(ISC)² SSCP (Systems Security Certified Practitioner) Practice Exam

What the (ISC)² SSCP (Systems Security Certified Practitioner) exam covers

• Security Concepts and Practices117 questions
• Access Controls120 questions
• Risk Identification, Monitoring, and Analysis117 questions
• Incident Response and Recovery102 questions
• Cryptography68 questions
• Network and Communications Security128 questions
• Systems and Application Security118 questions

Free (ISC)² SSCP (Systems Security Certified Practitioner) sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 770.

1. Question 1Security Concepts and Practices

   A hospital encrypts patient records so that only clinicians with the correct decryption key can read them. Which element of the CIA triad is this control primarily protecting?

   • AConfidentialityCorrect
   • BIntegrity
   • CAvailability
   • DNon-repudiation
   ✓ Correct answer: A

   Confidentiality means information is disclosed only to authorized parties. Encryption enforces this technically: plaintext is transformed into ciphertext that is unreadable without the correct decryption key, so even if the storage medium or transmission is intercepted, the data itself stays protected. Integrity uses hashing or digital signatures instead, and availability concerns uptime and redundancy, not access restriction.

   Why the other options are wrong

   • BIntegrity concerns preventing unauthorized modification, not restricting who can read data.
   • CAvailability ensures authorized users can access data when needed, which encryption does not primarily serve.
   • DNon-repudiation prevents denial of an action and is not one of the three CIA triad elements.
2. Question 2Security Concepts and PracticesSelect all that apply

   Which TWO responsibilities are typically assigned to a data custodian rather than the data owner? (Choose two.)

   • APerforming regular backups of the dataCorrect
   • BAssigning the classification level of the data
   • CApplying and maintaining technical access controls defined by the ownerCorrect
   • DDeciding the business purpose for which the data may be used
   ✓ Correct answer: A, C

   The data custodian handles the operational, hands-on tasks of data protection under the owner's direction: performing and testing regular backups so data can be recovered, and applying and maintaining the technical access controls, encryption, and permissions the data owner has specified. Deciding the classification level and defining the acceptable business use of the data remain owner responsibilities, since the owner holds ultimate accountability.

   Why the other options are wrong

   • BAssigning the classification level is a data owner responsibility, not a custodian task.
   • DDeciding the business purpose for data use is an owner or business-leadership decision, not a custodial duty.
3. Question 3Access ControlsSelect all that apply

   A security team is evaluating a biometric access system. Which TWO statements about biometric error rates and thresholds are correct? (Choose two.)

   • ALoosening the matching threshold typically raises the False Acceptance RateCorrect
   • BThe Crossover Error Rate is the point where FAR equals FRRCorrect
   • CA higher Crossover Error Rate indicates a more accurate system
   • DThe False Rejection Rate measures how often impostors are accepted
   • EFAR and FRR are unaffected by the sensitivity threshold
   ✓ Correct answer: A, B

   Biometric matching is a tradeoff governed by the sensitivity threshold. A looser threshold accepts more matches, raising FAR while lowering FRR; a stricter threshold does the reverse. The Crossover Error Rate is where these two rates intersect, and a lower CER means a more accurate device.

   Why the other options are wrong

   • CA lower, not higher, CER indicates a more accurate system.
   • DAccepting impostors is measured by FAR; FRR measures rejecting legitimate users.
   • EBoth FAR and FRR are directly affected by the sensitivity threshold.
4. Question 4Risk Identification, Monitoring, and Analysis

   In the NIST Risk Management Framework (RMF), which step immediately follows the selection of security controls?

   • ACategorize
   • BImplementCorrect
   • CAuthorize
   • DMonitor
   ✓ Correct answer: B

   The NIST RMF steps are: Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor. After controls are selected in the Select step, they are put in place during the Implement step, then evaluated in Assess, approved for operation in Authorize, and continuously watched in Monitor.

   Why the other options are wrong

   • ACategorize precedes Select; it defines the impact level of the system before controls are chosen.
   • CAuthorize comes later, after controls are implemented and assessed.
   • DMonitor is the final continuous step, well after Implement and Assess.
5. Question 5Risk Identification, Monitoring, and Analysis

   In security operations, which statement best distinguishes an event from an incident?

   • AAn event is any observable occurrence, while an incident is one that actually or imminently jeopardizes the CIA triadCorrect
   • BAn event always requires executive notification, while an incident can be handled silently by an analyst
   • CAn event is malicious by definition, while an incident is benign and expected
   • DAn event occurs only on endpoints, while an incident occurs only on network devices
   ✓ Correct answer: A

   Events are the raw observable activity captured by logs and sensors, and the vast majority are routine (a login, a service start). An incident is the subset of events that violate or threaten security policy or the CIA triad, such as a confirmed breach or malware infection. Correctly classifying events and escalating only genuine incidents is central to efficient monitoring and response.

   Why the other options are wrong

   • BNotification requirements depend on severity and policy, not on the event-versus-incident label, and incidents typically require more escalation than routine events.
   • CMost events are benign; being malicious is not part of the definition of an event, and incidents are by definition harmful rather than benign.
   • DBoth events and incidents can originate anywhere in the environment, so location does not distinguish them.
6. Question 6Incident Response and Recovery

   An organization determines that its order-processing system can be unavailable for no more than eight total hours before the business suffers unacceptable damage. Which metric does eight hours represent?

   • ARecovery Point Objective (RPO)
   • BMaximum Tolerable Downtime (MTD)Correct
   • CMean Time Between Failures (MTBF)
   • DRecovery Point Actual (RPA)
   ✓ Correct answer: B

   Maximum Tolerable Downtime represents the outer limit of acceptable outage for a process. It sets the ceiling that RTO and WRT combined must fit within: the system must be technically recovered (RTO) and validated and returned to production (WRT) before MTD elapses.

   Why the other options are wrong

   • ARPO measures allowable data loss over time, not the allowable duration of downtime.
   • CMTBF is a reliability metric describing average time between failures, not a downtime tolerance.
   • DRPA describes actual data loss achieved, not the tolerated downtime limit.
7. Question 7Cryptography

   What is the main advantage of OCSP over a traditional Certificate Revocation List (CRL)?

   • AOCSP validates the certificate's private key while CRLs only list serial numbers
   • BOCSP provides near real-time, per-certificate status instead of downloading a large listCorrect
   • COCSP extends the certificate's validity period beyond its stated expiration
   • DOCSP allows the client to issue its own certificate without the CA
   ✓ Correct answer: B

   The Online Certificate Status Protocol allows a relying party to ask an OCSP responder about one specific certificate and receive a signed good, revoked, or unknown response. This reduces bandwidth and latency compared with periodically downloading a potentially large CRL, and it provides fresher status information.

   Why the other options are wrong

   • ANeither OCSP nor CRLs validate private keys; both report revocation status of issued certificates.
   • CRevocation checking cannot extend validity; a certificate's expiration is fixed regardless of the method.
   • DOnly a CA issues certificates; OCSP is a status-checking protocol, not an issuance mechanism.
8. Question 8Network and Communications Security

   Which protocol and port combination should replace unencrypted FTP to provide file transfer over an encrypted SSH channel?

   • ASFTP over TCP port 22Correct
   • BTFTP over UDP port 69
   • CFTP over TCP port 21
   • DHTTP over TCP port 80
   ✓ Correct answer: A

   SFTP (SSH File Transfer Protocol) runs over the encrypted SSH channel on TCP port 22, protecting both credentials and file contents in transit. It is a strong replacement for FTP, which sends data and credentials in cleartext on TCP ports 20 and 21. Choosing SFTP or FTPS is a common hardening step when secure file transfer is required.

   Why the other options are wrong

   • BTFTP is a lightweight, unauthenticated protocol over UDP port 69 and offers no encryption, so it is not a secure replacement.
   • CFTP over TCP port 21 is the insecure cleartext protocol that needs to be replaced, not the secure option.
   • DHTTP over TCP port 80 is unencrypted web traffic and is not a file transfer replacement for FTP.
9. Question 9Systems and Application Security

   Which type of malware is specifically designed to conceal its presence and that of other malicious processes, often by subverting the operating system kernel or system calls?

   • ARansomware
   • BSpyware
   • CRootkitCorrect
   • DKeylogger
   ✓ Correct answer: C

   Rootkits are built for stealth and persistence: kernel-mode rootkits hook or patch system calls and data structures so that files, processes, and network connections associated with the attacker are hidden from normal detection tools. This makes them among the hardest malware to detect and remove.

   Why the other options are wrong

   • ARansomware encrypts or locks data to extort payment; it is generally not designed to hide its presence.
   • BSpyware collects information covertly but is not primarily defined by subverting the kernel to hide other processes.
   • DA keylogger captures keystrokes; concealment of the broader system is not its defining function.
10. Question 10Systems and Application SecuritySelect all that apply

    An application security team is building a testing program. Which TWO combinations correctly pair a technique with a genuine strength? (Choose TWO)

    • ASAST: can find flaws early in source code and pinpoint the exact vulnerable lineCorrect
    • BDAST: can detect runtime and configuration issues in a deployed app without source codeCorrect
    • CSAST: requires the application to be running in production to work
    • DDAST: analyzes source code line by line without executing the application
    ✓ Correct answer: A, B

    SAST analyzes code without executing it, so it can run early in the SDLC and point to the specific vulnerable line, making remediation easier. DAST exercises the running application from the outside and therefore catches runtime, authentication, and configuration problems, and it works even when source code is unavailable. Using both provides broader coverage than either alone.

    Why the other options are wrong

    • CSAST works on static code and does not require a running production application; it is used early, before deployment.
    • DAnalyzing source without executing describes SAST, not DAST, which tests the running application dynamically.

Who this (ISC)² SSCP (Systems Security Certified Practitioner) practice exam is for

This practice set is for anyone preparing for the (ISC)² SSCP (Systems Security Certified Practitioner) exam - from first-time candidates building a foundation to experienced professionals doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this (ISC)² SSCP (Systems Security Certified Practitioner) practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real (ISC)² SSCP (Systems Security Certified Practitioner) exam.

Related Security resources

• (ISC)² SSCP (Systems Security Certified Practitioner) study guideKey concepts
• Security practice examsAll Security
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• (ISC)² CISSP practice examRelated
• CompTIA SecurityX (CAS-005, formerly CASP+) practice examRelated
• (ISC)² Certified in Cybersecurity (CC) practice examRelated

(ISC)² SSCP (Systems Security Certified Practitioner) practice exam FAQ