SSCP Systems Security Certified Practitioner — Questions and Answers

Question 1: Which of the following describes a chosen-ciphertext attack (CCA)?

An attacker who can observe only encrypted traffic and attempts decryption
An attacker who modifies ciphertext blocks to alter plaintext
An attacker who intercepts the key exchange process
An attacker who submits ciphertexts and observes corresponding plaintexts to learn the key (Correct answer)

Correct answer: An attacker who submits ciphertexts and observes corresponding plaintexts to learn the key

In a chosen-ciphertext attack, the adversary can choose arbitrary ciphertexts and obtain their decryptions from the target system, using these oracle responses to deduce the decryption key or recover plaintexts.

Question 2: What physical security measure involves examining trash and discarded materials to find sensitive information?

Shoulder surfing
Piggyback attack
Dumpster diving (Correct answer)
Tailgating

Correct answer: Dumpster diving

Dumpster diving is the practice of searching through trash to find discarded documents, storage media, or other items that may contain sensitive or exploitable information.

Question 3: A developer is creating a web application that takes user input to search a product database. To provide the strongest defense against SQL injection attacks, which of the following techniques should be implemented?

Hashing all user input before appending it to the SQL query string.
Sanitizing user input by stripping out keywords like 'SELECT' and 'DROP'.
Using parameterized queries or prepared statements. (Correct answer)
Implementing an allow-list for specific special characters in the input field.

Correct answer: Using parameterized queries or prepared statements.

The most effective and recommended defense against SQL injection is the use of parameterized queries, also known as prepared statements. [3, 11, 17] This technique separates the SQL command logic from the data, ensuring that user input is treated as literal data and cannot be executed as part of the command. [27] Input sanitization and block-listing can be incomplete and bypassed, while hashing is used for storing passwords, not for querying data.

Question 4: A system logs every failed authentication attempt and alerts the security team after five consecutive failures. What security control does this represent?

Preventive control
Detective control (Correct answer)
Deterrent control
Corrective control

Correct answer: Detective control

Logging and alerting on failed attempts is a detective control because it identifies and reports suspicious activity without stopping it directly.

Question 5: During a security assessment, a tester finds that the application accepts user input in an XML document and processes it without disabling external entity references. Which attack does this enable?

Cross-site scripting (XSS) via injected script tags
SQL injection via crafted XML attribute values
XML External Entity (XXE) injection allowing server-side file disclosure (Correct answer)
Cross-site request forgery via XML-encoded form submissions

Correct answer: XML External Entity (XXE) injection allowing server-side file disclosure

XXE injection exploits XML parsers that resolve external entity references, allowing attackers to read local files, perform SSRF, or cause denial of service.

Question 6: In RBAC, what is a 'role hierarchy'?

A ranked list of users ordered by seniority
A logging mechanism that records role assignments over time
A structure where senior roles inherit permissions from junior roles (Correct answer)
A classification scheme for objects similar to MAC labels

Correct answer: A structure where senior roles inherit permissions from junior roles

Role hierarchies allow senior roles to inherit the permissions of subordinate roles, reducing administrative overhead.

Question 7: What is the primary purpose of a Trusted Path in an operating system?

Validating digital signatures on executables
Encrypting data in transit between processes
Providing a secure communication channel between the user and the TCB (Correct answer)
Establishing VPN tunnels for remote access

Correct answer: Providing a secure communication channel between the user and the TCB

A Trusted Path ensures that communications between a user and the Trusted Computing Base (TCB) cannot be intercepted or spoofed by malicious software.

Question 8: Which physical security concept uses layers of controls so that defeating one control does not grant full access?

Deterrence
Least privilege
Security through obscurity
Defense in depth (Correct answer)

Correct answer: Defense in depth

Defense in depth applies multiple overlapping physical controls (fences, guards, locks, cameras) so an attacker must overcome each successive layer to reach a target.

Question 9: A company's disaster recovery plan specifies an RTO of 4 hours for its e-commerce platform. What does this mean?

The average response time for customer support during an outage
The maximum time allowed to restore the platform to full operation after a disruption (Correct answer)
The minimum time between full backup cycles for the platform
The maximum amount of data loss measured in time that is acceptable after a failure

Correct answer: The maximum time allowed to restore the platform to full operation after a disruption

Recovery Time Objective (RTO) defines the maximum acceptable downtime before restoration must be complete to avoid unacceptable business impact.

Question 10: Which access control implementation enforces permissions at the operating system kernel level, making it resistant to application-level tampering?

Database row-level security
Reference Monitor (Correct answer)
Firewall rules
Application-layer ACLs

Correct answer: Reference Monitor

The Reference Monitor is a kernel-level concept that mediates all access requests between subjects and objects, and cannot be bypassed by user-space processes.

Question 11: Which defense-in-depth practice is MOST effective at reducing the impact of a successful malware infection on a corporate network?

Ensuring all endpoint passwords are at least 12 characters
Requiring security awareness training once per year
Deploying a web application firewall on public-facing servers
Segmenting the network so that infected hosts cannot reach all resources (Correct answer)

Correct answer: Segmenting the network so that infected hosts cannot reach all resources

Network segmentation contains a malware infection to the compromised segment, limiting lateral movement and preventing the malware from reaching critical systems or sensitive data across the entire network.

Question 12: What distinguishes a 'cold site' from a 'hot site' in disaster recovery?

A cold site is used for winter disasters while a hot site handles summer incidents
A cold site is minimally equipped requiring significant setup, while a hot site is fully operational immediately (Correct answer)
A cold site stores backup tapes offsite while a hot site processes live transactions onsite
A cold site has no climate control while a hot site has environmental controls

Correct answer: A cold site is minimally equipped requiring significant setup, while a hot site is fully operational immediately

A cold site provides basic infrastructure (space, power, connectivity) but requires equipment installation and configuration before use, while a hot site is immediately operational.

Question 13: What is the purpose of a visitor management system in a secure facility?

Monitor network bandwidth usage by guests
Automate payroll for contracted workers
Track and control the identity, access, and movement of non-employees within the facility (Correct answer)
Manage employee vacation scheduling

Correct answer: Track and control the identity, access, and movement of non-employees within the facility

A visitor management system logs visitor identity, purpose, host employee, badge issuance, and entry/exit times to ensure accountability for all non-employees in a secure facility.

Question 14: What kind of technology is an example of that duplicates what is displayed on a desktop PC to a distant computer?

Remote control (Correct answer)
Screen scraping
Remote node operation
RDP

Correct answer: Remote control

A remote access tool that copies what is displayed on a desktop PC to a remote computer is an example of remote control technology. Remote control allows a user to access and control a computer or device from a remote location. In this case, the tool enables the user to view and control the desktop PC from a remote computer, effectively replicating the display and functionality of the desktop PC on the remote device.

Question 15: An organization outsources its payroll processing to a third-party provider. From a risk management perspective, which obligation does the organization retain?

Right to transfer all legal liability to the third party vendor
Full operational responsibility for the third party's security controls
Ultimate accountability for protecting the data processed by the third party (Correct answer)
Elimination of the need to assess risks related to the outsourced function

Correct answer: Ultimate accountability for protecting the data processed by the third party

Organizations cannot outsource accountability — even when processing is delegated to a vendor, the organization remains ultimately responsible for protecting its data.

Question 16: A web developer needs to secure a new feature that allows users to post comments, which are then displayed to other users. To prevent attackers from injecting malicious scripts into the comments, which of the following is the MOST effective primary defense?

Performing output encoding on user-supplied data before rendering it in the browser (Correct answer)
Enforcing a strict character limit on the comment input field
Implementing a strong Content Security Policy (CSP)
Using prepared statements for all database interactions

Correct answer: Performing output encoding on user-supplied data before rendering it in the browser

The most effective primary defense against stored Cross-Site Scripting (XSS) is to perform output encoding on user-controllable data just before it is rendered on a page. [7, 15, 19] This process converts potentially malicious characters (e.g., '<', '>') into their HTML entity equivalents (e.g., '<', '>'), which prevents the browser from interpreting them as executable code. [19] While CSP is a valuable defense-in-depth measure, it is a secondary control. Prepared statements prevent SQL injection, not XSS. Character limits are easily bypassed.

Question 17: A security team wants to ensure that network traffic between branch offices and headquarters cannot be decrypted even if the long-term private key is later compromised. Which property provides this guarantee?

Key escrow
Non-repudiation
Perfect forward secrecy (Correct answer)
Data integrity

Correct answer: Perfect forward secrecy

Perfect forward secrecy (PFS) uses ephemeral session keys so that compromise of the long-term key cannot decrypt previously recorded sessions.

Question 18: Which risk response strategy is being used when a company purchases cyber liability insurance to cover potential data breach costs?

Risk transfer (Correct answer)
Risk mitigation
Risk avoidance
Risk acceptance

Correct answer: Risk transfer

Purchasing insurance transfers the financial consequence of a risk to a third party (the insurer), which is the definition of risk transfer.

Question 19: Which access control model is most commonly used in commercial operating systems like Windows and Linux file systems?

Rule-Based Access Control
Discretionary Access Control (DAC) (Correct answer)
Mandatory Access Control (MAC)
Role-Based Access Control (RBAC)

Correct answer: Discretionary Access Control (DAC)

DAC allows resource owners to control who can access their files, which is the standard model in mainstream operating systems via file permissions and ACLs.

Question 20: Which term describes the maximum amount of risk loss an organization can sustain without threatening its ability to continue operations?

Residual risk
Inherent risk
Risk appetite
Risk capacity (Correct answer)

Correct answer: Risk capacity

Risk capacity is the objective maximum risk an organization can absorb before its survival or core operations are threatened, distinct from the subjective risk appetite.

Question 21: A developer uses parameterized queries (prepared statements) when building database calls. Which attack class does this MOST directly mitigate?

SQL injection (Correct answer)
Path traversal
Cross-site scripting (XSS)
Cross-site request forgery (CSRF)

Correct answer: SQL injection

Parameterized queries separate SQL code from user-supplied data, preventing attackers from injecting SQL syntax that alters the intended query logic.

Question 22: During a security review, analysts find that an employee's account logged in from New York at 8 AM and from Tokyo at 9 AM. This is an example of which type of indicator?

Credential stuffing pattern
Insider threat baseline
Impossible travel anomaly (Correct answer)
Indicator of Exposure

Correct answer: Impossible travel anomaly

Impossible travel detection flags logins from geographically distant locations within a timeframe that is physically impossible, suggesting credential compromise.

Question 23: A security team implements honeypots on their network. What is the PRIMARY security goal of this deployment?

To speed up legitimate user authentication
To filter malicious traffic at the perimeter
To encrypt sensitive data before it leaves the network
To detect and study attacker techniques by luring them to decoy systems (Correct answer)

Correct answer: To detect and study attacker techniques by luring them to decoy systems

Honeypots are deliberately vulnerable decoy systems designed to attract attackers, allowing defenders to detect intrusions and analyze adversary tactics.

Question 24: Which log management practice ensures that logs cannot be tampered with after collection, preserving their evidentiary value?

Log filtering
Log rotation
Write-once log storage with cryptographic hashing (Correct answer)
Log compression

Correct answer: Write-once log storage with cryptographic hashing

Storing logs on write-once media and applying cryptographic hashes ensures integrity, making tampering detectable and preserving logs as admissible evidence.

Question 25: Which digital signature algorithm is based on elliptic curve cryptography and is used in modern TLS certificates?

RSA-PSS
ECDSA (Elliptic Curve Digital Signature Algorithm) (Correct answer)
ElGamal
DSA (Digital Signature Algorithm)

Correct answer: ECDSA (Elliptic Curve Digital Signature Algorithm)

ECDSA uses elliptic curve mathematics to produce digital signatures, offering equivalent security to RSA with much smaller key sizes, making it popular in TLS, SSH, and cryptocurrency.

Question 26: When conducting a physical security assessment, what does the term 'fence line attack' refer to?

Social engineering of security guards at the gate
Hacking into physical security cameras along a perimeter
Installing wireless access points near the property boundary
An attacker scaling or breaching the perimeter fence to gain site access (Correct answer)

Correct answer: An attacker scaling or breaching the perimeter fence to gain site access

A fence line attack involves an adversary physically breaching the outer perimeter fence, which is why perimeter fencing specifications (height, material, barbed wire) are critical controls.

Question 27: An organization has successfully contained and eradicated a security threat. During which phase of the incident response lifecycle would the team formally document their findings and recommend improvements to security controls and procedures?

Preparation
Containment, Eradication, & Recovery
Detection and Analysis
Post-Incident Activity (Correct answer)

Correct answer: Post-Incident Activity

The Post-Incident Activity phase, often called 'lessons learned,' is where the incident response process is reviewed. The primary purpose of this phase is to learn from the incident to improve security posture, update response plans, and prevent future occurrences. This involves documenting the incident, its impact, the actions taken, and recommending improvements.

Question 28: What vulnerability does the Electronic Codebook (ECB) mode of operation have?

It cannot encrypt data larger than one block
It requires an initialization vector, which can be guessed
Identical plaintext blocks produce identical ciphertext blocks, leaking patterns (Correct answer)
It is vulnerable to padding oracle attacks exclusively

Correct answer: Identical plaintext blocks produce identical ciphertext blocks, leaking patterns

ECB mode encrypts each block independently, so identical plaintext blocks always produce identical ciphertext blocks, revealing data patterns — famously illustrated by the 'ECB penguin' example.

Question 29: Which badge system technology is considered most secure against cloning attacks?

13.56 MHz smart cards with mutual authentication (Correct answer)
Barcode badges
125 kHz proximity (EM4100) cards
Magnetic stripe cards

Correct answer: 13.56 MHz smart cards with mutual authentication

13.56 MHz smart cards (such as MIFARE DESFire or iCLASS SE) implement mutual authentication and encryption, making them far more resistant to cloning than legacy proximity or magnetic stripe technologies.

Question 30: Which backup type copies only the data that changed since the last backup of ANY type?

Mirror backup
Full backup
Incremental backup (Correct answer)
Differential backup

Correct answer: Incremental backup

An incremental backup copies only data changed since the last backup (full or incremental), making each backup small and fast but requiring multiple sets for a complete restore.

Question 31: A security team is evaluating container security. Which risk is MOST unique to containerized environments compared to traditional VMs?

Unpatched guest OS kernels
Container escape allowing access to the shared host kernel (Correct answer)
Weak administrative passwords on management consoles
Unencrypted data at rest on storage volumes

Correct answer: Container escape allowing access to the shared host kernel

Containers share the host OS kernel, so a container escape vulnerability can give an attacker access to the host and all other containers.

Question 32: During incident response, a team member suggests wiping and reimaging an infected server immediately. What is a key risk of this approach?

Reimaging takes longer than manual cleanup
Evidence critical to understanding the attack may be destroyed (Correct answer)
It will restore the vulnerability that caused the infection
The server cannot be reimaged if malware is present

Correct answer: Evidence critical to understanding the attack may be destroyed

Wiping without first collecting forensic evidence destroys attack indicators, making root cause analysis and attribution impossible.

SSCP Systems Security Certified Practitioner

The SSCP (Systems Security Certified Practitioner) is an ISC2 certification validating technical IT security skills across 7 domains including access controls, cryptography, network security, and incident response. It is designed for IT administrators, security analysts, and network engineers responsible for implementing and maintaining secure infrastructures.

Questions

35 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds