Knowledge + Practice

Systems Security Certified Practitioner SSCP (SSCP) — Questions 451–525

920 questions total · 13pages · All types, answers revealed

Take a mock exam Exam hub

Page 7 of 13

451

Multi-Selecteasy

Which THREE of the following are common methods for identifying risks? (Select three.)

Select 3 answers

A.SWOT analysis

B.Threat modeling

C.Brainstorming sessions

D.Penetration testing

E.Vulnerability scanning

AnswersB, C, E

Systematic approach to identify threats and vulnerabilities.

Why this answer

Threat modeling is a structured approach for identifying risks by analyzing potential threats, vulnerabilities, and attack vectors in a system. It involves creating diagrams, identifying assets, and applying frameworks like STRIDE or PASTA to systematically uncover risks before they are exploited. This makes it a core risk identification method in the SSCP domain.

Exam trap

The trap here is that candidates confuse risk identification methods (like threat modeling and brainstorming) with risk validation or assessment techniques (like penetration testing and vulnerability scanning), leading them to select options D or A instead of the correct set.

Full explanation →

452

MCQmedium

A company's disaster recovery plan includes offsite tape backups. During a test, it is discovered that the tapes are stored at a location that shares the same power grid as the primary site. Which risk does this pose?

A.The tapes may degrade over time

B.The tapes may be inaccessible during a power outage

C.The tapes are not encrypted

D.The recovery time may exceed the RTO

AnswerB

If both sites lose power, the tapes cannot be retrieved for recovery.

Why this answer

Storing offsite tapes at a location that shares the same power grid as the primary site means a regional power outage could render both sites inaccessible, preventing retrieval of the tapes. Option A is incorrect because tape degradation is a separate issue related to storage conditions, not power grid dependency. Option C is incorrect because encryption is unrelated to power grid sharing.

Option D is incorrect because RTO (Recovery Time Objective) could be affected, but the primary risk here is inaccessibility due to power outage, not necessarily exceeding RTO.

Full explanation →

453

MCQmedium

An organization uses a network-based intrusion detection system (NIDS). An analyst receives an alert for a known exploit signature. Which type of detection is the NIDS using?

A.Anomaly-based detection

B.Behavior-based detection

C.Signature-based detection

D.Heuristic detection

AnswerC

Matching a known exploit signature is signature-based.

Why this answer

The NIDS generated an alert based on a known exploit signature, which means it compared network traffic against a database of predefined patterns or fingerprints of known attacks. This is the defining characteristic of signature-based detection, where the system relies on exact or pattern matches to known malicious activity.

Exam trap

The trap here is that candidates confuse 'signature-based' with 'heuristic' detection, because both involve pattern matching, but heuristic detection uses fuzzy logic or statistical models rather than exact known signatures.

How to eliminate wrong answers

Option A is wrong because anomaly-based detection establishes a baseline of normal network behavior and flags deviations from that baseline, not known exploit signatures. Option B is wrong because behavior-based detection analyzes patterns of activity over time to identify suspicious behavior, such as unusual data exfiltration rates, rather than matching static signatures. Option D is wrong because heuristic detection uses algorithms or rules to infer malicious intent based on generalized characteristics or statistical analysis, not a direct match to a known exploit signature.

Full explanation →

454

MCQmedium

An organization wants to ensure that privileged accounts are used only when needed and that all activities are recorded. Which Privileged Access Management (PAM) control should be implemented?

A.Password vaulting

B.Role-based access control

C.Multi-factor authentication

D.Just-in-Time (JIT) provisioning with session recording

AnswerD

JIT provides temporary access and session recording logs activities.

Why this answer

Just-in-Time (JIT) provisioning grants temporary elevated privileges for specific tasks, reducing the attack surface. Session recording captures all actions for auditing.

Full explanation →

455

MCQhard

A company uses Infrastructure as a Service (IaaS) for its production workloads. According to the shared responsibility model, which of the following security tasks is the customer responsible for?

A.Patching the hypervisor

B.Physical security of data centers

C.Securing the network infrastructure

D.Patching the guest operating system

AnswerD

The customer manages OS patches on their VMs.

Why this answer

In IaaS, the provider secures the physical infrastructure and hypervisor, while the customer secures the operating system, applications, and data. The customer is responsible for OS patch management. The provider handles physical security, hypervisor patching, and network infrastructure.

Full explanation →

456

MCQhard

During a security audit, an analyst finds that a server's audit log shows repeated failed login attempts from a single IP, followed by a successful login from the same IP five minutes later. What is the most likely type of attack that occurred?

A.Dictionary attack

B.Man-in-the-middle attack

C.Brute-force attack

D.Replay attack

E.Password spraying attack

AnswerC

Brute-force tries all possible combinations until success, matching the log pattern.

Why this answer

(brute-force attack). The scenario describes repeated failed login attempts from a single IP address followed by a successful login, which is characteristic of a brute-force attack where an attacker tries many passwords until one works. Option A (dictionary attack) uses a list of likely passwords but may not be as exhaustive; the description of repeated attempts without specifying a list suggests brute-force.

Option B (man-in-the-middle attack) intercepts communications, not login attempts. Option D (replay attack) involves capturing and reusing a valid credential, not repeated tries. Option E (password spraying attack) targets multiple accounts with a few common passwords, not repeated attempts on a single account from one IP.

Full explanation →

457

MCQmedium

An administrator reports that a TLS handshake fails between a web server and client. The server supports TLS 1.2 with ciphers ECDHE-RSA-AES128-GCM-SHA256 and RSA-AES256-CBC-SHA256. The client supports only TLS 1.0 with ciphers RSA-RC4-SHA and RSA-AES128-SHA. What is the most likely cause?

A.Cipher suite order misconfiguration

B.Certificate validation failure

C.No common TLS version

D.No common cipher suite

AnswerC

The server supports TLS 1.2 only; client only TLS 1.0.

Why this answer

The TLS handshake fails because the server supports only TLS 1.2, while the client supports only TLS 1.0. During the handshake, the client sends a ClientHello with its highest supported version (1.0), and the server responds with a ServerHello indicating its highest supported version (1.2). Since neither side can downgrade to a mutually supported version, the handshake aborts.

This is a version negotiation failure, not a cipher mismatch.

Exam trap

The trap here is that candidates see different cipher suites and assume a cipher mismatch (Option D), but the real issue is that the TLS versions are incompatible, which is checked before cipher negotiation.

How to eliminate wrong answers

Option A is wrong because cipher suite order misconfiguration would only matter if both sides shared a common TLS version; here, the version mismatch prevents any cipher negotiation from occurring. Option B is wrong because certificate validation failure occurs after the handshake establishes a secure channel, typically during the CertificateVerify or Finished messages, but the handshake fails before that point due to version incompatibility. Option D is wrong because even if the client and server had no common cipher suites, the handshake would still proceed to the ServerHello stage and fail at cipher negotiation, but here the failure is earlier at version negotiation; the client's TLS 1.0 ciphers are irrelevant when the server only offers TLS 1.2.

Full explanation →

458

MCQmedium

A company's internal network uses a /24 subnet and has a single firewall connecting to the internet. Employees report that they cannot access an external web server at 203.0.113.50. The firewall has a rule that allows outbound HTTP. What is the most likely cause?

A.The default gateway on the internal hosts is incorrect.

B.NAT is not configured for outbound traffic.

C.DNS resolution is failing for the server name.

D.An ACL is blocking the destination IP.

AnswerB

Internal private IPs must be translated to a public IP for internet access.

Why this answer

The firewall rule allows outbound HTTP, but without NAT configured, the internal hosts' private IP addresses (e.g., 192.168.1.x) are used as source addresses in packets sent to the external web server. The web server at 203.0.113.50 will see these private addresses as the source and attempt to reply to them, but private addresses are not routable on the public internet, so the return traffic never reaches the internal hosts. NAT (specifically source NAT or PAT) translates the private source IP to the firewall's public IP, enabling two-way communication.

Exam trap

The trap here is that candidates often assume a firewall rule allowing outbound HTTP is sufficient, forgetting that NAT is required to translate private source addresses to a routable public IP for return traffic to succeed.

How to eliminate wrong answers

Option A is wrong because an incorrect default gateway would prevent internal hosts from reaching any external destination, not just a specific web server, and the symptom is isolated to one external server. Option C is wrong because DNS resolution failure would manifest as a 'server not found' error when using a hostname, but the question states the external web server is accessed by IP address (203.0.113.50), so DNS is not involved. Option D is wrong because an ACL blocking the destination IP would be configured on the firewall, but the firewall already has a rule allowing outbound HTTP; if an ACL were blocking 203.0.113.50, it would contradict the existing permit rule or be a separate deny rule, but the most common and likely cause in a scenario with a single firewall and no mention of ACLs is the lack of NAT.

Full explanation →

459

MCQeasy

Which of the following is the primary purpose of a security awareness program?

A.To teach employees about security best practices and reduce human error.

B.To evaluate the effectiveness of security technologies.

C.To enforce security policies through penalties.

D.To train employees on advanced technical security skills.

AnswerA

This is the core purpose of awareness programs.

Why this answer

The primary purpose of a security awareness program is to educate employees on security best practices and reduce human error, which is the leading cause of security incidents. Unlike technical controls, awareness programs target the human element by teaching users to recognize phishing attempts, handle sensitive data properly, and follow secure behaviors. This aligns with the NIST SP 800-50 framework, which defines awareness as a foundational component of an organizational security posture.

Exam trap

ISC2 often tests the distinction between 'awareness' (general, non-technical education for all users) and 'training' (in-depth, role-specific technical instruction), so candidates mistakenly choose D when they confuse the scope of awareness programs with advanced technical training.

How to eliminate wrong answers

Option B is wrong because evaluating the effectiveness of security technologies is the purpose of security testing and assessment (e.g., vulnerability scanning, penetration testing), not a security awareness program. Option C is wrong because enforcing security policies through penalties is a function of policy enforcement and disciplinary procedures, not the primary goal of awareness, which is education and behavior change. Option D is wrong because training employees on advanced technical security skills is the domain of specialized technical training (e.g., for IT staff), whereas awareness programs target all employees with general, non-technical knowledge.

Full explanation →

460

MCQhard

An organization uses VMware ESXi in a production environment. Which of the following is the most effective mitigation against VM escape attacks?

A.Using VM snapshots for quick recovery

B.Implementing network segmentation between VMs

C.Regularly patching the ESXi hypervisor

D.Disabling unnecessary guest tools within VMs

AnswerC

Patching addresses vulnerabilities that could be exploited for VM escape.

Why this answer

VM escape attacks exploit hypervisor vulnerabilities. Keeping the hypervisor patched is the primary defense, as it closes known vulnerabilities that could be used for escape.

Full explanation →

461

Multi-Selecthard

Which TWO are security implications of using deprecated cryptographic protocols such as SSL 3.0 and TLS 1.0?

Select 2 answers

A.Susceptibility to downgrade attacks

B.Increased computational overhead

C.Compliance with regulations

D.Weak key exchange

E.Interoperability issues with modern systems

AnswersA, D

Correct. Deprecated protocols like SSL 3.0 and TLS 1.0 are vulnerable to downgrade attacks (e.g., POODLE), where an active attacker forces the client and server to negotiate a weaker protocol, exploiting known weaknesses.

Why this answer

Deprecated protocols such as SSL 3.0 and TLS 1.0 have well-known security vulnerabilities. Option A is correct because these protocols are susceptible to downgrade attacks (e.g., POODLE) where an attacker forces the use of the weaker protocol. Option D is correct because they often employ weak key exchange algorithms, making encrypted communications easier to decrypt.

Option E is incorrect because interoperability issues are a practical concern, not a direct security implication; the question specifically asks for security implications. Options B and C are not security implications: increased computational overhead is a performance issue, and compliance with regulations refers to legal requirements, not inherent security flaws.

Exam trap

ISC2 often tests the misconception that deprecated protocols are 'still secure enough' or that their only downside is performance overhead, but the real trap is that candidates confuse 'interoperability issues' (which are a practical concern) with 'security implications' (which are the core focus of the question).

Full explanation →

462

MCQeasy

Which of the following is a primary security concern when using VM snapshots in a virtualized environment?

A.Snapshots can be used to bypass authentication

B.Snapshots may contain unpatched vulnerabilities if not regularly updated

C.Snapshots can be exported and stolen

D.Snapshots consume excessive storage space

AnswerB

Reverting to an old snapshot can re-expose the system to known vulnerabilities.

Why this answer

VM snapshots capture the state at a point in time. If the snapshot is not updated with patches, reverting to it can reintroduce vulnerabilities that were previously fixed.

Full explanation →

463

MCQeasy

A company uses digital signatures to ensure the integrity and non-repudiation of internal contracts. The private key used for signing is stored in a hardware security module (HSM). A junior administrator asks why the HSM is necessary. What is the primary reason?

A.It reduces network latency during signing.

B.It enables symmetric key exchange for large files.

C.It allows the signing process to be faster.

D.It provides non-repudiation by protecting the private key.

AnswerD

Protecting the private key in a tamper-resistant device ensures that only the authorized user can sign, providing non-repudiation.

Why this answer

The primary reason for using an HSM is to protect the private key from unauthorized access or extraction. Non-repudiation relies on the assurance that only the legitimate signer could have used the private key; if the key is compromised, that assurance is lost. The HSM provides a tamper-resistant environment that performs signing operations internally, ensuring the private key never leaves the secure hardware.

Exam trap

The trap here is that candidates may think an HSM is used for performance or key exchange, but the SSCP exam emphasizes that its core purpose is to safeguard the private key to maintain non-repudiation and integrity.

How to eliminate wrong answers

Option A is wrong because an HSM does not reduce network latency; in fact, it may add slight latency due to hardware communication overhead. Option B is wrong because HSMs are used for asymmetric key operations (signing/encryption), not symmetric key exchange; symmetric keys are typically exchanged using asymmetric methods like Diffie-Hellman or RSA. Option C is wrong because HSMs are not primarily designed for speed; software-based signing can be faster, but HSMs prioritize security over raw performance.

Full explanation →

464

MCQmedium

After a security incident, the CSIRT is conducting lessons learned. Which output is most directly used to update the risk management process?

A.Updated incident response plan.

B.Risk register updates.

C.Corrective actions.

D.Forensic report.

AnswerB

New threats or control failures from the incident should be documented in the risk register to inform future risk assessments.

Why this answer

The risk management process is directly updated by incorporating new risk information derived from incident analysis. Risk register updates (option B) capture newly identified risks, changes in risk likelihood or impact, and the effectiveness of existing controls, which are the primary outputs that feed back into risk treatment decisions.

Exam trap

The trap here is that candidates confuse operational outputs (corrective actions, updated IR plans) with the formal risk management artifact (risk register) that directly influences risk acceptance, mitigation, or transfer decisions.

How to eliminate wrong answers

Option A is wrong because updating the incident response plan is a corrective action to improve future response, not a direct input to the risk management process; the plan itself does not modify risk registers or risk assessments. Option C is wrong because corrective actions address specific incident root causes and may reduce risk, but they are operational fixes, not the formal risk documentation updates that directly feed the risk management process. Option D is wrong because a forensic report documents evidence and findings for legal or investigative purposes, but it does not directly update risk registers or risk treatment plans unless its findings are abstracted into risk entries.

Full explanation →

465

MCQeasy

In a qualitative risk analysis, a risk is assigned a probability of 'High' and an impact of 'Medium'. According to common probability/impact matrices, what is the overall risk rating?

A.High

B.Critical

C.Medium

D.Low

AnswerA

High probability combined with medium impact yields High risk in most matrices.

Why this answer

In a standard qualitative risk analysis probability/impact matrix, a 'High' probability combined with a 'Medium' impact typically yields an overall risk rating of 'High'. This is because the matrix is designed to prioritize risks where both factors are elevated, and the product or intersection of these two values falls into the 'High' category in most common 3x3 or 5x5 matrices used in frameworks like NIST SP 800-30 or ISO 31000.

Exam trap

The trap here is that candidates often confuse 'High' probability with 'Critical' overall rating, or incorrectly assume that a 'Medium' impact automatically lowers the rating to 'Medium', ignoring that the probability weight dominates in many matrix designs.

How to eliminate wrong answers

Option B is wrong because 'Critical' is not a standard rating in a basic 3x3 probability/impact matrix; it is often used in 5x5 matrices for the highest combination (e.g., High/High) but not for High/Medium. Option C is wrong because 'Medium' would result from a combination like Medium/Medium or Low/High, not from High/Medium where the probability is elevated. Option D is wrong because 'Low' would require both probability and impact to be Low, or one to be Low and the other Very Low, which is not the case here.

Full explanation →

466

MCQmedium

What is the primary risk associated with service accounts in an enterprise?

A.They are used by multiple users simultaneously

B.They are difficult to create

C.They often have excessive privileges and infrequent password changes

D.They are always tied to a specific user

AnswerC

Service accounts are often overlooked, with standing privileges and unchanged passwords.

Why this answer

Service accounts often have high privileges and are rarely changed, making them prime targets for attackers if compromised.

Full explanation →

467

MCQhard

Which attack exploits the lack of IV (Initialization Vector) randomness in the RC4 algorithm to recover the Wi-Fi password, and is considered completely broken?

A.WEP IV attack

B.PMKID attack

C.Evil twin attack

D.KRACK attack

AnswerA

WEP's use of weak IVs in RC4 allows key recovery.

Why this answer

WEP uses RC4 with weak IVs that can be captured and analyzed to recover the key, making WEP completely insecure.

Full explanation →

468

Multi-Selecthard

A security auditor is reviewing the account lifecycle process. Which TWO of the following are mandatory steps during the deprovisioning (offboarding) process?

Select 2 answers

A.Preserve evidence for potential investigation

B.Change the user's password to a default

C.Immediately disable the account

D.Notify the user that their account will be removed

E.Delete the account and all associated data

AnswersA, C

Evidence must be preserved.

Why this answer

Immediate disabling prevents unauthorized access, and preserving evidence (logs, files) is essential for potential investigations. Deleting accounts immediately may hinder forensics, and notifying users is not required (they are leaving).

Full explanation →

469

Multi-Selectmedium

A security engineer is hardening a Linux server. Which TWO actions are recommended to reduce the attack surface? (Select TWO.)

Select 2 answers

A.Remove unnecessary services and daemons

B.Disable unused user accounts

C.Install a web server for management

D.Set umask to 000

E.Enable IPv6 routing

AnswersA, B

Reduces attack surface by eliminating unused services.

Why this answer

Removing unnecessary services and disabling unused accounts reduce the number of potential entry points for attackers.

Full explanation →

470

MCQmedium

Based on the exhibit, which security threat is likely being attempted?

A.DNS poisoning

B.Man-in-the-middle attack

C.Brute-force attack

D.SQL injection

AnswerC

Multiple failed password attempts from a single source in a short time frame is characteristic of a brute-force attack.

Why this answer

The exhibit shows a large number of failed login attempts (e.g., 'Login failed' or 'Authentication error') from a single source IP within a short time window, which is the classic signature of a brute-force attack. This attack systematically tries multiple username/password combinations to gain unauthorized access, and the repeated failure messages in the logs confirm the attempt.

Exam trap

ISC2 often tests the distinction between brute-force attacks and other threats by embedding subtle clues like 'multiple failed logins' in logs, which candidates may misinterpret as a man-in-the-middle attack due to the presence of authentication errors, but the key is the volume and repetition of failures.

How to eliminate wrong answers

Option A is wrong because DNS poisoning involves corrupting DNS resolver caches with false IP mappings, which would show DNS query anomalies or spoofed responses, not repeated login failures. Option B is wrong because a man-in-the-middle attack intercepts and potentially alters communications between two parties, typically indicated by ARP spoofing, SSL certificate mismatches, or unusual traffic patterns, not a flood of authentication failures. Option D is wrong because SQL injection exploits input validation flaws to execute arbitrary SQL commands, which would manifest as database error messages or unexpected query results, not repeated login attempts.

Full explanation →

471

Multi-Selectmedium

Which TWO of the following are symmetric encryption algorithms? (Select exactly two.)

Select 2 answers

A.DES

B.AES

C.RSA

D.ECC

E.SHA-256

AnswersA, B

DES is a symmetric cipher.

Why this answer

DES (Data Encryption Standard) is a symmetric encryption algorithm that uses a single key for both encryption and decryption. It operates on 64-bit blocks with a 56-bit key, and while now considered insecure due to its small key size, it remains a foundational symmetric cipher. AES (Advanced Encryption Standard) is also symmetric, using block sizes of 128 bits and key sizes of 128, 192, or 256 bits, and is the current standard for symmetric encryption.

Exam trap

ISC2 often tests the distinction between symmetric and asymmetric algorithms, and the trap here is that candidates may confuse RSA or ECC (both asymmetric) with symmetric ciphers, or mistakenly think SHA-256 is an encryption algorithm because it is used in security contexts.

Full explanation →

472

MCQmedium

A security analyst is reviewing logs from a SIEM and notices multiple failed login attempts for a privileged account from an IP address in a foreign country, followed by a successful login after hours. Which type of security monitoring tool would be most effective at detecting this pattern as anomalous behavior based on user baseline?

A.Signature-based IDS

B.Network-based IPS

C.Host-based IDS

D.User Behavior Analytics (UBA)

AnswerD

UBA uses baseline modeling to detect anomalous user activities.

Why this answer

User Behavior Analytics (UBA) is designed to establish a baseline of normal user activity and detect anomalies such as a privileged account logging in from an unusual geographic location after hours. Unlike signature or rule-based tools, UBA uses statistical modeling and machine learning to identify deviations from the user's historical patterns, making it ideal for detecting this type of credential misuse.

Exam trap

The trap here is that candidates often confuse anomaly detection with signature-based detection, assuming that a failed login followed by a success is a known brute-force pattern that a signature-based IDS would catch, but the question specifically asks for detection based on a user baseline, which is the core function of UBA, not signature matching.

How to eliminate wrong answers

Option A is wrong because a signature-based IDS relies on predefined patterns (e.g., known attack signatures) and cannot detect novel or anomalous behavior like a login from an unusual IP unless a specific signature exists for that scenario. Option B is wrong because a network-based IPS focuses on blocking malicious traffic at the network layer (e.g., exploiting vulnerabilities) and does not analyze user login patterns or establish behavioral baselines. Option C is wrong because a host-based IDS monitors system-level events (e.g., file changes, process execution) on a single host but lacks the cross-session, user-centric analytics needed to compare a login event against historical user behavior.

Full explanation →

473

MCQeasy

A small business wants to identify vulnerabilities in its network. Which type of scan should they perform first to get an overview?

A.Vulnerability scan.

B.Stealth scan.

C.Full port scan.

D.Ping sweep.

AnswerD

A ping sweep quickly identifies which IP addresses are active, providing a starting point.

Why this answer

A ping sweep (ICMP Echo Request) is the correct first step because it quickly identifies which hosts are alive on the network, providing a baseline of active IP addresses. This overview allows the business to scope the subsequent vulnerability scan to only live targets, reducing noise and scan time. Without a ping sweep, a full port or vulnerability scan would waste resources scanning dead or unresponsive hosts.

Exam trap

The trap here is that candidates often confuse 'vulnerability scan' (a deep assessment of known weaknesses) with 'host discovery' (a lightweight enumeration of live systems), leading them to select Option A as the first step instead of the correct ping sweep.

How to eliminate wrong answers

Option A is wrong because a vulnerability scan is a deeper, more resource-intensive assessment that should be performed after identifying live hosts; starting with it would waste time and bandwidth scanning non-responsive IPs. Option B is wrong because a stealth scan (e.g., SYN scan) is a port scanning technique that attempts to evade detection, not a host-discovery method; it is inappropriate for an initial overview and may trigger IDS/IPS alerts unnecessarily. Option C is wrong because a full port scan (e.g., scanning all 65,535 TCP ports) is exhaustive and time-consuming, and should only be run against known live hosts to avoid excessive network traffic and false positives from dead targets.

Full explanation →

474

MCQmedium

A security team discovers that a legacy system uses ECB mode to encrypt credit card numbers. What is the primary security concern with this mode?

A.Identical plaintext blocks produce identical ciphertext, revealing patterns

B.It is slow compared to other modes

C.It is vulnerable to padding oracle attacks

D.It does not provide integrity

AnswerA

This is the classic weakness of ECB.

Why this answer

ECB (Electronic Codebook) mode encrypts each plaintext block independently using the same key. This means identical plaintext blocks produce identical ciphertext blocks, which allows an attacker to detect patterns, data boundaries, and repetitions in the encrypted data. For credit card numbers, which often have predictable formats (e.g., BIN ranges, fixed lengths), this pattern leakage can reveal sensitive information without breaking the encryption key.

Exam trap

The trap here is that candidates often confuse ECB's lack of diffusion with performance issues or integrity flaws, but The SSCP exam specifically tests whether you recognize that ECB's deterministic block mapping is its fundamental weakness, not speed or padding vulnerabilities.

How to eliminate wrong answers

Option B is wrong because ECB is actually one of the fastest modes—it processes blocks in parallel with no chaining overhead, so slowness is not a valid concern. Option C is wrong because padding oracle attacks exploit CBC mode (or other modes using PKCS#7 padding), not ECB; ECB does not use an initialization vector or chaining, so padding oracle attacks are not applicable. Option D is wrong because ECB does not inherently provide integrity, but that is not its primary security concern—the core issue is pattern leakage from deterministic encryption; integrity is a separate property typically addressed by MACs or authenticated encryption modes like GCM.

Full explanation →

475

MCQhard

A company uses a federated identity system where partner employees access internal applications via SAML assertions. Recently, a partner employee who should have been terminated was still able to log in. Which missing control is the most likely root cause?

A.Just-in-time provisioning

B.Identity proofing

C.Session timeout

D.Single sign-on logout

AnswerA

JIT provisioning ensures accounts are created only when needed and removed when no longer necessary; missing this control leads to orphaned accounts.

Why this answer

Just-in-time (JIT) provisioning is the missing control because it ensures that user accounts are created and, more critically, disabled or removed in real-time based on the identity provider's (IdP) authoritative directory. Without JIT provisioning, the partner employee's account in the service provider (SP) remains active even after termination in the IdP, allowing continued access via valid SAML assertions. JIT provisioning would synchronize the account lifecycle by checking the IdP's user status at each authentication attempt and disabling the local account when the user is deactivated.

Exam trap

The trap here is that candidates confuse session management (session timeout or SSO logout) with account lifecycle management, assuming that ending a session or requiring re-authentication would prevent a terminated user from logging in again, when in fact the underlying account remains active in the SP.

How to eliminate wrong answers

Option B is wrong because identity proofing is the process of verifying a user's claimed identity during initial registration, which is unrelated to the ongoing lifecycle management of an existing user who should have been terminated. Option C is wrong because session timeout controls the duration of an active session after login, but it does not prevent a terminated user from initiating a new login session with a valid SAML assertion. Option D is wrong because single sign-on logout only terminates the current session across federated applications; it does not prevent a terminated user from authenticating again with a new SAML assertion if their account is still active in the SP.

Full explanation →

476

MCQhard

During an audit, it is discovered that a contractor’s account has read access to a financial database even though the contractor’s project ended six months ago. Which type of access control failure is this?

A.Inadequate authorization

B.Insufficient authentication

C.Weak password policy

D.Poor account management

AnswerD

Accounts must be disabled when no longer needed.

Why this answer

The contractor's account retained access privileges after the project ended, which is a failure of the account lifecycle management process. Proper account management requires disabling or removing accounts when a user's role or affiliation changes, such as when a contract terminates. This is not an authorization or authentication issue, as the access was originally granted correctly but was not revoked in a timely manner.

Exam trap

The trap here is that candidates confuse 'inadequate authorization' (which is about granting excessive permissions) with 'poor account management' (which is about failing to revoke access when it is no longer needed), even though the original authorization was correct.

How to eliminate wrong answers

Option A is wrong because inadequate authorization refers to granting permissions that are too broad or inappropriate for a role, whereas here the access was appropriate during the project but not revoked afterward. Option B is wrong because insufficient authentication deals with verifying identity (e.g., weak MFA or passwordless login), not with the ongoing validity of an account after its purpose ends. Option C is wrong because a weak password policy concerns password complexity, length, or rotation rules, not the failure to deprovision an account after a project concludes.

Full explanation →

477

Multi-Selecteasy

A security administrator is setting up a public key infrastructure (PKI) for internal use. Which two of the following components are essential for establishing a chain of trust from the root CA to end-entity certificates?

Select 2 answers

A.An intermediate (subordinate) CA certificate signed by the root CA

B.A certificate signing request (CSR)

C.A self-signed root CA certificate

D.An online certificate status protocol (OCSP) responder

E.A certificate revocation list (CRL)

AnswersA, C

Intermediate CAs issue end-entity certificates and are signed by the root CA, forming the chain.

Why this answer

The root CA must be self-signed (trust anchor), and intermediate CAs (subordinate) are used to issue end-entity certificates. CRLs and OCSP are revocation mechanisms, not trust chain components. CSR is for requesting certificates.

Full explanation →

478

MCQeasy

A company needs to encrypt large volumes of data at rest on a file server. Which type of cryptography is most appropriate for this task?

A.Asymmetric encryption

B.Public Key Infrastructure (PKI)

C.Symmetric encryption

D.Hash function

AnswerC

Symmetric encryption is fast and suitable for bulk data.

Why this answer

Symmetric encryption uses a single shared key for both encryption and decryption, making it significantly faster and more efficient than asymmetric encryption for bulk data encryption. For large volumes of data at rest on a file server, symmetric algorithms like AES-256 provide the necessary performance and security, as they are designed to handle high-throughput encryption with minimal computational overhead.

Exam trap

The trap here is that candidates confuse the role of asymmetric encryption (used for key exchange or small data) with bulk encryption, or mistakenly think PKI is an encryption method rather than a management framework, leading them to choose options that are technically valid in other contexts but inappropriate for large-scale data-at-rest encryption.

How to eliminate wrong answers

Option A is wrong because asymmetric encryption (e.g., RSA, ECC) is computationally intensive and orders of magnitude slower than symmetric encryption, making it impractical for encrypting large volumes of data at rest; it is typically used for key exchange or digital signatures. Option B is wrong because Public Key Infrastructure (PKI) is a framework for managing digital certificates and public keys, not an encryption algorithm itself; it supports asymmetric operations but does not directly encrypt bulk data. Option D is wrong because a hash function (e.g., SHA-256) is a one-way function that produces a fixed-size digest and is not reversible, so it cannot be used for encryption or decryption of data at rest.

Full explanation →

479

MCQeasy

An organization is hardening a new Windows server for production use. Which of the following is the most effective method to ensure that only approved applications can run?

A.Enable BitLocker drive encryption

B.Enable User Account Control (UAC)

C.Configure AppLocker or Windows Defender Application Control

D.Install Windows Defender Antivirus

AnswerC

AppLocker and WDAC enforce whitelisting of approved applications.

Why this answer

AppLocker or Windows Defender Application Control (WDAC) provide application whitelisting, ensuring only approved executables, scripts, and installers run. UAC controls privilege elevation, not execution. Windows Defender Antivirus detects malware but does not enforce whitelisting.

BitLocker provides full-disk encryption, not application control.

Full explanation →

480

MCQeasy

Which access control model is best suited for a military environment where data classification (Unclassified, Confidential, Secret, Top Secret) and subject clearance levels are the primary factors for access decisions?

A.Attribute-Based Access Control (ABAC)

B.Mandatory Access Control (MAC)

C.Discretionary Access Control (DAC)

D.Role-Based Access Control (RBAC)

AnswerB

MAC uses labels and clearance levels to enforce access, making it ideal for military and classified environments.

Why this answer

Mandatory Access Control (MAC) enforces access based on labels (classification and clearance) and is used in military and government settings. Option B is correct. Option A (ABAC) is attribute-based and not the traditional model for military-grade security.

Option C (DAC) allows owners to set permissions, which is unsuitable for classified environments. Option D (RBAC) uses roles, not classification levels.

Full explanation →

481

MCQeasy

A help desk technician needs to reset a user's password but should not be able to modify other user attributes. Which access control principle should be applied to enforce this restriction?

A.Need-to-know

B.Least privilege

C.Separation of duties

D.Mandatory access control

AnswerB

Least privilege grants only the minimal permissions required to perform a job, which directly applies to restricting the technician to password reset only.

Why this answer

Least privilege ensures that a user or process is granted only the minimum permissions necessary to perform their job function. In this scenario, the help desk technician needs the ability to reset passwords but must be restricted from modifying other user attributes, such as group membership or account expiration. By applying least privilege, the technician's account is assigned a role or permission set that specifically allows password reset operations (e.g., via Active Directory delegated permissions or a custom RBAC role) while explicitly denying write access to other user object properties.

Exam trap

ISC2 often tests least privilege by presenting a scenario where a user needs a specific action (like password reset) and candidates confuse it with separation of duties, which focuses on splitting tasks across multiple people rather than limiting the scope of a single user's permissions.

How to eliminate wrong answers

Option A is wrong because need-to-know is a confidentiality principle that restricts access to data based on the user's requirement to know that information to perform their duties, not a mechanism for limiting modification permissions on specific attributes. Option C is wrong because separation of duties divides critical tasks among multiple individuals to prevent fraud or error (e.g., one person requests a password reset and another approves it), but it does not directly limit the scope of permissions for a single technician. Option D is wrong because mandatory access control (MAC) enforces system-wide policies based on labels and clearances (e.g., Bell-LaPadula model), which is too rigid and not designed for granular attribute-level restrictions within a single user object.

Full explanation →

482

MCQmedium

A security administrator needs to choose an encryption algorithm for a high-speed network where data is encrypted at the link layer. Which algorithm is most appropriate?

A.RSA

B.Diffie-Hellman

C.AES

D.SHA-256

AnswerC

AES is symmetric, fast, and suitable for link-layer encryption.

Why this answer

AES (Advanced Encryption Standard) is the most appropriate choice for link-layer encryption in high-speed networks because it is a symmetric block cipher designed for efficient hardware and software implementation, offering high throughput with low latency. Unlike asymmetric algorithms, AES operates with a single shared key, making it ideal for encrypting bulk data at the data link layer where speed and minimal overhead are critical.

Exam trap

The trap here is that candidates confuse encryption algorithms with key exchange or hashing functions, mistakenly choosing RSA or Diffie-Hellman for bulk encryption, or SHA-256 for confidentiality, when symmetric ciphers like AES are the correct choice for high-speed link-layer encryption.

How to eliminate wrong answers

Option A is wrong because RSA is an asymmetric encryption algorithm used primarily for key exchange and digital signatures, not for bulk data encryption; its computational overhead makes it unsuitable for high-speed link-layer encryption. Option B is wrong because Diffie-Hellman is a key exchange protocol, not an encryption algorithm; it establishes a shared secret but does not encrypt data itself. Option D is wrong because SHA-256 is a cryptographic hash function, not an encryption algorithm; it provides integrity and authentication but cannot encrypt or decrypt data.

Full explanation →

483

MCQeasy

A security analyst is hardening a new Windows server. Which configuration would MOST effectively reduce the attack surface by limiting the software that can execute?

A.Enable Windows Defender Antivirus

B.Disable AutoPlay

C.Enable User Account Control (UAC)

D.Configure AppLocker rules

AnswerD

AppLocker provides application whitelisting to control execution.

Why this answer

AppLocker is a whitelisting technology that restricts which applications can run, reducing the attack surface.

Full explanation →

484

Multi-Selecthard

A security engineer is evaluating cloud security tools. Which TWO of the following are primarily used to protect cloud workloads? (Select two.)

Select 2 answers

A.Identity and Access Management (IAM)

B.Cloud Workload Protection Platform (CWPP)

C.Web Application Firewall (WAF)

D.Cloud Security Posture Management (CSPM)

E.Security Information and Event Management (SIEM)

AnswersB, C

CWPP offers runtime protection for cloud workloads.

Why this answer

CWPP provides runtime security for cloud VMs and containers. WAF protects web applications from attacks like SQL injection and XSS. CSPM focuses on misconfiguration detection, not workload runtime.

IAM manages identities. SIEM aggregates logs but is not workload-specific.

Full explanation →

485

MCQhard

During a security incident, the IR team discovers that an attacker used a valid user account to access sensitive data. The account had multifactor authentication (MFA) enabled. Which attack technique most likely bypassed the MFA?

A.Session hijacking

B.MFA fatigue attack

C.Man-in-the-middle (MITM) attack

D.Token theft from the endpoint

AnswerB

The attacker spams MFA requests until the user approves.

Why this answer

MFA fatigue attacks exploit user behavior by bombarding the victim with repeated push notifications until they inadvertently approve an authentication request. Since the attacker already has the valid credentials, they trigger the MFA prompt repeatedly, and the user eventually accepts, granting the attacker access without needing to compromise the MFA mechanism itself.

Exam trap

ISC2 often tests the distinction between technical bypasses (e.g., token theft, MITM) and social/behavioral bypasses (e.g., MFA fatigue), leading candidates to overcomplicate the attack when the simplest explanation—user error under pressure—is correct.

How to eliminate wrong answers

Option A is wrong because session hijacking steals an already-authenticated session token (e.g., via XSS or packet sniffing) and does not involve bypassing MFA at the authentication step; the MFA was already satisfied when the session was created. Option C is wrong because a man-in-the-middle attack intercepts credentials or tokens in transit (e.g., using a rogue access point or SSL stripping) but does not directly cause the user to approve an MFA prompt; it typically targets the authentication handshake, not the user's approval behavior. Option D is wrong because token theft from the endpoint requires physical or remote access to steal a stored OATH token or session cookie, which bypasses MFA by stealing the post-authentication artifact, not by tricking the user into approving a live MFA request.

Full explanation →

486

MCQhard

Which of the following is a characteristic of TLS 1.3 that improves security over previous versions?

A.Reduced cipher suite options including CBC mode

B.Use of RC4 cipher

C.Support for static RSA key exchange

D.Mandatory forward secrecy

AnswerD

TLS 1.3 requires ephemeral key exchange, providing forward secrecy.

Why this answer

TLS 1.3 mandates forward secrecy by requiring ephemeral Diffie-Hellman key exchange, ensuring that session keys cannot be derived if the server's private key is compromised later.

Full explanation →

487

MCQeasy

An organization is hardening its Windows servers. Which built-in Windows feature can be used to enforce application whitelisting, ensuring only approved executables run?

A.BitLocker

B.Windows Defender Antivirus

C.AppLocker

D.User Account Control (UAC)

AnswerC

AppLocker is specifically designed for application whitelisting.

Why this answer

AppLocker provides application whitelisting capabilities in Windows, allowing administrators to control which applications can run based on rules.

Full explanation →

488

MCQmedium

A security administrator notices that a critical server's event log shows repeated failed login attempts from an internal IP address that normally does not generate any traffic. The administrator immediately blocks the IP at the firewall and resets the account password. However, the incident response team later determines that the attacker had already gained access to the server. What is the MOST likely reason the administrator's actions were insufficient?

A.The administrator did not preserve the log evidence for forensic analysis.

B.The administrator neglected to perform a full system scan for malware.

C.The administrator did not isolate the server from the network.

D.The administrator failed to notify the data owner about the incident.

AnswerC

Isolation prevents further access and contains the threat.

Why this answer

The administrator's actions—blocking the IP at the firewall and resetting the password—were insufficient because the attacker had already gained access to the server. Isolating the server (e.g., disconnecting it from the network) would have severed the attacker's active connection and prevented further compromise. Option A is wrong because preserving logs is important for investigation but does not stop an ongoing breach.

Option B is wrong because a malware scan is a remediation step after containment. Option D is wrong because notifying the data owner addresses notification requirements but does not directly contain the threat.

Full explanation →

489

MCQhard

A critical vulnerability with a CVSS score of 9.8 is discovered in a web server that cannot be patched due to vendor dependency. What is the best compensating control?

A.Increase the frequency of vulnerability scans

B.Apply a virtual patch via a WAF

C.Decommission the server immediately

D.Disable the server's network connectivity

AnswerB

A WAF can block exploit attempts as a compensating control.

Why this answer

A WAF can apply a virtual patch by inspecting HTTP/HTTPS traffic and blocking exploit attempts against the unpatched vulnerability. This provides a compensating control at the application layer without modifying the vulnerable server, allowing the server to remain operational while mitigating the risk.

Exam trap

The trap here is that candidates may confuse compensating controls with detection or removal actions, choosing increased scanning (A) as a proactive measure, when in fact only a WAF provides active mitigation at the application layer.

How to eliminate wrong answers

Option A is wrong because increasing vulnerability scan frequency only detects the vulnerability; it does not prevent exploitation, so the risk remains unmitigated. Option C is wrong because decommissioning the server immediately may be too disruptive and is not a compensating control; it is a removal of the asset, not a control that allows continued operation. Option D is wrong because disabling network connectivity effectively removes the server from service, which is a last-resort isolation measure, not a compensating control that permits ongoing functionality.

Full explanation →

490

MCQmedium

Refer to the exhibit. What is the purpose of the 'group 14' parameter in the IKEv2 proposal?

A.Defines the integrity checking method

B.Specifies the encryption algorithm

C.Sets the Diffie-Hellman group for key exchange

D.Indicates the authentication method

AnswerC

Group 14 is a 2048-bit Diffie-Hellman group used for key exchange.

Why this answer

In IKEv2 proposals, the 'group 14' parameter specifies the Diffie-Hellman (DH) group used for the key exchange process. DH group 14 corresponds to a 2048-bit modular exponentiation group, which provides the cryptographic strength for establishing a shared secret over an insecure channel. This is distinct from encryption, integrity, or authentication parameters.

Exam trap

The trap is that candidates often misinterpret 'group' as referring to an integrity or encryption algorithm due to its usage in other networking contexts (e.g., router configuration for routing protocols), but in IKEv2 proposals it specifically denotes the Diffie-Hellman group used for key exchange.

How to eliminate wrong answers

Option A is wrong because integrity checking methods in IKEv2 are defined by the integrity algorithm (e.g., HMAC-SHA256), not by the DH group parameter. Option B is wrong because the encryption algorithm (e.g., AES-256) is specified by a separate 'encr' parameter in the IKEv2 proposal, not by 'group 14'. Option D is wrong because authentication methods (e.g., pre-shared keys, certificates) are configured independently, often under an 'authentication' or 'auth' parameter, and are not related to DH group selection.

Full explanation →

491

MCQmedium

An attacker sends a large number of DHCP request messages with spoofed MAC addresses to a network's DHCP server, causing the server to exhaust its IP address pool and deny service to legitimate clients. This attack is known as:

A.ARP spoofing

B.DNS poisoning

C.DHCP spoofing

D.DHCP starvation

AnswerD

DHCP starvation exhausts the IP pool by sending many fake DHCP requests.

Why this answer

DHCP starvation floods the DHCP server with fake requests to deplete the IP address pool.

Full explanation →

492

MCQeasy

A security analyst receives an alert indicating a large number of failed login attempts from a single IP. The analyst blocks the IP. What should be done next?

A.Report to management

B.Update the firewall rules

C.Conduct a thorough investigation

D.Monitor for recurrence

AnswerC

Investigation is critical to understand if the attack was successful and if other systems are affected.

Why this answer

Blocking an IP address is an immediate containment action, but it does not confirm the root cause or scope of the incident. A thorough investigation is required to determine whether the failed logins were part of a brute-force attack, credential stuffing, or a misconfigured service, and to check for indicators of compromise (IoCs) such as successful logins from the same IP or lateral movement. Without investigation, the analyst risks missing a broader breach or violating incident response procedures like those outlined in NIST SP 800-61.

Exam trap

The trap here is that candidates assume blocking the IP is the final step, confusing containment with resolution, and overlook the mandatory investigation phase required by incident response frameworks like NIST SP 800-61 or SANS PICERL.

How to eliminate wrong answers

Option A is wrong because reporting to management is a step that typically occurs after the incident is fully analyzed and documented, not immediately after a containment action; premature reporting can lead to incomplete or misleading information. Option B is wrong because updating firewall rules is redundant if the IP was already blocked (likely via a firewall or IPS rule), and the priority is to investigate the incident rather than modify rules without understanding the attack vector. Option D is wrong because monitoring for recurrence is a passive step that should follow investigation and remediation; without understanding the cause, monitoring alone cannot prevent the same attack from succeeding via a different IP or method.

Full explanation →

493

Multi-Selecthard

Which THREE of the following are common types of network attacks?

Select 3 answers

A.ARP spoofing

B.SYN flood

C.Pharming

D.DNS poisoning

E.SQL injection

AnswersA, B, D

An attack on the local network to intercept traffic.

Why this answer

ARP spoofing is a network attack where an attacker sends falsified Address Resolution Protocol (ARP) messages onto a local area network. This links the attacker's MAC address with the IP address of a legitimate host, enabling interception, modification, or blocking of traffic intended for that host. It is a classic Layer 2 attack that exploits the lack of authentication in ARP.

Exam trap

ISC2 often tests the distinction between network-layer attacks (like ARP spoofing, SYN flood, DNS poisoning) and application-layer attacks (like SQL injection), causing candidates to mistakenly classify SQL injection as a network attack because it involves network traffic.

Full explanation →

494

MCQmedium

Refer to the exhibit. A security analyst reviews a Windows Security event log entry showing multiple logon failures for user 'admin' from IP 10.0.0.100 within 5 minutes. What type of attack is most likely occurring?

A.Brute force attack

B.Kerberos ticket replay

C.Pass-the-hash attack

D.Privilege escalation

AnswerA

Repeated logon attempts suggest brute force.

Why this answer

Multiple logon failures from a single IP indicate a brute force attack. Pass-the-hash uses captured hashes, not repeated failures. Kerberos ticket replay is different.

Privilege escalation is not indicated.

Full explanation →

495

MCQmedium

A network engineer is troubleshooting a site-to-site VPN that is failing to establish. The pre-shared key is correct and both sides use IKEv2. The VPN logs show 'no proposal chosen'. What is the most likely cause?

A.Firewall blocking UDP port 500

B.Incorrect peer IP address

C.Mismatched encryption algorithms

D.Expired certificates

AnswerC

IKE negotiations require matching proposals; a mismatch in encryption, integrity, or DH group causes 'no proposal chosen'.

Why this answer

The 'no proposal chosen' error in IKEv2 indicates that the two VPN peers cannot agree on a common set of security parameters during the IKE_SA_INIT exchange. Since the pre-shared key is correct and both sides use IKEv2, the most likely cause is a mismatch in the encryption algorithms (e.g., AES-256 vs. AES-128), hash algorithms (e.g., SHA-256 vs.

SHA-1), or Diffie-Hellman groups (e.g., group 14 vs. group 2). This prevents the IKE security association from being established.

Exam trap

ISC2 often tests the distinction between 'no proposal chosen' (which points to a cryptographic parameter mismatch) and 'no response' or 'timeout' (which points to connectivity or firewall issues), leading candidates to incorrectly select firewall blocking when the error message clearly indicates a proposal negotiation failure.

How to eliminate wrong answers

Option A is wrong because a firewall blocking UDP port 500 would typically result in a timeout or 'no response' error, not a specific 'no proposal chosen' message, as the packets would not reach the peer. Option B is wrong because an incorrect peer IP address would cause a connection timeout or 'no route to host' error, as the packets would be sent to the wrong destination, not a proposal mismatch. Option D is wrong because expired certificates are not relevant in a pre-shared key (PSK) authentication scenario with IKEv2; certificate issues would generate authentication failures, not proposal mismatches.

Full explanation →

496

MCQeasy

A university's IT department manages a network used by students and faculty. The security team notices an unusual increase in outbound traffic from the student dormitory network during late hours. Upon investigation, they discover that several student laptops are infected with malware that is attempting to connect to external command-and-control (C2) servers. The team needs to contain the incident quickly while minimizing impact on legitimate users. Which of the following is the BEST immediate containment measure?

A.Shut down the entire dormitory network

B.Disconnect the infected laptops from the network and take them offline for remediation

C.Block all outbound traffic from the dormitory subnet

D.Update the antivirus definitions on the infected laptops

AnswerB

This isolates the threat specifically, preserving network functionality for others.

Why this answer

Isolating the infected devices from the network stops the C2 communication and prevents further spread, while allowing other users to continue working. Option A may block all students; C is disruptive to everyone; D does not stop communication.

Full explanation →

497

Multi-Selectmedium

Which TWO of the following are effective methods for monitoring risk in real-time?

Select 2 answers

A.User access reviews

B.Security information and event management (SIEM) systems

C.Quarterly vulnerability scanning

D.Annual penetration testing

E.Intrusion detection systems (IDS)

AnswersB, E

SIEM collects and analyzes logs in real-time.

Why this answer

Security information and event management (SIEM) systems aggregate and correlate logs from multiple sources in real-time, enabling immediate detection and response to security incidents. They provide continuous monitoring and alerting, which is essential for real-time risk management.

Exam trap

The trap here is that candidates confuse periodic review activities (like access reviews or vulnerability scans) with real-time monitoring, failing to recognize that only SIEM and IDS provide continuous, automated analysis of live data.

Full explanation →

498

MCQhard

A medium-sized e-commerce company uses a SIEM with correlation rules. During peak sales hours, the SIEM generates an alert: multiple failed login attempts from internal IP 172.16.10.50 followed by a successful login to a critical database server. The account used is 'dbadmin', which normally only authenticates from the IT department subnet. The user 'dbadmin' reports that they had to try several passwords because they forgot theirs earlier. The incident responder is under pressure to quickly restore normal operations. Which course of action should the responder take?

A.Block the user's account immediately to prevent any further access.

B.Reset the user's password and enable multi-factor authentication (MFA).

C.Dismiss the alert as a false positive since the user explained the failed attempts.

D.Investigate the user's recent activity, check for abnormal logins, and look for lateral movement from the source IP.

AnswerD

Thorough investigation is warranted given the anomalous source IP and the critical nature of the target.

Why this answer

While the user's explanation seems plausible, the alert indicates a deviation from normal behavior (logins from an unexpected subnet). The responder should investigate the user's recent activity, check for abnormal logins, and look for lateral movement from the source IP to rule out a potential compromise. Option A (blocking the user's account immediately) could be disruptive if it's a false positive and may prevent legitimate access.

Option B (resetting password and enabling MFA) is a good security measure but does not address the need to verify whether the account was actually compromised or if there is ongoing malicious activity. Option C (dismissing the alert as a false positive) is premature and ignores the possibility of credential stuffing or account takeover. Therefore, investigating further is the most appropriate course of action.

Full explanation →

499

Multi-Selectmedium

An incident responder is collecting volatile evidence from a compromised Linux server. Which TWO of the following should be collected first? (Select two.)

Select 2 answers

A.Disk image of the system drive

B.System log files from /var/log

C.Hardware configuration inventory

D.List of active network connections using netstat

E.Contents of RAM using LiME

AnswersD, E

Network connections are volatile and should be captured early.

Why this answer

In incident response, volatile data is data that will be lost when the system is powered off. Active network connections (captured via netstat) and the contents of RAM (captured via LiME) are the most volatile, as they change constantly and are lost immediately upon shutdown. Collecting these first preserves critical evidence of current attacker activity and in-memory artifacts like rootkits or encryption keys.

Exam trap

In the SSCP exam, the order of volatility is a key concept for incident response. The trap is that candidates mistakenly prioritize disk-based artifacts (logs, images) over truly volatile data like RAM and network connections, which are lost on power-off.

Full explanation →

500

MCQeasy

Which authentication method generates a one-time password that is valid for only a short time window?

A.Biometric scan

B.HMAC-based One-Time Password (HOTP)

C.Static password

D.Time-based One-Time Password (TOTP)

AnswerD

TOTP uses time as a variable, changing codes periodically.

Why this answer

Time-based One-Time Password (TOTP) uses the current time to generate a code that expires after a short interval (e.g., 30 seconds).

Full explanation →

501

MCQhard

A PKI administrator needs to check the revocation status of a digital certificate without requiring the client to download the entire CRL. Which method is designed for online, real-time certificate status checking?

A.OCSP

B.OCSP stapling

C.CRL

D.Certificate transparency

AnswerA

OCSP provides real-time status.

Why this answer

OCSP (Online Certificate Status Protocol) allows real-time checking of a certificate's revocation status without downloading the full CRL.

Full explanation →

502

MCQmedium

An organization's security team detects a potential data breach. After confirming the incident, they classify it as P2 (high severity) and begin containment. Which action should be performed FIRST to preserve evidence for forensic analysis?

A.Disconnect the system from the network

B.Capture a memory dump using a tool like Magnet RAM Capture

C.Create a forensic image of the hard drive

D.Run an antivirus scan to remove malware

AnswerB

Correct. Memory contains volatile evidence that is lost when power is removed.

Why this answer

When a high-severity incident (P2) is confirmed, the first priority for forensic preservation is capturing volatile data, which includes system memory (RAM). A memory dump using a tool like Magnet RAM Capture preserves running processes, network connections, encryption keys, and malware in memory that would be lost on shutdown or disconnection. This order follows the volatility principle: capture the most volatile data first before any other action that could alter the system state.

Exam trap

The trap here is that candidates often choose 'Disconnect the system from the network' first, thinking containment is the immediate priority, but the SSCP exam emphasizes that evidence preservation (starting with volatile data) must precede containment actions to avoid destroying forensic artifacts.

How to eliminate wrong answers

Option A is wrong because disconnecting from the network first would cause loss of volatile network connections, active sessions, and memory-resident artifacts; it also may trigger anti-forensic mechanisms in malware. Option C is wrong because creating a forensic image of the hard drive is a non-volatile step that should occur after memory capture, as disk imaging can overwrite slack space or alter timestamps if done prematurely. Option D is wrong because running an antivirus scan modifies the system state (e.g., quarantining or deleting files) and destroys evidence; scanning is a remediation step, not a preservation step.

Full explanation →

503

MCQeasy

Which Windows feature allows an administrator to define security policies such as password complexity and account lockout across multiple systems in a domain?

A.Local Security Policy

B.Security Audit Policies

C.Group Policy

D.User Account Control (UAC)

AnswerC

Group Policy centrally manages security settings for multiple systems.

Why this answer

Group Policy enforces security settings across Active Directory domain-joined systems. Local Security Policy only affects the local machine. UAC controls elevation.

Security Audit Policies are part of Group Policy but not the overarching feature.

Full explanation →

504

MCQeasy

Based on the exhibit, what type of attack is most likely occurring?

A.Brute-force attack

B.Pass-the-hash attack

C.Dictionary attack

D.Password spraying attack

AnswerD

Password spraying attempts one or a few common passwords across many accounts, matching the pattern.

Why this answer

The exhibit shows a scenario where an attacker attempts a small number of common passwords (e.g., one or a few) against many different usernames. This low-and-slow approach avoids triggering account lockout policies, which is the hallmark of a password spraying attack. Unlike dictionary attacks (many passwords on a single user) or brute-force attacks (exhaustive password guessing on one account), password spraying targets multiple accounts with commonly used passwords to increase success rates while staying under detection thresholds.

Exam trap

The trap here is confusing dictionary attacks (many passwords, one user) with password spraying (one password, many users), as both use a wordlist but differ in the attack vector and lockout avoidance strategy.

How to eliminate wrong answers

Option A is wrong because a brute-force attack tries all possible character combinations systematically, not a curated list of likely passwords, and would generate far more attempts than shown. Option B is wrong because a pass-the-hash attack uses captured NTLM or Kerberos hashes to authenticate without knowing the plaintext password, which is unrelated to trying passwords from a list. Option C is wrong because a dictionary attack focuses on many passwords against a single username, whereas the exhibit shows a single password attempt across multiple usernames, which is the hallmark of password spraying.

Full explanation →

505

MCQmedium

A company wants to implement a key management system. They need to generate cryptographic keys that are unpredictable. Which source of randomness should be used?

A.Hardware random number generator (HRNG)

B.Random numbers from a website

C.Linear congruential generator (LCG)

D.Pseudorandom number generator (PRNG) seeded with current timestamp

AnswerA

HRNGs provide high-quality entropy suitable for key generation.

Why this answer

A hardware random number generator (HRNG) is the correct choice because it derives randomness from physical processes (e.g., thermal noise, quantum effects) that are inherently unpredictable and non-deterministic. Cryptographic key generation requires true entropy to resist brute-force and prediction attacks, which software-based deterministic methods cannot guarantee.

Exam trap

ISC2 SSCP often tests the misconception that a PRNG seeded with a timestamp is sufficient for cryptography, but the trap is that timestamps are predictable or guessable, making the output deterministic and insecure for key generation.

How to eliminate wrong answers

Option B is wrong because random numbers from a website are sourced over an untrusted network and may be intercepted, reused, or generated by a pseudorandom algorithm, offering no verifiable entropy. Option C is wrong because a linear congruential generator (LCG) is a deterministic, predictable algorithm with a short period, making it unsuitable for cryptographic key generation. Option D is wrong because a pseudorandom number generator (PRNG) seeded with a current timestamp is deterministic; if the timestamp is guessed or observed, all outputs become predictable, violating the unpredictability requirement.

Full explanation →

506

MCQhard

A security analyst reviews a firewall log showing an internal IP attempting outbound connections to multiple external IPs on port 443. The analyst suspects command and control. Which additional data source would be MOST useful for confirmation?

A.NetFlow data

B.System event logs

C.DNS logs

D.Antivirus logs

AnswerC

DNS logs can show domain resolutions, often used by C2 to obfuscate IPs.

Why this answer

DNS logs are the most useful additional data source because C2 traffic often uses domain generation algorithms (DGAs) or connects to known malicious domains. By correlating the outbound connections on port 443 with DNS queries, the analyst can identify suspicious domain lookups that precede the connections, revealing the C2 infrastructure. Unlike NetFlow or system logs, DNS logs directly show the domain names being resolved, which is a key indicator of C2 activity.

Exam trap

The trap here is that candidates often choose NetFlow data (Option A) because it shows traffic flows, but they overlook that DNS logs directly reveal the domain names being resolved, which is critical for identifying C2 domains that may not appear in NetFlow's IP-only view.

How to eliminate wrong answers

Option A is wrong because NetFlow data provides metadata about traffic flows (source/destination IPs, ports, and volume) but does not include the domain names or DNS queries, making it less effective for identifying C2 domains. Option B is wrong because system event logs record local OS events (e.g., process creation, logins) and do not directly capture network-level DNS queries or outbound connection destinations. Option D is wrong because antivirus logs focus on file-based malware detections and may miss network-only C2 activity, especially if the malware is fileless or uses encrypted channels.

Full explanation →

507

MCQhard

You are the security administrator for a mid-sized financial services company. The company uses Active Directory (AD) for identity management and has implemented role-based access control (RBAC) for its core banking application. Recently, the company acquired a smaller firm and is integrating its employees into AD. During the integration, you notice that many of the new employees have been assigned multiple roles that grant them access to sensitive financial data, despite their job descriptions indicating they need only limited access. Additionally, some users who left the acquired company have not been disabled in AD. The company's security policy mandates the principle of least privilege and requires that access reviews be conducted quarterly, but no review has been performed in the past year. You have been tasked with remediating these issues. Which of the following approaches is the MOST effective initial step to address the immediate risk of excessive access?

A.Conduct a comprehensive access recertification review for all users in the acquired company.

B.Implement multifactor authentication (MFA) for all users in the acquired company.

C.Roll back all user permissions to the default role and then re-add each user based on their job function.

D.Immediately disable all user accounts from the acquired company that have not been logged in within the last 90 days.

AnswerD

This quickly removes dormant accounts that may have excessive privileges.

Why this answer

The most effective initial step because it immediately reduces the attack surface by disabling accounts that are likely orphaned (no login in 90 days), directly addressing the immediate risk of excessive access from former employees. This aligns with the principle of least privilege and is a quick, high-impact remediation that can be performed before a full access review or recertification.

Exam trap

The trap here is that candidates often choose a comprehensive review (Option A) as the 'best practice' without recognizing that immediate risk mitigation (disabling orphaned accounts) must precede a full recertification to prevent further exposure during the review process.

How to eliminate wrong answers

Option A is wrong because conducting a comprehensive access recertification review is a longer-term process that does not address the immediate risk of orphaned accounts or excessive permissions; it should follow initial containment. Option B is wrong because implementing MFA strengthens authentication but does not reduce excessive access or remove orphaned accounts; it addresses a different risk (unauthorized access via compromised credentials) rather than the immediate risk of already-assigned excessive permissions. Option C is wrong because rolling back all user permissions to a default role and re-adding them is disruptive, time-consuming, and may cause business interruption; it also assumes a clean baseline that may not exist and does not prioritize the highest-risk accounts (orphaned ones) first.

Full explanation →

508

MCQmedium

An organization wants to ensure that only corporate-managed devices can connect to the internal network. Non-compliant devices should be placed in a restricted VLAN with limited access. Which technology should be deployed?

A.Virtual Private Network (VPN)

B.Network Access Control (NAC)

C.Stateful firewall

D.Intrusion Prevention System (IPS)

AnswerB

NAC integrates with authentication to enforce compliance and VLAN assignment.

Why this answer

Network Access Control (NAC) with 802.1X can enforce policies, quarantine non-compliant devices, and assign appropriate VLANs.

Full explanation →

509

Multi-Selectmedium

Which TWO are valid reasons to revoke a user's access? (Choose two.)

Select 2 answers

A.User is terminated

B.User changes job roles

C.User password expires

D.User completes quarterly training

E.User updates personal information

AnswersA, B

Termination requires immediate revocation of all access.

Why this answer

When a user is terminated, their access must be immediately revoked to prevent unauthorized access to systems and data. This is a fundamental principle of access control, ensuring that former employees cannot exploit their credentials. Revocation typically involves disabling the user account, removing group memberships, and invalidating any active sessions or tokens.

Exam trap

The trap here is that candidates confuse password expiration (a temporary lockout that can be resolved) with revocation (a permanent or indefinite removal of access rights), and they may think that completing training or updating personal info could justify revocation, but these are normal user lifecycle events that do not indicate a security risk.

Full explanation →

510

Multi-Selecthard

Which three statements are true regarding mandatory access control (MAC) systems? (Select THREE)

Select 3 answers

A.Multilevel security is enforced

B.Subjects have clearance levels

C.Access decisions are based on security labels

D.The owner of an object can change its security label

E.Users can grant permissions to other users

AnswersA, B, C

MAC systems are designed to enforce multilevel security, allowing information at different classifications to be processed on the same system.

Why this answer

Mandatory Access Control (MAC) enforces system-wide policy based on security labels assigned to subjects and objects. Multilevel security (MLS) is a core MAC property where data at different classification levels (e.g., Secret, Top Secret) is isolated and access is governed by the system, not users. Subjects (users/processes) are assigned clearance levels, and objects have security labels; access decisions compare these labels using rules like the Bell-LaPadula model (no read up, no write down).

Exam trap

The trap here is that candidates confuse MAC with Discretionary Access Control (DAC), where owners can change permissions and grant access, leading them to incorrectly select options D or E as true for MAC.

Full explanation →

511

MCQhard

An organization is restoring a critical database from a backup after a ransomware attack. Which of the following steps should be performed BEFORE restoring the data to ensure the restoration is successful and secure?

A.Notify users that the system will be available in one hour

B.Disconnect the backup server from the network

C.Immediately restore the most recent backup to minimize data loss

D.Verify the integrity of the backup and patch the exploited vulnerability

AnswerD

This ensures the backup is clean and the system is hardened before restoration.

Why this answer

Verifying backup integrity (e.g., using checksums or restore tests) ensures the backup is not corrupted or incomplete, which is critical after a ransomware attack where backups may also be targeted. Patching the exploited vulnerability (e.g., applying a security update or disabling the vulnerable service) prevents re-infection during or after the restore, ensuring the recovery is secure. Without these steps, restoring a compromised or incomplete backup could lead to data loss or immediate re-encryption by the same ransomware.

Exam trap

The trap here is that candidates assume restoring the most recent backup is always the priority, but the SSCP exam emphasizes that verifying backup integrity and securing the environment against re-infection are mandatory prerequisites for a successful and secure recovery.

How to eliminate wrong answers

Option A is wrong because notifying users of a one-hour availability before verifying the backup or patching the vulnerability is premature and unrealistic; restoration time depends on backup size and integrity checks, and users should only be notified after a successful restore and testing. Option B is wrong because disconnecting the backup server from the network is a good practice during recovery to prevent ransomware spread, but it is not the step that ensures restoration success and security—it is a containment measure that should be done before or during the restore, not the critical prerequisite for a successful restore. Option C is wrong because immediately restoring the most recent backup without verifying its integrity risks restoring a corrupted or encrypted backup (common in ransomware attacks where backups are also encrypted), and without patching the vulnerability, the system will be immediately re-infected.

Full explanation →

512

MCQhard

A security analyst reviews firewall logs and sees multiple 'ACL drop' entries for a specific internal IP trying to connect to a database server on port 1433. The rule base has an explicit permit for this traffic. What is the most likely reason for the drops?

A.The firewall rule is disabled

B.The database server is down

C.An earlier deny rule matches the traffic before the permit rule

D.The internal IP is on a blacklist

AnswerC

Rule ordering is critical; a preceding deny rule that matches the same traffic will cause drops even if a later permit exists.

Why this answer

The most likely reason for the ACL drops despite an explicit permit rule is that an earlier deny rule in the firewall rule base matches the traffic before the permit rule. Firewalls process ACL rules sequentially from top to bottom; the first matching rule determines the action. If a deny rule appears before the permit rule and matches the source IP, destination port, or other criteria, the traffic is dropped before reaching the permit entry.

Exam trap

The trap here is that candidates assume an explicit permit rule guarantees traffic flow, but they forget that ACLs are processed top-down and an earlier deny rule can override a later permit rule.

How to eliminate wrong answers

Option A is wrong because if the firewall rule were disabled, the traffic would not match any rule and would be subject to the default implicit deny, but the logs specifically show 'ACL drop' entries, which indicate a rule explicitly denied the traffic. Option B is wrong because a down database server would cause connection timeouts or TCP RSTs, not ACL drops; ACL drops occur at the firewall layer before any server interaction. Option D is wrong because blacklists are typically implemented as separate threat intelligence feeds or dynamic block lists, not as standard ACL rules; if the IP were on a blacklist, it would still be matched by an earlier deny rule, not by a separate 'blacklist' mechanism in the ACL.

Full explanation →

513

Multi-Selecthard

Which THREE steps are essential during the identification phase of incident response?

Select 3 answers

A.Eradicate the threat

B.Notify stakeholders

C.Monitor logs and alerts

D.Determine scope of incident

E.Classify incident severity

AnswersC, D, E

Continuous monitoring is key to detecting anomalies.

Why this answer

During the identification phase of incident response, the essential steps are monitoring logs and alerts (C) to detect potential incidents, determining the scope of the incident (D) to understand its impact, and classifying incident severity (E) to prioritize response. Options A and B are not part of identification; eradication occurs later in the response phase, and stakeholder notification typically happens after identification and analysis.

Full explanation →

514

MCQeasy

Which wireless encryption protocol is currently considered the most secure for home use?

A.WPA2-Enterprise

B.WPA3-Personal

C.WEP (Wired Equivalent Privacy)

D.WPA2-PSK

AnswerB

WPA3-Personal is the latest standard with enhanced security.

Why this answer

WPA3-Personal is currently the most secure wireless encryption protocol for home use because it replaces the Pre-Shared Key (PSK) model with Simultaneous Authentication of Equals (SAE), which provides forward secrecy and protects against offline dictionary attacks. Unlike WPA2, WPA3 mandates the use of GCMP-256 encryption and disables legacy TKIP, ensuring robust confidentiality and integrity for home networks.

Exam trap

ISC2 often tests the misconception that WPA2-Enterprise is inherently more secure than WPA3-Personal for all environments, but the question specifically asks for home use, where WPA3-Personal's SAE and forward secrecy provide superior security without the complexity of a RADIUS server.

How to eliminate wrong answers

Option A is wrong because WPA2-Enterprise is designed for corporate environments with a RADIUS server for 802.1X authentication, not for typical home use, and it does not offer the forward secrecy or SAE improvements of WPA3. Option C is wrong because WEP (Wired Equivalent Privacy) uses the RC4 stream cipher with a static key and is trivially broken in minutes using tools like aircrack-ng, making it completely insecure. Option D is wrong because WPA2-PSK relies on a pre-shared key and the 4-way handshake, which is vulnerable to offline dictionary attacks (e.g., using captured handshakes and tools like Hashcat), and it lacks the forward secrecy and SAE protection of WPA3.

Full explanation →

515

MCQhard

A security analyst reviews log files and sees multiple failed SSH attempts from various IP addresses. The analyst implements a rate-limiting rule on the firewall to block IPs after 5 failed attempts in 10 minutes. This is an example of which type of security control?

A.Compensating

B.Preventive

C.Detective

D.Deterrent

E.Corrective

AnswerB

Rate-limiting blocks attacks before they succeed.

Why this answer

Rate-limiting SSH attempts by blocking IPs after 5 failed attempts in 10 minutes is a preventive control because it actively stops unauthorized access before it can occur. By enforcing a threshold on the firewall, the control reduces the attack surface against brute-force attacks, directly preventing further authentication attempts from suspicious sources.

Exam trap

Candidates often mistake preventive controls for deterrent controls. Preventive controls physically block the action (e.g., firewall rate-limiting), while deterrent controls only discourage (e.g., warning banners). This question's firewall rule actively blocks further attempts, making it preventive.

How to eliminate wrong answers

Option A is wrong because compensating controls are alternative measures that provide equivalent protection when a primary control cannot be implemented (e.g., using out-of-band authentication instead of a smart card), not a proactive block on SSH attempts. Option C is wrong because detective controls identify and log malicious activity after it happens (e.g., IDS alerts), whereas this firewall rule blocks attempts in real time. Option D is wrong because deterrent controls discourage attackers through fear of consequences (e.g., warning banners), but they do not physically or logically prevent the action.

Option E is wrong because corrective controls remediate damage after an incident (e.g., restoring from backup), not preemptively limiting failed logins.

Full explanation →

516

MCQmedium

A financial services firm with 500 servers and 2000 workstations uses an internal public key infrastructure (PKI) for authentication and secure communication. The root CA certificate is self-signed and stored on an offline root CA server. Recently, the root CA server was physically stolen from a locked data center. Although the server was encrypted, forensic analysis confirms that the root CA private key was extracted. The security team must immediately revoke trust in the compromised root CA and issue new certificates to all devices. The environment includes Active Directory and Group Policy. Which approach best ensures all systems trust the new CA hierarchy and obtain valid certificates with minimal disruption?

A.Generate a new root CA, sign new subordinate CAs, distribute the new root via Group Policy, and re-issue all end-entity certificates.

B.Publish a certificate revocation list (CRL) and wait for existing certificates to expire.

C.Generate a new root CA certificate and key, then re-issue all subordinate CA certificates without re-issuing end-entity certificates.

D.Enable OCSP stapling on all web servers to check revocation status in real time.

AnswerA

This ensures all systems trust the new CA hierarchy and have valid certificates.

Why this answer

The root CA private key has been compromised, requiring the entire PKI hierarchy to be rebuilt from scratch. A new self-signed root CA must be generated, new subordinate CAs signed under it, and all end-entity certificates re-issued to devices. Distributing the new root CA certificate via Active Directory Group Policy ensures that all domain-joined systems trust the new hierarchy automatically, minimizing manual intervention and disruption.

Exam trap

The trap here is that candidates may think re-issuing only subordinate CAs (Option C) is sufficient, overlooking that end-entity certificates signed by the compromised root remain untrusted and must also be replaced to restore a valid chain of trust.

How to eliminate wrong answers

Option B is wrong because publishing a CRL only revokes trust in the compromised root CA but does not establish a new trusted hierarchy; waiting for existing certificates to expire leaves systems vulnerable and without valid certificates for an extended period. Option C is wrong because re-issuing subordinate CA certificates without re-issuing end-entity certificates leaves all existing end-entity certificates signed by the compromised root CA still in use, which are untrusted and cannot be validated. Option D is wrong because OCSP stapling is a revocation checking mechanism, not a method to replace a compromised root CA or issue new certificates; it does not address the need to establish a new trust anchor.

Full explanation →

517

MCQmedium

During incident response, a team needs to isolate an infected workstation that is part of a critical manufacturing network. Which containment method is MOST appropriate to minimize disruption while preventing the spread of malware?

A.Place the workstation into a quarantine VLAN via switch configuration

B.Apply a host-based firewall rule to block all inbound traffic

C.Physically unplug the network cable

D.Disable the user's Active Directory account

AnswerA

Correct. VLAN quarantine isolates the device while allowing limited access for forensics.

Why this answer

Placing the workstation into a quarantine VLAN via switch configuration is most appropriate because it logically isolates the infected host from the rest of the network at Layer 2, preventing lateral spread of malware while allowing the manufacturing network to continue operating. This method uses 802.1Q VLAN tagging and access control lists (ACLs) on the switch to restrict traffic without physically disconnecting the device, which could disrupt time-sensitive manufacturing processes. It also preserves the ability to remotely manage or forensically image the workstation if needed.

Exam trap

The trap here is that candidates often choose 'physically unplug the network cable' because it seems like the most definitive containment, but they overlook the requirement to minimize disruption in a critical manufacturing network where sudden disconnection can halt production or cause safety hazards.

How to eliminate wrong answers

Option B is wrong because applying a host-based firewall rule to block all inbound traffic does not prevent the infected workstation from initiating outbound connections to spread malware to other systems, and it relies on the compromised host's own software, which may be disabled or bypassed by the malware. Option C is wrong because physically unplugging the network cable completely removes the workstation from the network, which can cause immediate disruption to critical manufacturing processes that depend on that workstation for real-time control or monitoring. Option D is wrong because disabling the user's Active Directory account only prevents authentication and access to domain resources, but does not stop the workstation from communicating with other devices on the same subnet or from spreading malware via non-authenticated protocols like ARP or NetBIOS.

Full explanation →

518

MCQhard

After containing a ransomware incident, the incident response team identifies that the attacker gained initial access through a phishing email that installed a backdoor. Which of the following eradication steps is MOST critical to prevent re-infection?

A.Resetting all user passwords

B.Reimaging all affected systems from a known-good backup

C.Removing the backdoor executable and associated persistence mechanisms

D.Conducting security awareness training for all employees

AnswerC

Directly removing the backdoor prevents it from being used again. Combined with patching, this is critical.

Why this answer

In the eradication phase, the immediate priority is to remove the attacker's direct access and persistence mechanisms. While reimaging (Option B) also removes the backdoor, it is a more time-consuming and disruptive approach that may not be necessary for all systems. Removing the backdoor executable and persistence mechanisms (e.g., scheduled tasks, registry Run keys) directly eliminates the attacker's foothold, preventing re-infection from the same vector without the overhead of full reimaging.

Password resets (Option A) and training (Option D) are important but address different phases (recovery and prevention) and do not directly remove the existing backdoor.

Exam trap

The trap here is that candidates often confuse eradication with recovery or prevention, choosing reimaging (Option B) or training (Option D) instead of recognizing that removing the attacker's specific foothold is the immediate technical priority to stop re-infection.

How to eliminate wrong answers

Option A is wrong because resetting user passwords addresses credential compromise but does not remove the backdoor or its persistence; the attacker can still re-enter via the backdoor without needing a password. Option B is wrong because reimaging from a known-good backup is a valid recovery step, but it is not the most critical eradication step—it is a more drastic measure that may not be necessary if the backdoor can be surgically removed, and it does not address the root cause of the initial compromise (the phishing vector). Option D is wrong because security awareness training is a preventive measure that reduces future risk but does not eradicate the existing backdoor or persistence mechanisms already present on affected systems.

Full explanation →

519

MCQmedium

During a security awareness training session, an employee asks how to identify a phishing email. Which of the following is the most reliable indicator of a phishing attempt?

A.The email contains an attachment from an unknown sender

B.The email has grammatical errors or misspellings

C.The email creates a sense of urgency or threatens negative consequences

D.The email address of the sender closely resembles a legitimate domain

AnswerC

Urgency and threats are classic phishing tactics designed to bypass rational thinking.

Why this answer

Phishing emails often contain urgent or threatening language to prompt immediate action. While other indicators like misspellings can be present, the most reliable is the use of urgency or threats, which is a common social engineering tactic.

Full explanation →

520

MCQeasy

Which of the following protocols operates on TCP port 443 and provides encrypted communication between a web browser and a web server?

A.HTTPS

B.SMTP

C.SSH

D.HTTP

AnswerA

HTTPS uses TCP port 443 with TLS/SSL encryption.

Why this answer

HTTPS uses TLS/SSL over TCP port 443 to secure HTTP traffic.

Full explanation →

521

Multi-Selectmedium

An organization uses a hot disaster recovery (DR) site and has a Recovery Time Objective (RTO) of 4 hours. During a DR test, the team discovers that data replication from the primary site fails. Which TWO actions should the team take to meet the RTO while ensuring data integrity? (Choose two.)

Select 2 answers

A.Verify the integrity of the backup before restoration using hash checks.

B.Extend the RTO to allow time for manual data re-entry.

C.Failover to the hot DR site immediately without data restoration.

D.Restore the latest valid backup from the primary site to the DR site.

E.Switch to a cold DR site that requires hardware setup.

AnswersA, D

Ensuring backup integrity prevents restoring corrupted or infected data.

Why this answer

Verifying the integrity of the backup using hash checks (e.g., SHA-256 or MD5) ensures that the data has not been corrupted during storage or transfer, which is critical before restoration to maintain data integrity. Option D is correct because restoring the latest valid backup from the primary site to the DR site provides a known-good data set, allowing the organization to meet the 4-hour RTO by having a consistent state to failover to, even if replication has failed.

Exam trap

A common misconception is that failing over to a hot site immediately is sufficient, but the trap here is that without verifying and restoring a valid backup, the DR site may contain corrupted or incomplete data, breaking data integrity requirements.

Full explanation →

522

MCQhard

You are the security administrator for a healthcare organization that uses a Windows Active Directory domain. The organization has recently implemented a new electronic health record (EHR) system that requires users to authenticate before accessing patient data. The EHR system uses Kerberos for authentication. Users report that they can access the EHR system from their office workstations, but when they attempt to access it remotely via VPN, they receive an 'Access Denied' error. The VPN uses RADIUS for authentication and assigns IP addresses from a separate subnet. The EHR server is in the same domain as the workstations. You verify that the users are able to connect to the VPN successfully and can access other internal resources. What is the most likely cause of the issue?

A.The EHR server is not joined to the domain.

B.The VPN does not forward Kerberos traffic to the domain controller.

C.The remote user's system clock is not synchronized with the domain controller.

D.The user's account is not in the EHR application's access group.

AnswerC

Kerberos requires time sync; VPN issues often corrupt time sync.

Why this answer

Kerberos authentication is highly sensitive to time skew; the default maximum tolerance is 5 minutes (RFC 4120). When users connect via VPN, their system clocks may drift from the domain controller's time, especially if they are not synchronized with the domain's time source. This time difference causes Kerberos to reject the ticket request, resulting in an 'Access Denied' error even though the VPN connection itself is successful.

Exam trap

The trap here is that candidates focus on network connectivity or VPN configuration (like port forwarding) rather than the time synchronization requirement of Kerberos, assuming that successful VPN connection implies all authentication protocols will work seamlessly.

How to eliminate wrong answers

Option A is wrong because the EHR server is explicitly stated to be in the same domain as the workstations, and users can access it from office workstations, confirming domain membership. Option B is wrong because the VPN successfully forwards other traffic (users can access other internal resources), and Kerberos traffic uses UDP/TCP port 88, which is typically allowed through VPN tunnels; the issue is not traffic forwarding but authentication failure. Option D is wrong because the error occurs during authentication, not authorization; if the user were not in the EHR application's access group, they would likely receive a different error (e.g., 'Access Denied' after successful authentication) or be prompted for credentials again, not fail at the Kerberos ticket-granting step.

Full explanation →

523

MCQmedium

A security auditor discovers that a Linux server has a user who can execute any command as root via sudo without a password. Which file should be reviewed to verify this configuration?

A./etc/shadow

B./etc/group

C./etc/sudoers

D./etc/passwd

AnswerC

sudoers defines which users can run which commands as which users, including NOPASSWD option.

Why this answer

The /etc/sudoers file controls sudo privileges. It can be edited with visudo. A NOPASSWD entry would allow passwordless sudo.

Full explanation →

524

MCQhard

In a Bell-LaPadula model implementation, a user with a Secret clearance attempts to read a document classified as Top Secret. Additionally, they try to write to a document classified as Unclassified. What are the results of these actions?

A.Read denied, write allowed

B.Read allowed, write allowed

C.Read denied, write denied

D.Read allowed, write denied

AnswerC

Correct. Both actions are denied.

Why this answer

Bell-LaPadula enforces *no read up* (simple security property) and *no write down* (*-property). Thus reading Top Secret is denied, and writing to Unclassified is also denied to prevent leakage.

Full explanation →

525

MCQeasy

Based on the exhibit, which type of attack is most likely occurring?

A.Denial of service.

B.Brute force attack.

C.Dictionary attack.

D.Man-in-the-middle.

AnswerB

Multiple rapid failed attempts for the same user from one IP is characteristic of brute force.

Why this answer

The exhibit shows a high number of failed authentication attempts (e.g., 1000+ failures) from a single source IP within a short time window, targeting a specific user account. This pattern is characteristic of a brute force attack, where an attacker systematically tries many password combinations to gain unauthorized access. Unlike a dictionary attack, which uses a predefined list of likely passwords, a brute force attack exhaustively tests all possible combinations, as indicated by the sheer volume of attempts.

Exam trap

The trap here is that candidates may confuse a brute force attack with a dictionary attack, but the key differentiator is the exhaustive, non-selective nature of the attempts versus the use of a precompiled wordlist.

How to eliminate wrong answers

Option A is wrong because a denial of service (DoS) attack aims to overwhelm system resources or disrupt service availability, not to repeatedly attempt authentication. Option C is wrong because a dictionary attack uses a curated list of common passwords or phrases, not the exhaustive, high-volume attempts shown in the exhibit. Option D is wrong because a man-in-the-middle (MITM) attack involves intercepting or altering communications between two parties, not directly targeting authentication endpoints with repeated login attempts.

Full explanation →

Page 7 of 13

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13

Practice SSCP by domain

Target a specific domain to shore up weak areas.

Access Controls Risk Identification, Monitoring, and Analysis Incident Response and Recovery Security Operations and Administration Cryptography Network and Communications Security Systems and Application Security

See all domains with question counts →