.Application log
AnswerD

Correct: Application logs capture events from specific software.

Why this answer

Application logs are generated by software applications and record application-specific events, including errors like 'unhandled exception' and stack traces. Since the log entry originates from an application and contains a stack trace (a developer-oriented diagnostic), it is categorized as an application log, not a system, security, or audit log.

Exam trap

The trap here is that candidates confuse 'unhandled exception' with a security event (like a crash due to an exploit) and incorrectly select Security log, but the question explicitly states the log contains a stack trace, which is a hallmark of application-level debugging output, not a security or system event.

How to eliminate wrong answers

Option A is wrong because system logs (e.g., /var/log/syslog or Windows System event log) record OS-level events such as driver failures, kernel panics, or service start/stop, not application-specific unhandled exceptions with stack traces. Option B is wrong because security logs (e.g., Windows Security log or /var/log/auth.log) track authentication attempts, privilege use, and policy violations, not application runtime errors. Option C is wrong because audit logs (e.g., Windows Audit log or Linux auditd logs) record compliance-relevant events like file access or user actions per predefined audit policies, not unhandled exceptions from application code.

Full explanation →
240
MCQmedium

A security analyst reviews the TLS configuration of a web server and notices that the cipher suite TLS_RSA_WITH_AES_128_CBC_SHA is enabled. The analyst recommends disabling RSA key exchange and enabling ECDHE. Which security property does ECDHE provide that RSA key exchange lacks?

A.ECDHE provides perfect forward secrecy.
B.ECDHE is faster than RSA key exchange.
C.ECDHE is required by PCI DSS for all web transactions.
D.ECDHE uses smaller key sizes for equivalent security.
AnswerA

This ensures that compromise of the server's long-term key does not expose past session keys.

Why this answer

ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) provides Perfect Forward Secrecy (PFS), meaning that if the server's long-term private key is compromised, past session keys cannot be derived. RSA key exchange does not provide PFS because the session key is encrypted with the server's static RSA public key; if the private key is later exposed, all recorded sessions can be decrypted.

Exam trap

The trap here is that candidates confuse the general benefits of elliptic curve cryptography (smaller keys, speed) with the specific security property of Perfect Forward Secrecy, which is the unique advantage of ephemeral Diffie-Hellman over static RSA key exchange.

How to eliminate wrong answers

Option B is wrong because ECDHE is not inherently faster than RSA key exchange; while ECDHE can have lower computational overhead in some contexts, performance depends on implementation and key sizes, and speed is not the primary security property. Option C is wrong because PCI DSS does not require ECDHE specifically; it requires the use of strong cryptography and may recommend PFS, but it does not mandate ECDHE for all web transactions. Option D is wrong because while ECDHE does use smaller key sizes for equivalent security compared to RSA, this is a property of elliptic curve cryptography in general, not the specific security property that RSA key exchange lacks—the key distinction is PFS.

Full explanation →
241
Multi-Selecteasy

Which TWO of the following are key components of the risk identification process?

Select 2 answers
A.Identifying assets and their value
B.Prioritizing risks based on impact
C.Selecting risk treatment options
D.Identifying threats and vulnerabilities
E.Calculating the annualized loss expectancy
AnswersA, D

Assets are the foundation for understanding what is at risk.

Why this answer

Identifying assets and their value is a foundational step in the risk identification process. Without knowing what assets exist and their relative importance, you cannot determine which threats and vulnerabilities pose the greatest risk. This step ensures that risk assessment efforts are focused on the most critical resources.

Exam trap

ISC2 often tests the distinction between risk identification and risk analysis, so candidates mistakenly select options like prioritizing risks (B) or calculating ALE (E) as part of identification, when they actually belong to later stages of the risk management process.

Full explanation →
242
Multi-Selectmedium

Which THREE are effective controls against internal network threats?

Select 3 answers
A.Network segmentation
B.Employee security awareness training
C.Intrusion detection system (IDS)
D.Single sign-on (SSO)
E.Data loss prevention (DLP)
AnswersA, B, E

Isolates sensitive systems to contain breaches.

Why this answer

Network segmentation (A) is effective because it divides the network into isolated segments, limiting lateral movement of threats. By using VLANs or firewalls, an attacker who compromises one segment cannot easily access other critical systems, reducing the blast radius of an internal breach.

Exam trap

ISC2 often tests the distinction between detection and prevention, so candidates mistakenly choose IDS (C) as a control against internal threats, but it only detects, not blocks, unlike network segmentation or DLP which actively prevent or contain threats.

Full explanation →
243
MCQmedium

A system administrator notices a high number of half-open TCP connections to the company's web server. The server is becoming unresponsive. Which attack is likely occurring, and which mitigation is effective?

A.ARP spoofing; mitigation: static ARP entries.
B.Smurf attack; mitigation: disable IP broadcasts.
C.SYN flood; mitigation: enable SYN cookies.
D.Ping of death; mitigation: block fragmented ICMP packets.
AnswerC

SYN cookies allow the server to maintain state without allocating resources until the handshake completes.

Why this answer

A SYN flood exploits the TCP three-way handshake by sending many SYN packets without completing the handshake. SYN cookies allow the server to avoid allocating resources until the handshake completes.

Full explanation →
244
MCQhard

During a code review, you discover that an application stores passwords in plaintext. What is the most secure remediation?

A.Hash passwords with MD5
B.Use bcrypt with a unique salt per password
C.Use AES encryption of passwords
D.Store passwords in a database with restricted access
AnswerB

Bcrypt is slow and salted, making brute force impractical.

Why this answer

Bcrypt with a unique salt is designed for password storage; it is slow and resistant to brute force. MD5 is fast and weak. AES encryption is reversible if the key is compromised.

Database access control does not protect if the database is breached.

Full explanation →
245
MCQhard

An organization has suffered a sophisticated attack where the attacker compromised a domain controller and used it to move laterally to several file servers. The incident response team has isolated the domain controller and some file servers, but they suspect that the attacker may have created hidden accounts and modified permissions to maintain access. The team needs to ensure that the attacker's access is entirely removed before restoring operations. The organization has a large number of users and complex Active Directory structure. The incident response plan outlines containment, eradication, recovery, and post-incident analysis. The team has forensic imaging of the domain controller and file servers. What is the MOST comprehensive approach to eradicate the attacker's presence?

A.Reset all domain user passwords and force a password change at next logon.
B.Use a tool to scan for hidden accounts and reset permissions on all file servers.
C.Perform a forensic analysis of the domain controller to identify all backdoors, hidden accounts, and unauthorized permission changes.
D.Rebuild the domain controller from a known good backup and reset all service account passwords.
AnswerC

Correct: Forensic analysis provides a complete picture of the attacker's actions and allows targeted eradication.

Why this answer

The most comprehensive approach to eradicate an attacker's presence after a domain controller compromise is to perform a forensic analysis of the domain controller. This analysis can identify all backdoors, hidden accounts (e.g., accounts with the 'ACCOUNTDISABLE' flag removed or created via 'net user' with hidden attributes), unauthorized permission changes (e.g., modified ACLs on AD objects), and other persistence mechanisms like scheduled tasks or service principal name (SPN) modifications. Without this deep analysis, the attacker's access may persist even after password resets or server rebuilds.

Exam trap

The trap here is that candidates often choose password resets or backup restoration as a quick fix, but fail to recognize that sophisticated attackers implant multiple persistence mechanisms (e.g., hidden accounts, modified ACLs, domain-level backdoors) that survive these actions without a comprehensive forensic analysis.

How to eliminate wrong answers

Option A is wrong because resetting all domain user passwords and forcing a password change at next logon does not remove hidden accounts, backdoors, or unauthorized permission changes; the attacker could still use hidden accounts or modified ACLs to regain access. Option B is wrong because scanning for hidden accounts and resetting permissions on file servers only addresses lateral movement targets, not the root compromise on the domain controller; the attacker could still leverage domain-level persistence (e.g., Golden Ticket, DCSync rights) to re-compromise the environment. Option D is wrong because rebuilding the domain controller from a known good backup may reintroduce the same vulnerabilities if the backup is from after the compromise, and resetting only service account passwords does not address hidden user accounts or modified permissions on the domain controller or file servers.

Full explanation →
246
MCQeasy

A small business with 20 employees uses a legacy customer relationship management (CRM) application that supports only RC4 encryption for data transmission between the client and server. The company must comply with a new industry regulation that mandates the use of strong encryption (e.g., AES or TLS 1.2+). The IT manager has attempted to upgrade the CRM application, but the vendor has discontinued support and no updates are available. The company cannot afford to replace the CRM immediately, but must achieve compliance within 60 days. The network consists of a single Windows Server 2016 running the CRM server application and 20 Windows 10 workstations. All systems are on a flat internal network. The IT manager proposes several options. Which action is the most appropriate to achieve compliance?

A.Replace the legacy CRM application with a modern web-based CRM that supports TLS 1.2.
B.Continue using RC4 and accept the risk, since the network is isolated.
C.Place a reverse proxy in front of the CRM server that terminates TLS and forwards requests to the server using RC4.
D.Deploy a VPN tunnel between each workstation and the server to encapsulate the RC4 traffic.
AnswerA

Replacing the application ensures strong encryption is used and achieves compliance.

Why this answer

Replacing the legacy CRM with a modern web-based CRM that supports TLS 1.2 directly satisfies the regulation's requirement for strong encryption (AES or TLS 1.2+). This is the only option that eliminates the use of RC4 entirely and achieves compliance within the 60-day timeframe, as the company cannot upgrade the unsupported legacy application.

Exam trap

The trap here is that candidates may think a VPN or reverse proxy 'wraps' the weak encryption to achieve compliance, but the regulation requires the application itself to use strong encryption, not just the network tunnel.

How to eliminate wrong answers

Option B is wrong because accepting the risk of using RC4 violates the mandatory regulation, regardless of network isolation; compliance is not optional and RC4 is considered weak due to known vulnerabilities (e.g., biases in its keystream). Option C is wrong because placing a reverse proxy that terminates TLS but forwards requests to the server using RC4 still exposes the internal traffic to RC4 encryption, which does not meet the regulation's requirement for strong encryption end-to-end. Option D is wrong because deploying a VPN tunnel encapsulates the RC4 traffic but does not replace it; the CRM application still uses RC4 for its own data transmission, and the regulation mandates strong encryption for the application layer, not just the transport layer.

Full explanation →
247
MCQhard

A company runs containerized applications in a Kubernetes cluster. They need to ensure that containers run with the least privilege and cannot escalate privileges. Which configuration change is MOST effective?

A.Set the container to run as non-root user
B.Drop all Linux capabilities from the container
C.Mount the container root filesystem as read-only
D.Enable SELinux enforcing mode on the host
AnswerB

Correct. Dropping all Linux capabilities removes the ability to perform privileged operations, directly preventing privilege escalation.

Why this answer

Dropping all Linux capabilities from the container directly removes the ability to perform privileged operations, including privilege escalation. This is the most effective measure for preventing privilege escalation. Option A is incorrect because running as non-root does not prevent privilege escalation if the container retains capabilities.

Option C is incorrect because mounting root as read-only does not prevent privilege escalation via kernel exploits or mounted volumes. Option D is incorrect because SELinux enforcing mode adds MAC but is not the most direct way to prevent privilege escalation within the container.

Exam trap

Mounting root as read-only prevents writes to the container filesystem but does not prevent privilege escalation; dropping capabilities directly blocks privileged operations.

Full explanation →
248
MCQeasy

You are the security analyst at a mid-sized retail company with 500 employees. The company recently experienced a ransomware attack that encrypted files on a file server. The infection was traced to a phishing email opened by an employee in accounting. The company has antivirus software, a firewall, and daily backups. After the incident, management wants to improve risk identification to prevent future attacks. Which of the following is the MOST effective first step to improve risk identification?

A.Implement a data loss prevention (DLP) solution to monitor email traffic
B.Conduct a risk assessment that includes threat modeling and vulnerability scanning
C.Deploy a SIEM system to aggregate logs from all systems
D.Review the logs of the compromised file server for forensic details
AnswerB

A comprehensive risk assessment identifies all relevant risks.

Why this answer

Performing a comprehensive risk assessment focusing on people, process, and technology will identify gaps like phishing training gaps, technical controls, etc. Option A only addresses one attack vector; C is reactive; D is a control but not a direct identification step.

Full explanation →
249
MCQmedium

Refer to the exhibit. A user reports being unable to remote desktop (RDP) into a Windows server. Given the event log, what is the most likely cause?

A.The user does not have the 'Allow log on through Remote Desktop Services' user right
B.The user account is locked out
C.The server is not a member of the domain
D.The user's Kerberos ticket has expired
AnswerA

The failure reason clearly states the logon type is not granted; this user right is required for RDP access.

Why this answer

The event log shows an 'An account failed to log on' event (ID 4625) with a failure reason indicating 'The user has not been granted the requested logon type at this machine.' For Remote Desktop connections, the required logon type is 'Remote Interactive' (logon type 10). This specific error means the user lacks the 'Allow log on through Remote Desktop Services' user right, which is assigned via Local Security Policy or Group Policy. Without this right, the RDP session is denied at the authentication stage, even if the username and password are correct.

Exam trap

The trap here is that candidates often assume RDP failures are due to network issues, firewall rules, or account lockouts, when the event log's specific failure reason (logon type denial) directly points to a missing user right assignment.

How to eliminate wrong answers

Option B is wrong because a locked-out account would produce a different failure reason, such as 'Account locked out' (sub-status 0xC0000234), not a logon type denial. Option C is wrong because domain membership is not required for RDP; a standalone server can accept RDP connections if the user has local credentials and the appropriate user right. Option D is wrong because an expired Kerberos ticket would cause a specific Kerberos-related error (e.g., 0xC0000381 or 0xC000006D), not a logon type restriction, and Windows would typically fall back to NTLM if Kerberos fails.

Full explanation →
250
MCQhard

You are the incident response lead for a medium-sized financial services company. The company uses a hybrid infrastructure with on-premises servers (Active Directory, file shares, and a SQL database) and cloud services (Office 365, Azure VMs). At 2:00 PM on a Tuesday, the helpdesk receives multiple calls that users cannot access the file shares. Simultaneously, the SOC alerts on unusual outbound traffic from the domain controller (DC) to an external IP on port 443. The DC is also running a scheduled antivirus scan. The file server (FS) shows no signs of compromise but is responding slowly. The backup system reports that last night's backup of the DC failed due to a 'volume shadow copy error'. The backup of the FS succeeded. You need to take immediate action. What should you do FIRST?

A.Run a full malware scan on the domain controller.
B.Restore the file server from last night's backup.
C.Isolate the domain controller from the network.
D.Disable the domain controller's antivirus to improve performance.
AnswerC

Immediate containment stops the attack and preserves evidence.

Why this answer

The domain controller (DC) is showing signs of active compromise: unusual outbound traffic on port 443 (likely C2 communication) and a failed backup due to a volume shadow copy error (indicating attempted destruction of forensic evidence). Isolating the DC first stops the attacker's command-and-control channel and prevents lateral movement, which is the highest priority in incident response. Running a scan or restoring other systems before containment risks allowing the attacker to spread or destroy more data.

Exam trap

The trap here is that candidates see a failed backup and slow file server and jump to recovery actions (restore or scan), failing to recognize that the DC's outbound traffic and VSS error are the highest-priority indicators of an active breach requiring immediate containment.

How to eliminate wrong answers

Option A is wrong because running a full malware scan on a potentially compromised DC while it is still connected to the network could alert the attacker, trigger destructive actions, or allow the scan to be tampered with; containment must precede any scanning. Option B is wrong because restoring the file server from backup does not address the active threat on the DC, and the file server shows no signs of compromise—restoring it prematurely could reintroduce a vulnerability if the DC is later used to reinfect it. Option D is wrong because disabling the antivirus on the DC would remove a critical defense layer, potentially allowing the attacker to operate unimpeded; the antivirus scan is not the cause of the performance issue—the compromise is.

Full explanation →
251
Drag & Dropmedium

Drag and drop the steps for setting up a certificate authority (CA) in Windows Server into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Setting up a Certificate Authority on Windows Server involves installing the Active Directory Certificate Services role, then configuring the CA type (e.g., Enterprise Root CA), specifying storage locations for the certificate database and log files, completing the installation, and finally testing the CA by requesting a certificate. The steps must follow this order because each step depends on the previous one; for instance, you cannot configure the CA type before the role is installed, and storage settings are part of the configuration phase.

Full explanation →
252
Multi-Selectmedium

During a risk assessment, a bank identifies the following threats: flood, phishing attack, hardware failure, and power outage. Which TWO of these are considered environmental threat sources?

Select 2 answers
A.Hardware failure
B.Software bug
C.Flood
D.Power outage
E.Phishing attack
AnswersC, D

Flood is a natural environmental threat.

Why this answer

Flood (C) is an environmental threat source because it originates from natural or physical conditions outside the organization's control, such as weather or geographic location. Power outage (D) is also an environmental threat source as it stems from utility infrastructure failures or natural events, not from human or system actions. Both are classified under environmental threats in risk assessment frameworks like NIST SP 800-30.

Exam trap

The SSCP exam often tests the distinction between environmental and operational/technical threat sources, trapping candidates who classify hardware failure or power outage as environmental due to their physical nature, when only natural or utility-origin events qualify.

Full explanation →
253
MCQmedium

An organization decides to outsource its data center operations to a cloud provider. The cloud provider is responsible for physical security and hardware maintenance. This is an example of which risk response strategy?

A.Risk acceptance
B.Risk transfer
C.Risk avoidance
D.Risk mitigation
AnswerB

Outsourcing transfers the risk to the provider.

Why this answer

Transferring risk to a third party (cloud provider) is risk transfer.

Full explanation →
254
MCQeasy

A company implements a policy that requires all employees to change their passwords every 60 days. Which of the following is the PRIMARY security benefit of this requirement?

A.Ensuring compliance with data privacy laws.
B.Reducing the risk of password reuse across multiple sites.
C.Limiting the window of opportunity for a compromised password.
D.Simplifying the account lockout process.
AnswerC

The shorter the validity, the less time an attacker has.

Why this answer

Password expiration policies limit the exposure window for compromised credentials. If an attacker obtains a password, the 60-day rotation ensures that the stolen credential becomes invalid after that period, reducing the time an attacker can maintain unauthorized access. This is a fundamental security control to mitigate the risk of undetected credential theft.

Exam trap

ISC2 often tests the distinction between a primary security benefit and a secondary compliance or administrative convenience; the trap here is that candidates see 'compliance' (Option A) and assume it is the main goal, but the actual security rationale is limiting the window of opportunity for a compromised password.

How to eliminate wrong answers

Option A is wrong because while password policies may help meet certain regulatory requirements (e.g., PCI DSS, HIPAA), the primary security benefit is not compliance itself—compliance is a secondary outcome, not the core security goal. Option B is wrong because password expiration does not directly prevent password reuse across different sites; that is addressed by password managers, unique password requirements, or blocklists, not rotation frequency. Option D is wrong because password expiration has no direct relationship with the account lockout process; lockout is triggered by failed login attempts, not password age.

Full explanation →
255
MCQhard

During a post-implementation review of a change, it is discovered that the change introduced a configuration deviation from the baseline. The deviation was not detected during testing. What is the BEST way to prevent this in the future?

A.Increase the number of testers
B.Require CAB approval for all future changes
C.Implement automated configuration scanning in the staging environment
D.Use a different change management process
AnswerC

Automated scanning can detect deviations from the baseline before implementation.

Why this answer

Configuration management includes automated scanning (e.g., SCAP) to detect deviations. Implementing such scans in the staging environment would catch deviations before production.

Full explanation →
256
MCQeasy

Which protocol is used for secure web browsing and operates on TCP port 443?

A.HTTPS
B.HTTP
C.SSH
D.FTP
AnswerA

HTTPS is HTTP over TLS on port 443.

Why this answer

HTTPS (HTTP over TLS) uses TCP port 443 and provides encrypted communication for websites.

Full explanation →
257
MCQmedium

A security analyst discovers that an attacker has set up a fake wireless access point with the same SSID as the corporate network. Users are unknowingly connecting to it. What is this attack called?

A.KRACK
B.Rogue AP
C.Evil twin
D.PMKID attack
AnswerC

An evil twin is a malicious AP with the same SSID as a trusted network.

Why this answer

An evil twin is a rogue AP that impersonates a legitimate SSID to capture credentials and traffic.

Full explanation →
258
MCQmedium

An organization is moving away from legacy encryption and wants to avoid stream ciphers due to known vulnerabilities. Which of the following algorithms should be avoided because it is a stream cipher with known weaknesses like the BEAST attack?

A.RC4
B.3DES
C.AES-GCM
D.ChaCha20
AnswerA

RC4 is the deprecated stream cipher.

Why this answer

RC4 is a stream cipher with known weaknesses, such as biases in its output stream that can lead to plaintext recovery attacks. Although the BEAST attack actually exploits CBC mode in TLS 1.0, RC4 was often used as a workaround; however, RC4 itself has inherent vulnerabilities, making it unsuitable for secure encryption. Since the organization wants to avoid stream ciphers due to such vulnerabilities, RC4 should be avoided.

Exam trap

The trap here is that candidates may assume all stream ciphers are equally vulnerable, but ChaCha20 is a modern, secure stream cipher, while RC4 is the specific one with known weaknesses like BEAST.

How to eliminate wrong answers

Option B (3DES) is wrong because 3DES is a block cipher, not a stream cipher, and while it is deprecated due to slow performance and small block size, it is not associated with the BEAST attack. Option C (AES-GCM) is wrong because AES-GCM is a block cipher operating in Galois/Counter Mode, which is an authenticated encryption mode and not a stream cipher; it is not vulnerable to BEAST. Option D (ChaCha20) is wrong because ChaCha20 is a stream cipher, but it is modern, secure, and not associated with the BEAST attack; it is actually recommended as a replacement for RC4.

Full explanation →
259
Multi-Selectmedium

A company is conducting a disaster recovery test. Which TWO types of tests involve minimal risk to production operations?

Select 2 answers
A.Tabletop exercise
B.Simulation test
C.Parallel test
D.Walkthrough
E.Full interruption test
AnswersA, D

A discussion-based exercise with no actual system changes.

Why this answer

A tabletop exercise is a discussion-based test where key personnel walk through a disaster scenario without affecting live systems. It involves no actual failover, data replication, or production traffic, so the risk to operations is zero. This makes it a safe, low-cost method to validate plans and roles.

Exam trap

A common misconception is that 'simulation' or 'parallel' tests are low-risk because they are 'controlled,' but the key distinction is that tabletop and walkthrough involve zero execution of technical recovery steps, while any test that touches production systems carries inherent risk.

Full explanation →
260
Multi-Selectmedium

Which TWO of the following are key components of an organization's security policy framework? (Choose two.)

Select 2 answers
A.Standard operating procedures
B.Intrusion detection system
C.Access control lists
D.Security awareness training
E.Firewall rules
AnswersA, D

Standard operating procedures define how policies are implemented.

Why this answer

Standard operating procedures (SOPs) are a key component of an organization's security policy framework because they provide detailed, step-by-step instructions for implementing security controls and responding to incidents. SOPs operationalize high-level policies into actionable tasks, ensuring consistency and compliance across the organization. They are formal documents that define the 'how' of security operations, such as patch management or user account provisioning.

Exam trap

ISC2 often tests the distinction between policy framework documents (e.g., SOPs, policies) and technical controls (e.g., IDS, ACLs, firewall rules), leading candidates to confuse operational tools with governance components.

Full explanation →
261
MCQmedium

A government agency requires all employees to use smart cards for network access. The security team notices a pattern of failed authentication attempts from a specific building after hours. The attempts occur every night at 2:00 AM for about 10 minutes. The building has a badge reader at the entrance. The team suspects an attacker is trying to brute-force smart card PINs. However, the building's door logs show no entry at that time. Which of the following should the security team do FIRST to identify the risk?

A.Correlate the authentication logs with physical access logs to see if any employee was present
B.Immediately isolate the building's network segment
C.Change all smart card PINs for that building's employees
D.Notify law enforcement about a potential cyberattack
AnswerA

Identifies whether the attempts are from legitimate users or external attacks.

Why this answer

Correlating authentication logs with physical access logs is the best first step because it can confirm whether the failed authentication attempts originated from someone physically inside the building. The door logs show no entry after hours, so if the authentication logs correlate with physical access logs, it might indicate an employee was present (e.g., piggybacking or badge sharing). If there is no correlation, it suggests the attempts are from outside, likely an attacker.

This analysis informs further action. Options B, C, and D are premature without this evidence.

Full explanation →
262
MCQeasy

A security administrator needs to store sensitive customer data in a database. To protect the data at rest, which encryption method should be used?

A.RSA-2048
B.Blowfish in CTR mode
C.AES-256 in CBC mode
D.DES in ECB mode
AnswerC

AES-256 in CBC mode is a strong symmetric encryption suitable for data at rest.

Why this answer

AES-256 in CBC mode is the correct choice because it is a strong, widely accepted symmetric encryption algorithm that provides confidentiality for data at rest. AES-256 uses a 256-bit key, making it resistant to brute-force attacks, and CBC mode adds an initialization vector (IV) to ensure that identical plaintext blocks produce different ciphertext, preventing pattern leakage. This combination is recommended by standards such as NIST SP 800-38A for protecting sensitive stored data.

Exam trap

The trap here is that candidates often confuse asymmetric encryption (RSA) with symmetric encryption for data at rest, or they overlook the weaknesses of legacy algorithms like DES and Blowfish, assuming any encryption is sufficient without considering key size and mode of operation.

How to eliminate wrong answers

Option A is wrong because RSA-2048 is an asymmetric encryption algorithm used for key exchange and digital signatures, not for encrypting large volumes of data at rest; it is computationally expensive and impractical for database encryption. Option B is wrong because Blowfish in CTR mode is a legacy cipher with a 64-bit block size, which is vulnerable to birthday attacks and not recommended for modern data-at-rest protection; CTR mode also turns the cipher into a stream cipher, which can introduce risks if the IV is reused. Option D is wrong because DES in ECB mode uses a 56-bit key that is easily brute-forced with modern hardware, and ECB mode encrypts identical plaintext blocks into identical ciphertext blocks, revealing patterns in the data.

Full explanation →
263
MCQmedium

In a forensic investigation, a hash of a suspect file is computed. Which of the following is the primary purpose of hashing in this context?

A.To compress the file
B.To decrypt the file
C.To identify the file owner
D.To verify file integrity
AnswerD

Hashing creates a unique fingerprint to detect changes.

Why this answer

In forensic investigations, hashing (using algorithms like SHA-256 or MD5) produces a unique fixed-size digest of the file's contents. The primary purpose is to verify file integrity by comparing the hash before and after analysis, ensuring the evidence has not been altered. This provides a cryptographic chain of custody, as any change to the file results in a completely different hash value.

Exam trap

ISC2 often tests the misconception that hashing is used for encryption or compression, leading candidates to confuse its integrity-checking role with data transformation or security functions.

How to eliminate wrong answers

Option A is wrong because hashing is not a compression algorithm; compression (e.g., ZIP, gzip) reduces file size for storage or transmission, while hashing produces a fixed-length digest regardless of file size and does not reduce the original data. Option B is wrong because hashing is a one-way function that cannot decrypt data; decryption requires a reversible cipher and a key, whereas hashing is irreversible by design. Option C is wrong because hashing identifies the file's content integrity, not the owner; file ownership is determined by metadata (e.g., NTFS security identifiers or Unix UID/GID) or digital signatures, not by a hash of the file's data.

Full explanation →
264
Multi-Selectmedium

A company is migrating to the cloud and wants to understand the shared responsibility model. For an IaaS deployment, which THREE are customer responsibilities? (Select THREE.)

Select 3 answers
A.Managing application security (e.g., patching web app code)
B.Configuring the host-based firewall on VMs
C.Patching the guest operating system
D.Physical security of the data center
E.Securing the hypervisor
AnswersA, B, C

Customer manages applications.

Why this answer

In IaaS, customer manages OS, applications, and network traffic controls (guest OS firewall).

Full explanation →
265
MCQeasy

An organization is developing its incident response plan. According to NIST SP 800-61, which phase should include establishing a communication plan, acquiring necessary tools, and conducting exercises?

A.Preparation
B.Post-Incident Activity
C.Detection and Analysis
D.Containment, Eradication, and Recovery
AnswerA

Correct. Preparation includes the IR plan, team, tools, exercises, and communication plan.

Why this answer

According to NIST SP 800-61, the Preparation phase is where the organization establishes a communication plan, acquires necessary tools (e.g., forensic workstations, imaging software, network monitoring tools), and conducts exercises (e.g., tabletop exercises or full-scale simulations) to ensure readiness. This phase lays the foundation for all subsequent incident response activities by ensuring resources and procedures are in place before an incident occurs.

Exam trap

A common misconception is that Detection and Analysis includes proactive preparation activities, but NIST SP 800-61 clearly separates the proactive Preparation phase from the reactive Detection phase, which only begins after an incident is suspected.

How to eliminate wrong answers

Option B is wrong because the Post-Incident Activity phase focuses on lessons learned, evidence retention, and report generation after containment and recovery, not on proactive preparation like tool acquisition or exercises. Option C is wrong because Detection and Analysis involves identifying and validating incidents through log analysis, alerts, and threat intelligence, not establishing communication plans or acquiring tools. Option D is wrong because Containment, Eradication, and Recovery are reactive phases that execute actions to stop the incident, remove threats, and restore systems, relying on the tools and plans already set up in Preparation.

Full explanation →
266
MCQmedium

A company is implementing a new access control system for its data center. Which physical security control is best for preventing tailgating?

A.Mantrap
B.Biometric reader
C.Security guard
D.CCTV cameras
AnswerA

Two-door system prevents tailgating.

Why this answer

A mantrap is specifically designed to prevent tailgating by using a small vestibule with two interlocking doors. Only one door can open at a time, and the system typically requires authentication (e.g., badge or biometric) to proceed, ensuring that only one authorized person enters per cycle. This physical barrier directly blocks unauthorized individuals from following an authorized user through a single entry point.

Exam trap

SSCP candidates often mistake authentication methods like biometric readers or key cards as preventive controls for tailgating. However, these are identification/authentication controls; preventing tailgating requires a physical barrier such as a mantrap that enforces one-at-a-time entry.

How to eliminate wrong answers

Option B is wrong because a biometric reader authenticates identity but does not physically prevent multiple people from entering together; tailgating can still occur if an authorized user opens the door and an unauthorized person follows. Option C is wrong because while a security guard can deter tailgating, they are not a mechanical or automated control and can be distracted, overwhelmed, or bypassed, making them less reliable than a mantrap. Option D is wrong because CCTV cameras only provide surveillance and recording of tailgating incidents after they occur; they do not actively prevent the act of tailgating in real time.

Full explanation →
267
MCQhard

Refer to the exhibit. A security analyst reviews the log and determines that the system was under a brute force attack. However, the analyst notices that the attack stopped after 5 minutes, and the IP address was not blocked. Which of the following is the MOST likely reason the attack stopped?

A.The SSH server's MaxAuthTries limit was exceeded.
B.The system's account lockout policy prevented further attempts.
C.The attacker achieved successful login.
D.The system's firewall dropped the traffic.
AnswerA

MaxAuthTries causes the connection to close after a set number of failures.

Why this answer

The SSH server's MaxAuthTries limit (default 6 in OpenSSH) causes the server to terminate the connection after a threshold of failed authentication attempts. This stops the attack on that specific TCP session, but does not block the IP address, which explains why the attack ceased after 5 minutes without any persistent block.

Exam trap

The trap here is confusing session-level authentication limits (MaxAuthTries) with persistent account lockout policies or firewall blocks, leading candidates to incorrectly choose account lockout or firewall options.

How to eliminate wrong answers

Option B is wrong because account lockout policies are typically enforced at the OS or PAM level, not by the SSH server itself, and would require a persistent block on the user account, not just a session termination. Option C is wrong because a successful login would show a successful authentication event in the log, not a cessation of attempts without any success record. Option D is wrong because if the firewall dropped the traffic, the IP address would be blocked and no further attempts would appear in the log, but the analyst noted the IP was not blocked.

Full explanation →
268
MCQmedium

A developer wants to ensure that a web application is protected against cross-site request forgery (CSRF). Which mitigation technique is most commonly recommended?

A.Implement a Content Security Policy (CSP).
B.Enable HTTP Strict Transport Security (HSTS).
C.Sanitize all user input.
D.Use anti-CSRF tokens in forms.
E.Implement Cross-Origin Resource Sharing (CORS) headers.
AnswerD

Anti-CSRF tokens are validated by the server to ensure request legitimacy.

Why this answer

Anti-CSRF tokens are unique per session and validated on state-changing requests, ensuring the request originated from the legitimate site. Option A (Content Security Policy) mitigates XSS, not CSRF. Option B (HTTP Strict Transport Security) enforces HTTPS.

Option C (sanitize user input) is for injection attacks. Option E (Cross-Origin Resource Sharing) controls cross-origin reads.

Full explanation →
269
Multi-Selecthard

A company is selecting a disaster recovery site for its critical applications. Which THREE characteristics differentiate a warm site from a cold site? (Select three.)

Select 3 answers
A.A warm site is typically ready to operate within hours.
B.A warm site has environmental controls (power, cooling) already in place.
C.A warm site has pre-installed servers and network equipment.
D.A warm site has live data replication from the primary site.
E.A warm site requires data restoration from backups before use.
AnswersB, C, E

Cold sites lack environmental controls; warm sites have them.

Why this answer

A warm site is partially configured with environmental controls such as power, cooling, and network connectivity already in place. This distinguishes it from a cold site, which lacks these infrastructure components and requires significant setup time. The presence of environmental controls is a key differentiator that allows a warm site to become operational faster than a cold site, though it still requires data restoration from backups before full recovery.

Exam trap

Candidates often confuse warm sites with hot sites, incorrectly attributing features like live data replication or rapid recovery (hours) to warm sites. In the SSCP exam, focus on the fact that warm sites have pre-installed infrastructure and environmental controls but require backup restoration before full operation.

Full explanation →
270
MCQeasy

An organization wants to ensure that a software update has not been tampered with during download. Which cryptographic technique should be used?

A.Compute a SHA-256 hash of the update
B.Sign the update with the developer's private key
C.Encrypt the update with AES
D.Append a MAC (Message Authentication Code)
AnswerB

A digital signature ensures integrity and authenticates the developer.

Why this answer

Signing the update with the developer's private key provides both integrity and authenticity. When the user verifies the signature using the developer's public key, they can confirm that the update has not been tampered with and that it originated from the claimed developer. This is the standard approach for ensuring trust in software distribution, as used in code signing certificates (e.g., Authenticode, GPG).

Exam trap

The trap here is that candidates confuse integrity-only mechanisms (hash, MAC) with the combined integrity and authenticity provided by digital signatures, or they mistakenly think encryption (AES) prevents tampering when it only provides confidentiality.

How to eliminate wrong answers

Option A is wrong because computing a SHA-256 hash alone provides integrity but no authentication; an attacker could replace both the update and its hash, and the user would have no way to detect the substitution. Option C is wrong because encrypting the update with AES ensures confidentiality but does not prevent tampering; an attacker could modify the ciphertext, and decryption would produce garbage, but the user would not know if the original plaintext was altered. Option D is wrong because appending a MAC (Message Authentication Code) provides integrity and authenticity only if both parties share a secret key; in a public download scenario, the user cannot verify the MAC without the shared secret, making it impractical for verifying the update's origin.

Full explanation →
271
MCQeasy

A security analyst notices repeated failed login attempts from a single IP address on the VPN gateway. The analyst adjusts the threshold for account lockout and enables geo-ip blocking. This activity is part of which risk management process?

A.Risk identification
B.Risk assessment
C.Risk reporting
D.Risk monitoring
AnswerD

Adjusting controls based on observed events is a core risk monitoring activity.

Why this answer

The analyst is actively monitoring the VPN gateway for security events (failed logins) and then adjusting controls (lockout threshold, geo-IP blocking) in response to observed threats. This continuous observation and adjustment is the essence of risk monitoring, which is the ongoing process of tracking identified risks and evaluating the effectiveness of controls. The actions taken are not about identifying new risks, assessing their likelihood/impact, or formally reporting them, but rather about reacting to real-time data to maintain an acceptable risk posture.

Exam trap

The trap here is that candidates confuse 'monitoring' (ongoing observation and adjustment) with 'risk assessment' (quantitative/qualitative analysis), because adjusting thresholds feels like evaluating risk, but the question explicitly describes a reactive, operational action rather than a formal assessment process.

How to eliminate wrong answers

Option A is wrong because risk identification is the initial step of discovering and documenting potential risks (e.g., 'failed logins could indicate a brute-force attack'), but the analyst has already identified the risk and is now adjusting controls based on observed events. Option B is wrong because risk assessment involves evaluating the likelihood and impact of a risk (e.g., calculating the annualized loss expectancy), not implementing or tuning technical controls like lockout thresholds or geo-IP blocking. Option C is wrong because risk reporting is the formal communication of risk findings to stakeholders (e.g., via a risk register or executive summary), not the real-time operational adjustment of security configurations.

Full explanation →
272
MCQeasy

What is the primary purpose of establishing a chain of custody for digital evidence?

A.To reduce the size of evidence for storage
B.To encrypt evidence for secure transmission
C.To maintain evidence integrity and track handling
D.To prioritize which evidence to analyze first
AnswerC

It documents who handled evidence, when, and why, ensuring it hasn't been tampered with.

Why this answer

The primary purpose of establishing a chain of custody for digital evidence is to maintain evidence integrity and track every person who handled the evidence from collection through presentation in court. This process ensures that the evidence has not been tampered with, altered, or corrupted, which is critical for admissibility under legal standards such as the Federal Rules of Evidence (FRE) Rule 901. By documenting each transfer with timestamps, signatures, and hash values (e.g., MD5 or SHA-256), the chain of custody provides a verifiable audit trail that supports the evidence's authenticity and reliability.

Exam trap

The trap here is that candidates confuse chain of custody with data preservation techniques like encryption or compression, but the exam specifically tests that its core purpose is to ensure integrity and provide an unbroken audit trail of handling, not to secure or reduce the data.

How to eliminate wrong answers

Option A is wrong because reducing the size of evidence for storage is not a purpose of chain of custody; that is typically achieved through compression algorithms like ZIP or deduplication, and it has no bearing on legal admissibility. Option B is wrong because encrypting evidence for secure transmission is a separate security measure (e.g., using AES-256 or TLS), not a function of chain of custody, which focuses on documenting handling rather than protecting confidentiality. Option D is wrong because prioritizing which evidence to analyze first is a triage decision made during incident response based on impact or volatility (e.g., memory over disk), not a goal of chain of custody, which applies equally to all evidence items.

Full explanation →
273
MCQmedium

A network administrator configured the above port security on an access port connected to a VoIP phone and a PC. A third device is connected to the phone's passthrough port. What will happen when the third device attempts to communicate?

A.The third device will be allowed to communicate because the phone's MAC is not counted.
B.The third device's traffic will be dropped, and a syslog message will be generated.
C.The port will be error-disabled.
D.The port will remain up but all traffic will be dropped.
AnswerB

'Restrict' drops excess traffic and logs the violation.

Why this answer

The port security configuration on the access port has a maximum MAC address count that includes the VoIP phone's MAC address. When a third device connects to the phone's passthrough port, it introduces an additional MAC address, exceeding the configured limit. The switch will then drop traffic from the third device and generate a syslog message, as the default violation mode is 'restrict' (or 'protect' depending on the configuration), which does not error-disable the port but discards offending frames and logs the event.

Exam trap

ISC2 often tests the misconception that the VoIP phone's MAC address is not counted toward port security limits, leading candidates to incorrectly choose that the third device is allowed, when in fact the phone's MAC is always counted unless a specific 'voice VLAN' exception is configured (which is not the case here).

How to eliminate wrong answers

Option A is wrong because the VoIP phone's MAC address is indeed counted toward the port security limit, as the phone is a network device with its own MAC; the statement that it is not counted is a common misconception. Option C is wrong because the default violation mode for port security is 'restrict' or 'protect', not 'shutdown'; 'shutdown' would error-disable the port, but the question implies a violation mode that drops traffic without disabling the port (as indicated by the correct answer generating a syslog message). Option D is wrong because while the port remains up, not all traffic is dropped; only traffic from the third device (the violating MAC) is dropped, while traffic from the phone and PC continues normally.

Full explanation →
274
MCQhard

Based on the exhibit, which of the following best describes the firewall configuration?

A.The firewall allows only loopback traffic.
B.The firewall allows all traffic from the internal subnet.
C.The firewall allows SSH, HTTP, and HTTPS from the internal subnet and drops all other traffic.
D.The firewall allows all traffic from external sources.
AnswerC

The rules show ACCEPT for ports 22, 80, 443 from 10.0.0.0/24, and a final DROP all.

Why this answer

The exhibit shows an access control list (ACL) that explicitly permits TCP traffic on ports 22 (SSH), 80 (HTTP), and 443 (HTTPS) from the internal subnet (e.g., 192.168.1.0/24) to any destination, followed by an implicit deny all rule. This configuration allows only SSH, HTTP, and HTTPS from the internal subnet and drops all other traffic, matching option C.

Exam trap

The trap here is that candidates often overlook the implicit deny at the end of an ACL, assuming that only the listed permits exist and that all other traffic is allowed by default, rather than understanding that any traffic not explicitly permitted is dropped.

How to eliminate wrong answers

Option A is wrong because loopback traffic (127.0.0.0/8) is not explicitly permitted or denied in the ACL; the ACL focuses on the internal subnet, not loopback. Option B is wrong because the ACL does not allow all traffic from the internal subnet; it specifically permits only SSH, HTTP, and HTTPS, and denies everything else via the implicit deny. Option D is wrong because the ACL does not allow any traffic from external sources; it only permits traffic from the internal subnet, and external traffic would be subject to the implicit deny unless explicitly permitted.

Full explanation →
275
Multi-Selecteasy

Which THREE of the following are data loss prevention (DLP) controls that can be implemented to protect sensitive data?

Select 3 answers
A.Require strong passwords for all user accounts
B.Encrypt sensitive data both at rest and in transit
C.Deploy endpoint DLP agents to monitor and block unauthorized data transfers
D.Classify data based on sensitivity and apply appropriate labels
E.Implement network firewalls to block all outbound traffic
AnswersB, C, D

Encryption renders data unreadable if leaked.

Why this answer

The correct answers are B, C, and D. Encrypting sensitive data at rest and in transit (B) directly prevents unauthorized disclosure. Deploying endpoint DLP agents (C) monitors and blocks unauthorized data transfers.

Classifying data based on sensitivity and applying appropriate labels (D) enables targeted protection. Option A (strong passwords) is an authentication control, not a DLP control. Option E (network firewalls) controls traffic but does not inspect content for data loss prevention.

Full explanation →
276
Multi-Selectmedium

Which TWO of the following are key components of a Security Information and Event Management (SIEM) system? (Select two.)

Select 2 answers
A.Vulnerability scanning
B.Centralized log collection and storage
C.Correlation and analysis engine
D.Intrusion detection system (IDS)
E.Data loss prevention (DLP)
AnswersB, C

Core function of SIEM.

Why this answer

Centralized log collection and storage is a core SIEM component because it aggregates logs from diverse sources (servers, firewalls, applications) into a single repository, enabling unified analysis and forensic investigation. Without this centralized data lake, the correlation engine would have no data to process, making the SIEM ineffective.

Exam trap

ISC2 often tests the misconception that SIEM includes active security controls like IDS or DLP, when in fact SIEM is a passive analysis and management platform that aggregates data from those tools.

Full explanation →
277
MCQeasy

A company's incident response plan includes a step to preserve evidence. Which action BEST ensures the integrity of forensic evidence?

A.Turn off the system immediately
B.Copy files to a network share
C.Run a checksum on the live system
D.Create a forensic image with write blocker and hash
AnswerD

Forensic imaging with hashing ensures original data is unchanged.

Why this answer

Creating a forensic image with a write blocker ensures that the original data is not altered during acquisition, and hashing (e.g., SHA-256) provides a cryptographic integrity check that can later verify the image is an exact bit-for-bit copy. This preserves the chain of custody and admissibility of evidence in legal proceedings.

Exam trap

The trap here is that candidates confuse 'preserving evidence' with 'preserving system availability' or 'quick data capture,' leading them to choose turning off the system or copying files, which actually destroy or alter forensic integrity.

How to eliminate wrong answers

Option A is wrong because turning off the system immediately can cause loss of volatile data (e.g., RAM contents, network connections) and may trigger anti-forensic mechanisms or corrupt the file system. Option B is wrong because copying files to a network share alters file metadata (e.g., timestamps, access times) and does not capture deleted or hidden data, nor does it provide a verifiable hash of the original media. Option C is wrong because running a checksum on the live system modifies the system state (e.g., reading files changes access times) and the hash is taken from a potentially altered source, so it cannot guarantee the integrity of the original evidence.

Full explanation →
278
MCQmedium

A company uses AWS for critical workloads. An analyst notices unauthorized API calls from an IP address outside the company. The logs show that the attacker used stolen access keys belonging to an IAM user with administrative privileges. The incident response team must contain the breach as quickly as possible. The analyst has access to the AWS Management Console and can use the CLI. The team is following the incident response plan. Which action should be taken FIRST to prevent further unauthorized actions?

A.Create a new security group to block the attacker's source IP at the network level.
B.Disable the compromised access keys using the IAM dashboard or CLI.
C.Delete the compromised IAM user immediately.
D.Rotate all IAM user access keys across the entire AWS account.
AnswerB

Correct: This directly stops the attacker's ability to authenticate with those keys.

Why this answer

The immediate priority in an access key compromise is to invalidate the stolen credentials to stop the attacker from making further API calls. Disabling the compromised access keys via the IAM dashboard or CLI (using `aws iam update-access-key --status Inactive`) is the fastest containment action that directly revokes the attacker's authentication token without disrupting other legitimate users or services.

Exam trap

ISC2 often tests the principle of least disruption during containment — candidates may choose to delete the user or block the IP, but the correct first step is to disable the specific compromised credential to stop the attack without breaking other dependencies.

How to eliminate wrong answers

Option A is wrong because creating a security group to block the attacker's source IP at the network level does not prevent the attacker from using the stolen keys from a different IP address, and AWS API calls are not filtered by security groups (which apply only to VPC network traffic, not to the AWS API endpoint). Option C is wrong because deleting the compromised IAM user immediately could cause unintended disruption to any services or automation relying on that user, and it is a more destructive action than simply disabling the keys; the incident response plan typically recommends disabling keys first to preserve the user for forensic analysis. Option D is wrong because rotating all IAM user access keys across the entire account is an overly broad and time-consuming action that could break legitimate operations and is not the first step; the priority is to contain the specific compromised keys, not to rotate every key in the account.

Full explanation →
279
MCQmedium

A biometric system has a high false rejection rate (FRR). Which of the following is a likely consequence?

A.The system will require less frequent calibration
B.Unauthorized users are more likely to gain access
C.Legitimate users may be denied access, leading to frustration
D.The system's crossover error rate (CER) will be very low
AnswerC

Correct. High FRR means many false rejections.

Why this answer

False rejection means legitimate users are denied access, causing inconvenience. This is often a trade-off when trying to lower false acceptance rate (FAR).

Full explanation →
280
Drag & Dropmedium

Drag and drop the steps for properly disposing of a hard drive containing sensitive data into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

The proper order for disposing of a hard drive with sensitive data is: first, backup any data that needs to be retained; second, overwrite the entire drive to sanitize it; third, verify that the overwrite was successful using a tool; fourth, physically destroy the drive (e.g., shredding or crushing); and finally, document the process for audit trails and compliance. This sequence ensures data confidentiality and availability of necessary data.

Full explanation →
281
MCQhard

During a security audit, it is discovered that a service account has been used to log in interactively to a server. The account was originally provisioned only for running a background service. Which PAM (Privileged Access Management) control would best prevent such misuse in the future?

A.Password vaulting with automatic rotation
B.Requiring multi-factor authentication for the service account
C.Just-in-time (JIT) provisioning of the service account
D.Session recording and monitoring
AnswerC

Correct. JIT ensures the account is only active when needed, reducing exposure.

Why this answer

Just-in-time (JIT) provisioning grants temporary privileges only when needed, and password vaulting stores credentials securely with automatic rotation. Session recording monitors activity but doesn't prevent misuse. MFA adds a layer but service accounts often can't use MFA interactively.

The best preventive control is to restrict interactive logon via policy, but among PAM controls, JIT provisioning ensures the account is not available for interactive use continuously.

Full explanation →
282
MCQhard

A security analyst is investigating a potential data exfiltration incident. The logs show a large number of outbound DNS queries to a domain that resolves to an IP address in a foreign country. The queries contain encoded strings in the subdomain. Which type of attack is MOST likely occurring?

A.DNS poisoning
B.DNS amplification attack
C.DNS rebinding
D.DNS tunneling
AnswerD

DNS tunneling encodes data in DNS queries and responses for covert exfiltration.

Why this answer

DNS tunneling encodes data within DNS queries and responses to bypass network security controls. The large volume of outbound queries to a foreign IP, combined with encoded subdomain strings, is the classic signature of data exfiltration via DNS tunneling, as the protocol is often allowed through firewalls.

Exam trap

The trap here is that candidates confuse DNS tunneling with DNS amplification because both involve high query volumes, but amplification focuses on response size and reflection, not on encoding data in subdomains for exfiltration.

How to eliminate wrong answers

Option A is wrong because DNS poisoning corrupts the cache of a resolver to redirect traffic to malicious sites, not to exfiltrate data via encoded queries. Option B is wrong because a DNS amplification attack uses open resolvers to flood a victim with large responses, not to send outbound queries with encoded payloads. Option C is wrong because DNS rebinding manipulates DNS responses to bypass same-origin policy for browser-based attacks, not to exfiltrate data through subdomain strings.

Full explanation →
283
MCQeasy

A company is implementing a new file-sharing application for employees. Which of the following is the most important security control to prevent unauthorized access to shared files?

A.Schedule regular backups.
B.Implement access control lists (ACLs) on shared folders.
C.Install antivirus software on all endpoints.
D.Enable detailed audit logging.
E.Encrypt files with AES-256.
AnswerB

ACLs enforce permissions, restricting access only to authorized users.

Why this answer

The most important control to prevent unauthorized access to shared files is implementing access control lists (ACLs), which explicitly define who can access resources and what permissions they have. Encryption (E) protects data at rest but does not manage permissions; audit logging (D) is detective, not preventive; antivirus (C) prevents malware but does not control access; backups (A) ensure availability, not confidentiality. Therefore, B is correct.

Full explanation →
284
MCQmedium

A security analyst is evaluating the cryptographic settings for a new application that requires both confidentiality and integrity for data in transit. The analyst needs to choose a symmetric cipher that provides authenticated encryption. Which of the following is the best choice?

A.RC4 stream cipher
B.AES in ECB mode
C.AES in GCM mode
D.AES in CBC mode
AnswerC

GCM mode provides both confidentiality and integrity (authenticated encryption) using a counter mode for encryption and a Galois field for authentication.

Why this answer

AES in GCM mode provides both encryption and authentication, making it the preferred choice for authenticated encryption. ECB lacks diffusion and is insecure, CBC provides only encryption, and RC4 is a broken stream cipher.

Full explanation →
285
Multi-Selectmedium

A security analyst is reviewing the configuration of an enterprise wireless network. Which TWO of the following are best practices for securing the wireless network against unauthorized access and eavesdropping?

Select 2 answers
A.Configure a dedicated guest network on a separate VLAN
B.Activate WPS for simplified client setup
C.Enable WPA2-PSK with a complex passphrase
D.Implement WPA2-Enterprise with RADIUS authentication
E.Disable SSID broadcast to hide the network
AnswersA, D

Isolating guest traffic on a separate VLAN prevents unauthorized access to internal resources and contains potential threats.

Why this answer

WPA2-Enterprise with RADIUS provides strong per-user authentication and encryption, mitigating unauthorized access. Placing guest traffic on a separate VLAN segments network traffic and reduces exposure of internal resources. WPA2-PSK with a complex passphrase is acceptable for small networks but not enterprise-grade.

Disabling SSID broadcast is not a security control as it can be easily discovered. WPS is known to have severe vulnerabilities and should be disabled.

Full explanation →
286
MCQhard

Refer to the exhibit. An organization's incident response policy defines these actions. In what sequence should these phases be applied?

A.Isolate, reimage, restore from backup
B.Reimage, isolate, restore
C.Restore, isolate, reimage
D.Isolate, restore, reimage
AnswerA

Containment before eradication before recovery is standard process.

Why this answer

The correct sequence is Isolate, reimage, restore from backup because containment (isolation) must occur first to prevent the incident from spreading, followed by eradication (reimaging) to remove the threat, and finally recovery (restoring from backup) to return the system to a known good state. This aligns with the NIST SP 800-61 incident response lifecycle, where containment, eradication, and recovery are performed in that order.

Exam trap

The trap here is that candidates mistakenly think restoration can occur before eradication, but in practice, restoring from backup without reimaging leaves the system vulnerable if the backup itself is compromised or if the root cause (e.g., a persistent rootkit) remains in the system firmware or boot sector.

How to eliminate wrong answers

Option B is wrong because reimaging before isolation could allow the threat to spread to other systems during the reimage process, violating the containment principle. Option C is wrong because restoring from backup before isolating and reimaging would reintroduce the threat if the backup is compromised, and the system remains vulnerable. Option D is wrong because restoring from backup before reimaging fails to eradicate the root cause; the threat may persist in the restored data or system state.

Full explanation →
287
Multi-Selectmedium

A security administrator is hardening a wireless network. Which TWO of the following should be avoided due to known vulnerabilities?

Select 2 answers
A.WPA3-Enterprise
B.WPA3-Personal
C.WEP
D.WPA2-PSK
E.WPA2-Enterprise
AnswersC, D

WEP is broken and should not be used.

Why this answer

WEP and WPA2-PSK have known vulnerabilities; WEP is broken, and WPA2-PSK is vulnerable to offline dictionary attacks (PMKID, KRACK).

Full explanation →
288
MCQmedium

In X.509 certificate format, which field is used to specify the fully qualified domain name(s) for which the certificate is valid?

A.Key Usage
B.Issuer
C.Subject
D.Subject Alternative Name
AnswerD

SAN is the correct field.

Why this answer

The Subject Alternative Name (SAN) extension allows specifying multiple hostnames.

Full explanation →
289
Multi-Selecthard

An organization is designing a secure email system using S/MIME. Which of the following are essential components of the PKI that must be in place? (Select THREE)

Select 3 answers
A.A symmetric key distribution center (KDC)
B.X.509 digital certificates for each user
C.A method to check certificate revocation (e.g., CRL or OCSP)
D.A timestamp authority (TSA)
E.A certificate authority (CA) to sign certificates
AnswersB, C, E

Each user needs a certificate containing their public key and identity.

Why this answer

S/MIME relies on a PKI where each user possesses an X.509 digital certificate that binds their identity to a public key. This certificate is essential for signing and encrypting emails, as it allows recipients to verify the sender's identity and encrypt messages using the sender's public key.

Exam trap

In the SSCP exam, candidates often mistakenly select a KDC or TSA as essential for S/MIME, but these are auxiliary services, not core PKI components.

Full explanation →
290
Drag & Dropmedium

Drag and drop the steps for conducting a security incident response under the NIST framework into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

NIST incident response follows: Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident Activity, and Reporting.

Full explanation →
291
MCQmedium

A company is implementing a VPN for remote employees. The security policy requires that all traffic from the remote device to the corporate network be encrypted, but internet-bound traffic should go directly to the internet. Which VPN configuration should be used?

A.Remote Desktop Gateway
B.Split tunnel VPN
C.Host-to-host VPN
D.Full tunnel VPN
AnswerB

Split tunnel allows direct internet access while encrypting corporate-bound traffic.

Why this answer

A split tunnel VPN configuration allows remote users to access the corporate network securely over an encrypted tunnel while simultaneously sending internet-bound traffic directly to the internet without passing through the corporate VPN gateway. This meets the security policy requirement because only traffic destined for the corporate network is encrypted, reducing latency and bandwidth load on the VPN concentrator.

Exam trap

ISC2 often tests the misconception that 'all traffic must be encrypted for security,' leading candidates to choose full tunnel VPN (Option D) when the question explicitly states internet-bound traffic should go directly to the internet, which split tunneling uniquely supports.

How to eliminate wrong answers

Option A is wrong because Remote Desktop Gateway is a Microsoft service that provides encrypted RDP connections to internal resources, not a VPN configuration that handles general IP traffic routing. Option C is wrong because a host-to-host VPN (e.g., IPsec transport mode) creates a direct encrypted tunnel between two specific hosts, not between a remote device and a corporate network with split routing. Option D is wrong because a full tunnel VPN sends all traffic (including internet-bound) through the corporate VPN gateway, which violates the policy that internet-bound traffic should go directly to the internet.

Full explanation →
292
MCQmedium

A financial institution uses a risk management framework based on ISO 31000. During a quarterly risk review, the risk manager identifies that the residual risk for a critical trading application remains high despite multiple controls. The application's risk score has not decreased after implementing two-factor authentication and encryption. The risk appetite statement says 'no high residual risk for systems processing transactions over $10M.' What should the risk manager do next?

A.Reduce the risk by disabling non-essential features of the application.
B.Transfer the risk by purchasing cyber insurance.
C.Escalate to senior management for a decision on additional controls or risk acceptance.
D.Accept the risk because controls are already in place.
AnswerC

Escalation ensures that senior management, who own the risk appetite, decide on additional controls or formally accept the residual risk.

Why this answer

When residual risk exceeds the organization's risk appetite, standard risk management frameworks (like ISO 31000) require escalation to senior management to decide on additional controls or formal risk acceptance. Option A is incorrect because disabling non-essential features may not sufficiently reduce the risk to within appetite and could harm business operations. Option B is incorrect because cyber insurance transfers financial loss but does not reduce the residual risk itself; the risk appetite statement addresses residual risk, not just financial impact.

Option D is incorrect because the risk appetite explicitly prohibits high residual risk for this system, so acceptance would violate policy.

Full explanation →
293
MCQmedium

An organization allows employees to use personal smartphones to access corporate email and data. Which control is MOST important to protect corporate data if a device is lost or stolen?

A.Require device encryption
B.Require strong passwords with complexity requirements
C.Implement remote wipe capability
D.Enforce a screen lock timeout of 1 minute
AnswerC

Allows administrator to erase corporate data remotely when device is lost.

Why this answer

Remote wipe allows an organization to erase corporate data from a lost or stolen device, directly mitigating data exposure. Option A (device encryption) protects data at rest but does not help if the device is unlocked or if the attacker gains access through other means. Option B (strong passwords) can be bypassed via brute-force or social engineering, and once the device is unlocked, data is exposed.

Option D (screen lock timeout) only delays access; it does not prevent data extraction once the device is unlocked. Therefore, remote wipe is the most important control for responding to a lost or stolen device.

Full explanation →
294
MCQhard

Refer to the exhibit. A network administrator is reviewing the VPN configuration on a site-to-site VPN hub. Which of the following is the most significant security vulnerability in this configuration?

A.The encryption algorithm AES-256 is too weak
B.The pre-shared key is applied to all potential peers due to the wildcard address
C.The hash algorithm SHA is insecure
D.The pre-shared key is too short and easily guessable
AnswerB

The wildcard peer address (0.0.0.0 0.0.0.0) means the key is shared with any device, making it a shared secret across all peers. This greatly increases the risk of unauthorized access.

Why this answer

The most significant security vulnerability in this configuration is the use of a wildcard peer address (0.0.0.0 0.0.0.0) for the ISAKMP key. This allows any device to attempt authentication using the same pre-shared key, effectively turning it into a shared secret across all potential peers. An attacker who obtains the key can establish unauthorized VPN connections.

While AES-256 is a strong encryption algorithm, SHA is generally secure (though specific versions like SHA-1 are deprecated), and the key length is not the issue here. The wildcard setting is the critical flaw, making Option B correct.

Full explanation →
295
MCQhard

An organization is setting up a site-to-site VPN between two branch offices. They require encryption of the entire IP packet, including the original IP header, and plan to use IPsec. Which mode should they configure?

A.Transport mode
B.Tunnel mode
C.ESP mode
D.AH mode
AnswerB

Tunnel mode encrypts the entire original packet for site-to-site VPN.

Why this answer

IPsec tunnel mode encrypts the entire original IP packet and adds a new IP header, suitable for site-to-site VPNs.

Full explanation →
296
MCQeasy

After an incident, what is the primary purpose of a lessons learned meeting?

A.Update security policies
B.Assign blame
C.Improve future response
D.Document findings for litigation
AnswerC

The main goal is to identify strengths and weaknesses to enhance the IR process.

Why this answer

The primary purpose of a lessons learned meeting after an incident is to identify what worked well and what did not during the response, enabling the team to refine procedures, update playbooks, and improve future incident response effectiveness. This aligns with the continuous improvement cycle in incident management, as outlined in NIST SP 800-61 and ISO 27035, where the focus is on process enhancement rather than punitive measures.

Exam trap

The trap here is that candidates confuse the primary purpose of a lessons learned meeting (process improvement) with secondary outcomes like policy updates or legal documentation, leading them to select A or D instead of C.

How to eliminate wrong answers

Option A is wrong because updating security policies is a possible outcome of a lessons learned meeting, but it is not the primary purpose; the meeting focuses on response process improvement, and policy changes are a secondary action that may follow. Option B is wrong because assigning blame is counterproductive and explicitly discouraged in incident response frameworks; the goal is to foster a blame-free culture to encourage honest reporting and learning. Option D is wrong because documenting findings for litigation is a separate legal activity that may occur after an incident, but it is not the core objective of a lessons learned meeting, which is centered on operational improvement.

Full explanation →
297
MCQmedium

Which type of disaster recovery test involves running the DR systems alongside the production systems to validate functionality without impacting live operations?

A.Simulation test
B.Full interruption test
C.Tabletop exercise
D.Parallel test
AnswerD

Parallel test runs DR systems side-by-side with production, verifying functionality without risk.

Why this answer

A parallel test runs the disaster recovery systems concurrently with the production systems to verify that the DR environment can handle the workload without disrupting live operations. This approach validates data replication, application functionality, and failover readiness while keeping production untouched, making it the correct choice for non-disruptive validation.

Exam trap

The trap here is that candidates often confuse 'parallel test' with 'simulation test' because both sound non-disruptive, but a simulation test is purely theoretical while a parallel test actually runs DR systems with live data.

How to eliminate wrong answers

Option A is wrong because a simulation test involves a controlled, often tabletop-style walkthrough of disaster scenarios without actually activating DR systems or processing live data. Option B is wrong because a full interruption test (also called a full-scale test) requires shutting down production systems to fail over to the DR site, which directly impacts live operations. Option C is wrong because a tabletop exercise is a discussion-based review of roles and procedures, not a technical validation of DR system functionality.

Full explanation →
298
MCQmedium

Refer to the exhibit. The analyst sees this IDS alert. What is the most likely outcome if the target web application is vulnerable?

A.Buffer overflow and remote code execution
B.Authentication bypass or data extraction
C.Cross-site scripting (XSS) attack
D.Privilege escalation on the database server
AnswerB

The payload tries to bypass authentication by always returning true.

Why this answer

The IDS alert indicates a SQL injection attempt (e.g., '1=1' or similar pattern). If the web application is vulnerable, the attacker can manipulate SQL queries to bypass authentication (e.g., logging in without valid credentials) or extract data from the database (e.g., dumping user tables). This is the most direct outcome of a successful SQL injection.

Exam trap

ISC2 often tests the distinction between SQL injection and other web attacks (like XSS or buffer overflows), and the trap here is that candidates may confuse the outcome of SQL injection with remote code execution or privilege escalation, when the primary and most likely result is authentication bypass or data extraction.

How to eliminate wrong answers

Option A is wrong because buffer overflow and remote code execution are typically associated with memory corruption vulnerabilities (e.g., stack overflows), not SQL injection. Option C is wrong because cross-site scripting (XSS) exploits client-side script injection into web pages, not server-side SQL query manipulation. Option D is wrong because privilege escalation on the database server is a secondary effect that may follow data extraction, but the immediate and most likely outcome of a SQL injection is authentication bypass or data extraction, not direct privilege escalation.

Full explanation →
299
MCQmedium

A security metric tracking the percentage of systems with critical patches applied within 48 hours is an example of which type of metric?

A.Service level agreement (SLA)
B.Key performance indicator (KPI)
C.Control objective
D.Key risk indicator (KRI)
AnswerB

KPIs track the effectiveness of processes like patch management.

Why this answer

A key performance indicator (KPI) measures the performance of a process or activity. Patch compliance rates are common KPIs for patch management, indicating how well the organization is meeting patching objectives.

Full explanation →
300
Multi-Selecthard

An organization is deploying a network-based intrusion detection system (NIDS). The security team must decide on placement and configuration. Which THREE considerations are critical for effective NIDS deployment?

Select 3 answers
A.Using a network tap or SPAN port to monitor traffic without introducing latency
B.Placing the NIDS inline to block malicious traffic immediately
C.Configuring the NIDS to drop packets that match attack signatures
D.Placing the NIDS on the internal network behind the firewall to detect insider threats
E.Tuning signatures to reduce false positives relevant to the environment
AnswersA, D, E

Passive monitoring avoids impact on network performance.

Why this answer

Using a network tap or SPAN port ensures full visibility without introducing latency (A). Placing the NIDS on the internal network behind the firewall allows it to detect insider threats that have already passed perimeter defenses (D). Tuning signatures to match the environment reduces false positives, making alerts more actionable (E).

Full explanation →
Page 3

Page 4 of 13

Page 5

All pages

12345678910111213

Practice SSCP by domain

Target a specific domain to shore up weak areas.

Access ControlsRisk Identification, Monitoring, and AnalysisIncident Response and RecoverySecurity Operations and AdministrationCryptographyNetwork and Communications SecuritySystems and Application Security
See all domains with question counts →