SSCP Certification SSCP Security Operations 5

Question 1

A security engineer implements time-based one-time passwords (TOTP) for VPN access. Which attack does this MOST effectively mitigate?

Accepted Answer

Credential replay attacks using stolen static passwords

Answer

TOTP generates codes valid for a short window, rendering stolen static credentials useless because the code changes with each login.

Question 2

What distinguishes a vulnerability scan from a penetration test?

Accepted Answer

Vulnerability scans identify weaknesses passively; penetration tests actively exploit them

Answer

Vulnerability scans enumerate and report potential weaknesses, whereas penetration tests actively exploit vulnerabilities to demonstrate real-world impact.

Question 3

During incident containment, an analyst isolates a compromised workstation from the network. What is the MOST important action to take BEFORE isolation?

Accepted Answer

Capture volatile memory and document the current state for forensic purposes

Answer

Preserving volatile evidence before disconnecting ensures forensic data is not lost when the machine loses power or network state.

Question 4

An organization wants to ensure that no single employee can both initiate and approve a financial transaction. Which control achieves this?

Accepted Answer

Separation of duties

Answer

Separation of duties requires different individuals to handle distinct phases of a sensitive process, preventing fraud or errors by a single actor.

Question 5

Which SIEM function normalizes log data from disparate sources into a consistent format?

Accepted Answer

Log aggregation and normalization

Answer

Log normalization translates fields from different source formats into a common schema, enabling consistent querying and correlation across all sources.

SSCP Certification Practice Test

SSCP Certification Practice Test

SSCP Certification SSCP Security Operations 5