CertArea
All ISC2 exams

Free Systems Security Certified Practitioner (SSCP) practice test: 30 questions with answers

30 original questions for Systems Security Certified Practitioner (SSCP), drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
112 questions

Systems Security Certified Practitioner (SSCP) exam guide: topics, cost and format

All 30 Systems Security Certified Practitioner (SSCP) questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Systems and Application Security (5 questions)

  1. Question 1

    Which control most directly reduces the risk that a vulnerable application component is exploited in production?

    1. ARunning the component as the root user, so that updates do not fail due to missing permissions on the system during patching
    2. BHiding the version of each component from the scanner by changing server headers to generic values only, so it is harder to find
    3. CTurning off all logging, so that attackers cannot see which components are installed on the systems that they try to target
    4. DPatch management, with tested updates applied on a schedule and prioritised by the severity and exposure of each vulnerability
    Show answer and explanation
    Correct answer: D

    Patch management with prioritised, tested updates removes known vulnerabilities from production. Hiding versions, disabling logs and running as root do not fix the vulnerability, and some of them weaken security further.

  2. Question 2

    Which approach best keeps server configurations secure over time?

    1. AA manual checklist completed once when the server is first installed, after which no changes are ever reviewed again by staff
    2. BA hardened baseline image with configuration management that detects and corrects drift away from the baseline settings
    3. CAllowing each administrator to choose their own settings, which gives the team the flexibility to tune every server individually
    4. DLeaving the vendor's default settings in place, since the defaults are considered secure for any server in any network
    Show answer and explanation
    Correct answer: B

    A hardened baseline with configuration management keeps servers consistent and reports drift when settings change. One-off checklists, personal settings and vendor defaults do not hold a secure state over time.

  3. Question 3

    Which control stops a web application from running injected script in a user's browser?

    1. AOutput encoding for each context where user data is displayed, combined with a content security policy for the page
    2. BDisabling cookie storage for the application, which prevents scripts from reading any user data held by the browser at all
    3. CMaking the input fields longer, so that an attacker has more room to write a complete script in a single request
    4. DUsing a shared administrator password for the web server, which prevents users from entering any data into the pages
    Show answer and explanation
    Correct answer: A

    Context-aware output encoding stops injected data from executing as script, and a content security policy limits what scripts the browser will run. The other options do not address script injection.

  4. Question 4

    Which control best protects sensitive database contents if an intruder has already reached the database server?

    1. ATurning off the database's query logs, which hides the queries that the intruder runs against the data held in the database
    2. BA firewall rule that allows only the database port, which does nothing once the intruder is already on the server itself
    3. CA password on the database administrator's account, which the intruder can read from the server's configuration files easily
    4. DEncryption of the data at rest with keys held in a separate key management system, so the stolen files are unreadable
    Show answer and explanation
    Correct answer: D

    Encrypting data at rest with keys held elsewhere protects stolen files even when an intruder has reached the server. Firewalls, server-side passwords and disabling logs do not stop an intruder who already has access to the data.

  5. Question 5

    Which two controls protect systems against malware that arrives on removable media? (Choose two.)

    1. ADevice control policies that restrict removable media so that only approved devices can be connected to the systems
    2. BScanning each removable device with an endpoint protection agent on connection, before any file on it is opened
    3. CTurning on autorun for all removable devices so that approved tools start automatically whenever a device connects
    4. DAllowing any USB device to connect without checks, since the users have been trained to recognise the unsafe devices
    5. EKeeping the sensitive files only on removable media, so that the systems hold no data that malware could reach at all
    Show answer and explanation
    Correct answer: A, B

    Device control and on-connect scanning both limit what can enter a system from removable media. Autorun, unchecked devices and storing sensitive data on removable media each increase the chance of infection or loss.

Security Concepts and Practices (5 questions)

  1. Question 6

    Which security principle requires that no single individual can complete a sensitive transaction alone?

    1. ADefence in depth, which layers several independent controls so that the failure of one control does not expose the asset
    2. BLeast privilege, which gives each user only the access needed to perform the assigned job function and nothing more
    3. CNeed to know, which restricts information to those who have a specific operational reason to see it for their work
    4. DSeparation of duties, which divides a sensitive process among several people so that no one person controls every step
    Show answer and explanation
    Correct answer: D

    Separation of duties makes at least two people responsible for a critical process, which prevents one person from committing and concealing fraud. Least privilege, need to know and defence in depth are valuable principles but do not require several people to take part in a transaction.

  2. Question 7

    Which document type gives the ordered steps that staff follow to complete a specific security task?

    1. AA policy, which states management's high-level intent and the rules that apply to the organisation as a whole in general terms
    2. BA procedure, which gives the ordered steps that staff follow to complete a specific security task correctly each time
    3. CA guideline, which suggests good practice without making its recommendations mandatory for any team or any system at all
    4. DA baseline, which records the minimum configuration that every system of a given type must meet before it is put into use
    Show answer and explanation
    Correct answer: B

    A procedure is the step-by-step document for carrying out a task. A policy states intent, guidelines are advisory, and baselines set minimum configurations, so none of the others gives the ordered steps for a task.

  3. Question 8

    An unauthorised person reads confidential payroll data. Which element of the CIA triad is violated?

    1. AIntegrity, which protects data from unauthorised change and keeps the data accurate and complete over its life
    2. BConfidentiality, which limits access to information to the parties that are authorised to see it
    3. CAvailability, which ensures that systems and data are accessible to authorised users at the times they require them
    4. DAccountability, which ensures that actions on a system can be traced to the identity that performed them during the period
    Show answer and explanation
    Correct answer: B

    Reading confidential data without authorisation breaches confidentiality. Integrity concerns unauthorised change, availability concerns access when needed, and accountability concerns tracing actions to a person.

  4. Question 9

    Which two options are recognised risk treatment choices? (Choose two.)

    1. AMitigate the risk by adding controls that reduce its likelihood or its impact on the business if it occurs
    2. BTransfer the risk to an insurer or a third party through a contract or a suitable insurance policy for the exposure
    3. CIgnore the risk entirely and do not record it in the risk register, so that the register stays short and manageable
    4. DPublish the details of the risk publicly, so that customers can decide for themselves how they want to respond to it
    5. EAssume the risk will never happen, because the organisation has recorded no incidents of that type in the past years
    Show answer and explanation
    Correct answer: A, B

    Mitigation and transfer are two of the standard risk treatment options, alongside acceptance and avoidance. Ignoring a risk without recording it, publishing risk details and assuming an event will not happen are not treatment options.

  5. Question 10

    Which control confirms that a person is who they claim to be before any access decision is made?

    1. AAuthorisation, which decides which resources an already authenticated identity is allowed to use after the sign-in succeeds
    2. BAuthentication, which verifies the identity of a user or device through a factor such as a password or a hardware token
    3. CAccounting, which records the actions a user performed on the systems during each session so that the records can be reviewed
    4. DLog auditing, which reviews the records after the events have taken place to find irregularities in the activity recorded
    Show answer and explanation
    Correct answer: B

    Authentication verifies identity before access decisions are made. Authorisation decides what an authenticated identity may do, accounting records activity, and log auditing reviews events after they happen.

Access Controls (4 questions)

  1. Question 11

    Which access control model enforces access decisions using labels on resources and clearance levels held by subjects, under a central policy?

    1. ARole-based access control, where access depends on the job role a user holds, rather than on labels or clearance levels
    2. BDiscretionary access control, where the owner of each resource decides who may access it and at what level of permission
    3. CMandatory access control, where a central policy assigns labels and clearances, and users cannot change the access decisions
    4. DAttribute-based access control alone, which grants access by the time of day and the device type that each request uses
    Show answer and explanation
    Correct answer: C

    Mandatory access control uses labels and clearances enforced by a central policy that users cannot override. Discretionary, role-based and attribute-based models decide access differently and do not rely on labels and clearances in this way.

  2. Question 12

    An employee has left the company. Which access control action should happen first?

    1. AChange the user's password to a random string and email the new password to the user's manager so that access can be checked
    2. BLeave the accounts active for six months in case the person returns to a similar job later in the company's structure
    3. CDisable the user's accounts and revoke active sessions and tokens immediately, then remove the remaining access rights in the review
    4. DDelete the user's mailbox and files, which removes their access along with everything else that they had stored on the systems
    Show answer and explanation
    Correct answer: C

    Disabling accounts and revoking sessions and tokens cuts off access immediately, and removal of the remaining rights follows. Long dormant accounts, emailed passwords and deleted files either leave access open or destroy records that should be kept.

  3. Question 13

    A user receives a one-time code generated by an app on their phone at each sign-in. Which authentication factor type is this?

    1. ASomewhere you are, since the factor depends on a location check that confirms the user is inside an approved office area
    2. BSomething you are, since the factor depends on a biometric characteristic measured by a sensor on the device the user holds
    3. CSomething you know, since the factor depends on a secret that the user memorises and types in during each sign-in attempt
    4. DSomething you have, since the factor depends on a device or token that the user possesses and that generates the code
    Show answer and explanation
    Correct answer: D

    A code generated by a phone app is a possession factor, because the user holds the device that produces it. Biometrics, knowledge factors and location checks are different factor categories.

  4. Question 14

    Which practice most effectively prevents permission creep as users change roles over time?

    1. AAllowing users to grant themselves any permission they request, which saves time for the team during each change of role
    2. BGranting every new permission as a permanent addition, so that the user never loses access needed for a previous job role
    3. CSharing one administrator account among the team members, which avoids accumulating permissions on individual user accounts
    4. DPeriodic access reviews, in which managers confirm each user's rights and excess rights are removed when the user changes role
    Show answer and explanation
    Correct answer: D

    Periodic access reviews catch permission creep as roles change, and removing excess rights keeps access to the minimum needed. Adding permissions permanently, shared accounts and self-granting all increase the rights that accumulate.

Risk Identification, Monitoring and Analysis (4 questions)

  1. Question 15

    Which step in a risk assessment estimates the damage to the business if a threat successfully exploits a vulnerability?

    1. AAsset inventory, which lists the hardware and software that the organisation owns and records where each item is located
    2. BImpact analysis, which estimates the damage to the business if an identified threat successfully exploits a vulnerability
    3. CVulnerability scanning, which identifies the weaknesses present in the systems and applications across the network
    4. DPenetration testing, which attempts to exploit systems to show that the weaknesses found are real and reachable by an attacker
    Show answer and explanation
    Correct answer: B

    Impact analysis estimates the business damage from a successful exploit, and that estimate is combined with likelihood to rate the risk. Inventories, scans and penetration tests identify assets or weaknesses rather than estimating the impact.

  2. Question 16

    A monitoring tool reports unusual outbound traffic from a workstation. What is the first analytical step?

    1. ACompare the traffic with the workstation's normal baseline, and check the destination, timing and volume against threat indicators
    2. BShut the workstation down immediately, since any unusual traffic must be treated as an active data theft in progress
    3. CReboot the network switch that the workstation connects to, which clears any malware sessions that may be running on it
    4. DRemove the workstation from the asset register until the investigation is complete, since its record may no longer be reliable
    Show answer and explanation
    Correct answer: A

    Comparing the traffic with a baseline and checking destinations and volumes against threat indicators turns an alert into evidence. Shutting down, rebooting the switch and removing the asset record all destroy evidence or add disruption without any analysis.

  3. Question 17

    Which risk response keeps the residual risk after controls have been applied, and records that management has approved the decision?

    1. ARisk avoidance, where the activity that creates the risk is stopped so that the risk no longer applies to the organisation
    2. BRisk acceptance, where management knowingly keeps the residual risk within appetite and records the approval for it
    3. CRisk transfer, where an insurer or a contractor takes on the financial burden of the risk through a signed contract
    4. DRisk mitigation, where new controls are added each quarter to reduce the likelihood or the impact of the risk further
    Show answer and explanation
    Correct answer: B

    Risk acceptance is a documented decision to keep residual risk that falls within appetite. Avoidance stops the activity, transfer shifts the burden, and mitigation adds controls, so none of them describes accepting what remains.

  4. Question 18

    Which two factors are used to rate a risk in a qualitative risk assessment? (Choose two.)

    1. AThe likelihood of the threat exploiting the vulnerability within the period that the assessment covers
    2. BThe impact on the business if the exploit succeeds, measured in operational, financial or legal terms
    3. CThe colour of the risk register's cover page, which the team uses to group risks when presenting them to the board
    4. DThe number of meetings that were held about the risk during the quarter, which shows how much attention it received
    5. EThe name of the person who first reported the risk to the IT service desk when the report was first raised
    Show answer and explanation
    Correct answer: A, B

    Qualitative ratings combine likelihood and impact, which is why both drive the risk score. The cover colour, meeting counts and the name of the reporter do not change how serious the risk is.

Incident Response and Recovery (4 questions)

  1. Question 19

    Which phase of incident response comes after detection and before recovery?

    1. AContainment, eradication and analysis, which limit the spread of the incident and remove the attacker's access before recovery
    2. BPreparation, which builds the plans, tools and training that the team needs before any incident occurs in the environment
    3. CLessons learned, which reviews the incident after recovery is complete so that controls can be improved for the future
    4. DIdentification of the vendor, which determines which supplier's product was involved in the attack on the systems
    Show answer and explanation
    Correct answer: A

    After detection, containment limits spread and eradication removes the attacker's access before recovery begins. Preparation comes before detection, lessons learned come after recovery, and vendor identification is not a standard phase of response.

  2. Question 20

    Which forensic practice shows that collected evidence has not been altered since it was collected?

    1. ADefence in depth around the data store, which places several controls between an attacker and the evidence held there
    2. BLeast privilege for the investigators, which limits the access they have to the systems that they examine during the analysis
    3. CChain of custody with integrity checks such as hashing, which records each handler and shows that the evidence is unchanged
    4. DNetwork segmentation of the systems under investigation, which isolates them from the rest of the production environment
    Show answer and explanation
    Correct answer: C

    Chain of custody and hashing show that evidence is unchanged from collection onwards, which is needed for it to be admissible. Least privilege, defence in depth and segmentation are good practices but do not prove the integrity of collected evidence.

  3. Question 21

    Which metric shows how long an incident remains active before its spread is stopped?

    1. ARecovery point objective, which measures the maximum amount of data loss the organisation can accept after a failure occurs
    2. BMean time between failures, which measures the average operating time between failures of a component in the environment
    3. CMean time to contain, which measures the average time from the start of an incident to the moment its spread is stopped
    4. DService availability percentage, which measures the share of a period during which a service was working for its users
    Show answer and explanation
    Correct answer: C

    Mean time to contain measures how long incidents run before they are stopped, which tracks responsiveness. The other metrics describe hardware reliability, data loss tolerance and availability rather than containment time.

  4. Question 22

    Which two actions belong in the eradication phase after an intrusion? (Choose two.)

    1. ARemoving malware, backdoors and unauthorised accounts from the affected systems so that the attacker has no foothold left
    2. BResetting credentials that the attacker may have stolen, and revoking any tokens that the attacker could still use
    3. CPublishing the attacker's IP address on the public internet, so that other organisations can block it at their perimeter
    4. DDeleting the logs of the affected systems to remove traces of the attack before the post-incident review takes place
    5. EDeciding the date of the next company holiday party for the security team to attend after the incident has closed
    Show answer and explanation
    Correct answer: A, B

    Eradication removes the attacker's footholds, including malware, backdoors and accounts, and resets stolen credentials so they cannot be reused. Publishing IP addresses, deleting logs and social planning do not remove the intrusion and destroy or distract from the response.

Network and Communications Security (4 questions)

  1. Question 23

    Which firewall type inspects the content of a session and understands the protocol being used, rather than only addresses and ports?

    1. AAn application-layer firewall, which inspects the content of a session and enforces rules based on the protocol and the data
    2. BA stateless packet filter, which decides on each packet using only its addresses and ports, without any awareness of the session
    3. CA static packet filter with port rules only, which allows any packet that uses a permitted port number on the device
    4. DA DNS sinkhole, which returns false answers for blocked domain names so that clients cannot reach the malicious hosts
    Show answer and explanation
    Correct answer: A

    An application-layer firewall understands the protocol and inspects the content that the session carries, which packet filters cannot do. Stateless and static filters decide on addresses and ports, and a DNS sinkhole acts on names.

  2. Question 24

    A network team must prevent unauthorised devices from connecting to switch ports. Which standard does this?

    1. AIEEE 802.3, which defines the physical and data link standards used for wired Ethernet connections across the network
    2. BIEEE 802.11, which defines the wireless standards used for connecting laptops and phones to the access points
    3. CIEEE 802.1X, which authenticates each device or user before the switch port is enabled for network access
    4. DIEEE 802.1Q VLAN tagging, which separates traffic into virtual networks but does not authenticate the devices connected
    Show answer and explanation
    Correct answer: C

    802.1X authenticates devices or users before a port is opened, which blocks unauthorised connections. 802.11, 802.3 and 802.1Q define wireless, Ethernet and VLAN tagging, and none of them authenticates the device before access is granted.

  3. Question 25

    Which control best protects a remote worker's traffic across an untrusted network?

    1. AAn open Wi-Fi network with no encryption, which is accepted because the worker's device is trusted by the company's own policy
    2. BA VPN with strong encryption and device authentication, which protects traffic between the worker's device and the corporate network
    3. CA split tunnel that sends all corporate traffic in clear text, which is faster and avoids the cost of running the VPN gateway
    4. DAn HTTP proxy with no authentication, which caches pages so that the worker can read them more quickly from the network
    Show answer and explanation
    Correct answer: B

    A VPN with strong encryption and device authentication protects the worker's traffic across an untrusted network and ties it to a trusted device. Open or clear-text options and unauthenticated proxies leave the traffic exposed.

  4. Question 26

    Which two measures reduce the risk of lateral movement inside a corporate network? (Choose two.)

    1. ASegmenting the network into zones with firewall rules that allow only the traffic each zone actually requires to function
    2. BAllowing all internal hosts to reach each other on any port, to simplify troubleshooting for the network operations team
    3. CUsing separate administrative accounts and jump hosts to manage servers in the sensitive zones of the network
    4. DTrusting every device on the internal network because it sits behind the corporate perimeter firewall that filters traffic
    5. ESharing the same local administrator password across every workstation in the building, for easy support by the team
    Show answer and explanation
    Correct answer: A, C

    Zoned segmentation limits the paths an attacker can use, and separate admin accounts with jump hosts stop credentials from being reused across the network. Open east-west access, implicit trust and shared local passwords each make lateral movement easier.

Cryptography (4 questions)

  1. Question 27

    Which property does a cryptographic hash function provide that a symmetric cipher does not?

    1. AA one-way computation that produces a fixed-length digest from input of any size, so that the original input cannot be recovered from it
    2. BA reversible transformation of plaintext into ciphertext with a secret key, which the receiver uses to restore the original text
    3. CA method for agreeing a key between two parties over an insecure channel, without either party sharing a secret beforehand
    4. DAutomatic deletion of the original data after the digest has been computed, which removes any copy of the source input at once
    Show answer and explanation
    Correct answer: A

    A hash is a one-way function that maps input of any size to a fixed-length digest, and the input cannot be recovered from it. Symmetric ciphers are reversible with a key, key agreement is a separate function, and hashes do not delete their inputs.

  2. Question 28

    Which algorithm is an asymmetric cipher, in which the public key can be shared openly while the private key stays secret?

    1. ARSA, which uses a public and private key pair so that the public key can be shared openly for encryption and verification
    2. BAES, which uses a single symmetric key that must be kept secret by both parties and shared through a secure channel
    3. CSHA-256, which produces a fixed-length digest from any input so that the digest can be checked for integrity later
    4. DHMAC-SHA256, which authenticates messages with a shared secret key that both parties hold in confidence between them
    Show answer and explanation
    Correct answer: A

    RSA is an asymmetric algorithm with a public and private key pair, which is how public keys can be shared openly. AES and HMAC rely on shared secrets, and SHA-256 is a hash rather than a cipher.

  3. Question 29

    A message must be checked for tampering by parties who share a secret key. Which mechanism does this?

    1. AA salt added to a password before hashing, which makes each stored password unique but does not check any messages
    2. BA digital certificate, which binds a public key to an identity and is verified against a certificate authority's signature
    3. CA message authentication code (HMAC), which combines the message with a shared secret key to produce a tag the receiver verifies
    4. DA random number generator, which produces unpredictable values that can be used as session identifiers for each user
    Show answer and explanation
    Correct answer: C

    HMAC produces a tag from the message and a shared secret, so the receiver detects tampering. Certificates bind keys to identities, salts protect password storage, and random numbers are not integrity checks.

  4. Question 30

    Which key exchange method lets two parties derive a shared secret over an insecure channel without sending the secret itself?

    1. AA symmetric key written on a card and handed to the other party in a sealed envelope before the session begins each time
    2. BSending the shared secret in clear text over the channel, which is protected only by the network's perimeter firewall at the edge
    3. CA hash of a password sent in clear text, which both parties compare afterwards to confirm that they hold the same secret
    4. DDiffie-Hellman key exchange, which lets both parties derive the same shared secret from public values exchanged between them
    Show answer and explanation
    Correct answer: D

    Diffie-Hellman lets two parties derive a common secret from public values exchanged over the channel, so the secret itself is never sent. The other options send the secret in clear text, compare hashes of passwords, or depend on physical handover.