SSCP Practice Questions

Question 1

An analyst notices unusual outbound traffic from a workstation to an external IP on port 445. Which protocol is likely being used?

Accepted Answer

SMB. Port 445 is the default port for Microsoft-DS (Direct Hosting of SMB over TCP/IP), which is used by the Server Message Block (SMB) protocol for file and printer sharing. Unusual outbound traffic on this port often indicates SMB activity, such as a workstation attempting to connect to a remote share or, in a security context, potential data exfiltration or lateral movement using SMB.

Answer

HTTP

Answer

FTP

Answer

DNS

Question 2

Which TWO of the following are key components of a Business Impact Analysis (BIA)?

Accepted Answer

Recovery time objective.. A Business Impact Analysis (BIA) identifies the critical business functions and the maximum tolerable downtime, so the Recovery Time Objective (RTO) is a core output — it defines how quickly a process or system must be restored after disruption, directly driving continuity and recovery strategies. Criticality analysis is also a key BIA component because it ranks business processes and assets by their importance to the organization, typically using impact categories such as financial, operational, legal, and reputational, which determines prioritization for recovery. Vulnerability assessment (B) is a risk-assessment activity that identifies weaknesses in systems, not a BIA component, and it focuses on exposure rather than business impact. Likelihood estimation (D) belongs to risk analysis, where the probability of a threat event is evaluated, whereas the BIA focuses on consequences and tolerances. Threat modeling (E) is a security design technique for identifying threats and attack paths, not a BIA element, since the BIA is threat-agnostic and centers on business process impact.

Answer

Vulnerability assessment.

Answer

Likelihood estimation.

Answer

Threat modeling.

Question 3

Which of the following is a secure remote access VPN protocol that uses TLS for encryption and is commonly used with Cisco AnyConnect?

Accepted Answer

SSL/TLS VPN. An SSL/TLS VPN uses TLS (typically over TCP port 443) to encrypt traffic and is the protocol underlying Cisco AnyConnect, which is a classic example of a client-based SSL VPN. It provides secure remote access without requiring IPsec's UDP ports, making it firewall-friendly.

Answer

IPsec

Answer

L2TP/IPsec

Answer

PPTP

Question 4

A security analyst needs to verify that a downloaded file has not been tampered with. The publisher provides a SHA-256 hash. Which property of the hash function is being relied upon?

Accepted Answer

Second pre-image resistance. When relying on a provided hash to verify file integrity, the security analyst is using second pre-image resistance. This property ensures that given a hash value (the original file's hash), it is computationally infeasible to find another input (a tampered file) that produces the same hash. Thus, if the computed hash matches the provided hash, the file is authentic and unchanged. Collision resistance is a stronger property but not directly required here; second pre-image resistance is the exact requirement for this scenario.

Answer

Avalanche effect

Answer

Collision resistance

Answer

Pre-image resistance

Question 5

An organization uses a SIEM to alert when a server's configuration changes from its hardened baseline. This is an example of:

Accepted Answer

Deviation detection. SIEM alerts on configuration changes from baseline are a form of deviation detection, which is part of configuration management.

Answer

Patch management

Answer

Vulnerability scanning

Answer

Asset management

Question 6

A security administrator is prioritizing patches for a vulnerability with a CVSS score of 9.8 that is being actively exploited in the wild. The affected server has a low criticality classification. What should the administrator do?

Accepted Answer

Prioritize patching via the change management process. Even though the server is low criticality, a CVSS score of 9.8 with active exploitation represents an urgent risk that must be addressed. The administrator should prioritize patching through the change management process to ensure proper approval, testing, and documentation while still expediting the fix.

Answer

Apply the patch immediately without change management

Answer

Ignore the patch because the server is low criticality

Answer

Wait for the next scheduled patch cycle

Question 7

During the preparation phase of incident response, which TWO components are essential for an effective incident response plan? (Select TWO)

Accepted Answer

A communication plan with contact information for key stakeholders. Option C is correct because an incident response plan must include a communication plan with up-to-date contact information for key stakeholders (e.g., incident handlers, management, legal, PR, and law enforcement) so that notifications and escalations occur quickly and in the proper order during an incident. Option E is correct because detailed recovery procedures for each critical system provide the documented, tested steps (such as restoration order, RTO/RPO targets, and system-specific rebuild or failover instructions) needed to return operations to normal after containment and eradication. Option A is not essential to the plan itself, since vendor lists support logistics but are not a core IR plan component. Option B is incorrect and a security risk, as storing all employee passwords violates least privilege and credential-management best practices. Option D, while useful for scoping and containment, is supporting documentation rather than one of the two essential components emphasized here.

Answer

A list of approved vendors for hardware replacement

Answer

A list of all employee passwords

Answer

Network topology diagrams

Question 8

A patch management process is being audited. Which finding indicates a critical gap in the process?

Accepted Answer

Patches are not tested in a staging environment before production deployment. A patch management process must include testing patches in a staging environment before production deployment to validate compatibility and avoid breaking critical systems. Without staging validation, patches can introduce regressions, incompatibilities, or outages in production. This is a critical gap because it removes the safety net that catches patch-related issues before they impact live operations.

Answer

Exception requests for unpatched systems are documented

Answer

Critical systems are patched monthly

Answer

Patches are deployed within 30 days of release

Question 9

A company's security policy requires that all servers be hardened according to CIS Level 1 benchmarks. During an audit, it is discovered that a server has password complexity settings that exceed Level 1 requirements. Which of the following is the most appropriate action?

Accepted Answer

Document the deviation and accept the stronger configuration. Exceeding CIS Level 1 password complexity requirements represents a stronger security posture, not a violation. CIS benchmarks define Level 1 as a minimum baseline of essential security controls, and deviations that improve security are acceptable as long as they are documented and formally accepted by management. The key principle is that compliance is measured against the minimum baseline, and stronger configurations are permitted with proper risk acceptance.

Answer

Report the non-compliance to management for remediation

Answer

Implement Level 2 benchmarks to be consistent

Answer

Immediately revert to Level 1 settings to ensure compliance

Question 10

Drag and drop the steps for conducting a security incident response under the NIST framework into the correct order.

Accepted Answer

Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident Activity, Reporting. NIST incident response follows: Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident Activity, and Reporting.

Answer

Detection & Analysis, Containment/Eradication/Recovery, Preparation, Post-Incident Activity, Reporting

Answer

Preparation, Containment/Eradication/Recovery, Detection & Analysis, Post-Incident Activity, Reporting

Answer

Preparation, Detection & Analysis, Post-Incident Activity, Containment/Eradication/Recovery, Reporting

Question 11

Drag and drop the steps for a typical TLS 1.3 handshake into the correct order.

Accepted Answer

ClientHello, then ServerHello, then EncryptedExtensions, then Finished from server, then Finished from client. TLS 1.3 reduces round trips: ClientHello, ServerHello, EncryptedExtensions, Finished from server, Finished from client.

Answer

ClientHello, then ServerHello, then Finished from client, then EncryptedExtensions, then Finished from server

Answer

ClientHello, then EncryptedExtensions, then ServerHello, then Finished from server, then Finished from client

Answer

ServerHello, then ClientHello, then EncryptedExtensions, then Finished from server, then Finished from client

Question 12

Refer to the exhibit. During a security review, an analyst finds these firewall rules. Which recommendation should be made to reduce risk?

Accepted Answer

Restrict the source for rule 10 to specific administrative IPs. Rule 10 allows SSH (TCP/22) from any source (0.0.0.0/0) to the internal server, which exposes the management interface to the entire internet. Restricting the source to specific administrative IPs reduces the attack surface by limiting who can initiate SSH connections, mitigating brute-force and unauthorized access risks. This aligns with the principle of least privilege and is a fundamental access control recommendation.

Answer

Enable logging on rule 15 as well

Answer

Require VPN access for all internal traffic

Answer

Remove rule 15 entirely

Question 13

A company is implementing a new patch management process. After scanning for missing patches, the team must prioritize which patches to apply first. Which combination of factors is most critical for prioritization?

Accepted Answer

CVSS score and asset criticality. CVSS score quantifies the technical severity of a vulnerability (base, temporal, and environmental metrics), while asset criticality reflects the business impact if that asset is compromised. Combining these two factors ensures patches that are both highly exploitable and protect the most valuable systems are applied first, which is the standard risk-based prioritization approach in patch management frameworks like those from NIST and CIS.

Answer

Number of systems affected and patch size

Answer

Age of the patch and vendor reputation

Answer

Cost of the patch and availability of workarounds

Question 14

An organization uses mandatory access control (MAC) with the Bell-LaPadula model. A subject has a clearance of 'Secret' and an object has a classification of 'Top Secret'. What is the result if the subject attempts to read the object?

Accepted Answer

Read denied. In the Bell-LaPadula model, the Simple Security Property (no read up) prohibits a subject from reading an object with a higher classification. Since the subject has a clearance of 'Secret' and the object is classified as 'Top Secret', the read attempt is denied. This enforces mandatory access control (MAC) by preventing information flow from higher to lower security levels.

Answer

Write denied

Answer

Write allowed

Answer

Read allowed

Question 15

Which TWO of the following are examples of key risk indicators (KRIs)?

Accepted Answer

Number of unpatched critical vulnerabilities. The number of unpatched critical vulnerabilities directly measures the organization's exposure to known exploits. A KRI must be quantifiable and predictive of risk; unpatched vulnerabilities are a leading indicator of potential breaches, as attackers actively scan for and exploit such weaknesses. This metric is commonly tracked in vulnerability management programs to prioritize remediation efforts.

Answer

Total number of employees

Answer

Average user satisfaction score

Answer

Number of security incidents this quarter

Systems Security Certified Practitioner SSCP practice test

Three ways to study

Study SSCP by domain

Study SSCP by topic

Risk Identification, Monitoring, and Analysis practice questions

Access Controls practice questions

Incident Response and Recovery practice questions

Systems and Application Security practice questions

Security Operations and Administration practice questions

Network and Communications Security practice questions

Cryptography practice questions

SSCP fundamentals practice questions

SSCP scenario practice questions

SSCP troubleshooting practice questions

Top SSCP questions

Systems Security Certified Practitioner SSCP practice questions