ISC2 Systems Security Certified Practitioner (SSCP) — Questions and Answers

Question 1: What is the core principle of Zero Trust Architecture?

Trust users after initial login for the rest of the session
Never trust, always verify — authenticate and authorize every request regardless of network location (Correct answer)
Block all external traffic at the perimeter
Trust all internal network traffic by default

Correct answer: Never trust, always verify — authenticate and authorize every request regardless of network location

Zero Trust assumes breach and requires continuous verification of every user, device, and request regardless of whether it originates inside or outside the network.

Question 2: What is the key security concern with using automated vulnerability scanners as the sole testing method?

They generate false positives and miss logic flaws, business logic issues, and chained attacks requiring human reasoning (Correct answer)
They only work on Linux systems
They take too long to run
They require root access

Correct answer: They generate false positives and miss logic flaws, business logic issues, and chained attacks requiring human reasoning

Automated scanners miss complex multi-step attack chains, business logic vulnerabilities, and context-dependent flaws that require human analysis.

Question 3: What is the primary goal of a security architecture review?

Approve firewall rules
Automate patch deployment
Ensure the system design meets security requirements and identify architectural weaknesses before implementation (Correct answer)
Verify hardware inventory

Correct answer: Ensure the system design meets security requirements and identify architectural weaknesses before implementation

A security architecture review evaluates the design against security principles and requirements to catch structural weaknesses early in the development lifecycle.

Question 4: Which of the following best describes the primary goal of risk management?

To comply with regulatory standards
To reduce the cost of security infrastructure
To identify and mitigate risks based on their potential impact (Correct answer)
To eliminate all risks

Correct answer: To identify and mitigate risks based on their potential impact

The primary goal of risk management in cybersecurity is to identify and mitigate risks based on their potential impact and likelihood. It's often impractical to eliminate all risks, so the focus is on systematically assessing and prioritizing them. By understanding the potential consequences of various threats, security engineers can implement appropriate controls to reduce risks to an acceptable level, balancing security with business objectives.

Question 5: In a PKI hierarchy, what is the role of an Intermediate CA?

It issues end-entity certificates, insulating the Root CA from direct exposure (Correct answer)
It stores private keys for end users
It revokes the Root CA certificate
It generates password hashes

Correct answer: It issues end-entity certificates, insulating the Root CA from direct exposure

Intermediate CAs sit between the Root CA and end-entity certificates, allowing the Root CA to be kept offline and reducing risk if the Intermediate is compromised.

Question 6: A user's account shows login activity from two geographically distant locations within minutes. What type of detection is this?

Impossible travel anomaly detection (Correct answer)
Privilege escalation detection
Password spray detection
Brute-force detection

Correct answer: Impossible travel anomaly detection

Impossible travel detection flags authentication events from locations that could not be reached in the time elapsed between logins.

Question 7: A digital signature provides which two security properties?

Authentication and non-repudiation (Correct answer)
Authorization and accounting
Confidentiality and availability
Integrity and confidentiality

Correct answer: Authentication and non-repudiation

Digital signatures verify the signer's identity (authentication) and prevent them from denying the action (non-repudiation).

Question 8: Which design pattern allows security teams to inspect encrypted TLS traffic within a corporate network without compromising end-to-end security to the endpoint?

Certificate pinning on endpoints
TLS inspection / SSL decryption proxy (Correct answer)
VPN split tunneling
DNSSEC validation

Correct answer: TLS inspection / SSL decryption proxy

A TLS inspection proxy terminates and re-establishes TLS sessions, allowing the proxy to inspect content for malware or data loss before re-encrypting to the destination.

Question 9: What is data classification and how does it support security architecture decisions?

Sorting files by date; it determines backup schedules
Indexing data for search; it improves query performance
Tagging data by file type; it determines storage costs
Categorizing data by sensitivity level; it drives access controls, encryption, and handling requirements (Correct answer)

Correct answer: Categorizing data by sensitivity level; it drives access controls, encryption, and handling requirements

Data classification assigns sensitivity tiers (e.g., Public, Internal, Confidential, Restricted) that inform which controls, encryption standards, and access policies apply.

Question 10: In cloud security architecture, what does the Shared Responsibility Model define?

How cloud costs are split between teams
Which security responsibilities belong to the cloud provider vs. the customer (Correct answer)
The SLA for cloud uptime
How encryption keys are shared

Correct answer: Which security responsibilities belong to the cloud provider vs. the customer

The Shared Responsibility Model clarifies that cloud providers secure the underlying infrastructure while customers are responsible for their data, applications, and access controls.

Question 11: Which network security control is specifically designed to deceive attackers by mimicking real systems and logging their activity?

Honeypot (Correct answer)
SIEM
IPS
WAF

Correct answer: Honeypot

A honeypot is a decoy system intentionally deployed to attract attackers and gather intelligence on their techniques.

Question 12: What is the role of a DMZ (demilitarized zone) in network security architecture?

Perform intrusion prevention
Provide wireless access
Host publicly accessible services isolated from the internal network (Correct answer)
Store internal databases

Correct answer: Host publicly accessible services isolated from the internal network

A DMZ places externally accessible servers (web, mail, DNS) in a buffer zone between the internet and the trusted internal network.

Question 13: Which of the following is the primary function of a Security Information and Event Management (SIEM) system?

Collecting and correlating log data from various sources to detect security threats (Correct answer)
Managing network traffic
Running vulnerability scans on systems
Encrypting sensitive data

Correct answer: Collecting and correlating log data from various sources to detect security threats

A Security Information and Event Management (SIEM) system is designed to provide a centralized view of an organization's security posture. It achieves this by aggregating log data from diverse network devices, servers, and applications. By correlating these events, SIEMs can identify patterns and anomalies indicative of potential security threats, enabling proactive detection and response.

Question 14: What does software supply chain security primarily address?

Ensuring fast and reliable delivery of software updates to end users
Managing software procurement costs and vendor contracts
Protecting the integrity of code, dependencies, and build processes from development through deployment (Correct answer)
Optimizing CI/CD pipeline throughput and deployment frequency

Correct answer: Protecting the integrity of code, dependencies, and build processes from development through deployment

Supply chain security addresses risks from third-party components, compromised build tools, and tampered delivery pipelines that could introduce malicious code or backdoors.

Question 15: What is the primary purpose of a Certificate Authority (CA) in a PKI?

Issue and sign digital certificates to verify identity (Correct answer)
Generate passwords for users
Manage firewall rules
Encrypt data in transit

Correct answer: Issue and sign digital certificates to verify identity

A CA is a trusted entity that issues, signs, and manages digital certificates that bind a public key to an identity.

Question 16: Which access control model grants permissions based on a user's role within an organization?

Attribute-Based Access Control (ABAC)
Discretionary Access Control (DAC)
Mandatory Access Control (MAC)
Role-Based Access Control (RBAC) (Correct answer)

Correct answer: Role-Based Access Control (RBAC)

RBAC assigns permissions to roles rather than individuals, simplifying access management based on job function.

Question 17: What is the key difference between SAST (Static Application Security Testing) and DAST (Dynamic Application Security Testing)?

SAST tests production systems while DAST tests development environments
SAST detects only injection vulnerabilities while DAST finds only configuration issues
SAST is performed only by developers while DAST requires certified external testers
SAST analyzes code without execution while DAST tests the running application from the outside (Correct answer)

Correct answer: SAST analyzes code without execution while DAST tests the running application from the outside

SAST analyzes source code or binaries without executing the application, while DAST tests the live running application by simulating external attacks through its interfaces.

Question 18: What is the difference between a hash function and encryption?

Hashing is a one-way function with no decryption; encryption is reversible with a key (Correct answer)
Hashing is reversible; encryption is not
Hashing uses public keys; encryption uses private keys
Encryption is faster than hashing

Correct answer: Hashing is a one-way function with no decryption; encryption is reversible with a key

Hash functions produce a fixed-length digest that cannot be reversed, while encryption transforms data that can be decrypted with the correct key.

Question 19: What is the primary goal of integrating security into the DevOps pipeline (DevSecOps)?

Delegating all security responsibilities to the security operations team
Shifting security left to identify and remediate vulnerabilities earlier in the SDLC (Correct answer)
Slowing deployment velocity to allow thorough manual security reviews
Replacing traditional penetration testing entirely with automated scanning tools

Correct answer: Shifting security left to identify and remediate vulnerabilities earlier in the SDLC

DevSecOps 'shifts security left' by embedding security activities throughout the CI/CD pipeline, reducing the cost and complexity of remediating vulnerabilities discovered late.

Question 20: What is the first step a Security Engineer should take when identifying a potential threat?

Identify and categorize assets (Correct answer)
Assess the threat's potential impact
Implement security patches immediately
Block all incoming traffic

Correct answer: Identify and categorize assets

The first step a Security Engineer should take when identifying a potential threat is to identify and categorize assets. Understanding what needs protection, such as critical data, systems, or applications, allows for proper prioritization and assessment of potential impacts. Without a clear inventory and classification of assets, it's impossible to effectively evaluate threats or implement targeted security measures.

Question 21: Which vulnerability occurs when an application passes user-controlled input to a system command interpreter without proper sanitization?

Command Injection (Correct answer)
Remote File Inclusion
Path Traversal
XML External Entity (XXE)

Correct answer: Command Injection

Command injection allows attackers to execute arbitrary OS commands by embedding them in user input that the application passes to a system shell.

Question 22: During which Secure SDLC phase are Data Flow Diagrams (DFDs) and trust boundaries typically created?

Post-deployment security monitoring
Security regression testing during QA
Threat modeling during the design phase (Correct answer)
Requirements gathering and stakeholder interviews

Correct answer: Threat modeling during the design phase

Threat modeling is conducted during the design phase using DFDs and trust boundaries to identify attack surfaces and potential threats before any code is written.

Question 23: Which of the following components are part of the risk management process?

Incident Response
Risk Monitoring (Correct answer)
Risk Elimination
Risk Mitigation (Correct answer)
Risk Identification (Correct answer)

Correct answer: Risk Monitoring

Risk Identification is a fundamental component of the risk management process. It involves systematically discovering, recognizing, and describing potential risks that could affect an organization's assets. This initial step is crucial because you cannot manage risks that you haven't identified, setting the foundation for subsequent steps like assessment, mitigation, and monitoring.

Question 24: During a secure code review of a web application, which area is MOST critical to examine for high-severity vulnerabilities?

Database query optimization and connection pooling configuration
UI/UX design patterns and accessibility compliance
Input handling, output encoding, and authentication and authorization logic (Correct answer)
Code formatting consistency and adherence to style guides

Correct answer: Input handling, output encoding, and authentication and authorization logic

Input handling, output encoding, and authentication logic are the primary sources of critical vulnerabilities such as injection attacks, XSS, and broken access control.

Question 25: An attacker collects two different messages that produce the same hash value. What type of cryptographic attack is this?

Birthday (collision) attack (Correct answer)
Length extension attack
Pre-image attack
Side-channel attack

Correct answer: Birthday (collision) attack

A collision attack finds two distinct inputs with the same hash output, exploiting the birthday paradox in hash function design.

Question 26: What is threat modeling and when should it ideally be performed?

Writing security policies; during audits
A structured process to identify, quantify, and address security threats; ideally during the design phase (Correct answer)
Testing production systems for vulnerabilities; after deployment
Scanning for known CVEs; during patching cycles

Correct answer: A structured process to identify, quantify, and address security threats; ideally during the design phase

Threat modeling systematically identifies threats, attack vectors, and mitigations early in the design phase when changes are least costly.

Question 27: Which type of encryption uses the same key for both encryption and decryption?

Hashing
Symmetric encryption (Correct answer)
Steganography
Asymmetric encryption

Correct answer: Symmetric encryption

Symmetric encryption (e.g., AES) uses a single shared secret key for both encrypting and decrypting data.

Question 28: Which threat modeling methodology developed by Microsoft uses the acronym STRIDE to categorize software threats?

Microsoft's STRIDE model (Correct answer)
VAST (Visual, Agile, and Simple Threat modeling)
OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation)
PASTA (Process for Attack Simulation and Threat Analysis)

Correct answer: Microsoft's STRIDE model

STRIDE—Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege—was created by Microsoft as a framework for identifying threats against software systems.

Question 29: A security engineer needs to detect unauthorized devices connecting to a wired network. Which technology provides the best control?

Port mirroring
Network Access Control (NAC) (Correct answer)
MAC address filtering
VLAN tagging

Correct answer: Network Access Control (NAC)

NAC enforces policy-based access, performing posture checks before granting network admission.

Question 30: What is the difference between business continuity planning (BCP) and disaster recovery planning (DRP)?

BCP is for natural disasters; DRP is for cyberattacks
DRP covers the entire business; BCP covers only IT systems
BCP focuses on maintaining critical business operations during a disruption; DRP focuses on restoring IT systems after a disaster (Correct answer)
They are identical frameworks

Correct answer: BCP focuses on maintaining critical business operations during a disruption; DRP focuses on restoring IT systems after a disaster

BCP is the broader plan to keep critical business functions running during any disruption, while DRP is the technical subset focused on recovering IT infrastructure.

Question 31: Which authentication factor category does a hardware security key (e.g., YubiKey) belong to?

Something you have (Correct answer)
Something you know
Something you are
Somewhere you are

Correct answer: Something you have

A hardware security key is a physical device the user possesses, making it a 'something you have' authentication factor.

Question 32: Which concept describes separating administrative duties so no single person can complete a sensitive transaction alone?

Separation of duties (SoD) (Correct answer)
Need to know
Defense in depth
Least privilege

Correct answer: Separation of duties (SoD)

Separation of duties requires multiple individuals to complete sensitive tasks, preventing fraud or error by any single actor.

Question 33: What is a false positive in the context of vulnerability scanning?

A critical patch that was not applied
A vulnerability with a CVSS score above 9.0
A vulnerability that is exploitable but not reported
A reported vulnerability that does not actually exist in the target (Correct answer)

Correct answer: A reported vulnerability that does not actually exist in the target

A false positive occurs when a scanner reports a vulnerability that, upon manual verification, does not actually exist or is not exploitable.

Question 34: Which of the following best describes a 'cryptographic failure' as defined by OWASP?

Failing to encrypt sensitive data or using weak/broken cryptographic algorithms (Correct answer)
Using an expired TLS certificate on a public-facing server
Implementing two-factor authentication with a weak second factor
Using self-signed certificates in a production environment

Correct answer: Failing to encrypt sensitive data or using weak/broken cryptographic algorithms

OWASP A02:2021 Cryptographic Failures occur when sensitive data is exposed due to absent encryption or the use of deprecated and weak cryptographic algorithms.

Question 35: Which vulnerability scoring system provides a standardized way to assess and communicate the severity of security vulnerabilities?

CVSS (Common Vulnerability Scoring System) (Correct answer)
OWASP Top 10
STRIDE
PASTA

Correct answer: CVSS (Common Vulnerability Scoring System)

CVSS provides a numerical score (0–10) based on exploitability and impact metrics to standardize vulnerability severity communication.

Question 36: What is the purpose of a data flow diagram (DFD) in threat modeling?

Document software release pipelines
Visualize how data moves through a system to identify trust boundaries and potential attack surfaces (Correct answer)
Show database query performance
Map network topology

Correct answer: Visualize how data moves through a system to identify trust boundaries and potential attack surfaces

DFDs map data flows between processes, data stores, and external entities, revealing trust boundaries where threats like injection or tampering are most likely.

Question 37: Which CVSS metric indicates how complex the conditions must be for an attacker to exploit a vulnerability?

Privileges Required
Attack Vector
User Interaction
Attack Complexity (Correct answer)

Correct answer: Attack Complexity

The CVSS Attack Complexity metric reflects whether exploitation requires specific conditions beyond the attacker's control, such as race conditions.

Question 38: In a penetration test scope definition, what does 'rules of engagement' specify?

The boundaries, permitted actions, timing, and escalation procedures for the test (Correct answer)
The list of CVEs to test
The client's security budget
The attacker's tools

Correct answer: The boundaries, permitted actions, timing, and escalation procedures for the test

Rules of engagement define the scope, prohibited actions, notification requirements, and emergency contacts to ensure a controlled and legal test.

Question 39: Which of the following steps is typically the first in an incident response process?

Identification (Correct answer)
Eradication
Recovery
Containment

Correct answer: Identification

The incident response process typically begins with the "Identification" phase, where an organization detects and confirms a security incident. This involves monitoring systems, analyzing alerts, and determining if an actual security breach or event has occurred. Without proper identification, subsequent steps like containment or eradication cannot be initiated effectively.

Question 40: What type of scan discovers live hosts and open ports on a network without attempting exploitation?

Compliance scan
Vulnerability scan
Exploitation scan
Discovery / reconnaissance scan (Correct answer)

Correct answer: Discovery / reconnaissance scan

A discovery scan (e.g., using Nmap) maps the network, identifying live hosts and open services without testing for vulnerabilities.

Question 41: Which term describes the practice of an attacker using valid credentials obtained through phishing to access systems, bypassing traditional perimeter defenses?

Living off the land
Lateral movement via exploits
Valid account abuse (Correct answer)
Zero-day exploit

Correct answer: Valid account abuse

Valid account abuse uses legitimately obtained credentials so that the attacker's activity blends with normal user behavior, making detection harder.

Question 42: What is Server-Side Request Forgery (SSRF)?

A method to bypass server authentication using crafted HTTP requests
A technique to intercept encrypted server-to-server communications
An attack that forces a server to make requests to unintended internal or external locations (Correct answer)
An attack that forges server-side TLS certificates

Correct answer: An attack that forces a server to make requests to unintended internal or external locations

SSRF induces the server-side application to make HTTP requests to arbitrary domains, potentially exposing internal services not accessible from the internet.

Question 43: An attacker sends thousands of SYN packets to a server without completing the TCP handshake. What type of attack is this?

Ping of Death
SYN flood (DoS) (Correct answer)
Smurf attack
UDP flood

Correct answer: SYN flood (DoS)

A SYN flood exhausts server resources by filling the connection table with half-open TCP connections.

Question 44: Which HTTP security header helps prevent clickjacking attacks by controlling whether a page can be rendered inside an iframe?

X-Content-Type-Options
X-Frame-Options (Correct answer)
Strict-Transport-Security
Content-Security-Policy

Correct answer: X-Frame-Options

The X-Frame-Options header (or the frame-ancestors CSP directive) instructs browsers not to render the page within a frame or iframe on other origins.

Question 45: Which DNS security extension adds digital signatures to DNS records to prevent cache poisoning?

DMARC
DNSSEC (Correct answer)
DNS over TLS (DoT)
DNS over HTTPS (DoH)

Correct answer: DNSSEC

DNSSEC uses cryptographic signatures on DNS records to allow resolvers to verify data authenticity.

Question 46: Which of the following techniques are commonly used in threat identification?

Vulnerability Scanning (Correct answer)
Encryption
Penetration Testing (Correct answer)
Data Compression

Correct answer: Vulnerability Scanning

Vulnerability scanning and penetration testing are commonly used techniques in threat identification. Vulnerability scanning employs automated tools to detect known security weaknesses in systems and applications. Penetration testing involves ethical hackers simulating real-world attacks to uncover exploitable vulnerabilities and assess the effectiveness of existing security controls, providing a comprehensive view of potential threats.

Question 47: What does a network-based IDS (NIDS) primarily analyze to detect threats?

Memory dumps
Host log files
User authentication events
Network packet traffic (Correct answer)

Correct answer: Network packet traffic

A NIDS passively monitors and analyzes network traffic flows to detect suspicious patterns or signatures.

Question 48: A penetration tester establishes persistence on a compromised host and then moves to other internal systems. What phase does the lateral movement represent?

Post-exploitation / lateral movement (Correct answer)
Reconnaissance
Privilege escalation
Initial access

Correct answer: Post-exploitation / lateral movement

Lateral movement occurs during post-exploitation when an attacker pivots from an initial foothold to additional internal systems.

Question 49: Which federation protocol is most commonly used for SSO between web applications using XML-based assertions?

Kerberos
OpenID Connect
SAML 2.0 (Correct answer)
OAuth 2.0

Correct answer: SAML 2.0

SAML 2.0 uses XML-based security assertions to pass authentication and authorization data between identity providers and service providers.

Question 50: What is privilege creep, and why is it a security concern?

A brute-force attack on privileged accounts
Unauthorized privilege escalation via malware
The gradual accumulation of excessive access rights over time, beyond what a role requires (Correct answer)
A bug that crashes privilege management systems

Correct answer: The gradual accumulation of excessive access rights over time, beyond what a role requires

Privilege creep occurs when users accumulate permissions over time through role changes without removal of old rights, violating least privilege.

Question 51: Which technique splits outbound traffic so that only traffic destined for the VPN tunnel is encrypted, while other traffic goes directly to the internet?

Full-tunnel VPN
Split tunneling (Correct answer)
SSL inspection
Traffic shaping

Correct answer: Split tunneling

Split tunneling allows selective routing so corporate traffic uses the VPN while internet traffic bypasses it.

Question 52: A security engineer wants to prevent email spoofing for a domain. Which combination of DNS records is most effective?

DNSSEC + MX records
PTR + TXT records
A + MX records
SPF + DKIM + DMARC (Correct answer)

Correct answer: SPF + DKIM + DMARC

SPF defines authorized senders, DKIM adds email signatures, and DMARC enforces policy and reporting when either check fails.

Question 53: What is a security baseline and how is it used?

A documented minimum set of security controls all systems must implement (Correct answer)
The starting cost of a security program
The minimum traffic volume before triggering an alert
A benchmark comparing two security vendors

Correct answer: A documented minimum set of security controls all systems must implement

A security baseline defines the minimum required configuration and controls for a class of systems, ensuring consistent protection across the environment.

Question 54: What is the purpose of a Privileged Access Workstation (PAW)?

Provide a hardened, dedicated workstation for performing privileged administrative tasks (Correct answer)
Automate patch management
Replace VPN for remote access
Enable remote desktop for all users

Correct answer: Provide a hardened, dedicated workstation for performing privileged administrative tasks

A PAW is a dedicated, isolated workstation used exclusively for administrative tasks to reduce the risk of credential theft from malware on regular workstations.

Question 55: Which tool is commonly used to perform port scanning and OS fingerprinting during the reconnaissance phase of a penetration test?

Metasploit
Burp Suite
Wireshark
Nmap (Correct answer)

Correct answer: Nmap

Nmap is the de facto standard for network discovery, port scanning, service detection, and OS fingerprinting.

Question 56: What is the recommended approach for secure session management after a user successfully authenticates?

Embed user credentials in session tokens for faster server-side validation
Generate a new session ID and set appropriate expiration after login (Correct answer)
Use long-lived sessions to minimize re-authentication friction
Store session tokens in URL parameters for compatibility

Correct answer: Generate a new session ID and set appropriate expiration after login

Regenerating the session ID after login prevents session fixation attacks, while setting a proper expiration limits the window of exposure if a session token is stolen.

Question 57: Which type of network attack allows an attacker to gain access to traffic on a different VLAN by sending double-tagged 802.1Q frames?

MAC flooding
DHCP spoofing
VLAN hopping (Correct answer)
Spanning tree attack

Correct answer: VLAN hopping

VLAN hopping exploits default trunk port behavior to send frames to a VLAN the attacker should not have access to.

Question 58: Which algorithm is widely used for asymmetric key exchange and digital signatures in TLS certificates?

AES-256
HMAC
RSA (Correct answer)
SHA-256

Correct answer: RSA

RSA is a widely deployed asymmetric algorithm used for digital signatures and key exchange in PKI and TLS.

Question 59: Which framework maps adversary tactics, techniques, and procedures (TTPs) and is widely used to guide penetration testing scenarios?

MITRE ATT&CK (Correct answer)
NIST CSF
OWASP
ISO 27001

Correct answer: MITRE ATT&CK

MITRE ATT&CK is a knowledge base of real-world adversary TTPs organized by tactic, used to model and test against realistic attack scenarios.

Question 60: Which technology aggregates logs from firewalls, IDS, and other network devices to correlate security events?

DLP
WAF
NAC
SIEM (Correct answer)

Correct answer: SIEM

A SIEM (Security Information and Event Management) collects, normalizes, and correlates log data from across the environment.

Question 61: What is the principle of least privilege?

All data is publicly readable
Admins should not require passwords
Users should have only the minimum access required to perform their job (Correct answer)
Users receive all permissions by default

Correct answer: Users should have only the minimum access required to perform their job

Least privilege limits user and process access to only what is necessary, reducing the attack surface if credentials are compromised.

Question 62: Which of the following is an example of a post-incident activity?

Updating firewall rules during the attack
Conducting a post-incident review to learn lessons (Correct answer)
Eradicating malware from infected systems
Monitoring network traffic to detect the ongoing attack

Correct answer: Conducting a post-incident review to learn lessons

Post-incident activities occur after an incident has been fully resolved and systems have been restored. A crucial part of this phase is conducting a post-incident review, also known as a "lessons learned" session. This helps organizations analyze what went wrong, evaluate the effectiveness of their response, and implement improvements to prevent similar incidents in the future.

Question 63: What is the purpose of continuous security monitoring?

To automate the backup of critical data
To ensure compliance with data privacy regulations
To detect, investigate, and respond to security threats in real-time (Correct answer)
To regularly update all software and applications

Correct answer: To detect, investigate, and respond to security threats in real-time

Continuous security monitoring involves constantly observing an organization's systems and networks for suspicious activities and vulnerabilities. Its primary purpose is to provide real-time visibility into the security landscape, allowing for immediate detection, thorough investigation, and rapid response to emerging or ongoing security threats. This proactive approach minimizes potential damage and downtime.

Question 64: Which of the following tools is best suited for scanning a network to find open ports and services?

Wireshark
Nmap (Correct answer)
Nikto
Tripwire

Correct answer: Nmap

Nmap (Network Mapper) is the best-suited tool for scanning a network to find open ports and services. It is a free and open-source utility that allows security professionals to discover hosts and services on a computer network, creating a 'map' of the network. Nmap can identify operating systems, service versions, and potential vulnerabilities by analyzing network responses.

Question 65: Which OAuth 2.0 grant type is recommended for server-to-server API authentication without user interaction?

Implicit
Device Code
Client Credentials (Correct answer)
Authorization Code

Correct answer: Client Credentials

The Client Credentials grant allows a service to authenticate directly with the authorization server using its own credentials, without a user context.

Question 66: Which firewall type inspects traffic at the application layer and understands specific protocols like HTTP and FTP?

Application-layer (proxy) firewall (Correct answer)
Stateful inspection firewall
Packet-filtering firewall
Circuit-level gateway

Correct answer: Application-layer (proxy) firewall

Application-layer firewalls (proxies) operate at Layer 7 and can inspect and filter protocol-specific content.

Question 67: What is the main advantage of using out-of-band management networks for network devices?

Management access remains available even if the production network is compromised or down (Correct answer)
Lower latency
Higher bandwidth
Simpler configuration

Correct answer: Management access remains available even if the production network is compromised or down

Out-of-band management provides a separate, dedicated channel so administrators can still reach devices when the primary network fails.

Question 68: Which cipher mode of operation provides both confidentiality and integrity in a single pass?

CTR
ECB
GCM (Galois/Counter Mode) (Correct answer)
CBC

Correct answer: GCM (Galois/Counter Mode)

AES-GCM is an authenticated encryption mode that simultaneously provides confidentiality (counter mode encryption) and data integrity (GHASH authentication tag).

Question 69: What is the primary security benefit of using 802.1X port-based authentication on a network switch?

Authenticates devices before granting network access (Correct answer)
Encrypts all switch traffic
Blocks VLAN hopping attacks
Prevents physical cable tapping

Correct answer: Authenticates devices before granting network access

802.1X requires devices to authenticate via an authentication server (e.g., RADIUS) before the switch port is opened.

Question 70: Which protocol is used by network devices to send log messages to a centralized logging server?

NetFlow
Syslog (Correct answer)
TFTP
SNMP

Correct answer: Syslog

Syslog is the standard protocol for transmitting log messages from network devices to a centralized log management server.

Question 71: A security engineer discovers that the same nonce was used twice with AES-GCM. What is the impact?

Confidentiality and integrity are both broken for those sessions (Correct answer)
Only performance degrades
No impact; nonce reuse is expected
The cipher falls back to CBC mode

Correct answer: Confidentiality and integrity are both broken for those sessions

Nonce reuse with AES-GCM allows an attacker to recover plaintext and forge authentication tags, breaking both confidentiality and integrity.

Question 72: What security principle requires each application component to operate with only the minimum permissions necessary to perform its function?

Separation of Duties
Defense in Depth
Principle of Least Privilege (Correct answer)
Zero Trust Architecture

Correct answer: Principle of Least Privilege

The Principle of Least Privilege limits access rights and permissions of software components to the absolute minimum required, reducing the attack surface if a component is compromised.

Question 73: Which of the following actions helps a Security Engineer identify potential threats proactively?

Security Information and Event Management (SIEM) (Correct answer)
Network Monitoring (Correct answer)
Post-incident Forensics
Data Backup

Correct answer: Security Information and Event Management (SIEM)

Network monitoring and Security Information and Event Management (SIEM) are crucial actions that help a Security Engineer proactively identify potential threats. Network monitoring continuously observes network traffic and behavior for anomalies or suspicious patterns that could indicate an attack. SIEM systems aggregate and analyze security logs and events from various sources, providing real-time insights and alerts on potential security incidents as they emerge.

Question 74: What is the primary security purpose of multi-factor authentication (MFA)?

Encrypt user sessions
Eliminate the need for passwords
Speed up login
Require attackers to compromise multiple independent factors to gain access (Correct answer)

Correct answer: Require attackers to compromise multiple independent factors to gain access

MFA ensures that stealing a single factor (e.g., a password) is insufficient for access, requiring additional proof of identity.

Question 75: Which concept ensures that all cryptographic mechanisms, protocols, and key sizes are documented and can be updated without redesigning the entire system?

Algorithm negotiation
Crypto agility (Correct answer)
Key escrow
Certificate pinning

Correct answer: Crypto agility

Crypto agility designs systems so cryptographic algorithms and parameters can be swapped out quickly when a cipher is broken or deprecated.

Question 76: What is a Certificate Revocation List (CRL) used for?

Renewing expired certificates
Storing private keys
Listing all issued certificates
Publishing certificates that have been revoked before their expiry (Correct answer)

Correct answer: Publishing certificates that have been revoked before their expiry

A CRL is a list published by a CA of certificates that have been revoked and should no longer be trusted.

Question 77: Which of the following best defines a "zero-day vulnerability"?

A vulnerability in software that is no longer supported.
A vulnerability that has no associated risk.
A vulnerability discovered and disclosed to the public before a patch is available. (Correct answer)
A vulnerability that has been exploited for more than a year without detection.

Correct answer: A vulnerability discovered and disclosed to the public before a patch is available.

A "zero-day vulnerability" is a critical software flaw that is unknown to the vendor or for which no official patch has yet been released. This means attackers can exploit the vulnerability before developers have had a chance to fix it, making it particularly dangerous. The term signifies that the vendor has had "zero days" to address the issue since its public discovery or exploitation.

Question 78: A security team runs authenticated vulnerability scans versus unauthenticated scans. What additional information do authenticated scans provide?

Network topology mapping
Web application SQL injection findings
Deeper insight into installed software versions, missing patches, and misconfigurations on the host (Correct answer)
External attacker perspective

Correct answer: Deeper insight into installed software versions, missing patches, and misconfigurations on the host

Authenticated scans log into the target with valid credentials, giving the scanner access to installed packages, registry settings, and local configurations for more accurate results.

Question 79: Which of the following is a cloud-native security solution that helps secure cloud infrastructure?

Metasploit
Wireshark
Burp Suite
AWS Guard Duty (Correct answer)

Correct answer: AWS Guard Duty

AWS GuardDuty is a cloud-native security solution that helps secure cloud infrastructure within the Amazon Web Services (AWS) environment. It continuously monitors for malicious activity and unauthorized behavior to protect AWS accounts and workloads. GuardDuty leverages machine learning and threat intelligence to identify potential threats, making it an essential tool for cloud security.

Question 80: What is the first step in a typical risk management process?

Risk Assessment
Risk Identification (Correct answer)
Risk Monitoring
Risk Treatment

Correct answer: Risk Identification

The first step in a typical risk management process is Risk Identification. Before any risks can be assessed, treated, or monitored, they must first be recognized and documented. This involves understanding an organization's assets, potential threats, and existing vulnerabilities to pinpoint where risks might arise.

Question 81: In application security, what does 'defense in depth' mean?

Focusing all security resources on the most critical application components
Implementing multiple layered security controls so failure of one does not compromise the whole system (Correct answer)
Deploying the most advanced firewall technology available at the perimeter
Encrypting all data at multiple stages of processing

Correct answer: Implementing multiple layered security controls so failure of one does not compromise the whole system

Defense in depth applies multiple overlapping security controls at different layers so no single point of failure can lead to a complete system compromise.

Question 82: During a web application penetration test, a tester sends `' OR '1'='1` in a login field and successfully bypasses authentication. What vulnerability is present?

Cross-site scripting (XSS)
SQL injection (Correct answer)
LDAP injection
Command injection

Correct answer: SQL injection

The input manipulates an SQL query's logic to return true for all records, bypassing the intended authentication check via SQL injection.

Question 83: A client wants to test only their web application login portal without testing the underlying infrastructure. What type of engagement is this?

Red team exercise
Full-scope penetration test
Physical penetration test
Targeted / focused penetration test (Correct answer)

Correct answer: Targeted / focused penetration test

A targeted engagement restricts testing to a specific system or application, allowing focused assessment without broader infrastructure risk.

Question 84: Which protocol provides encrypted tunneling for site-to-site VPN connections commonly used in enterprise environments?

Telnet
PPTP
IPsec (Correct answer)
L2TP alone

Correct answer: IPsec

IPsec provides authentication and encryption at the IP layer and is the standard for secure site-to-site VPN tunnels.

Question 85: Which of the following is an example of risk transference?

Installing a firewall to protect against cyber attacks
Outsourcing IT services to a third-party provider with liability insurance (Correct answer)
Encrypting sensitive data to prevent data breaches
Conducting regular security training for employees

Correct answer: Outsourcing IT services to a third-party provider with liability insurance

Risk transference involves shifting the potential financial impact or responsibility of a risk to a third party. Outsourcing IT services to a provider that carries liability insurance is a prime example, as the financial burden of certain incidents would fall upon the third-party vendor or their insurer. This strategy does not eliminate the risk but reallocates its consequences.

Question 86: Which protocol is commonly used to centralize authentication and authorization for network devices and VPNs?

LDAP
SAML
OAuth 2.0
RADIUS (Correct answer)

Correct answer: RADIUS

RADIUS (Remote Authentication Dial-In User Service) centralizes network access authentication and is widely used for VPNs and 802.1X.

Question 87: What is the purpose of salting a password before hashing?

Allow password recovery
Speed up the hashing process
Encrypt the password
Prevent precomputed (rainbow table) attacks by making each hash unique (Correct answer)

Correct answer: Prevent precomputed (rainbow table) attacks by making each hash unique

A salt is a random value added to the password before hashing, ensuring identical passwords produce different hashes and defeating precomputed table attacks.

Question 88: What is the purpose of a Common Vulnerabilities and Exposures (CVE) identifier?

Assign patches to vulnerabilities
Score vulnerability severity
Provide a unique public identifier for a known vulnerability to enable consistent reference across tools (Correct answer)
Track exploit code availability

Correct answer: Provide a unique public identifier for a known vulnerability to enable consistent reference across tools

CVE IDs provide a standardized naming scheme so vendors, tools, and researchers refer to the same vulnerability consistently.

Question 89: What is the primary purpose of network segmentation in a security architecture?

Increase bandwidth
Limit lateral movement and contain breaches (Correct answer)
Reduce hardware costs
Simplify network management

Correct answer: Limit lateral movement and contain breaches

Network segmentation restricts an attacker's ability to move laterally across the environment after an initial compromise.

Question 90: What does Perfect Forward Secrecy (PFS) ensure in a TLS session?

Session tokens never expire
All traffic is encrypted end-to-end
Past session keys cannot be compromised even if the server's long-term private key is later exposed (Correct answer)
The server certificate is always valid

Correct answer: Past session keys cannot be compromised even if the server's long-term private key is later exposed

PFS uses ephemeral key exchange (e.g., ECDHE) so each session uses a unique key, protecting past sessions if the private key is compromised.

Question 91: Which hashing algorithm is currently recommended by NIST for secure applications due to its collision resistance?

CRC32
MD5
SHA-1
SHA-256 (SHA-2 family) (Correct answer)

Correct answer: SHA-256 (SHA-2 family)

SHA-256 is part of the NIST-recommended SHA-2 family, offering strong collision resistance for security applications.

Question 92: What is the purpose of a Software Bill of Materials (SBOM)?

To document the cost breakdown of all software development activities
To provide a complete inventory of components, libraries, and dependencies in a software product (Correct answer)
To track open-source license compliance obligations exclusively
To list all known software defects and their remediation status

Correct answer: To provide a complete inventory of components, libraries, and dependencies in a software product

An SBOM is a formally structured, machine-readable inventory of all software components and dependencies, enabling organizations to identify supply chain risks and respond rapidly to new CVEs.

Question 93: Which access control model uses security labels and clearance levels to make access decisions, typically in government systems?

DAC
Mandatory Access Control (MAC) (Correct answer)
RBAC
ABAC

Correct answer: Mandatory Access Control (MAC)

MAC enforces access based on sensitivity labels (e.g., Top Secret, Secret) assigned to both subjects and objects by a central authority.

Question 94: What is the difference between authentication and authorization?

Authentication encrypts data; authorization decrypts it
Authorization verifies identity; authentication grants access
They are the same concept
Authentication verifies identity; authorization determines what the identity is permitted to do (Correct answer)

Correct answer: Authentication verifies identity; authorization determines what the identity is permitted to do

Authentication answers 'who are you?', while authorization answers 'what are you allowed to do?' — they are distinct and sequential processes.

Question 95: Which reconnaissance technique gathers information about a target using publicly available sources without directly interacting with the target's systems?

OSINT (Open Source Intelligence) (Correct answer)
Port scanning
Banner grabbing
Active reconnaissance

Correct answer: OSINT (Open Source Intelligence)

OSINT collects information from public sources such as WHOIS, social media, job postings, and DNS records without touching the target's infrastructure.

Question 96: Which protocol provides online certificate status checking as a faster alternative to CRLs?

SCEP
EST
LDAP
OCSP (Correct answer)

Correct answer: OCSP

OCSP (Online Certificate Status Protocol) allows clients to query a CA in real time for the revocation status of a specific certificate.

Question 97: Which HTTP security header instructs browsers to only access the site over HTTPS and prevents protocol downgrade attacks?

Content-Security-Policy
Strict-Transport-Security (HSTS) (Correct answer)
X-Frame-Options
X-XSS-Protection

Correct answer: Strict-Transport-Security (HSTS)

HSTS (HTTP Strict Transport Security) tells browsers to enforce HTTPS connections for a specified duration, preventing downgrade attacks and cookie hijacking over HTTP.

Question 98: Which security design principle advocates building multiple layers of defense so that if one layer fails, others continue to protect?

Defense in depth (Correct answer)
Economy of mechanism
Least privilege
Fail secure

Correct answer: Defense in depth

Defense in depth layers technical, administrative, and physical controls so an attacker must bypass multiple independent defenses to succeed.

Question 99: Which elliptic curve algorithm is recommended by NIST for digital signatures and key agreement?

ECDSA / ECDH (Correct answer)
DH (Diffie-Hellman)
RC4
DSA

Correct answer: ECDSA / ECDH

ECDSA (digital signatures) and ECDH (key agreement) use elliptic curve cryptography for strong security with smaller key sizes than RSA.

Question 100: What is the primary defense mechanism against Cross-Site Request Forgery (CSRF) attacks?

Requiring HTTPS for all form submissions
Using anti-CSRF tokens (synchronizer token pattern) (Correct answer)
Enforcing Content Security Policy (CSP) headers
Validating all form fields with server-side input validation

Correct answer: Using anti-CSRF tokens (synchronizer token pattern)

Anti-CSRF tokens are unique, secret values embedded in forms that verify each request originated from the legitimate application, preventing forged cross-origin requests.

Question 101: What is the purpose of egress filtering on a network perimeter firewall?

Balance outbound load
Prevent internal hosts from sending unauthorized outbound traffic (Correct answer)
Encrypt outbound packets
Block inbound attack traffic

Correct answer: Prevent internal hosts from sending unauthorized outbound traffic

Egress filtering inspects and restricts traffic leaving the network to prevent data exfiltration and stop compromised hosts from beaconing.

Question 102: Which of the following is a Security Information and Event Management (SIEM) tool?

Splunk (Correct answer)
OpenVAS
Snort
Nmap

Correct answer: Splunk

Splunk is a leading Security Information and Event Management (SIEM) tool. It is designed to collect, index, and analyze machine-generated data, including security logs and events, from various sources across an IT infrastructure. This capability provides real-time visibility into security posture, facilitates threat detection, and aids in incident response.

Question 103: What is directory harvesting and how is it mitigated?

Dumping AD groups; mitigated by encryption
Brute-forcing service accounts; mitigated by lockout
Stealing password hashes; mitigated by MFA
Exploiting LDAP to enumerate valid usernames; mitigated by returning identical responses for valid and invalid accounts (Correct answer)

Correct answer: Exploiting LDAP to enumerate valid usernames; mitigated by returning identical responses for valid and invalid accounts

Directory harvesting enumerates valid email addresses or usernames by observing different server responses; using uniform responses prevents disclosure.

Question 104: Which OWASP Top 10 category covers weaknesses in authentication mechanisms that allow attackers to compromise passwords, keys, or session tokens?

Injection
Identification and Authentication Failures (Correct answer)
Cryptographic Failures
Broken Access Control

Correct answer: Identification and Authentication Failures

OWASP A07:2021 - Identification and Authentication Failures covers weaknesses that allow attackers to compromise user identity through flawed login, session, or credential management.

Question 105: Which attack exploits a weakness in the ARP protocol to intercept traffic between two hosts on the same network?

ARP spoofing (poisoning) (Correct answer)
DNS poisoning
ICMP redirect attack
BGP hijacking

Correct answer: ARP spoofing (poisoning)

ARP spoofing sends forged ARP replies to associate the attacker's MAC with a legitimate IP, enabling man-in-the-middle attacks.

Question 106: Which key management practice ensures that encryption keys are changed regularly to limit exposure from a compromise?

Key splitting
Key rotation (Correct answer)
Key wrapping
Key derivation

Correct answer: Key rotation

Key rotation periodically replaces cryptographic keys so that even if one is compromised, the window of exposed data is limited.

Question 107: Which of the following describes the primary use of Snort in cybersecurity?

Intrusion Detection System (IDS) (Correct answer)
Network vulnerability scanning
Password cracking
Web application scanning

Correct answer: Intrusion Detection System (IDS)

Snort's primary use in cybersecurity is as an Intrusion Detection System (IDS). It performs real-time traffic analysis and packet logging on networks, using a rule-based engine to detect malicious activities, policy violations, and other suspicious network behavior. While it can also function as an Intrusion Prevention System (IPS), its core capability is detection.

Question 108: Which of the following tools would a Security Engineer use for penetration testing?

Burp Suite (Correct answer)
Metasploit (Correct answer)
SolarWinds
ELK Stack

Correct answer: Burp Suite

Metasploit is a powerful open-source framework widely used by Security Engineers for penetration testing. It provides a comprehensive suite of tools for developing, testing, and executing exploits against vulnerable systems. This allows security professionals to simulate real-world attacks to identify and remediate security weaknesses before malicious actors can exploit them.

Question 109: Which Kerberos component issues Ticket Granting Tickets (TGTs) after initial user authentication?

Key Distribution Center (KDC) / Authentication Server (AS) (Correct answer)
Service Ticket
Service Principal
Ticket Granting Server (TGS)

Correct answer: Key Distribution Center (KDC) / Authentication Server (AS)

The Authentication Server (AS) within the KDC validates the user's credentials and issues a TGT that the user presents to get service tickets.

Question 110: What does pivoting mean in the context of penetration testing?

Pivoting from web to API attacks
Escalating local privileges to domain admin
Changing the attack methodology mid-engagement
Using a compromised host as a relay to attack systems on network segments that are otherwise unreachable (Correct answer)

Correct answer: Using a compromised host as a relay to attack systems on network segments that are otherwise unreachable

Pivoting uses a compromised host as a tunnel or proxy to route attacker traffic through network segments that would otherwise be inaccessible.

Question 111: An organization moves workloads to the cloud. Under the IaaS model, which security responsibility remains entirely with the customer?

Hypervisor patching
Physical datacenter security
Network switch maintenance
Operating system patching and application security (Correct answer)

Correct answer: Operating system patching and application security

Under IaaS, the cloud provider manages physical infrastructure and the hypervisor, while the customer is fully responsible for the OS, middleware, and application security.

Question 112: Why is insecure deserialization considered a critical application security risk?

It converts JSON to objects without validation, causing performance degradation
Deserializing untrusted data can lead to remote code execution or privilege escalation (Correct answer)
It exposes sensitive data by using unencrypted serialization formats
It creates compatibility issues between different application versions

Correct answer: Deserializing untrusted data can lead to remote code execution or privilege escalation

Insecure deserialization can allow attackers to manipulate serialized objects so that when reconstructed the application executes attacker-controlled logic, potentially leading to RCE.

Question 113: What is the primary difference between a vulnerability assessment and a penetration test?

Penetration tests are automated; vulnerability assessments are manual
Vulnerability assessments are illegal; pen tests are not
They are the same thing
A vulnerability assessment identifies weaknesses; a penetration test actively exploits them to demonstrate impact (Correct answer)

Correct answer: A vulnerability assessment identifies weaknesses; a penetration test actively exploits them to demonstrate impact

Vulnerability assessments catalog known weaknesses, while penetration tests go further by exploiting vulnerabilities to confirm real-world risk.

Question 114: Which of the following is a qualitative method used in risk assessment?

Cost-Benefit Analysis
Annualized Loss Expectancy (ALE)
Risk Scoring Matrix (Correct answer)
Asset Valuation

Correct answer: Risk Scoring Matrix

A Risk Scoring Matrix is a qualitative method used in risk assessment. It involves assigning subjective ratings (e.g., high, medium, low) to the likelihood and impact of identified risks, often using a grid or table. This approach helps prioritize risks based on their relative severity without requiring precise numerical calculations, making it useful for initial assessments.

Question 115: What does 'fail secure' (fail closed) mean in security design?

Systems continue operating during failures to maintain availability
When a system fails, it defaults to a secure state that denies access rather than granting it (Correct answer)
Automatic patching occurs on failure
Logs are preserved even after system failure

Correct answer: When a system fails, it defaults to a secure state that denies access rather than granting it

Fail secure means a system in an error or failure state denies access by default, preventing security bypasses through induced failures.

Question 116: What does certificate pinning accomplish in a mobile application?

Speeds up TLS handshakes
Pins the UI layout to the screen
Stores the certificate on the device permanently
Restricts the app to accept only specific certificates, preventing MITM via rogue CAs (Correct answer)

Correct answer: Restricts the app to accept only specific certificates, preventing MITM via rogue CAs

Certificate pinning hardcodes the expected certificate or public key so the app rejects connections using any other certificate, even if signed by a trusted CA.

Question 117: What is the purpose of a penetration test report's executive summary?

List every CVE discovered
Provide detailed technical exploitation steps
Summarize risk and business impact for non-technical stakeholders (Correct answer)
Document scanner configuration

Correct answer: Summarize risk and business impact for non-technical stakeholders

The executive summary translates technical findings into business risk language for leadership who need to make risk decisions without deep technical knowledge.

Question 118: What does Static Application Security Testing (SAST) analyze to find vulnerabilities?

Database query execution plans and access patterns
Running application behavior in a staging environment
Network traffic generated by the application under load
Source code, bytecode, or binary code without executing the application (Correct answer)

Correct answer: Source code, bytecode, or binary code without executing the application

SAST (white-box testing) examines application source code, bytecode, or binaries for security vulnerabilities without running the program, enabling early detection in the development cycle.

Question 119: What does JIT (Just-In-Time) provisioning accomplish in identity management?

Generates OTP tokens just before they expire
Provisions hardware tokens in real time
Automatically creates user accounts at the moment of first login via federation (Correct answer)
Pre-creates all user accounts before onboarding

Correct answer: Automatically creates user accounts at the moment of first login via federation

JIT provisioning automatically creates accounts when a user first authenticates through a federated identity provider, reducing manual overhead.

Question 120: Which action is part of the "containment" phase in incident response?

Restoring affected systems from backups
Reporting the incident to regulatory authorities
Disconnecting affected systems from the network (Correct answer)
Analyzing log data to identify the cause of the incident

Correct answer: Disconnecting affected systems from the network

The "containment" phase in incident response aims to limit the scope and impact of a security incident. Disconnecting affected systems from the network is a critical containment action, as it prevents the threat from spreading further within the organization's infrastructure or exfiltrating more data. This isolates the compromised systems, allowing for more controlled investigation and remediation.

Question 121: Which architecture pattern places all security enforcement at a single point through which all access must pass?

Choke point / complete mediation (Correct answer)
Distributed security controls
Microservices mesh
Decentralized identity

Correct answer: Choke point / complete mediation

Complete mediation ensures every access request is checked through a central enforcement point, preventing policy bypass through alternate paths.

Question 122: A security engineer reviews access logs and finds a service account with domain admin rights that hasn't logged in for 180 days. What is the recommended action?

Reset the password only
Immediately disable and review the account's necessity and permissions (Correct answer)
Move it to a different OU
Leave it; service accounts need broad rights

Correct answer: Immediately disable and review the account's necessity and permissions

Dormant privileged accounts are a major attack surface; they should be disabled and reviewed for least-privilege compliance.

Question 123: Which security design principle recommends that security mechanisms should be as simple as possible to facilitate verification and reduce attack surface?

Separation of privilege
Economy of mechanism (Correct answer)
Open design
Complete mediation

Correct answer: Economy of mechanism

Economy of mechanism (simplicity) reduces the likelihood of design and implementation flaws by keeping security mechanisms small and understandable.

Question 124: What is a Secure Software Development Lifecycle (SSDLC), and why is it important?

An approach integrating security activities into every phase of software development to find and fix flaws early (Correct answer)
A testing methodology for QA teams; optional for security teams
A process to automate software releases; reduces deployment time
A compliance framework for cloud deployments; required by PCI-DSS

Correct answer: An approach integrating security activities into every phase of software development to find and fix flaws early

SSDLC integrates security requirements, design reviews, code analysis, and testing throughout development, making security a built-in property rather than an afterthought.

Question 125: What is the purpose of a threat model in the threat identification process?

To ensure that data is encrypted
To categorize threats by their geographic origin
To analyze and understand how an attacker might exploit vulnerabilities (Correct answer)
To prioritize assets based on their business value

Correct answer: To analyze and understand how an attacker might exploit vulnerabilities

The purpose of a threat model in the threat identification process is to systematically analyze and understand how an attacker might exploit vulnerabilities within a system or application. It helps security engineers identify potential attack vectors, assess the likelihood of an attack, and understand the potential impact. This proactive analysis guides the implementation of appropriate security controls and mitigation strategies.

ISC2 Systems Security Certified Practitioner (SSCP)

The SSCP validates hands-on technical skills in implementing, monitoring, and administering IT infrastructure using security best practices. It covers network security, cryptography, IAM, incident response, and application security domains.

125

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds