Systems Security Certified Practitioner (SSCP) — Questions and Answers

Question 1: Which Windows Event ID is associated with a failed logon attempt and is critical for brute-force detection?

4720
4776
4625 (Correct answer)
4648

Correct answer: 4625

Event ID 4625 logs failed logon attempts on Windows systems and is essential for detecting brute-force and credential stuffing attacks.

Question 2: An organization's IR plan calls for notifying legal counsel immediately upon incident declaration. This requirement primarily addresses which concern?

Ensuring technical remediation is prioritized
Speeding up forensic imaging
Establishing attorney-client privilege over IR communications (Correct answer)
Complying with change management procedures

Correct answer: Establishing attorney-client privilege over IR communications

Involving legal counsel early can extend attorney-client privilege to IR findings, protecting sensitive investigation details from discovery in litigation.

Question 3: In qualitative risk analysis, risks are typically rated using which method?

Descriptive scales such as High, Medium, and Low (Correct answer)
Annualized Loss Expectancy calculations
Monte Carlo simulations
Net Present Value analysis

Correct answer: Descriptive scales such as High, Medium, and Low

Qualitative risk analysis uses subjective, descriptive scales rather than precise monetary calculations to rank risk severity.

Question 4: Which recovery strategy involves maintaining a fully operational duplicate site that can assume production load within minutes?

Mobile recovery unit
Hot site (Correct answer)
Warm site
Cold site

Correct answer: Hot site

A hot site mirrors the production environment with live data synchronization, enabling near-instant failover with minimal data loss or downtime.

Question 5: Which tool is commonly used for network intrusion detection?

Snort (Correct answer)
Firewall
Antivirus
Web browser

Correct answer: Snort

Snort is a widely recognized open-source network intrusion detection system (NIDS) that performs real-time traffic analysis and packet logging. It detects various attacks, such as buffer overflows and stealth port scans, by comparing network traffic against a defined set of rules. While firewalls and antivirus tools serve different security functions, Snort specifically excels at identifying and alerting on network intrusions.

Question 6: What is the PRIMARY purpose of obtaining SSCP certification in Security Operations and Administration?

To satisfy a personal achievement goal
To bypass educational requirements
To guarantee employment
To demonstrate verified competency and adherence to professional standards (Correct answer)

Correct answer: To demonstrate verified competency and adherence to professional standards

Certification demonstrates verified competency and adherence to professional standards.

Question 7: Which indicator would BEST help an analyst identify beaconing behavior from a compromised endpoint?

A single large file transfer to a cloud storage service
Increased inbound SMTP connections to the mail server
Random spike in CPU utilization
Periodic outbound connections to the same external IP at consistent intervals (Correct answer)

Correct answer: Periodic outbound connections to the same external IP at consistent intervals

Beaconing is characterized by regular, timed outbound communications from a compromised host checking in with a C2 server.

Question 8: Which attack involves using a previously captured authentication credential to gain unauthorized access at a later time?

Credential stuffing
Pass-the-hash
Golden ticket attack
Replay attack (Correct answer)

Correct answer: Replay attack

In a replay attack, an adversary captures and reuses a valid authentication message or token to impersonate a user.

Question 9: Which concept describes running applications with the minimum permissions necessary to perform their function?

Separation of duties
Least privilege (Correct answer)
Need to know
Defense in depth

Correct answer: Least privilege

The principle of least privilege limits an application's permissions to only what is required, reducing the attack surface if the application is compromised.

Question 10: What is the purpose of a Web Application Firewall (WAF)?

To encrypt all web traffic between client and server
To cache frequently accessed web content
To filter and monitor HTTP traffic to protect web applications from attacks (Correct answer)
To load-balance web requests across multiple servers

Correct answer: To filter and monitor HTTP traffic to protect web applications from attacks

A WAF inspects HTTP/HTTPS traffic between a web application and the internet, blocking common attacks like SQL injection and XSS.

Question 11: Which configuration management practice ensures that all changes to production systems are reviewed and approved before implementation?

Configuration audit
Change control process (Correct answer)
Asset inventory management
Baseline configuration

Correct answer: Change control process

A change control process requires formal review and approval of system changes, reducing the risk of unauthorized or poorly planned modifications to production environments.

Question 12: Which framework is commonly used as a baseline for auditing IT governance and aligns IT goals with business objectives?

OWASP
CVE
COBIT (Correct answer)
MITRE ATT&CK

Correct answer: COBIT

COBIT (Control Objectives for Information and Related Technologies) provides a framework for IT governance and management aligned with business goals.

Question 13: Which security measure involves using multiple independent systems to perform the same function to verify results?

Failover clustering
Redundancy
Diversity of defense (Correct answer)
Defense in depth

Correct answer: Diversity of defense

Diversity of defense uses different, independent security controls so that a failure or bypass of one does not compromise the entire system.

Question 14: What is the significance of establishing a 'chain of custody' during the incident detection and evidence collection phase?

It ensures alerts are routed to the correct analyst tier
It tracks which signatures triggered during the detection phase
It preserves evidence integrity so it remains admissible for legal or disciplinary proceedings (Correct answer)
It defines escalation paths within the SOC hierarchy

Correct answer: It preserves evidence integrity so it remains admissible for legal or disciplinary proceedings

Chain of custody documents who handled evidence and how, preserving its integrity and ensuring it can be used in legal or disciplinary actions.

Question 15: How does the SSCP body of knowledge relate to daily professional practice?

It is only for academic research
It is theoretical with limited application
It only applies during exams
It provides the foundational framework guiding decision-making and standard practices (Correct answer)

Correct answer: It provides the foundational framework guiding decision-making and standard practices

The body of knowledge provides the framework guiding daily decision-making and practices.

Question 16: Under FedRAMP, which authorization path allows a CSP to receive authorization from a single agency that other agencies can then leverage?

FedRAMP Ready designation
Agency Authorization (Correct answer)
JAB Provisional Authorization
Continuous Authorization

Correct answer: Agency Authorization

Agency Authorization allows a federal agency to sponsor a CSP, and other agencies can reuse that authorization rather than starting from scratch.

Question 17: What is a 'sandbox' in the context of application security?

A honeypot system designed to attract and trap malware
A container for storing cryptographic keys securely
A test environment that mirrors production for software testing
An isolated execution environment that restricts what a program can access or do (Correct answer)

Correct answer: An isolated execution environment that restricts what a program can access or do

A sandbox confines an application to a restricted environment, limiting its access to system resources and preventing it from affecting other processes.

Question 18: During an audit, the auditor reviews system-generated reports rather than paper records. This approach is called:

Inquiry and observation
Substantive testing
Manual walkthrough testing
Computer-assisted audit techniques (CAATs) (Correct answer)

Correct answer: Computer-assisted audit techniques (CAATs)

Computer-Assisted Audit Techniques (CAATs) use software tools to analyze large volumes of electronic data, improving audit efficiency and coverage.

Question 19: What is a 'zero-day' vulnerability?

A vulnerability that is publicly known but has no available patch (Correct answer)
A flaw known only to the vendor but not yet exploited
A vulnerability that has been patched within 24 hours
A flaw that has zero impact on system security

Correct answer: A vulnerability that is publicly known but has no available patch

A zero-day vulnerability is one that is publicly known (or known to attackers) with no vendor-supplied patch available, leaving systems exposed.

Question 20: Which protocol is commonly used by enterprise directories to authenticate users and query directory information?

LDAP (Correct answer)
RADIUS
TACACS+
Kerberos

Correct answer: LDAP

LDAP (Lightweight Directory Access Protocol) is the standard protocol for accessing and managing directory services like Active Directory.

Question 21: What is the PRIMARY purpose of SSCP certification in Security Operations and Administration?

Demonstrating verified competency and professional standards adherence (Correct answer)
Bypassing education
Guaranteeing employment
Personal achievement

Correct answer: Demonstrating verified competency and professional standards adherence

Certification demonstrates verified competency to employers and the public.

Question 22: What is the purpose of a 'security baseline' for a system?

It records the highest level of security a system has ever achieved
It establishes the maximum number of users allowed on a system
It defines the minimum acceptable security configuration that all systems must meet (Correct answer)
It documents the history of all security incidents for a system

Correct answer: It defines the minimum acceptable security configuration that all systems must meet

A security baseline defines the minimum required security settings and configurations that a system must implement to be considered acceptably secure.

Question 23: Which technique allows attackers to hide malicious traffic within legitimate HTTPS sessions, making monitoring harder?

MAC flooding
VLAN hopping
ARP spoofing
SSL/TLS encryption tunneling (Correct answer)

Correct answer: SSL/TLS encryption tunneling

Attackers use SSL/TLS encryption to conceal malicious payloads within legitimate HTTPS traffic, bypassing content inspection.

Question 24: Which technique tests an application by supplying random, unexpected, or malformed input to find vulnerabilities?

Unit testing
Fuzz testing (Correct answer)
Regression testing
Integration testing

Correct answer: Fuzz testing

Fuzz testing (fuzzing) automatically generates large volumes of invalid or unexpected inputs to uncover crashes, memory leaks, and security vulnerabilities.

Question 25: What is MOST important when selecting assessment tools for SSCP work?

Tool cost
Personal familiarity
Validity, reliability, and contextual appropriateness (Correct answer)
Speed of administration

Correct answer: Validity, reliability, and contextual appropriateness

Validity, reliability, and appropriateness ensure quality outcomes.

Question 26: What is the role of a 'public affairs' or 'communications' team member in an IR plan?

Manage external messaging to media, customers, and regulators (Correct answer)
Perform forensic disk imaging
Coordinate technical containment actions
Monitor SIEM alerts during the incident

Correct answer: Manage external messaging to media, customers, and regulators

The communications function controls the narrative during an incident, issuing approved statements to prevent rumor, reputational damage, and regulatory missteps.

Question 27: An auditor discovers that access rights have not been reviewed in 18 months. Which audit finding category best describes this?

Observation
Minor nonconformity
Major nonconformity (Correct answer)
Opportunity for improvement

Correct answer: Major nonconformity

A major nonconformity indicates a systematic failure or absence of a required control, such as a completely missing access review process.

Question 28: Which vulnerability is caused when an application processes more data than a fixed-size memory buffer can hold?

SQL injection
Cross-site scripting
Directory traversal
Buffer overflow (Correct answer)

Correct answer: Buffer overflow

A buffer overflow occurs when input data exceeds the allocated buffer size, potentially allowing attackers to overwrite adjacent memory and execute arbitrary code.

Question 29: Which access control approach allows the data owner to determine who can access their resources?

Discretionary Access Control (DAC) (Correct answer)
Role-Based Access Control (RBAC)
Rule-Based Access Control
Mandatory Access Control (MAC)

Correct answer: Discretionary Access Control (DAC)

DAC lets the resource owner decide who is granted access, as seen in traditional file system permissions.

Question 30: What is the MOST effective way for new SSCP professionals to build competency?

Trial and error
Combine formal education, mentored practice, and ongoing development (Correct answer)
Focus only on advanced topics
Study materials exclusively

Correct answer: Combine formal education, mentored practice, and ongoing development

Multiple complementary approaches build comprehensive competency.

Question 31: Which NIST SP 800-53 control family addresses audit and accountability?

SI — System and Information Integrity
AU — Audit and Accountability (Correct answer)
CM — Configuration Management
AC — Access Control

Correct answer: AU — Audit and Accountability

The AU (Audit and Accountability) control family in NIST SP 800-53 covers audit event logging, log content, audit review, and protection of audit information.

Question 32: A tabletop exercise differs from a full-scale IR drill primarily because it:

Tests backup restoration procedures in production
Requires all staff to be on-site simultaneously
Is a discussion-based simulation with no live system actions (Correct answer)
Involves actual network failover and system recovery

Correct answer: Is a discussion-based simulation with no live system actions

Tabletop exercises are verbal walkthroughs of an incident scenario that test decision-making and communication without disrupting live systems or services.

Question 33: A healthcare organization uses data classification labels to enforce access, ensuring only cleared staff can view patient records above their clearance level. Which access control model is this?

Role-Based Access Control (RBAC)
Discretionary Access Control (DAC)
Mandatory Access Control (MAC) (Correct answer)
Attribute-Based Access Control (ABAC)

Correct answer: Mandatory Access Control (MAC)

MAC uses security labels and clearance levels to enforce access decisions, and users cannot override these policies.

Question 34: What is identity management in cybersecurity?

Overseeing power supply levels.
Managing physical hardware.
Conducting market research.
Ensuring proper administration of user identities and privileges (Correct answer)

Correct answer: Ensuring proper administration of user identities and privileges

Identity management in cybersecurity encompasses the processes and technologies used to manage digital identities and their associated access rights across an organization. It focuses on creating, maintaining, and revoking user accounts and ensuring each user has the appropriate level of access (privileges) to systems and data based on their role. This is crucial for maintaining security, ensuring compliance, and streamlining operations.

Question 35: Which audit type is performed without prior notice to the auditee to capture the true state of security controls?

Certification audit
Compliance audit
Unannounced audit (Correct answer)
Announced audit

Correct answer: Unannounced audit

Unannounced audits capture the genuine state of controls because staff cannot prepare or temporarily implement missing safeguards.

Question 36: What is the purpose of a control gap analysis in risk management?

To assign ownership of risks to business units
To measure network latency between security devices
To calculate the financial cost of each implemented control
To identify where current controls fail to meet required security objectives (Correct answer)

Correct answer: To identify where current controls fail to meet required security objectives

A control gap analysis compares current control implementation against requirements or standards to identify deficiencies that need remediation.

Question 37: When documenting SSCP assessment findings, which approach is MOST appropriate?

Summarize verbally only
Include only positive findings
Use expert-only jargon
Record objective findings and observations factually (Correct answer)

Correct answer: Record objective findings and observations factually

Objective, factual documentation supports decision-making and scrutiny.

Question 38: When collecting volatile evidence from a live system, what is the correct ORDER of collection according to the order of volatility?

CPU registers → RAM → Network connections → Disk (Correct answer)
Network connections → Disk → RAM → CPU registers
RAM → Disk → CPU registers → Network connections
Disk → RAM → Network connections → CPU registers

Correct answer: CPU registers → RAM → Network connections → Disk

RFC 3227 and forensic best practice dictate collecting most volatile (CPU/registers) to least volatile (disk), so that the shortest-lived data is captured first.

Question 39: What distinguishes a Security Operations and Administration certified professional from non-certified practitioners?

More experience always
No meaningful difference
Validated competency through standardized assessment (Correct answer)
Only works in large organizations

Correct answer: Validated competency through standardized assessment

Certification provides objective validation through standardized assessment.

Question 40: What is the function of anomaly-based detection?

It encrypts data in transit
It checks for known virus signatures
It identifies unusual behavior (Correct answer)
It disables unauthorized users

Correct answer: It identifies unusual behavior

Anomaly-based detection systems establish a baseline of normal system or network behavior over time. They then continuously monitor for any deviations from this established baseline, flagging unusual activities as potential threats. This method is particularly effective at detecting novel or zero-day attacks that signature-based systems, which rely on known patterns, might otherwise miss.

Question 41: What is the primary purpose of application whitelisting?

Logging all application activity
Blocking known malware signatures
Allowing only pre-approved applications to execute (Correct answer)
Encrypting application data at rest

Correct answer: Allowing only pre-approved applications to execute

Application whitelisting permits only explicitly approved programs to run, preventing unauthorized or malicious software from executing.

Question 42: When rebuilding a compromised server, which action must occur BEFORE returning it to production?

Notifying all end users of the rebuild schedule
Disabling the firewall temporarily to test connectivity
Archiving all old log files from the compromised system
Applying all patches and verifying the system against a known-good baseline (Correct answer)

Correct answer: Applying all patches and verifying the system against a known-good baseline

Patching and baseline verification ensure the root vulnerability is closed and no malicious artifacts remain before the system handles live traffic.

Question 43: Which metric best measures the effectiveness of an incident response program over time?

Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) (Correct answer)
Number of incidents declared per year
Total number of security tools deployed
Headcount of the security operations center

Correct answer: Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR)

MTTD and MTTR quantify how quickly threats are found and neutralized, directly reflecting IR program maturity and effectiveness.

Question 44: How do Security Operations and Administration certification requirements relate to industry evolution?

Become less stringent
Evolve periodically to reflect advances in knowledge and practice (Correct answer)
Never change
Only change by government mandate

Correct answer: Evolve periodically to reflect advances in knowledge and practice

Requirements evolve to keep pace with professional and technological advances.

Question 45: A user's account is automatically locked after three failed login attempts. What type of control is this?

Compensating control
Preventive control (Correct answer)
Detective control
Corrective control

Correct answer: Preventive control

Account lockout is a preventive control that stops brute-force attacks before unauthorized access occurs.

Question 46: What is the primary purpose of a 'hot wash' or after-action review following an incident?

Destroy evidence before litigation
Identify lessons learned to improve future response (Correct answer)
Notify regulators of the breach
Restore all affected systems

Correct answer: Identify lessons learned to improve future response

A hot wash captures what worked, what failed, and recommended improvements so the organization strengthens its IR capability for the next event.

Question 47: What is the primary security benefit of containerization technologies like Docker?

They isolate applications from each other and the host system (Correct answer)
They automatically encrypt all application data
They eliminate the need for operating system patches
They prevent all forms of privilege escalation

Correct answer: They isolate applications from each other and the host system

Containers provide process and filesystem isolation so that a compromised container has limited ability to affect other containers or the host OS.

Question 48: During recovery, an organization restores a database from backup but discovers the backup itself was encrypted by ransomware. This scenario highlights the importance of:

Running more frequent vulnerability scans
Storing backups on the same network segment as production
Compressing backups to reduce storage costs
Air-gapping or immutable backup storage inaccessible to ransomware (Correct answer)

Correct answer: Air-gapping or immutable backup storage inaccessible to ransomware

Ransomware often targets connected backup systems; air-gapped or immutable (WORM) storage ensures backups remain clean and recoverable.

Question 49: Which risk metric measures the percentage of an asset's value that would be lost in a single threat event?

Single Loss Expectancy (SLE)
Annualized Rate of Occurrence (ARO)
Annualized Loss Expectancy (ALE)
Exposure Factor (EF) (Correct answer)

Correct answer: Exposure Factor (EF)

Exposure Factor (EF) is the percentage of asset value lost in a single realized threat event, used to calculate SLE (SLE = Asset Value × EF).

Question 50: What is the role of a security policy enforcement mechanism?

To create advertisements.
To conduct social events.
To train new sales representatives.
To ensure adherence to security policies (Correct answer)

Correct answer: To ensure adherence to security policies

Security policy enforcement mechanisms are technical or administrative controls designed to ensure that users and systems comply with established security policies. These mechanisms, which can include access controls, firewalls, and security awareness training, actively prevent or detect violations. Their role is critical in translating policy guidelines into practical, actionable security measures that protect organizational assets.

Question 51: Which of the following best represents 'least privilege'?

Granting access to entire departments.
Giving all users full administrative rights.
Providing access only necessary for specific job roles (Correct answer)
Blocking all access requests.

Correct answer: Providing access only necessary for specific job roles

The principle of 'least privilege' dictates that users, programs, or processes should be granted only the minimum necessary permissions to perform their specific tasks. This minimizes the potential damage from accidental errors, misuse, or malicious activity, as it limits the scope of what an attacker can do if an account is compromised. It is a cornerstone of robust security architecture.

Question 52: A company operating in the EU and US must align its data transfer practices with which mechanism that governs cross-border personal data transfers post-Privacy Shield?

COPPA
CCPA
EU-US Data Privacy Framework (Correct answer)
Safe Harbor Framework

Correct answer: EU-US Data Privacy Framework

The EU-US Data Privacy Framework (2023) replaced Privacy Shield and provides the legal mechanism for transatlantic personal data transfers under GDPR.

Question 53: An organization requires that two administrators must simultaneously approve any changes to firewall rules. This is an example of which control?

Defense in depth
Need to know
Dual control (Correct answer)
Least privilege

Correct answer: Dual control

Dual control requires two authorized individuals to act together, preventing unilateral changes to critical systems.

Question 54: Which statement BEST describes the relationship between Security Operations and Administration certification and industry evolution?

Requirements evolve periodically to reflect advances in knowledge and practice (Correct answer)
Requirements become less stringent over time
Certification requirements never change
Changes only occur when government mandates them

Correct answer: Requirements evolve periodically to reflect advances in knowledge and practice

Certification requirements evolve to keep pace with professional and technological advances.

Question 55: Which foundational principle is MOST important for Security Operations and Administration success?

Narrow specialization only
Minimum certification requirements
Maximizing financial returns
Continuous learning, ethical practice, and quality outcomes (Correct answer)

Correct answer: Continuous learning, ethical practice, and quality outcomes

Success requires learning, ethics, and quality focus.

Question 56: What distinguishes a Security Operations and Administration certified professional from a non-certified practitioner?

There is no meaningful difference
Certification validates competency through standardized assessment against benchmarks (Correct answer)
Certified professionals only work in larger organizations
Certified professionals always have more experience

Correct answer: Certification validates competency through standardized assessment against benchmarks

Certification provides objective validation of competency through standardized assessment.

Question 57: In the context of risk management, what does 'risk appetite' mean?

The residual risk remaining after controls are applied
The cost of implementing all available security controls
The total amount of risk an organization is willing to accept in pursuit of its objectives (Correct answer)
The maximum possible loss an organization could suffer

Correct answer: The total amount of risk an organization is willing to accept in pursuit of its objectives

Risk appetite is the board-level statement of how much risk the organization is willing to tolerate while pursuing its strategic goals.

Question 58: During a Business Impact Analysis (BIA), the team identifies that a system must be restored within 4 hours after a disaster. This 4-hour window is called the:

Mean Time to Repair (MTTR)
Recovery Point Objective (RPO)
Recovery Time Objective (RTO) (Correct answer)
Maximum Tolerable Downtime (MTD)

Correct answer: Recovery Time Objective (RTO)

The Recovery Time Objective (RTO) defines the maximum acceptable time to restore a system or process after a disruption.

Question 59: In a Kerberos authentication flow, what does the Ticket Granting Ticket (TGT) allow a user to do?

Store user credentials on the local workstation
Request service tickets without re-entering their password (Correct answer)
Authenticate directly to application servers
Decrypt messages encrypted with the KDC's public key

Correct answer: Request service tickets without re-entering their password

The TGT is used to obtain service tickets from the Key Distribution Center without requiring the user's password again.

Question 60: What distinguishes a Security Operations and Administration certified professional from non-certified practitioners?

Validated competency through standardized assessment (Correct answer)
Only works in large organizations
No meaningful difference
More experience always

Correct answer: Validated competency through standardized assessment

Certification provides objective validation through standardized assessment.

Question 61: Which foundational principle is MOST important for Security Operations and Administration success?

Narrow specialization only
Maximizing financial returns
Continuous learning, ethical practice, and quality outcomes (Correct answer)
Minimum certification requirements

Correct answer: Continuous learning, ethical practice, and quality outcomes

Success requires learning, ethics, and quality focus.

Question 62: In the context of patch management, what does 'patch prioritization' primarily consider?

The number of users affected by the patch
The vendor releasing the patch
The severity of the vulnerability and asset criticality (Correct answer)
The size of the patch file

Correct answer: The severity of the vulnerability and asset criticality

Patch prioritization weighs the CVSS severity score of the vulnerability against the criticality of the affected asset to determine remediation order.

Question 63: When implementing a security monitoring strategy, what does 'defense in depth' mean for logging?

Collecting logs from multiple layers including network, host, and application (Correct answer)
Encrypting logs with multiple algorithms
Storing all logs on a single hardened server
Requiring dual analyst approval for log deletion

Correct answer: Collecting logs from multiple layers including network, host, and application

Defense in depth in logging means collecting telemetry from network, host, and application layers to ensure comprehensive visibility.

Question 64: A security administrator wants to ensure that no single employee can both initiate and approve a financial transaction. Which principle does this enforce?

Need to know
Separation of duties (Correct answer)
Least privilege
Defense in depth

Correct answer: Separation of duties

Separation of duties requires that critical tasks be split among multiple people to prevent fraud or error.

Question 65: Which document outlines the process for responding to security incidents?

Financial audit summary.
Organizational chart.
Incident response plan (Correct answer)
Vacation policy.

Correct answer: Incident response plan

An incident response plan is a critical document that details the systematic process an organization will follow when a security incident occurs. It outlines steps for detection, analysis, containment, eradication, recovery, and post-incident review. Having a well-defined plan ensures a coordinated, efficient, and effective response, minimizing damage, recovery time, and overall impact on the organization.

Question 66: Which technique do attackers use to avoid detection by IDS/IPS systems through packet fragmentation?

Pass-the-hash
Session splicing (Correct answer)
SQL injection
ARP poisoning

Correct answer: Session splicing

Session splicing splits attack payloads across multiple small TCP segments, hoping the IDS fails to reassemble them for inspection.

Question 67: Which foundational principle is MOST important for Security Operations and Administration success?

Narrow specialization only
Minimum certification requirements
Maximizing financial returns
Continuous learning, ethical practice, and quality outcomes (Correct answer)

Correct answer: Continuous learning, ethical practice, and quality outcomes

Success requires learning, ethics, and quality focus.

Question 68: A security analyst receives an alert that a workstation is beaconing to a known C2 IP every 60 seconds. The FIRST containment action should be to:

Block the C2 IP at the firewall only
Notify law enforcement before taking any action
Isolate the host from the network while preserving volatile memory (Correct answer)
Reimage the workstation immediately

Correct answer: Isolate the host from the network while preserving volatile memory

Network isolation stops ongoing exfiltration while preserving volatile memory (running processes, connections) critical for forensic analysis.

Question 69: How does the SSCP body of knowledge relate to daily practice?

Theoretical only
Only for exams
Provides the framework guiding decisions and standard practices (Correct answer)
Only for research

Correct answer: Provides the framework guiding decisions and standard practices

The body of knowledge guides daily decision-making.

Question 70: What distinguishes a Security Operations and Administration certified professional from non-certified practitioners?

Only works in large organizations
Validated competency through standardized assessment (Correct answer)
More experience always
No meaningful difference

Correct answer: Validated competency through standardized assessment

Certification provides objective validation through standardized assessment.

Question 71: How do Security Operations and Administration certification requirements relate to industry evolution?

Become less stringent
Evolve periodically to reflect advances in knowledge and practice (Correct answer)
Never change
Only change by government mandate

Correct answer: Evolve periodically to reflect advances in knowledge and practice

Requirements evolve to keep pace with professional and technological advances.

Question 72: How do Security Operations and Administration certification requirements relate to industry evolution?

Never change
Only change by government mandate
Evolve periodically to reflect advances in knowledge and practice (Correct answer)
Become less stringent

Correct answer: Evolve periodically to reflect advances in knowledge and practice

Requirements evolve to keep pace with professional and technological advances.

Question 73: In public key infrastructure (PKI), what role does a Certificate Authority (CA) serve in identity management?

It issues and signs digital certificates that bind a public key to an identity (Correct answer)
It generates private keys for all users
It stores user passwords in a hashed format
It manages access control lists for network resources

Correct answer: It issues and signs digital certificates that bind a public key to an identity

A CA vouches for the identity of certificate holders by digitally signing certificates that bind public keys to identities.

Question 74: Which authentication factor category does a retinal scan belong to?

Somewhere you are
Something you have
Something you are (Correct answer)
Something you know

Correct answer: Something you are

Biometric identifiers like retinal scans fall under 'something you are' authentication factors.

Question 75: How does the SSCP body of knowledge relate to daily practice?

Only for research
Theoretical only
Provides the framework guiding decisions and standard practices (Correct answer)
Only for exams

Correct answer: Provides the framework guiding decisions and standard practices

The body of knowledge guides daily decision-making.

Question 76: When implementing RBAC, which process involves defining and organizing job functions and their corresponding access permissions?

Role engineering (Correct answer)
Access recertification
Identity federation
Privilege escalation

Correct answer: Role engineering

Role engineering is the process of defining roles, determining what access each role requires, and mapping users to appropriate roles.

Question 77: When documenting SSCP assessment findings, which approach is MOST appropriate?

Use expert-only jargon
Include only positive findings
Record objective findings and observations factually (Correct answer)
Summarize verbally only

Correct answer: Record objective findings and observations factually

Objective, factual documentation supports decision-making and scrutiny.

Question 78: When a user is granted the minimum access rights needed to perform their job, which security principle is being applied?

Defense in depth
Separation of duties
Least privilege (Correct answer)
Zero trust

Correct answer: Least privilege

The principle of least privilege limits user access to only what is necessary for their role, reducing exposure.

Question 79: Which eradication step specifically addresses removing attacker-installed scheduled tasks, cron jobs, or startup scripts?

Removing persistence mechanisms (Correct answer)
Rotating all service account credentials
Patching the exploited vulnerability
Rebuilding the OS from scratch

Correct answer: Removing persistence mechanisms

Attackers establish persistence through scheduled tasks, registry run keys, or cron jobs; explicitly hunting and removing these ensures the threat doesn't survive a reboot.

Question 80: A security manager wants to calculate the probability that a specific threat will occur within a given year. Which metric does this represent?

Exposure Factor (EF)
Single Loss Expectancy (SLE)
Annualized Loss Expectancy (ALE)
Annualized Rate of Occurrence (ARO) (Correct answer)

Correct answer: Annualized Rate of Occurrence (ARO)

ARO expresses how often a specific threat is expected to materialize in a 12-month period.

Question 81: A Recovery Time Objective (RTO) of four hours means the organization must:

Complete forensic analysis within four hours
Retain logs for four hours before deletion
Restore systems and resume operations within four hours of a disruption (Correct answer)
Back up data every four hours

Correct answer: Restore systems and resume operations within four hours of a disruption

RTO defines the maximum acceptable downtime; a four-hour RTO means business functions must be restored within four hours of an incident or disaster.

Question 82: Which control framework specifically addresses security requirements for US federal information systems and is mandated by law?

FISMA / NIST SP 800-53 (Correct answer)
SOC 2
ISO 27001
PCI DSS

Correct answer: FISMA / NIST SP 800-53

FISMA (Federal Information Security Modernization Act) mandates that federal agencies implement security controls defined in NIST SP 800-53.

Question 83: Which of the following is a key component of a risk management plan?

Risk identification and mitigation strategies (Correct answer)
Employee vacation schedules.
Sales forecasts.
Office layout design.

Correct answer: Risk identification and mitigation strategies

A comprehensive risk management plan systematically identifies potential risks to an organization's assets, operations, and reputation. Crucially, it also outlines specific strategies and controls to mitigate these identified risks, reducing their likelihood or impact. This proactive approach ensures that the organization is prepared to address potential security challenges effectively and maintain business continuity.

Question 84: How do Security Operations and Administration certification requirements relate to industry evolution?

Only change by government mandate
Become less stringent
Never change
Evolve periodically to reflect advances in knowledge and practice (Correct answer)

Correct answer: Evolve periodically to reflect advances in knowledge and practice

Requirements evolve to keep pace with professional and technological advances.

Question 85: Which of the following is an example of physical access control?

Firewall configuration.
Password policy.
Encryption software.
Security badge system (Correct answer)

Correct answer: Security badge system

Physical access control refers to security measures that restrict physical entry to buildings, rooms, or specific areas. A security badge system is a direct example, as it requires a physical credential to unlock doors or gates, thereby controlling who can physically enter a restricted space. Other options like password policies or firewalls are forms of logical or technical access control.

Question 86: Which of the following best describes a federated identity management system?

A biometric system used across multiple organizations
A single server that authenticates all users for all applications
A system where each application maintains its own user directory
A framework that allows identity information to be shared across different security domains (Correct answer)

Correct answer: A framework that allows identity information to be shared across different security domains

Federated identity management enables trusted identity sharing across organizational boundaries using standards like SAML or OpenID.

Question 87: In a secure SDLC, during which phase should threat modeling ideally occur?

Maintenance
Testing
Design (Correct answer)
Deployment

Correct answer: Design

Threat modeling during the design phase identifies potential threats and security requirements early, when changes are least costly to implement.

Question 88: Which ISO 27001 document establishes the scope, objectives, and policies of an organization's information security management system?

Statement of Applicability
Asset Inventory
Information Security Policy (Correct answer)
Risk Treatment Plan

Correct answer: Information Security Policy

The Information Security Policy sets top-level direction and commitment from management for the ISMS, defining scope and objectives.

Question 89: During an ISO 27001 surveillance audit, the auditor identifies a control that was previously certified but is now missing evidence of operation. This would MOST likely result in:

Immediate certificate revocation
An observation with no formal follow-up required
A major nonconformity requiring corrective action within a defined timeframe (Correct answer)
A minor nonconformity noted in the audit report

Correct answer: A major nonconformity requiring corrective action within a defined timeframe

A control that existed but lacks operational evidence is a major nonconformity that requires documented corrective action within a specified period.

Question 90: What is 'input validation' in the context of application security?

Logging all user inputs for audit purposes
Ensuring data entered by users meets expected format and type before processing (Correct answer)
Verifying user credentials before granting access
Encrypting user-submitted data in transit

Correct answer: Ensuring data entered by users meets expected format and type before processing

Input validation checks that user-supplied data conforms to expected formats, preventing injection attacks and other input-based vulnerabilities.

Question 91: Which type of alert indicates a true security incident?

False negative
False positive
True positive (Correct answer)
True negative

Correct answer: True positive

In security monitoring, a true positive alert accurately indicates that a genuine security incident or threat has occurred. This means the detection system correctly identified a malicious activity that warrants immediate investigation and response. Recognizing true positives is crucial for prioritizing alerts and effectively allocating resources to address real security risks, preventing potential damage.

Question 92: A security policy review committee recommends retiring an outdated password complexity policy in favor of NIST SP 800-63B guidance on passphrases. What process formalizes this change?

A change management and policy update process with management approval (Correct answer)
A configuration management database update
An emergency incident response process
A vulnerability disclosure process

Correct answer: A change management and policy update process with management approval

Policy changes must go through a formal change management process, including review, approval, version control, and communication to affected parties.

Question 93: What is the term for an attack where an adversary intercepts an authentication session token to gain unauthorized access?

Brute force attack
Credential stuffing
Replay attack
Session hijacking (Correct answer)

Correct answer: Session hijacking

Session hijacking involves stealing a valid session token to impersonate an authenticated user.

Question 94: The concept of 'separation of duties' in an audit context is designed primarily to prevent:

Insecure software development
Unauthorized network access
Single-person fraud or error going undetected (Correct answer)
Weak encryption implementation

Correct answer: Single-person fraud or error going undetected

Separation of duties ensures no single individual can complete a sensitive process alone, reducing the risk of undetected fraud or error.

Question 95: How often should compliance audits be performed?

Whenever the company changes CEO.
Annually or as required by regulations (Correct answer)
Only after a security incident.
Every ten years.

Correct answer: Annually or as required by regulations

The frequency of compliance audits depends on various factors, including regulatory requirements, industry standards, organizational risk appetite, and internal policies. Many regulations mandate annual audits (e.g., HIPAA, PCI DSS), but some high-risk areas might require more frequent reviews. Regular audits ensure ongoing adherence and timely identification of non-compliance.

Question 96: What is the primary purpose of a Privileged Identity Management (PIM) solution?

To enforce multi-factor authentication on standard user accounts
To store encrypted credentials in a shared team vault
To replace passwords with biometric authentication for all users
To monitor, control, and audit the use of privileged accounts (Correct answer)

Correct answer: To monitor, control, and audit the use of privileged accounts

PIM solutions manage and monitor privileged accounts to reduce risk from misuse of administrative credentials.

Question 97: When Security Operations and Administration assessment results are inconclusive, the BEST practice is to:

Report as definitive
Conduct additional assessment using alternative methods (Correct answer)
Discard and start over
Delay until favorable

Correct answer: Conduct additional assessment using alternative methods

Alternative methods help triangulate and clarify findings.

Question 98: What is the PRIMARY purpose of SSCP certification in Security Operations and Administration?

Personal achievement
Demonstrating verified competency and professional standards adherence (Correct answer)
Bypassing education
Guaranteeing employment

Correct answer: Demonstrating verified competency and professional standards adherence

Certification demonstrates verified competency to employers and the public.

Question 99: How does identity federation work?

By blocking all federated logins.
By sharing identity information across trusted domains (Correct answer)
By creating duplicate accounts for each system.
By disabling external access.

Correct answer: By sharing identity information across trusted domains

Identity federation allows users to use a single set of credentials to access multiple applications or services across different security domains without having to re-authenticate for each one. This is achieved by establishing trust relationships between identity providers and service providers, enabling the secure exchange of authentication and authorization information. It enhances user convenience and reduces administrative overhead.

Question 100: What is the MOST effective way for new SSCP professionals to build competency?

Combine formal education, mentored practice, and ongoing development (Correct answer)
Trial and error
Study materials exclusively
Focus only on advanced topics

Correct answer: Combine formal education, mentored practice, and ongoing development

Multiple complementary approaches build comprehensive competency.

Question 101: How do organizations benefit from a formal risk management framework?

By increasing entertainment budget.
By enabling consistent and proactive risk handling (Correct answer)
By minimizing staff involvement.
By outsourcing IT entirely.

Correct answer: By enabling consistent and proactive risk handling

A formal risk management framework provides a structured and systematic approach to identifying, assessing, mitigating, and monitoring risks across an organization. This consistency ensures that risks are handled uniformly and proactively, rather than reactively. It leads to more effective resource allocation, better decision-making, and an improved overall security posture, enhancing organizational resilience.

Question 102: Which artifact would BEST help an analyst determine if a Windows system has been compromised by a fileless malware attack?

Windows PowerShell script block logging and memory dumps (Correct answer)
Network packet captures of HTTP traffic
Antivirus scan of the C: drive
File system hash comparison

Correct answer: Windows PowerShell script block logging and memory dumps

Fileless malware operates in memory, so PowerShell script block logs and memory forensics are the most effective investigative artifacts.

Question 103: Which provisioning process should be immediately triggered when an employee is terminated?

Account deprovisioning (Correct answer)
Account review
Privilege escalation audit
Access recertification

Correct answer: Account deprovisioning

Deprovisioning immediately disables or removes a terminated employee's accounts to prevent unauthorized access.

Question 104: An organization experiences a DDoS attack that overwhelms its upstream bandwidth. Which mitigation technique routes attack traffic through a scrubbing center before delivering clean traffic?

Traffic scrubbing / cloud DDoS mitigation (Correct answer)
Anycast diffusion
Rate limiting at the perimeter firewall
BGP blackholing

Correct answer: Traffic scrubbing / cloud DDoS mitigation

Cloud scrubbing services absorb and filter malicious DDoS traffic upstream, forwarding only legitimate packets to the origin infrastructure.

Question 105: The NIST Cybersecurity Framework's 'Identify' function primarily focuses on:

Containing security incidents
Recovering normal operations
Developing organizational understanding of cybersecurity risk (Correct answer)
Detecting anomalous events

Correct answer: Developing organizational understanding of cybersecurity risk

The Identify function helps organizations develop understanding of their assets, risks, and governance to manage cybersecurity risk.

Question 106: Which document formally authorizes an incident response team to investigate a suspected security breach on production systems?

Chain of custody form
Risk register entry
Rules of engagement or authorization memo (Correct answer)
Business continuity plan

Correct answer: Rules of engagement or authorization memo

Rules of engagement or an authorization memo grant the IR team legal permission to access and investigate systems without being liable for unauthorized access.

Question 107: What is MOST important when selecting assessment tools for SSCP work?

Personal familiarity
Validity, reliability, and contextual appropriateness (Correct answer)
Tool cost
Speed of administration

Correct answer: Validity, reliability, and contextual appropriateness

Validity, reliability, and appropriateness ensure quality outcomes.

Question 108: Which foundational principle is MOST important for success in Security Operations and Administration?

Specializing in only one narrow area
Maximizing financial returns
Maintaining minimum certification requirements
Commitment to continuous learning, ethical practice, and quality outcomes (Correct answer)

Correct answer: Commitment to continuous learning, ethical practice, and quality outcomes

Success requires continuous learning, ethical practice, and focus on quality outcomes.

Question 109: An analyst notices that a server is making DNS requests to randomly generated domain names at regular intervals. This behavior most likely indicates:

A misconfigured DNS resolver
IPv6 transition tunneling
Normal software update activity
Domain Generation Algorithm (DGA) malware (Correct answer)

Correct answer: Domain Generation Algorithm (DGA) malware

DGA malware generates random domain names to communicate with command-and-control servers, evading static blocklists.

Question 110: Which IR concept describes the practice of preemptively searching through networks and endpoints for hidden threats before alerts fire?

Threat hunting (Correct answer)
Vulnerability scanning
Incident triage
Log correlation

Correct answer: Threat hunting

Threat hunting is a proactive, human-driven process of seeking indicators of compromise that evaded automated detection, rather than waiting for SIEM alerts.

Question 111: What is the MOST effective way for new SSCP professionals to build competency?

Focusing solely on advanced topics
Combining formal education, mentored practice, and ongoing professional development (Correct answer)
Studying certification materials exclusively
Learning through trial and error

Correct answer: Combining formal education, mentored practice, and ongoing professional development

Building competency requires formal education, mentored practice, and ongoing development.

Question 112: What does 'defense in depth' mean in the context of systems security?

Conducting thorough security testing before any system goes live
Placing the most sensitive data in the innermost network segment
Using the deepest available encryption algorithms
Applying multiple overlapping security controls so no single failure compromises the system (Correct answer)

Correct answer: Applying multiple overlapping security controls so no single failure compromises the system

Defense in depth layers multiple independent security controls so that if one layer fails, others continue to protect the system.

Question 113: Which type of malware disguises itself as legitimate software to trick users into installing it?

Rootkit
Ransomware
Worm
Trojan horse (Correct answer)

Correct answer: Trojan horse

A Trojan horse masquerades as benign or useful software, but delivers a malicious payload once executed by an unsuspecting user.

Question 114: What distinguishes a Security Operations and Administration certified professional from non-certified practitioners?

Validated competency through standardized assessment (Correct answer)
More experience always
Only works in large organizations
No meaningful difference

Correct answer: Validated competency through standardized assessment

Certification provides objective validation through standardized assessment.

Question 115: A forensic investigator uses write blockers when imaging a hard drive primarily to:

Prevent modification of evidence on the source drive (Correct answer)
Encrypt the forensic image automatically
Validate the hash of the destination media
Speed up the imaging process

Correct answer: Prevent modification of evidence on the source drive

Write blockers are hardware or software controls that ensure no data is written back to the evidence drive, preserving its original state for legal admissibility.

Question 116: What is the MOST effective way for new SSCP professionals to build competency?

Study materials exclusively
Combine formal education, mentored practice, and ongoing development (Correct answer)
Focus only on advanced topics
Trial and error

Correct answer: Combine formal education, mentored practice, and ongoing development

Multiple complementary approaches build comprehensive competency.

Question 117: What is the PRIMARY purpose of SSCP certification in Security Operations and Administration?

Demonstrating verified competency and professional standards adherence (Correct answer)
Guaranteeing employment
Personal achievement
Bypassing education

Correct answer: Demonstrating verified competency and professional standards adherence

Certification demonstrates verified competency to employers and the public.

Question 118: During a ransomware incident, the IR team must decide whether to restore from backup or pay the ransom. Which factor most directly drives this decision?

Attacker's known identity
Age and integrity of available backups (Correct answer)
Cost of the ransom payment
Number of systems encrypted

Correct answer: Age and integrity of available backups

The viability, recency, and tested integrity of backups determines whether restoration is feasible and faster than negotiating a ransom.

Question 119: What is the goal of access control in information security?

To protect sensitive data from unauthorized access (Correct answer)
To increase website traffic.
To promote user sharing of credentials.
To slow down network access.

Correct answer: To protect sensitive data from unauthorized access

Access control is a fundamental security mechanism designed to regulate who or what can view or use resources within an information system. Its primary goal is to enforce policies that ensure only authorized individuals or systems can interact with sensitive data. This prevents unauthorized access, maintaining the confidentiality, integrity, and availability of information.

Question 120: Which log source is most critical for detecting lateral movement within a Windows environment?

Windows Security Event logs (Event ID 4624/4625) (Correct answer)
DHCP lease logs
Firewall egress logs
Web server access logs

Correct answer: Windows Security Event logs (Event ID 4624/4625)

Windows Security Event logs record logon successes and failures (4624/4625), enabling detection of credential-based lateral movement.

Question 121: How does the SSCP body of knowledge relate to daily practice?

Provides the framework guiding decisions and standard practices (Correct answer)
Theoretical only
Only for research
Only for exams

Correct answer: Provides the framework guiding decisions and standard practices

The body of knowledge guides daily decision-making.

Question 122: A user requests access to a sensitive system, and the system automatically routes the request to the user's manager for approval before granting access. This is part of which process?

Role engineering
Just-in-time provisioning
Access request and approval workflow (Correct answer)
Access recertification

Correct answer: Access request and approval workflow

Access request and approval workflows ensure that access grants are reviewed and authorized by appropriate personnel before being applied.

Question 123: What type of control is a mandatory vacation policy primarily designed to support?

Deterrent control
Preventive control
Corrective control
Detective control (Correct answer)

Correct answer: Detective control

Mandatory vacation is a detective control because it creates opportunities to uncover fraud or irregularities that may be concealed by a single employee staying on the job.

Question 124: Which type of access control list (ACL) entry explicitly denies access to a specific user, overriding any other permissions?

Deny ACE (Correct answer)
Allow ACE
Inherited ACE
Audit ACE

Correct answer: Deny ACE

A Deny ACE explicitly blocks access for a specified user or group, and in most systems deny rules take precedence over allow rules.

Systems Security Certified Practitioner (SSCP)

The SSCP certification validates the advanced technical skills and knowledge to implement, monitor, and administer IT infrastructure in accordance with information security policies and procedures.

125

Questions

180 min

Time Limit

700%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds