Courseiva

Systems Security Certified Practitioner SSCP (SSCP) — Questions 601–675

920 questions total · 13pages · All types, answers revealed

Take a mock examExam hub
Page 8

Page 9 of 13

Page 10
601
Multi-Selecthard

An organization is enhancing its backup strategy. According to the 3-2-1 rule, which THREE characteristics must the backup strategy include? (Select THREE)

Select 3 answers
A.At least two different media types
B.Daily full backups
C.At least one copy stored offsite
D.At least three copies of the data
E.Encryption of all backups
AnswersA, C, D

e.g., disk and tape.

Why this answer

The 3-2-1 rule requires at least two different media types (e.g., tape and disk, or disk and cloud) to mitigate the risk of a single media failure or vulnerability. This ensures that if one media type becomes corrupted or obsolete, the other remains viable for recovery.

Exam trap

Candidates often confuse the 3-2-1 rule with other backup best practices like encryption or frequency. The rule strictly requires: three copies, two different media types, and one offsite copy. Security professionals may mistakenly think daily full backups or encryption are part of the rule, but they are not.

Full explanation →
602
MCQhard

An organization is implementing configuration management and wants to detect unauthorized changes to server configurations. Which of the following tools would be most effective for this purpose?

A.Configuration management database (CMDB)
B.SIEM with change detection rules
C.Vulnerability scanner
D.Patch management tool
AnswerB

A SIEM can aggregate logs and trigger alerts on specific configuration changes, making it effective for deviation detection.

Why this answer

SIEM (Security Information and Event Management) systems can collect and correlate logs from various sources. When configured with rules to detect configuration changes, such as modifications to registry keys or system files, a SIEM can generate alerts on unauthorized changes.

Full explanation →
603
Multi-Selecthard

Which THREE are required components of a core role-based access control (RBAC) system according to NIST? (Choose three.)

Select 3 answers
A.Constraints
B.Users
C.Permissions
D.Sessions
E.Roles
AnswersB, C, E

Users are the subjects that are assigned to roles.

Why this answer

(Users) is correct because in NIST's RBAC model (INCITS 359-2012), users are the human actors who are assigned to roles. The core components of RBAC are users, roles, and permissions; users are the subjects that ultimately receive permissions through their role membership. Without users, there is no entity to which roles and permissions can be assigned.

Exam trap

ISC2 often tests the distinction between core and advanced RBAC components, and the trap here is that candidates mistakenly include constraints or sessions as mandatory because they are commonly discussed in security policies, but NIST explicitly defines them as optional extensions to the core model.

Full explanation →
604
MCQhard

A cloud security team is deploying a new web application on an IaaS platform. According to the shared responsibility model, which of the following security tasks is the customer responsible for?

A.Network infrastructure security such as DDoS protection at the provider edge
B.Hypervisor security and vulnerability management
C.Patching the guest operating system and web server software
D.Physical security of the data center hosting the servers
AnswerC

The customer manages the OS and applications in IaaS, including patching.

Why this answer

In IaaS, the customer is responsible for securing the operating system, applications, and data, while the provider secures the physical infrastructure.

Full explanation →
605
MCQhard

A security analyst discovers that an internal DNS server is returning incorrect IP addresses for legitimate domains. The analyst suspects that an attacker has compromised the DNS resolver's cache. Which type of attack has likely occurred?

A.DNS amplification attack
B.SYN flood
C.DNS tunneling
D.DNS poisoning
AnswerD

The attacker corrupted the cache to redirect traffic.

Why this answer

DNS poisoning involves inserting false DNS records into a resolver's cache, redirecting users to malicious sites.

Full explanation →
606
MCQhard

Based on the exhibit, if the user attempts to upload (write) a file to the shared data repository corporate-data, what is the result?

A.Allowed because the access policy likely allows public writes
B.Denied because the explicit deny overrides any allow
C.Denied because write permission is not explicitly allowed
D.Allowed because the policy also allows read access
AnswerB

Denied because the explicit deny overrides any allow

Why this answer

The resource's access control policy includes an explicit deny statement that denies write permission for the user's principal. In standard access control policy evaluation, an explicit deny always overrides any allow, regardless of other permissions. Therefore, even if other statements allow write access, the explicit deny blocks the upload.

Exam trap

The trap here is that candidates often assume an explicit allow for write would override a deny, but in access control policies, an explicit deny always wins, making the presence of any deny statement the decisive factor.

How to eliminate wrong answers

Option A is wrong because the bucket policy does not allow public puts; it contains an explicit deny that overrides any potential allow. Option C is wrong because the issue is not the absence of an explicit allow but the presence of an explicit deny, which takes precedence. Option D is wrong because GetObject permission is irrelevant to PutObject; each action is evaluated independently, and the explicit deny for PutObject still applies.

Full explanation →
607
MCQeasy

Refer to the exhibit. An analyst sees these logs and is concerned about a potential attack. What is the most likely scenario?

A.Denial of service (DoS)
B.SSH brute force
C.Successful RDP connection
D.Port scan
AnswerC

The full handshake and FIN indicate a normal RDP session to port 3389.

Why this answer

The log shows a successful RDP connection (source IP 10.0.0.5, destination port 3389, with 'Session established' or similar success indicator). RDP is a common target for lateral movement after initial compromise, and a single successful connection from an external IP to an internal host is a strong indicator of an attacker gaining remote access, not a brute force attempt (which would show multiple failures) or a scan (which would show many ports).

Exam trap

The trap here is that candidates see a single connection to a common service and assume it is a brute force or scan, but the key is the 'successful' indicator—brute force attacks show failures, and scans show multiple attempts, not a single established session.

How to eliminate wrong answers

Option A is wrong because a denial of service attack would show a flood of traffic, high packet rates, or resource exhaustion indicators, not a single successful session log. Option B is wrong because an SSH brute force would target port 22, not 3389, and would show numerous failed authentication attempts before any success, not a single established session. Option D is wrong because a port scan would show connection attempts to multiple ports (e.g., SYN packets to a range of ports) from the same source, not a single successful connection to one specific port.

Full explanation →
608
MCQeasy

When implementing a digital signature, which key is used to create the signature?

A.Receiver's private key
B.Sender's private key
C.Sender's public key
D.Receiver's public key
AnswerB

The private key is used to sign documents.

Why this answer

In a digital signature scheme, the sender uses their own private key to create the signature. This ensures non-repudiation because only the sender possesses that private key, and the corresponding public key can verify the signature. The process involves encrypting a hash of the message with the sender's private key, as specified in standards like PKCS#1 and RFC 8017.

Exam trap

The trap here is that candidates often confuse the roles of keys in encryption versus signing, mistakenly thinking the receiver's private key or the sender's public key is used to create the signature because they associate 'private' with secrecy and 'public' with sharing, without understanding the specific asymmetric operations required for non-repudiation.

How to eliminate wrong answers

Option A is wrong because the receiver's private key is used for decryption in asymmetric encryption, not for creating a digital signature; using it would allow anyone with the receiver's public key to forge the signature. Option C is wrong because the sender's public key is used to verify the signature, not create it; using it to sign would allow anyone to create a valid signature since the public key is widely known. Option D is wrong because the receiver's public key is used for encrypting messages to the receiver, not for signing; it cannot provide non-repudiation as the sender does not possess the corresponding private key.

Full explanation →
609
MCQeasy

After a security incident, the CISO asks for a report detailing which assets were affected, the attack vector, and the financial impact. Which of the following best describes this report?

A.Lessons learned report
B.Incident response plan
C.Risk register
D.Business impact analysis (BIA)
AnswerA

A lessons learned report captures post-incident details and improvements.

Why this answer

A lessons learned report is a post-incident document that captures what happened during a security incident, including affected assets, the attack vector, and financial impact. It is used to improve future incident response processes and is distinct from operational plans or risk assessments.

Exam trap

ISC2 often tests the distinction between proactive planning documents (incident response plan, BIA) and reactive post-incident reports (lessons learned), leading candidates to confuse the BIA's financial impact analysis with the incident-specific financial impact in the lessons learned report.

How to eliminate wrong answers

Option B is wrong because an incident response plan is a pre-defined set of procedures for detecting, responding to, and recovering from incidents, not a post-incident summary of specific impacts. Option C is wrong because a risk register is a living document that logs identified risks, their likelihood, and mitigation status, not a retrospective report on a single incident. Option D is wrong because a business impact analysis (BIA) identifies critical business functions and their recovery priorities, not the details of a specific security event.

Full explanation →
610
MCQhard

During a forensic investigation, a responder must collect evidence from a live Windows system. Which of the following represents the correct order for collecting volatile data?

A.Disk image, memory dump, process list, network connections
B.Memory dump, network connections, process list, disk image
C.Process list, memory dump, disk image, network connections
D.Network connections, memory dump, process list, disk image
AnswerB

Correct. Memory is the most volatile data.

Why this answer

Volatile data must be collected in order of decreasing volatility to avoid losing critical evidence. Memory (RAM) is the most volatile, followed by network connections and process lists (which change rapidly), and finally disk images (persistent storage). This order ensures that transient data is captured before it disappears.

Exam trap

The trap here is that candidates often think disk imaging is the most critical step and should be done first, but the SSCP exam tests the principle that volatile data (memory) must be captured before any non-volatile collection to prevent evidence loss.

How to eliminate wrong answers

Option A is wrong because it starts with a disk image, which is non-volatile, and places memory dump after it, risking loss of volatile data like running processes and network connections. Option C is wrong because it places process list before memory dump, but process list data resides in memory and can change if the system is altered during memory capture; memory must be collected first. Option D is wrong because it starts with network connections, which are more volatile than memory dump; memory should be captured before network state to avoid changes from system activity.

Full explanation →
611
Multi-Selectmedium

An organization wants to implement separation of duties to reduce the risk of fraud. Which THREE of the following are common techniques used to enforce separation of duties?

Select 3 answers
A.Audit logging and monitoring of privileged actions
B.Role-based access control with mutually exclusive roles
C.Enforcing complex password policies
D.Using biometric authentication
E.Requiring two or more people to approve a transaction
AnswersA, B, E

Logging provides accountability, a key component of separation of duties.

Why this answer

Separation of duties is enforced through role-based access control (assigning conflicting roles to different users), requiring dual authorization for critical actions, and audit logging for accountability. Password complexity and biometrics are authentication, not separation of duties.

Full explanation →
612
MCQmedium

A company's security policy requires that employees must change their passwords every 60 days. However, help desk tickets show that many users are locked out after forgetting their new passwords. Which of the following would BEST balance security and usability?

A.Require users to use a password manager
B.Extend the password change interval to 90 days
C.Disable account lockout after failed attempts
D.Implement single sign-on (SSO) for all applications
AnswerD

SSO reduces password fatigue and thus forgotten passwords.

Why this answer

Single sign-on (SSO) reduces the number of passwords users must remember to one set of credentials, which decreases the likelihood of forgotten passwords and lockouts. By centralizing authentication, SSO allows the organization to enforce a strong password policy (e.g., 60-day rotation) while improving usability, as users only need to manage a single password. This balances security (centralized control, stronger authentication) with usability (fewer password resets).

Exam trap

The trap here is that candidates may choose to extend the password change interval (Option B) thinking it reduces user burden, but the SSCP exam emphasizes that usability improvements must not weaken security controls like password rotation frequency or account lockout policies.

How to eliminate wrong answers

Option A is wrong because requiring a password manager does not reduce the number of passwords users must remember or change; it only stores them, and users may still forget the master password or fail to update stored passwords, leading to continued lockouts. Option B is wrong because extending the password change interval to 90 days reduces security by increasing the window of exposure for compromised credentials, and it does not address the root cause of forgotten passwords (users still have multiple passwords to remember). Option C is wrong because disabling account lockout removes a critical security control that prevents brute-force attacks, violating security policy and increasing risk of unauthorized access.

Full explanation →
613
MCQmedium

A security analyst is evaluating encryption modes for a new system that requires authenticated encryption to ensure both confidentiality and integrity of data in transit. Which AES mode should the analyst recommend?

A.ECB
B.CBC
C.CTR
D.GCM
AnswerD

GCM provides authenticated encryption.

Why this answer

GCM (Galois/Counter Mode) is the correct choice because it provides authenticated encryption, combining the confidentiality of CTR mode with integrity verification via a Galois field authentication tag. This makes it ideal for securing data in transit, as it ensures both privacy and tamper detection in a single, efficient operation.

Exam trap

The trap here is that candidates often confuse confidentiality-only modes (like CBC or CTR) with authenticated encryption, overlooking that GCM is the only option listed that natively provides both encryption and integrity in a single mode.

How to eliminate wrong answers

Option A is wrong because ECB (Electronic Codebook) mode encrypts each block independently, producing identical ciphertext for identical plaintext blocks, which leaks patterns and provides no integrity protection. Option B is wrong because CBC (Cipher Block Chaining) mode ensures confidentiality through chaining but does not inherently provide authentication or integrity; it requires a separate MAC (e.g., HMAC) for authenticated encryption. Option C is wrong because CTR (Counter) mode offers confidentiality by encrypting a counter value, but like CBC, it lacks built-in integrity verification and is vulnerable to bit-flipping attacks without an additional authentication mechanism.

Full explanation →
614
MCQmedium

A security analyst notices unusual outbound traffic from a server in the DMZ to an external IP address on port 4444. The server runs a web application. Which action should the analyst take first?

A.Disconnect the server from the network.
B.Reboot the server to clear any malware.
C.Check the server's running processes and established connections.
D.Block the outbound traffic at the firewall.
AnswerC

This provides immediate visibility into potential compromise without destroying evidence.

Why this answer

The first step in incident response is to gather forensic evidence and understand the scope of the compromise. Checking running processes and established connections allows the analyst to identify the malicious process, its parent, and the active command-and-control (C2) channel on port 4444, which is commonly associated with reverse shells or backdoor traffic. This data is volatile and must be captured before any disruptive action like disconnection or reboot, which would destroy evidence.

Exam trap

The trap here is that candidates often choose to immediately block or disconnect, confusing containment with the first step of incident response, which must always be evidence preservation and scoping.

How to eliminate wrong answers

Option A is wrong because immediately disconnecting the server from the network destroys volatile evidence (e.g., active network connections, memory-resident malware) and may alert the attacker, hindering forensic analysis. Option B is wrong because rebooting clears memory-resident malware and volatile forensic data, such as running processes and network connections, making root cause analysis impossible. Option D is wrong because blocking outbound traffic at the firewall without first investigating the source may disrupt the attacker's C2 channel, but it also prevents the analyst from observing the attacker's actions and collecting evidence; it should be done only after evidence is preserved.

Full explanation →
615
MCQmedium

After an incident, the team identifies that the incident was caused by a missing security patch. Which of the following is the MOST effective way to prevent recurrence?

A.Conduct phishing simulations
B.Increase network monitoring
C.Implement a patch management policy
D.Update the incident response plan
AnswerC

A policy ensures patches are applied in a timely manner, preventing recurrence.

Why this answer

A missing security patch indicates a failure in the vulnerability management lifecycle. Implementing a patch management policy ensures that patches are systematically identified, tested, and deployed, directly addressing the root cause. This is the most effective preventive measure because it establishes a recurring process to close known vulnerabilities before they can be exploited.

Exam trap

The trap here is that candidates often confuse reactive measures (monitoring, response plans) with proactive prevention, or they mistakenly think user training (phishing simulations) addresses a technical configuration failure.

How to eliminate wrong answers

Option A is wrong because phishing simulations address social engineering attacks, not missing patches; they test user awareness, not system configuration. Option B is wrong because increasing network monitoring improves detection of ongoing attacks but does not prevent exploitation of unpatched vulnerabilities. Option D is wrong because updating the incident response plan improves future response efficiency but does not prevent the initial cause—the missing patch—from recurring.

Full explanation →
616
Multi-Selecteasy

A network administrator is implementing segmentation to limit the spread of malware. Which two technologies can achieve network segmentation? (Choose two.)

Select 2 answers
A.Firewalls
B.VPN
C.NAT
D.Subnetting
E.VLANs
AnswersA, E

Firewalls can segment by controlling traffic between network zones.

Why this answer

Firewalls are correct because they can enforce network segmentation by controlling traffic between network segments based on security policies. By placing firewalls at segment boundaries, administrators can filter traffic using rules that inspect source/destination IP addresses, ports, and application-layer data, thereby limiting the lateral spread of malware.

Exam trap

The trap here is that candidates often confuse subnetting with segmentation, not realizing that subnetting alone provides no traffic filtering or isolation without a firewall or router ACL, and that VPNs are for secure tunneling, not internal network partitioning.

Full explanation →
617
MCQmedium

A security administrator is implementing an access control system that uses sensitivity labels on subjects and objects. The policy dictates that a subject can only read objects with a label equal to or lower than the subject's clearance, and can only write to objects with a label equal to or higher than the subject's clearance. Which access control model and principle is being enforced?

A.MAC with Bell-LaPadula model
B.MAC with Biba model
C.DAC with owner-based permissions
D.RBAC with role hierarchy
AnswerA

Bell-LaPadula uses mandatory labels and enforces no read up and no write down for confidentiality.

Why this answer

Bell-LaPadula model enforces confidentiality through the simple security property (no read up) and the *-property (no write down). The described rules match Bell-LaPadula's restrictions.

Full explanation →
618
MCQeasy

A network administrator implements the firewall rules above. What is the effect of this rulebase?

A.HTTP and HTTPS traffic from all networks is blocked
B.HTTP and HTTPS traffic from the 10.0.0.0/8 network is allowed
C.All traffic from the 10.0.0.0/8 network is blocked
D.The deny rule is redundant because permit rules exist
AnswerB

The permit rules (1 and 2) are listed before the deny rule, so they match first.

Why this answer

Firewall rules are processed top-down; the first match applies. Rule 1 permits HTTP/HTTPS traffic from source 10.0.0.0/8 to any destination. Rule 2 permits similar traffic from other networks (but that is irrelevant).

Rule 3 denies all traffic from 10.0.0.0/8, but because Rule 1 matches first for HTTP/HTTPS from that network, the deny rule is never evaluated for those protocols. Therefore, HTTP and HTTPS traffic from the 10.0.0.0/8 network is allowed, making option B correct. Options A and C are incorrect due to the logic above.

Option D is incorrect because the deny rule is not redundant; it blocks non-HTTP/HTTPS traffic from 10.0.0.0/8, which would otherwise be implicitly denied anyway.

Full explanation →
619
MCQeasy

A company wants to ensure that data transmitted between its two branch offices remains confidential. Which cryptographic goal is primarily being addressed?

A.Availability
B.Non-repudiation
C.Integrity
D.Confidentiality
AnswerD

Confidentiality is the goal of keeping data secret, achieved via encryption.

Why this answer

Confidentiality ensures that data is accessible only to authorized parties, typically achieved through encryption. In this scenario, the company wants to prevent unauthorized interception of data between branch offices, which is the core goal of confidentiality. Technologies such as IPsec VPNs or TLS are used to encrypt the data in transit, directly addressing this requirement.

Exam trap

The trap here is that candidates often confuse confidentiality with integrity, mistakenly thinking that protecting data from modification also prevents it from being read, but encryption alone does not guarantee integrity unless combined with a MAC or authenticated encryption mode like GCM.

How to eliminate wrong answers

Option A is wrong because availability ensures that systems and data are accessible when needed, often through redundancy or fault tolerance, not by protecting data from eavesdropping. Option B is wrong because non-repudiation provides proof of origin or delivery of data, typically via digital signatures, and does not prevent unauthorized reading of the data. Option C is wrong because integrity ensures that data has not been altered during transit, often using hashing or MACs, but does not protect against unauthorized viewing of the data.

Full explanation →
620
MCQhard

A company is preparing for a PCI DSS assessment. According to PCI DSS requirements, how frequently must internal vulnerability scans be performed?

A.Annually
B.Monthly
C.Weekly
D.Quarterly
AnswerD

PCI DSS mandates quarterly scans.

Why this answer

PCI DSS Requirement 11.2.1 mandates that internal vulnerability scans must be performed at least quarterly and after any significant change in the network. This frequency ensures that new vulnerabilities introduced since the last scan are identified and remediated before they can be exploited. Quarterly scans are a minimum; more frequent scanning is recommended for high-risk environments.

Exam trap

The trap here is that candidates often confuse the quarterly internal scan requirement with the weekly external scan requirement (for internet-facing systems), leading them to incorrectly select 'Weekly' as the answer.

How to eliminate wrong answers

Option A is wrong because annual scans are far too infrequent to meet PCI DSS requirements, which demand a minimum of quarterly scans to keep pace with emerging vulnerabilities. Option B is wrong because monthly scans, while more frequent than required, are not the mandated minimum; PCI DSS specifically requires quarterly scans, not monthly. Option C is wrong because weekly scans are not required by PCI DSS for internal scans; the standard explicitly states quarterly as the baseline frequency, though weekly scans may be used for external scans or as a best practice.

Full explanation →
621
MCQmedium

A system administrator receives an alert from the SIEM indicating a possible brute-force attack on a server. The logs show 100 failed logins in 2 minutes from a single source. Which of the following is the best immediate action to verify and respond?

A.Immediately disable the user account that was targeted most
B.Check firewall logs for the source IP and block it in the firewall
C.Reset all user passwords and enable multi-factor authentication
D.Ignore the alert because it is likely a false positive
AnswerB

This confirms the attack and stops it at network perimeter.

Why this answer

The immediate priority is to stop the ongoing attack by blocking the source IP at the firewall. Checking firewall logs confirms the source IP and ensures the block is applied to the correct address, preventing further authentication attempts. This aligns with the principle of containment before remediation in incident response.

Exam trap

The trap here is that candidates confuse immediate containment (blocking the source IP) with long-term remediation (resetting passwords or disabling accounts), leading them to choose a reactive user-focused action instead of a network-level control to stop the attack in progress.

How to eliminate wrong answers

Option A is wrong because disabling the targeted user account does not stop the brute-force attack; the attacker can simply target another account or continue with different usernames, and it may disrupt legitimate user access without addressing the source. Option C is wrong because resetting all passwords and enabling MFA is a long-term remediation step, not an immediate action; it is premature without first verifying the attack and containing it, and it could cause widespread disruption. Option D is wrong because ignoring the alert assumes a false positive without verification; 100 failed logins in 2 minutes from a single source is a strong indicator of a brute-force attack and requires investigation, not dismissal.

Full explanation →
622
Multi-Selecthard

During a post-implementation review of a recent change, it is found that the change introduced a security vulnerability. What TWO actions should be taken? (Select TWO)

Select 2 answers
A.Immediately apply a patch
B.Document the findings and update processes
C.Roll back the change
D.Blame the change implementer
E.Proceed and accept the risk
AnswersB, C

Improves future change management.

Why this answer

Documenting findings and updating processes is a fundamental part of the change management lifecycle. It ensures that the security vulnerability is formally recorded, root causes are analyzed, and preventive measures are incorporated into future changes. This aligns with the post-implementation review (PIR) phase, where lessons learned are captured to improve security operations and administration.

Exam trap

The trap here is that candidates often confuse the immediate operational response (rollback or patch) with the post-review documentation step, but the question specifically asks for actions during the post-implementation review, not the initial incident response.

Full explanation →
623
Multi-Selecthard

Which THREE of the following are appropriate techniques for securely disposing of magnetic hard disk drives that contain sensitive data? (Choose three.)

Select 3 answers
A.Low-level format
B.Shredding
C.Quick format
D.Overwriting with random patterns
E.Degaussing
AnswersB, D, E

Physical destruction renders the drive unreadable.

Why this answer

Shredding (B) physically destroys the platters, making data recovery impossible regardless of the magnetic state. This is a definitive disposal method for sensitive data on magnetic hard disk drives.

Exam trap

The trap here is that candidates often confuse 'low-level format' or 'quick format' with secure erasure, not realizing these methods leave recoverable data on the platters.

Full explanation →
624
Multi-Selectmedium

Which TWO of the following are characteristics of a Mandatory Access Control (MAC) system?

Select 2 answers
A.Access decisions are based on security labels.
B.Access is determined by the owner of the object.
C.It uses roles to assign permissions.
D.Users can change permissions on their own objects.
E.It is commonly used in military environments.
AnswersA, E

MAC relies on labels assigned to subjects and objects to determine access.

Why this answer

Mandatory Access Control (MAC) systems use security labels (e.g., classifications like Top Secret, Secret, Confidential) attached to subjects and objects. The operating system or reference monitor enforces access decisions based on these labels and a set of rules (e.g., the Bell-LaPadula model's simple security property and *-property), not at the discretion of users or owners. This ensures that access is determined by a central policy, typically implemented via labels in systems like SELinux or Trusted Solaris.

Exam trap

The trap here is that candidates often confuse MAC with DAC or RBAC, mistakenly thinking that owners or roles can override label-based policies, when in fact MAC strictly enforces system-wide rules that neither users nor owners can modify.

Full explanation →
625
MCQeasy

During which phase of the NIST SP 800-61 incident response lifecycle are incident response plan updates and lessons learned typically documented?

A.Preparation
B.Containment, Eradication, and Recovery
C.Detection and Analysis
D.Post-Incident Activity
AnswerD

Correct. This phase is dedicated to learning from the incident and improving future response.

Why this answer

The Post-Incident Activity phase of NIST SP 800-61 is specifically designed for conducting lessons learned meetings, documenting improvements, and updating the incident response plan based on findings from the incident. This phase ensures that the organization captures feedback to refine procedures, tools, and training for future incidents.

Exam trap

The trap here is that candidates confuse the Post-Incident Activity phase with the Preparation phase, mistakenly thinking that plan updates occur before incidents, but NIST SP 800-61 explicitly places lessons learned and plan updates after the incident is resolved.

How to eliminate wrong answers

Option A is wrong because the Preparation phase focuses on establishing policies, tools, and training before an incident occurs, not on documenting updates after an incident. Option B is wrong because Containment, Eradication, and Recovery phases are operational steps to stop the incident, remove threats, and restore systems, not for retrospective documentation. Option C is wrong because Detection and Analysis involves identifying and analyzing potential incidents, not capturing lessons learned or updating plans.

Full explanation →
626
Multi-Selecthard

Which THREE of the following are critical elements of a patch management policy? (Select THREE)

Select 3 answers
A.Patch prioritization based on CVSS score and asset criticality
B.Immediate deployment of all patches without testing
C.Annual review of patch status
D.Vulnerability scanning to identify missing patches
E.Testing patches in a staging environment
AnswersA, D, E

Prioritization ensures critical patches are applied first.

Why this answer

Patch prioritization based on CVSS score and asset criticality ensures that resources are allocated to the most impactful vulnerabilities first. CVSS provides a standardized severity rating (0-10), while asset criticality accounts for the business value and exposure of the system, enabling risk-based decision-making rather than a one-size-fits-all approach.

Exam trap

In this question, the trap is that candidates might select 'Immediate deployment of all patches without testing' (Option B) or 'Annual review of patch status' (Option C) thinking they are critical elements. However, patch management requires testing, prioritization, and continuous verification, not haphazard deployment or infrequent reviews.

Full explanation →
627
MCQmedium

A security analyst notices an unusual number of ARP replies on the network where one MAC address is claiming to be multiple IP addresses. Which type of attack is most likely occurring?

A.ARP spoofing
B.SYN flood
C.DNS poisoning
D.DHCP starvation
AnswerA

Attacker sends gratuitous ARP replies to poison the ARP cache.

Why this answer

ARP spoofing involves sending forged ARP replies to associate the attacker's MAC with the victim's IP, enabling man-in-the-middle attacks at Layer 2.

Full explanation →
628
MCQhard

During a user offboarding process, the security team must ensure that the former employee's access is revoked immediately. However, the user's manager requests that the account remain active for a week to review files. What is the BEST practice?

A.Change the account to a service account and keep it active
B.Disable the account immediately and transfer ownership of files to the manager
C.Keep the account active but change the password and share it with the manager
D.Leave the account as-is and monitor activity for the week
AnswerB

Correct. This balances security with business needs.

Why this answer

Best practice is to disable the account immediately to prevent unauthorized access, then transfer ownership of necessary files to another user for review. Keeping the account active poses a security risk.

Full explanation →
629
MCQmedium

A company experiences a security breach where an attacker gained access to the network through a compromised vendor account. Which of the following controls would have BEST prevented this attack?

A.Install a network-based intrusion detection system.
B.Require vendors to sign an NDA.
C.Create a separate VLAN for vendor access.
D.Enable multi-factor authentication for vendor accounts.
AnswerD

MFA makes it harder for attackers to use stolen credentials.

Why this answer

Multi-factor authentication (MFA) for vendor accounts is the best preventive control because it adds an additional layer of security beyond just a password. Even if the attacker compromises the vendor's credentials, MFA requires a second factor (e.g., a one-time code from a token or biometric) to authenticate, effectively blocking unauthorized access. This directly addresses the attack vector of credential theft, which was the root cause of the breach.

Exam trap

The trap here is that candidates often confuse network segmentation (VLANs) with access control, mistakenly believing that isolating vendor traffic on a separate VLAN prevents credential-based attacks, when in fact VLANs do not authenticate users or validate the legitimacy of the account being used.

How to eliminate wrong answers

Option A is wrong because a network-based intrusion detection system (NIDS) is a detective control that monitors traffic for suspicious patterns after the attack has begun, not a preventive control that stops initial access via compromised credentials. Option B is wrong because a non-disclosure agreement (NDA) is a legal contract that addresses confidentiality after access is granted, not a technical control that prevents unauthorized access through a compromised account. Option C is wrong because creating a separate VLAN for vendor access segments network traffic but does not prevent an attacker from using stolen credentials to authenticate into that VLAN; VLANs provide network isolation, not authentication security.

Full explanation →
630
MCQmedium

You are a security analyst at a financial institution. The company uses a role-based access control (RBAC) system for its internal banking application. Recently, the compliance team discovered that a teller, who should only have access to customer account information for their branch, was able to view account details for customers in other branches. The RBAC system assigns roles based on job titles. You review the configuration and find that the 'Teller' role has a permission that allows viewing all customer accounts, regardless of branch. The company wants to enforce branch-level restrictions. Which of the following is the best approach to address this issue?

A.Implement attribute-based access control (ABAC) to incorporate branch location as an attribute.
B.Use mandatory access control (MAC) with labels for each customer account.
C.Create separate roles for each branch, such as 'Teller_Branch1', 'Teller_Branch2', etc.
D.Modify the 'Teller' role to remove the permission to view all accounts.
AnswerA

Adding an attribute for branch location and using ABAC in conjunction with RBAC allows fine-grained control. This approach is scalable and minimizes administrative overhead because permissions are evaluated dynamically based on the user's branch attribute.

Why this answer

ABAC extends RBAC by evaluating attributes (e.g., branch location) at access time, enabling fine-grained per-branch restrictions without role explosion. Option B is incorrect: MAC with labels would require re-labeling all accounts and users, which is complex and less flexible than ABAC for this dynamic requirement. Option C is incorrect because creating separate roles per branch leads to role explosion (many roles to manage) and does not scale well.

Option D is insufficient because simply removing the permission to view all accounts would prevent tellers from seeing any branch data; they need branch-specific access, not a global removal.

Full explanation →
631
Multi-Selecthard

Which TWO of the following are key indicators of a potential data exfiltration attempt?

Select 2 answers
A.Large number of failed login attempts from multiple accounts
B.Unusual outbound traffic to a known malicious IP address
C.Multiple firewall rule changes in a short period
D.Successful logins from unusual geolocations for multiple users
E.Sudden increase in database read operations by a single user account
AnswersB, E

This is a direct indicator of data being sent to an external threat actor.

Why this answer

Unusual outbound traffic to a known malicious IP address (B) is a direct sign of data being sent to an attacker. Sudden increase in database read operations by a single user (E) could indicate data harvesting. Failed login attempts (A) indicate brute force but not exfiltration.

Firewall rule changes (C) are more about network changes. Successful logins from unusual geolocations (D) indicate compromised credentials, not necessarily exfiltration itself.

Full explanation →
632
Multi-Selectmedium

Which THREE activities are part of the post-incident phase?

Select 3 answers
A.Lessons learned meeting
B.Conduct root cause analysis
C.Notify affected customers
D.Reimage infected computers
E.Update incident response plan
AnswersA, B, E

Post-incident review includes identifying improvements.

Why this answer

Options A, B, and E are correct. Lessons learned meetings, conducting root cause analysis, and updating the incident response plan are key post-incident activities. Reimaging computers (D) is part of the eradication phase, and notifying affected customers (C) typically occurs during the containment and response phase, not post-incident.

Full explanation →
633
MCQhard

A vulnerability scanner reports a medium-severity finding on a server. After investigation, the security team determines that the vulnerability is not exploitable due to existing compensating controls. How should this finding be classified in the vulnerability management process?

A.True positive
B.Risk acceptance
C.False positive
D.False negative
AnswerC

False positive indicates the scanner incorrectly identified a vulnerability.

Why this answer

A false positive occurs when a vulnerability scanner reports a finding that, upon investigation, is determined not to be a real security risk. In this case, the vulnerability is not exploitable due to compensating controls, meaning the scanner's alert was incorrect in the context of the actual environment. Therefore, the finding should be classified as a false positive, not a true vulnerability.

Exam trap

The trap here is that candidates confuse a non-exploitable vulnerability with a true positive, failing to recognize that the classification depends on actual exploitability in the current environment, not just the presence of a potential weakness.

How to eliminate wrong answers

Option A is wrong because a true positive would mean the vulnerability is actually exploitable and poses a real risk, which contradicts the investigation finding that it is not exploitable. Option B is wrong because risk acceptance is a management decision to accept the risk of a real vulnerability, not a classification for a finding that is not actually exploitable. Option D is wrong because a false negative would mean the scanner failed to report a real vulnerability, which is the opposite of this scenario where a reported finding is determined to be non-exploitable.

Full explanation →
634
Multi-Selecthard

Which THREE of the following are characteristics of a stateful firewall?

Select 3 answers
A.Is generally slower than a stateless firewall
B.Maintains a state table of active connections
C.Can make decisions based on traffic patterns
D.Operates only at the network layer (Layer 3)
E.Performs deep packet inspection (DPI)
AnswersA, B, C

Stateful inspection requires more processing.

Why this answer

Stateful firewalls maintain a state table that tracks the state of active connections, allowing them to make decisions based on the context of traffic patterns, such as the TCP three-way handshake. This additional processing overhead generally makes them slower than stateless firewalls, which only inspect packet headers individually without connection tracking.

Exam trap

ISC2 often tests the misconception that stateful firewalls perform deep packet inspection, but DPI is a separate capability of NGFWs, while stateful firewalls focus on session-layer tracking.

Full explanation →
635
Multi-Selecteasy

Which TWO of the following are best practices for securing a wireless network? (Choose two.)

Select 2 answers
A.Disable SSID broadcast
B.Set a short, simple pre-shared key for convenience
C.Use WEP encryption
D.Enable MAC address filtering
E.Use WPA3 encryption
AnswersA, E

Hiding SSID reduces visibility to casual scanners.

Why this answer

Disabling SSID broadcast prevents the access point from including the network name in beacon frames, making the network less visible to casual scanning tools. However, it is not a security measure because the SSID is still transmitted in probe requests and responses, and can be easily discovered using packet capture tools like Wireshark or airodump-ng. It is considered a best practice only as a minor obscurity layer, not a replacement for strong encryption.

Exam trap

ISC2 often tests the misconception that disabling SSID broadcast is a strong security measure, when in reality it is only a minor obscurity technique that does not prevent determined attackers from discovering the network.

Full explanation →
636
Multi-Selectmedium

Which TWO of the following are key components of a Business Impact Analysis (BIA)?

Select 2 answers
A.Recovery time objective.
B.Vulnerability assessment.
C.Criticality analysis.
D.Likelihood estimation.
E.Threat modeling.
AnswersA, C

RTO specifies the maximum acceptable downtime for a process.

Why this answer

A Recovery Time Objective (RTO) is a key component of a Business Impact Analysis (BIA) because it defines the maximum acceptable downtime for a business process or system after a disruption. The BIA identifies critical functions and their dependencies, and RTO is derived from the financial and operational impact of downtime, directly informing recovery strategy and resource allocation.

Exam trap

ISC2 often tests the distinction between BIA components (RTO, criticality analysis) and risk assessment components (vulnerability assessment, likelihood, threat modeling), causing candidates to conflate impact analysis with risk analysis.

Full explanation →
637
MCQhard

A security engineer is designing a system that must ensure data integrity at all costs, even if it means sacrificing availability. Which access control model and corresponding principle should be applied?

A.Bell-LaPadula with no read-down
B.Biba with no read-up
C.Biba with no write-up and no read-down
D.Bell-LaPadula with no write-up
AnswerC

Biba enforces no write-up (to protect higher integrity) and no read-down (to prevent corruption). This prioritizes integrity over availability.

Why this answer

Biba is a MAC model that focuses on integrity, preventing subjects from writing to higher integrity levels (no write-up) and preventing subjects from reading lower integrity levels (no read-down). This can impact availability.

Full explanation →
638
MCQmedium

A security analyst reviews a cryptographic implementation and notices that the same initialization vector (IV) is used repeatedly with the same key in CBC mode. What is the primary risk?

A.Loss of confidentiality
B.Loss of authentication
C.Non-repudiation is compromised
D.Loss of integrity
AnswerA

IV reuse can lead to identical ciphertext blocks for identical plaintext, revealing patterns.

Why this answer

In CBC (Cipher Block Chaining) mode, the initialization vector (IV) is XORed with the first plaintext block before encryption. Reusing the same IV with the same key means that identical plaintext blocks will produce identical ciphertext blocks, revealing patterns in the data. This directly breaks confidentiality, as an attacker can detect repeated plaintext segments, infer message structure, or even recover plaintext through known-plaintext attacks.

Exam trap

The trap here is that candidates often confuse confidentiality with integrity or authentication, mistakenly thinking IV reuse primarily enables data tampering (integrity) or impersonation (authentication), when in fact the core cryptographic weakness is the exposure of plaintext patterns, directly violating confidentiality.

How to eliminate wrong answers

Option B is wrong because loss of authentication refers to the inability to verify the origin or identity of the sender, which is not directly caused by IV reuse; CBC mode does not provide authentication by itself (that requires a MAC). Option C is wrong because non-repudiation is a property that prevents a party from denying an action, typically provided by digital signatures, not by CBC mode or IV usage. Option D is wrong because loss of integrity means data has been tampered with undetected; while IV reuse can enable certain attacks (e.g., bit-flipping), the primary and most immediate risk is the exposure of plaintext patterns, i.e., loss of confidentiality.

Full explanation →
639
MCQeasy

Which of the following is a secure hash algorithm currently recommended by NIST?

A.SHA-1
B.RC4
C.MD5
D.SHA-256
AnswerD

SHA-256 is a current standard and is considered secure.

Why this answer

SHA-256 is a member of the SHA-2 family of secure hash algorithms and is currently recommended by NIST for cryptographic use. It produces a 256-bit (32-byte) hash value and is widely deployed in protocols such as TLS, SSH, and IPsec, as well as in digital signatures and certificate validation.

Exam trap

ISC2 SSCP exams often test the distinction between hash algorithms and encryption ciphers, so candidates may mistakenly select RC4 because it is a well-known cryptographic algorithm, but it is not a hash function at all.

How to eliminate wrong answers

Option A is wrong because SHA-1 is no longer considered secure by NIST due to demonstrated collision attacks (e.g., the SHAttered attack in 2017) and is deprecated for most cryptographic applications. Option B is wrong because RC4 is a stream cipher, not a hash algorithm, and it is also deprecated due to severe biases in its output. Option C is wrong because MD5 is a broken hash algorithm with practical collision attacks (e.g., used in the Flame malware) and is explicitly not recommended by NIST for any security purpose.

Full explanation →
640
MCQmedium

Which of the following is a primary advantage of using TLS 1.3 over earlier versions?

A.Mandatory forward secrecy
B.Reduced handshake latency with 0-RTT
C.Support for RC4 cipher suites
D.Backward compatibility with SSL 3.0
AnswerA

All TLS 1.3 cipher suites use ephemeral Diffie-Hellman, providing forward secrecy.

Why this answer

TLS 1.3 requires forward secrecy for all cipher suites, meaning that session keys are not derived from the server's private key, protecting past sessions if the private key is compromised.

Full explanation →
641
Multi-Selecthard

A security engineer is designing a key management system for a large enterprise. Which two of the following practices are essential for securing cryptographic keys throughout their lifecycle?

Select 2 answers
A.Store keys in dedicated hardware security modules (HSMs).
B.Use the same key for encryption, digital signatures, and key exchange.
C.Email keys to authorized users for convenience.
D.Store keys in the same database as encrypted data.
E.Rotate keys regularly and upon compromise.
AnswersA, E

HSMs provide tamper-resistant storage and protect keys from unauthorized access.

Why this answer

Key storage in hardware security modules (HSMs) and regular key rotation are critical for key security. Storing keys with the data and emailing them violate security best practices. Using a single key for all purposes reduces security.

Full explanation →
642
Multi-Selectmedium

A security administrator is implementing the 3-2-1 backup rule. Which THREE actions are required to comply with this rule? (Select THREE.)

Select 3 answers
A.Store one copy offsite
B.Maintain at least three copies of the data
C.Use two different media types (e.g., disk and tape)
D.Perform daily full backups
E.Use encryption for all backup copies
AnswersA, B, C

Correct. Offsite copy protects against site-level disasters.

Why this answer

The 3-2-1 rule requires three copies, two different media types, and one offsite copy.

Full explanation →
643
MCQmedium

A company implements a DMZ to host public services. Which of the following is the best practice for securing the DMZ?

A.Allow all traffic from the internet to the DMZ
B.Disable logging on DMZ firewalls
C.Use separate firewall rules for inbound and outbound traffic
D.Place the DMZ behind the internal firewall
E.Use the same subnet for DMZ and internal network
AnswerC

Allows strict control over traffic flows.

Why this answer

DMZ security relies on strict separation of inbound and outbound traffic rules. Inbound rules should permit only necessary traffic (e.g., HTTP/HTTPS to web servers) from the internet to the DMZ, while outbound rules should restrict DMZ-initiated connections to the internal network, typically allowing only established sessions or specific protocols. This prevents an attacker who compromises a DMZ host from using it as a pivot to access internal resources.

Exam trap

The trap here is that candidates often confuse the DMZ's placement (thinking it should be behind the internal firewall for extra protection) with the need for separate rule sets, but the correct placement is between two firewalls (or a single firewall with three interfaces) with distinct inbound and outbound rules to enforce isolation.

How to eliminate wrong answers

Option A is wrong because allowing all traffic from the internet to the DMZ defeats the purpose of a DMZ, which is to expose only specific services while blocking all other traffic. Option B is wrong because disabling logging on DMZ firewalls eliminates the ability to detect and investigate security incidents, violating fundamental security monitoring practices. Option D is wrong because placing the DMZ behind the internal firewall would expose the internal network to direct internet traffic if the DMZ is compromised, negating the isolation a DMZ provides.

Option E is wrong because using the same subnet for DMZ and internal network removes network segmentation, allowing broadcast traffic and potential lateral movement between zones.

Full explanation →
644
MCQhard

A security analyst is tuning a SIEM and needs to reduce false positives from a rule that alerts on failed logins. The rule currently triggers on any single failed login. Which modification would best reduce false positives while still detecting brute-force attacks?

A.Add a threshold of 5 failed logins within 5 minutes
B.Disable the rule entirely
C.Increase the severity level of the alert
D.Ignore failed logins from known users
AnswerA

This reduces noise and still catches brute force.

Why this answer

Adding a threshold of 5 failed logins within 5 minutes reduces false positives from isolated accidental lockouts while still detecting the sustained pattern of failed attempts characteristic of brute-force attacks. This aligns with SIEM tuning best practices where aggregation over a time window filters out noise without losing signal.

Exam trap

The SSCP exam often tests the misconception that increasing severity or ignoring specific users reduces false positives, when in fact only time-based thresholding or contextual filtering (e.g., source IP reputation) properly addresses the root cause of noise from isolated events.

How to eliminate wrong answers

Option B is wrong because disabling the rule entirely would remove detection of brute-force attacks, creating a security gap. Option C is wrong because increasing the severity level does not reduce false positives; it only changes the alert's priority, leaving the same number of noisy alerts. Option D is wrong because ignoring failed logins from known users would miss attacks where a legitimate user's account is compromised and used for brute-force attempts, and it assumes user identity is reliably verified at the authentication layer.

Full explanation →
645
MCQhard

An organization is implementing a jump server architecture for managing critical servers. Which additional control BEST reduces the risk of lateral movement if the jump server is compromised?

A.Enable verbose logging on all target servers.
B.Require multi-factor authentication for all jump server logins.
C.Implement SSH key-based authentication with agent forwarding restricted to specific target hosts.
D.Use a separate VLAN for management traffic.
AnswerC

Restricts which hosts can be accessed from the jump server, reducing lateral movement.

Why this answer

Restricting SSH agent forwarding to specific target hosts prevents an attacker who compromises the jump server from using forwarded credentials to authenticate to arbitrary internal systems. This containment limits lateral movement by ensuring that even if the jump server is breached, the attacker cannot reuse SSH keys to pivot to non-approved targets.

Exam trap

The trap here is that candidates often choose multi-factor authentication (Option B) thinking it prevents all post-compromise risks, but MFA only protects the initial login, not lateral movement after the jump server is already compromised.

How to eliminate wrong answers

Option A is wrong because verbose logging on target servers is a detective control that records activity after the fact; it does not prevent an attacker from moving laterally from a compromised jump server. Option B is wrong because multi-factor authentication for jump server logins protects the initial access to the jump server but does not restrict lateral movement once an attacker has already compromised that server. Option D is wrong because a separate VLAN for management traffic segments network traffic but does not prevent an attacker who already controls the jump server from using its SSH agent or credentials to reach other hosts within that VLAN.

Full explanation →
646
MCQeasy

A small business uses a wireless network for employees and guests. The network uses WPA2-PSK with a single SSID, and the guest network is separate but broadcasts the same SSID. Recently, employees report intermittent connection drops and slow internet speeds. A site survey shows multiple access points from neighboring businesses operating on channels 1, 6, and 11. The business's access points are set to auto-channel selection. What is the most likely cause of the issue?

A.RADIUS server misconfiguration
B.Rogue access point
C.Channel interference due to overlapping channels
D.Weak PSK passphrase
AnswerC

Auto-channel selection often leads to channel overlap with neighboring networks, causing interference and performance degradation.

Why this answer

With multiple neighboring access points operating on channels 1, 6, and 11, and the business's access points set to auto-channel selection, the most likely cause is channel interference. Auto-channel selection may not dynamically avoid co-channel or adjacent-channel overlap, leading to contention, retransmissions, and degraded performance. The separate guest network broadcasting the same SSID can also cause client confusion and increased collisions.

Exam trap

The trap here is that candidates may confuse WPA2-PSK with WPA2-Enterprise and assume a RADIUS misconfiguration is involved, or they may overlook that auto-channel selection does not dynamically mitigate interference from neighboring APs on the same non-overlapping channels.

How to eliminate wrong answers

Option A is wrong because RADIUS server misconfiguration is irrelevant to WPA2-PSK, which uses a pre-shared key for authentication, not 802.1X/EAP; RADIUS is only used in WPA2-Enterprise mode. Option B is wrong because a rogue access point would typically present a different SSID or security configuration, and the symptoms of intermittent drops and slow speeds are more consistent with channel congestion than an unauthorized device; a rogue AP would more likely cause authentication failures or security alerts. Option D is wrong because a weak PSK passphrase does not cause intermittent connection drops or slow speeds; it would either allow connection (if correct) or prevent it (if incorrect), and performance issues are unrelated to passphrase strength.

Full explanation →
647
MCQeasy

Which protocol is used to securely transfer files over a network and operates on TCP port 22?

A.Telnet
B.SFTP
C.FTP
D.SSH
AnswerD

SSH uses TCP port 22 and provides secure encrypted communications for file transfer and remote administration.

Why this answer

SSH (Secure Shell) is used for secure remote login and file transfer, and it operates on TCP port 22. FTP uses ports 20-21, Telnet uses port 23, and SFTP (which runs over SSH) also uses port 22.

Full explanation →
648
Multi-Selectmedium

A company is upgrading its legacy systems to use modern cryptographic standards. Which two of the following algorithms should be avoided due to known weaknesses or deprecation?

Select 2 answers
A.SHA-256 for hashing
B.MD5 for hashing
C.AES-256 for encryption
D.ECDH for key exchange
E.3DES for encryption
AnswersB, E

MD5 is cryptographically broken; collision attacks are feasible.

Why this answer

MD5 and 3DES are considered weak: MD5 has collision vulnerabilities, and 3DES is deprecated due to small block size and performance issues. SHA-256, AES-256, and ECDH are modern and secure.

Full explanation →
649
MCQhard

Based on the TLS connection output, what is a potential security vulnerability?

A.The certificate has expired
B.The key exchange is ephemeral, reducing security
C.The cipher suite uses AES-128, which is too weak
D.The certificate uses SHA-1 for the signature algorithm
AnswerD

SHA-1 is deprecated due to collision attacks.

Why this answer

The signature algorithm sha1WithRSAEncryption is deprecated for certificates; SHA-1 is weak and should not be used. Options A, B, and C are incorrect: the certificate is not expired (no date shown), AES-128 is acceptable, and ECDHE provides forward secrecy.

Full explanation →
650
MCQeasy

An organization is migrating its on-premises applications to a cloud provider. Which of the following security controls should be implemented to protect data at rest in the cloud?

A.Implement multi-factor authentication for all users.
B.Configure network segmentation using VPCs.
C.Use access keys for API authentication.
D.Enable CloudTrail or equivalent audit logging.
E.Enable server-side encryption on storage services.
AnswerE

Server-side encryption encrypts data at rest automatically.

Why this answer

Enable server-side encryption on storage services. Server-side encryption ensures data is encrypted at rest by the cloud provider, protecting it from unauthorized access even if storage media is compromised. Option A (multi-factor authentication) protects access but not data at rest.

Option B (network segmentation) primarily protects data in transit and network boundaries. Option C (access keys for API authentication) is for identity and access management, not data encryption. Option D (CloudTrail or equivalent audit logging) provides detective controls, not data protection at rest.

Full explanation →
651
MCQhard

A healthcare organization stores patient records in a database that is encrypted at rest using AES-256-CBC. The encryption key is stored in a plaintext configuration file on the database server, with file permissions set to read-only for the database service account and administrators. During an internal audit, the security team flags this as a critical vulnerability because the key is co-located with the encrypted data. The system administrator argues that the file permissions are sufficient to prevent unauthorized access. Separately, the organization must comply with HIPAA requirements for encryption key management. Which remediation most effectively addresses the vulnerability and meets compliance requirements?

A.Change the encryption algorithm from AES-256-CBC to AES-256-GCM.
B.Implement file integrity monitoring (FIM) on the configuration file to alert on unauthorized access.
C.Move the encryption key to a hardware security module (HSM) accessible only via authenticated API calls.
D.Encrypt the configuration file containing the key with a second AES-256 key stored in the same directory.
AnswerC

An HSM provides tamper-resistant key storage and meets compliance requirements.

Why this answer

Moving the encryption key to a hardware security module (HSM) physically separates the key from the encrypted data, eliminating the co-location vulnerability. HSMs provide tamper-resistant key storage and enforce access controls via authenticated API calls, which aligns with HIPAA requirements for proper key management and protection of electronic protected health information (ePHI).

Exam trap

The trap here is that candidates often confuse encryption algorithm improvements (like GCM) or monitoring controls (like FIM) with proper key management, failing to recognize that co-location of the key with the data is the core vulnerability that must be addressed by physical or logical separation.

How to eliminate wrong answers

Option A is wrong because changing the cipher mode from CBC to GCM addresses data integrity and authentication, not the fundamental issue of key storage co-location or access control. Option B is wrong because file integrity monitoring (FIM) only detects unauthorized access or changes after the fact; it does not prevent an attacker who gains access to the server from reading the plaintext key from the configuration file. Option D is wrong because encrypting the configuration file with a second key stored in the same directory merely adds a layer of obfuscation; the second key remains co-located and accessible, so an attacker who compromises the server can retrieve both keys.

Full explanation →
652
Multi-Selectmedium

Which TWO of the following are characteristics of the Biba integrity model? (Choose TWO.)

Select 2 answers
A.No write-up
B.No write-down
C.No read-up
D.Discretionary access
E.No read-down
AnswersA, E

Subjects cannot write to higher integrity levels.

Why this answer

Biba is a MAC model for integrity with rules: no write-up (integrity levels) and no read-down (to prevent corruption).

Full explanation →
653
MCQmedium

A security administrator receives an alert from the SIEM indicating a configuration change on a critical server. The change was not part of any approved change request. What should be the first step?

A.Investigate the change to determine its source and impact
B.Notify the server owner
C.Revert the server to the last known good configuration
D.Disable the server's network access
AnswerA

Investigation helps decide the appropriate response.

Why this answer

The first step when an unauthorized configuration change is detected is to investigate the change to determine its source and impact. This aligns with the incident response process, where initial assessment (identification and scoping) precedes containment or remediation. Without investigation, reverting or disabling could destroy forensic evidence or disrupt legitimate services.

Exam trap

The trap here is that candidates often jump to immediate containment (revert or disable) without recognizing that the first step in incident response is always to verify and scope the incident before taking action.

How to eliminate wrong answers

Option B is wrong because notifying the server owner is premature; the security administrator must first gather information about the change to provide accurate context. Option C is wrong because reverting the server to the last known good configuration could destroy forensic evidence and may not address the root cause, potentially allowing the change to reoccur. Option D is wrong because disabling the server's network access is a containment step that should only be taken after investigation confirms malicious intent or immediate threat, as it could cause unnecessary service disruption.

Full explanation →
654
MCQmedium

A healthcare organization is implementing an access control system to ensure that employees can only access patient records necessary for their job functions. Which model best enforces this principle?

A.Role-Based Access Control (RBAC)
B.Rule-Based Access Control (RuBAC)
C.Discretionary Access Control (DAC)
D.Mandatory Access Control (MAC)
AnswerA

RBAC assigns permissions to roles based on job functions, and users are assigned to roles, effectively enforcing least privilege.

Why this answer

Role-Based Access Control (RBAC) is the correct model because it assigns permissions based on job roles, ensuring employees only access patient records necessary for their duties. In healthcare, RBAC aligns with the principle of least privilege by mapping roles (e.g., nurse, doctor, billing) to specific data access, as defined in standards like NIST SP 800-53. This directly enforces the requirement that access is tied to job functions, not individual discretion or system-wide rules.

Exam trap

ISC2 often tests the distinction between RBAC and Rule-Based Access Control, where candidates mistakenly choose RuBAC because they confuse 'rules' with 'roles,' not realizing RuBAC applies static conditions to all users rather than dynamic role assignments.

How to eliminate wrong answers

Option B (Rule-Based Access Control) is wrong because it uses global rules (e.g., time-of-day or IP-based conditions) applied uniformly to all users, not role-specific job functions, making it too coarse for granular patient record access. Option C (Discretionary Access Control) is wrong because it allows data owners to grant access at their discretion, violating the mandatory job-function restriction and risking unauthorized sharing of patient records. Option D (Mandatory Access Control) is wrong because it enforces system-wide labels (e.g., classification levels like 'Confidential') rather than job roles, which is overly rigid and does not map to specific healthcare job functions.

Full explanation →
655
MCQhard

Which network security control can enforce that only authorized devices with current antivirus and patches can connect to the network?

A.Firewall rules
B.Network Access Control
C.Intrusion Prevention System
D.Port security
AnswerB

NAC assesses device health (e.g., antivirus, patches) before allowing network access.

Why this answer

Network Access Control (NAC) enforces security policies by checking device compliance before granting access, typically using 802.1X for authentication and quarantine for non-compliant devices.

Full explanation →
656
MCQmedium

Based on the exhibit, what is the most likely cause of the web application outage?

A.Network connectivity issue between web and DB
B.Application pool memory leak
C.SQL Server service is down
D.Database server disk failure
AnswerC

The 'Connection refused' error on port 1433 indicates the SQL Server is not listening or is down.

Why this answer

The exhibit shows that the web application is returning HTTP 500 errors, which typically indicate a server-side issue. Since the web server can connect to the database server (as shown by the successful ping), but the application fails, the most likely cause is that the SQL Server service is down, preventing the application from executing queries. This aligns with the correct answer C.

Exam trap

The trap here is that candidates assume a successful ping implies full database availability, but ping only tests network layer connectivity, not the application layer service (SQL Server).

How to eliminate wrong answers

Option A is wrong because the exhibit shows a successful ping from the web server to the database server, indicating network connectivity is intact. Option B is wrong because a memory leak in the application pool would cause gradual performance degradation or application crashes, not an immediate HTTP 500 error with successful network connectivity. Option D is wrong because a disk failure would likely cause SQL Server to log errors or fail to start, but the exhibit does not show disk-related symptoms; the immediate cause is the SQL Server service being down, not the underlying storage.

Full explanation →
657
MCQmedium

A security metric shows that patch compliance is at 85%. The goal is 95%. Which action should be taken first?

A.Increase the frequency of vulnerability scans
B.Disable automatic updates to prevent issues
C.Prioritize patching based on vulnerability criticality
D.Exclude non-critical systems from patching
AnswerC

Focuses resources on most critical patches first.

Why this answer

To improve patch compliance, prioritize patching based on vulnerability criticality to address highest risk first.

Full explanation →
658
MCQeasy

After containing a malware outbreak, the incident response team needs to ensure the malware is completely removed from all systems. Which phase of the incident response process is this?

A.Post-Incident
B.Eradication
C.Detection
D.Recovery
AnswerB

Eradication involves removing malware and closing vulnerabilities.

Why this answer

The eradication phase is specifically focused on removing the root cause of the incident, such as deleting malware files, registry keys, and disabling malicious services from all affected systems. After containment (which stops the spread), eradication ensures the threat is completely eliminated before recovery begins. This aligns with the NIST SP 800-61 incident response lifecycle, where eradication follows containment and precedes recovery.

Exam trap

The trap here is confusing eradication with recovery, as candidates often think 'removing malware' is part of getting systems back online, but recovery only begins after the threat is fully eradicated to avoid restoring infected data.

How to eliminate wrong answers

Option A is wrong because the post-incident phase occurs after recovery and involves lessons learned, documentation, and forensic analysis, not active removal of malware. Option C is wrong because detection is the initial phase where the incident is identified through alerts or anomalies, not the phase for removing the threat. Option D is wrong because recovery focuses on restoring systems to normal operation (e.g., restoring from clean backups, reconnecting to networks) after the malware has already been eradicated.

Full explanation →
659
Multi-Selecthard

A network administrator is designing a secure remote access solution for employees using company laptops. The solution must support strong authentication, encryption, and be resistant to man-in-the-middle attacks. Which THREE components should be included?

Select 3 answers
A.L2TP tunneling protocol
B.EAP-TLS for authentication
C.IPsec in tunnel mode
D.PPTP with MPPE encryption
E.IKEv2 key exchange protocol
AnswersB, C, E

EAP-TLS uses certificates for mutual authentication, preventing MITM.

Why this answer

IKEv2 supports strong authentication and mobility; EAP-TLS provides certificate-based authentication; IPsec provides encryption and authentication.

Full explanation →
660
MCQmedium

A security analyst is tuning a SIEM to reduce false positives. Which of the following actions is most likely to reduce false positives while maintaining detection of real threats?

A.Increase the severity of all alerts to high
B.Modify correlation rules to require multiple events before alerting
C.Disable all anomaly-based detection rules
D.Create a whitelist for known benign IP addresses
AnswerB

Requiring multiple events reduces single-event false positives and improves signal-to-noise ratio.

Why this answer

Modifying correlation rules to require multiple events before alerting reduces false positives by ensuring that a single benign event does not trigger an alert. This technique, often called 'thresholding' or 'event correlation,' filters out noise while still detecting multi-step attack patterns, such as a brute-force login attempt that requires multiple failed logins within a time window.

Exam trap

The trap here is that candidates often confuse 'reducing false positives' with 'eliminating all alerts,' leading them to choose disabling detection rules (Option C) or whitelisting (Option D), rather than understanding that correlation tuning preserves detection capability while filtering noise.

How to eliminate wrong answers

Option A is wrong because increasing the severity of all alerts to high does not reduce false positives; it merely reclassifies them, potentially causing alert fatigue and desensitizing analysts to critical incidents. Option C is wrong because disabling all anomaly-based detection rules would eliminate the ability to detect unknown or zero-day threats, which rely on behavioral baselines rather than static signatures. Option D is wrong because creating a whitelist for known benign IP addresses reduces false positives only for those specific IPs, but does not address false positives from other sources or from legitimate traffic that does not match the whitelist; it also risks missing real threats if an attacker spoofs a whitelisted IP.

Full explanation →
661
Multi-Selecteasy

A company is adopting a role-based access control (RBAC) model. Which TWO principles are fundamental to RBAC?

Select 2 answers
A.Roles can be organized in a hierarchy to inherit permissions
B.Users are assigned to roles based on their job functions
C.Access is controlled by the data owner
D.Permissions are assigned directly to users
E.Access decisions are based on subject and object attributes
AnswersA, B

Role hierarchy allows senior roles to inherit permissions from junior roles.

Why this answer

RBAC assigns permissions to roles, and users are members of roles. Least privilege and separation of duties are enforced through role design.

Full explanation →
662
MCQhard

A financial institution uses a quantitative risk analysis to evaluate a new online payment system. The asset value is $5 million, the exposure factor is 40%, and the annualized rate of occurrence (ARO) is 0.5. What is the annualized loss expectancy (ALE)?

A.$1,000,000
B.$800,000
C.$2,000,000
D.$2,500,000
AnswerA

Correct calculation: SLE = $5M × 0.4 = $2M; ALE = $2M × 0.5 = $1M.

Why this answer

The annualized loss expectancy (ALE) is calculated as single loss expectancy (SLE) multiplied by the annualized rate of occurrence (ARO). SLE is asset value ($5,000,000) times exposure factor (40%) = $2,000,000. Then ALE = $2,000,000 × 0.5 = $1,000,000.

This quantitative risk analysis formula is standard in financial risk assessments for payment systems.

Exam trap

ISC2 often tests the distinction between SLE and ALE, trapping candidates who stop after calculating SLE ($2,000,000) and forget to multiply by the ARO (0.5).

How to eliminate wrong answers

Option B ($800,000) is wrong because it incorrectly multiplies the asset value by the ARO without applying the exposure factor (i.e., $5,000,000 × 0.5 × 0.4? No, it's $5,000,000 × 0.4 × 0.5 = $1,000,000; $800,000 suggests a miscalculation like using 0.4 × 0.5 = 0.2 then $5,000,000 × 0.2 = $1,000,000? Actually $800,000 would come from $5,000,000 × 0.4 × 0.4 or similar error). Option C ($2,000,000) is wrong because it represents the SLE only (asset value × exposure factor) and fails to multiply by the ARO of 0.5. Option D ($2,500,000) is wrong because it incorrectly multiplies the asset value by the ARO only ($5,000,000 × 0.5) and ignores the exposure factor entirely.

Full explanation →
663
Matchingmedium

Match each access control model to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Owner sets permissions

System-enforced labels

Roles determine access

Attributes and policies

Why these pairings

The four primary access control models are DAC (owner-determined), MAC (label-based), RBAC (role-based), and ABAC (attribute-based). Common confusions include mixing up DAC and MAC, or RBAC with DAC.

Full explanation →
664
Multi-Selecthard

Which THREE of the following are security features of WPA3 compared to WPA2? (Select THREE)

Select 3 answers
A.Backward compatibility with WEP
B.Protected Management Frames (PMF) mandatory
C.192-bit security suite for Enterprise mode
D.Simultaneous Authentication of Equals (SAE) replaces PSK
E.Use of TKIP encryption
AnswersB, C, D

PMF is required in WPA3.

Why this answer

WPA3 introduces SAE (Simultaneous Authentication of Equals) to replace PSK, provides 192-bit security in Enterprise mode, and mandates PMF (Protected Management Frames).

Full explanation →
665
Multi-Selectmedium

A company is migrating from WPA2 to WPA3 for wireless security. Which THREE features does WPA3 introduce? (Select three)

Select 3 answers
A.192-bit security suite for Enterprise networks
B.Wi-Fi Protected Setup (WPS)
C.Simultaneous Authentication of Equals (SAE)
D.Protected Management Frames (PMF) mandatory
E.CCMP encryption as mandatory
AnswersA, C, D

WPA3-Enterprise offers 192-bit minimum security strength.

Why this answer

WPA3 introduces SAE (Simultaneous Authentication of Equals) to replace PSK, mandates PMF (Protected Management Frames), and offers 192-bit security for Enterprise mode. WPS is removed in WPA3. CCMP is used in WPA2 as well.

Full explanation →
666
MCQeasy

An administrator wants to ensure that users cannot share passwords. Which control is most effective at reducing the risk of password sharing?

A.Account lockout policies
B.Multifactor authentication
C.Password complexity
D.Password history
AnswerB

MFA requires a second factor that is often physical or biometric, making it difficult to share credentials.

Why this answer

Multifactor authentication (MFA) is the most effective control because it requires users to present two or more distinct factors (e.g., something you know, something you have, something you are) to authenticate. Even if a user shares their password (something you know), an attacker cannot authenticate without the second factor (e.g., a one-time passcode from a hardware token or biometric). This directly reduces the risk of password sharing by making the shared credential insufficient for access.

Exam trap

The trap here is that candidates often choose password complexity or account lockout policies because they associate them with 'stronger security,' but they fail to recognize that these controls do not address the specific threat of voluntary password sharing, which MFA directly mitigates by adding an independent authentication factor.

How to eliminate wrong answers

Option A is wrong because account lockout policies (e.g., locking after 5 failed attempts) are designed to prevent brute-force attacks, not to prevent users from voluntarily sharing their passwords; a shared password still works until the account is locked. Option C is wrong because password complexity (e.g., requiring uppercase, numbers, symbols) only makes passwords harder to guess or crack, but does nothing to stop a user from sharing that complex password with another person. Option D is wrong because password history (e.g., remembering the last 10 passwords) prevents users from reusing old passwords, but it has no effect on sharing the current password with others.

Full explanation →
667
MCQmedium

A company uses multiple virtual machines on a single hypervisor. To prevent a VM from escaping its virtualized environment and compromising the hypervisor, which of the following should be implemented?

A.Use a separate network for VM management traffic
B.Apply hypervisor security patches and disable unnecessary VM guest tools
C.Deploy a host-based firewall on each VM
D.Enable VM snapshots to restore in case of compromise
AnswerB

Patching hypervisor and minimizing guest tools reduce the risk of VM escape.

Why this answer

VM escape attacks exploit vulnerabilities in the hypervisor. Keeping the hypervisor patched and disabling unnecessary VM guest tools reduces attack surface.

Full explanation →
668
MCQeasy

An organization wants to protect endpoints from ransomware that encrypts files and demands payment. Which control should be implemented FIRST?

A.Deploy email spam filtering
B.Implement application whitelisting
C.Conduct user security awareness training
D.Enable file-level backup to a separate location
AnswerB

Blocks unauthorized executables from running.

Why this answer

Application whitelisting blocks unauthorized executables, including ransomware, from running. Option A is wrong because email filtering can reduce but not block all ransomware delivery. Option C is wrong because user training is important but not a technical control that immediately prevents execution.

Option D is wrong because backups help recovery but do not prevent infection.

Full explanation →
669
Multi-Selectmedium

A security analyst is reviewing application security and identifies risks related to the OWASP Top 10. Which THREE are examples of OWASP Top 10 vulnerabilities? (Select THREE.)

Select 3 answers
A.Security Misconfiguration
B.Injection
C.Man-in-the-Middle (MitM)
D.Cross-Site Scripting (XSS)
E.Buffer overflow
AnswersA, B, D

Misconfiguration is a widespread issue in the OWASP Top 10.

Why this answer

Injection, XSS, and Security Misconfiguration are classic OWASP Top 10 categories.

Full explanation →
670
MCQmedium

A new employee needs access to the CRM, email, and file servers. The security policy requires that access privileges are granted based on job function. Which process should be used?

A.The employee completes a request form detailing the access they need
B.The IT department grants full access to all systems and later reviews
C.The identity management team assigns the employee to a role that includes the necessary permissions
D.The employee's supervisor decides which access is appropriate and informs IT
AnswerC

Role-based access control aligns with job functions.

Why this answer

Role-based access control (RBAC) assigns permissions based on job functions, not individual requests or ad-hoc approvals. By placing the employee into a predefined role (e.g., 'Sales Rep'), the identity management team ensures that the CRM, email, and file server permissions are granted consistently and in compliance with the security policy. This process enforces the principle of least privilege and simplifies auditing.

Exam trap

The trap here is that candidates often choose the supervisor's approval (Option D) because it seems logical, but the SSCP exam emphasizes automated role-based assignment over manual approval to enforce consistent, policy-driven access control.

How to eliminate wrong answers

Option A is wrong because allowing the employee to self-select access needs violates the principle of least privilege and bypasses the job-function-based policy; it introduces risk of over-provisioning. Option B is wrong because granting full access upfront and reviewing later is a 'trust but verify' model that contradicts the security policy's requirement to grant access based on job function, and it creates a window of excessive privilege. Option D is wrong because while the supervisor may understand the role, the decision should be automated through role assignment rather than relying on a manual, subjective decision that could lead to inconsistent or excessive permissions.

Full explanation →
671
MCQmedium

An organization's disaster recovery plan specifies an RTO of 4 hours and an RPO of 1 hour for its critical database. Which of the following DR site configurations BEST meets these requirements?

A.Cold site with weekly backup tapes shipped offsite
B.Cloud-based cold site with daily backups
C.Hot site with synchronous replication
D.Warm site with hourly log shipping to a standby database
AnswerD

Hourly log shipping achieves RPO of 1 hour; warm site provides hardware ready for activation within hours, meeting RTO.

Why this answer

A warm site with hourly log shipping to a standby database can achieve an RPO of 1 hour (by losing at most one hour of transactions) and an RTO of 4 hours (by applying the logs and bringing the standby online within that window). The standby database is kept nearly current with minimal lag, meeting both recovery objectives without the cost of full synchronous replication.

Exam trap

The trap here is that candidates often choose a hot site (Option C) because it provides the best protection, but the question asks for the configuration that BEST meets the specified RTO/RPO, not the most robust or expensive option, making the warm site the most cost-effective and appropriate choice.

How to eliminate wrong answers

Option A is wrong because a cold site requires hardware setup and restoration from weekly backup tapes, which cannot meet a 4-hour RTO (setup alone often takes days) and the weekly backups exceed the 1-hour RPO (potential data loss of up to a week). Option B is wrong because a cloud-based cold site still requires provisioning resources and restoring from daily backups, which cannot achieve a 4-hour RTO (provisioning and restoration take longer) and the daily backups exceed the 1-hour RPO (potential data loss of up to 24 hours). Option C is wrong because a hot site with synchronous replication provides near-zero RPO and very low RTO (minutes), which over-delivers on the requirements and is unnecessarily expensive; the question asks for the configuration that BEST meets the stated RTO/RPO, not exceeds them with higher cost.

Full explanation →
672
MCQeasy

During an incident, the IR team needs to collect volatile data. Which order should they follow?

A.Hard disk, memory, network connections, running processes
B.Network connections, running processes, memory, hard disk
C.Running processes, memory, network connections, hard disk
D.Memory, running processes, network connections, hard disk
AnswerD

Memory is the most volatile and should be captured first.

Why this answer

Volatile data must be collected in order of decreasing volatility to minimize data loss. Memory (RAM) is the most volatile, followed by running processes, network connections, and finally the hard disk, which is non-volatile. This order ensures that transient evidence (e.g., encryption keys, active network sessions) is captured before it disappears.

Exam trap

ISC2 often tests the order of volatility (OOV) principle, and the trap here is that candidates mistakenly think running processes are more volatile than memory, or they confuse the order by prioritizing network connections over process state.

How to eliminate wrong answers

Option A is wrong because it starts with the hard disk, which is non-volatile, and delays collection of memory and network connections, risking loss of critical transient data. Option B is wrong because it places network connections before running processes and memory, but network connections depend on process state and can change rapidly; memory should be captured first to preserve process artifacts. Option C is wrong because it lists running processes before memory, but memory contains the actual process data (e.g., code, variables) that must be captured before processes are terminated or altered.

Full explanation →
673
MCQmedium

Which access control mechanism most likely failed to prevent this unauthorized privilege escalation?

A.Sudoers configuration
B.Account lockout policy
C.Password policy
D.SELinux
AnswerB

An account lockout policy would have locked the account after a threshold of failed attempts, preventing the eventual successful login.

Why this answer

An account lockout policy is designed to prevent brute-force attacks by locking an account after a specified number of failed login attempts. In the context of unauthorized privilege escalation, a lockout policy would not prevent a user who already has valid credentials from escalating privileges through other means, such as exploiting a misconfigured sudoers file or a kernel vulnerability. Therefore, the failure of the account lockout policy is the most likely mechanism that allowed the escalation, as it does not control what an authenticated user can do after login.

Exam trap

ISC2 often tests the misconception that account lockout policies are a catch-all defense against unauthorized access, when in fact they only prevent brute-force login attempts and do not control actions taken by an already authenticated user.

How to eliminate wrong answers

Option A is wrong because the sudoers configuration directly controls which users can execute commands with elevated privileges; if it were misconfigured (e.g., allowing a user to run all commands as root without a password), it could be the mechanism that failed, but the question asks which mechanism most likely failed to prevent the escalation, and a lockout policy is unrelated to post-authentication privilege escalation. Option C is wrong because a password policy (e.g., complexity, length, history) only affects the strength of user passwords and does not prevent an authorized user from escalating privileges after successful authentication. Option D is wrong because SELinux is a mandatory access control (MAC) system that enforces security policies at the kernel level, and while it can limit privilege escalation, its failure would be due to misconfiguration or being in permissive mode, not because of a lockout policy; the lockout policy is the least relevant to the escalation event.

Full explanation →
674
MCQmedium

A Linux system administrator needs to restrict network traffic to a server, allowing only HTTP and HTTPS from the internet. Which tool should be used to configure packet filtering rules?

A.PAM
B.SELinux
C.auditd
D.iptables
AnswerD

iptables is a packet filter firewall utility.

Why this answer

iptables or nftables are Linux firewall tools for packet filtering. PAM handles authentication. SELinux enforces MAC. auditd logs events.

They do not filter network traffic.

Full explanation →
675
MCQeasy

Which of the following is a secure protocol for remote administration of a server, replacing insecure protocols like Telnet?

A.FTP
B.SSH
C.HTTP
D.Telnet
AnswerB

SSH encrypts all traffic, making it secure for remote administration.

Why this answer

SSH (Secure Shell) is the correct answer because it provides encrypted remote administration capabilities, replacing insecure protocols like Telnet that transmit data in plaintext. SSH uses public-key cryptography for authentication and symmetric encryption (e.g., AES, ChaCha20) for session confidentiality, protecting against eavesdropping and man-in-the-middle attacks.

Exam trap

The trap here is that candidates may confuse Telnet with SSH or think that FTP or HTTP can be used for remote administration, but the question specifically asks for a secure replacement for Telnet, which is SSH.

How to eliminate wrong answers

Option A (FTP) is wrong because it is a file transfer protocol, not a remote administration protocol, and it transmits credentials and data in plaintext unless secured with FTPS or SFTP. Option C (HTTP) is wrong because it is a web protocol used for transferring hypertext, not for remote server administration, and it lacks encryption by default (HTTPS is the secure variant). Option D (Telnet) is wrong because it is the very insecure protocol that SSH replaces, sending all data including passwords in cleartext over TCP port 23.

Full explanation →
Page 8

Page 9 of 13

Page 10

All pages

12345678910111213

Practice SSCP by domain

Target a specific domain to shore up weak areas.

Access ControlsRisk Identification, Monitoring, and AnalysisIncident Response and RecoverySecurity Operations and AdministrationCryptographyNetwork and Communications SecuritySystems and Application Security
See all domains with question counts →