ISC2 Systems Security Certified Practitioner (SSCP) — Questions and Answers

Question 1: Which of the following is a Security Information and Event Management (SIEM) tool?

Splunk (Correct answer)
Snort
OpenVAS
Nmap

Correct answer: Splunk

Splunk is a leading Security Information and Event Management (SIEM) tool. It is designed to collect, index, and analyze machine-generated data, including security logs and events, from various sources across an IT infrastructure. This capability provides real-time visibility into security posture, facilitates threat detection, and aids in incident response.

Question 2: What does a network-based IDS (NIDS) primarily analyze to detect threats?

Memory dumps
User authentication events
Network packet traffic (Correct answer)
Host log files

Correct answer: Network packet traffic

A NIDS passively monitors and analyzes network traffic flows to detect suspicious patterns or signatures.

Question 3: What is the purpose of continuous security monitoring?

To regularly update all software and applications
To detect, investigate, and respond to security threats in real-time (Correct answer)
To ensure compliance with data privacy regulations
To automate the backup of critical data

Correct answer: To detect, investigate, and respond to security threats in real-time

Continuous security monitoring involves constantly observing an organization's systems and networks for suspicious activities and vulnerabilities. Its primary purpose is to provide real-time visibility into the security landscape, allowing for immediate detection, thorough investigation, and rapid response to emerging or ongoing security threats. This proactive approach minimizes potential damage and downtime.

Question 4: What is the first step in a typical risk management process?

Risk Identification (Correct answer)
Risk Treatment
Risk Monitoring
Risk Assessment

Correct answer: Risk Identification

The first step in a typical risk management process is Risk Identification. Before any risks can be assessed, treated, or monitored, they must first be recognized and documented. This involves understanding an organization's assets, potential threats, and existing vulnerabilities to pinpoint where risks might arise.

Question 5: Which federation protocol is most commonly used for SSO between web applications using XML-based assertions?

OAuth 2.0
OpenID Connect
SAML 2.0 (Correct answer)
Kerberos

Correct answer: SAML 2.0

SAML 2.0 uses XML-based security assertions to pass authentication and authorization data between identity providers and service providers.

Question 6: Which of the following is a qualitative method used in risk assessment?

Cost-Benefit Analysis
Risk Scoring Matrix (Correct answer)
Asset Valuation
Annualized Loss Expectancy (ALE)

Correct answer: Risk Scoring Matrix

A Risk Scoring Matrix is a qualitative method used in risk assessment. It involves assigning subjective ratings (e.g., high, medium, low) to the likelihood and impact of identified risks, often using a grid or table. This approach helps prioritize risks based on their relative severity without requiring precise numerical calculations, making it useful for initial assessments.

Question 7: Which of the following describes the primary use of Snort in cybersecurity?

Password cracking
Network vulnerability scanning
Web application scanning
Intrusion Detection System (IDS) (Correct answer)

Correct answer: Intrusion Detection System (IDS)

Snort's primary use in cybersecurity is as an Intrusion Detection System (IDS). It performs real-time traffic analysis and packet logging on networks, using a rule-based engine to detect malicious activities, policy violations, and other suspicious network behavior. While it can also function as an Intrusion Prevention System (IPS), its core capability is detection.

Question 8: Which tool is commonly used to perform port scanning and OS fingerprinting during the reconnaissance phase of a penetration test?

Metasploit
Burp Suite
Wireshark
Nmap (Correct answer)

Correct answer: Nmap

Nmap is the de facto standard for network discovery, port scanning, service detection, and OS fingerprinting.

Question 9: In a penetration test scope definition, what does 'rules of engagement' specify?

The boundaries, permitted actions, timing, and escalation procedures for the test (Correct answer)
The client's security budget
The list of CVEs to test
The attacker's tools

Correct answer: The boundaries, permitted actions, timing, and escalation procedures for the test

Rules of engagement define the scope, prohibited actions, notification requirements, and emergency contacts to ensure a controlled and legal test.

Question 10: What does Perfect Forward Secrecy (PFS) ensure in a TLS session?

Past session keys cannot be compromised even if the server's long-term private key is later exposed (Correct answer)
All traffic is encrypted end-to-end
Session tokens never expire
The server certificate is always valid

Correct answer: Past session keys cannot be compromised even if the server's long-term private key is later exposed

PFS uses ephemeral key exchange (e.g., ECDHE) so each session uses a unique key, protecting past sessions if the private key is compromised.

Question 11: Which STRIDE category describes an attacker gaining capabilities or permissions beyond what was intended?

Repudiation
Elevation of privilege (Correct answer)
Spoofing
Tampering

Correct answer: Elevation of privilege

The 'E' in STRIDE — Elevation of Privilege — covers scenarios where an attacker gains unauthorized access rights beyond their intended permission level.

Question 12: A security engineer reviews access logs and finds a service account with domain admin rights that hasn't logged in for 180 days. What is the recommended action?

Leave it; service accounts need broad rights
Reset the password only
Immediately disable and review the account's necessity and permissions (Correct answer)
Move it to a different OU

Correct answer: Immediately disable and review the account's necessity and permissions

Dormant privileged accounts are a major attack surface; they should be disabled and reviewed for least-privilege compliance.

Question 13: What is data classification and how does it support security architecture decisions?

Tagging data by file type; it determines storage costs
Categorizing data by sensitivity level; it drives access controls, encryption, and handling requirements (Correct answer)
Indexing data for search; it improves query performance
Sorting files by date; it determines backup schedules

Correct answer: Categorizing data by sensitivity level; it drives access controls, encryption, and handling requirements

Data classification assigns sensitivity tiers (e.g., Public, Internal, Confidential, Restricted) that inform which controls, encryption standards, and access policies apply.

Question 14: What is the purpose of a Privileged Access Workstation (PAW)?

Provide a hardened, dedicated workstation for performing privileged administrative tasks (Correct answer)
Enable remote desktop for all users
Replace VPN for remote access
Automate patch management

Correct answer: Provide a hardened, dedicated workstation for performing privileged administrative tasks

A PAW is a dedicated, isolated workstation used exclusively for administrative tasks to reduce the risk of credential theft from malware on regular workstations.

Question 15: Which of the following actions helps a Security Engineer identify potential threats proactively?

Post-incident Forensics
Security Information and Event Management (SIEM) (Correct answer)
Network Monitoring (Correct answer)
Data Backup

Correct answer: Security Information and Event Management (SIEM)

Network monitoring and Security Information and Event Management (SIEM) are crucial actions that help a Security Engineer proactively identify potential threats. Network monitoring continuously observes network traffic and behavior for anomalies or suspicious patterns that could indicate an attack. SIEM systems aggregate and analyze security logs and events from various sources, providing real-time insights and alerts on potential security incidents as they emerge.

Question 16: Which of the following steps is typically the first in an incident response process?

Containment
Eradication
Recovery
Identification (Correct answer)

Correct answer: Identification

The incident response process typically begins with the "Identification" phase, where an organization detects and confirms a security incident. This involves monitoring systems, analyzing alerts, and determining if an actual security breach or event has occurred. Without proper identification, subsequent steps like containment or eradication cannot be initiated effectively.

Question 17: Which of the following is the primary function of a Security Information and Event Management (SIEM) system?

Encrypting sensitive data
Managing network traffic
Collecting and correlating log data from various sources to detect security threats (Correct answer)
Running vulnerability scans on systems

Correct answer: Collecting and correlating log data from various sources to detect security threats

A Security Information and Event Management (SIEM) system is designed to provide a centralized view of an organization's security posture. It achieves this by aggregating log data from diverse network devices, servers, and applications. By correlating these events, SIEMs can identify patterns and anomalies indicative of potential security threats, enabling proactive detection and response.

Question 18: Which access control model grants permissions based on a user's role within an organization?

Discretionary Access Control (DAC)
Role-Based Access Control (RBAC) (Correct answer)
Mandatory Access Control (MAC)
Attribute-Based Access Control (ABAC)

Correct answer: Role-Based Access Control (RBAC)

RBAC assigns permissions to roles rather than individuals, simplifying access management based on job function.

Question 19: A security engineer needs to detect unauthorized devices connecting to a wired network. Which technology provides the best control?

VLAN tagging
Port mirroring
MAC address filtering
Network Access Control (NAC) (Correct answer)

Correct answer: Network Access Control (NAC)

NAC enforces policy-based access, performing posture checks before granting network admission.

Question 20: What is the principle of least privilege?

Users should have only the minimum access required to perform their job (Correct answer)
Users receive all permissions by default
All data is publicly readable
Admins should not require passwords

Correct answer: Users should have only the minimum access required to perform their job

Least privilege limits user and process access to only what is necessary, reducing the attack surface if credentials are compromised.

Question 21: Which of the following is a cloud-native security solution that helps secure cloud infrastructure?

Metasploit
Burp Suite
AWS Guard Duty (Correct answer)
Wireshark

Correct answer: AWS Guard Duty

AWS GuardDuty is a cloud-native security solution that helps secure cloud infrastructure within the Amazon Web Services (AWS) environment. It continuously monitors for malicious activity and unauthorized behavior to protect AWS accounts and workloads. GuardDuty leverages machine learning and threat intelligence to identify potential threats, making it an essential tool for cloud security.

Question 22: Which of the following techniques are commonly used in threat identification?

Penetration Testing (Correct answer)
Data Compression
Encryption
Vulnerability Scanning (Correct answer)

Correct answer: Penetration Testing

Vulnerability scanning and penetration testing are commonly used techniques in threat identification. Vulnerability scanning employs automated tools to detect known security weaknesses in systems and applications. Penetration testing involves ethical hackers simulating real-world attacks to uncover exploitable vulnerabilities and assess the effectiveness of existing security controls, providing a comprehensive view of potential threats.

Question 23: What type of scan discovers live hosts and open ports on a network without attempting exploitation?

Discovery / reconnaissance scan (Correct answer)
Compliance scan
Exploitation scan
Vulnerability scan

Correct answer: Discovery / reconnaissance scan

A discovery scan (e.g., using Nmap) maps the network, identifying live hosts and open services without testing for vulnerabilities.

Question 24: Which of the following best describes a 'cryptographic failure' as defined by OWASP?

Using self-signed certificates in a production environment
Failing to encrypt sensitive data or using weak/broken cryptographic algorithms (Correct answer)
Implementing two-factor authentication with a weak second factor
Using an expired TLS certificate on a public-facing server

Correct answer: Failing to encrypt sensitive data or using weak/broken cryptographic algorithms

OWASP A02:2021 Cryptographic Failures occur when sensitive data is exposed due to absent encryption or the use of deprecated and weak cryptographic algorithms.

Question 25: In cloud security architecture, what does the Shared Responsibility Model define?

The SLA for cloud uptime
How encryption keys are shared
How cloud costs are split between teams
Which security responsibilities belong to the cloud provider vs. the customer (Correct answer)

Correct answer: Which security responsibilities belong to the cloud provider vs. the customer

The Shared Responsibility Model clarifies that cloud providers secure the underlying infrastructure while customers are responsible for their data, applications, and access controls.

Question 26: Which of the following is an example of a post-incident activity?

Eradicating malware from infected systems
Monitoring network traffic to detect the ongoing attack
Conducting a post-incident review to learn lessons (Correct answer)
Updating firewall rules during the attack

Correct answer: Conducting a post-incident review to learn lessons

Post-incident activities occur after an incident has been fully resolved and systems have been restored. A crucial part of this phase is conducting a post-incident review, also known as a "lessons learned" session. This helps organizations analyze what went wrong, evaluate the effectiveness of their response, and implement improvements to prevent similar incidents in the future.

Question 27: Which protocol provides encrypted tunneling for site-to-site VPN connections commonly used in enterprise environments?

PPTP
Telnet
L2TP alone
IPsec (Correct answer)

Correct answer: IPsec

IPsec provides authentication and encryption at the IP layer and is the standard for secure site-to-site VPN tunnels.

Question 28: In a PKI hierarchy, what is the role of an Intermediate CA?

It generates password hashes
It stores private keys for end users
It revokes the Root CA certificate
It issues end-entity certificates, insulating the Root CA from direct exposure (Correct answer)

Correct answer: It issues end-entity certificates, insulating the Root CA from direct exposure

Intermediate CAs sit between the Root CA and end-entity certificates, allowing the Root CA to be kept offline and reducing risk if the Intermediate is compromised.

Question 29: Which technique splits outbound traffic so that only traffic destined for the VPN tunnel is encrypted, while other traffic goes directly to the internet?

Traffic shaping
Full-tunnel VPN
SSL inspection
Split tunneling (Correct answer)

Correct answer: Split tunneling

Split tunneling allows selective routing so corporate traffic uses the VPN while internet traffic bypasses it.

Question 30: What does certificate pinning accomplish in a mobile application?

Restricts the app to accept only specific certificates, preventing MITM via rogue CAs (Correct answer)
Stores the certificate on the device permanently
Speeds up TLS handshakes
Pins the UI layout to the screen

Correct answer: Restricts the app to accept only specific certificates, preventing MITM via rogue CAs

Certificate pinning hardcodes the expected certificate or public key so the app rejects connections using any other certificate, even if signed by a trusted CA.

ISC2 Systems Security Certified Practitioner (SSCP)

The SSCP validates hands-on technical skills in implementing, monitoring, and administering IT infrastructure using security best practices. It covers network security, cryptography, IAM, incident response, and application security domains.

Questions

35 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds