ISC2 Systems Security Certified Practitioner (SSCP) — Questions and Answers

Question 1: Which network security control is specifically designed to deceive attackers by mimicking real systems and logging their activity?

Honeypot (Correct answer)
IPS
WAF
SIEM

Correct answer: Honeypot

A honeypot is a decoy system intentionally deployed to attract attackers and gather intelligence on their techniques.

Question 2: Which OAuth 2.0 grant type is recommended for server-to-server API authentication without user interaction?

Client Credentials (Correct answer)
Implicit
Authorization Code
Device Code

Correct answer: Client Credentials

The Client Credentials grant allows a service to authenticate directly with the authorization server using its own credentials, without a user context.

Question 3: Which vulnerability scoring system provides a standardized way to assess and communicate the severity of security vulnerabilities?

STRIDE
OWASP Top 10
CVSS (Common Vulnerability Scoring System) (Correct answer)
PASTA

Correct answer: CVSS (Common Vulnerability Scoring System)

CVSS provides a numerical score (0–10) based on exploitability and impact metrics to standardize vulnerability severity communication.

Question 4: An organization moves workloads to the cloud. Under the IaaS model, which security responsibility remains entirely with the customer?

Hypervisor patching
Network switch maintenance
Operating system patching and application security (Correct answer)
Physical datacenter security

Correct answer: Operating system patching and application security

Under IaaS, the cloud provider manages physical infrastructure and the hypervisor, while the customer is fully responsible for the OS, middleware, and application security.

Question 5: A security engineer reviews access logs and finds a service account with domain admin rights that hasn't logged in for 180 days. What is the recommended action?

Move it to a different OU
Reset the password only
Immediately disable and review the account's necessity and permissions (Correct answer)
Leave it; service accounts need broad rights

Correct answer: Immediately disable and review the account's necessity and permissions

Dormant privileged accounts are a major attack surface; they should be disabled and reviewed for least-privilege compliance.

Question 6: Which authentication factor category does a hardware security key (e.g., YubiKey) belong to?

Something you know
Something you are
Something you have (Correct answer)
Somewhere you are

Correct answer: Something you have

A hardware security key is a physical device the user possesses, making it a 'something you have' authentication factor.

Question 7: What does pivoting mean in the context of penetration testing?

Escalating local privileges to domain admin
Changing the attack methodology mid-engagement
Pivoting from web to API attacks
Using a compromised host as a relay to attack systems on network segments that are otherwise unreachable (Correct answer)

Correct answer: Using a compromised host as a relay to attack systems on network segments that are otherwise unreachable

Pivoting uses a compromised host as a tunnel or proxy to route attacker traffic through network segments that would otherwise be inaccessible.

Question 8: Which of the following best defines a "zero-day vulnerability"?

A vulnerability in software that is no longer supported.
A vulnerability that has no associated risk.
A vulnerability discovered and disclosed to the public before a patch is available. (Correct answer)
A vulnerability that has been exploited for more than a year without detection.

Correct answer: A vulnerability discovered and disclosed to the public before a patch is available.

A "zero-day vulnerability" is a critical software flaw that is unknown to the vendor or for which no official patch has yet been released. This means attackers can exploit the vulnerability before developers have had a chance to fix it, making it particularly dangerous. The term signifies that the vendor has had "zero days" to address the issue since its public discovery or exploitation.

Question 9: Which CVSS metric indicates how complex the conditions must be for an attacker to exploit a vulnerability?

User Interaction
Attack Vector
Privileges Required
Attack Complexity (Correct answer)

Correct answer: Attack Complexity

The CVSS Attack Complexity metric reflects whether exploitation requires specific conditions beyond the attacker's control, such as race conditions.

Question 10: Which of the following is a cloud-native security solution that helps secure cloud infrastructure?

Metasploit
AWS Guard Duty (Correct answer)
Wireshark
Burp Suite

Correct answer: AWS Guard Duty

AWS GuardDuty is a cloud-native security solution that helps secure cloud infrastructure within the Amazon Web Services (AWS) environment. It continuously monitors for malicious activity and unauthorized behavior to protect AWS accounts and workloads. GuardDuty leverages machine learning and threat intelligence to identify potential threats, making it an essential tool for cloud security.

Question 11: Which protocol provides encrypted tunneling for site-to-site VPN connections commonly used in enterprise environments?

Telnet
L2TP alone
IPsec (Correct answer)
PPTP

Correct answer: IPsec

IPsec provides authentication and encryption at the IP layer and is the standard for secure site-to-site VPN tunnels.

Question 12: What is the first step in a typical risk management process?

Risk Assessment
Risk Monitoring
Risk Identification (Correct answer)
Risk Treatment

Correct answer: Risk Identification

The first step in a typical risk management process is Risk Identification. Before any risks can be assessed, treated, or monitored, they must first be recognized and documented. This involves understanding an organization's assets, potential threats, and existing vulnerabilities to pinpoint where risks might arise.

Question 13: What is the purpose of egress filtering on a network perimeter firewall?

Block inbound attack traffic
Prevent internal hosts from sending unauthorized outbound traffic (Correct answer)
Encrypt outbound packets
Balance outbound load

Correct answer: Prevent internal hosts from sending unauthorized outbound traffic

Egress filtering inspects and restricts traffic leaving the network to prevent data exfiltration and stop compromised hosts from beaconing.

Question 14: Which elliptic curve algorithm is recommended by NIST for digital signatures and key agreement?

DH (Diffie-Hellman)
DSA
RC4
ECDSA / ECDH (Correct answer)

Correct answer: ECDSA / ECDH

ECDSA (digital signatures) and ECDH (key agreement) use elliptic curve cryptography for strong security with smaller key sizes than RSA.

Question 15: What is the most effective defense against SQL injection attacks in application code?

Using stored procedures exclusively
Input length validation
Parameterized queries (prepared statements) (Correct answer)
Encrypting database connections

Correct answer: Parameterized queries (prepared statements)

Parameterized queries separate SQL code from user-supplied data, preventing input from being interpreted as SQL syntax regardless of its content.

Question 16: Which of the following is an example of a post-incident activity?

Monitoring network traffic to detect the ongoing attack
Conducting a post-incident review to learn lessons (Correct answer)
Eradicating malware from infected systems
Updating firewall rules during the attack

Correct answer: Conducting a post-incident review to learn lessons

Post-incident activities occur after an incident has been fully resolved and systems have been restored. A crucial part of this phase is conducting a post-incident review, also known as a "lessons learned" session. This helps organizations analyze what went wrong, evaluate the effectiveness of their response, and implement improvements to prevent similar incidents in the future.

Question 17: Which of the following describes the primary use of Snort in cybersecurity?

Password cracking
Web application scanning
Intrusion Detection System (IDS) (Correct answer)
Network vulnerability scanning

Correct answer: Intrusion Detection System (IDS)

Snort's primary use in cybersecurity is as an Intrusion Detection System (IDS). It performs real-time traffic analysis and packet logging on networks, using a rule-based engine to detect malicious activities, policy violations, and other suspicious network behavior. While it can also function as an Intrusion Prevention System (IPS), its core capability is detection.

Question 18: What is the first step a Security Engineer should take when identifying a potential threat?

Identify and categorize assets (Correct answer)
Assess the threat's potential impact
Block all incoming traffic
Implement security patches immediately

Correct answer: Identify and categorize assets

The first step a Security Engineer should take when identifying a potential threat is to identify and categorize assets. Understanding what needs protection, such as critical data, systems, or applications, allows for proper prioritization and assessment of potential impacts. Without a clear inventory and classification of assets, it's impossible to effectively evaluate threats or implement targeted security measures.

Question 19: Which of the following is the primary function of a Security Information and Event Management (SIEM) system?

Running vulnerability scans on systems
Managing network traffic
Encrypting sensitive data
Collecting and correlating log data from various sources to detect security threats (Correct answer)

Correct answer: Collecting and correlating log data from various sources to detect security threats

A Security Information and Event Management (SIEM) system is designed to provide a centralized view of an organization's security posture. It achieves this by aggregating log data from diverse network devices, servers, and applications. By correlating these events, SIEMs can identify patterns and anomalies indicative of potential security threats, enabling proactive detection and response.

Question 20: Which design approach reduces the impact of a single component compromise by running components with only the permissions they need for their specific function?

Least privilege / minimal footprint per component (Correct answer)
Defense in depth at the perimeter only
Monolithic architecture
Full-trust internal networking

Correct answer: Least privilege / minimal footprint per component

Applying least privilege at the component level ensures that even if one microservice or process is compromised, its blast radius is limited.

Question 21: A security team runs authenticated vulnerability scans versus unauthenticated scans. What additional information do authenticated scans provide?

Web application SQL injection findings
Deeper insight into installed software versions, missing patches, and misconfigurations on the host (Correct answer)
Network topology mapping
External attacker perspective

Correct answer: Deeper insight into installed software versions, missing patches, and misconfigurations on the host

Authenticated scans log into the target with valid credentials, giving the scanner access to installed packages, registry settings, and local configurations for more accurate results.

Question 22: What is data classification and how does it support security architecture decisions?

Categorizing data by sensitivity level; it drives access controls, encryption, and handling requirements (Correct answer)
Tagging data by file type; it determines storage costs
Indexing data for search; it improves query performance
Sorting files by date; it determines backup schedules

Correct answer: Categorizing data by sensitivity level; it drives access controls, encryption, and handling requirements

Data classification assigns sensitivity tiers (e.g., Public, Internal, Confidential, Restricted) that inform which controls, encryption standards, and access policies apply.

Question 23: What is the primary purpose of network segmentation in a security architecture?

Increase bandwidth
Simplify network management
Reduce hardware costs
Limit lateral movement and contain breaches (Correct answer)

Correct answer: Limit lateral movement and contain breaches

Network segmentation restricts an attacker's ability to move laterally across the environment after an initial compromise.

Question 24: Which algorithm is widely used for asymmetric key exchange and digital signatures in TLS certificates?

SHA-256
HMAC
RSA (Correct answer)
AES-256

Correct answer: RSA

RSA is a widely deployed asymmetric algorithm used for digital signatures and key exchange in PKI and TLS.

Question 25: Which of the following is an example of risk transference?

Encrypting sensitive data to prevent data breaches
Installing a firewall to protect against cyber attacks
Outsourcing IT services to a third-party provider with liability insurance (Correct answer)
Conducting regular security training for employees

Correct answer: Outsourcing IT services to a third-party provider with liability insurance

Risk transference involves shifting the potential financial impact or responsibility of a risk to a third party. Outsourcing IT services to a provider that carries liability insurance is a prime example, as the financial burden of certain incidents would fall upon the third-party vendor or their insurer. This strategy does not eliminate the risk but reallocates its consequences.

Question 26: What is the purpose of continuous security monitoring?

To regularly update all software and applications
To ensure compliance with data privacy regulations
To automate the backup of critical data
To detect, investigate, and respond to security threats in real-time (Correct answer)

Correct answer: To detect, investigate, and respond to security threats in real-time

Continuous security monitoring involves constantly observing an organization's systems and networks for suspicious activities and vulnerabilities. Its primary purpose is to provide real-time visibility into the security landscape, allowing for immediate detection, thorough investigation, and rapid response to emerging or ongoing security threats. This proactive approach minimizes potential damage and downtime.

Question 27: Which key management practice ensures that encryption keys are changed regularly to limit exposure from a compromise?

Key wrapping
Key derivation
Key splitting
Key rotation (Correct answer)

Correct answer: Key rotation

Key rotation periodically replaces cryptographic keys so that even if one is compromised, the window of exposed data is limited.

Question 28: Which of the following actions helps a Security Engineer identify potential threats proactively?

Network Monitoring (Correct answer)
Post-incident Forensics
Data Backup
Security Information and Event Management (SIEM) (Correct answer)

Correct answer: Network Monitoring

Network monitoring and Security Information and Event Management (SIEM) are crucial actions that help a Security Engineer proactively identify potential threats. Network monitoring continuously observes network traffic and behavior for anomalies or suspicious patterns that could indicate an attack. SIEM systems aggregate and analyze security logs and events from various sources, providing real-time insights and alerts on potential security incidents as they emerge.

Question 29: What is the principle of least privilege?

Users should have only the minimum access required to perform their job (Correct answer)
All data is publicly readable
Admins should not require passwords
Users receive all permissions by default

Correct answer: Users should have only the minimum access required to perform their job

Least privilege limits user and process access to only what is necessary, reducing the attack surface if credentials are compromised.

Question 30: Which of the following steps is typically the first in an incident response process?

Recovery
Containment
Identification (Correct answer)
Eradication

Correct answer: Identification

The incident response process typically begins with the "Identification" phase, where an organization detects and confirms a security incident. This involves monitoring systems, analyzing alerts, and determining if an actual security breach or event has occurred. Without proper identification, subsequent steps like containment or eradication cannot be initiated effectively.

ISC2 Systems Security Certified Practitioner (SSCP)

The SSCP validates hands-on technical skills in implementing, monitoring, and administering IT infrastructure using security best practices. It covers network security, cryptography, IAM, incident response, and application security domains.

Questions

35 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds