SSCP Certification SSCP Certification II 3

Question 1

Which incident response phase involves identifying the scope and impact of a security event after it has been detected?

Accepted Answer

Analysis / Identification

Answer

The Analysis (or Identification) phase determines what happened, what systems are affected, and the severity of the incident.

Question 2

A firewall rule permits all outbound traffic on port 443 but blocks unsolicited inbound traffic. What type of firewall behavior does this describe?

Accepted Answer

Stateful inspection

Answer

Stateful inspection tracks the state of TCP connections, allowing return traffic for established outbound sessions while blocking unsolicited inbound packets.

Question 3

Which key exchange protocol allows two parties to establish a shared secret over an insecure channel without transmitting the secret itself?

Accepted Answer

Diffie-Hellman key exchange

Answer

Diffie-Hellman enables two parties to independently compute the same shared secret using public values without ever sending the secret across the network.

Question 4

An attacker sends thousands of SYN packets to a server but never completes the TCP handshake, exhausting the server's connection table. This is an example of what attack?

Accepted Answer

SYN flood (DoS)

Answer

A SYN flood exploits the TCP three-way handshake by sending many half-open connections, consuming server resources until legitimate connections are denied.

Question 5

What does the concept of 'data at rest' encryption primarily protect against?

Accepted Answer

Unauthorized access to stored data if physical media is stolen or improperly decommissioned

Answer

Encrypting data at rest protects stored information so that physical theft or unauthorized access to storage media does not expose readable data.

SSCP Certification Practice Test

SSCP Certification Practice Test

SSCP Certification SSCP Certification II 3