SSCP Certification SSCP Certification II 2 — Questions and Answers
Question 1: Which cryptographic mode of operation turns a block cipher into a stream cipher by XORing plaintext with an encrypted counter value?
- CBC
- ECB
- CTR (Correct answer)
- OFB
Correct answer: CTR
Counter (CTR) mode encrypts successive counter values and XORs the output with plaintext, effectively creating a keystream like a stream cipher.
Question 2: An organization wants to ensure that no single employee can both approve a purchase order and issue the payment. Which security principle does this enforce?
- Least privilege
- Separation of duties (Correct answer)
- Need to know
- Defense in depth
Correct answer: Separation of duties
Separation of duties requires that critical tasks be split among multiple individuals to prevent fraud and error.
Question 3: Which type of malware hides its presence by modifying the operating system kernel to intercept and falsify system calls?
- Ransomware
- Adware
- Rootkit (Correct answer)
- Worm
Correct answer: Rootkit
A rootkit subverts OS-level functions to conceal its own processes, files, and network connections from security tools.
Question 4: A security analyst uses a tool that intercepts and displays all traffic between a client and a server on the same subnet. What type of attack does this technique represent?
- Replay attack
- Smurf attack
- ARP poisoning / MitM (Correct answer)
- DNS hijacking
Correct answer: ARP poisoning / MitM
ARP poisoning allows an attacker to associate their MAC address with a legitimate IP, redirecting traffic through their machine in a Man-in-the-Middle attack.
Question 5: Which access control model assigns permissions based on job functions defined by the organization rather than individual user identities?
- DAC
- MAC
- RBAC (Correct answer)
- ABAC
Correct answer: RBAC
Role-Based Access Control (RBAC) grants permissions to roles (e.g., nurse, manager) and users inherit access by being assigned to a role.
Question 6: What is the PRIMARY purpose of a certificate revocation list (CRL) in a PKI environment?
- To list all trusted root certificates
- To publish certificates that are no longer valid before their expiry date (Correct answer)
- To distribute new certificates to endpoints
- To store encrypted private keys
Correct answer: To publish certificates that are no longer valid before their expiry date
A CRL is a signed list published by a CA containing serial numbers of certificates that have been revoked prior to their natural expiration.
Question 7: During a penetration test, the tester has no prior knowledge of the target environment. Which testing approach best describes this scenario?
- White-box testing
- Gray-box testing
- Black-box testing (Correct answer)
- Crystal-box testing
Correct answer: Black-box testing
Black-box testing simulates an external attacker who has no insider knowledge of the system's architecture or credentials.
SSCP Certification SSCP Certification II 2
Which cryptographic mode of operation turns a block cipher into a stream cipher by XORing plaintext with an encrypted counter value?