Systems Security Certified Practitioner SSCP SSCP Questions 376–450 | Page 6/13

376

MCQhard

In an OAuth 2.0 authorization flow, a client application receives an access token. This token is used to:

A.Encrypt data between client and resource server

B.Identify the user across different applications

C.Authorize access to protected resources at the resource server

D.Authenticate the user to the authorization server

AnswerC

The access token grants authorized access.

Why this answer

The access token is sent to the resource server to authorize access to protected resources on behalf of the user.

Full explanation →

377

Multi-Selecthard

A security auditor is reviewing the cryptographic algorithms used in an organization. Which THREE of the following are considered insecure or deprecated and should be avoided? (Select THREE.)

Select 3 answers

A.RSA-2048

B.DES

C.3DES

D.AES-256

E.MD5

AnswersB, C, E

DES uses a 56-bit key, making it vulnerable to brute-force attacks.

Why this answer

DES (Data Encryption Standard) uses a 56-bit key, which is too short to withstand modern brute-force attacks; it was officially withdrawn as a standard by NIST in 2005. 3DES, while an improvement, is now deprecated due to its relatively slow performance and susceptibility to meet-in-the-middle attacks, with NIST disallowing it for new applications after 2023. MD5 is a broken hash algorithm; collision attacks (e.g., using a chosen-prefix collision) can be performed in seconds on commodity hardware, making it unsuitable for any security-sensitive use.

Exam trap

ISC2 often tests the misconception that 3DES is still acceptable because it is 'triple' strength, but the trap is that both DES and 3DES are deprecated due to small block sizes and key lengths, while MD5 is often mistakenly considered safe for checksums despite its proven collision vulnerabilities.

Full explanation →

378

Multi-Selecthard

A company is migrating to a PaaS cloud environment. According to the shared responsibility model, which THREE security responsibilities remain with the customer? (Select THREE.)

Select 3 answers

A.Patch management of the underlying OS

B.User access and identity management

C.Data classification and encryption

D.Security of the application code

E.Physical security of the data center

AnswersB, C, D

Customers manage their own users and identities.

Why this answer

In PaaS, the customer manages access policies, application-level security, and data protection, while the provider manages the runtime, OS, and infrastructure.

Full explanation →

379

MCQeasy

A company wants to secure wireless communication for guests. Which protocol provides the strongest encryption for a wireless network?

A.WEP with 128-bit key

B.WPA2-PSK with TKIP

C.WPA2-PSK with AES

D.WPA3-SAE

AnswerD

WPA3-SAE offers the strongest encryption and authentication.

Why this answer

WPA3-SAE (Simultaneous Authentication of Equals) provides the strongest encryption for wireless networks, using 128-bit AES in CCMP mode for encryption and replacing the Pre-Shared Key (PSK) exchange with a more secure handshake that resists offline dictionary attacks. This makes it the most secure option among the choices, especially for guest networks where authentication security is critical.

Exam trap

The trap here is that candidates often assume WPA2-PSK with AES is the strongest because it uses AES encryption, but they overlook the vulnerability of the PSK authentication method to offline dictionary attacks, which WPA3-SAE specifically addresses with SAE.

How to eliminate wrong answers

Option A is wrong because WEP with a 128-bit key still uses the flawed RC4 stream cipher and a weak integrity check (CRC-32), making it vulnerable to key recovery attacks within minutes regardless of key length. Option B is wrong because WPA2-PSK with TKIP (Temporal Key Integrity Protocol) is a deprecated protocol that still uses RC4 and is susceptible to attacks like Beck-Tews and Michael MIC exhaustion, offering weaker encryption than AES. Option C is wrong because while WPA2-PSK with AES provides strong encryption via AES-CCMP, it relies on the 4-way handshake with a pre-shared key that is vulnerable to offline dictionary attacks if the passphrase is weak, making it less secure than WPA3-SAE.

Full explanation →

380

MCQhard

In a biometric system, the point at which the false rejection rate (FRR) equals the false acceptance rate (FAR) is known as the:

A.False acceptance rate (FAR)

B.Crossover error rate (CER)

C.Failure to enroll rate

D.False rejection rate (FRR)

AnswerB

CER is the point where FAR equals FRR.

Why this answer

The crossover error rate (CER), also called the equal error rate (EER), is where FAR and FRR are equal, indicating overall accuracy.

Full explanation →

381

Multi-Selecteasy

Which TWO of the following are examples of administrative controls? (Choose two.)

Select 2 answers

A.Firewall rules

B.Access control policies

C.Security awareness training

D.Security guards

E.Encryption of data at rest

AnswersB, C

Policies are administrative controls.

Why this answer

Access control policies (B) are administrative controls because they define the rules, procedures, and responsibilities for managing access to resources, forming the governance framework that guides technical and physical implementations. Security awareness training (C) is also an administrative control as it educates users on security policies and procedures, reducing human error and reinforcing organizational security culture.

Exam trap

The trap here is that candidates often confuse administrative controls with technical or physical controls, mistakenly selecting firewall rules or encryption because they are common security measures, but the SSCP exam specifically tests the distinction between administrative (policy/training), technical (software/hardware), and physical (guards/locks) control categories.

Full explanation →

382

Multi-Selecthard

Which THREE of the following are common use cases for public key infrastructure (PKI)? (Select exactly three.)

Select 3 answers

A.Password hashing

B.Symmetric key exchange

C.Digital signatures

D.Email encryption (S/MIME)

E.SSL/TLS certificate authentication

AnswersC, D, E

PKI enables digital signatures using certificates.

Why this answer

Digital signatures are a core use case for PKI because they rely on asymmetric cryptography where a private key signs data and the corresponding public key, bound to an identity via a digital certificate issued by a Certificate Authority (CA), verifies the signature. This ensures authenticity, integrity, and non-repudiation of the signed message or document.

Exam trap

The trap here is that candidates may confuse the mechanism (e.g., using PKI to exchange a symmetric key) with a direct use case of PKI, or mistakenly think password hashing involves certificates, when PKI is specifically about public key certificates, not symmetric key exchange or hashing algorithms.

Full explanation →

383

Multi-Selectmedium

Which TWO of the following are required properties of a cryptographically secure hash function? (Select exactly 2.)

Select 2 answers

A.Deterministic output

B.Collision resistance

C.High speed for large inputs

D.Low output entropy

E.Preimage resistance

AnswersB, E

It should be infeasible to find two different inputs with the same hash.

Why this answer

Collision resistance (B) is a required property because it ensures that it is computationally infeasible to find two distinct inputs that produce the same hash output. Without this property, an attacker could substitute a legitimate message with a fraudulent one that yields an identical hash, breaking the integrity guarantees of the hash function. This is a fundamental requirement for digital signatures and message authentication codes (MACs) in cryptographic protocols.

Exam trap

ISC2 often tests the distinction between general hash function properties (like deterministic output) and the specific security properties required for cryptographic use, leading candidates to mistakenly select deterministic output as a required property when it is merely a basic characteristic of any hash function.

Full explanation →

384

MCQeasy

Refer to the exhibit. What is the effect of this access control list on traffic entering the interface?

A.Permits only TCP traffic to 10.0.0.1 on port 22

B.Allows SSH to 10.0.0.1 and blocks all other traffic with logging

C.Blocks all traffic except SSH and logs the denied packets

D.Allows all TCP traffic to any host on port 22

E.Allows all traffic to 10.0.0.1

AnswerB

The permit allows SSH, the deny blocks all else with log.

Why this answer

The ACL shown (likely an extended IP access list with a permit statement for TCP port 22 to host 10.0.0.1 followed by a deny ip any any log statement) permits SSH traffic to 10.0.0.1 and explicitly denies all other traffic while logging the denied packets. The implicit deny at the end of every ACL would block unmatched traffic, but the explicit deny with the 'log' keyword ensures that denied packets are logged, which matches the description in B.

Exam trap

ISC2 often tests the distinction between the implicit deny (which does not log) and an explicit deny with the 'log' keyword, leading candidates to mistakenly think that all denied traffic is automatically logged.

How to eliminate wrong answers

Option A is wrong because the ACL permits only TCP traffic to 10.0.0.1 on port 22, but it does not block all other traffic with logging—the explicit deny with log is required for that behavior, and the question states the ACL includes such a deny. Option C is wrong because it says 'blocks all traffic except SSH and logs the denied packets,' which is essentially the same as B, but B is more precise in stating 'Allows SSH to 10.0.0.1 and blocks all other traffic with logging'—the key difference is that C incorrectly implies the ACL logs all denied packets without specifying that the deny is explicit, while B correctly captures the explicit deny with log. Option D is wrong because the ACL is specific to host 10.0.0.1, not 'any host,' and it only permits port 22, not all TCP traffic.

Option E is wrong because the ACL does not allow all traffic to 10.0.0.1; it only permits TCP port 22 and denies everything else.

Full explanation →

385

MCQeasy

A company is migrating its on-premises applications to a public cloud. Which security control is MOST important to implement to protect data in transit?

A.Enable server-side encryption for cloud storage.

B.Implement data classification labels.

C.Use IPsec VPNs for all cloud connections.

D.Ensure all data transmissions use TLS 1.2 or higher.

AnswerD

TLS encrypts data in transit and is widely supported.

Why this answer

TLS 1.2 or higher is the standard protocol for encrypting data in transit over public networks, ensuring confidentiality and integrity between client and server. It is the most critical control because it directly protects data as it moves across the internet to the cloud, which is the primary risk in a migration scenario.

Exam trap

The trap here is that candidates often confuse IPsec VPNs (which protect network-layer traffic) with the application-layer encryption provided by TLS, assuming VPNs are always superior for cloud connections, but TLS is the standard and most practical control for protecting data in transit to public cloud services.

How to eliminate wrong answers

Option A is wrong because server-side encryption protects data at rest in cloud storage, not data in transit. Option B is wrong because data classification labels help manage access and handling policies but do not encrypt or protect data during transmission. Option C is wrong because IPsec VPNs secure site-to-site connections but are not the most important for all cloud connections; many cloud services use HTTPS/TLS natively, and forcing all traffic through a VPN can introduce latency and complexity without providing better protection than TLS for application-layer data.

Full explanation →

386

MCQeasy

A company wants to ensure that employees use strong passwords. Which policy is most effective?

A.Prohibit password reuse for the last 10 passwords.

B.Require password changes every 30 days.

C.Require a minimum password length of 12 characters.

D.Require a mix of uppercase, lowercase, numbers, and symbols.

AnswerC

Length is the most important factor for password strength.

Why this answer

Password length is the single most important factor in resistance to brute-force and rainbow table attacks. NIST SP 800-63B and industry best practices now recommend a minimum of 12–16 characters, as each additional character exponentially increases the keyspace. While complexity adds some entropy, a long passphrase is far more effective against modern GPU-based cracking than a short, complex password.

Exam trap

The trap here is that many candidates overvalue complexity (uppercase, numbers, symbols) because of legacy policies, but the ISC2 SSCP exam tests the modern NIST guidance that password length trumps complexity and periodic changes.

How to eliminate wrong answers

Option A is wrong because prohibiting reuse of the last 10 passwords does not prevent weak passwords from being chosen; it only prevents immediate repetition, and attackers can still crack a weak password if it is not in the history. Option B is wrong because forcing changes every 30 days often leads users to create predictable patterns (e.g., Password1!, Password2!) or write passwords down, reducing overall security; NIST now advises against arbitrary periodic expiration. Option D is wrong because requiring a mix of character types without a sufficient length is ineffective—a 6-character password with all four types has only ~2^36 possibilities, which can be brute-forced in minutes, whereas a 12-character lowercase-only password has ~2^56 possibilities, making length far more impactful than complexity alone.

Full explanation →

387

MCQhard

During a security audit, it is discovered that a system administrator shared their personal credentials with a colleague to troubleshoot an issue after hours. This violates the company's policy regarding password sharing. Which control would BEST prevent this type of incident in the future?

A.Implement a two-person rule for administrative actions.

B.Enforce a stricter password complexity policy.

C.Require multifactor authentication for all systems.

D.Deploy a privileged access management (PAM) solution.

AnswerD

PAM allows temporary access without sharing credentials.

Why this answer

A Privileged Access Management (PAM) solution provides temporary, audited access without sharing permanent credentials. Option A is incorrect because a two-person rule is for dual control, not sharing prevention. Option B is incorrect because password complexity does not deter sharing.

Option C is incorrect because while MFA adds a layer, it does not prevent sharing of the first factor.

Full explanation →

388

MCQeasy

A security administrator is drafting an acceptable use policy (AUP). Which of the following should be included to address the use of personal devices for work purposes?

A.Procedures for data backup and recovery

B.Requirements for password complexity and multifactor authentication

C.Guidelines for responding to security incidents

D.A list of approved social media platforms

AnswerB

The AUP should define security requirements for personal devices, such as password complexity and MFA, to ensure they meet organizational security standards.

Why this answer

An acceptable use policy (AUP) for personal devices (BYOD) must include authentication requirements like password complexity and multifactor authentication to ensure that only authorized users can access corporate resources from potentially untrusted endpoints. This directly addresses the security risk of unauthorized access via personal devices, which is a primary concern in BYOD environments.

Exam trap

The trap here is that candidates confuse the AUP with broader security policies like incident response or data backup, but the AUP specifically governs user behavior and access controls, not operational procedures.

How to eliminate wrong answers

Option A is wrong because data backup and recovery procedures belong in a disaster recovery or data retention policy, not in an AUP focused on acceptable use of personal devices. Option C is wrong because incident response guidelines are part of an incident response plan (IRP), not an AUP, which defines user behavior rather than post-incident actions. Option D is wrong because listing approved social media platforms is a social media policy detail, not a core element of an AUP for personal device usage, which focuses on security controls like authentication and device management.

Full explanation →

389

MCQmedium

A security engineer is reviewing system logs and notices that the log file size has not changed for several days, despite high system activity. Which log management concern does this indicate?

A.Incorrect time synchronization

B.Normal log rotation

C.Insufficient storage capacity

D.Log tampering or disabled logging

AnswerD

Logs not updating during high activity may indicate intentional stopping or tampering.

Why this answer

The log file size remaining static despite high system activity strongly indicates that logging has been disabled or the log files have been tampered with (e.g., truncated or replaced with empty files). Under normal operation, a busy system generates continuous log entries, causing the log file size to increase. A complete lack of size change over several days is a classic red flag for log integrity compromise, not a benign administrative action.

Exam trap

ISC2 SSCP often tests the misconception that a static log file size is due to log rotation, but rotation actually creates a new active log file with new entries, not a file that remains unchanged for days.

How to eliminate wrong answers

Option A is wrong because incorrect time synchronization would cause timestamps to be wrong, but it would not prevent log entries from being written; the log file size would still increase. Option B is wrong because normal log rotation typically renames or compresses the current log file and starts a new one, which would result in a new file with a non-zero size, not a static file size for days. Option C is wrong because insufficient storage capacity would cause the system to stop writing logs, but the log file would still show a final size from when writes ceased; the question states the size has not changed for several days, implying no writes occurred, which is more consistent with disabled logging or tampering than a full disk (which would still show the last written size).

Full explanation →

390

MCQmedium

Based on the exhibit, which conclusion is most likely?

A.Two hosts are consistently downloading malware.

B.The downloads are false positives.

C.The threat has been contained.

D.The proxy is blocking the downloads.

AnswerA

The logs show repeated successful GET requests for an executable from a known malware domain by two IPs.

Why this answer

Two internal hosts (192.168.1.10 and .20) repeatedly download an executable from a known malware domain. The HTTP status 200 indicates successful downloads. Option B is incorrect because 'TCP_MISS' and 'DIRECT' show the proxy allowed the request.

Option C is unlikely given the repeated connections to a malware domain. Option D is incorrect because the activity is ongoing.

Full explanation →

391

MCQhard

An organization wants to ensure that servers are configured securely before deployment. They plan to use a hardened operating system image and regularly scan for deviations using SCAP. Which concept does this represent?

A.Change management

B.Asset management

C.Configuration management

D.Patch management

AnswerC

Configuration management involves establishing and maintaining baseline configurations and detecting deviations.

Why this answer

C is correct because configuration management involves establishing and maintaining consistent baseline configurations for systems, such as using a hardened OS image, and then monitoring for deviations using tools like SCAP (Security Content Automation Protocol). SCAP enables automated vulnerability scanning and compliance checking against defined security baselines, ensuring servers remain in a known secure state before and after deployment.

Exam trap

The trap here is that candidates confuse configuration management with patch management, thinking that scanning for deviations always means checking for missing patches, when in fact SCAP scans assess a wide range of configuration settings (e.g., registry keys, file permissions, service states) beyond just patch levels.

How to eliminate wrong answers

Option A is wrong because change management focuses on controlling and documenting changes to systems after deployment, not on establishing a secure baseline image or scanning for deviations from that baseline. Option B is wrong because asset management deals with tracking and inventorying hardware and software assets throughout their lifecycle, not with enforcing secure configurations or scanning for compliance. Option D is wrong because patch management specifically addresses the application of software updates to fix vulnerabilities, whereas the scenario describes using a hardened image and SCAP scanning for configuration deviations, which is broader than patching.

Full explanation →

392

MCQmedium

A network administrator wants to block all inbound traffic except for web and email services. Which firewall rule configuration would achieve this?

A.Default-deny with allow rules for HTTP, HTTPS, and SMTP

B.Stateful inspection without default policy

C.Stateless packet filtering with a rule per service

D.Default-allow with deny rules for unwanted services

AnswerA

Default-deny blocks everything; allow rules enable only required services.

Why this answer

A default-deny rule blocks all traffic by default, and then explicit allow rules for specific services (HTTP, HTTPS, SMTP) permit desired inbound traffic.

Full explanation →

393

MCQmedium

After implementing security controls, a risk assessment shows that a residual risk of data exfiltration remains. Which document should formally record this residual risk and the decision to accept it?

A.Incident response plan

B.Risk register

C.Business continuity plan

D.Security baseline

AnswerB

The risk register tracks all identified risks and their treatment.

Why this answer

The risk register is the formal document used to track identified risks, their assessed likelihood and impact, and the chosen risk response. When a residual risk remains after controls are implemented, the risk register records that residual risk level and formally documents management's decision to accept it, including the rationale and approval. This ensures auditability and accountability for the accepted risk.

Exam trap

The trap here is that candidates confuse the risk register with the incident response plan, thinking that any risk-related documentation belongs in the incident response plan, but the risk register is specifically designed for tracking and formally accepting residual risks before any incident occurs.

How to eliminate wrong answers

Option A is wrong because the incident response plan documents procedures for detecting, responding to, and recovering from security incidents, not for recording residual risks or acceptance decisions. Option C is wrong because the business continuity plan focuses on maintaining critical business functions during and after a disruption, not on tracking residual risks from data exfiltration. Option D is wrong because a security baseline defines the minimum security configuration standards for systems, not a repository for risk acceptance decisions.

Full explanation →

394

MCQeasy

In the context of risk assessment, which of the following best describes a vulnerability?

A.A potential event that can cause harm

B.The likelihood of a threat exploiting a weakness

C.An actual occurrence of a harmful event

D.A weakness in a system that can be exploited

AnswerD

Correct definition.

Why this answer

In risk assessment, a vulnerability is specifically a weakness in a system, application, or process that can be exploited by a threat. Option D correctly defines this as a weakness that can be exploited, which aligns with the NIST SP 800-30 definition of vulnerability as a flaw or weakness in system security procedures, design, implementation, or internal controls that could be exercised (accidentally triggered or intentionally exploited) and result in a security breach or a violation of the system’s security policy.

Exam trap

The trap here is that candidates confuse 'vulnerability' with 'threat' (Option A) or 'risk' (Option B), because risk assessment terminology is often used interchangeably in casual conversation, but the SSCP exam strictly defines vulnerability as a weakness, not the event or likelihood.

How to eliminate wrong answers

Option A is wrong because it describes a threat (a potential event that can cause harm), not a vulnerability. Option B is wrong because it describes risk (the likelihood of a threat exploiting a weakness), which combines threat, vulnerability, and impact. Option C is wrong because it describes an incident or actual occurrence of a harmful event, which is the realization of a threat exploiting a vulnerability, not the vulnerability itself.

Full explanation →

395

Matchingmedium

Match each network security device to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Filters traffic based on rules

Monitors and alerts on suspicious activity

Blocks malicious traffic in real-time

Manages encrypted tunnels

Why these pairings

Correct matches: Firewall filters traffic, IDS monitors and alerts, IPS monitors and blocks, VPN concentrator handles encryption. Common confusions: swapping firewall and IDS functions.

Full explanation →

396

MCQhard

A SOC analyst reviews an alert for a user who downloaded a large amount of data from a sensitive database at 3:00 AM. The user's manager confirms the user was not on call. Which type of risk indicator is this activity best described as?

A.Technical vulnerability indicator

B.User behavior risk indicator

C.Error log indicator

D.Configuration drift indicator

AnswerB

The unusual access pattern is a behavioral indicator of potential insider threat or compromise.

Why this answer

The activity describes a user downloading a large volume of sensitive data at an anomalous time (3:00 AM) without authorization, which directly maps to a User Behavior Risk Indicator (UBRI). UBRI focuses on deviations from established baselines of user actions, such as unusual access times, data volumes, or locations, to detect potential insider threats or compromised accounts. This is not a technical vulnerability, error log, or configuration issue, but a behavioral anomaly that requires investigation.

Exam trap

ISC2 often tests the distinction between technical indicators (like vulnerabilities or errors) and behavioral indicators, trapping candidates who confuse a user's anomalous action with a system-level flaw or log entry.

How to eliminate wrong answers

Option A is wrong because a technical vulnerability indicator refers to a flaw in software, hardware, or network design (e.g., an unpatched CVE in the database server) that could be exploited, not an anomalous user action. Option C is wrong because an error log indicator is derived from system or application error messages (e.g., failed login attempts, disk I/O errors), not from successful but suspicious user behavior. Option D is wrong because configuration drift indicator tracks changes to system settings or policies over time (e.g., a firewall rule being altered or a registry key modified), not a user's data access pattern.

Full explanation →

397

Multi-Selecteasy

A Linux administrator is hardening a server. Which TWO commands are used to manage file permissions? (Select TWO.)

Select 2 answers

A.usermod

B.passwd

C.groupadd

D.chmod

E.chown

AnswersD, E

Modifies file permissions.

Why this answer

chmod changes permissions (read/write/execute); chown changes ownership.

Full explanation →

398

MCQmedium

A security analyst is evaluating a biometric system. The system currently has a high number of false rejections. Which metric is most directly related to this issue?

A.False Acceptance Rate (FAR)

B.Equal Error Rate (EER)

C.Crossover Error Rate (CER)

D.False Rejection Rate (FRR)

AnswerD

FRR directly measures false rejections.

Why this answer

False Rejection Rate (FRR) measures the likelihood that an authorized user is incorrectly denied access. A high FRR indicates many false rejections.

Full explanation →

399

Multi-Selecteasy

Which THREE of the following are examples of security awareness training topics?

Select 3 answers

A.How to apply patches to servers

B.Recognizing phishing emails

C.Configuring firewall rules

D.Physical security best practices (e.g., locking screens)

E.Social engineering tactics

AnswersB, D, E

Phishing recognition is a core awareness topic.

Why this answer

Recognizing phishing emails is a core security awareness training topic that teaches users to identify social engineering attempts, such as spoofed sender addresses, suspicious links, and urgent language. This training reduces the risk of credential theft and malware installation, which are common attack vectors in organizations.

Exam trap

The trap here is that candidates confuse technical administration tasks (patching, firewall configuration) with awareness-level training, which is designed for all employees and focuses on behavioral change rather than technical skills.

Full explanation →

400

MCQhard

An organization wants to ensure that all new servers are deployed with a hardened baseline configuration. Which of the following is the most effective control to enforce this?

A.Requiring post-deployment security reviews for each server

B.Using a configuration management tool to deploy a hardened image automatically

C.Requiring administrators to manually apply CIS benchmarks after installation

D.Performing periodic vulnerability scans on all servers

AnswerB

Automated deployment ensures every server starts from a known hardened baseline.

Why this answer

Using a configuration management tool (e.g., Ansible, Puppet, Chef) to deploy a hardened image automatically ensures that every new server is built from a pre-defined, secure baseline without relying on manual steps. This enforces consistency and prevents configuration drift from the moment of deployment, which is the most effective control for ensuring compliance with hardening standards.

Exam trap

The trap here is that candidates often choose post-deployment reviews or vulnerability scans because they seem like thorough security measures, but the question specifically asks for the most effective control to *enforce* a hardened baseline, which requires a preventive, automated approach rather than a reactive or manual one.

How to eliminate wrong answers

Option A is wrong because post-deployment security reviews are reactive and do not prevent insecure configurations from being deployed; they only identify issues after the fact. Option C is wrong because requiring administrators to manually apply CIS benchmarks after installation introduces human error and inconsistency, and it does not guarantee that hardening is applied before the server is placed into production. Option D is wrong because periodic vulnerability scans detect existing weaknesses but do not enforce a hardened baseline at deployment time; they are a detective control, not a preventive one.

Full explanation →

401

MCQmedium

A network administrator wants to prevent unauthorized devices from connecting to the wired network. Which technology can be used to enforce authentication at the switch port level before granting network access?

A.MAC address filtering

B.WPA2-Enterprise

C.VLAN segmentation

D.802.1X

AnswerD

802.1X authenticates devices at the port level.

Why this answer

802.1X is a port-based access control standard used in NAC to authenticate devices before network access.

Full explanation →

402

Matchingmedium

Match each security policy type to its purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Defines proper use of resources

Requirements for password strength

Categorizes data sensitivity

Procedures for handling breaches

Why these pairings

The correct matches are: Acceptable Use Policy (acceptable use), Data Classification Policy (data categorization), Password Policy (password rules), Incident Response Policy (incident handling). Common confusions: mixing up policy scopes.

Full explanation →

403

MCQeasy

Which access control model enforces security based on classification labels assigned to subjects and objects, commonly used for confidentiality?

A.Clark-Wilson

B.Brewer-Nash

C.Bell-LaPadula

D.Biba

AnswerC

Bell-LaPadula enforces confidentiality.

Why this answer

Bell-LaPadula is a MAC model that enforces confidentiality via labels, preventing read-up and write-down.

Full explanation →

404

MCQmedium

In Role-Based Access Control (RBAC), what is the purpose of role hierarchy?

A.To inherit permissions from higher-level roles

B.To enforce separation of duties

C.To allow users to have multiple roles

D.To reduce the number of roles

AnswerA

Role hierarchy enables inheritance; higher roles get permissions of lower roles.

Why this answer

Role hierarchy allows senior roles to inherit permissions from junior roles, simplifying permission management and reflecting organizational structure.

Full explanation →

405

MCQmedium

Refer to the exhibit. A security analyst observes this event on a workstation. What is the MOST likely explanation?

A.Microsoft Office is performing an automatic update.

B.A scheduled task triggered the command.

C.A user ran a legitimate command from the Start menu.

D.A malicious macro in a Word document executed the command.

AnswerD

Macros can execute shell commands; this is a common attack vector.

Why this answer

The event shows a command prompt launching with a base64-encoded PowerShell command, which is a common technique used by malicious macros to download and execute payloads. Microsoft Office macros can invoke cmd.exe or PowerShell to bypass security controls, and the encoded command suggests obfuscation typical of malware, not legitimate software updates or user actions.

Exam trap

ISC2 often tests the distinction between legitimate system processes and obfuscated command execution, where candidates mistake encoded PowerShell commands for normal update or task operations instead of recognizing them as indicators of macro-based malware.

How to eliminate wrong answers

Option A is wrong because Microsoft Office automatic updates are managed by the Office Click-to-Run service or Windows Update, not by launching a base64-encoded PowerShell command from cmd.exe. Option B is wrong because scheduled tasks typically run with a clear task name and path in the command line, not with obfuscated PowerShell commands that hide the actual execution. Option C is wrong because a user running a legitimate command from the Start menu would not involve a base64-encoded PowerShell command; such encoding is used to conceal malicious intent, not for normal user operations.

Full explanation →

406

MCQeasy

Which of the following is a vulnerability source explicitly based on publicly known flaws?

A.Configuration weaknesses

B.Hardware failure

C.CVEs

D.Design flaws

AnswerC

CVE is a dictionary of publicly disclosed vulnerabilities.

Why this answer

C is correct because Common Vulnerabilities and Exposures (CVEs) are a standardized, publicly maintained list of known security flaws. Each CVE entry explicitly documents a specific vulnerability that has been discovered, verified, and published, making it a direct source of publicly known flaws used for vulnerability identification and remediation.

Exam trap

The trap here is that candidates may confuse 'vulnerability source' with 'vulnerability cause'—configuration weaknesses and design flaws are causes of vulnerabilities, but only CVEs represent a formal, publicly known source of flaw documentation.

How to eliminate wrong answers

Option A is wrong because configuration weaknesses are typically the result of improper system setup or misapplied security controls, not a source of publicly known flaws; they are often organization-specific and not cataloged in a public database. Option B is wrong because hardware failure is a physical reliability issue, not a security vulnerability, and is not tracked as a publicly known flaw in vulnerability databases like CVE. Option D is wrong because design flaws are inherent architectural weaknesses that may not be publicly documented or assigned a CVE identifier; they are often discovered during security reviews or penetration testing rather than being listed as known flaws.

Full explanation →

407

MCQhard

A company is implementing a new patch management process. After scanning for missing patches, the team must prioritize which patches to apply first. Which combination of factors is most critical for prioritization?

A.CVSS score and asset criticality

B.Number of systems affected and patch size

C.Age of the patch and vendor reputation

D.Cost of the patch and availability of workarounds

AnswerA

CVSS score indicates vulnerability severity, and asset criticality determines business impact. Together, they provide a risk-based priority.

Why this answer

Patch prioritization should consider both the severity of the vulnerability (CVSS score) and the criticality of the asset being patched. A high CVSS score on a critical asset poses the greatest risk.

Full explanation →

408

MCQmedium

An organization implements a policy requiring passwords to be at least 12 characters, include uppercase, lowercase, digits, and special characters, and be changed every 60 days. Which password policy elements are being enforced?

A.Complexity, expiry, and lockout

B.Length, complexity, and history

C.Length, complexity, and expiry

D.Length, complexity, and lockout

AnswerC

These three are explicitly stated.

Why this answer

The policy specifies length, complexity (character types), and expiry (change interval). History and lockout are not mentioned.

Full explanation →

409

MCQhard

A security analyst reviews the syslog message from a router. What does this log entry indicate?

A.The router's ACL is misconfigured and is blocking all traffic.

B.An external host attempted to access an internal web server and was blocked.

C.An internal host attempted to access an external web server and was blocked.

D.An internal host successfully accessed an external web server.

AnswerC

The ACL denied the TCP connection to port 80.

Why this answer

The log entry shows a packet from source IP 10.0.0.2 (internal) to destination IP 203.0.113.5 (external) on port 80 (HTTP) being denied by the router's access control list (ACL). The 'DENY' action indicates the traffic was blocked, not allowed. Since the source is internal and the destination is external, this matches an outbound connection attempt being blocked.

Exam trap

ISC2 often tests the ability to distinguish source vs. destination IPs in ACL logs, and the trap here is that candidates may misidentify the internal IP (10.0.0.2) as external due to not recognizing RFC 1918 private addresses, leading them to choose option B.

How to eliminate wrong answers

Option A is wrong because the log shows only specific traffic being denied (source 10.0.0.2 to 203.0.113.5:80), not all traffic; a misconfigured ACL blocking all traffic would show multiple denials for various protocols and ports. Option B is wrong because the source IP (10.0.0.2) is internal (RFC 1918 private address), not external; an external host would have a public IP. Option D is wrong because the log explicitly states 'DENY', meaning the packet was blocked, not successfully accessed.

Full explanation →

410

MCQmedium

A company is deploying a VPN for remote employees. They require strong encryption and authentication, and the solution must be compatible with native OS clients without additional software. Which VPN protocol is most appropriate?

A.PPTP

B.SSL VPN with proprietary client

C.IPsec with IKEv2

D.L2TP/IPsec with pre-shared keys

AnswerC

IKEv2/IPsec is natively supported on Windows, macOS, iOS, and Android.

Why this answer

IKEv2 with IPsec is widely supported natively on major operating systems, provides strong security, and is suitable for remote access VPNs.

Full explanation →

411

MCQeasy

A security administrator is configuring a firewall to allow HTTPS traffic from the internet to a web server. Which default port must be permitted?

A.8443

B.8080

C.443

D.80

AnswerC

HTTPS utilizes port 443 as its default port for secure communications.

Why this answer

HTTPS uses port 443 by default. Port 80 is HTTP, 8080 is common HTTP alternative, and 8443 is HTTPS alternative but not default.

Full explanation →

412

MCQmedium

A network administrator needs to ensure that internal users can access only approved external websites. Which technology should be implemented?

A.Web Proxy with content filtering

B.Intrusion Prevention System (IPS)

C.Virtual Private Network (VPN)

D.Network Address Translation (NAT)

AnswerA

A proxy can enforce URL whitelists/blacklists.

Why this answer

A web proxy with content filtering intercepts HTTP/HTTPS requests from internal users and applies policy rules (e.g., URL whitelists, category blocking) to allow only approved external websites. This technology operates at the application layer, inspecting the full URL and content, making it the correct choice for granular access control.

Exam trap

ISC2 often tests the misconception that an IPS or firewall can perform URL filtering, but these devices typically filter based on IP/port/application signatures, not full URL paths or content categories, which is the specific function of a web proxy with content filtering.

How to eliminate wrong answers

Option B (Intrusion Prevention System) is wrong because an IPS monitors network traffic for malicious activity and blocks attacks, not for enforcing website access policies based on URL or content categories. Option C (Virtual Private Network) is wrong because a VPN creates an encrypted tunnel for secure remote access but does not filter or restrict which external websites users can visit. Option D (Network Address Translation) is wrong because NAT translates private IP addresses to a public IP for internet connectivity and has no capability to filter or approve specific websites.

Full explanation →

413

Drag & Dropmedium

Drag and drop the steps for implementing a patch management process into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct order for patch management is Inventory, Assess, Test, Deploy, Verify. This sequence ensures that all systems are identified, patches are evaluated, tested to avoid disruptions, deployed safely, and finally confirmed as applied correctly.

Full explanation →

414

MCQeasy

A help desk technician receives multiple reports that users cannot access a critical web application. The application's error log shows repeated '403 Forbidden' errors. Which of the following is the most likely cause?

A.The web application firewall is blocking legitimate traffic.

B.The SSL certificate has expired.

C.The application's database connection pool is exhausted.

D.The web server's IP address has changed.

AnswerA

WAFs often return 403 Forbidden when security rules trigger on legitimate traffic.

Why this answer

A 403 Forbidden error indicates that the server understood the request but is refusing to authorize it. The most likely cause is the web application firewall (WAF) blocking legitimate traffic due to false positives or overly strict rules. Option B (expired SSL certificate) would cause SSL handshake errors, not 403.

Option C (database connection pool exhausted) would result in 500-type errors. Option D (IP address change) would cause connection timeouts or DNS errors, not 403.

Full explanation →

415

Multi-Selectmedium

Which two components are integral to a Kerberos authentication system? (Select TWO)

Select 2 answers

A.Authentication Server (AS)

B.Key Distribution Center (KDC)

C.Ticket Granting Ticket (TGT)

D.Certificate Authority (CA)

E.Security Assertion Markup Language (SAML)

AnswersB, C

The KDC is the central component that authenticates users and issues tickets.

Why this answer

The Key Distribution Center (KDC) is the core component of a Kerberos authentication system, responsible for issuing tickets and managing session keys. The Ticket Granting Ticket (TGT) is a temporary credential obtained from the Authentication Server (AS) within the KDC, used to request service tickets without re-entering credentials. Both are integral to the Kerberos protocol (RFC 4120) for secure, ticket-based authentication.

Exam trap

The trap here is that candidates often select 'Authentication Server (AS)' as a separate component, not realizing it is a subcomponent of the KDC, and thus fail to recognize that the KDC and TGT are the two integral components tested.

Full explanation →

416

MCQhard

An organization implements an attribute-based access control (ABAC) system with the following policy: if user.role == 'doctor' and resource.type == 'patient_record' and environment.time between 08:00-18:00 then permit. A doctor tries to access a patient record at 20:00. What is the result?

A.Permit

B.Indeterminate

C.Not applicable

D.Deny

AnswerD

Since the time condition is not satisfied, the policy does not grant access, and the default deny rule applies.

Why this answer

The ABAC policy requires the environment.time to be between 08:00 and 18:00 for access to be permitted. Since the doctor attempts access at 20:00, which falls outside this time window, the condition is not met, and the policy evaluates to 'deny' by default in a closed-system ABAC model. The correct result is Deny (option D).

Exam trap

ISC2 often tests the default deny principle in ABAC, where candidates mistakenly assume a missing explicit 'deny' rule means 'permit' or 'not applicable', but the absence of a matching permit condition results in an implicit deny.

How to eliminate wrong answers

Option A is wrong because 'permit' would only occur if all conditions in the policy are satisfied, but the time condition (08:00-18:00) is false at 20:00. Option B is wrong because 'indeterminate' typically arises from missing attributes or policy evaluation errors, not from a clear false condition; here, all attributes are present and the time is explicitly outside the allowed range. Option C is wrong because 'not applicable' would mean the policy does not match the request at all, but the user role and resource type do match; the policy applies, but the time condition fails, leading to a deny.

Full explanation →

417

MCQhard

What is the analyst's BEST next step?

A.Isolate the system

B.Block PowerShell execution

C.Decode the command to analyze

D.Run a full antivirus scan

AnswerC

Decoding allows the analyst to determine if the command is malicious.

Why this answer

Decoding the encoded PowerShell command will reveal the payload. Option A is premature without understanding the threat. Option B is less helpful.

Option D may break legitimate functionality.

Full explanation →

418

Multi-Selecthard

Which THREE of the following are common techniques for identifying risks?

Select 3 answers

A.Stakeholder interviews

B.Penetration testing

C.SWOT analysis

D.Quantitative risk analysis

E.Brainstorming sessions

AnswersA, C, E

Interviews with knowledgeable individuals are a key identification technique.

Why this answer

Stakeholder interviews are a common technique for identifying risks because they leverage the knowledge and experience of individuals who have a direct interest in or are affected by the project or system. By engaging stakeholders, you can uncover risks that may not be apparent from documentation or technical analysis, as they provide insights into operational, regulatory, and business-specific threats. This aligns with the risk identification process in the SSCP domain, which emphasizes gathering input from diverse sources to build a comprehensive risk profile.

Exam trap

ISC2 often tests the distinction between risk identification techniques and risk analysis or validation techniques, so the trap here is confusing a method like penetration testing (which validates controls) or quantitative analysis (which evaluates risk) with the initial discovery process of risk identification.

Full explanation →

419

MCQhard

A Linux server administrator configures SSH key-based authentication for user 'admin'. The authentication fails with the error 'Authentication refused: bad permissions' in the logs. What is the most likely cause?

A.The SSH service is not running

B.The private key file has permissions set to 644 (world-readable)

C.The public key is not in the ~/.ssh/authorized_keys file

D.The passphrase on the private key is incorrect

AnswerB

SSH daemon checks private key permissions; if too permissive, it refuses authentication for security.

Why this answer

SSH key-based authentication requires the private key file to have restrictive permissions (typically 600 or 640) to prevent unauthorized access. When the private key is world-readable (e.g., 644), the SSH daemon refuses to use it for security reasons, logging 'Authentication refused: bad permissions'. This is a direct check performed by OpenSSH to protect against key disclosure.

Exam trap

ISC2 often tests the distinction between file permission errors and other authentication failures, trapping candidates who confuse 'bad permissions' with missing keys or incorrect passphrases.

How to eliminate wrong answers

Option A is wrong because if the SSH service were not running, the error would be a connection timeout or 'Connection refused', not an authentication-specific permission error. Option C is wrong because a missing public key in authorized_keys would result in 'Permission denied (publickey)' or 'No supported authentication methods available', not a 'bad permissions' error. Option D is wrong because an incorrect passphrase would prompt for the passphrase again or fail with 'Permission denied', but the error 'bad permissions' specifically refers to file permission checks, not passphrase validation.

Full explanation →

420

Multi-Selecthard

Which THREE of the following are key elements of a security incident response plan?

Select 3 answers

A.Vendor management process

B.Preparation and training

C.Restoring all systems from backup

D.Containment, eradication, and recovery

E.Detection and analysis

AnswersB, D, E

Preparation is the first phase of the incident response process.

Why this answer

Preparation and training (Option B) is a key element because an incident response plan must include establishing and rehearsing procedures, roles, and tools before an incident occurs. Without trained personnel and tested playbooks, the response will be chaotic and ineffective, regardless of other plan components.

Exam trap

ISC2 often tests the misconception that 'restoring all systems from backup' is a standalone key element, when in fact it is a sub-step of the recovery phase and must be preceded by containment and eradication to avoid reinfection.

Full explanation →

421

MCQeasy

Which of the following is a primary function of a firewall?

A.Filter traffic based on rules

B.Assign IP addresses

C.Encrypt network traffic

D.Detect malware on endpoints

AnswerA

Firewalls enforce security policies by filtering packets.

Why this answer

A firewall's primary function is to filter network traffic based on a defined set of security rules, such as source/destination IP addresses, ports, and protocols. It operates at the network layer (or higher) to permit or deny packets, acting as a barrier between trusted and untrusted networks. This rule-based filtering is the core mechanism that enforces access control policies.

Exam trap

The trap here is that candidates often confuse a firewall's primary function with ancillary features like VPN termination or intrusion detection, but the SSCP exam emphasizes that filtering traffic based on rules is the fundamental and defining role of a firewall.

How to eliminate wrong answers

Option B is wrong because assigning IP addresses is the function of a DHCP server, not a firewall; firewalls may integrate DHCP services but that is not their primary role. Option C is wrong because encrypting network traffic is performed by VPN gateways, IPsec, or TLS, not by a standard firewall; firewalls can inspect encrypted traffic but do not perform the encryption themselves. Option D is wrong because detecting malware on endpoints is the function of endpoint protection platforms (EPP) or antivirus software; firewalls may include intrusion prevention systems (IPS) to detect network-based threats, but endpoint malware detection is outside their scope.

Full explanation →

422

MCQeasy

A small financial services company has deployed a SIEM solution collecting logs from their firewall, web server, and domain controller. They also have an IDS monitoring the network perimeter. The security analyst receives an alert from the IDS indicating a potential exploit attempt against the web server from an external IP. The analyst checks the SIEM and sees that the firewall log shows the connection was allowed, but the web server log does not show any corresponding request. The domain controller logs show no abnormal activity. The company has a policy to immediately contain any confirmed threats. What should the analyst do first based on this information?

A.Reboot the web server to clear any potential memory-resident malware

B.Block the external IP at the firewall

C.Verify the web server's integrity by checking for filesystem changes or anomalous processes

D.Escalate the alert to the incident response team

AnswerC

The missing log entry could be an anomaly; checking the server ensures no compromise occurred.

Why this answer

The IDS alert indicates a possible exploit, but the missing web server log suggests the request may have been blocked or the IDS generated a false positive. However, the firewall allowed the connection, so it is possible the traffic reached the web server but the log entry is missing or delayed. The safest first step is to verify the web server's integrity by checking for signs of compromise (Option C).

Immediately blocking the external IP (Option B) might disrupt legitimate traffic if the alert is false. Rebooting (Option A) could destroy forensic evidence. Escalating (Option D) without verification wastes time.

Full explanation →

423

MCQhard

During a change management process, the Change Advisory Board (CAB) approves a high-risk change. What is the NEXT step according to standard change management?

A.Implement the change immediately

B.Document the rollback plan

C.Perform a post-implementation review

D.Test the change in a staging environment

AnswerD

Correct. Testing is crucial before production deployment.

Why this answer

After CAB approval, the next step is to test the change in a staging environment to validate its functionality and identify potential issues before production deployment. This aligns with standard change management processes (e.g., ITIL) where testing follows approval to ensure the change does not disrupt operations. Immediate implementation without testing would bypass risk mitigation, making D the correct answer.

Exam trap

The trap here is confusing the order of steps: candidates often think approval directly leads to implementation, but standard change management mandates testing in a controlled environment first to prevent production incidents.

How to eliminate wrong answers

Option A is wrong because implementing immediately after approval skips mandatory testing, which is required to verify the change's impact and rollback procedures. Option B is wrong because documenting the rollback plan should occur during the planning phase, not after approval; the next step is testing, not documentation. Option C is wrong because a post-implementation review occurs after the change is deployed and tested in production, not immediately after approval.

Full explanation →

424

MCQeasy

Which backup strategy is MOST suitable for a server with an RTO of 4 hours and an RPO of 15 minutes?

A.Full backup daily, transaction log backup every 15 minutes

B.Full backup daily

C.Full backup monthly, incremental daily

D.Full backup weekly, differential daily

AnswerA

Transaction log backups every 15 minutes meet RPO; full daily allows recovery within RTO.

Why this answer

A full backup daily combined with transaction log backups every 15 minutes meets the RPO of 15 minutes by allowing point-in-time recovery to within that window, and the full backup ensures the RTO of 4 hours is achievable because restoring the full backup plus the transaction logs is a well-understood process that can complete within the time limit. Transaction log backups capture every committed change, enabling granular recovery without requiring a full backup more frequently.

Exam trap

ISC2 often tests the distinction between RPO and RTO by making candidates think that more frequent full backups are needed for a low RPO, when in fact transaction log or differential backups can achieve the same with less overhead, and the trap here is assuming that incremental or differential backups alone can meet a 15-minute RPO without log backups.

How to eliminate wrong answers

Option B is wrong because a daily full backup alone cannot achieve an RPO of 15 minutes; any data loss would be up to 24 hours. Option C is wrong because monthly full backups with incremental daily backups would require restoring the full backup plus all incrementals, which is slow and cannot guarantee an RTO of 4 hours, and the RPO would be up to 24 hours (not 15 minutes). Option D is wrong because a weekly full backup with differential daily backups still results in an RPO of up to 24 hours (since differentials do not provide point-in-time recovery within 15 minutes), and restoring a full backup plus a differential can be time-consuming, risking the 4-hour RTO.

Full explanation →

425

MCQmedium

A security administrator is configuring password policies to meet compliance. Which combination of settings provides the strongest protection against brute-force attacks?

A.Minimum 10 characters, no complexity, lockout after 3 attempts, history of 1

B.Minimum 6 characters, complexity required, lockout after 10 attempts, history of 5

C.Minimum 8 characters, no complexity, no lockout, password history of 3

D.Minimum 12 characters, complexity required, lockout after 5 attempts, history of 10

AnswerD

Correct. Longer length, complexity, lockout, and history provide strong protection.

Why this answer

Longer passwords with complexity and account lockout significantly increase the time required for brute-force attacks, while history prevents reuse. Short expiry (e.g., 30 days) also helps, but length and lockout are most effective.

Full explanation →

426

MCQmedium

A security administrator needs to ensure that all servers are configured with a hardened baseline. Which tool is best suited to detect deviations from the baseline configuration?

A.Vulnerability scanner

B.Asset management database

C.SCAP scanner

D.SIEM

AnswerC

Designed to check compliance with security baselines.

Why this answer

SCAP (Security Content Automation Protocol) scanners are specifically designed to automate the verification of system configurations against a defined baseline, such as a hardened image or a security policy. They use standardized checklists (e.g., XCCDF, OVAL) to detect deviations, making them the ideal tool for this task. Unlike vulnerability scanners, SCAP scanners focus on configuration compliance rather than known vulnerabilities.

Exam trap

The trap here is that candidates confuse a vulnerability scanner (which finds weaknesses) with a configuration compliance scanner (which checks for policy drift), but the question specifically asks for detecting deviations from a baseline, not vulnerabilities.

How to eliminate wrong answers

Option A is wrong because a vulnerability scanner (e.g., Nessus, Qualys) primarily identifies known software vulnerabilities (CVEs) and missing patches, not configuration drift from a hardened baseline. Option B is wrong because an asset management database (e.g., CMDB) stores inventory and configuration items but does not actively scan or detect real-time deviations from a baseline. Option D is wrong because a SIEM (Security Information and Event Management) aggregates and correlates logs for incident detection, but it does not perform proactive configuration compliance checks against a baseline.

Full explanation →

427

MCQhard

During a security incident, the IR team collects memory dumps from an infected workstation. The analysis reveals a process injecting code into 'svchost.exe'. Which technique is most likely being used?

A.Process hollowing

B.Reflective DLL injection

C.Token stealing

D.DLL injection

AnswerD

DLL injection loads a malicious DLL into a target process.

Why this answer

DLL injection is the most likely technique because it involves a process loading a malicious DLL into the address space of a legitimate process like svchost.exe. This is typically achieved using Windows API calls such as CreateRemoteThread and LoadLibrary, allowing the attacker to execute code within the trusted svchost.exe context, evading detection by blending in with legitimate system processes.

Exam trap

The trap here is that candidates often confuse DLL injection with process hollowing, but process hollowing replaces the process's code entirely, whereas the question describes injecting code into an already running svchost.exe, which aligns with DLL injection.

How to eliminate wrong answers

Option A is wrong because process hollowing replaces the legitimate code of a process (e.g., svchost.exe) with malicious code in its own memory space, but the question specifies code injection into an existing svchost.exe, not replacement of its code. Option B is wrong because reflective DLL injection loads a DLL from memory without using the standard Windows loader (LoadLibrary), but the question does not indicate a need to avoid the loader or bypass detection mechanisms like API monitoring; standard DLL injection is more common for this scenario. Option C is wrong because token stealing is a privilege escalation technique that involves duplicating or impersonating a security token (e.g., using DuplicateTokenEx) to gain higher privileges, not a method for injecting code into a process.

Full explanation →

428

MCQmedium

An analyst detects suspicious outbound traffic from a workstation to a known command-and-control IP. Which IoC blocking method is MOST appropriate as an immediate containment measure?

A.Delete the malicious files from the system

B.Remove the malware from the workstation using EDR

C.Block the IP address at the perimeter firewall

D.Disable the user's account

AnswerC

Correct. This disrupts the malicious communication channel.

Why this answer

Blocking the IP address at the perimeter firewall is the most appropriate immediate containment measure because it directly cuts the outbound communication channel to the known command-and-control (C2) server. This stops data exfiltration and prevents the attacker from issuing further commands, buying time for deeper analysis. Firewall ACLs or blackhole routes can be applied in seconds without altering the endpoint, which is critical when the malware may have persistence mechanisms or anti-forensic capabilities.

Exam trap

The trap is that candidates may focus on endpoint remediation (e.g., deleting files or removing malware) rather than immediate containment through network-level blocking, which is the priority in incident response.

How to eliminate wrong answers

Option A is wrong because deleting malicious files from the system does not stop active C2 traffic; the malware may be running in memory or have already established a persistent connection, and file deletion alone does not terminate existing network sessions. Option B is wrong because removing malware using EDR is a remediation step, not an immediate containment measure; EDR removal can take time, may trigger malware defenses, and does not instantly block the outbound C2 traffic already in progress. Option D is wrong because disabling the user's account does not affect the malware's network communication; the malware runs as a process independent of user authentication and can continue sending data over the network even with the account disabled.

Full explanation →

429

Multi-Selectmedium

Which TWO of the following are effective measures to prevent cross-site scripting (XSS) vulnerabilities in a web application?

Select 2 answers

A.Implement a Content Security Policy (CSP).

B.Use a web application firewall (WAF) to block known XSS payloads.

C.Replace GET requests with POST for all form submissions.

D.Encode all user input before displaying it in HTTP responses.

E.Use HTTPS for all communications.

AnswersA, D

CSP restricts sources of executable scripts, mitigating XSS even if injection occurs.

Why this answer

The correct answers are A and D. Implementing a Content Security Policy (CSP) is an effective browser-side defense that restricts the execution of unauthorized scripts, thereby mitigating XSS attacks. Encoding all user input before displaying it in HTTP responses (output encoding) neutralizes any embedded malicious scripts, preventing them from executing in the user's browser.

Option B (WAF) can help detect and block some known XSS payloads but is not a primary prevention measure and can be bypassed. Option C (replacing GET with POST) does not prevent XSS because XSS can occur regardless of the HTTP method used; the vulnerability lies in how input is handled on the server side. Option E (HTTPS) only encrypts data in transit and does not protect against XSS, which is a client-side injection attack.

Full explanation →

430

Multi-Selecthard

Which THREE of the following are common indicators of a cross-site scripting (XSS) attack? (Choose three.)

Select 3 answers

A.Unusual cookie values or multiple cookies

B.JavaScript execution in the browser's developer console that was not initiated by the user

C.Presence of script tags in the page source that are not part of the original application

D.Unexpected pop-up windows in the browser

E.Unusual network traffic to external IP addresses

AnswersB, C, D

XSS payloads often execute script automatically.

Why this answer

XSS attacks often inject malicious JavaScript that executes in the victim's browser without user initiation. Observing unexpected script execution in the developer console indicates that an attacker's payload has run, which is a direct sign of a successful XSS exploit.

Exam trap

ISC2 often tests the distinction between direct indicators of an attack (like unexpected script execution or script tags) and secondary consequences (like unusual network traffic or cookie anomalies), causing candidates to select options that are results of an attack rather than the attack itself.

Full explanation →

431

MCQeasy

Which of the following backup methods copies all data that has changed since the last full backup, regardless of any intermediate backups?

A.Differential backup

B.Full backup

C.Incremental backup

D.Snapshot backup

AnswerA

A differential backup copies all changes since the last full backup.

Why this answer

A differential backup copies all data that has changed since the last full backup, regardless of any intermediate backups. This means each differential backup grows in size as it accumulates all changes made since the last full backup, making it distinct from incremental backups which only capture changes since the last backup of any type.

Exam trap

The trap here is that candidates often confuse differential and incremental backups, mistakenly thinking differential only captures changes since the last backup of any type, when it actually captures all changes since the last full backup.

How to eliminate wrong answers

Option B is wrong because a full backup copies all data, not just changed data since the last full backup. Option C is wrong because an incremental backup copies only data that has changed since the last backup (whether full or incremental), not since the last full backup. Option D is wrong because a snapshot backup captures the state of a system at a point in time, often using copy-on-write technology, and is not a traditional backup method that tracks changes since a full backup.

Full explanation →

432

MCQeasy

Refer to the exhibit. What does this event indicate?

A.A successful logon for the Administrator account.

B.An interactive logon failure for the Administrator account.

C.The Administrator account is locked out.

D.A failed logon attempt for the Administrator account from the network.

AnswerD

The event shows a failed logon for Administrator via network (logon type 3).

Why this answer

The event shows a logon failure with a status code indicating the account is disabled or locked, but the exhibit specifically references a network logon (logon type 3) for the Administrator account. Option D is correct because the failure is from the network, not interactive or locked out, and the event ID 4625 with logon type 3 indicates a failed network logon attempt.

Exam trap

The trap here is that candidates confuse a failed logon with an account lockout, or misinterpret logon type 3 as interactive, because they focus on the 'Administrator' account name rather than the logon type and status code details.

How to eliminate wrong answers

Option A is wrong because the event is a failure (event ID 4625), not a success (event ID 4624). Option B is wrong because logon type 3 indicates a network logon, not an interactive logon (logon type 2 or 10). Option C is wrong because a locked-out account would show a specific status code like 0xC0000234, not the generic failure code in the exhibit; the event does not indicate lockout.

Full explanation →

433

MCQhard

An organization wants to implement a centralized authentication system that supports single sign-on and uses tickets. Which technology should they choose?

A.LDAP

B.Kerberos

C.SAML

D.RADIUS

AnswerB

Kerberos uses a ticket-granting system for SSO.

Why this answer

Kerberos is the correct choice because it is a ticket-based authentication protocol that provides single sign-on (SSO) capabilities. It uses a trusted third-party Key Distribution Center (KDC) to issue time-limited tickets, allowing users to authenticate once and access multiple services without re-entering credentials.

Exam trap

The trap here is that candidates often confuse LDAP (a directory protocol) with authentication, or assume SAML's SSO capability uses tickets, when in fact Kerberos is the only option that explicitly uses tickets as its core mechanism.

How to eliminate wrong answers

Option A (LDAP) is wrong because LDAP is a directory access protocol used for querying and modifying directory services, not a ticket-based authentication system; it does not inherently support SSO via tickets. Option C (SAML) is wrong because SAML is an XML-based federated identity standard that uses assertions (not tickets) for SSO across domains, but it relies on browser redirects and does not use a ticket-granting ticket model like Kerberos. Option D (RADIUS) is wrong because RADIUS is a network access protocol for AAA (Authentication, Authorization, Accounting) typically used for dial-up or VPN connections, and it does not provide ticket-based SSO; it uses shared secrets and is not designed for centralized ticket management.

Full explanation →

434

MCQmedium

A security administrator is configuring a new system and wants to enforce a mandatory access control model to ensure confidentiality of classified data. Which access control model should the administrator implement?

A.Discretionary Access Control (DAC)

B.Biba

C.Role-Based Access Control (RBAC)

D.Bell-LaPadula

AnswerD

Bell-LaPadula enforces confidentiality through mandatory labels and the simple security property and *-property.

Why this answer

Bell-LaPadula is a mandatory access control model that focuses on confidentiality by preventing read-up and write-down.

Full explanation →

435

MCQeasy

What is the default port for Microsoft SQL Server?

A.443

B.3389

C.1433

D.3306

AnswerC

Port 1433 is the default listener for MSSQL.

Why this answer

MSSQL defaults to TCP port 1433. MySQL uses 3306.

Full explanation →

436

MCQhard

During a malware containment operation, the incident response team decides to isolate an infected endpoint using network access controls. However, the malware is spreading via removable media. Which additional containment measure should the team implement?

A.Block the malware's command-and-control IP at the firewall

B.Disable the user's account and force a password reset

C.Reimage the infected system immediately

D.Group policy to disable USB ports or restrict autorun

AnswerD

Disabling USB ports or autorun prevents the malware from spreading via removable media.

Why this answer

The malware is spreading via removable media, so disabling USB ports or restricting autorun via Group Policy directly cuts off the propagation vector. Network access controls (NAC) isolate the endpoint from the network, but they do not prevent the malware from copying itself to USB drives or executing via autorun.inf. Group Policy can disable the storage device class (e.g., via 'Removable Storage Access' policies) or disable autorun entirely (via 'Turn off Autoplay' policy), stopping the spread at the physical media level.

Exam trap

The exam often tests the distinction between containment and remediation, and the trap here is that candidates confuse blocking C2 traffic (Option A) with stopping local propagation, failing to recognize that removable media spread is independent of network connectivity.

How to eliminate wrong answers

Option A is wrong because blocking the C2 IP at the firewall only disrupts command-and-control communication, not the local spread via removable media; the malware can still propagate via USB drives without needing network connectivity. Option B is wrong because disabling the user's account and forcing a password reset addresses credential compromise or unauthorized access, but does not stop the malware from copying itself to removable media or autorunning on other systems. Option C is wrong because reimaging the infected system immediately is a remediation step, not a containment step; containment must first stop the spread, and reimaging should only occur after containment is achieved to avoid reinfection or data loss.

Full explanation →

437

MCQhard

A security analyst is reviewing logs and sees an alert for a known malware signature on an endpoint. Upon investigation, the file is identified as a false positive. What should the analyst do next?

A.Create an exception in the detection rule.

B.Quarantine the endpoint anyway.

C.Escalate to management.

D.Delete the alert from the SIEM.

AnswerA

An exception reduces noise and improves detection fidelity for actual threats.

Why this answer

Creating an exception in the detection rule is the correct next step because the file has been confirmed as a false positive. This action prevents the security tool from generating future alerts for the same benign file, reducing noise and allowing the analyst to focus on genuine threats. It is a standard whitelisting practice in endpoint detection and response (EDR) or antivirus systems to maintain operational efficiency without compromising security.

Exam trap

The trap here is that candidates may confuse 'false positive' with 'true positive' and choose to quarantine or escalate, failing to recognize that the correct response is to tune the detection rule to eliminate noise.

How to eliminate wrong answers

Option B is wrong because quarantining a known false positive would disrupt legitimate operations and waste resources, as the file is not malicious. Option C is wrong because escalating a confirmed false positive to management is unnecessary and bypasses the analyst's responsibility to handle routine tuning of detection rules. Option D is wrong because deleting the alert from the SIEM removes forensic evidence and audit trails; instead, the alert should be closed with a reason or suppressed via an exception rule.

Full explanation →

438

MCQmedium

A security analyst is reviewing Linux server logs after a suspected breach. Which auditing tool should be used to examine detailed records of system calls and file access events?

A.SELinux

B.PAM

C.auditd

D.iptables

AnswerC

auditd logs security-relevant events like system calls and file accesses.

Why this answer

auditd is the Linux audit daemon that logs system calls, file access, and security events. PAM manages authentication, iptables is a firewall, and SELinux enforces MAC policies but does not log all system calls.

Full explanation →

439

MCQeasy

A security analyst notices repeated failed login attempts from a single IP address within a short time window. Which control should be implemented to automatically mitigate this behavior?

A.Set session timeout to 15 minutes

B.Implement account lockout policy

C.Enforce complex password policy

D.Require multi-factor authentication

AnswerB

Account lockout disables the account after a set number of failed attempts.

Why this answer

An account lockout policy automatically disables an account after a specified number of failed login attempts within a defined time window, directly mitigating brute-force attacks from a single IP. This control is specifically designed to prevent repeated authentication failures by temporarily or permanently locking the account, stopping further attempts without manual intervention.

Exam trap

ISC2 often tests the distinction between preventive controls (like complex passwords or MFA) and corrective/detective controls (like account lockout), leading candidates to choose MFA because it seems stronger, but the question specifically asks for automatic mitigation of repeated failed attempts, which only lockout directly addresses.

How to eliminate wrong answers

Option A is wrong because setting a session timeout to 15 minutes controls idle session duration, not failed login attempts; it does not prevent repeated authentication failures from a single IP. Option C is wrong because enforcing a complex password policy makes passwords harder to guess but does not automatically stop repeated failed login attempts; it is a preventive control, not a detective or corrective one. Option D is wrong because requiring multi-factor authentication (MFA) adds an additional layer of security but does not automatically mitigate repeated failed login attempts; MFA can still be bypassed if the first factor is guessed, and it does not lock out the account after failures.

Full explanation →

440

MCQmedium

A security engineer needs to choose an asymmetric algorithm for a system with limited computational resources, such as an IoT device. The algorithm must provide equivalent security to RSA 2048-bit while using smaller key sizes. Which algorithm should they choose?

A.RSA with 2048-bit keys

B.Elliptic Curve Cryptography (ECC) with 256-bit keys

C.Diffie-Hellman with 2048-bit keys

D.3DES with 168-bit keys

AnswerB

ECC provides strong security with smaller keys, ideal for IoT.

Why this answer

Elliptic Curve Cryptography (ECC) with 256-bit keys provides equivalent security to RSA 2048-bit because the elliptic curve discrete logarithm problem is significantly harder to solve than the integer factorization problem for the same key length. This allows ECC to achieve strong security with much smaller key sizes, making it ideal for resource-constrained IoT devices where memory, power, and processing are limited.

Exam trap

The SSCP exam often tests the misconception that larger key sizes always mean stronger security, leading candidates to pick RSA 2048-bit or Diffie-Hellman 2048-bit, while the trap is that ECC with much smaller key sizes (e.g., 256-bit) provides equivalent security with lower computational overhead, which is the exact requirement for IoT devices.

How to eliminate wrong answers

Option A is wrong because RSA with 2048-bit keys is the baseline for comparison, not a smaller key size alternative, and it requires significantly more computational resources than ECC for equivalent security. Option C is wrong because Diffie-Hellman with 2048-bit keys is a symmetric-key-agreement protocol that also uses large key sizes for security, not a smaller key size alternative, and it does not provide the same key-size efficiency as ECC. Option D is wrong because 3DES with 168-bit keys is a symmetric encryption algorithm, not an asymmetric algorithm, and it provides only about 112 bits of security, far less than RSA 2048-bit, while also being computationally heavy and deprecated in modern standards.

Full explanation →

441

MCQmedium

A company's security policy requires that all logs be stored in a write-once, read-many (WORM) format. What is the primary security objective of this requirement?

A.To maintain log integrity

B.To ensure log availability

C.To improve log review speed

D.To reduce storage costs

AnswerA

WORM prevents tampering, preserving integrity.

Why this answer

WORM storage ensures that logs cannot be altered after creation, preserving their integrity for forensic purposes.

Full explanation →

442

MCQhard

To determine how malware initially infected a workstation, which artifact would be MOST useful?

A.Windows Event Log showing process creation

B.Prefetch files

C.Windows registry autorun keys

D.Web browser history

AnswerA

Process creation events can reveal the initial executable that ran.

Why this answer

The Windows Event Log showing process creation (Event ID 4688) provides a chronological record of every executable that ran on the system, including the parent process and command-line arguments. This allows an investigator to trace the initial execution of the malware binary, identifying the exact moment and mechanism (e.g., a dropped file, a script launch, or a scheduled task) that triggered the infection. Other artifacts may indicate persistence or lateral movement, but only process creation logs directly capture the first execution event.

Exam trap

The trap here is that candidates often choose web browser history (Option D) because they assume malware always arrives via the internet, but SSCP tests the understanding that process creation logs are the definitive source for identifying the first execution of any binary, regardless of delivery method.

How to eliminate wrong answers

Option B is wrong because Prefetch files (.pf) record application startup times and load patterns to speed up subsequent launches, but they do not capture the initial infection vector (e.g., how the malware was introduced via email, drive-by download, or removable media). Option C is wrong because Windows registry autorun keys (e.g., Run, RunOnce, RunServices) show persistence mechanisms that execute malware after reboot, not the initial infection event that first introduced the malware to the workstation. Option D is wrong because web browser history only shows URLs visited, not the execution of a downloaded file or the triggering of a malicious script; malware can be delivered without any browser interaction (e.g., via network share or USB).

Full explanation →

443

MCQmedium

A security analyst needs to ensure that a legacy application running on an unsupported operating system remains secure until it can be replaced. Which strategy provides the most effective risk reduction?

A.Move the application to a sandboxed virtual machine and isolate it from the network.

B.Apply all available security patches from third-party sources.

C.Upgrade the application to the latest version with vendor support.

D.Implement application whitelisting to allow only approved executables.

AnswerA

Correct. Sandboxing with network isolation contains the application and limits exposure to threats, reducing risk most effectively.

Why this answer

Isolating the legacy application in a sandboxed virtual machine with network restrictions minimizes the attack surface and prevents exploitation of OS-level vulnerabilities. Option B is incorrect because third-party patches are unreliable and may introduce instability or conflicts. Option C is incorrect because upgrading the application is not feasible if it runs on an unsupported OS, and vendor support is unavailable.

Option D is incorrect because application whitelisting only controls execution but does not protect against OS vulnerabilities that could compromise the entire system.

Full explanation →

444

Drag & Dropmedium

Drag and drop the steps for performing a risk assessment according to NIST SP 800-30 into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Risk assessment steps: characterize system, identify threats, identify vulnerabilities, determine risk, then mitigate.

Full explanation →

445

Multi-Selecthard

A network security team is implementing a defense-in-depth strategy. Which three layers should be included? (Choose three.)

Select 3 answers

A.Intrusion Detection System (IDS)

B.Firewall

C.Single sign-on (SSO)

D.Physical security controls

E.Anti-malware at endpoints

AnswersA, B, E

An IDS monitors network traffic for malicious activity, providing a detection layer.

Why this answer

An Intrusion Detection System (IDS) is a key layer in defense-in-depth because it monitors network traffic for suspicious activity and known attack signatures, providing visibility and alerting when perimeter defenses like firewalls are bypassed. It operates by analyzing packets against a rule set (e.g., Snort rules) and generating alerts, enabling a response before damage escalates. This adds a detection layer that complements preventive controls, ensuring that even if an attacker penetrates the outer defenses, the breach is identified.

Exam trap

The trap here is that candidates often mistake Single Sign-On (SSO) for a security layer because it involves authentication, but it is an access management convenience tool, not a defensive control that protects against network or endpoint threats.

Full explanation →

446

MCQhard

A company's backup strategy uses a full backup on Sundays and differential backups on other days. On Thursday, the storage system fails. How many backups are required to restore the data?

A.One (the full backup only)

B.Five (the full backup and all differentials from Monday to Thursday)

C.Two (the full backup and the Thursday differential)

D.Six (all backups from Sunday to Thursday)

AnswerC

The full backup provides the baseline, and the Thursday differential contains all changes since Sunday.

Why this answer

A differential backup copies all data changed since the last full backup. Therefore, to restore data on Thursday, you need the last full backup (Sunday) and the most recent differential backup (Thursday), which contains all changes from Sunday through Thursday. This totals two backups.

Exam trap

The trap here is confusing differential backups with incremental backups, leading candidates to think they need all backups from Monday to Thursday (Option B) or all backups (Option D), when in fact only the full and the latest differential are required.

How to eliminate wrong answers

Option A is wrong because a full backup alone does not include changes made after Sunday, so data from Monday through Thursday would be lost. Option B is wrong because differential backups are cumulative; you do not need all differentials from Monday to Thursday—only the latest differential (Thursday) contains all changes since the full backup. Option D is wrong because you do not need every backup from Sunday to Thursday; the full backup plus the Thursday differential is sufficient, and including the other differentials is redundant and inefficient.

Full explanation →

447

MCQhard

Refer to the exhibit. A network engineer is configuring a site-to-site VPN. The remote peer is using AES-256 encryption and SHA-1 for integrity. Which configuration parameter is likely misconfigured?

A.Transform-set

B.Pre-shared key

C.Group 5

D.IKE lifetime

AnswerC

Group 5 (DH5) is deprecated; the peer may require a stronger DH group.

Why this answer

The remote peer is using AES-256 encryption and SHA-1 for integrity, which are both supported in an IPsec transform-set. However, the exhibit shows that the local peer is configured with Group 5 (Diffie-Hellman 1536-bit), while the remote peer likely expects a different DH group (e.g., Group 2 or Group 14). DH group mismatch during Phase 1 (IKE) negotiation causes the VPN tunnel to fail, even if encryption and integrity algorithms match.

Exam trap

ISC2 often tests the misconception that transform-set mismatches are the only cause of VPN failures, but the trap here is that DH group mismatch in IKE Phase 1 is a separate, easily overlooked parameter that prevents tunnel establishment even when encryption and integrity algorithms match.

How to eliminate wrong answers

Option A is wrong because the transform-set defines encryption (AES-256) and integrity (SHA-1) algorithms for Phase 2, and both are compatible with the remote peer's settings. Option B is wrong because the pre-shared key is used for authentication in Phase 1; a mismatch would cause authentication failure, not a DH group negotiation error. Option D is wrong because the IKE lifetime (e.g., 86400 seconds) is a timer for rekeying; while mismatched lifetimes can cause rekey issues, they do not prevent initial tunnel establishment as DH group mismatch does.

Full explanation →

448

MCQhard

An organization uses attribute-based access control (ABAC) for its cloud storage. The policy states that a user can read a document only if the user’s department attribute matches the document’s department attribute AND the current time is within business hours (9AM-5PM). A user from Engineering tries to read a document classified for Engineering at 8:55 AM. What is the expected result?

A.Access granted because the department matches

B.Access denied because the department does not match

C.Access granted because the user is in Engineering

D.Access denied because the time is outside business hours

AnswerD

8:55 AM is before 9 AM, so the time condition fails.

Why this answer

The ABAC policy requires both conditions to be true: department match AND time within business hours (9AM-5PM). At 8:55 AM, the time condition is false, so access is denied regardless of the department match. This is a classic example of a conjunctive (AND) policy in ABAC where all attributes must satisfy the rules.

Exam trap

The trap here is that candidates focus on the department match and overlook the conjunctive AND logic, assuming a single matching attribute is sufficient for access.

How to eliminate wrong answers

Option A is wrong because it ignores the time condition; ABAC policies with AND require all attributes to match, not just one. Option B is wrong because the department does match (both Engineering), but the denial is due to time, not department mismatch. Option C is wrong because being in Engineering alone does not satisfy the policy; the time attribute must also be within business hours.

Full explanation →

449

MCQmedium

Which of the following is the PRIMARY purpose of establishing a chain of custody when handling digital evidence?

A.To determine the priority of the incident

B.To ensure that evidence is stored in a secure location

C.To prove that evidence has not been altered or tampered with from collection to presentation

D.To identify which forensic tools were used during analysis

AnswerC

Chain of custody maintains integrity and admissibility.

Why this answer

The primary purpose of chain of custody is to create a documented, unbroken record of every person who handled the evidence, from collection through presentation in court. This documentation is critical to demonstrate that the digital evidence has not been altered, tampered with, or corrupted, thereby preserving its integrity and admissibility. Without a proper chain of custody, the opposing party can successfully challenge the evidence as unreliable or compromised.

Exam trap

The trap here is that candidates often confuse the purpose of chain of custody with the purpose of secure storage (Option B), but the exam specifically tests that the primary goal is proving evidence integrity through an unbroken record of custody, not just physical security.

How to eliminate wrong answers

Option A is wrong because establishing chain of custody has nothing to do with determining incident priority; priority is based on impact, criticality, and business risk, not evidence handling. Option B is wrong because while secure storage is an important part of evidence preservation, it is only one component of the chain of custody process, not the primary purpose; the core goal is proving integrity through documentation of every transfer and access event. Option D is wrong because identifying forensic tools used during analysis is a matter of methodology documentation, not chain of custody; chain of custody focuses on who had possession and when, not which software was employed.

Full explanation →

450

MCQeasy

A company wants to prevent unauthorized applications from running on employee workstations. Which of the following is the most effective control?

A.User training

B.Regular antivirus updates

C.Host-based intrusion detection system

D.Application whitelisting

AnswerD

Whitelisting blocks unapproved applications from running.

Why this answer

Application whitelisting allows only approved executables to run, effectively preventing unauthorized applications. Host-based intrusion detection can detect but not prevent. Antivirus relies on signatures and may miss unknown malware.

User training is important but not a technical control.

Full explanation →

Systems Security Certified Practitioner SSCP (SSCP) — Questions 376–450