SSCP Certification SSCP Security Operations 5 — Questions and Answers
Question 1: A security engineer implements time-based one-time passwords (TOTP) for VPN access. Which attack does this MOST effectively mitigate?
- Brute-force attacks against VPN certificates
- Credential replay attacks using stolen static passwords (Correct answer)
- Man-in-the-browser attacks on web applications
- ARP poisoning on the internal network
Correct answer: Credential replay attacks using stolen static passwords
TOTP generates codes valid for a short window, rendering stolen static credentials useless because the code changes with each login.
Question 2: What distinguishes a vulnerability scan from a penetration test?
- Vulnerability scans require physical access while penetration tests are remote
- Vulnerability scans identify weaknesses passively; penetration tests actively exploit them (Correct answer)
- Penetration tests are automated while vulnerability scans are manual
- Vulnerability scans require prior written authorization while penetration tests do not
Correct answer: Vulnerability scans identify weaknesses passively; penetration tests actively exploit them
Vulnerability scans enumerate and report potential weaknesses, whereas penetration tests actively exploit vulnerabilities to demonstrate real-world impact.
Question 3: During incident containment, an analyst isolates a compromised workstation from the network. What is the MOST important action to take BEFORE isolation?
- Reimage the workstation to remove malware
- Capture volatile memory and document the current state for forensic purposes (Correct answer)
- Notify all users on the same subnet of the compromise
- Uninstall all third-party software from the workstation
Correct answer: Capture volatile memory and document the current state for forensic purposes
Preserving volatile evidence before disconnecting ensures forensic data is not lost when the machine loses power or network state.
Question 4: An organization wants to ensure that no single employee can both initiate and approve a financial transaction. Which control achieves this?
- Least privilege
- Separation of duties (Correct answer)
- Mandatory access control
- Two-person integrity
Correct answer: Separation of duties
Separation of duties requires different individuals to handle distinct phases of a sensitive process, preventing fraud or errors by a single actor.
Question 5: Which SIEM function normalizes log data from disparate sources into a consistent format?
- Correlation engine
- Log aggregation and normalization (Correct answer)
- Threat intelligence enrichment
- Retention policy enforcement
Correct answer: Log aggregation and normalization
Log normalization translates fields from different source formats into a common schema, enabling consistent querying and correlation across all sources.
Question 6: A company's disaster recovery plan specifies an RTO of 4 hours for its e-commerce platform. What does this mean?
- The maximum amount of data loss measured in time that is acceptable after a failure
- The maximum time allowed to restore the platform to full operation after a disruption (Correct answer)
- The minimum time between full backup cycles for the platform
- The average response time for customer support during an outage
Correct answer: The maximum time allowed to restore the platform to full operation after a disruption
Recovery Time Objective (RTO) defines the maximum acceptable downtime before restoration must be complete to avoid unacceptable business impact.
Question 7: When reviewing logs, an analyst finds that a service account normally used for database queries suddenly made 500 directory lookups in 10 seconds. This BEST represents which threat indicator?
- An indicator of a denial-of-service attack on the directory service
- An anomalous behavioral indicator suggesting account compromise or privilege abuse (Correct answer)
- Normal behavior for scheduled directory synchronization jobs
- An indicator of a misconfigured DNS resolver
Correct answer: An anomalous behavioral indicator suggesting account compromise or privilege abuse
A sudden burst of directory lookups by a service account significantly deviates from its baseline, which is a classic sign of credential misuse or automated reconnaissance.
SSCP Certification SSCP Security Operations 5
A security engineer implements time-based one-time passwords (TOTP) for VPN access.
Which attack does this MOST effectively mitigate?