SSCP Certification SSCP Certification II 3 — Questions and Answers
Question 1: Which incident response phase involves identifying the scope and impact of a security event after it has been detected?
- Preparation
- Containment
- Analysis / Identification (Correct answer)
- Eradication
Correct answer: Analysis / Identification
The Analysis (or Identification) phase determines what happened, what systems are affected, and the severity of the incident.
Question 2: A firewall rule permits all outbound traffic on port 443 but blocks unsolicited inbound traffic. What type of firewall behavior does this describe?
- Packet filtering only
- Stateful inspection (Correct answer)
- Application-layer proxy
- Circuit-level gateway
Correct answer: Stateful inspection
Stateful inspection tracks the state of TCP connections, allowing return traffic for established outbound sessions while blocking unsolicited inbound packets.
Question 3: Which key exchange protocol allows two parties to establish a shared secret over an insecure channel without transmitting the secret itself?
- RSA key transport
- Diffie-Hellman key exchange (Correct answer)
- AES key wrapping
- HMAC key derivation
Correct answer: Diffie-Hellman key exchange
Diffie-Hellman enables two parties to independently compute the same shared secret using public values without ever sending the secret across the network.
Question 4: An attacker sends thousands of SYN packets to a server but never completes the TCP handshake, exhausting the server's connection table. This is an example of what attack?
- Ping of Death
- SYN flood (DoS) (Correct answer)
- Teardrop attack
- Smurf attack
Correct answer: SYN flood (DoS)
A SYN flood exploits the TCP three-way handshake by sending many half-open connections, consuming server resources until legitimate connections are denied.
Question 5: What does the concept of 'data at rest' encryption primarily protect against?
- Eavesdropping on network traffic
- Unauthorized access to stored data if physical media is stolen or improperly decommissioned (Correct answer)
- Session hijacking attacks
- Man-in-the-middle attacks
Correct answer: Unauthorized access to stored data if physical media is stolen or improperly decommissioned
Encrypting data at rest protects stored information so that physical theft or unauthorized access to storage media does not expose readable data.
Question 6: Which SSCP domain focuses on ensuring systems and services remain available and operational, including backup and recovery strategies?
- Cryptography
- Incident Response and Recovery (Correct answer)
- Network and Communications Security
- Risk Identification, Monitoring, and Analysis
Correct answer: Incident Response and Recovery
The Incident Response and Recovery domain covers business continuity planning, disaster recovery, and backup strategies to restore operations after disruptions.
Question 7: A security team implements honeypots on their network. What is the PRIMARY security goal of this deployment?
- To speed up legitimate user authentication
- To detect and study attacker techniques by luring them to decoy systems (Correct answer)
- To encrypt sensitive data before it leaves the network
- To filter malicious traffic at the perimeter
Correct answer: To detect and study attacker techniques by luring them to decoy systems
Honeypots are deliberately vulnerable decoy systems designed to attract attackers, allowing defenders to detect intrusions and analyze adversary tactics.
SSCP Certification SSCP Certification II 3
Which incident response phase involves identifying the scope and impact of a security event after it has been detected?