CCNA Sscp Security Ops Questions

A security baseline is a documented set of minimum security settings that must be applied to a system to meet organizational policy. Applying it to the new web server ensures consistent hardening, reduces attack surface, and provides a known configuration to compare against during audits. It directly addresses the need to enforce desired security settings.

The 3-2-1 rule directly encodes the policy's three constraints: three copies of data, two distinct media types, and one copy held offsite. Its whole purpose is resilient recovery, so it satisfies the stated requirement exactly, whereas alternatives such as RAID or full backups address redundancy or scope but not the offsite and media-diversity conditions.

CCTV is a physical security control because it monitors and records the tangible environment, deterring and detecting intrusions at a facility. It satisfies the scenario's requirement for controls operating on physical premises rather than logical access.

RBAC assigns permissions to roles rather than individuals, and users are assigned to roles based on their job functions. This directly enforces least privilege because users inherit only the permissions of their role. It matches the requirement to grant access based on job roles and minimal necessary permissions.

Restoring Wednesday's failure to Tuesday night requires the Sunday full backup plus Monday's and Tuesday's incrementals — three sets. Incrementals capture only changes since the previous backup, so each intervening day must be applied sequentially; the full alone is insufficient and Tuesday's incremental cannot reconstruct Monday's changes.

Multi-factor authentication requires a second factor beyond the password, so stolen credentials alone are insufficient for an attacker to authenticate. If the employee had entered credentials on the fake page, MFA would have blocked the account takeover unless the attacker also compromised the second factor. This directly reduces the impact of successful phishing and is the most effective control for credential theft in this scenario.

A differential backup captures every block changed since the last full backup, so successive differentials each grow larger until the next full backup resets the baseline. This matches the stem's requirement of copying changes since the last full backup regardless of subsequent backups.

An independent audit report, such as a SOC 2 report, provides evidence that controls were examined by a qualified external party against defined criteria. Reviewing the scope, period, and exceptions gives reliable assurance for regulated data handling. It is stronger than self-attestation because the provider does not control the assessment.

Sanitising overwrites or cryptographically erases residual data before the drive leaves the departing employee's control, satisfying the offboarding requirement to prevent unauthorised data recovery. Reassignment or disposal without sanitisation would expose company data, so this action directly addresses the hardware handling constraint in the stem.

Full disk encryption renders the entire volume unreadable without the decryption key, so a stolen laptop's data stays confidential even if the drive is removed. This directly satisfies the loss-or-theft constraint, unlike file-level or database controls that leave unencrypted remnants exposed.

The CAB owns change approval, so a discovered compatibility issue invalidates the approved change and must be escalated for reassessment. Proceeding without reapproval bypasses change control; reporting back and requesting a revised change preserves governance and satisfies the stem's testing constraint.

Assessing risk and applying compensating controls, such as a web application firewall rule or network segmentation, addresses the exposure without rebooting. This satisfies the stem's constraint of avoiding business-hours downtime while the critical 9.8 CVSS vulnerability remains unpatched on the public-facing server.

A retention policy defines how long data must be kept and automates its destruction when the period expires. This directly enforces the legal mandate without relying on manual intervention, ensuring records are deleted exactly at seven years and reducing the risk of non-compliance or accidental over-retention.

A Clean Desk Policy requires sensitive information, including written credentials, to be secured or removed when workspaces are unattended. Sticky notes exposing passwords on monitors directly breach that requirement, since the policy explicitly covers physical artefacts left in plain view.

An Acceptable Use Policy defines permitted employee behaviour for corporate email and internet resources, directly addressing the stated need. It specifies what staff may and may not do with these assets, unlike password or access policies that govern credentials.

A baseline configuration defines the approved, hardened settings — services, ports, registry values — that every system must match, giving configuration management a measurable reference for detecting drift. This satisfies the stem's purpose by establishing the consistent, secure starting point from which deviations are identified and corrected.

Differential backups copy every change made since the last full backup, so Sunday's full plus each day's cumulative changes matches this description. Incremental backups would capture only changes since the previous backup, which the stem explicitly excludes.

Security awareness training educates users about phishing, pretexting, and other social engineering tactics, making them less likely to fall victim. This directly reduces the risk of human-based attacks, which are a common initial access vector. It is a key administrative control in defense-in-depth.

Average time to patch critical vulnerabilities directly quantifies remediation speed, the core objective of a patching programme. It satisfies the stem's effectiveness requirement by measuring elapsed duration from vulnerability disclosure to deployed fix, exposing process delays that raw patch counts conceal. Shorter averages indicate a responsive, well-functioning patch management capability.

The sequence begins with a formal change request, followed by impact assessment, approval from the change advisory board, testing, implementation, and finally a post-implementation review to confirm the change achieved its objective without adverse effects.

Transaction log backups capture all committed transactions since the last log backup, enabling point-in-time recovery with an RPO as low as the backup interval. Scheduling them every 15 minutes directly meets the 15-minute RPO. They also consume far less storage than full backups because they contain only the log records, not the entire database.

Automated configuration scanning in staging compares deployed settings against the approved baseline before production release, catching drift that functional testing misses. This satisfies the stem's constraint that the deviation escaped testing, because scanning detects configuration variance rather than relying on test cases.

FIM works by comparing current file hashes against a known good baseline. Storing the baseline hashes offline prevents an attacker who compromises the server from altering the baseline to hide their changes. This ensures the integrity of the comparison and allows detection of unauthorized modifications. Cryptographic hashes provide a unique fingerprint for each file, so any change will be detected.

A mantrap uses two interlocking doors with an enclosed vestibule, admitting one person at a time and preventing an unauthorised individual from following closely behind. This interlock mechanism directly defeats tailgating, unlike turnstiles, guards or cameras that detect but do not physically stop it.

An independent security assessment combines multiple evidence-gathering techniques, including interviews, documentation review, observation, and direct testing of controls. Because it validates that controls operate as intended rather than merely existing on paper, it satisfies the requirement to evaluate effectiveness through observation and testing. The independence of the assessor also reduces bias compared with self-reported results.

A remote access policy defines who may connect remotely, from where, and under what conditions. The login from a foreign IP at 03:00 breaches the manager-confirmed restriction that this user lacks remote access authorisation, so the access control constraint in the stem is directly violated.

A KPI measures progress toward a strategic objective, such as patch-management effectiveness, rather than raw operational volume. Tracking the percentage of systems meeting the 48-hour critical-patch window directly satisfies the stem's requirement for a performance-oriented metric, since it evaluates how well the patching process achieves its target, not merely how many patches were deployed.

Administrative controls are policy-level directives governing behaviour, and the stem's requirement is precisely a mandated rule rather than a technical mechanism. Encryption itself is the technical control; the policy compelling its use on portable media is administrative. It satisfies the constraint by defining expected practise without enforcing it through hardware or software.

A mantrap uses two interlocking doors with an occupancy sensor, admitting one person into a holding vestibule before the second door releases. This directly enforces the single-person entry constraint that defeats tailgating, unlike turnstiles or access badges, which cannot verify that only one individual passes per authentication.

WORM storage physically or logically prevents modification or deletion of data once written, directly satisfying the immutability requirement even against privileged administrators. A seven-year retention policy ensures compliance with the stated retention period. This is the standard approach for tamper-evident audit log archiving in regulated industries.

Using the intercom to contact security is the safe response when the mantrap's second door fails. A mantrap is a physical access control vestibule designed to prevent tailgating and trap intruders; remaining inside and alerting security preserves that containment. Forcing the door or exiting backwards could breach the controlled entry and defeat the mantrap's purpose.

Relationships between configuration items are a core CMDB component because they map dependencies and connections across the IT estate. This satisfies the stem's requirement for key components, distinguishing a CMDB from a plain asset inventory, which records items without capturing how they interlink or affect one another.

A password policy defines rules for password creation, management, and authentication, including multi-factor authentication.

A biometric reader verifies a unique physiological trait, so credentials cannot be shared, copied or lost like badges and PINs. This satisfies the high-security constraint by binding entry to a specific enrolled person, preventing unauthorised individuals from gaining access with stolen or borrowed credentials.

A description of the change is essential because it defines the scope, affected systems and intended outcome, enabling the change advisory board to assess risk and impact before approval. Without it, reviewers cannot evaluate the request against the change management process, so this element satisfies the stem's requirement for every change request.

Least privilege means granting users only the access required to perform their job and no more. This directly matches the requirement to avoid excessive permissions. It reduces attack surface and limits damage from compromised accounts, making it the correct principle for this scenario.

Phishing is the leading vector for stolen credentials, tricking users into surrendering passwords on fraudulent pages. Training staff to recognise suspicious senders, links and urgent requests directly reduces that risk, addressing the credential-theft constraint more effectively than general policy or password topics.

Tracking licence type and count directly satisfies the inventory's licensing-compliance constraint, since each asset's entitlement must be reconcilable against deployed instances. Licence type distinguishes perpetual, subscription, and concurrent models, while the count exposes over-deployment or shortfalls during audits. This pairing is therefore essential for software asset management.

A mantrap permits only one person through at a time, using interlocking doors to prevent tailgating and credential passback. It enforces strict identity verification at the perimeter, forming the outermost layer of defence-in-depth for the data centre.

A SOC 2 Type II report covers a historical period, and the migration to a new data center means the controls assessed in the old report may no longer be representative. Requesting an updated report or a bridge letter that covers the gap is the appropriate first step because it gives current, independent evidence of control effectiveness before any contractual or technical decisions are made.

Configuration management maintains a known, hardened baseline image and detects drift through SCAP scans, directly satisfying the requirement to verify servers are securely configured before deployment. It governs the full lifecycle of configuration items, ensuring deviations are identified and remediated, which is precisely the control the organisation seeks.

Recognising phishing emails is a core security awareness topic, teaching staff to identify suspicious senders, links and requests. It directly reduces credential theft and malware risk, satisfying the question's requirement for a valid awareness training subject.

Automated configuration management enforces the hardened baseline consistently across every new server, removing manual drift. Deploying a hardened image automatically satisfies the stem's requirement for guaranteed baseline configuration at deployment, unlike documentation or manual checklists.

CVSS score quantifies technical severity, while asset criticality reflects business impact if that host is compromised. Combining both prevents wasting effort on severe flaws on trivial systems and ensures patches for exploitable vulnerabilities on high-value assets are applied first.

An SCAP scanner evaluates system configurations against standardised checklists such as DISA STIG or CIS benchmarks, reporting deviations from the hardened baseline. This satisfies the requirement to detect configuration drift, which signature-based vulnerability scanners alone would not reliably identify.

Containment is a critical step in incident response that aims to limit the scope and impact of an incident. It involves isolating affected systems, disabling compromised accounts, and preventing the spread of malware. This step follows identification and precedes eradication and recovery. Without containment, the incident could escalate and cause more damage, so it is an essential part of the process.

Differential backups capture all data changed since the last full backup, ignoring intermediate backups entirely. Incremental backups would only copy changes since the most recent backup of any type, so differential is the precise match for the stem's wording.

Retention and destruction rules for payment card data flow from laws, industry standards such as the Payment Card Industry Data Security Standard, and contracts with acquiring banks. These obligations define minimum and maximum retention periods and acceptable destruction methods. Basing the standard on them ensures the company can demonstrate compliance and avoid penalties.

Differential backups capture all changes since the last full backup, so Thursday's differential already contains Monday through Thursday's modifications. Restoration therefore needs only the Sunday full plus that single Thursday differential — two sets — satisfying the stem's recovery requirement without replaying intermediate daily backups.

PCI DSS requires strong cryptography and secure key management for stored cardholder data. Keys must be protected against disclosure and misuse, with documented processes for generation, distribution, storage, rotation, and destruction. Encryption alone without proper key management is ineffective, so implementing both encryption and formal key management procedures is a required practice for protecting stored cardholder data.

Automated deprovisioning triggered by HR termination records ensures accounts are disabled or removed as soon as the employment status changes. This directly reduces the window of unauthorized access and eliminates reliance on manual, error-prone processes. It addresses the root cause: accounts remaining active after termination.

Separation of duties requires that no single individual controls all parts of a critical transaction. Allowing a trader to both execute and approve trades creates an opportunity for fraud or undetected error. Remediation is to define mutually exclusive roles so the approval function is performed by a different authorized person, which directly addresses the conflicting duties observed by the auditor.

A WAF virtual patch inspects and blocks exploit traffic targeting the known vulnerability signature, mitigating risk without touching the vendor-locked server. This satisfies the unpatachable constraint by compensating at the network layer rather than the host.

The rule mandates three total copies of data, stored across two distinct media types, with one copy held offsite. That separation protects against simultaneous loss: a single media failure, theft or site disaster cannot destroy every copy at once.

A severity matrix defines levels such as low, medium, high, and critical based on factors like business impact, data sensitivity, and number of affected systems. It gives responders a consistent, repeatable way to decide escalation and notification. Because the gap is inconsistent triage, a documented classification scheme directly resolves the problem and supports metrics reporting.

Executing the documented rollback restores the unstable server to its last known-good state, immediately containing the outage. The change management plan already authorises this procedure, so it takes precedence over investigation, which can follow once service is restored.

A mantrap interposes two interlocked doors so only one opens at a time, holding each person alone in the vestibule before the second door releases. This directly satisfies the requirement to prevent tailgating, since a follower cannot pass through while the first door remains secured.

PCI DSS requires that stored cardholder data be rendered unreadable, typically through strong encryption, truncation, or tokenization. Encryption at rest is a direct requirement to protect data if storage media is compromised. This control is explicitly mandated and is essential for compliance.

Two distinct media types ensure a single media failure cannot destroy every copy, satisfying the redundancy element of the 3-2-1 rule. This complements the three copies and one offsite copy the strategy must also include.

Disabling the directory account stops new authentications, while revoking sessions and tokens terminates existing access that would otherwise persist. Together they provide immediate, comprehensive revocation across federated and single sign-on systems. This is the standard offboarding action for prompt access removal.

Disabling the accounts immediately removes the unauthorized access risk posed by former employees. Following that, reviewing the process identifies the root cause of the failure to remove accounts, such as a missing trigger from HR, and allows the administrator to implement corrective controls to prevent recurrence. This aligns with the SSCP principle of least privilege and timely access revocation.

Prioritisation using CVSS severity combined with asset criticality directs remediation effort to the most exploitable flaws on the most valuable systems, satisfying the policy's need to sequence patching within limited maintenance windows rather than treating every vulnerability identically.

Role-based access control ties permissions to defined job functions, so users receive only what their role requires. It makes excessive access easier to spot and simplifies reviews because entitlements are grouped logically. This supports least privilege at scale and gives auditors a clear model showing how access decisions are derived.

The 3-2-1 rule's final component requires one copy stored at a separate physical location, protecting against site-level loss such as fire, flood or theft destroying all on-premises backups simultaneously. Offsite storage satisfies that geographic-separation requirement.

Investigating first establishes whether the unapproved configuration change is malicious or accidental and what it affected, which determines the appropriate containment or rollback. This satisfies the stem's requirement to identify the change's source and impact before acting.

Prioritising by vulnerability criticality directs remediation toward the highest-risk exposures first, satisfying the stem's requirement to close the 10% compliance gap efficiently. Rather than chasing every missing patch equally, risk-based sequencing reduces exploitable attack surface fastest when resources cannot immediately achieve full coverage.

The number of phishing emails reported by employees during simulations directly measures their ability to recognize and respond to phishing attempts. An increase in reporting indicates improved awareness and vigilance. This metric reflects behavioral change, which is the ultimate goal of security awareness training. It is a strong indicator of the training's effectiveness in reducing susceptibility.

A mantrap is a physical security control that consists of a small space with two interlocking doors. It allows only one person to enter at a time and can detect tailgating. By requiring authentication at both doors, it ensures that only authorized personnel can access the data center. This directly restricts physical access to authorized individuals and is a strong preventive control.

RPO defines the maximum tolerable data loss measured as elapsed time before the disruption, setting the required backup or replication frequency. This satisfies the definition requested: it expresses how much data, in time terms, the organisation can afford to lose.

Deploying untested patches straight to production risks breaking critical systems and forces emergency rollback, so defects escape detection. Staging validation is the control that catches compatibility and regression issues before they affect live services, making its absence a critical process gap.

A post-implementation review closes the change management lifecycle by verifying the change achieved its intended outcome and identifying any unanticipated effects. It is a recognised procedural step, distinct from implementation itself, and satisfies the stem's requirement for a valid change process stage.

Checking change management records and on-call schedules provides context to determine if the access was planned or expected. This is a non-intrusive first step that can quickly validate or refute the need for further investigation. It preserves evidence and avoids disrupting operations prematurely.

Setting a seven-year retention with automatic purge directly enforces the documented policy and limits unnecessary data exposure. It satisfies legal hold requirements during the retention window while reducing storage and breach impact afterward. This is the corrective action that brings technical controls in line with the approved data retention policy.

WPA2-Enterprise with 802.1X provides strong, certificate-based or credential-based authentication for each device or user before network access is granted. It ensures that only authorized devices with valid credentials can connect, and it supports dynamic key management. This meets the requirement for strict device authorization.

Click rate on simulated phishing links directly measures whether employees apply the training, since clicking is the behaviour the programme targets. It satisfies the stem's effectiveness requirement by quantifying real susceptibility rather than completion or awareness, which do not prove reduced phishing success.