Systems Security Certified Practitioner SSCP (SSCP) — Questions 301–375

Why this answer

How to eliminate wrong answers

Option B (TLS 1.2) is wrong because TLS 1.2 is a protocol version, not a component that provides PFS; it can support PFS if ECDHE or DHE cipher suites are negotiated, but the protocol itself does not guarantee PFS. Option C (AES256-GCM) is wrong because AES256-GCM is a symmetric encryption and authenticated encryption algorithm (AEAD) that protects data confidentiality and integrity, but it does not influence key exchange or provide PFS. Option D (SHA384) is wrong because SHA384 is a hash function used for message authentication in HMAC or for integrity checks in TLS, and it has no role in establishing ephemeral keys or PFS.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'need to know' is a confidentiality principle that restricts access to information based on whether the user requires that specific data to perform their duties, not the minimum permissions to execute a command; it does not address the granularity of execute-only versus read/modify. Option C is wrong because separation of duties divides critical tasks among multiple people to prevent fraud (e.g., the backup operator cannot also restore), but the question is about limiting the backup operator's own permissions, not splitting tasks. Option D is wrong because defense in depth is a layered security strategy using multiple controls (firewalls, IDS, encryption), not a principle for assigning a single user's permissions to a specific command.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Medium risk would require either Low likelihood with High impact, or Medium likelihood with Medium impact, but here the impact is High due to the application's high availability requirements. Option B is wrong because Extreme risk typically requires both High likelihood and High impact, or a combination like High likelihood with Medium impact in some matrices, but the likelihood is only Medium. Option D is wrong because Low risk would require Low likelihood and Low impact, or Low likelihood with Medium impact, but the impact is High and the likelihood is Medium.

Why this answer

How to eliminate wrong answers

Option A is wrong because Mandatory Access Control (MAC) uses system-enforced labels (e.g., security classifications like Top Secret) and is typically used in military or high-security environments, not for simple department-based access in a small business. Option B is wrong because Attribute-Based Access Control (ABAC) evaluates multiple attributes (e.g., time, location, resource type) using policy rules, which adds complexity and administrative overhead beyond what is needed for straightforward department-based access. Option C is wrong because Discretionary Access Control (DAC) allows individual users to control access to their own files (e.g., via file permissions), which does not scale well for department-wide access and can lead to inconsistent enforcement.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Why this answer

How to eliminate wrong answers

Option A is wrong because the Account Operators group can create, delete, and modify most user accounts and groups, which includes the ability to reset passwords but also grants excessive privileges beyond the required task. Option B is wrong because Domain Admins have full administrative control over the entire domain, including all user and computer objects, which is far more privilege than needed and violates least privilege. Option D is wrong because physical access to a domain controller does not inherently grant the ability to reset passwords; it could allow unauthorized actions but is not a controlled delegation method and introduces significant security risks.

Why this answer

How to eliminate wrong answers

Option A is wrong because a digital signature using RSA provides non-repudiation (the sender cannot deny signing) and is computationally heavier than necessary when non-repudiation is not required. Option B is wrong because symmetric encryption with CBC mode provides confidentiality, not authenticity or integrity; CBC mode alone does not prevent an attacker from modifying ciphertext blocks. Option D is wrong because Elliptic Curve Diffie-Hllman (ECDH) is a key exchange protocol used to establish a shared secret over an insecure channel, not a method for authenticating or verifying the integrity of an API request.

Why this answer

How to eliminate wrong answers

Why this answer

How to eliminate wrong answers

Why this answer

Why these pairings

Why this answer

How to eliminate wrong answers

Option A is wrong because Encrypted File System (EFS) protects data at rest by encrypting files on NTFS volumes, but it does not control memory execution permissions or prevent code injection into running processes. Option B is wrong because Address Space Layout Randomization (ASLR) randomizes the memory addresses of process components to make exploitation harder, but it does not enforce non-execution of memory pages; it works alongside DEP but is not a direct prevention mechanism against code execution in memory. Option C is wrong because Mandatory Access Control (MAC) enforces system-wide security policies based on labels and subjects, but it does not manage memory page execution permissions at the hardware or kernel level.

Why this answer

How to eliminate wrong answers

Option A is wrong because containment (e.g., isolating systems via VLAN segmentation or disabling network interfaces) should occur only after evidence has been preserved; premature containment can destroy volatile data like active network connections or running processes. Option C is wrong because identifying the attacker is a later analytical goal, not an initial step—focusing on attribution early can waste time and compromise evidence collection. Option D is wrong because notifying law enforcement is a strategic decision that typically occurs after the incident is confirmed and evidence is secured; premature notification may lead to legal complications or loss of control over the investigation.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because WPA2-Enterprise with RADIUS requires an authentication server and is not supported by legacy devices that only support WPA2-PSK; it would break compatibility. Option C is wrong because WPA3-SAE is not supported by legacy WPA2-only devices, so it would render the network inaccessible to them. Option D is wrong because WPA2-PSK with TKIP uses the deprecated TKIP cipher, which is vulnerable to attacks like Michael and Beck-Tews, and provides weaker security than AES-CCMP.

Why this answer

How to eliminate wrong answers

Option B is wrong because a revoked certificate would produce a different error, such as 'certificate revoked' or a CRL/OCSP failure message, not a trust-related error. Option C is wrong because an expired certificate would generate a specific 'certificate expired' error, not a root CA trust issue. Option D is wrong because weak encryption (e.g., RSA 512-bit) would cause a security policy violation or cipher mismatch error, not a root CA trust failure.

Why this answer

How to eliminate wrong answers

Option A is wrong because notifying senior management is a later step in the incident response process; the first action must be technical containment to stop the exfiltration. Option B is wrong because blocking the external IP address at the firewall does not stop the compromised system from using other IPs or protocols, and it may alert the attacker, destroying forensic evidence. Option C is wrong because analyzing data transfer logs to determine scope is part of the investigation phase, which should occur after containment to avoid further data loss while logs are being reviewed.

Why this answer

How to eliminate wrong answers

Option A is wrong because the static route to 10.3.3.0 is irrelevant to reaching 10.2.2.100; the destination is 10.2.2.0/24, not 10.3.3.0/24, so a misconfigured static route to a different subnet does not affect this connectivity. Option B is wrong because a missing gateway of last resort (default route) would only affect traffic to networks not explicitly in the routing table; here, the routing table already contains an OSPF route for 10.2.2.0/24, so a default route is unnecessary for this specific destination. Option C is wrong because the OSPF route for 10.2.2.0 is present in the routing table (as shown in the exhibit), so the issue is not that the route is missing entirely, but rather that it may be flapping due to an unstable OSPF neighbor relationship.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because 4 backup sets would be needed only if you were using incremental backups (which require all backups since the last full), but the policy uses differential backups. Option B is wrong because 3 backup sets would be needed if you had to restore from Sunday full, Tuesday differential, and Wednesday differential (if it existed), but the Wednesday backup was never completed. Option D is wrong because 1 backup set (only the full backup) would restore the database to Sunday's state, not Tuesday's state, missing the changes captured in the Tuesday differential.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the bucket policy does not allow public puts; it contains an explicit deny that overrides any potential allow. Option C is wrong because the issue is not the absence of an explicit allow but the presence of an explicit deny, which takes precedence. Option D is wrong because GetObject permission is irrelevant to PutObject; each action is evaluated independently, and the explicit deny for PutObject still applies.

Why this answer

How to eliminate wrong answers

Option A is wrong because a denial of service attack would show a flood of traffic, high packet rates, or resource exhaustion indicators, not a single successful session log. Option B is wrong because an SSH brute force would target port 22, not 3389, and would show numerous failed authentication attempts before any success, not a single established session. Option D is wrong because a port scan would show connection attempts to multiple ports (e.g., SYN packets to a range of ports) from the same source, not a single successful connection to one specific port.

Why this answer

How to eliminate wrong answers

Option A is wrong because the receiver's private key is used for decryption in asymmetric encryption, not for creating a digital signature; using it would allow anyone with the receiver's public key to forge the signature. Option C is wrong because the sender's public key is used to verify the signature, not create it; using it to sign would allow anyone to create a valid signature since the public key is widely known. Option D is wrong because the receiver's public key is used for encrypting messages to the receiver, not for signing; it cannot provide non-repudiation as the sender does not possess the corresponding private key.

Why this answer

How to eliminate wrong answers

Option B is wrong because an incident response plan is a pre-defined set of procedures for detecting, responding to, and recovering from incidents, not a post-incident summary of specific impacts. Option C is wrong because a risk register is a living document that logs identified risks, their likelihood, and mitigation status, not a retrospective report on a single incident. Option D is wrong because a business impact analysis (BIA) identifies critical business functions and their recovery priorities, not the details of a specific security event.

Why this answer

How to eliminate wrong answers

Option A is wrong because requiring a password manager does not reduce the number of passwords users must remember or change; it only stores them, and users may still forget the master password or fail to update stored passwords, leading to continued lockouts. Option B is wrong because extending the password change interval to 90 days reduces security by increasing the window of exposure for compromised credentials, and it does not address the root cause of forgotten passwords (users still have multiple passwords to remember). Option C is wrong because disabling account lockout removes a critical security control that prevents brute-force attacks, violating security policy and increasing risk of unauthorized access.

Why this answer

How to eliminate wrong answers

Option A is wrong because immediately disconnecting the server from the network destroys volatile evidence (e.g., active network connections, memory-resident malware) and may alert the attacker, hindering forensic analysis. Option B is wrong because rebooting clears memory-resident malware and volatile forensic data, such as running processes and network connections, making root cause analysis impossible. Option D is wrong because blocking outbound traffic at the firewall without first investigating the source may disrupt the attacker's C2 channel, but it also prevents the analyst from observing the attacker's actions and collecting evidence; it should be done only after evidence is preserved.

Why this answer

How to eliminate wrong answers

Option A is wrong because phishing simulations address social engineering attacks, not missing patches; they test user awareness, not system configuration. Option B is wrong because increasing network monitoring improves detection of ongoing attacks but does not prevent exploitation of unpatched vulnerabilities. Option D is wrong because updating the incident response plan improves future response efficiency but does not prevent the initial cause—the missing patch—from recurring.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because availability ensures that systems and data are accessible when needed, often through redundancy or fault tolerance, not by protecting data from eavesdropping. Option B is wrong because non-repudiation provides proof of origin or delivery of data, typically via digital signatures, and does not prevent unauthorized reading of the data. Option C is wrong because integrity ensures that data has not been altered during transit, often using hashing or MACs, but does not protect against unauthorized viewing of the data.

Why this answer

How to eliminate wrong answers

Option A is wrong because disabling the targeted user account does not stop the brute-force attack; the attacker can simply target another account or continue with different usernames, and it may disrupt legitimate user access without addressing the source. Option C is wrong because resetting all passwords and enabling MFA is a long-term remediation step, not an immediate action; it is premature without first verifying the attack and containing it, and it could cause widespread disruption. Option D is wrong because ignoring the alert assumes a false positive without verification; 100 failed logins in 2 minutes from a single source is a strong indicator of a brute-force attack and requires investigation, not dismissal.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a network-based intrusion detection system (NIDS) is a detective control that monitors traffic for suspicious patterns after the attack has begun, not a preventive control that stops initial access via compromised credentials. Option B is wrong because a non-disclosure agreement (NDA) is a legal contract that addresses confidentiality after access is granted, not a technical control that prevents unauthorized access through a compromised account. Option C is wrong because creating a separate VLAN for vendor access segments network traffic but does not prevent an attacker from using stolen credentials to authenticate into that VLAN; VLANs provide network isolation, not authentication security.

Why this answer

Why this order

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because loss of authentication refers to the inability to verify the origin or identity of the sender, which is not directly caused by IV reuse; CBC mode does not provide authentication by itself (that requires a MAC). Option C is wrong because non-repudiation is a property that prevents a party from denying an action, typically provided by digital signatures, not by CBC mode or IV usage. Option D is wrong because loss of integrity means data has been tampered with undetected; while IV reuse can enable certain attacks (e.g., bit-flipping), the primary and most immediate risk is the exposure of plaintext patterns, i.e., loss of confidentiality.

Why this answer

How to eliminate wrong answers

Why this answer

How to eliminate wrong answers

Option A is wrong because verbose logging on target servers is a detective control that records activity after the fact; it does not prevent an attacker from moving laterally from a compromised jump server. Option B is wrong because multi-factor authentication for jump server logins protects the initial access to the jump server but does not restrict lateral movement once an attacker has already compromised that server. Option D is wrong because a separate VLAN for management traffic segments network traffic but does not prevent an attacker who already controls the jump server from using its SSH agent or credentials to reach other hosts within that VLAN.

Why this answer

How to eliminate wrong answers

Option A is wrong because RADIUS server misconfiguration is irrelevant to WPA2-PSK, which uses a pre-shared key for authentication, not 802.1X/EAP; RADIUS is only used in WPA2-Enterprise mode. Option B is wrong because a rogue access point would typically present a different SSID or security configuration, and the symptoms of intermittent drops and slow speeds are more consistent with channel congestion than an unauthorized device; a rogue AP would more likely cause authentication failures or security alerts. Option D is wrong because a weak PSK passphrase does not cause intermittent connection drops or slow speeds; it would either allow connection (if correct) or prevent it (if incorrect), and performance issues are unrelated to passphrase strength.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because changing the cipher mode from CBC to GCM addresses data integrity and authentication, not the fundamental issue of key storage co-location or access control. Option B is wrong because file integrity monitoring (FIM) only detects unauthorized access or changes after the fact; it does not prevent an attacker who gains access to the server from reading the plaintext key from the configuration file. Option D is wrong because encrypting the configuration file with a second key stored in the same directory merely adds a layer of obfuscation; the second key remains co-located and accessible, so an attacker who compromises the server can retrieve both keys.

Why this answer

How to eliminate wrong answers

Option B (Rule-Based Access Control) is wrong because it uses global rules (e.g., time-of-day or IP-based conditions) applied uniformly to all users, not role-specific job functions, making it too coarse for granular patient record access. Option C (Discretionary Access Control) is wrong because it allows data owners to grant access at their discretion, violating the mandatory job-function restriction and risking unauthorized sharing of patient records. Option D (Mandatory Access Control) is wrong because it enforces system-wide labels (e.g., classification levels like 'Confidential') rather than job roles, which is overly rigid and does not map to specific healthcare job functions.

Why this answer

How to eliminate wrong answers

Option A is wrong because the exhibit shows a successful ping from the web server to the database server, indicating network connectivity is intact. Option B is wrong because a memory leak in the application pool would cause gradual performance degradation or application crashes, not an immediate HTTP 500 error with successful network connectivity. Option D is wrong because a disk failure would likely cause SQL Server to log errors or fail to start, but the exhibit does not show disk-related symptoms; the immediate cause is the SQL Server service being down, not the underlying storage.

Why this answer

How to eliminate wrong answers

Option A is wrong because the post-incident phase occurs after recovery and involves lessons learned, documentation, and forensic analysis, not active removal of malware. Option C is wrong because detection is the initial phase where the incident is identified through alerts or anomalies, not the phase for removing the threat. Option D is wrong because recovery focuses on restoring systems to normal operation (e.g., restoring from clean backups, reconnecting to networks) after the malware has already been eradicated.

Why this answer

How to eliminate wrong answers

Option B ($800,000) is wrong because it incorrectly multiplies the asset value by the ARO without applying the exposure factor (i.e., $5,000,000 × 0.5 × 0.4? No, it's $5,000,000 × 0.4 × 0.5 = $1,000,000; $800,000 suggests a miscalculation like using 0.4 × 0.5 = 0.2 then $5,000,000 × 0.2 = $1,000,000? Actually $800,000 would come from $5,000,000 × 0.4 × 0.4 or similar error). Option C ($2,000,000) is wrong because it represents the SLE only (asset value × exposure factor) and fails to multiply by the ARO of 0.5. Option D ($2,500,000) is wrong because it incorrectly multiplies the asset value by the ARO only ($5,000,000 × 0.5) and ignores the exposure factor entirely.

Why these pairings

Why this answer

How to eliminate wrong answers

Option A is wrong because account lockout policies (e.g., locking after 5 failed attempts) are designed to prevent brute-force attacks, not to prevent users from voluntarily sharing their passwords; a shared password still works until the account is locked. Option C is wrong because password complexity (e.g., requiring uppercase, numbers, symbols) only makes passwords harder to guess or crack, but does nothing to stop a user from sharing that complex password with another person. Option D is wrong because password history (e.g., remembering the last 10 passwords) prevents users from reusing old passwords, but it has no effect on sharing the current password with others.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because allowing the employee to self-select access needs violates the principle of least privilege and bypasses the job-function-based policy; it introduces risk of over-provisioning. Option B is wrong because granting full access upfront and reviewing later is a 'trust but verify' model that contradicts the security policy's requirement to grant access based on job function, and it creates a window of excessive privilege. Option D is wrong because while the supervisor may understand the role, the decision should be automated through role assignment rather than relying on a manual, subjective decision that could lead to inconsistent or excessive permissions.

Why this answer

How to eliminate wrong answers

Option A is wrong because it starts with the hard disk, which is non-volatile, and delays collection of memory and network connections, risking loss of critical transient data. Option B is wrong because it places network connections before running processes and memory, but network connections depend on process state and can change rapidly; memory should be captured first to preserve process artifacts. Option C is wrong because it lists running processes before memory, but memory contains the actual process data (e.g., code, variables) that must be captured before processes are terminated or altered.

Why this answer

How to eliminate wrong answers

Option A is wrong because the sudoers configuration directly controls which users can execute commands with elevated privileges; if it were misconfigured (e.g., allowing a user to run all commands as root without a password), it could be the mechanism that failed, but the question asks which mechanism most likely failed to prevent the escalation, and a lockout policy is unrelated to post-authentication privilege escalation. Option C is wrong because a password policy (e.g., complexity, length, history) only affects the strength of user passwords and does not prevent an authorized user from escalating privileges after successful authentication. Option D is wrong because SELinux is a mandatory access control (MAC) system that enforces security policies at the kernel level, and while it can limit privilege escalation, its failure would be due to misconfiguration or being in permissive mode, not because of a lockout policy; the lockout policy is the least relevant to the escalation event.

Why this answer

How to eliminate wrong answers

Option A is wrong because blocking outbound TCP ports 80 and 443 would prevent all HTTP/HTTPS traffic, not just external websites, and the DF flag behavior is unrelated to port blocking. Option C is wrong because DNS resolution failure would prevent name resolution for both internal and external sites, but users can browse internal web servers, indicating DNS is working. Option D is wrong because a wrong VLAN on the switch port would cause complete connectivity loss to the firewall, not selective dropping of packets with the DF flag.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because retaining logs for a longer period does not improve detection speed; it only preserves evidence for later audits, which still occur months after the incident. Option C is wrong because assigning additional staff to manually review logs is not scalable and would still be overwhelmed by the high volume of logs, leading to delayed or missed detections. Option D is wrong because increasing log verbosity would generate even more log data, exacerbating the existing problem of log overload without providing automated analysis or alerting.

Why this answer

How to eliminate wrong answers

Option A is wrong because password spraying involves trying a small set of common passwords against many usernames, not multiple failed attempts from a single IP against one account. Option C is wrong because credential stuffing uses previously breached username/password pairs from other services, which would typically show a high success rate or rapid failures, not a long sequence of failures from one IP. Option D is wrong because social engineering relies on manipulating users (e.g., phishing or pretexting) to reveal credentials, not on automated login attempts visible in logs.

Why this answer

How to eliminate wrong answers

Option A is wrong because non-repudiation ensures that a party cannot deny having performed an action, typically achieved through digital signatures or audit logs, and is not directly related to the level of access granted. Option C is wrong because availability ensures that systems and data are accessible when needed, often addressed through redundancy and fault tolerance, not by restricting write permissions. Option D is wrong because confidentiality protects data from unauthorized disclosure, which is a concern here, but the specific violation described is the granting of excessive permissions (write access) rather than the exposure of data itself; the core principle being violated is least privilege, not confidentiality.

Why this answer

How to eliminate wrong answers

Option B is wrong because adding the Marketing role before removing the Sales role creates a 30-day window where the employee has permissions from both departments, violating least privilege and increasing the risk of unauthorized access. Option C is wrong because modifying the Sales role to include Marketing permissions would grant those permissions to all Sales users, not just the transferring employee, leading to privilege creep and potential data leakage. Option D is wrong because creating a new custom role with combined permissions is unnecessary and inefficient; it complicates role management and may inadvertently grant the employee access to both departments' resources if the Sales role is not removed.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because an explicit deny on the report folder would block access regardless of role membership, but the scenario states the user cannot access team reports despite being assigned the 'Sales Manager' role, which suggests the issue is with permission inheritance, not an explicit deny. Option B is wrong because if the user account were disabled, the user would not be able to access any resources, not just team reports, and the question implies the user can access CRM and reporting. Option D is wrong because session management issues would typically cause authentication or authorization failures across all resources, not a specific permission problem with team reports, and RBAC permissions are evaluated at the time of access request, not tied to session state.