SSCP Certification SSCP Security Operations 3 — Questions and Answers
Question 1: Which type of backup captures only the data that has changed since the LAST FULL backup, regardless of subsequent backups?
- Incremental backup
- Differential backup (Correct answer)
- Snapshot backup
- Mirror backup
Correct answer: Differential backup
A differential backup always references the last full backup, growing larger over time but requiring only two sets for restore.
Question 2: A company's IDS generates a high number of alerts for normal business traffic. This is an example of which problem?
- False negatives
- True positives
- False positives (Correct answer)
- True negatives
Correct answer: False positives
False positives occur when the IDS incorrectly flags legitimate traffic as malicious, increasing analyst workload and causing alert fatigue.
Question 3: In a SCADA environment, which security concern is MOST unique compared to traditional IT environments?
- Lack of encryption support
- Inability to patch systems without impacting operational availability (Correct answer)
- Absence of user authentication mechanisms
- No network connectivity requirements
Correct answer: Inability to patch systems without impacting operational availability
SCADA systems often cannot tolerate downtime for patching because they control physical processes that must run continuously.
Question 4: What does the concept of 'defense in depth' require in security operations?
- Relying on a single strong perimeter control to protect all assets
- Implementing multiple overlapping layers of security controls (Correct answer)
- Focusing all resources on endpoint protection
- Using only hardware-based security solutions
Correct answer: Implementing multiple overlapping layers of security controls
Defense in depth ensures that if one control fails, additional layers continue to protect assets, reducing the risk of total compromise.
Question 5: An administrator is reviewing firewall rules and finds a rule that permits all outbound traffic. What risk does this rule pose?
- It allows attackers to bypass physical security controls
- It can enable data exfiltration and command-and-control communications from malware (Correct answer)
- It exposes internal systems to inbound scanning
- It prevents VPN tunnels from functioning correctly
Correct answer: It can enable data exfiltration and command-and-control communications from malware
Unrestricted outbound traffic allows malware to communicate with C2 servers and exfiltrate data without triggering egress filtering.
Question 6: Which security operations practice involves reviewing user access rights on a scheduled basis to ensure they remain appropriate?
- Privileged access management
- Access recertification (user access review) (Correct answer)
- Identity federation
- Single sign-on auditing
Correct answer: Access recertification (user access review)
Access recertification requires managers or system owners to periodically confirm that each user's access rights are still needed and appropriate.
Question 7: What is the MAIN purpose of a honeypot in a security operations environment?
- To absorb DDoS attack traffic and protect production systems
- To detect, deflect, and study attacker techniques using a decoy system (Correct answer)
- To cache frequently accessed web content for performance
- To store encrypted backups in an isolated network segment
Correct answer: To detect, deflect, and study attacker techniques using a decoy system
Honeypots simulate vulnerable systems to attract attackers, allowing defenders to observe tactics and gather threat intelligence.
SSCP Certification SSCP Security Operations 3
Which type of backup captures only the data that has changed since the LAST FULL backup, regardless of subsequent backups?