SSCP Certification SSCP Certification II 5 — Questions and Answers
Question 1: Which type of IDS analyzes network traffic and compares it against known attack signatures to detect threats?
- Anomaly-based IDS
- Heuristic-based IDS
- Signature-based IDS (Correct answer)
- Behavioral IDS
Correct answer: Signature-based IDS
Signature-based IDS matches network traffic or system events against a database of known attack patterns, making it effective against known threats but blind to zero-days.
Question 2: Which risk treatment option involves purchasing cyber liability insurance to offset potential financial losses from a security incident?
- Risk avoidance
- Risk mitigation
- Risk acceptance
- Risk transference (Correct answer)
Correct answer: Risk transference
Risk transference shifts the financial burden of a risk to a third party, such as an insurance provider, without eliminating the underlying vulnerability.
Question 3: A user authenticates using a smart card combined with a PIN. What type of authentication factor combination does this represent?
- Something you know + something you know
- Something you have + something you know (Correct answer)
- Something you are + something you have
- Something you know + something you are
Correct answer: Something you have + something you know
A smart card is 'something you have' and a PIN is 'something you know,' making this a two-factor authentication combination across different factor categories.
Question 4: In the context of secure network design, what is the purpose of a demilitarized zone (DMZ)?
- To provide a fully private internal network segment for sensitive data
- To segment publicly accessible servers (e.g., web, email) away from the internal trusted network (Correct answer)
- To create an encrypted tunnel between branch offices
- To isolate infected workstations during incident response
Correct answer: To segment publicly accessible servers (e.g., web, email) away from the internal trusted network
A DMZ places externally accessible services in an isolated network segment so that a compromise of those servers does not directly expose the internal network.
Question 5: Which log source would MOST likely contain evidence of a successful brute-force login attack against a Windows server?
- Application event log
- System event log
- Security event log (audit log) (Correct answer)
- DNS debug log
Correct answer: Security event log (audit log)
Windows Security event logs record authentication events, including failed and successful logon attempts, making them the primary source for detecting brute-force attacks.
Question 6: What is the main security concern with using default credentials on network devices such as routers and switches?
- Default credentials cause performance degradation on the device
- Attackers can easily find default credentials online and gain administrative access (Correct answer)
- Default credentials prevent firmware updates
- Default credentials disable encryption on the device
Correct answer: Attackers can easily find default credentials online and gain administrative access
Default credentials are publicly documented by manufacturers, so any attacker can use them to gain full administrative control of unmodified devices.
Question 7: Which backup strategy copies only the data that has changed since the LAST FULL backup, requiring only two sets of media (full + incremental) for a complete restore?
- Incremental backup
- Differential backup (Correct answer)
- Mirror backup
- Snapshot backup
Correct answer: Differential backup
A differential backup captures all changes since the last full backup; restoring requires only the most recent full backup plus the latest differential set.
SSCP Certification SSCP Certification II 5
Which type of IDS analyzes network traffic and compares it against known attack signatures to detect threats?