Systems Security Certified Practitioner (SSCP)

Last checked October 22, 2026 against the official ISC2 exam page.

1. Question 1Systems and Application Security

   Which control most directly reduces the risk that a vulnerable application component is exploited in production?

   1. ARunning the component as the root user, so that updates do not fail due to missing permissions on the system during patching
   2. BHiding the version of each component from the scanner by changing server headers to generic values only, so it is harder to find
   3. CTurning off all logging, so that attackers cannot see which components are installed on the systems that they try to target
   4. DPatch management, with tested updates applied on a schedule and prioritised by the severity and exposure of each vulnerability
   Show answer and explanationHide answer

   Correct answer: D

   Patch management with prioritised, tested updates removes known vulnerabilities from production. Hiding versions, disabling logs and running as root do not fix the vulnerability, and some of them weaken security further.

2. Question 2Security Concepts and Practices

   Which security principle requires that no single individual can complete a sensitive transaction alone?

   1. ADefence in depth, which layers several independent controls so that the failure of one control does not expose the asset
   2. BLeast privilege, which gives each user only the access needed to perform the assigned job function and nothing more
   3. CNeed to know, which restricts information to those who have a specific operational reason to see it for their work
   4. DSeparation of duties, which divides a sensitive process among several people so that no one person controls every step
   Show answer and explanationHide answer

   Correct answer: D

   Separation of duties makes at least two people responsible for a critical process, which prevents one person from committing and concealing fraud. Least privilege, need to know and defence in depth are valuable principles but do not require several people to take part in a transaction.

3. Question 3Access Controls

   Which access control model enforces access decisions using labels on resources and clearance levels held by subjects, under a central policy?

   1. ARole-based access control, where access depends on the job role a user holds, rather than on labels or clearance levels
   2. BDiscretionary access control, where the owner of each resource decides who may access it and at what level of permission
   3. CMandatory access control, where a central policy assigns labels and clearances, and users cannot change the access decisions
   4. DAttribute-based access control alone, which grants access by the time of day and the device type that each request uses
   Show answer and explanationHide answer

   Correct answer: C

   Mandatory access control uses labels and clearances enforced by a central policy that users cannot override. Discretionary, role-based and attribute-based models decide access differently and do not rely on labels and clearances in this way.

4. Question 4Risk Identification, Monitoring and Analysis

   Which step in a risk assessment estimates the damage to the business if a threat successfully exploits a vulnerability?

   1. AAsset inventory, which lists the hardware and software that the organisation owns and records where each item is located
   2. BImpact analysis, which estimates the damage to the business if an identified threat successfully exploits a vulnerability
   3. CVulnerability scanning, which identifies the weaknesses present in the systems and applications across the network
   4. DPenetration testing, which attempts to exploit systems to show that the weaknesses found are real and reachable by an attacker
   Show answer and explanationHide answer

   Correct answer: B

   Impact analysis estimates the business damage from a successful exploit, and that estimate is combined with likelihood to rate the risk. Inventories, scans and penetration tests identify assets or weaknesses rather than estimating the impact.

5. Question 5Incident Response and Recovery

   Which phase of incident response comes after detection and before recovery?

   1. AContainment, eradication and analysis, which limit the spread of the incident and remove the attacker's access before recovery
   2. BPreparation, which builds the plans, tools and training that the team needs before any incident occurs in the environment
   3. CLessons learned, which reviews the incident after recovery is complete so that controls can be improved for the future
   4. DIdentification of the vendor, which determines which supplier's product was involved in the attack on the systems
   Show answer and explanationHide answer

   Correct answer: A

   After detection, containment limits spread and eradication removes the attacker's access before recovery begins. Preparation comes before detection, lessons learned come after recovery, and vendor identification is not a standard phase of response.