SSCP Systems Security Certified Practitioner — Questions and Answers

Question 1: Which OWASP Top 10 category covers vulnerabilities such as JWT algorithm confusion and broken object-level authorization?

Security Misconfiguration
Broken Access Control (Correct answer)
Injection
Vulnerable and Outdated Components

Correct answer: Broken Access Control

Broken Access Control encompasses failures that allow users to act outside their intended permissions, including BOLA/IDOR and authentication token weaknesses that bypass authorization.

Question 2: During the development phase of the Secure Software Development Lifecycle (SSDLC), a team uses an automated tool to analyze the application's source code for security flaws without executing the program. Which of the following BEST describes this activity?

Fuzzing
Dynamic Application Security Testing (DAST)
Static Application Security Testing (SAST) (Correct answer)
Penetration Testing

Correct answer: Static Application Security Testing (SAST)

Static Application Security Testing (SAST) involves analyzing an application's source code, bytecode, or binaries for security vulnerabilities without running the application. [8, 16, 18] This "white-box" testing approach is performed early in the SDLC to find flaws in the code itself. [5, 22] DAST, fuzzing, and penetration testing are all "black-box" or dynamic methods that test the application while it is in a running state.

Question 3: In a Clark-Wilson integrity model, what are 'Transformation Procedures' (TPs)?

Authentication steps required before data access
Encryption routines that transform plaintext to ciphertext
Audit logs that record all data changes
Well-formed transactions that are the only permitted operations on constrained data (Correct answer)

Correct answer: Well-formed transactions that are the only permitted operations on constrained data

TPs are the only authorized methods for manipulating Constrained Data Items (CDIs), ensuring all changes follow defined integrity rules.

Question 4: Which of the following is one of the Biba model's three main rules?

A subject can read an object that has a lower integrity level.
A subject cannot modify an object that has a lower integrity level. (Correct answer)
A subject cannot request services from an object that has a higher integrity level
A subject cannot read or modify an object of either a lower or higher integrity level.

Correct answer: A subject cannot modify an object that has a lower integrity level.

The Biba model is a security model that focuses on data integrity. It defines three primary rules, also known as the Biba integrity rules. These rules are designed to prevent data corruption and maintain the integrity of information within a system.

Question 5: What is the PRIMARY purpose of a certificate revocation list (CRL) in a PKI environment?

To store encrypted private keys
To distribute new certificates to endpoints
To publish certificates that are no longer valid before their expiry date (Correct answer)
To list all trusted root certificates

Correct answer: To publish certificates that are no longer valid before their expiry date

A CRL is a signed list published by a CA containing serial numbers of certificates that have been revoked prior to their natural expiration.

Question 6: In a Public Key Infrastructure (PKI), what is the primary function of a Certificate Authority (CA)?

To generate and securely store the private keys for all users in the infrastructure.
To maintain a list of all encrypted communications for auditing purposes.
To vouch for the identity of an entity and bind it to a public key through a digital certificate. [7] (Correct answer)
To encrypt and decrypt messages exchanged between two parties.

Correct answer: To vouch for the identity of an entity and bind it to a public key through a digital certificate. [7]

A Certificate Authority (CA) is a trusted third party that issues digital certificates. [7] The CA's main role is to verify the identity of an individual or organization (the subject) and then issue a digital certificate that binds that identity to their public key. [26] This creates a chain of trust. CAs do not store users' private keys.

Question 7: What is key stretching, and why is it used in password-based cryptography?

Extending key length by appending zeros to meet algorithm requirements
Distributing a key across multiple servers for redundancy
Applying a function repeatedly to make brute-force attacks slower and costlier (Correct answer)
Converting symmetric keys into asymmetric key pairs

Correct answer: Applying a function repeatedly to make brute-force attacks slower and costlier

Key stretching algorithms like PBKDF2, bcrypt, and Argon2 apply a hash function thousands of times to a password, making brute-force and dictionary attacks computationally expensive.

Question 8: A company reviews its risk assessments every quarter. Which risk management concept does this practice support?

Threat modeling
Vulnerability scanning
Continuous monitoring (Correct answer)
Risk quantification

Correct answer: Continuous monitoring

Continuous monitoring ensures that risk assessments remain current as the threat landscape, systems, and business environment change over time.

Question 9: Which physical security concept uses layers of controls so that defeating one control does not grant full access?

Deterrence
Defense in depth (Correct answer)
Security through obscurity
Least privilege

Correct answer: Defense in depth

Defense in depth applies multiple overlapping physical controls (fences, guards, locks, cameras) so an attacker must overcome each successive layer to reach a target.

Question 10: What is the primary security purpose of a mantrap (airlock) at a facility entrance?

Monitor temperature and humidity
Detect explosives and weapons
Log employee work hours
Prevent tailgating by allowing only one person to enter at a time (Correct answer)

Correct answer: Prevent tailgating by allowing only one person to enter at a time

A mantrap uses two interlocking doors so that only one can open at a time, preventing unauthorized individuals from following an authorized person into a secure area.

Question 11: What is the Biba model primarily designed to protect?

Auditability of user actions
Availability of critical systems
Confidentiality of sensitive data
Integrity of data from unauthorized modification (Correct answer)

Correct answer: Integrity of data from unauthorized modification

The Biba model enforces data integrity by preventing subjects from writing to higher-integrity objects or reading from lower-integrity objects.

Question 12: What is the purpose of a visitor management system in a secure facility?

Automate payroll for contracted workers
Manage employee vacation scheduling
Monitor network bandwidth usage by guests
Track and control the identity, access, and movement of non-employees within the facility (Correct answer)

Correct answer: Track and control the identity, access, and movement of non-employees within the facility

A visitor management system logs visitor identity, purpose, host employee, badge issuance, and entry/exit times to ensure accountability for all non-employees in a secure facility.

Question 13: A developer is creating a web application that takes user input to search a product database. To provide the strongest defense against SQL injection attacks, which of the following techniques should be implemented?

Sanitizing user input by stripping out keywords like 'SELECT' and 'DROP'.
Using parameterized queries or prepared statements. (Correct answer)
Implementing an allow-list for specific special characters in the input field.
Hashing all user input before appending it to the SQL query string.

Correct answer: Using parameterized queries or prepared statements.

The most effective and recommended defense against SQL injection is the use of parameterized queries, also known as prepared statements. [3, 11, 17] This technique separates the SQL command logic from the data, ensuring that user input is treated as literal data and cannot be executed as part of the command. [27] Input sanitization and block-listing can be incomplete and bypassed, while hashing is used for storing passwords, not for querying data.

Question 14: A company implements an access control system where permissions are assigned to job titles rather than to individual users. When an employee changes their job title, their access rights are automatically updated to reflect their new position. This is an example of which access control model?

Role-Based Access Control (RBAC) (Correct answer)
Mandatory Access Control (MAC)
Rule-Based Access Control
Discretionary Access Control (DAC)

Correct answer: Role-Based Access Control (RBAC)

Role-Based Access Control (RBAC) assigns permissions to roles, and users acquire permissions by being assigned to those roles. This simplifies administration, as described in the scenario where access rights are tied to job titles.

Question 15: Which badge system technology is considered most secure against cloning attacks?

Barcode badges
Magnetic stripe cards
13.56 MHz smart cards with mutual authentication (Correct answer)
125 kHz proximity (EM4100) cards

Correct answer: 13.56 MHz smart cards with mutual authentication

13.56 MHz smart cards (such as MIFARE DESFire or iCLASS SE) implement mutual authentication and encryption, making them far more resistant to cloning than legacy proximity or magnetic stripe technologies.

Question 16: A security team is evaluating container security. Which risk is MOST unique to containerized environments compared to traditional VMs?

Unencrypted data at rest on storage volumes
Container escape allowing access to the shared host kernel (Correct answer)
Unpatched guest OS kernels
Weak administrative passwords on management consoles

Correct answer: Container escape allowing access to the shared host kernel

Containers share the host OS kernel, so a container escape vulnerability can give an attacker access to the host and all other containers.

Question 17: In the case that backup tapes are taken or misplaced, what security method might offer an extra security control?

Keep multiple copies of the tapes
Replace tape media with hard drives
Use appropriate security labels
Use AES-256 encryption (Correct answer)

Correct answer: Use AES-256 encryption

Using AES-256 encryption can provide an additional security control in the event that backup tapes are stolen or lost. Encryption ensures that the data stored on the backup tapes is protected even if the tapes fall into unauthorized hands. AES-256 encryption is a strong encryption algorithm widely recognized for its security and is commonly used to secure sensitive information. By encrypting the data on the backup tapes, unauthorized individuals would not be able to access or decipher the data without the encryption key, thus providing an additional layer of protection to the backup data.

Question 18: A security analyst notices repeated failed login attempts followed by a successful login from an unusual location. This BEST describes which type of attack?

Man-in-the-middle attack
Brute force attack (Correct answer)
Credential stuffing
Replay attack

Correct answer: Brute force attack

Repeated failed login attempts followed by eventual success from an unusual location is the hallmark pattern of a brute force attack.

Question 19: Which type of fire suppression system is most appropriate for a data center to minimize equipment damage?

Foam deluge system
Wet pipe sprinkler
Dry pipe sprinkler
Clean agent (e.g., FM-200) system (Correct answer)

Correct answer: Clean agent (e.g., FM-200) system

Clean agent systems discharge a non-conductive gas or chemical that suppresses fire without damaging sensitive electronic equipment, making them ideal for data centers.

Question 20: What is the purpose of a VLAN in network security?

To encrypt traffic between endpoints
To logically segment a network without requiring additional physical hardware (Correct answer)
To provide redundant network paths for high availability
To monitor and log all network traffic for forensic purposes

Correct answer: To logically segment a network without requiring additional physical hardware

VLANs create logical network segments on the same physical infrastructure, isolating broadcast domains and limiting lateral movement.

Question 21: A user reports their system shows a ransom note demanding cryptocurrency, and all personal files have the extension '.locked'. Which type of malware has infected the system?

Rootkit
Spyware
Ransomware (Correct answer)
Trojan horse

Correct answer: Ransomware

Ransomware encrypts victim files and demands payment for the decryption key, commonly appending a new extension to encrypted files.

Question 22: What physical security measure involves examining trash and discarded materials to find sensitive information?

Piggyback attack
Shoulder surfing
Tailgating
Dumpster diving (Correct answer)

Correct answer: Dumpster diving

Dumpster diving is the practice of searching through trash to find discarded documents, storage media, or other items that may contain sensitive or exploitable information.

Question 23: Which security feature in modern CPUs helps prevent shellcode execution by marking memory regions as either executable or non-executable?

Address Space Layout Randomization (ASLR)
Control Flow Integrity (CFI)
Stack canaries
Data Execution Prevention (DEP) / NX bit (Correct answer)

Correct answer: Data Execution Prevention (DEP) / NX bit

DEP (also called the NX/XD bit) marks data memory pages as non-executable, preventing attackers from executing shellcode injected into stack or heap regions.

Question 24: What is a primary risk of using shared accounts in a multi-user environment?

Increased password complexity requirements
Loss of individual accountability and audit trail integrity (Correct answer)
Slower authentication performance
Higher licensing costs for the application

Correct answer: Loss of individual accountability and audit trail integrity

Shared accounts make it impossible to attribute actions to a specific individual, destroying accountability and complicating forensic investigations.

Question 25: During a security assessment, a tester finds that the application accepts user input in an XML document and processes it without disabling external entity references. Which attack does this enable?

Cross-site scripting (XSS) via injected script tags
Cross-site request forgery via XML-encoded form submissions
SQL injection via crafted XML attribute values
XML External Entity (XXE) injection allowing server-side file disclosure (Correct answer)

Correct answer: XML External Entity (XXE) injection allowing server-side file disclosure

XXE injection exploits XML parsers that resolve external entity references, allowing attackers to read local files, perform SSRF, or cause denial of service.

Question 26: What term describes the practice of following an authorized person through a secured door without using your own credentials?

Dumpster diving
Tailgating (Correct answer)
Shoulder surfing
Piggybacking

Correct answer: Tailgating

Tailgating (also called piggybacking) is the act of following closely behind an authorized person to gain unauthorized physical entry to a restricted area.

Question 27: Which of the following BEST describes a supply chain attack in the context of software security?

Performing a denial-of-service attack on the software vendor's update servers
Compromising a trusted third-party component, library, or build process to deliver malicious code (Correct answer)
Using social engineering to obtain developer credentials
An attacker exploiting a buffer overflow in the target application directly

Correct answer: Compromising a trusted third-party component, library, or build process to deliver malicious code

Supply chain attacks target trusted upstream components—such as open-source libraries or CI/CD pipelines—to inject malicious code that is then distributed to all downstream users.

Question 28: In a hybrid encryption scheme, how is asymmetric encryption typically used?

To encrypt only the symmetric session key used for bulk data encryption (Correct answer)
To generate hash values for message authentication
To compress data before symmetric encryption
To encrypt the entire message content

Correct answer: To encrypt only the symmetric session key used for bulk data encryption

Hybrid encryption uses asymmetric cryptography to securely exchange a symmetric session key, and the much faster symmetric cipher encrypts the actual data — combining security with performance.

Question 29: Which of the following best describes 'indicator of compromise' (IoC)?

A predictive model for future attack vectors
A baseline configuration for secure system deployment
Forensic artifacts that suggest a system has been breached (Correct answer)
A metric used to calculate incident response effectiveness

Correct answer: Forensic artifacts that suggest a system has been breached

IoCs are forensic artifacts such as malicious IPs, file hashes, or registry keys that indicate a system has likely been compromised.

Question 30: What is a 'parallel test' in disaster recovery?

Running scheduled backups in parallel with normal production workloads
Activating the recovery site and running operations there while production systems remain online (Correct answer)
Running simultaneous backups across multiple storage systems
Testing two different recovery sites against each other simultaneously

Correct answer: Activating the recovery site and running operations there while production systems remain online

A parallel test activates the recovery site and verifies it can handle operations while keeping primary production systems fully operational, providing realistic testing without service disruption.

Question 31: Which metric measures the average time elapsed between a security event occurring and its detection by the security team?

Recovery Time Objective (RTO)
Recovery Point Objective (RPO)
Mean Time to Detect (MTTD) (Correct answer)
Mean Time to Repair (MTTR)

Correct answer: Mean Time to Detect (MTTD)

Mean Time to Detect (MTTD) measures how long it takes from when a security event occurs until it is identified, and reducing it is a key SOC performance goal.

Question 32: What physical security control is specifically designed to prevent vehicle-based attacks against building entrances?

Turnstile
Mantrap
Bollard (Correct answer)
Cipher lock

Correct answer: Bollard

Bollards are short, sturdy posts placed around building perimeters and entrances specifically to stop or slow vehicles from ramming into structures.

Question 33: During the eradication phase, a security analyst discovers malware persisting via a registry run key. After removing the malware, what is the NEXT critical step?

Remove the malicious registry entry as well (Correct answer)
Immediately reconnect the system to the network
Archive the malware sample and close the ticket
Notify users the system is clean

Correct answer: Remove the malicious registry entry as well

Removing only the malware executable without eliminating its persistence mechanism (the registry key) allows it to re-execute on reboot.

Question 34: Which risk response strategy is being used when a company purchases cyber liability insurance to cover potential data breach costs?

Risk acceptance
Risk transfer (Correct answer)
Risk mitigation
Risk avoidance

Correct answer: Risk transfer

Purchasing insurance transfers the financial consequence of a risk to a third party (the insurer), which is the definition of risk transfer.

Question 35: Which SSCP domain concept involves reviewing and confirming that user access rights remain appropriate over time?

Privilege escalation
Single sign-on
Account lockout
Access recertification (Correct answer)

Correct answer: Access recertification

Access recertification (or access review) is the periodic process of validating that users still require and appropriately hold their current access rights.

Question 36: Under US federal law, which regulation requires certain organizations to report cybersecurity incidents to CISA within 72 hours?

HIPAA Security Rule
SOX Section 404
GLBA Safeguards Rule
CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act) (Correct answer)

Correct answer: CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act)

CIRCIA mandates that covered critical infrastructure entities report significant cyber incidents to CISA within 72 hours of reasonable belief of occurrence.

Question 37: Which cryptographic attack involves an attacker intercepting and possibly altering communications between two parties without their knowledge?

Replay attack
Chosen-plaintext attack
Man-in-the-middle attack (Correct answer)
Birthday attack

Correct answer: Man-in-the-middle attack

A man-in-the-middle (MITM) attack occurs when an attacker secretly intercepts and potentially modifies communications between two parties who believe they are communicating directly.

Question 38: Which type of backup captures only the data that has changed since the LAST FULL backup, regardless of subsequent backups?

Mirror backup
Incremental backup
Differential backup (Correct answer)
Snapshot backup

Correct answer: Differential backup

A differential backup always references the last full backup, growing larger over time but requiring only two sets for restore.

Question 39: What does a host-based IDS (HIDS) monitor that a network-based IDS (NIDS) cannot?

Inter-VLAN traffic
Network packet headers
Internal system calls and file integrity (Correct answer)
Router configuration changes

Correct answer: Internal system calls and file integrity

HIDS operates on individual endpoints and can monitor system calls, file changes, registry modifications, and local log events that network traffic analysis cannot observe.

Question 40: During incident response, a team member suggests wiping and reimaging an infected server immediately. What is a key risk of this approach?

Evidence critical to understanding the attack may be destroyed (Correct answer)
It will restore the vulnerability that caused the infection
Reimaging takes longer than manual cleanup
The server cannot be reimaged if malware is present

Correct answer: Evidence critical to understanding the attack may be destroyed

Wiping without first collecting forensic evidence destroys attack indicators, making root cause analysis and attribution impossible.

Question 41: An organization wants to grant contractors temporary access to a project folder that automatically expires after 30 days. Which mechanism best supports this?

Access Control Lists with time-based entries
Mandatory labels with low sensitivity
Capability tokens with embedded expiration (Correct answer)
User accounts without password expiration

Correct answer: Capability tokens with embedded expiration

Capability tokens can embed expiration dates, ensuring access is automatically revoked when the token expires without manual ACL changes.

Question 42: What is the main difference between a deterrent and a preventive physical security control?

Preventive controls are more expensive than deterrents
Deterrents discourage attacks; preventive controls physically stop them (Correct answer)
Deterrents are only used outdoors
Deterrents are always electronic; preventive controls are always physical

Correct answer: Deterrents discourage attacks; preventive controls physically stop them

Deterrent controls (such as warning signs or visible cameras) discourage potential attackers, while preventive controls (such as locks or barriers) physically prevent unauthorized access.

Question 43: During a security incident, an analyst notices that an attacker deleted Windows Event Logs to cover their tracks. Which forensic technique might still recover evidence of the deleted logs?

Checking the active directory replication logs
Running a new vulnerability scan against the system
Analyzing Volume Shadow Copies or backup snapshots (Correct answer)
Reviewing the firewall's stateful inspection tables

Correct answer: Analyzing Volume Shadow Copies or backup snapshots

Volume Shadow Copies (VSS) or backup snapshots may contain previous versions of event logs before they were deleted by the attacker.

Question 44: A developer stores session tokens in HTML5 localStorage. What is the primary security risk?

localStorage is accessible by any JavaScript on the same origin, enabling XSS theft (Correct answer)
Tokens are sent in HTTP headers automatically, causing CSRF
Tokens expire too quickly due to browser caching
localStorage is not persistent across browser tabs

Correct answer: localStorage is accessible by any JavaScript on the same origin, enabling XSS theft

localStorage is accessible to all scripts on the same origin, so an XSS vulnerability allows attackers to steal session tokens directly.

Question 45: An attacker used a zero-day exploit to breach a network. During post-incident analysis, which document should be UPDATED first to address this gap?

The acceptable use policy for employees
The disaster recovery plan for natural disasters
The incident response plan and detection playbooks (Correct answer)
The organization's privacy policy

Correct answer: The incident response plan and detection playbooks

The incident response plan and playbooks must be updated to incorporate detection methods and response procedures for previously unknown exploit types.

Question 46: In a Discretionary Access Control (DAC) model, who is responsible for determining which users have access to a resource?

The owner of the resource (Correct answer)
The security administrator
The system itself based on predefined rules
A central authority based on security labels

Correct answer: The owner of the resource

In the Discretionary Access Control (DAC) model, the owner of an object (such as a file or folder) has the discretion to grant or deny access to other subjects (users).

Question 47: Which malware category is specifically designed to remain hidden on a compromised system by modifying OS components to conceal its presence?

Ransomware
Worm
Rootkit (Correct answer)
Adware

Correct answer: Rootkit

Rootkits modify operating system components such as system calls or kernel modules to hide processes, files, and network connections from administrators.

Question 48: What is the primary security function of 802.1X in a wired or wireless network?

Traffic encryption
QoS enforcement
Port-based network access control (Correct answer)
VLAN segmentation

Correct answer: Port-based network access control

802.1X enforces port-based network access control by requiring devices to authenticate before being granted network access.

Question 49: What is the primary purpose of uninterruptible power supplies (UPS) in a data center context?

Serve as the main backup generator for extended outages
Boost voltage for high-demand servers
Reduce electricity costs during peak hours
Provide conditioned, continuous power during brief outages and protect against power fluctuations (Correct answer)

Correct answer: Provide conditioned, continuous power during brief outages and protect against power fluctuations

A UPS provides immediate battery-backed power during outages and filters power quality issues (spikes, sags, surges) to protect equipment until utility power is restored or a generator starts.

Question 50: What does DANE (DNS-Based Authentication of Named Entities) use to bind TLS certificates to DNS names?

OCSP stapling
RADIUS
TLSA DNS records secured by DNSSEC (Correct answer)
Certificate Transparency logs

Correct answer: TLSA DNS records secured by DNSSEC

DANE uses TLSA resource records published in DNSSEC-signed zones to authenticate TLS server certificates without relying solely on commercial CAs.

Question 51: Which type of backup strategy involves backing up only the data that has changed since the LAST FULL backup, regardless of incremental backups?

Continuous backup
Incremental backup
Snapshot backup
Differential backup (Correct answer)

Correct answer: Differential backup

A differential backup captures all changes since the last full backup, making restoration faster than incremental since only two sets (full + latest differential) are needed.

Question 52: Which of the following BEST describes the principle of 'least privilege' in the context of access control?

Ensuring all users have a baseline set of access permissions.
Granting users only the minimum permissions necessary to perform their job responsibilities. (Correct answer)
Allowing resource owners to decide who can access their resources.
Granting users the highest level of access required to perform any potential job function.

Correct answer: Granting users only the minimum permissions necessary to perform their job responsibilities.

The principle of least privilege is a fundamental security concept that dictates a user should be given only the minimum levels of access – or permissions – needed to perform their job tasks. This minimizes the potential damage from a compromised account.

Question 53: What is the purpose of a 'clean desk policy' as a physical security control?

Comply with OSHA workplace safety requirements
Ensure equipment is properly cleaned to prevent static discharge
Reduce clutter to improve productivity
Prevent unauthorized access to sensitive information left unattended (Correct answer)

Correct answer: Prevent unauthorized access to sensitive information left unattended

A clean desk policy requires employees to clear sensitive documents and materials from their workstations when unattended, preventing unauthorized viewing or theft of information.

Question 54: What is the primary purpose of Address Space Layout Randomization (ASLR) as an exploit mitigation?

Randomizing the memory addresses of process components to make exploitation harder (Correct answer)
Preventing execution of code marked as data in the NX bit
Scanning heap memory for known shellcode signatures
Encrypting memory pages containing sensitive data at rest

Correct answer: Randomizing the memory addresses of process components to make exploitation harder

ASLR randomizes the base addresses of the stack, heap, and libraries so attackers cannot reliably predict memory locations needed for exploitation.

Question 55: Which container security best practice MOST reduces the risk of privilege escalation if a container is compromised?

Encrypting all container images at rest
Running containers as non-root users with read-only root filesystems (Correct answer)
Using only official base images from public registries
Scanning container images for vulnerabilities during CI/CD

Correct answer: Running containers as non-root users with read-only root filesystems

Running containers as non-root with read-only filesystems limits what an attacker can do after compromising a container, constraining privilege escalation paths.

Question 56: A security team wants to detect malware that uses domain generation algorithms (DGA) for command-and-control. Which tool is MOST useful?

Full-packet network capture at the perimeter firewall
Host-based vulnerability scanner
File integrity monitoring software
DNS query log analysis with anomaly detection (Correct answer)

Correct answer: DNS query log analysis with anomaly detection

DGA malware generates large numbers of pseudo-random domain names; analyzing DNS query logs for high volumes of non-resolving or algorithmically generated domain requests reveals this behavior.

Question 57: Which physical security control uses infrared beams to detect motion or intrusion in a protected area?

Biometric reader
CCTV
Bollard
Passive infrared (PIR) sensor (Correct answer)

Correct answer: Passive infrared (PIR) sensor

PIR sensors detect changes in infrared radiation caused by moving warm objects (such as people), triggering an alarm when unauthorized movement is detected.

Question 58: A security analyst is reviewing a legacy system that stores user passwords in a database. The analyst discovers the passwords are obfuscated using a method that is easily reversible. Which of the following was MOST likely used, representing the weakest form of password protection?

AES-256 encryption
Asymmetric encryption with RSA
Salting and hashing with SHA-256
Base64 encoding (Correct answer)

Correct answer: Base64 encoding

Base64 is an encoding scheme, not an encryption or hashing algorithm. It is designed to represent binary data in an ASCII string format and is easily reversible. Hashing (especially with a salt) and strong encryption algorithms like AES or RSA are secure methods for protecting passwords, whereas encoding provides no confidentiality.

Question 59: What is the primary purpose of a Message Authentication Code (MAC)?

Generating public/private key pairs
Verifying both data integrity and authenticity (Correct answer)
Compressing data before transmission
Encrypting the message content

Correct answer: Verifying both data integrity and authenticity

A MAC provides data integrity and authenticity verification by using a shared secret key to produce a tag that confirms the message has not been altered and came from a legitimate sender.

Question 60: What is the main advantage of using threat intelligence feeds in a SIEM?

They automate vulnerability patching
They eliminate false positives completely
They replace the need for human analysts
They enrich alerts with context about known malicious indicators (Correct answer)

Correct answer: They enrich alerts with context about known malicious indicators

Threat intelligence feeds provide IOCs (IP addresses, domains, hashes) and context that enrich SIEM alerts, helping analysts prioritize and investigate faster.

Question 61: Which term describes the maximum amount of risk loss an organization can sustain without threatening its ability to continue operations?

Risk capacity (Correct answer)
Residual risk
Inherent risk
Risk appetite

Correct answer: Risk capacity

Risk capacity is the objective maximum risk an organization can absorb before its survival or core operations are threatened, distinct from the subjective risk appetite.

Question 62: A monitoring system flags an alert every time a user accesses a file server after hours. After investigating, the analyst confirms this is an authorized admin performing backups. What should be done?

Escalate to incident response
Terminate the admin's access
Disable all after-hours alerts
Create a tuning exception for this specific authorized activity (Correct answer)

Correct answer: Create a tuning exception for this specific authorized activity

Tuning exceptions for known authorized activity reduces false positives while preserving detection of truly anomalous after-hours access by unauthorized users.

Question 63: What is the purpose of an initialization vector (IV) in symmetric encryption?

To compress plaintext before encryption
To ensure identical plaintexts produce different ciphertexts when encrypted with the same key (Correct answer)
To increase the key length of the cipher
To authenticate the sender of encrypted data

Correct answer: To ensure identical plaintexts produce different ciphertexts when encrypted with the same key

An IV is a random value used along with the encryption key to ensure that encrypting the same plaintext twice with the same key produces different ciphertext, preventing pattern analysis.

Question 64: Recently, Ceasar put into place an intrusion prevention system meant to prevent typical network threats from harming his business. What kind of risk management approach is Ceasar employing?

Risk acceptance
Risk transference
Risk avoidance
Risk mitigation (Correct answer)

Correct answer: Risk mitigation

Risk mitigation is a risk management strategy that involves taking actions to reduce or mitigate the impact or likelihood of risks. In this case, Mike implemented an intrusion prevention system (IPS) to block common network attacks from affecting his organization. The IPS is a proactive measure that aims to detect and prevent network attacks before they can cause damage or compromise the network. By implementing the IPS, Mike is pursuing a risk mitigation strategy to reduce the risk associated with network attacks.

Question 65: What is the correct sequence for developing a Business Continuity Plan?

Documentation, testing, implementation, risk planning
Business Impact Analysis, risk assessment, strategy development, plan implementation (Correct answer)
Planning, implementation, BIA, and then final testing
Risk assessment, documentation, employee training, testing

Correct answer: Business Impact Analysis, risk assessment, strategy development, plan implementation

BCP development follows: BIA (identify critical functions) → risk assessment (identify threats) → strategy development (define recovery options) → plan implementation and testing.

Question 66: In a Delphi risk assessment technique, a group of experts anonymously provide risk estimates in multiple rounds. What is the primary advantage of this approach?

It eliminates the need for a risk register
It is the fastest risk assessment method available
It reduces groupthink and anchoring bias by anonymizing expert opinions (Correct answer)
It produces precise quantitative risk values based on historical data

Correct answer: It reduces groupthink and anchoring bias by anonymizing expert opinions

The Delphi technique uses anonymized, iterative expert feedback to reach consensus while avoiding the social pressures that cause groupthink or anchoring bias.

Question 67: Which virtualization security control ensures that a virtual machine cannot read the memory of another VM running on the same hypervisor?

VM-level firewall rules between guest OSes
Separate VLAN assignment for each virtual machine
Encrypted virtual disk images on shared storage
Hypervisor-enforced memory isolation between VM address spaces (Correct answer)

Correct answer: Hypervisor-enforced memory isolation between VM address spaces

The hypervisor enforces strict memory isolation so each VM's address space is inaccessible to other VMs, preventing cross-VM memory snooping.

Question 68: Which mobile security control prevents an application from communicating with a fraudulent server even if the device trusts a rogue CA certificate?

Two-factor authentication at login
Certificate pinning embedded in the application (Correct answer)
Certificate transparency logging
HTTP Strict Transport Security (HSTS) headers

Correct answer: Certificate pinning embedded in the application

Certificate pinning hardcodes the expected certificate or public key within the app, rejecting connections to servers presenting different certificates.

Question 69: What distinguishes a Type 1 (bare-metal) hypervisor from a Type 2 (hosted) hypervisor in terms of security?

Type 1 requires a host OS, which increases the attack surface compared to Type 2
Type 2 is always more secure because it runs within a hardened OS
Type 1 runs directly on hardware without a host OS, reducing the attack surface (Correct answer)
Type 2 provides stronger VM isolation because it uses hardware-assisted virtualization

Correct answer: Type 1 runs directly on hardware without a host OS, reducing the attack surface

Type 1 hypervisors run directly on hardware, eliminating the host OS layer and its associated vulnerabilities, resulting in a smaller attack surface.

Question 70: An attacker embeds a malicious macro in a Microsoft Word document sent via phishing email. Which countermeasure MOST directly prevents execution of this macro?

Configuring Group Policy to disable macros in Office applications (Correct answer)
Enabling full-disk encryption on employee workstations
Deploying a network intrusion detection system
Requiring multi-factor authentication for email login

Correct answer: Configuring Group Policy to disable macros in Office applications

Disabling macros via Group Policy prevents Office documents from executing embedded VBA code, directly blocking this common malware delivery vector.

Question 71: Which access control concept limits the damage a compromised account can cause by granting only the permissions required for its job function?

Separation of duties
Least privilege (Correct answer)
Dual control
Job rotation

Correct answer: Least privilege

Least privilege minimizes an account's permissions to only what is necessary, reducing the attack surface if that account is compromised.

Question 72: Which technique does a Web Application Firewall (WAF) primarily use to detect SQL injection attacks?

Behavioral analysis of user login times
Certificate pinning on HTTPS connections
Deep packet inspection of network headers
Signature-based pattern matching against request payloads (Correct answer)

Correct answer: Signature-based pattern matching against request payloads

WAFs primarily use signature-based pattern matching to compare HTTP request payloads against known malicious patterns like SQL injection syntax.

Question 73: What does Recovery Point Objective (RPO) define?

The maximum acceptable time to restore a system after a failure
The maximum acceptable amount of data loss expressed as a point in time (Correct answer)
The total financial cost of recovering from a disaster
The physical location where recovery operations are conducted

Correct answer: The maximum acceptable amount of data loss expressed as a point in time

RPO defines the maximum acceptable amount of data loss measured in time, indicating the point to which data must be restored after a disaster.

Question 74: A financial services company has a regulatory requirement to resume critical operations within one hour of a disaster declaration. The company needs a recovery site that is fully configured with all necessary hardware, software, and real-time synchronized data. Which type of disaster recovery site would BEST meet this requirement?

Mobile Site
Hot Site (Correct answer)
Cold Site
Warm Site

Correct answer: Hot Site

A hot site is a fully operational replica of the primary production environment, often with real-time or near-real-time data synchronization. It is designed for immediate or near-immediate failover, meeting the very low Recovery Time Objective (RTO) of one hour. A warm site has hardware but requires configuration and data restoration, while a cold site is just a facility with power and cooling, both resulting in much longer recovery times.

Question 75: In a SCADA environment, which security concern is MOST unique compared to traditional IT environments?

Inability to patch systems without impacting operational availability (Correct answer)
Absence of user authentication mechanisms
Lack of encryption support
No network connectivity requirements

Correct answer: Inability to patch systems without impacting operational availability

SCADA systems often cannot tolerate downtime for patching because they control physical processes that must run continuously.

Question 76: Which access control model assigns permissions based on the sensitivity label of an object and the clearance level of a subject?

Mandatory Access Control (MAC) (Correct answer)
Attribute-Based Access Control (ABAC)
Discretionary Access Control (DAC)
Role-Based Access Control (RBAC)

Correct answer: Mandatory Access Control (MAC)

MAC uses sensitivity labels on objects and clearance levels on subjects to enforce access decisions centrally, independent of user discretion.

Question 77: What distinguishes need-to-know from clearance in a MAC environment?

Clearance grants eligibility; need-to-know restricts access to specific information despite clearance (Correct answer)
Clearance is granted by users; need-to-know is granted by the system
They are functionally identical in MAC systems
Clearance is a minimum level; need-to-know is a maximum level

Correct answer: Clearance grants eligibility; need-to-know restricts access to specific information despite clearance

Even with sufficient clearance, a subject must also have a demonstrated need-to-know for the specific data to be granted access.

Question 78: What is the difference between identification and authentication in access control?

They are interchangeable terms for the same process
Identification is stronger than authentication
Identification claims identity; authentication verifies the claim (Correct answer)
Identification verifies identity; authentication claims it

Correct answer: Identification claims identity; authentication verifies the claim

Identification is the act of claiming an identity (e.g., username), while authentication is the process of proving that claim with evidence.

Question 79: What is the primary purpose of a call tree (notification tree) in BCP?

To provide a structured chain for rapidly notifying all relevant personnel during a disaster (Correct answer)
To track the financial cost of disaster recovery operations in real time
To document all IT system dependencies and recovery priorities
To document step-by-step recovery procedures for each critical system

Correct answer: To provide a structured chain for rapidly notifying all relevant personnel during a disaster

A call tree defines a branching notification sequence so that each person contacts a defined set of others, ensuring all key personnel are reached quickly without a single point of contact becoming overwhelmed.

Question 80: When conducting a physical security assessment, what does the term 'fence line attack' refer to?

Hacking into physical security cameras along a perimeter
Installing wireless access points near the property boundary
An attacker scaling or breaching the perimeter fence to gain site access (Correct answer)
Social engineering of security guards at the gate

Correct answer: An attacker scaling or breaching the perimeter fence to gain site access

A fence line attack involves an adversary physically breaching the outer perimeter fence, which is why perimeter fencing specifications (height, material, barbed wire) are critical controls.

Question 81: In physical security, what does CPTED stand for and what is its goal?

Crime Prevention Through Environmental Design — to reduce crime opportunity through design (Correct answer)
Computer Physical Testing and Evaluation Design — to assess hardware security
Critical Physical Technology for Electronic Defense — to harden server rooms
Centralized Physical Threat Evaluation Database — to log security incidents

Correct answer: Crime Prevention Through Environmental Design — to reduce crime opportunity through design

CPTED (Crime Prevention Through Environmental Design) uses architectural and environmental features like lighting, sight lines, and landscaping to naturally deter criminal activity.

Question 82: Which environmental control is critical for preventing electrostatic discharge (ESD) damage to hardware in a data center?

Humidity control (Correct answer)
Hot/cold aisle containment
Positive air pressure
Raised flooring

Correct answer: Humidity control

Maintaining relative humidity between approximately 40–60% prevents the buildup of static electricity that can cause electrostatic discharge and damage sensitive electronic components.

Question 83: An Intrusion Prevention System (IPS) is configured to identify and block threats by comparing network traffic against a large database of known malicious packet sequences and exploit payloads. What type of detection method is being used?

Heuristic-based
Behavior-based
Signature-based (Correct answer)
Anomaly-based

Correct answer: Signature-based

Signature-based detection works by comparing observed data (like network traffic) against a database of known patterns, or 'signatures,' of malicious activity. This method is very effective at stopping known threats. Anomaly, behavior, and heuristic methods focus on identifying deviations from a baseline of normal activity and are better suited for detecting new or unknown threats.

Question 84: Which of the following activities is a fundamental part of the system hardening process aimed at reducing a server's attack surface?

Installing a host-based intrusion prevention system (HIPS)
Removing or disabling unnecessary services, protocols, and accounts (Correct answer)
Configuring daily incremental backups to an offsite location
Deploying the server as a virtual machine for easier snapshots

Correct answer: Removing or disabling unnecessary services, protocols, and accounts

A primary goal of system hardening is to reduce the attack surface. [6, 13] This is most directly achieved by uninstalling unnecessary software and disabling non-essential services, ports, and user accounts. [10, 32] Each running service or open port represents a potential vector for attack. While backups, HIPS, and virtualization are all valuable security practices, they are separate controls and not the most fundamental aspect of minimizing the initial attack surface through configuration.

Question 85: Which access control model is most commonly used in commercial operating systems like Windows and Linux file systems?

Discretionary Access Control (DAC) (Correct answer)
Mandatory Access Control (MAC)
Role-Based Access Control (RBAC)
Rule-Based Access Control

Correct answer: Discretionary Access Control (DAC)

DAC allows resource owners to control who can access their files, which is the standard model in mainstream operating systems via file permissions and ACLs.

Question 86: In the context of SSCP risk management, what does the term 'residual risk' mean?

The risk remaining after controls have been applied (Correct answer)
The risk transferred to an insurance company
The total risk before any controls are in place
The risk accepted by senior management

Correct answer: The risk remaining after controls have been applied

Residual risk is the remaining risk exposure after all planned security controls and risk treatments have been implemented.

Question 87: Which protocol provides mutual authentication and encrypts both control and data channels in FTP-based communications?

TFTP
FTPS with TLS (Correct answer)
SCP
SFTP

Correct answer: FTPS with TLS

FTPS uses TLS to encrypt both the control and data channels and supports mutual certificate-based authentication.

Question 88: An organization's IDS generates 200 alerts per day, of which 190 are false positives. What is the false positive rate?

10%
90%
95% (Correct answer)
5%

Correct answer: 95%

With 190 false positives out of 200 total alerts, the false positive rate is 190/200 = 95%, indicating the IDS needs significant tuning.

Question 89: After a major incident, an organization discovers its incident response plan had not been tested in two years. Which activity would BEST address this gap going forward?

Hiring additional security analysts to improve response speed
Purchasing a new SIEM platform for better detection
Requiring all employees to complete cybersecurity awareness training
Conducting quarterly tabletop exercises and annual full-scale simulations (Correct answer)

Correct answer: Conducting quarterly tabletop exercises and annual full-scale simulations

Regular tabletop exercises and simulations test the IRP, identify gaps, train responders, and ensure the plan remains current with evolving threats.

Question 90: An attacker intercepts several encrypted messages sent with the same key. The attacker also has access to the plaintext for a few of those messages. Using this information, the attacker attempts to determine the key to decrypt other messages. What type of cryptographic attack is this?

Chosen-plaintext attack
Brute-force attack
Ciphertext-only attack
Known-plaintext attack (Correct answer)

Correct answer: Known-plaintext attack

In a known-plaintext attack, the attacker has access to both the plaintext and its corresponding encrypted version (ciphertext). [10] This allows the attacker to analyze the relationship between them to try and deduce the key or find weaknesses in the encryption algorithm. A ciphertext-only attack means the attacker only has the encrypted text. A chosen-plaintext attack is where the attacker can choose the plaintext to be encrypted.

Question 91: Which type of lock provides the highest resistance to lock-picking attacks among the options listed?

Standard pin tumbler lock
Wafer lock
Cam lock
High-security disc-detainer lock (Correct answer)

Correct answer: High-security disc-detainer lock

High-security disc-detainer locks use rotating discs instead of pins, making them significantly more resistant to picking, drilling, and other physical bypass techniques.

Question 92: What is a 'hot site' in the context of disaster recovery?

An empty facility with only basic power and network infrastructure
A partially equipped facility that requires some setup time before becoming operational
A mobile recovery unit deployed directly to the disaster location
A fully equipped backup facility that can assume operations immediately after a disaster (Correct answer)

Correct answer: A fully equipped backup facility that can assume operations immediately after a disaster

A hot site is a fully equipped, operational duplicate facility with current data replication that can assume business operations immediately after a disaster is declared.

Question 93: In asymmetric encryption, which key is used to encrypt data that only the recipient should read?

Recipient's public key (Correct answer)
Recipient's private key
Sender's private key
Sender's public key

Correct answer: Recipient's public key

Data intended for a specific recipient is encrypted with the recipient's public key; only the recipient's corresponding private key can decrypt it.

Question 94: What is the purpose of baselining in security monitoring?

To establish normal behavior patterns for anomaly detection (Correct answer)
To define access control policies
To set patch management schedules
To configure firewall rules

Correct answer: To establish normal behavior patterns for anomaly detection

Baselining documents normal system and network behavior so that deviations—potential indicators of compromise—can be reliably identified.

Question 95: Which protocol is commonly used to provide centralized AAA services for network access?

SNMP
DNS
SMTP
RADIUS (Correct answer)

Correct answer: RADIUS

RADIUS (Remote Authentication Dial-In User Service) provides centralized Authentication, Authorization, and Accounting for network access control.

Question 96: What does the term 'dwell time' refer to in the context of security monitoring?

Time required to recover systems after an incident
Duration an attacker remains undetected within a network (Correct answer)
Period between security audits
Time taken to patch a vulnerability after disclosure

Correct answer: Duration an attacker remains undetected within a network

Dwell time measures how long an attacker operates within a network before being detected; minimizing dwell time is a primary goal of security monitoring programs.

Question 97: What is the purpose of hot aisle/cold aisle containment in a data center?

Improve cooling efficiency by directing airflow predictably (Correct answer)
Prevent unauthorized physical access to servers
Reduce fire risk by isolating heat sources
Separate server racks by security clearance level

Correct answer: Improve cooling efficiency by directing airflow predictably

Hot aisle/cold aisle containment organizes server racks so cold air intake and hot air exhaust face consistent directions, maximizing cooling efficiency and preventing recirculation.

Question 98: An organization uses a 5×5 risk matrix to rate risks by likelihood and impact. A risk scored 4 (likelihood) × 5 (impact) would be classified as:

Low risk requiring periodic review
Critical risk requiring insurance transfer
Medium risk accepted without controls
High risk requiring immediate treatment (Correct answer)

Correct answer: High risk requiring immediate treatment

A score of 20 out of 25 on a 5×5 matrix places the risk in the high or critical zone, demanding immediate treatment action.

Question 99: A security analyst observes that a process is making outbound connections to multiple IP addresses on port 6667 at regular intervals. This behavior MOST likely indicates:

Malware communicating with a command-and-control server via IRC protocol (Correct answer)
An encrypted backup service using non-standard ports
A legitimate software update process using a custom protocol
A misconfigured DNS resolver querying multiple upstream servers

Correct answer: Malware communicating with a command-and-control server via IRC protocol

Port 6667 is the default IRC port, and periodic beaconing to multiple external IPs is a classic indicator of botnet malware checking in with its C2 infrastructure.

Question 100: Which type of access control list (ACL) is typically associated with network devices like routers and firewalls?

Filesystem ACLs
Database ACLs
Application ACLs
Network ACLs (Correct answer)

Correct answer: Network ACLs

Network ACLs on routers and firewalls filter traffic based on IP addresses, ports, and protocols to control network-layer access.

Question 101: An organization wants to implement a secure email system. The requirements state that only the intended recipient should be able to read the message content (confidentiality) and that the recipient must be able to verify the sender's identity (authenticity). Which combination of cryptographic technologies would BEST meet these requirements?

The sender encrypts the message with the recipient's public key and signs the message with the recipient's public key.
The sender encrypts the message with a symmetric key and sends the key to the recipient in a separate email.
The sender hashes the message and encrypts the hash with their private key, then encrypts the message with the recipient's public key. (Correct answer)
The sender encrypts the message with their own private key, and the recipient decrypts with the sender's public key.

Correct answer: The sender hashes the message and encrypts the hash with their private key, then encrypts the message with the recipient's public key.

To ensure confidentiality, the message is encrypted with the recipient's public key, so only the recipient's private key can decrypt it. [18] To provide authenticity and non-repudiation, the sender creates a hash of the message and encrypts that hash with their own private key, creating a digital signature. [22, 26] The recipient can then use the sender's public key to decrypt the hash and verify the signature. [24]

Question 102: Which type of malware disguises itself as legitimate software to trick users into installing it?

Trojan horse (Correct answer)
Rootkit
Ransomware
Worm

Correct answer: Trojan horse

A Trojan horse masquerades as a legitimate or desirable program while secretly performing malicious actions once installed.

Question 103: A database administrator can modify any record but a separate auditor must approve deletions. This enforces which principle?

Least privilege
Separation of duties (Correct answer)
Need-to-know
Non-repudiation

Correct answer: Separation of duties

Separation of duties splits sensitive tasks between multiple people so no single individual can complete a critical action alone.

Question 104: A subject at SECRET level attempting to write data to a CONFIDENTIAL object would violate which Bell-LaPadula rule?

Simple Security Property (no read up)
Tranquility Property
Star (*) Property (no write down) (Correct answer)
Discretionary Security Property

Correct answer: Star (*) Property (no write down)

The Star (*) Property prohibits writing to objects at a lower classification level, preventing information from leaking downward.

Question 105: Which backup type copies only the data that changed since the last backup of ANY type?

Mirror backup
Incremental backup (Correct answer)
Full backup
Differential backup

Correct answer: Incremental backup

An incremental backup copies only data changed since the last backup (full or incremental), making each backup small and fast but requiring multiple sets for a complete restore.

Question 106: An organization discovers that an attacker exploited a vulnerability in an unpatched web server plugin that had been public for 60 days. This BEST illustrates the risk of:

Failure to apply available patches within an acceptable remediation window (Correct answer)
Zero-day vulnerabilities with no available patch
Inadequate network segmentation between DMZ and internal systems
Weak authentication on the web server administrative console

Correct answer: Failure to apply available patches within an acceptable remediation window

A 60-day-old patch represents a known, patchable vulnerability; the risk materializes from the organization's failure to apply the available fix within its remediation SLA.

Question 107: A security administrator is configuring access to a highly sensitive database containing classified government information. The policy dictates that access is determined by the clearance level of the user and the classification level of the data. Even the data owner is not permitted to grant access to users without the appropriate clearance. Which access control model is being implemented?

Discretionary Access Control (DAC)
Attribute-Based Access Control (ABAC)
Mandatory Access Control (MAC) (Correct answer)
Role-Based Access Control (RBAC)

Correct answer: Mandatory Access Control (MAC)

Mandatory Access Control (MAC) is the correct model because access decisions are based on security labels (clearance for subjects, classification for objects) assigned by a central authority. In a MAC environment, individuals cannot alter access permissions, which is a key requirement described in the scenario.

Question 108: Which Kerberos component issues Ticket-Granting Tickets (TGTs)?

Authentication Server (AS) (Correct answer)
Ticket-Granting Server (TGS)
Service Server (SS)
Key Distribution Center client

Correct answer: Authentication Server (AS)

The Authentication Server (AS) within the Key Distribution Center verifies the user's credentials and issues the initial Ticket-Granting Ticket.

Question 109: During a risk assessment, the security team determines that the Annualized Loss Expectancy (ALE) for a specific threat is $15,000. They implement a new security control that costs $3,000 annually. After implementation, the new ALE is calculated to be $4,000. The risk that remains after implementing the control is known as:

Total risk
Residual risk (Correct answer)
Inherent risk
Risk appetite

Correct answer: Residual risk

Residual risk is the amount of risk that remains after security controls and other mitigation efforts have been implemented. In this scenario, the initial risk was reduced by the control, but a level of risk ($4,000 ALE) still exists.

Question 110: Which type of firewall can track the state of active network connections and make decisions based on connection context?

Application-layer gateway
Circuit-level gateway
Stateful inspection firewall (Correct answer)
Packet filtering firewall

Correct answer: Stateful inspection firewall

Stateful inspection firewalls maintain a state table of active connections and evaluate packets in the context of established sessions.

Question 111: What is the primary difference between an Intrusion Detection System (IDS) and an Intrusion Prevention System (IPS)?

IDS uses signatures; IPS uses anomaly detection
IDS is network-based; IPS is host-based
IDS monitors encrypted traffic; IPS cannot
IDS only detects and alerts; IPS can actively block malicious traffic (Correct answer)

Correct answer: IDS only detects and alerts; IPS can actively block malicious traffic

An IDS passively monitors and generates alerts, while an IPS sits inline in the traffic path and can actively block or drop malicious packets in real time.

Question 112: In PKI, what is the role of the Certificate Authority (CA)?

To encrypt data between endpoints
To issue and manage digital certificates that bind identities to public keys (Correct answer)
To store private keys for users
To perform intrusion detection

Correct answer: To issue and manage digital certificates that bind identities to public keys

A CA is a trusted entity that issues digital certificates binding a public key to an identity after verifying the requester.

Question 113: Which hashing algorithm produces a 256-bit digest and is commonly used in TLS and certificate signing?

RIPEMD-128
SHA-1
SHA-256 (Correct answer)
MD5

Correct answer: SHA-256

SHA-256 is part of the SHA-2 family, produces a 256-bit hash digest, and is widely used in TLS, digital certificates, and blockchain applications.

Question 114: What is the significance of Authenticated Encryption with Associated Data (AEAD) modes like AES-GCM?

They are exclusively used for key exchange protocols
They provide encryption only, leaving authentication to a separate process
They combine confidentiality and integrity/authentication in a single cryptographic operation (Correct answer)
They replace public key infrastructure entirely

Correct answer: They combine confidentiality and integrity/authentication in a single cryptographic operation

AEAD modes like AES-GCM simultaneously provide data confidentiality, integrity, and authenticity in one pass, eliminating the complexity and vulnerabilities of combining separate encryption and MAC operations.

Question 115: An attacker gains admin-level access by exploiting a vulnerability in a low-privilege process. This attack technique is called:

Privilege creep
Lateral movement
Horizontal privilege escalation
Vertical privilege escalation (Correct answer)

Correct answer: Vertical privilege escalation

Vertical privilege escalation involves gaining higher-level privileges than originally assigned, moving up the permission hierarchy.

Question 116: An attacker intercepts communications between two parties and relays altered messages without either party knowing. This is an example of:

Eavesdropping
Man-in-the-middle attack (Correct answer)
Replay attack
Session hijacking

Correct answer: Man-in-the-middle attack

A man-in-the-middle attack positions the attacker between two communicating parties to intercept, read, and potentially alter messages.

Question 117: Which concept describes organizing detected threats by tactics, techniques, and procedures to understand attacker behavior?

Kill chain mapping
Risk scoring
MITRE ATT&CK framework alignment (Correct answer)
CVE categorization

Correct answer: MITRE ATT&CK framework alignment

The MITRE ATT&CK framework organizes adversary behavior into tactics (goals) and techniques (methods), helping analysts understand and detect attacker TTPs.

Question 118: What is the primary purpose of a risk appetite statement in an organization's risk management framework?

To assign dollar values to potential losses
To document regulatory compliance requirements
To define the level of risk the organization is willing to accept in pursuit of its objectives (Correct answer)
To enumerate all identified threats and vulnerabilities

Correct answer: To define the level of risk the organization is willing to accept in pursuit of its objectives

A risk appetite statement formally defines how much risk an organization is willing to tolerate while pursuing its strategic objectives.

Question 119: A risk register entry shows a vulnerability with no known exploits and a patch available but not yet applied. Which qualitative risk rating is most appropriate?

High
Low
Critical
Medium (Correct answer)

Correct answer: Medium

No known active exploits lowers likelihood, but an unpatched vulnerability with available patch represents a moderate, manageable risk — typically rated Medium.

Question 120: What is the purpose of a 'lessons learned' meeting held after an incident is resolved?

To improve processes, update documentation, and prevent future incidents (Correct answer)
To assign blame to responsible individuals
To satisfy legal requirements for incident disclosure
To calculate the total financial cost of the incident

Correct answer: To improve processes, update documentation, and prevent future incidents

Lessons learned meetings focus on identifying what worked, what failed, and how to improve the incident response process going forward.

Question 121: A forensic investigator creates a bit-for-bit copy of a hard drive before analysis. What is this copy called?

A logical backup
A differential backup
A forensic image (Correct answer)
A shadow copy

Correct answer: A forensic image

A forensic image is a bit-for-bit copy of storage media that captures all data including deleted files, preserving the original evidence.

Question 122: An analyst is implementing patch management for a fleet of servers. Which priority order is MOST appropriate?

Oldest patches first regardless of severity
Alphabetical order by server name
Critical vulnerabilities with known exploits first, then high, medium, and low (Correct answer)
Patches that require the least downtime first

Correct answer: Critical vulnerabilities with known exploits first, then high, medium, and low

Prioritizing by exploitability and severity ensures the highest-risk vulnerabilities are addressed before attackers can leverage them.

Question 123: An analyst is configuring a Host-based Intrusion Detection System (HIDS) to identify potential malware. The system is first put into a learning mode to build a profile of normal CPU usage, file access patterns, and network traffic for a critical server. Once the profile is built, the system will alert on any significant deviations. Which detection method is being implemented?

Static code analysis
Signature-based detection
Application whitelisting
Anomaly-based detection (Correct answer)

Correct answer: Anomaly-based detection

Anomaly-based detection works by establishing a baseline of normal system or network behavior and then flagging any significant deviations from that baseline as potential threats. This method is effective for detecting novel or zero-day attacks that do not have known signatures.

Question 124: Which fire class involves energized electrical equipment, and which extinguishing agent should be used?

Class C — CO2 or dry chemical (Correct answer)
Class A — water
Class B — foam
Class D — sand

Correct answer: Class C — CO2 or dry chemical

Class C fires involve energized electrical equipment, and non-conductive agents such as CO2 or dry chemical extinguishers must be used to avoid electrocution risk from conductive agents like water.

Question 125: During the Detection and Analysis phase of an incident response, a SOC analyst notices anomalous traffic patterns from a server. What is a critical next step within this specific phase?

Restoring the server from a known-good backup.
Patching the server to remove potential vulnerabilities.
Validating the incident by correlating logs from firewalls, IDS, and server event logs. (Correct answer)
Implementing new firewall rules to block the anomalous traffic.

Correct answer: Validating the incident by correlating logs from firewalls, IDS, and server event logs.

In the Detection and Analysis phase, the goal is to confirm whether a suspected event is actually a security incident and to determine its scope and priority. Correlating data from multiple sources (like firewall logs, IDS alerts, and server logs) is a crucial analysis step to validate the alert, understand the context, and avoid acting on a false positive. Patching, blocking traffic (containment), and restoring (recovery) are actions taken in later phases.

Question 126: An organization wants to prevent employees from accessing social media sites. Which control is BEST suited at the network layer?

URL filtering proxy (Correct answer)
DNS TTL reduction
IDS signature update
Host-based firewall

Correct answer: URL filtering proxy

A URL filtering proxy inspects and blocks requests to specific website categories before they leave the network.

SSCP Systems Security Certified Practitioner

The SSCP (Systems Security Certified Practitioner) is an ISC2 certification validating technical IT security skills across 7 domains including access controls, cryptography, network security, and incident response. It is designed for IT administrators, security analysts, and network engineers responsible for implementing and maintaining secure infrastructures.

125

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds