(ISC)² SSCP (Systems Security Certified Practitioner) Practice Exam

What the (ISC)² SSCP (Systems Security Certified Practitioner) exam covers

• Security Operations and Administration113 questions
• Access Controls113 questions
• Risk Identification, Monitoring, and Analysis114 questions
• Incident Response and Recovery83 questions
• Cryptography79 questions
• Network and Communications Security114 questions
• Systems and Application Security114 questions

Free (ISC)² SSCP (Systems Security Certified Practitioner) sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 730.

1. Question 1Security Operations and Administration

   A hospital encrypts patient records so that only clinicians with the correct decryption key can read them. Which element of the CIA triad is this control primarily protecting?

   • AConfidentialityCorrect
   • BIntegrity
   • CAvailability
   • DNon-repudiation
   ✓ Correct answer: A

   Confidentiality ensures information is disclosed only to authorized parties. Encrypting records so only key holders can decrypt them directly prevents unauthorized disclosure.

   Why the other options are wrong

   • BIntegrity concerns preventing unauthorized modification, not restricting who can read data.
   • CAvailability ensures authorized users can access data when needed, which encryption does not primarily serve.
   • DNon-repudiation prevents denial of an action and is not one of the three CIA triad elements.
2. Question 2Security Operations and Administration

   A commercial (non-government) organization is choosing classification levels. Which of the following is the MOST appropriate set of commercial classification labels?

   • ATop Secret, Secret, Confidential, Unclassified
   • BPublic, Sensitive, Private, ConfidentialCorrect
   • CAlpha, Beta, Gamma, Delta
   • DLevel 1, Level 2, Level 3 with no definitions
   ✓ Correct answer: B

   Commercial organizations commonly adopt business-oriented classification labels such as Public, Sensitive, Private, and Confidential, each tied to defined handling requirements, rather than the government Top Secret/Secret hierarchy.

   Why the other options are wrong

   • ATop Secret, Secret, and Confidential are government/military labels, not the typical commercial set.
   • CArbitrary names like Alpha through Delta convey no sensitivity meaning and lack defined handling rules.
   • DNumbered levels without definitions provide no guidance on how each level must be handled.
3. Question 3Access Controls

   A relying party in an OAuth 2.0 / OpenID Connect flow receives an ID token. What does the ID token primarily convey?

   • AThe user's raw password for verification
   • BClaims asserting that the user was authenticated by the identity providerCorrect
   • CThe full contents of the user's session cookies
   • DThe application's source code signing key
   ✓ Correct answer: B

   OpenID Connect adds an identity layer on top of OAuth 2.0. The ID token is a signed JWT containing claims such as the subject identifier and authentication time, allowing the relying party to trust that the user was authenticated by the IdP without ever seeing the user's credentials.

   Why the other options are wrong

   • AThe IdP never shares the user's raw password with the relying party.
   • CThe ID token conveys identity claims, not the user's session cookies.
   • DIt is not an application code-signing key.
4. Question 4Access Controls

   In a Zero Trust model, before granting access a policy engine evaluates user identity, device health, and requested resource sensitivity. This ongoing per-request evaluation is best described as?

   • AImplicit trust based on network location
   • BContinuous, context-aware verificationCorrect
   • COne-time perimeter authentication
   • DStatic allow-listing of IP addresses
   ✓ Correct answer: B

   A defining Zero Trust behavior is evaluating multiple signals such as identity, device health, and resource sensitivity for each access request and re-evaluating as context changes. Trust is never assumed and is continuously re-established.

   Why the other options are wrong

   • AImplicit trust by location is the perimeter assumption Zero Trust rejects.
   • COne-time perimeter authentication does not re-verify on each request.
   • DStatic IP allow-listing ignores identity and device context.
5. Question 5Risk Identification, Monitoring, and Analysis

   An organization decides that a low-severity vulnerability on an isolated test system is not worth the cost of remediation and formally documents the decision to take no further action. This is an example of:

   • ARisk avoidance
   • BRisk mitigation
   • CRisk acceptanceCorrect
   • DRisk transference
   ✓ Correct answer: C

   Risk acceptance is a valid treatment when the cost of remediation outweighs the potential impact and the residual risk is within tolerance. It should be documented and approved by an appropriate risk owner.

   Why the other options are wrong

   • ARisk avoidance eliminates the activity or asset creating the risk, which is not what is described.
   • BRisk mitigation reduces the risk through controls or fixes; here no action is taken.
   • DRisk transference shifts impact to a third party, such as insurance, which is not described.
6. Question 6Incident Response and Recovery

   What is the MAIN advantage of running periodic tabletop exercises during the preparation phase?

   • AThey guarantee that no incident will ever occur
   • BThey validate and rehearse the incident response plan and reveal gaps before a real incidentCorrect
   • CThey replace the need for backups
   • DThey automatically patch all system vulnerabilities
   ✓ Correct answer: B

   Tabletop exercises walk the team through simulated incident scenarios in a discussion-based setting. They test whether the plan, roles, communication paths, and playbooks work as intended and expose weaknesses so they can be fixed before a genuine incident.

   Why the other options are wrong

   • ANo exercise can guarantee incidents never happen; the goal is readiness, not prevention of all events.
   • CExercises test response readiness and do not substitute for data backups.
   • DTabletop exercises are discussion-based and do not apply patches.
7. Question 7Cryptography

   To send an encrypted message so that only the intended recipient can read it in an asymmetric scheme, the sender should encrypt with which key?

   • AThe sender's private key
   • BThe sender's public key
   • CThe recipient's public keyCorrect
   • DA shared symmetric key that both already possess
   ✓ Correct answer: C

   In asymmetric encryption, data encrypted with a recipient's public key can only be decrypted with the matching private key, which only the recipient holds. This guarantees that just the intended recipient can read the message.

   Why the other options are wrong

   • AEncrypting with the sender's private key provides a signature, not confidentiality, since anyone can decrypt with the public key.
   • BThe sender's public key would only be decryptable by the sender's private key, which the recipient does not have.
   • DThis question concerns asymmetric encryption; using a preexisting shared symmetric key is a different model.
8. Question 8Network and Communications Security

   What is the broadcast address of the subnet 192.168.10.0/28?

   • A192.168.10.15Correct
   • B192.168.10.16
   • C192.168.10.255
   • D192.168.10.31
   ✓ Correct answer: A

   A /28 has 4 host bits, giving a block size of 16 addresses. The subnet 192.168.10.0/28 spans 192.168.10.0 through 192.168.10.15. The network address is 192.168.10.0 and the broadcast address is the last address in the block, 192.168.10.15. Usable hosts run from .1 to .14. Calculating block boundaries is central to subnet planning.

   Why the other options are wrong

   • B192.168.10.16 is the network address of the next /28 subnet, not the broadcast of the first.
   • C192.168.10.255 would be the broadcast for a /24, not a /28.
   • D192.168.10.31 is the broadcast address of the second /28 (192.168.10.16/28), not the first.
9. Question 9Network and Communications SecuritySelect all that apply

   Which TWO controls most directly help mitigate VLAN hopping attacks on managed switches? (Choose two.)

   • ADisabling Dynamic Trunking Protocol / auto-trunk negotiation on access portsCorrect
   • BAssigning an unused, dedicated VLAN as the native VLAN on trunk linksCorrect
   • CEnabling Power over Ethernet on all ports
   • DIncreasing the MTU to allow jumbo frames
   ✓ Correct answer: A, B

   VLAN hopping via switch spoofing is mitigated by turning off automatic trunk negotiation on access ports so a host cannot negotiate a trunk. Double-tagging is mitigated by setting the native VLAN on trunks to a dedicated, unused VLAN (and not carrying it to hosts), so the outer tag trick fails.

   Why the other options are wrong

   • CPower over Ethernet supplies power to devices and has no effect on VLAN hopping.
   • DJumbo frames change frame size for performance and do not mitigate VLAN hopping.
10. Question 10Systems and Application Security

    An organization wants to consume a fully managed email and productivity suite where the provider maintains the application, runtime, OS, and hardware. Which cloud service model is this?

    • AInfrastructure as a Service (IaaS)
    • BPlatform as a Service (PaaS)
    • CSoftware as a Service (SaaS)Correct
    • DFunction as a Service (FaaS)
    ✓ Correct answer: C

    SaaS delivers complete applications over the network where the provider manages everything from the physical hardware up through the application layer. The customer typically manages only its data, user access, and application-level configuration. A hosted productivity and email suite consumed directly by users is the classic SaaS example.

    Why the other options are wrong

    • AIaaS provides raw compute, storage, and networking where the customer manages the OS and everything above it, not a finished application.
    • BPaaS provides a managed platform and runtime for the customer to deploy its own code, not a ready-to-use application suite.
    • DFaaS runs customer-supplied event-driven functions on managed infrastructure and is not a complete end-user application.

(ISC)² SSCP (Systems Security Certified Practitioner) practice exam FAQ