920 questions total · 13pages · All types, answers revealed
Which of the following is a common defense against ARP spoofing attacks on a local area network?
DAI validates ARP packets to prevent spoofing.
Why this answer
Dynamic ARP Inspection (DAI) validates ARP packets against a trusted database (DHCP snooping binding), preventing spoofed ARP messages.
During a security assessment, you discover that a Windows server has the Telnet service running. Which of the following is the BEST action to harden the server against this finding?
This removes an insecure service and replaces it with a secure alternative (SSH), which is a best practice for system hardening.
Why this answer
Telnet is an unencrypted protocol that transmits credentials in cleartext. Removing unnecessary services reduces the attack surface; disabling Telnet eliminates a known vulnerability.
Application proxies terminate and inspect application-layer traffic.
SSL/TLS VPN uses TLS and is used by AnyConnect.
Why this answer
SSL/TLS VPNs use TLS to provide secure remote access, often with AnyConnect client.
A security administrator is implementing an access control model that assigns permissions based on the clearance of the subject and the classification of the object. Which model is being implemented?
MAC uses clearance and classification labels.
Why this answer
Mandatory Access Control (MAC) uses labels for subjects (clearance) and objects (classification) to enforce access decisions, commonly used in government and military environments.
A network administrator notices that legitimate clients are unable to obtain IP addresses from the DHCP server. The network logs show a high volume of DHCP Discover messages from different MAC addresses. Which attack is most likely occurring?
A high volume of DHCP Discover messages from fake MACs is characteristic of a DHCP starvation attack.
Why this answer
DHCP starvation floods the network with fake DHCP Discover messages to exhaust the IP address pool, preventing legitimate clients from obtaining addresses.
Which TWO are benefits of network segmentation using VLANs? (Choose two.)
Traffic in one VLAN cannot directly reach another VLAN.
Why this answer
VLANs segment a network into separate broadcast domains at Layer 2. By isolating traffic between VLANs, they prevent unauthorized access and contain potential threats, which directly improves security. Additionally, because each VLAN is its own broadcast domain, broadcast frames are confined to that VLAN, reducing overall broadcast traffic on the network.
Exam trap
ISC2 often tests the misconception that VLANs increase bandwidth, when in fact they only reduce unnecessary traffic (like broadcasts) but do not add physical throughput.
A forensic analyst needs to review security events from multiple Windows servers. To ensure that logs are centrally collected and resistant to tampering, which of the following should be implemented?
This centralizes logs and can be configured to forward even when the server is compromised, preserving evidence.
Why this answer
Centralized logging with a SIEM (or similar) aggregates logs from multiple sources. Forwarding events to a central collector ensures logs are preserved even if a server is compromised.
A vulnerability management program requires that critical vulnerabilities be remediated within 72 hours. A scanner identifies a critical vulnerability on a server, but after patching, the scanner still reports it as vulnerable. What is the most likely cause?
A false positive means the scanner incorrectly reports vulnerability.
Why this answer
False positives are common; the scanner may incorrectly flag the vulnerability even after patching.
Which access control model allows the owner of a resource to grant access permissions to other users?
Correct. DAC allows the resource owner to control access.
Why this answer
In DAC (Discretionary Access Control), the resource owner has discretion over who can access the resource. This contrasts with MAC, where access is based on labels, and RBAC/ABAC, where access is based on roles or attributes.
During a virtualized environment security assessment, which THREE of the following are considered risks associated with virtual machine snapshots? (Select three.)
Snapshots are static and may lack the latest patches.
Why this answer
Snapshots can reintroduce vulnerabilities because they capture the VM state at a point in time; if the VM was not fully patched, the snapshot retains those unpatched vulnerabilities (option A). Additionally, snapshots may contain sensitive data in memory or disk that could be exposed if not properly secured (option B). Furthermore, snapshots can be used to roll back security configurations, undoing security updates or settings (option D).
The incorrect options are C (snapshots cause VM sprawl) and E (snapshots can be used as an attack vector for VM escape). VM sprawl is more about excessive VM creation, not a direct risk of snapshots, and VM escape is a different vulnerability unrelated to snapshot risks.
Which of the following is a key principle of the 3-2-1 backup rule?
Correct description of the rule.
Why this answer
The 3-2-1 backup rule is a foundational data protection strategy: maintain three copies of your data (one primary and two backups), store them on two different media types (e.g., disk and tape, or local SSD and cloud object storage), and ensure at least one copy is stored offsite to protect against site-level disasters. Option C correctly captures this: three copies, two media types, one offsite.
Exam trap
The trap here is that candidates often misremember the numbers, confusing the '3' copies with '3' media types or '2' offsite, leading them to select options like A or D that sound plausible but violate the exact 3-2-1 structure.
How to eliminate wrong answers
Option A is wrong because it states 'two copies on three different media types with one onsite' — the rule requires three copies, not two, and only two different media types, not three. Option B is wrong because it says 'one copy on two different media types with three offsite' — the rule mandates three copies total, with only one offsite, not three offsite. Option D is wrong because it specifies 'three copies on three different media types with two offsite' — the rule requires only two different media types, not three, and only one offsite copy, not two.
A hospital is implementing an access control system for its electronic health record (EHR) system. The system must comply with HIPAA regulations, which require that access to patient records is limited to personnel who need it to perform their job duties. The hospital has many roles: doctors, nurses, lab technicians, and administrative staff. Each role can access different types of records. The system currently uses a DAC model where each user sets permissions on their own files. However, a recent risk assessment identified that some nurses have been sharing their accounts with each other to access records outside their unit. The hospital wants to implement a more restrictive model that enforces access based on job roles and prevents sharing of accounts. Which access control model should the hospital adopt?
RBAC restricts access based on roles, and requiring unique accounts ensures no sharing; this combination directly addresses the problem.
Why this answer
Role-Based Access Control (RBAC) enforces access permissions based on job roles, directly aligning with HIPAA's need-to-know principle. Mandatory account uniqueness prevents account sharing by requiring each user to have a unique identifier, eliminating the ability to share credentials. This combination provides a more restrictive, policy-driven model than DAC, which allowed users to set their own permissions and led to unauthorized access.
Exam trap
The trap here is that candidates may choose ABAC (Option A) because it seems more flexible and modern, but they overlook that RBAC with mandatory account uniqueness directly addresses the account-sharing issue and is the simplest, most compliant model for role-based healthcare access under HIPAA.
How to eliminate wrong answers
Option A is wrong because Attribute-Based Access Control (ABAC) uses attributes (e.g., time, location, patient relationship) to grant access, which is more granular than needed and does not inherently enforce mandatory account uniqueness to prevent sharing. Option B is wrong because Mandatory Access Control (MAC) with clearance labels is designed for classified environments (e.g., military) using security labels and clearances, not for healthcare roles; it would require labeling all patients and users, which is impractical and does not directly address account sharing. Option C is wrong because Discretionary Access Control (DAC) is the current model that allows users to set permissions on their own files, which led to the account-sharing problem; it is the opposite of the restrictive model needed.
During a risk assessment, a company identifies that a legacy system cannot be patched due to vendor end-of-life. The system is critical to operations. Which risk response strategy is most appropriate initially?
Compensating controls such as network segmentation and strict access controls can reduce the risk even if the system cannot be patched.
Why this answer
When a legacy system cannot be patched due to vendor end-of-life, the most appropriate initial risk response is to implement compensating controls. Compensating controls, such as network segmentation, strict access controls, or an intrusion detection system, reduce the likelihood or impact of exploitation without requiring a patch. This approach balances operational necessity with security, as immediate decommissioning (avoidance) may be infeasible for a critical system.
Exam trap
The trap here is that candidates often confuse risk acceptance with passive inaction, but the SSCP exam expects that acceptance must be a deliberate decision with documented justification and often paired with compensating controls, not simply ignoring the risk.
How to eliminate wrong answers
Option A is wrong because decommissioning a critical system immediately would disrupt operations, and risk avoidance is not appropriate when the system is essential to business functions; the goal is to manage risk, not eliminate it at the cost of operations. Option B is wrong because transferring risk via cyber insurance does not reduce the technical vulnerability; it only provides financial compensation after a breach, which does not address the immediate security gap. Option C is wrong because accepting the risk without any further action is negligent; while acceptance is a valid strategy, it requires documented understanding and often compensating controls, not passive inaction.
Which of the following is the primary purpose of network segmentation?
Correct. Network segmentation isolates sensitive systems, containing breaches and limiting lateral movement.
Why this answer
The primary purpose of network segmentation is to enhance security by isolating sensitive systems and limiting lateral movement of threats. Option D is correct. Option A is incorrect because segmentation does not directly increase bandwidth.
Option B is incorrect; while performance may improve due to reduced broadcast domains, security is the primary goal. Option C is incorrect because segmentation can complicate IP address management. Option E is incorrect because segmentation often increases hardware cost.
Which TWO of the following are effective controls to prevent buffer overflow attacks? (Choose two.)
ASLR randomizes memory addresses, making it harder to predict target addresses.
Why this answer
Address Space Layout Randomization (ASLR) is a memory protection technique that randomizes the base addresses of executable modules, heap, and stack regions. This makes it significantly harder for an attacker to predict the memory addresses needed to inject and execute shellcode, thereby mitigating many buffer overflow exploits that rely on fixed address references.
Exam trap
ISC2 often tests the misconception that input validation alone is sufficient to prevent buffer overflows, or that stack canaries are a primary control rather than a detection mechanism, leading candidates to select them instead of the memory protection controls ASLR and NX bit.
During a risk assessment, the team identifies that a critical database server is not included in the backup schedule. Which risk term best describes this condition?
The missing backup is a weakness that could lead to data loss.
Why this answer
A vulnerability is a weakness in a system that can be exploited by a threat. The database server missing from the backup schedule represents a weakness in the organization's data protection and disaster recovery posture, making it susceptible to data loss. This absence of a control (backup) is a classic example of a vulnerability, not an active threat or an exploit.
Exam trap
ISC2 often tests the distinction between a vulnerability (a weakness) and a threat (a potential danger), tricking candidates into selecting 'Threat' because they associate the missing backup with a potential data loss event, rather than recognizing it as the underlying weakness.
How to eliminate wrong answers
Option A is wrong because a threat is a potential event or actor (like a ransomware attack or a natural disaster) that could cause harm, not the absence of a backup. Option B is wrong because risk is the potential for loss or damage when a threat exploits a vulnerability; the missing backup is the vulnerability itself, not the calculated risk. Option C is wrong because an exploit is a specific method or code used to take advantage of a vulnerability (e.g., a SQL injection payload), not the condition of being unbacked.
A company wants to implement a firewall that can track the state of network connections and make decisions based on the context of traffic (e.g., allowing return packets for an established connection). Which type of firewall should they choose?
Stateful firewall tracks connection state and allows return traffic accordingly.
Why this answer
Stateful firewalls maintain connection state tables and allow return traffic for established sessions.
Which THREE of the following are key steps in performing a business impact analysis (BIA)?
Impact analysis is central to BIA.
Why this answer
Assessing the financial and operational impact of disruptions is a core step in a business impact analysis (BIA). The BIA focuses on quantifying the consequences of losing business functions, including revenue loss, regulatory fines, and reputational damage, rather than evaluating threat likelihood or selecting recovery solutions.
Exam trap
ISC2 often tests the distinction between BIA steps (impact-focused) and risk assessment steps (likelihood-focused), so candidates mistakenly include threat likelihood ratings as a BIA step.
The security team discovers that a user in the finance department can read files in the human resources share. The share permissions on the HR folder are set to deny all except the HR group, and the user is not a member of HR. What is the most likely cause?
Share permissions only apply to network access; local access is governed by NTFS permissions alone, which may allow the user.
Why this answer
When a user logs on locally to the file server, Windows evaluates NTFS permissions directly, bypassing share permissions entirely. Share permissions only apply to network access via SMB, so a local logon allows the user to read files if NTFS permissions grant access, even if share permissions deny all except the HR group.
Exam trap
ISC2 often tests the distinction between share permissions and NTFS permissions, specifically that share permissions only apply to network access, not local logons, leading candidates to overlook the local logon scenario.
How to eliminate wrong answers
Option B is wrong because being an administrator on the file server does not automatically grant read access to files if the NTFS permissions explicitly deny the user or their groups; administrators can take ownership or override permissions, but the most likely cause in this scenario is local logon, not administrative privilege. Option C is wrong because using a different file server would not grant access to files on the original HR share; the user would need appropriate permissions on that specific server. Option D is wrong because if the user's token included a group explicitly denied, that deny would block access, not allow it; the scenario describes the user being able to read files despite not being in the HR group.
An organization wants to implement an access control model where data owners decide who can access resources. Which model should they choose?
DAC allows data owners to grant access to others at their discretion.
Why this answer
Discretionary Access Control (DAC) is the correct model because it allows data owners (the users who create or own the resource) to decide who can access their resources. In DAC, the owner sets permissions (e.g., read, write, execute) on objects like files or directories, typically using Access Control Lists (ACLs). This directly matches the requirement where data owners control access decisions.
Exam trap
ISC2 often tests the misconception that 'data owners decide' implies a role-based or attribute-based model, but the key distinction is that DAC explicitly grants ownership-based control, while RBAC and ABAC centralize decisions with administrators or policies.
How to eliminate wrong answers
Option A is wrong because Attribute-Based Access Control (ABAC) uses policies based on attributes (e.g., user role, time, location) evaluated by a central policy engine, not by the data owner. Option B is wrong because Mandatory Access Control (MAC) enforces system-wide policies set by a central authority (e.g., security labels like Top Secret), and users (including data owners) cannot override these rules. Option C is wrong because Role-Based Access Control (RBAC) assigns permissions based on predefined roles (e.g., 'Manager'), and access decisions are made by administrators, not by the data owner.
Refer to the exhibit. A security engineer is reviewing an S3 bucket policy. Which risk is most directly introduced by this policy?
The ListBucket action with Principal "*" allows anyone to enumerate objects.
Why this answer
The S3 bucket policy grants public access via a Principal of '*' and an Effect of 'Allow' for the 's3:GetObject' and 's3:ListBucket' actions. This means any unauthenticated user on the internet can list the objects in the bucket and read their contents, directly exposing the bucket contents to the public, making option D correct.
Exam trap
ISC2 often tests the distinction between read access (GetObject) and list access (ListBucket). Here, the policy grants both, allowing public enumeration and reading. Candidates may mistakenly think only read is possible, but both actions are permitted, increasing the exposure risk.
How to eliminate wrong answers
Option A is wrong because the policy only allows 's3:GetObject' (read) and does not include 's3:DeleteObject' or any write/delete actions, so unauthorized deletion is not introduced. Option B is wrong because the policy does not address encryption settings at all; encryption at rest is a separate configuration (e.g., SSE-S3, SSE-KMS) and is not impacted by this access control policy. Option C is wrong because the policy does not disable or affect CloudTrail or other audit logging; auditing remains possible regardless of this policy, though the policy itself does not enable or disable it.
What is the primary purpose of a Privileged Access Management (PAM) solution?
PAM provides vaulting, session recording, and just-in-time access for privileged accounts.
Why this answer
PAM solutions focus on securing, managing, and monitoring privileged accounts to reduce the risk of misuse.
An alert shows a successful login from an unusual geographic location. Which of the following is the BEST initial response?
Immediate containment to stop ongoing unauthorized access.
Why this answer
Disabling the account immediately prevents further unauthorized access while the incident is investigated. Option B is premature without confirmation of compromise. Option C may be done after disabling.
Option D is too slow as the first step.
An organization uses smart cards combined with a PIN to access secure facilities. This is an example of which type of authentication factor?
Combining something you have (smart card) with something you know (PIN) is a classic definition of two-factor authentication.
Why this answer
Smart cards are a possession factor (something you have), and the PIN is a knowledge factor (something you know). Combining both satisfies the requirement for two distinct authentication factors, making this a textbook example of two-factor authentication (2FA). This is not single-factor because two separate categories of credentials are used, and it is not biometric because no physical characteristic is measured.
Exam trap
The trap here is that candidates often confuse 'something you have' (possession factor) with 'something you know' (knowledge factor) and mistakenly classify the combination as single-factor because they think the smart card alone is the authentication, ignoring that the PIN adds a second distinct factor.
How to eliminate wrong answers
Option A is wrong because token-based authentication typically refers to a device that generates a one-time password (OTP) or cryptographic token, not a smart card with a PIN; while a smart card can be considered a token, the combination with a PIN specifically makes it two-factor, not merely token-based. Option B is wrong because single-factor authentication uses only one category of credential (e.g., just a password or just a smart card), but here both a smart card (possession) and a PIN (knowledge) are required, so it is multi-factor. Option D is wrong because biometric authentication relies on unique physical traits such as fingerprints, iris patterns, or voice recognition, not on a smart card and PIN combination.
A company has implemented a new vulnerability scanner and the first scan reports 200 vulnerabilities. The security team needs to prioritize remediation. Which approach should they use first?
CVSS scores provide a standardized severity rating; focusing on critical/high vulnerabilities aligns with risk management.
Why this answer
The Common Vulnerability Scoring System (CVSS) provides a standardized, industry-accepted method for rating vulnerability severity based on exploitability, impact, and other metrics. Prioritizing critical and high CVSS scores (e.g., 9.0-10.0 and 7.0-8.9) ensures the team addresses vulnerabilities with the highest potential for damage and exploitation first, which is a fundamental risk-based remediation strategy. This approach aligns with the NIST SP 800-40 guidance on prioritizing vulnerabilities by risk, not by arbitrary ordering or waiting for confirmation.
Exam trap
The trap here is that candidates may think waiting for a second scan (Option B) is prudent to avoid false positives, but the SSCP exam emphasizes proactive risk management and immediate prioritization based on severity, not delaying action.
How to eliminate wrong answers
Option A is wrong because focusing solely on internet-exploitable vulnerabilities ignores internal threats, such as lateral movement by an attacker who has already breached the perimeter, or vulnerabilities in critical internal systems that could be exploited by insiders or via phishing. Option B is wrong because waiting for a second scan delays remediation unnecessarily; vulnerability scanners can produce false positives, but the correct first step is to validate and prioritize based on severity, not to defer action entirely. Option D is wrong because remediating in alphabetical order by CVE ID is arbitrary and ignores the actual risk level, potentially leaving critical vulnerabilities unpatched while wasting resources on low-severity issues.
According to the shared responsibility model in cloud computing, which security responsibility belongs to the customer in a SaaS deployment?
Data security is a customer responsibility in all cloud models.
Refer to the exhibit. Which component of the cipher suite provides perfect forward secrecy?
ECDHE uses ephemeral keys, ensuring forward secrecy.
Why this answer
ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) provides perfect forward secrecy (PFS) because it generates a unique, ephemeral session key for each TLS session. If the long-term private key is compromised, past session keys cannot be derived, as the ephemeral keys are discarded after use. This is defined in RFC 4492 and is a core property of ephemeral Diffie-Hellman key exchange.
Exam trap
ISC2 often tests the distinction between the protocol version (TLS 1.2) and the cipher suite components that actually implement PFS, leading candidates to incorrectly select TLS 1.2 because they associate it with modern security features.
How to eliminate wrong answers
Option B (TLS 1.2) is wrong because TLS 1.2 is a protocol version, not a component that provides PFS; it can support PFS if ECDHE or DHE cipher suites are negotiated, but the protocol itself does not guarantee PFS. Option C (AES256-GCM) is wrong because AES256-GCM is a symmetric encryption and authenticated encryption algorithm (AEAD) that protects data confidentiality and integrity, but it does not influence key exchange or provide PFS. Option D (SHA384) is wrong because SHA384 is a hash function used for message authentication in HMAC or for integrity checks in TLS, and it has no role in establishing ephemeral keys or PFS.
What is the primary purpose of account deprovisioning?
Deprovisioning removes access rights and disables accounts.
Why this answer
Deprovisioning ensures that when an employee leaves or changes roles, access is removed promptly to prevent unauthorized use.
A system administrator needs to assign permissions to a new employee who will be performing database backups. The employee should only be able to execute the backup command but not read or modify the data. Which access control principle should be applied?
Least privilege grants only the permissions required to perform the job.
Why this answer
The least privilege principle dictates that a user should be granted only the minimum permissions necessary to perform their job function. In this scenario, the employee needs only the ability to execute the backup command (e.g., using a tool like `pg_dump` or `mysqldump` with a read-only snapshot), not read or modify the underlying data files. Applying least privilege ensures the backup process can run without granting broader SELECT or FILE privileges that would allow data access or alteration.
Exam trap
The trap here is that candidates often confuse 'least privilege' with 'need to know' because both limit access, but least privilege focuses on the minimum permissions to perform an action (execute a command), while need to know focuses on whether the user requires access to specific data content.
How to eliminate wrong answers
Option A is wrong because 'need to know' is a confidentiality principle that restricts access to information based on whether the user requires that specific data to perform their duties, not the minimum permissions to execute a command; it does not address the granularity of execute-only versus read/modify. Option C is wrong because separation of duties divides critical tasks among multiple people to prevent fraud (e.g., the backup operator cannot also restore), but the question is about limiting the backup operator's own permissions, not splitting tasks. Option D is wrong because defense in depth is a layered security strategy using multiple controls (firewalls, IDS, encryption), not a principle for assigning a single user's permissions to a specific command.
A security team is implementing Network Access Control (NAC) to enforce endpoint compliance before granting network access. Which technology allows port-based authentication on wired networks?
802.1X provides port-based authentication for wired networks.
A database administrator notices unusual queries that seem to be trying to extract data via SQL injection. The application uses parameterized queries for most queries, but some dynamic queries are built using string concatenation. What is the BEST remediation?
Parameterized queries prevent interpretation of user input as SQL code.
Why this answer
Rewriting all dynamic queries to use parameterized queries separates SQL code from user data, effectively preventing SQL injection. Option A (restricting permissions) reduces damage but does not stop injection. Option B (input validation) is helpful but can be bypassed if concatenation remains.
Option C (WAF) is a detection/blocking measure, not a code-level fix.
A security team uses a risk matrix with likelihood (Low, Medium, High) and impact (Low, Medium, High). A vulnerability scan finds a buffer overflow in a customer-facing web application. The application is not critical but has high availability requirements. The likelihood of exploitation is considered Medium due to internal network segmentation. What is the risk level?
Standard 3x3 risk matrix: Medium likelihood + High impact = High risk.
Why this answer
The risk level is High because the likelihood is Medium (due to internal network segmentation reducing but not eliminating the chance of exploitation) and the impact is High (the application has high availability requirements, so a buffer overflow could cause a denial of service or code execution, severely affecting availability). In a standard 3x3 risk matrix, Medium likelihood combined with High impact yields a High risk rating.
Exam trap
ISC2 often tests the misconception that internal network segmentation automatically lowers the risk to Medium or Low, but the high availability requirement elevates the impact, resulting in a High risk level despite the reduced likelihood.
How to eliminate wrong answers
Option A is wrong because Medium risk would require either Low likelihood with High impact, or Medium likelihood with Medium impact, but here the impact is High due to the application's high availability requirements. Option B is wrong because Extreme risk typically requires both High likelihood and High impact, or a combination like High likelihood with Medium impact in some matrices, but the likelihood is only Medium. Option D is wrong because Low risk would require Low likelihood and Low impact, or Low likelihood with Medium impact, but the impact is High and the likelihood is Medium.
A small business wants to implement an access control system where employees can access files based on their department (e.g., HR, Finance). They want simplicity and ease of administration. Which access control model is BEST suited?
RBAC assigns permissions to roles, and users are assigned roles based on their department, providing a straightforward and manageable solution.
Why this answer
Role-Based Access Control (RBAC) is best suited because it maps access permissions directly to job functions (roles) such as HR or Finance, rather than to individual users. This simplifies administration: when an employee changes departments, the administrator simply updates their role assignment, and all associated permissions are automatically applied or revoked. RBAC is designed for environments where access decisions are based on organizational roles, providing a balance of security and ease of management.
Exam trap
The trap here is that candidates often confuse RBAC with DAC because both involve user-based permissions, but RBAC centralizes control through roles while DAC delegates control to individual resource owners, making RBAC the correct choice for department-based access.
How to eliminate wrong answers
Option A is wrong because Mandatory Access Control (MAC) uses system-enforced labels (e.g., security classifications like Top Secret) and is typically used in military or high-security environments, not for simple department-based access in a small business. Option B is wrong because Attribute-Based Access Control (ABAC) evaluates multiple attributes (e.g., time, location, resource type) using policy rules, which adds complexity and administrative overhead beyond what is needed for straightforward department-based access. Option C is wrong because Discretionary Access Control (DAC) allows individual users to control access to their own files (e.g., via file permissions), which does not scale well for department-wide access and can lead to inconsistent enforcement.
A financial services organization deploys a new web application that allows customers to check account balances and transfer funds. The application uses a RESTful API with JSON payloads. Shortly after deployment, the security team notices unusual traffic patterns: many requests contain excessively long JSON strings in the 'amount' field, and some of these requests return 500 Internal Server Errors. The application logs show that these requests cause high CPU usage on the application server. The developers confirm that the input validation only checks for negative numbers and characters. Which type of attack is most likely occurring, and what is the best immediate mitigation?
Large JSON payloads can exhaust server resources; validation should restrict field sizes.
Why this answer
The symptoms indicate a Denial of Service attack via large payloads that consume server resources. Excessive JSON string length in the 'amount' field causes high CPU usage during parsing and processing, leading to 500 errors. The best immediate mitigation is to implement input size limits and strict validation to reject oversized payloads.
Option A is incorrect because brute-force attacks typically involve repeated attempts with different values, not large payloads causing CPU exhaustion; rate limiting would not address the root cause. Option B is incorrect because cross-site scripting (XSS) targets client-side script execution in the browser, not server-side CPU spikes. Option D is incorrect because SQL injection would likely return database error messages or cause data manipulation, not high CPU from JSON parsing.
Which TWO protocols are used to secure email communication at the message level?
Provides encryption and signing for email.
Why this answer
PGP (Pretty Good Privacy) and S/MIME (Secure/Multipurpose Internet Mail Extensions) are the two primary protocols that secure email at the message level. They encrypt the entire email body and attachments, ensuring end-to-end confidentiality and integrity regardless of the transport path. PGP uses a web of trust model, while S/MIME relies on a hierarchical public key infrastructure (PKI) with X.509 certificates.
Exam trap
ISC2 often tests the distinction between transport-layer security (SSL/TLS) and message-level security (PGP/SMIME), so candidates mistakenly choose SSL/TLS because they associate it with email security (e.g., SMTPS), but it does not provide end-to-end message encryption.
During a risk assessment, a company identifies that a legacy system has a known CVE with a CVSS score of 9.8. The system is critical but cannot be patched immediately. The management decides to implement strict network segmentation and monitor the system continuously. This risk response is best described as:
Correct: Mitigation reduces risk through controls like segmentation and monitoring.
Why this answer
Risk mitigation, because the company is implementing strict network segmentation and continuous monitoring to reduce the likelihood and impact of the vulnerability being exploited. This reduces the risk without eliminating it entirely, which is the essence of mitigation. The CVSS score of 9.8 indicates critical severity, and the controls (e.g., ACLs, VLANs, IDS/IPS) directly address the attack surface.
Exam trap
The trap here is that candidates confuse 'risk mitigation' with 'risk acceptance' because the system remains vulnerable, but the key distinction is that active controls are applied to reduce risk, not merely acknowledged.
How to eliminate wrong answers
Option A is wrong because risk acceptance would involve acknowledging the risk without taking any active controls, but here the company actively deploys segmentation and monitoring. Option B is wrong because risk avoidance would require removing the system or ceasing its operation entirely, which is not done since the system remains in use. Option C is wrong because risk transfer would involve shifting the financial burden or liability to a third party (e.g., insurance or outsourcing), not implementing technical controls.
Which of the following encryption protocols should be used to secure wireless traffic in an enterprise environment?
Provides the strongest security with 802.1X authentication and GCMP-256 encryption.
Why this answer
WPA3-Enterprise is the correct choice because it provides the highest level of security for enterprise wireless networks, incorporating mandatory 192-bit Suite B cryptographic suites (AES-256 in GCM mode, HMAC-SHA384, and ECDHE key exchange) to protect against offline dictionary attacks, forward secrecy, and brute-force attempts. It also uses Simultaneous Authentication of Equals (SAE) for the handshake, replacing the vulnerable 4-way handshake of WPA2, and supports 802.1X/EAP authentication with RADIUS for centralized user management.
Exam trap
ISC2 often tests the distinction between 'PSK' and 'Enterprise' modes, trapping candidates who see 'WPA3' and assume it is always best, but the question's 'enterprise environment' requirement specifically demands the Enterprise mode (with 802.1X/RADIUS), not the PSK variant, even though both use SAE.
How to eliminate wrong answers
Option B (WEP) is wrong because it uses the insecure RC4 stream cipher with a static 40- or 104-bit key, making it trivially crackable with tools like aircrack-ng in minutes. Option C (WPA3-PSK) is wrong because it uses a pre-shared key (PSK) mode, which lacks the per-user authentication and centralized management required in an enterprise environment, and is more suited for small office/home office (SOHO) deployments. Option D (WPA2-PSK) is wrong because it relies on the vulnerable 4-way handshake with a pre-shared key, making it susceptible to offline dictionary attacks (e.g., using hashcat) and KRACK attacks, and it lacks enterprise-grade user authentication.
Option E (WPA2-Enterprise) is wrong because while it supports 802.1X/EAP, it uses the older 4-way handshake which is vulnerable to KRACK (CVE-2017-13077) and lacks forward secrecy and the stronger cryptographic suites mandated in WPA3-Enterprise.
A security administrator needs to ensure that only authorized personnel can reset user passwords in Active Directory. Which of the following is the BEST method to delegate this responsibility without granting unnecessary privileges?
This provides exactly the needed permission without extra rights.
Why this answer
The Delegation of Control wizard allows granular assignment of specific Active Directory permissions, such as 'Reset user passwords and force password change at next logon', without granting broader administrative rights. This follows the principle of least privilege by limiting the delegated personnel to only the necessary task. Option C is correct because it directly addresses the requirement with a built-in, secure delegation mechanism.
Exam trap
The trap here is that candidates often assume built-in groups like Account Operators are the simplest delegation method, overlooking that they grant far more permissions than the specific task requires, which is a common violation of the principle of least privilege tested on the SSCP.
How to eliminate wrong answers
Option A is wrong because the Account Operators group can create, delete, and modify most user accounts and groups, which includes the ability to reset passwords but also grants excessive privileges beyond the required task. Option B is wrong because Domain Admins have full administrative control over the entire domain, including all user and computer objects, which is far more privilege than needed and violates least privilege. Option D is wrong because physical access to a domain controller does not inherently grant the ability to reset passwords; it could allow unauthorized actions but is not a controlled delegation method and introduces significant security risks.
During a wireless site survey, a security engineer identifies several security weaknesses. Which TWO measures should be implemented to improve wireless security for a corporate network using WPA2-Enterprise?
EAP-TLS provides strong mutual authentication.
Which of the following is the FIRST step in the volatile evidence collection order when responding to an incident on a live system?
Memory is the most volatile; capturing it first preserves running processes, network connections, and encryption keys.
Why this answer
Volatile evidence is collected starting with the most volatile (memory) to preserve data that can be lost when the system is powered down. RAM dump must be done first.
A software developer wants to ensure the authenticity and integrity of an API request but does not require non-repudiation. Which cryptographic method should be used?
HMAC verifies authenticity and integrity without non-repudiation.
Why this answer
HMAC uses a shared secret key combined with a cryptographic hash function to produce a fixed-size authentication tag. This ensures both authenticity (the request came from a party knowing the key) and integrity (the data has not been altered) without providing non-repudiation, because the same key is shared between sender and receiver, so the receiver could also have generated the tag.
Exam trap
ISC2 often tests the distinction between authentication/integrity (HMAC) and non-repudiation (digital signatures), leading candidates to incorrectly choose digital signatures when non-repudiation is explicitly not required.
How to eliminate wrong answers
Option A is wrong because a digital signature using RSA provides non-repudiation (the sender cannot deny signing) and is computationally heavier than necessary when non-repudiation is not required. Option B is wrong because symmetric encryption with CBC mode provides confidentiality, not authenticity or integrity; CBC mode alone does not prevent an attacker from modifying ciphertext blocks. Option D is wrong because Elliptic Curve Diffie-Hllman (ECDH) is a key exchange protocol used to establish a shared secret over an insecure channel, not a method for authenticating or verifying the integrity of an API request.
What is the primary purpose of account deprovisioning in the account lifecycle?
Deprovisioning involves disabling and preserving data.
Why this answer
Deprovisioning ensures that when an employee leaves, access is revoked immediately to prevent unauthorized use, and evidence is preserved for investigations.
A network engineer configures a VLAN hopping attack prevention by setting all unused switch ports to an unused VLAN and disabling trunking. What vulnerability is being mitigated?
DTP spoofing can turn an access port into a trunk, enabling VLAN hopping.
Why this answer
DTP spoofing is the correct answer because VLAN hopping attacks often exploit Dynamic Trunking Protocol (DTP) to negotiate a trunk link between a switch and an attacker's device, allowing the attacker to send and receive traffic on multiple VLANs. By disabling trunking on all unused ports and assigning them to an unused VLAN, the switch will not respond to DTP negotiation requests, preventing unauthorized trunk establishment.
How to eliminate wrong answers
Option A is wrong because STP manipulation attacks target Spanning Tree Protocol to cause network loops or traffic redirection, not VLAN hopping. Option B is wrong because ARP spoofing involves sending forged ARP replies to associate an attacker's MAC with a legitimate IP address, which is a man-in-the-middle technique unrelated to trunk negotiation. Option C is wrong because MAC flooding overwhelms a switch's CAM table to force it into fail-open mode, causing frames to flood out all ports, but it does not involve trunking or VLAN tagging.
Option E is wrong because DHCP starvation exhausts the DHCP server's address pool by sending many fake DHCP requests, preventing legitimate clients from obtaining IP addresses, and has no connection to DTP or VLAN hopping.
During a penetration test, the tester captures traffic on a switch port that is part of a VLAN other than the native VLAN. The tester is able to receive traffic destined for the management VLAN. What configuration flaw is exploited?
If the native VLAN on trunk matches management VLAN, frames can be double-tagged to hop VLANs.
Why this answer
The scenario describes a native VLAN mismatch on a trunk port. When two switches have different native VLANs configured on a trunk, they will not tag frames for their respective native VLANs. This allows an attacker on a non-native VLAN to receive traffic destined for the management VLAN (typically VLAN 1) by sending frames with no 802.1Q tag, which the receiving switch treats as belonging to its own native VLAN, effectively bypassing VLAN segmentation.
Exam trap
ISC2 often tests the native VLAN mismatch concept by describing a scenario where an attacker on a non-native VLAN receives management traffic, and candidates mistakenly choose options like 'VTP transparent mode' or 'STP enabled' because they confuse protocol behavior with security flaws.
How to eliminate wrong answers
Option A is wrong because Spanning Tree Protocol (STP) prevents loops, not VLAN hopping or traffic leakage; enabling STP does not cause or mitigate native VLAN mismatches. Option C is wrong because port security limits MAC addresses on an access port, but it does not prevent VLAN hopping attacks exploiting trunk misconfigurations. Option D is wrong because DHCP snooping filters untrusted DHCP messages and prevents rogue DHCP servers, but it does not address native VLAN mismatches or VLAN hopping.
Option E is wrong because VTP transparent mode simply forwards VTP advertisements without processing them; it does not cause or prevent the native VLAN mismatch vulnerability.
An attacker is performing a man-in-the-middle attack at Layer 2 by sending forged ARP messages to associate their MAC address with the IP address of a legitimate host on the same subnet. This attack is known as:
ARP spoofing sends fake ARP messages to perform MitM.
Why this answer
ARP spoofing involves sending gratuitous ARP replies to poison the ARP cache of other hosts.
A security analyst is reviewing Linux audit logs with auditd. Which TWO events would be of greatest concern for a server that should not have interactive logins? (Select TWO.)
Unauthorized interactive login.
Why this answer
Failed login attempts indicate brute force; successful root login indicates unauthorized access.
Which TWO of the following are key components of an incident response plan (IRP) according to NIST SP 800-61?
A communication plan is a required component of an IRP.
Why this answer
NIST SP 800-61 (Computer Security Incident Handling Guide) explicitly identifies the communication plan and testing the plan as key components of an incident response plan. The communication plan ensures all stakeholders (internal teams, legal, PR, external partners) are notified and coordinated during an incident, while testing validates the plan's effectiveness through exercises like tabletop or functional drills.
Exam trap
ISC2 often tests the distinction between components of the plan itself (like communication and testing) versus operational activities or supporting resources (like forensic tools or budgets), leading candidates to select items that are part of incident response but not key components of the plan.
Match each authentication factor to its category.
Drag a concept onto its matching description — or click a concept then click the description.
Something you know
Something you have
Something you are
Something you do
Why these pairings
Authentication factors are categorized into knowledge (something you know), possession (something you have), inherence (something you are), and location (somewhere you are). Common confusions include mixing knowledge with possession or inherence.
A company is deploying a web application and wants to protect against OWASP Top 10 attacks. Which THREE controls should be implemented? (Select THREE.)
WAF can detect and block OWASP attacks such as SQL injection and XSS.
Why this answer
Web Application Firewall (WAF) blocks common attacks like injection and XSS. Input validation prevents injection. Code signing ensures software integrity.
Disabling auto-run is unrelated.
During a risk assessment, a team identifies that a legacy application cannot be patched due to vendor end-of-life. The business decides to continue using the application but implement compensating controls such as network segmentation and strict access controls. This risk response strategy is best classified as:
The business accepts the residual risk after applying compensating controls.
Why this answer
Risk acceptance means acknowledging the risk and taking no further action beyond existing controls. Compensating controls do not eliminate the risk; they reduce it to an acceptable level, which is still acceptance.
An organization requires users to authenticate using a password and a one-time code from a mobile app. Which authentication method is being used?
TOTP is a common OTP method using time synchronization.
Why this answer
Time-based One-Time Password (TOTP) generates a temporary code that changes every 30-60 seconds, commonly used with mobile apps like Google Authenticator.
An organization experiences malware that injects code into legitimate processes. Which security feature should be enabled to prevent code execution in memory pages?
DEP prevents execution from non-executable memory regions.
Why this answer
Data Execution Prevention (DEP) is a hardware and software security feature that marks memory pages as non-executable unless they explicitly contain executable code. By preventing code execution in data-only memory regions (such as the heap and stack), DEP stops malware that attempts to inject and run shellcode within legitimate processes, even if the process is compromised.
Exam trap
The trap here is that candidates often confuse ASLR with DEP, thinking randomization alone prevents code execution, but ASLR only makes addresses unpredictable while DEP actively blocks execution from non-executable pages.
How to eliminate wrong answers
Option A is wrong because Encrypted File System (EFS) protects data at rest by encrypting files on NTFS volumes, but it does not control memory execution permissions or prevent code injection into running processes. Option B is wrong because Address Space Layout Randomization (ASLR) randomizes the memory addresses of process components to make exploitation harder, but it does not enforce non-execution of memory pages; it works alongside DEP but is not a direct prevention mechanism against code execution in memory. Option C is wrong because Mandatory Access Control (MAC) enforces system-wide security policies based on labels and subjects, but it does not manage memory page execution permissions at the hardware or kernel level.
An organization suspects a security incident. Which initial step should the incident response team take?
Preserving volatile evidence is the first priority to support forensic analysis.
Why this answer
The initial step in incident response is to protect evidence (Option B) because preserving forensic data ensures the integrity of logs, memory dumps, and disk images for later analysis. According to NIST SP 800-61, the first priority after detection is to secure volatile data (e.g., RAM, network connections) before it is lost, which is critical for determining the scope and root cause of the incident.
Exam trap
The trap here is that candidates confuse the urgency of containment with the priority of evidence preservation, often selecting 'Contain the incident' because it seems immediately necessary, but the SSCP emphasizes that evidence must be secured first to support legal and forensic processes.
How to eliminate wrong answers
Option A is wrong because containment (e.g., isolating systems via VLAN segmentation or disabling network interfaces) should occur only after evidence has been preserved; premature containment can destroy volatile data like active network connections or running processes. Option C is wrong because identifying the attacker is a later analytical goal, not an initial step—focusing on attribution early can waste time and compromise evidence collection. Option D is wrong because notifying law enforcement is a strategic decision that typically occurs after the incident is confirmed and evidence is secured; premature notification may lead to legal complications or loss of control over the investigation.
During a qualitative risk analysis, an organization assigns a risk rating of 'High' for a specific threat. Which combination of factors most directly leads to this rating?
Both high probability and high impact result in a high risk rating.
Why this answer
In qualitative risk analysis, risk rating is determined by the product of probability and impact. A 'High' rating directly results from both high probability and high impact, as this combination represents the greatest potential for loss. This aligns with the risk matrix approach where the highest risk scores occupy the top-right quadrant.
Exam trap
ISC2 often tests the misconception that high impact alone is sufficient for a 'High' risk rating, ignoring that probability must also be high to reach the top risk level.
How to eliminate wrong answers
Option B is wrong because low probability and low impact produce a 'Low' risk rating, not 'High'. Option C is wrong because high probability combined with low impact typically yields a 'Medium' or 'Moderate' rating, as the low impact reduces overall risk severity. Option D is wrong because low probability with high impact often results in a 'Medium' risk rating, as the low likelihood mitigates the overall risk despite the high potential damage.
A security engineer is hardening a Windows workstation. Which TWO configurations reduce the attack surface by limiting execution of unauthorized code? (Select TWO.)
AppLocker restricts which applications can run.
Why this answer
AppLocker whitelists allowed applications; Windows Defender Application Control blocks unsigned drivers and applications.
A healthcare organization uses an electronic health records (EHR) system that stores patient data in a relational database. The system is accessed by doctors and nurses via tablet devices on a wireless network. The security team has detected that some patient records were accessed outside of normal business hours from an IP address not belonging to the organization. The database logs show that the queries originated from the application server. The application logs indicate that the access was performed using a legitimate user account that had been disabled due to employee departure two weeks earlier. Which of the following is the most effective step to prevent recurrence?
A timely account disable process prevents use of former employees' credentials.
Why this answer
The most effective step to prevent recurrence is option C: implement a process to disable user accounts within one hour of employee termination. The root cause was that the former employee's account remained active, allowing unauthorized access. Option A (MFA for remote access) is not preventive because the access used a legitimate account and MFA does not prevent use of an active enabled account; also, the access may have been from within the network.
Option B (audit logging) is detective, not preventive. Option D (network segregation) does not address the account being active. Therefore, prompt account disabling is the most effective preventive measure.
Which TWO of the following are effective measures to prevent buffer overflow attacks in software development?
Correct: Input validation that enforces length constraints prevents data from exceeding buffer capacity, directly stopping buffer overflows.
Why this answer
Options A and E are correct. Input validation with length constraints (A) directly prevents buffer overflows by ensuring data does not exceed buffer boundaries. Bounds-checking functions like strncpy (E) also prevent overflows by limiting data copy.
Stack canaries (B) detect overflows but do not prevent them; code obfuscation (C) hinders exploitation but does not prevent the vulnerability; ASLR (D) randomizes memory addresses but does not stop the overflow itself.
A security administrator is configuring a wireless network for a branch office. The office has legacy devices that only support WPA2-PSK. The administrator wants to provide the highest level of security while maintaining compatibility. Which configuration should be used?
AES is the strongest encryption available for WPA2 and is supported by most devices.
Why this answer
WPA2-PSK with AES (CCMP) is correct because it provides the highest security level compatible with legacy devices that only support WPA2-PSK. AES-CCMP is the mandatory encryption protocol for WPA2, offering strong data confidentiality and integrity, whereas TKIP is deprecated due to known vulnerabilities. This configuration avoids the need for a RADIUS server (required by WPA2-Enterprise) and does not force an upgrade to WPA3, which legacy devices cannot support.
Exam trap
The trap here is that candidates often assume WPA2-Enterprise is always more secure than WPA2-PSK, but the question explicitly requires compatibility with legacy devices that only support WPA2-PSK, making WPA2-Enterprise an invalid choice despite its stronger authentication model.
How to eliminate wrong answers
Option A is wrong because WPA2-Enterprise with RADIUS requires an authentication server and is not supported by legacy devices that only support WPA2-PSK; it would break compatibility. Option C is wrong because WPA3-SAE is not supported by legacy WPA2-only devices, so it would render the network inaccessible to them. Option D is wrong because WPA2-PSK with TKIP uses the deprecated TKIP cipher, which is vulnerable to attacks like Michael and Beck-Tews, and provides weaker security than AES-CCMP.
Refer to the exhibit. What is the most likely cause of this error?
A self-signed certificate in the chain means the CA is not in the trust store.
Why this answer
The error 'The root CA is not trusted' occurs because the client device does not have the root CA certificate installed in its trusted root store. When a server presents a certificate chain, the client must be able to validate the chain up to a trusted root CA; if the root CA is missing or not trusted, the certificate chain is considered invalid, and the connection is rejected.
Exam trap
ISC2 often tests the distinction between certificate chain validation failures (root CA not trusted) versus other certificate errors (expired, revoked, weak key), and the trap here is that candidates confuse a missing root CA with a revoked or expired certificate, which produce different error messages.
How to eliminate wrong answers
Option B is wrong because a revoked certificate would produce a different error, such as 'certificate revoked' or a CRL/OCSP failure message, not a trust-related error. Option C is wrong because an expired certificate would generate a specific 'certificate expired' error, not a root CA trust issue. Option D is wrong because weak encryption (e.g., RSA 512-bit) would cause a security policy violation or cipher mismatch error, not a root CA trust failure.
An organization is implementing system hardening. Which of the following actions are recommended by CIS Benchmarks? (Select all that apply.)
This is recommended to reduce attack surface.
Why this answer
CIS Benchmarks recommend removing unnecessary services and accounts (A) to reduce attack surface, disabling autorun and autoplay features (C) to prevent unauthorized code execution, and enabling User Account Control (UAC) (D) to enforce least privilege. These are all common system hardening recommendations.
Which protocol is used to securely transfer files between a client and server, typically over TCP port 22?
SSH provides secure file transfer over TCP port 22.
Why this answer
SSH (Secure Shell) provides encrypted file transfer capabilities via SCP or SFTP, using port 22.
A security team is investigating a potential data exfiltration incident. They notice that a large amount of data was transferred to an external IP address during off-hours. What should be the first step?
Isolation stops the exfiltration immediately.
Why this answer
The immediate priority in a suspected data exfiltration incident is to contain the threat and prevent further data loss. Isolating the affected system from the network stops ongoing communication with the external IP address, preserving the system state for forensic analysis. This aligns with the NIST SP 800-61 incident response lifecycle, where containment precedes eradication and recovery.
Exam trap
The trap here is that candidates often choose to block the external IP (Option B) thinking it stops the attack, but the correct first step is to isolate the affected system at the host level to prevent the attacker from pivoting or using alternate C2 channels, and to preserve forensic evidence.
How to eliminate wrong answers
Option A is wrong because notifying senior management is a later step in the incident response process; the first action must be technical containment to stop the exfiltration. Option B is wrong because blocking the external IP address at the firewall does not stop the compromised system from using other IPs or protocols, and it may alert the attacker, destroying forensic evidence. Option C is wrong because analyzing data transfer logs to determine scope is part of the investigation phase, which should occur after containment to avoid further data loss while logs are being reviewed.
A security administrator is designing an identity federation solution. Which THREE of the following are commonly used federation standards?
Kerberos can be used in federated environments (e.g., cross-realm).
Why this answer
SAML, OAuth/OIDC, and Kerberos (with extensions) are used for federation. LDAP is a directory protocol, not a federation standard.
A network administrator is unable to ping the server at 10.2.2.100 from a host on the 192.168.1.0/24 network. Based on the exhibit, what is the most likely cause?
The route is learned but the age (00:05:12) may indicate recent instability.
Why this answer
The exhibit shows that the host on 192.168.1.0/24 cannot reach 10.2.2.100, but the routing table includes both a static route to 10.3.3.0 and an OSPF route to 10.2.2.0. Option D is correct because the symptom of intermittent reachability (sometimes ping works, sometimes not) combined with a known OSPF neighbor relationship points to route flapping, where the OSPF route for 10.2.2.0 is repeatedly added and removed due to an unstable neighbor adjacency, causing the ping to fail when the route is absent.
Exam trap
ISC2 often tests the distinction between a missing route (which would cause a complete failure) and an unstable route (which causes intermittent failure), tricking candidates into choosing a static answer like 'missing route' when the symptom of intermittent connectivity points to route flapping.
How to eliminate wrong answers
Option A is wrong because the static route to 10.3.3.0 is irrelevant to reaching 10.2.2.100; the destination is 10.2.2.0/24, not 10.3.3.0/24, so a misconfigured static route to a different subnet does not affect this connectivity. Option B is wrong because a missing gateway of last resort (default route) would only affect traffic to networks not explicitly in the routing table; here, the routing table already contains an OSPF route for 10.2.2.0/24, so a default route is unnecessary for this specific destination. Option C is wrong because the OSPF route for 10.2.2.0 is present in the routing table (as shown in the exhibit), so the issue is not that the route is missing entirely, but rather that it may be flapping due to an unstable OSPF neighbor relationship.
A company's vulnerability scanner reports a critical vulnerability in a third-party library. The remediation SLA for critical vulnerabilities is 48 hours. However, the patch is not yet available from the vendor. Which of the following is the most appropriate immediate action?
Compensating controls reduce risk until a patch is available.
Why this answer
When a patch is unavailable, implementing compensating controls (e.g., network segmentation, WAF rules, disabling unused features) is the immediate action to reduce risk exposure while awaiting an official fix. This aligns with the NIST SP 800-40 risk mitigation framework, which prioritizes compensating controls when patching is not feasible. Simply removing the software (A) may break business operations, extending the SLA (B) violates policy, and accepting risk (C) ignores the need for active mitigation.
Exam trap
The trap here is that candidates assume 'no patch available' means 'no action required' (Option C), but the SSCP exam expects proactive risk mitigation through compensating controls even when patching is delayed.
How to eliminate wrong answers
Option A is wrong because removing the vulnerable software immediately could cause significant operational disruption and is not required if compensating controls can reduce risk to an acceptable level. Option B is wrong because extending the SLA to 30 days violates the established 48-hour remediation policy and does not address the immediate threat; SLAs are not arbitrarily extended without formal risk acceptance. Option C is wrong because accepting risk without implementing any controls is negligent; the absence of a vendor patch does not justify inaction—compensating controls must be applied to reduce the likelihood of exploitation.
SYN flood uses incomplete TCP handshakes to exhaust resources.
Why this answer
SYN flood sends many SYN packets without completing the handshake, exhausting server resources.
Which term describes the risk that remains after implementing risk mitigation controls?
Residual risk remains after mitigation.
Why this answer
Residual risk is the risk that remains after all risk mitigation controls have been applied. It represents the portion of the original risk that cannot be eliminated or reduced further, and it must be accepted by management if it falls within the organization's risk appetite.
Exam trap
The trap here is that candidates confuse 'residual risk' with 'accepted risk,' but accepted risk is the subset of residual risk that management formally approves to tolerate, not the risk that remains after controls.
How to eliminate wrong answers
Option A is wrong because accepted risk is a decision to formally acknowledge and tolerate a specific risk, often after evaluating residual risk, not the risk that remains after controls. Option C is wrong because inherent risk is the level of risk before any controls are implemented, not after. Option D is wrong because control risk is the risk that a control may fail or be ineffective, not the leftover risk after controls are applied.
What is the PRIMARY purpose of a lessons learned meeting after an incident?
Correct. It helps refine the IR plan and procedures.
Why this answer
The primary purpose of a lessons learned meeting is to analyze the incident response process to identify what worked well and what did not, enabling the team to update procedures, playbooks, and tools to improve future responses. This aligns with the continuous improvement cycle mandated by frameworks like NIST SP 800-61, which emphasizes post-incident activity to refine detection and remediation capabilities.
Exam trap
The trap here is that candidates confuse the primary goal of process improvement with secondary outcomes like cost calculation or compliance, but the SSCP exam emphasizes that the core purpose is to enhance the incident response plan's effectiveness, not to assign blame or tally expenses.
How to eliminate wrong answers
Option A is wrong because lessons learned meetings are explicitly non-punitive and focus on process improvement, not assigning blame, which would discourage open reporting and hinder future incident handling. Option B is wrong while regulatory compliance may require documentation of post-incident reviews, the primary purpose is not compliance but operational improvement; compliance is a secondary benefit. Option C is wrong because calculating financial cost is typically part of a separate damage assessment or forensic accounting, not the core objective of a lessons learned meeting, which centers on process effectiveness.
Which TWO of the following are types of intrusion detection systems (IDS) based on the detection method?
Detects deviations from baseline behavior.
Why this answer
The two types of IDS based on detection method are anomaly-based (detects deviations from normal behavior) and signature-based (matches known attack patterns). Host-based and network-based are types based on deployment location, not detection method. Rule-based is often considered a subtype of signature-based detection.
Therefore, options A (Anomaly-based) and D (Signature-based) are correct.
A security analyst notices a sudden increase in failed login attempts from a single IP address across multiple user accounts. Which risk response strategy is most appropriate to implement immediately?
Blocking the source IP mitigates the ongoing brute-force attempt.
Why this answer
Blocking the IP address is immediate risk mitigation that stops the ongoing attack. Option B is wrong because changing all passwords is a more disruptive and time-consuming remediation step, not the immediate first response. Option C is wrong because risk transfer (e.g., cyber insurance) does not stop the active threat.
Option D is wrong because risk acceptance is not appropriate when an active threat is present.
A security administrator is reviewing backup procedures for a database server. The current backup policy mandates a full backup every Sunday and differential backups Tuesday through Friday. On Wednesday, a failure occurs, and the database is lost. The last successful full backup was completed on Sunday, and the last differential backup was completed on Tuesday. How many backup sets are needed to restore the database to its state as of Tuesday?
Full backup plus the latest differential backup.
Why this answer
To restore the database to its state as of Tuesday, you need the last full backup (Sunday) and the last differential backup (Tuesday). A differential backup contains all changes since the last full backup, so applying the Tuesday differential to the Sunday full backup recovers all data up to Tuesday. The Wednesday failure does not affect the Tuesday state, and no other backups are required.
Exam trap
The trap here is confusing differential backups with incremental backups, leading candidates to think they need all backups from Sunday through Tuesday (3 or 4 sets), when differential backups only require the last full and the most recent differential.
How to eliminate wrong answers
Option A is wrong because 4 backup sets would be needed only if you were using incremental backups (which require all backups since the last full), but the policy uses differential backups. Option B is wrong because 3 backup sets would be needed if you had to restore from Sunday full, Tuesday differential, and Wednesday differential (if it existed), but the Wednesday backup was never completed. Option D is wrong because 1 backup set (only the full backup) would restore the database to Sunday's state, not Tuesday's state, missing the changes captured in the Tuesday differential.
A company is implementing single sign-on (SSO) for its internal applications. Which TWO of the following protocols are commonly used for SSO?
Kerberos provides SSO within a domain.
Why this answer
Kerberos and SAML are both widely used for SSO. Kerberos is common in Windows domains, while SAML is used for web-based federated SSO. LDAP is a directory protocol, OAuth is for authorization (though OIDC adds authentication), and RADIUS is for network access.
Which THREE of the following are considered cryptographic best practices for key management? (Select exactly 3.)
Using the same key for both purposes weakens security.
Why this answer
Using separate keys for encryption and digital signatures ensures that compromising one key does not affect the other. This separation aligns with the principle of key usage restrictions, as defined in NIST SP 800-57, which mandates distinct keys for different cryptographic operations to prevent misuse and maintain non-repudiation.
Exam trap
ISC2 often tests the misconception that convenience (like storing keys with data) is acceptable, when in fact it violates the core security principle of key separation and confidentiality.
Which TWO of the following are examples of key risk indicators (KRIs)?
A high number indicates higher risk of exploitation.
Why this answer
The number of unpatched critical vulnerabilities directly measures the organization's exposure to known exploits. A KRI must be quantifiable and predictive of risk; unpatched vulnerabilities are a leading indicator of potential breaches, as attackers actively scan for and exploit such weaknesses. This metric is commonly tracked in vulnerability management programs to prioritize remediation efforts.
Exam trap
ISC2 often tests the distinction between leading indicators (KRIs) and lagging indicators (outcome metrics), so candidates mistakenly select 'Number of security incidents this quarter' because it seems risk-related, but it is a historical outcome, not a predictive risk indicator.
Practice SSCP by domain
Target a specific domain to shore up weak areas.