SSCP

One question per exam domain, 7 in all, each with the answer, the reasoning behind it, and the public source it was written from. Read them here with no account. These are original questions written against the published exam outline, not real exam items.

1. Question 1 · Security Concepts and Practices

   An injection-molding plant's programmable logic controller gets no firmware updates and can run neither the antimalware nor monthly patching the company standard requires. It will not be replaced for eighteen months. What should be done?

   1. AApply compensating controls such as network segmentation and monitoring, and record the approved deviation
   2. BMark the controller as out of scope for the standard because the vendor no longer supports or updates it
   3. CInstall the antimalware agent on the controller anyway and accept whatever instability results on the line
   4. DAir-gap the controller by disconnecting it from the network entirely so no remote access is possible
   Show answer and explanation

   Correct answer

   Apply compensating controls such as network segmentation and monitoring, and record the approved deviation

   Where a required control is genuinely not feasible, the accepted path is a documented and approved compensating control that meets the same objective by other means, which segmentation plus monitoring can do for an unpatchable device. Forcing an unsupported agent onto the controller risks the production availability the plant is trying to protect. Declaring the device out of scope removes it from oversight without reducing any risk. Full air-gapping is attractive in theory but the controller feeds the line and severing it is usually infeasible, so proposing it without confirming that is not a workable answer.

   Source: FIPS 200, Minimum Security Requirements for Federal Information and Information Systems

2. Question 2 · Access Controls

   Six months after moving into a finance role, an employee still holds her old edit rights to every project media library alongside her new entitlements; eleven other movers match the pattern. Which practice should the team adopt?

   1. ARun a quarterly separation of duties report across all movers and remediate whatever conflicts it flags
   2. BRequire the receiving manager to approve the new role before it is assigned to the transferring employee
   3. CTreat a transfer as a deprovision and reprovision event, removing the prior role assignments as the new ones are granted
   4. DGrant the new role and keep the old one for thirty days so the employee can finish handover work for her old team
   Show answer and explanation

   Correct answer

   Treat a transfer as a deprovision and reprovision event, removing the prior role assignments as the new ones are granted

   Privilege accumulation happens because a transfer is processed as an addition rather than as a move, so the correction is to make removal of the old assignments part of the same transaction that grants the new ones. A thirty-day overlap is a pragmatic-sounding compromise that in practice becomes permanent, since nothing forces the cleanup once the handover ends. A quarterly conflict report only catches combinations that violate a defined rule, so an editor who is now an analyst but has no rule against that pairing stays invisible while still holding excessive access. Manager approval controls whether the new role is appropriate and says nothing about the old one.

   Source: NIST CSRC Glossary: Least Privilege

3. Question 3 · Risk Identification, Monitoring, and Analysis

   An analyst confirms a bottling line control server's management interface is reachable from the office network with a default account enabled. The production engineering team owns it. What is the BEST way to communicate this?

   1. ARaise the issue verbally at the next monthly operations meeting with the production engineering team
   2. BPost the details in the company-wide chat channel so the issue receives immediate attention from everyone
   3. COpen a ticket in the engineering queue with the severity set to critical and no further detail attached
   4. DSend the system owner a written finding with the asset, evidence, operational risk, action and due date
   Show answer and explanation

   Correct answer

   Send the system owner a written finding with the asset, evidence, operational risk, action and due date

   A finding moves when the owner receives evidence, understands the consequence in terms that matter to their operation, is given a specific action and date, and the whole thing is tracked so it can be followed up. Broadcasting the detail publicly advertises an exploitable weakness to everyone including anyone already inside. A bare critical ticket with no evidence invites a dispute about whether the rating is justified. Waiting for a monthly meeting leaves a default credential exposed for weeks and creates no record.

   Source: NIST SP 800-115: Technical Guide to Information Security Testing and Assessment

4. Question 4 · Incident Response and Recovery

   A county is writing its first contingency plan. The IT director wants recovery sequenced by technical complexity, hardest first. The practitioner is asked to justify a different basis. What should determine the recovery sequence?

   1. AThe technical dependency map, so that supporting infrastructure is always recovered ahead of applications.
   2. BThe business impact analysis, which establishes what each system supports and how long it can be down.
   3. CThe asset inventory's criticality ratings, as assigned by each individual system owner in turn.
   4. DThe order that minimizes the total recovery time for the estate when taken as a whole.
   Show answer and explanation

   Correct answer

   The business impact analysis, which establishes what each system supports and how long it can be down.

   Contingency planning derives recovery priorities from the business impact analysis, which ties each system to the processes it supports and to the outage those processes can absorb. Everything else is an input applied within those priorities. The dependency map is genuinely necessary and determines ordering constraints inside a priority tier, but it describes what must precede what technically, not what matters most to the county. Owner-assigned criticality ratings are useful raw material and are usually inflated, since every owner rates their own system highly, which is exactly why the analysis normalizes them against actual process impact. Minimizing total estate recovery time optimizes an aggregate that nobody depends on, and it can leave the highest impact service last because it happens to be slow.

   Source: NIST SP 800-34 Rev. 1: Contingency Planning Guide for Federal Information Systems

5. Question 5 · Cryptography

   After a marketing appliance was inserted in the outbound mail path to append a promotional footer, receipts began landing in spam and receiving domains report that the body hash did not verify. DNS was untouched. What is the cause and fix?

   1. AThe public key record for the signing selector was removed from DNS and must be republished for verification
   2. BThe signing key is only 1024 bits, and receiving domains are now rejecting that signature as too weak to trust
   3. CThe appliance's sending address is not listed in the domain's sender policy record, so the mail is treated as unauthorized
   4. DThe appliance modifies the message body after the signature is applied, so signing should move to the final egress hop
   Show answer and explanation

   Correct answer

   The appliance modifies the message body after the signature is applied, so signing should move to the final egress hop

   The reported result is specific: a body hash mismatch means the body that arrived is not the body that was signed, and the only new variable is an appliance that rewrites bodies in flight. Signing must therefore happen after the last component that modifies the message, which normally means the final egress hop. A missing public key record would produce a permanent error about key retrieval rather than a body hash failure, and the scenario states DNS was untouched. A short signing key would be reported as a weak key or policy failure and would fail consistently rather than starting the day a body rewriter was introduced. Sender policy records concern which hosts may send for the domain and produce their own separate result, not a body hash outcome.

   Source: RFC 6376: DomainKeys Identified Mail (DKIM) Signatures

6. Question 6 · Network and Communications Security

   Captures on a technical college lab VLAN show unsolicited ARP replies claiming the default gateway address, and the switch table shows that address moving between access ports. Which switch-level control stops this at the source?

   1. AInstall static ARP entries for the default gateway on each of the lab servers and workstations there
   2. BConfigure port security so that each lab access port will accept only a single learned MAC address
   3. CDeploy port-based network access control on every lab access port so only authenticated devices connect
   4. DEnable DHCP snooping on the lab VLAN plus dynamic ARP inspection to validate each of the ARP replies
   Show answer and explanation

   Correct answer

   Enable DHCP snooping on the lab VLAN plus dynamic ARP inspection to validate each of the ARP replies

   ARP has no authentication, so the switch has to be given an independent source of truth about which address belongs on which port. DHCP snooping builds that binding table, and dynamic ARP inspection then discards ARP messages that contradict it, which stops the forged gateway replies at the ingress port. Port security limits how many addresses a port may learn but does not evaluate the contents of an ARP reply, so a single attacking host stays within its limit while poisoning the whole VLAN. Port-based authentication proves a student is authorized to be on the network and says nothing about what that authorized host then advertises. Static entries on the servers protect only the servers and leave every client and the gateway path unprotected.

   Source: MITRE ATT&CK T1557.002, Adversary-in-the-Middle: ARP Cache Poisoning

7. Question 7 · Systems and Application Security

   A defense integrator wants assurance that a laptop's firmware and early boot components were not tampered with before that laptop is permitted to reach internal systems. Which capability provides that specific assurance?

   1. ACertificate based network authentication using a certificate stored in the user's own Windows profile
   2. BHealth attestation in which boot measurements from the trusted platform module are evaluated by a remote verifier
   3. CA scheduled full antimalware scan configured to run at each boot before the sign-in prompt appears
   4. DA host-based firewall rule that permits internal access only from the corporate virtual private network address range
   Show answer and explanation

   Correct answer

   Health attestation in which boot measurements from the trusted platform module are evaluated by a remote verifier

   Only measured boot with remote attestation produces hardware-rooted evidence about what firmware and boot code actually executed, and having a separate verifier evaluate those measurements is what converts the evidence into an access decision. A firewall rule constrains where a connection originates, not whether the device booted trustworthy code. An antimalware scan runs on top of the very software stack that firmware level tampering would have subverted, so it inherits the compromise it is meant to detect. A user profile certificate attests to an identity and can be exported or used from a compromised machine, so it says nothing about boot integrity.

   Source: Microsoft, Trusted Platform Module Technology Overview