SSCP Certification SSCP Network Communications Security 4 — Questions and Answers
Question 1: Which protocol provides cryptographic authentication of BGP route announcements to prevent route hijacking?
- OSPF MD5 authentication
- BGPsec
- RPKI with ROA (Correct answer)
- IS-IS authentication
Correct answer: RPKI with ROA
RPKI (Resource Public Key Infrastructure) with Route Origin Authorizations cryptographically validates that an AS is authorized to announce specific prefixes.
Question 2: What is the security risk introduced by using HTTP TRACE method on a web server?
- SQL injection
- Cross-site tracing (XST) enabling cookie theft (Correct answer)
- Buffer overflow
- XML external entity injection
Correct answer: Cross-site tracing (XST) enabling cookie theft
HTTP TRACE echoes the request back to the client and can be exploited in cross-site tracing attacks to steal HttpOnly cookies via XSS.
Question 3: In a PKI environment, which component is responsible for checking whether a certificate has been revoked before its expiration date?
- Certificate Authority
- Registration Authority
- OCSP Responder (Correct answer)
- Key Escrow
Correct answer: OCSP Responder
An OCSP (Online Certificate Status Protocol) responder provides real-time certificate revocation status without requiring a full CRL download.
Question 4: Which network scanning technique sends a SYN packet and completes the handshake only if the port is open, making it easier to detect in logs?
- SYN stealth scan
- Connect scan (full TCP) (Correct answer)
- FIN scan
- NULL scan
Correct answer: Connect scan (full TCP)
A full TCP connect scan completes the three-way handshake, which is logged by the target OS and therefore more detectable than a SYN scan.
Question 5: A network defender wants to detect lateral movement by attackers who have already breached the perimeter. Which approach is MOST effective?
- Perimeter firewall rules
- East-west traffic monitoring with micro-segmentation (Correct answer)
- Increasing antivirus signature updates
- Disabling guest wireless access
Correct answer: East-west traffic monitoring with micro-segmentation
Monitoring east-west (internal) traffic and enforcing micro-segmentation detects and limits lateral movement within the network.
Question 6: What does DANE (DNS-Based Authentication of Named Entities) use to bind TLS certificates to DNS names?
- RADIUS
- TLSA DNS records secured by DNSSEC (Correct answer)
- OCSP stapling
- Certificate Transparency logs
Correct answer: TLSA DNS records secured by DNSSEC
DANE uses TLSA resource records published in DNSSEC-signed zones to authenticate TLS server certificates without relying solely on commercial CAs.
Question 7: Which wireless security control prevents clients from discovering an access point by suppressing SSID broadcasts?
- WPA3 encryption
- SSID hiding (Correct answer)
- MAC address filtering
- WPS disablement
Correct answer: SSID hiding
SSID hiding suppresses beacon frames that advertise the network name, but it provides only obscurity since SSIDs are still visible in probe requests.
SSCP Certification SSCP Network Communications Security 4
Which protocol provides cryptographic authentication of BGP route announcements to prevent route hijacking?