Question bank
ISC2 SSCP
45 ISC2 SSCP questions with the correct answer and a written explanation, organised across 7 exam domains.
- 45 questions
- 7 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Access Controls
7 questions in this domain
- Question 1Single Choice
At a login prompt, a user enters their username. Which security process is being performed at this exact moment?
- AIdentificationCorrect answer
- BAuthentication
- CAuthorization
- DAccounting
Why this is the answer
Identification is the claim of identity. Authentication proves the claim, authorization grants permissions, and accounting records activity.
- Question 2Multiple Select
Which of the following are recognized primary authentication factors? (Select all that apply)
- AKnowledgeCorrect answer
- BPossessionCorrect answer
- CInherenceCorrect answer
- DLocation
Why this is the answer
The three primary authentication factors are knowledge (something you know), possession (something you have), and inherence (something you are). Location is sometimes used as a contextual attribute, but it is not one of the three primary factors.
- Question 3Interactive
In the access control log excerpt, one event corresponds to the verification of a submitted secret against a stored value. Which phase is that event?
- AIdentification
- BAuthenticationCorrect answer
- CAuthorization
- DAccounting
Why this is the answer
The event labeled credential_validation compares the submitted password hash to a stored value. That action is authentication, because it verifies the identity claim.
- Question 4Single Choice
An authenticated user is denied access to a file and receives an 'Access Denied' message. What is the best interpretation of this event?
- AAuthentication failed; the user must re-enter credentials
- BAuthorization failed; the user's granted permissions do not include this fileCorrect answer
- CIdentification was not completed
- DThe account is locked due to failed logins
Why this is the answer
Authentication succeeded, but the access control decision made after authentication is authorization. A validly authenticated subject can still lack permission to a specific object.
- Question 5Multiple Select
Which of the following combinations qualify as true multi-factor authentication? (Select two)
- APassword and PIN
- BSmart card and PINCorrect answer
- CFingerprint and retina scan
- DPassword and one-time token codeCorrect answer
Why this is the answer
MFA requires factors from distinct categories. A smart card is possession and a PIN is knowledge. A password is knowledge and a one-time token code is possession. Fingerprint and retina are both inherence, and password plus PIN are both knowledge.
- Question 6Interactive
In the certificate-based authentication flow shown, what does step 4 prove to the server?
- AThe client possesses the corresponding private keyCorrect answer
- BThe client knows a shared password
- CThe certificate is encrypted
- DThe server's public key is valid
Why this is the answer
Signing the challenge with a private key proves possession of that private key. The server verifies the signature using the public key from the certificate, confirming the client's identity.
- Question 7Single Choice
In biometric authentication, what does the false acceptance rate (FAR) measure?
- AThe percentage of legitimate users rejected
- BThe percentage of imposters incorrectly acceptedCorrect answer
- CThe point where FAR equals FRR
- DThe speed of template matching
Why this is the answer
False Acceptance Rate (FAR) measures the rate at which unauthorized users are incorrectly accepted. False Rejection Rate (FRR) is the opposite, and CER is the crossover point.
Cryptography
4 questions in this domain
- Question 8Single Choice
Which process transforms plaintext into ciphertext using a key and an algorithm in a cryptographic system?
- AEncryptionCorrect answer
- BDecryption
- CHashing
- DCryptanalysis
Why this is the answer
Encryption is the process of converting plaintext into ciphertext using a key and algorithm. It provides confidentiality, while decryption reverses the process and hashing is irreversible.
- Question 9Multiple Select
Which two statements about a cryptographic salt are true? Select two.
- AIt is a random value added before hashing.Correct answer
- BIt must be kept secret from attackers.
- CIt prevents precomputed rainbow table attacks.Correct answer
- DIt is derived from the encryption key.
Why this is the answer
A salt is a random value added before hashing; it prevents precomputed rainbow table attacks and does not need to be secret.
- Question 10Interactive
In the authentication exchange code block, what is the primary purpose of the nonce value?
- AEnsure freshness and prevent replayCorrect answer
- BEncrypt the request payload
- CReplace the session key
- DKeep the HMAC key secret
Why this is the answer
A nonce is a number used once to provide freshness and prevent replay attacks. Its uniqueness matters more than secrecy.
- Question 11Single Choice
Which block cipher mode encrypts each block independently with the same key and can leak patterns in plaintext?
- AElectronic Codebook (ECB)Correct answer
- BCipher Block Chaining (CBC)
- CCounter (CTR)
- DGalois/Counter (GCM)
Why this is the answer
ECB encrypts each block independently with the same key, so identical plaintext blocks create identical ciphertext and data patterns leak.
Incident Response and Recovery
6 questions in this domain
- Question 12Single Choice
According to the six-phase incident response lifecycle used in the SSCP domain, which phase begins the process?
- APreparationCorrect answer
- BDetection
- CEradication
- DRecovery
Why this is the answer
Preparation establishes the IR policy, team, tools, and training so the organization is ready before an incident occurs.
- Question 13Multiple Select
Which two activities are considered part of the preparation phase of the incident response lifecycle?
- ADeveloping the IR policy and training the CSIRTCorrect answer
- BConducting tabletop exercisesCorrect answer
- CIsolating infected hosts from the network
- DRestoring systems from verified backups
Why this is the answer
Preparation builds readiness through policy, trained teams, tools, and exercises. Isolating and restoring occur during later lifecycle phases.
- Question 14Interactive
The array in the code block is missing one of the six incident response lifecycle phases. Which phase should be added?
- ALessons LearnedCorrect answer
- BPreparation
- CContainment
- DRecovery
Why this is the answer
The six-phase lifecycle includes preparation, detection and analysis, containment, eradication, recovery, and lessons learned.
- Question 15Single Choice
In the incident response lifecycle, which phase directly follows detection and analysis according to the six-phase model?
- AContainmentCorrect answer
- BEradication
- CPreparation
- DLessons Learned
Why this is the answer
Containment limits the blast radius after an incident is detected and analyzed, before eradication and recovery.
- Question 16Multiple Select
Which two actions are examples of containment activities used to limit an incident's spread during response?
- ADisconnecting an infected host from the networkCorrect answer
- BBlocking malicious IP addresses at the firewallCorrect answer
- CDeleting malware files from the host
- DRestoring data from off-site backups
Why this is the answer
Containment isolates the threat by disconnecting systems and blocking malicious traffic. Deleting and restoring are eradication and recovery.
- Question 17Interactive
The backup plan in the code block uses daily incremental backups after a Sunday full backup. What is required for a complete restore?
- AFull backup plus all incremental backupsCorrect answer
- BFull backup only
- CLatest incremental backup only
- DDifferential backup plus latest incremental
Why this is the answer
Incremental backups require the last full backup and every incremental backup in chronological order for restoration.
Network and Communications Security
7 questions in this domain
- Question 18Single Choice
Which OSI layer handles logical addressing and routing decisions?
- ANetworkCorrect answer
- BData Link
- CTransport
- DSession
Why this is the answer
The network layer handles IP addressing and routing. Data link handles MAC addresses, transport manages end-to-end communication, and session manages dialog control.
- Question 19Multiple Select
Which two protocols operate at the transport layer of the TCP/IP model?
- ATCPCorrect answer
- BUDPCorrect answer
- CIP
- DHTTP
Why this is the answer
TCP and UDP are transport-layer protocols. IP operates at the network layer, and HTTP operates at the application layer.
- Question 20Interactive
Refer to the code block. Which PDU name corresponds to the network layer?
- APacketCorrect answer
- BFrame
- CSegment
- DBits
Why this is the answer
The network layer PDU is called a packet, while frames belong to the data link layer, segments to transport, and bits to physical.
- Question 21Single Choice
Which protocol suite provides encryption for IP packets at the network layer?
- AIPsecCorrect answer
- BTLS
- CSSH
- DSSL
Why this is the answer
IPsec is the network-layer protocol suite used for VPNs and IP traffic protection. TLS and SSH operate at higher layers.
- Question 22Multiple Select
Which two statements correctly describe a stateful firewall?
- AIt tracks active connections in a state table.Correct answer
- BIt performs deep application-layer inspection by default.
- CIt can block unsolicited inbound packets without a matching state.Correct answer
- DIt is always deployed as a passive tap.
Why this is the answer
A stateful firewall maintains session state and blocks unsolicited inbound traffic. It is inline and does not perform deep application inspection by default.
- Question 23Interactive
Refer to the code block. The network is segmented into VLANs. What is missing from this design?
- ASegregationCorrect answer
- BSegmentation
- CVirtualization
- DEncryption
Why this is the answer
Segmentation creates VLANs, but segregation enforces policy between them through ACLs or firewalls. The empty ACL list shows missing segregation.
- Question 24Single Choice
Which network zone is designed to host publicly reachable services while protecting internal systems?
- ADMZCorrect answer
- BExtranet
- CGuest VLAN
- DManagement VLAN
Why this is the answer
The DMZ hosts externally accessible services and provides a controlled boundary between the untrusted Internet and the trusted internal network.
Risk Identification, Monitoring and Analysis
7 questions in this domain
- Question 25Single Choice
What is the first step in the risk management lifecycle?
- AAsset identificationCorrect answer
- BThreat modeling
- CVulnerability analysis
- DRisk response
Why this is the answer
Asset identification establishes what needs protection. Without an accurate inventory, threat modeling, vulnerability analysis, and risk response cannot be prioritized effectively.
- Question 26Multiple Select
Which of the following are standard risk response strategies recognized in the risk management lifecycle? (Choose all that apply.)
- AMitigationCorrect answer
- BAvoidanceCorrect answer
- CRisk elimination
- DAcceptanceCorrect answer
Why this is the answer
The four standard responses are mitigation, avoidance, transfer, and acceptance. 'Elimination' is not used; avoidance is the response that removes exposure.
- Question 27Interactive
The code block defines a value that the monitoring system uses to distinguish normal activity from unusual activity. What is this value called?
- ABaselineCorrect answer
- BBenchmark
- CRisk threshold
- DControl objective
Why this is the answer
A baseline is an organization-specific reference point of normal behavior. This expression captures typical traffic and a statistical variance, forming a baseline.
- Question 28Single Choice
Which system provides centralized aggregation, normalization, correlation, and alerting of security data?
- ASIEMCorrect answer
- BDLP
- CIDS
- DFirewall
Why this is the answer
A SIEM is the central platform for log aggregation, normalization, correlation, and alerting. DLP, IDS, and firewalls perform narrower functions.
- Question 29Multiple Select
Which of the following are common data sources used for continuous monitoring? (Choose all that apply.)
- AAuthentication logsCorrect answer
- BFirewall and IDS/IPS logsCorrect answer
- CEndpoint telemetryCorrect answer
- DVendor marketing plans
Why this is the answer
Authentication logs, network security logs, and endpoint telemetry provide security-relevant data. Marketing plans are not a technical monitoring source.
- Question 30Interactive
The code block contains a risk register entry. Which risk response strategy has been selected for the identified risk?
- ATransferCorrect answer
- BMitigation
- CAvoidance
- DAcceptance
Why this is the answer
Purchasing insurance shifts the financial burden of the risk to a third party, which is the definition of risk transfer.
- Question 31Single Choice
Which statement correctly distinguishes a vulnerability from a threat?
- AA vulnerability is a weakness; a threat is an actor or event that can exploit itCorrect answer
- BA vulnerability is an exploited control; a threat is a missing patch
- CA threat is a weakness; a vulnerability is an attack
- DThey are interchangeable terms
Why this is the answer
A vulnerability is a weakness in an asset or control; a threat is an actor, event, or condition that could exploit that weakness to cause harm.
Security Concepts and Practices
7 questions in this domain
- Question 32Single Choice
Which fundamental security concept ensures that data is accessible only to authorized individuals, systems, or processes?
- AConfidentialityCorrect answer
- BIntegrity
- CAvailability
- DNon-repudiation
Why this is the answer
Confidentiality prevents unauthorized disclosure. Integrity protects accuracy, availability ensures access, and non-repudiation proves actions.
- Question 33Multiple Select
Which two controls are commonly used to protect the integrity of data and detect unauthorized modifications?
- ACryptographic hash functionsCorrect answer
- BDigital signaturesCorrect answer
- CSymmetric encryption
- DRAID
Why this is the answer
Hashes and digital signatures detect unauthorized changes. Encryption protects confidentiality, and RAID supports availability.
- Question 34Interactive
In the risk register entry shown in the code block, what is the $25,000 figure called?
- AResidual riskCorrect answer
- BInherent risk
- CRisk appetite
- DRisk avoidance
Why this is the answer
Residual risk is what remains after controls are implemented. Inherent risk exists before controls, while appetite is the acceptable threshold.
- Question 35Single Choice
Which security principle limits each user's access to only the information and resources required for their job role?
- ALeast privilegeCorrect answer
- BDefense in depth
- CSeparation of duties
- DDue diligence
Why this is the answer
Least privilege restricts permissions to job needs. Defense in depth layers controls, separation of duties divides tasks, and due diligence is verification.
- Question 36Multiple Select
Which two activities are examples of security governance rather than security management?
- ABoard approves the organization's risk appetiteCorrect answer
- BExecutive management reviews security policies annuallyCorrect answer
- CAn administrator configures firewall rule sets
- DAnalysts update antivirus signatures
Why this is the answer
Governance sets direction and authority, including risk appetite and policy approval. Configuring tools is operational management.
- Question 37Interactive
In the document excerpt shown in the code block, the word 'must' indicates which type of document?
- AStandardCorrect answer
- BGuideline
- CProcedure
- DInformative policy
Why this is the answer
Mandatory 'must' language indicates a standard. Guidelines use 'should', procedures are step-by-step, and informative policies are educational.
- Question 38Single Choice
Which risk treatment strategy transfers the financial consequence of a potential loss to another party?
- ATransferCorrect answer
- BMitigation
- CAcceptance
- DAvoidance
Why this is the answer
Transfer shifts financial risk to a third party, such as an insurer. Mitigation reduces impact, acceptance tolerates risk, and avoidance eliminates activity.
Systems and Application Security
7 questions in this domain
- Question 39Single Choice
What is the primary purpose of operating system hardening?
- AReduce the attack surface by eliminating unnecessary services and enforcing least privilegeCorrect answer
- BIncrease system performance by overclocking hardware
- CAutomatically install all available vendor updates
- DReplace the existing operating system with a cloud-based solution
Why this is the answer
Hardening reduces attack surface by removing unneeded services, locking configurations, enforcing least privilege, and maintaining a known secure state.
- Question 40Multiple Select
Which of the following are insecure protocols that should be replaced with encrypted alternatives during hardening? (Choose all that apply.)
- ATelnetCorrect answer
- BFTPCorrect answer
- CSNMPv1Correct answer
- DSSH
Why this is the answer
Telnet, FTP, and SNMPv1 send data in clear text or use weak security. SSH is the secure alternative for remote administration.
- Question 41Interactive
Review the command in the code block. Which security principle is violated by this command?
- ALeast privilegeCorrect answer
- BDefense in depth
- CSeparation of duties
- DNon-repudiation
Why this is the answer
World-writable permissions grant every user full read, write, and execute rights, violating least privilege and data integrity.
- Question 42Single Choice
What is patch management?
- AThe process of obtaining, testing, and applying vendor updates to fix known vulnerabilitiesCorrect answer
- BThe process of replacing hardware components that are no longer under warranty
- CThe process of configuring firewall rules to block malicious traffic
- DThe process of creating user accounts for new employees
Why this is the answer
Patch management is the lifecycle of acquiring, testing, deploying, and verifying software updates to remediate known security vulnerabilities.
- Question 43Multiple Select
Which capabilities are typically included in modern Endpoint Protection Platforms (EPPs)? (Choose all that apply.)
- ABehavioral analysisCorrect answer
- BMachine learningCorrect answer
- CSignature-based detectionCorrect answer
- DFull-disk encryption
Why this is the answer
Modern EPPs combine signature detection with behavioral analysis, machine learning, and cloud threat intelligence. Full-disk encryption is a separate control.
- Question 44Interactive
Review the PowerShell command in the code block. What is the effect of this command on the Windows service?
- AIt disables the Print Spooler serviceCorrect answer
- BIt uninstalls the Print Spooler service binary
- CIt removes the Print Spooler driver from the system
- DIt starts the Print Spooler service automatically
Why this is the answer
The command sets the Spooler service startup type to Disabled. It disables the service but does not remove the underlying software or driver.
- Question 45Single Choice
What does Transparent Data Encryption (TDE) primarily protect against?
- APhysical theft of database files and backupsCorrect answer
- BSQL injection attacks through the application
- CUnauthorized logical access by database users
- DDenial-of-service attacks against the database server
Why this is the answer
TDE encrypts database files on disk and backups, protecting data at rest from physical theft. It does not stop logical attacks or unauthorized queries.
Frequently asked questions
Everything about the ISC2 SSCP question bank and how to use it.