920 questions total · 13pages · All types, answers revealed
Which term describes the process of verifying the identity of a user, system, or entity?
Authentication verifies the identity claim.
Why this answer
Authentication is the process of verifying that a claimed identity is valid, typically using factors like passwords, biometrics, or tokens.
An organization's security policy requires that all portable media containing sensitive data be encrypted. Which type of control does this requirement represent?
Policies are administrative controls that guide behavior and define requirements.
Why this answer
This requirement is an administrative control because it is a policy mandate that defines rules and procedures for handling sensitive data. Administrative controls are management directives, such as security policies, standards, and guidelines, that govern behavior and processes. The encryption itself is a technical control, but the requirement to encrypt is a policy statement, which falls under administrative controls.
Exam trap
ISC2 SSCP exams test the distinction between administrative and technical controls. The requirement to encrypt is a policy (administrative control), while the encryption algorithm itself is a technical control. Candidates often select 'Technical control' because they focus on the encryption mechanism rather than the mandate.
How to eliminate wrong answers
Option A is wrong because detective controls are designed to identify and alert on security incidents after they occur (e.g., audit logs, intrusion detection systems), not to mandate encryption. Option C is wrong because technical controls are the actual mechanisms (e.g., BitLocker, AES-256 encryption software) that enforce the policy, not the policy requirement itself. Option D is wrong because physical controls protect assets through tangible means (e.g., locks, guards, safes), not through policy directives about data encryption.
To prevent VM escape attacks in a virtualized environment, which of the following is the most critical security measure?
Patching fixes known vulnerabilities that could be used for VM escape.
DHCP servers use UDP port 67 to receive client requests.
A security analyst is reviewing a digital signature implementation. The signer uses their private key to encrypt the hash of a message. What does the recipient use to verify the signature?
The signer's public key is used to verify the signature by decrypting the hash.
Why this answer
Digital signatures use asymmetric cryptography where the signer encrypts the message hash with their private key. The recipient decrypts that encrypted hash using the signer's public key, then compares it to a locally computed hash of the received message. If they match, the signature is verified, proving both authenticity and integrity.
Exam trap
Candidates often confuse the roles of keys in digital signatures, mistakenly thinking the recipient uses their own private key or the signer's private key for verification. In asymmetric cryptography, signature verification always uses the signer's public key.
How to eliminate wrong answers
Option A is wrong because the recipient's private key is used for decryption of data encrypted with the recipient's public key, not for verifying a signature from another party. Option B is wrong because the signer's private key is kept secret and used only by the signer to create the signature; sharing it would compromise the entire system. Option C is wrong because the recipient's public key is used by others to encrypt data for the recipient, not to verify a signature created by a different entity.
An organization implements a new security policy requiring all portable storage devices to be encrypted. Which of the following is the MOST effective control to enforce this policy?
Group Policy can enforce encryption for removable drives when supported.
Why this answer
Configuring Group Policy to require BitLocker encryption on removable drives is the most effective control because it enforces the encryption policy automatically and centrally across all domain-joined systems, preventing users from bypassing the requirement. Unlike a memo or auditing, Group Policy provides a technical enforcement mechanism that blocks unencrypted removable media from being used, ensuring compliance without relying on user discretion.
Exam trap
The trap here is that candidates often confuse 'encrypting the system drive' (Option D) with 'encrypting removable drives,' or they assume auditing (Option C) is a preventive control rather than a detective one.
How to eliminate wrong answers
Option A is wrong because distributing a memo is an administrative control that relies on user compliance and provides no technical enforcement, making it ineffective against intentional or accidental policy violations. Option C is wrong because enabling auditing for removable drive usage only logs events for review after the fact, it does not prevent unencrypted drives from being used or enforce encryption. Option D is wrong because enabling BitLocker on all laptops encrypts the system drives, not removable storage devices, and does not address the policy requirement for portable storage devices.
A company's incident response plan includes a requirement to notify law enforcement within 24 hours of certain security incidents. Which regulation most likely mandates this requirement?
PCI DSS Section 12.10.2 requires notification to law enforcement within 24 hours of a suspected breach.
Why this answer
PCI DSS Requirement 12.10.1 mandates that the incident response plan includes specific procedures to notify law enforcement within 24 hours of detecting a breach involving cardholder data. This is because PCI DSS is a contractual security standard for entities that handle payment card information, and timely law enforcement notification is critical for forensic investigation and legal compliance in payment card fraud cases.
Exam trap
The trap here is that candidates confuse the 24-hour law enforcement notification requirement with GDPR's 72-hour breach notification to the supervisory authority, or assume HIPAA's 60-day rule applies to all healthcare data incidents, when PCI DSS is the only standard with a specific 24-hour law enforcement notification mandate for payment card breaches.
How to eliminate wrong answers
Option A is wrong because SOX (Sarbanes-Oxley Act) focuses on financial reporting accuracy and internal controls for publicly traded companies, not on specific incident notification timelines to law enforcement. Option C is wrong because GDPR requires notification to the supervisory authority within 72 hours of a personal data breach, but it does not mandate law enforcement notification within 24 hours. Option D is wrong because HIPAA requires notification to affected individuals and the Department of Health and Human Services within 60 days for breaches of protected health information, not law enforcement within 24 hours.
A security analyst sees the event log exhibit. What does this indicate?
Logon Type 3 and source IP indicate remote attempt.
Why this answer
The event log shows multiple failed logon attempts for the built-in Administrator account from a remote IP address (e.g., 10.0.0.5) using different passwords, which is a classic brute-force attack pattern. Event ID 4625 (Windows Security Log) with Logon Type 3 (Network logon) and a non-zero workstation name or source network address confirms the attempts originated remotely, not from the console. This indicates a remote attacker is systematically trying to guess the Administrator password.
Exam trap
The trap here is that candidates confuse Logon Type 3 (network) with interactive logon (Type 2) or assume any failed logon for Administrator means a local user, but the presence of a remote IP address and Logon Type 3 specifically indicates a remote brute-force attack.
How to eliminate wrong answers
Option A is wrong because a local user typing the wrong password at the console would generate Event ID 4625 with Logon Type 2 (Interactive) and a local source (e.g., console session), not a remote IP address. Option C is wrong because the event log shows the account name 'Administrator' which exists; a nonexistent account would generate Event ID 4625 with a different status code (e.g., 0xC0000064 for account name not found) and the account name would not match a built-in account. Option D is wrong because a locked-out Administrator account would generate Event ID 4740 (account locked out) or Event ID 4625 with status 0xC0000234 (account locked), not just multiple failed logon attempts with status 0xC000006D (bad password).
A company wants to implement a security baseline for its Windows servers. Which of the following frameworks is most commonly used for this purpose?
CIS Benchmarks are specific, actionable configuration guides for securing operating systems and applications.
Why this answer
CIS Benchmarks are widely adopted security configuration guidelines for various systems, including Windows servers. They provide Level 1 (basic) and Level 2 (defense-in-depth) recommendations.
An organization is implementing a secure software development lifecycle (SDLC). Which activity should be performed during the design phase to minimize security flaws?
Threat modeling in design phase identifies risks before coding.
Why this answer
Threat modeling is a proactive security activity performed during the design phase to identify potential attack vectors, trust boundaries, and threats before any code is written. By analyzing the system architecture and data flows, teams can mitigate security flaws early, reducing the cost and effort of fixing vulnerabilities later in the SDLC.
Exam trap
ISC2 often tests the distinction between design-phase activities (like threat modeling) and implementation or testing-phase activities (like code review or DAST), so the trap is assuming that any security testing or patching belongs in the design phase.
How to eliminate wrong answers
Option B is wrong because dynamic application security testing (DAST) is a runtime testing activity performed after the application is built, not during the design phase. Option C is wrong because applying security patches to the development environment is an operational security task that maintains the integrity of the development infrastructure, not a design-phase activity to minimize flaws in the application itself. Option D is wrong because code review for security vulnerabilities is performed during the implementation phase, after code has been written, not during the design phase.
You are a risk analyst at a healthcare organization. The organization recently deployed a new electronic health records (EHR) system. During the first month of operation, the IT helpdesk received multiple reports from doctors that the system becomes unresponsive for 10-15 seconds several times a day. The EHR vendor attributes this to insufficient database connection pooling, but the organization's system administrator notes that the database server's CPU and memory utilization never exceed 30%. The organization has a risk management policy that requires any system with availability <99.5% to be treated as a high risk. Based on initial data, the system has been unavailable for about 0.1% of the time (excluding planned maintenance). However, doctors report that the brief unresponsiveness is causing frustration and potential misdiagnosis due to interrupted workflows. You need to recommend a risk treatment approach. What should you do?
A deeper analysis will clarify the true risk level before deciding on treatment.
Why this answer
The risk management policy defines high risk based on availability <99.5%, and the system currently shows 99.9% availability (0.1% unavailability). However, the brief 10-15 second unresponsiveness may still pose a clinical safety risk that is not captured by a simple uptime metric. A deeper analysis is required to quantify the actual impact on clinical workflows and patient safety before deciding on risk treatment, as the policy may need to consider functional availability rather than just binary uptime.
Exam trap
The trap here is that candidates focus on the 99.5% availability threshold and assume the risk is acceptable (Option A) or immediately high (Option C), without recognizing that the policy requires a risk assessment that includes impact analysis, and that the technical symptom (connection pooling) may not be resolved by hardware upgrades or load balancers.
How to eliminate wrong answers
Option A is wrong because accepting the risk based solely on the 99.5% availability threshold ignores the qualitative reports of frustration and potential misdiagnosis; the policy may require a risk assessment that includes impact on patient safety, not just uptime percentage. Option B is wrong because implementing a load balancer and additional application servers addresses a different problem (scalability under load) while the vendor attributes the issue to insufficient database connection pooling, which is a database-tier configuration problem, not an application-tier capacity issue. Option C is wrong because documenting the system as high risk and requiring immediate hardware upgrade is premature without first quantifying the clinical impact; the database server CPU and memory are below 30%, indicating the bottleneck is likely connection pooling configuration, not hardware capacity.
Which of the following is a technical threat source that could lead to a security breach?
Software bugs are technical threat sources.
Why this answer
A software bug is a technical threat source because it is an unintentional flaw in code that can be exploited to cause a security breach. For example, a buffer overflow bug in a network service can allow an attacker to execute arbitrary code, bypassing access controls. This directly aligns with the definition of a technical threat as an inherent weakness in hardware or software.
Exam trap
The trap here is confusing vulnerabilities (like configuration weaknesses) with threat sources, but the SSCP exam specifically tests the distinction that a threat source is the cause (e.g., a bug), while a vulnerability is the exploitable condition (e.g., a misconfiguration).
How to eliminate wrong answers
Option B is wrong because a disgruntled employee is a human or personnel threat source, not a technical one; it involves intentional malicious actions by an insider. Option C is wrong because a configuration weakness is a vulnerability (a weakness in a system's setup), not a threat source; threats are the potential causes of harm, while configuration issues are exploitable conditions. Option D is wrong because a flood is a natural or environmental threat source, not a technical one; it falls under physical or environmental threats, not software or hardware flaws.
A security auditor reviews a system that uses HMAC-SHA256 for message authentication. Which property does HMAC provide that a simple hash of the message does not?
HMAC ensures the message has not been altered and verifies the sender's possession of the secret key.
Why this answer
HMAC-SHA256 uses a shared secret key combined with the message before hashing, which provides both integrity (detecting tampering) and authentication (verifying the sender knows the secret). A simple hash of the message alone offers integrity but no authentication, because anyone can compute the same hash without a secret. Thus, HMAC adds authentication via the shared secret, making option C correct.
Exam trap
The trap here is that candidates confuse integrity (provided by any hash) with authentication (which requires a shared secret), leading them to think a simple hash is sufficient for message authentication, but HMAC specifically adds the keyed property.
How to eliminate wrong answers
Option A is wrong because HMAC does not provide confidentiality; it does not encrypt the message, only authenticates it. Option B is wrong because non-repudiation requires asymmetric cryptography (e.g., digital signatures) to bind a message to a specific entity, whereas HMAC uses a shared symmetric key and cannot prove which party created it. Option D is wrong because forward secrecy is a property of key exchange protocols (e.g., Diffie-Hellman ephemeral) that ensures session keys are not compromised if long-term keys are leaked; HMAC does not provide forward secrecy.
A security engineer is hardening a Windows server. Which TWO actions should be taken to reduce the attack surface? (Select TWO.)
Reducing the number of services and accounts minimizes potential entry points.
Why this answer
Removing unnecessary accounts and services, and applying patches are core hardening steps. Disabling auto-run prevents malware from executing automatically.
A system administrator needs to ensure that a Linux server is hardened against common attacks. Which configuration change is MOST effective in preventing privilege escalation via SUID binaries?
Prevents execution of SUID binaries on those partitions.
Why this answer
Mounting partitions like /tmp and /var with the 'nosuid' option prevents SUID and SGID bits from taking effect on files stored there. Since attackers often place malicious SUID binaries in world-writable directories to escalate privileges, this configuration blocks the execution of such binaries regardless of their permissions. This is more effective than logging or removing all SUID binaries, as it proactively neutralizes a common attack vector without breaking system functionality.
Exam trap
The trap here is that candidates may think logging (auditd) or removing all SUID binaries is a viable solution, but the exam tests the understanding that 'nosuid' is a practical, targeted control that prevents exploitation without breaking legitimate system functionality.
How to eliminate wrong answers
Option A is wrong because enabling auditd to log all SUID executions only provides visibility into when SUID binaries are run; it does not prevent privilege escalation, as the binaries still execute with elevated privileges. Option B is wrong because setting the umask to 077 for all users restricts default file permissions for new files but does not affect existing SUID binaries or prevent their execution, nor does it remove the SUID bit from files already present. Option D is wrong because removing all SUID binaries from the system is impractical and often breaks essential system utilities (e.g., sudo, passwd, ping) that legitimately require the SUID bit to function; a more targeted approach like using 'nosuid' on specific partitions is preferred.
Which physical security control is designed to prevent tailgating by allowing only one person to enter at a time?
Correct. A mantrap is specifically designed to prevent tailgating.
Why this answer
A mantrap is a small room with two doors where the first door must close before the second opens, preventing tailgating.
Which THREE of the following are examples of detective controls?
IDS detects intrusions and alerts.
Why this answer
An intrusion detection system (IDS) is a detective control because it passively monitors network traffic or system activity for signs of malicious behavior or policy violations, generating alerts when suspicious patterns are detected. Unlike a preventive control, an IDS does not block traffic; it only identifies and reports incidents after they occur or in real-time, making it a classic example of a detective security measure.
Exam trap
The trap here is that candidates often confuse preventive controls (like firewalls and encryption) with detective controls, mistakenly thinking that any security tool that 'stops' or 'protects' data also detects attacks, when in fact detective controls only identify and report incidents without blocking them.
A company has deployed an intrusion detection system (IDS) that generates numerous false positives. Which approach would best reduce false positives while maintaining detection capability?
Tuning reduces false positives by refining detection criteria.
Why this answer
Tuning IDS signatures and rules (option D) directly addresses the root cause of false positives by refining detection patterns to match legitimate traffic more accurately. This approach preserves the IDS's ability to detect genuine threats while eliminating noise, unlike threshold adjustments which can miss low-and-slow attacks.
Exam trap
The trap here is that candidates confuse 'increasing the threshold' (option A) with tuning, but threshold adjustments are a blunt instrument that can suppress true positives, whereas signature tuning refines detection granularity without sacrificing sensitivity.
How to eliminate wrong answers
Option A is wrong because increasing the alert generation threshold reduces sensitivity across all events, potentially causing true positives (e.g., stealthy attacks) to be missed, which compromises detection capability. Option B is wrong because replacing the IDS with an IPS does not inherently reduce false positives; an IPS uses the same detection mechanisms and may block legitimate traffic if false positives persist, introducing availability risks. Option C is wrong because disabling the IDS eliminates all detection capability, leaving the network blind to attacks during the review period, which is an unacceptable security gap.
An organization's security policy requires that all data at rest be encrypted. A database administrator objects, stating that encryption will degrade performance. What is the best response?
TDE encrypts the entire database transparently with low overhead.
Why this answer
Transparent Data Encryption (TDE) encrypts data at rest at the storage layer, automatically encrypting data before it is written to disk and decrypting it when read into memory. This minimizes performance impact because encryption/decryption occurs outside the application logic and does not require schema changes, making it the best response to the DBA's concern while still meeting the policy requirement.
Exam trap
The trap here is that candidates may choose column-level encryption (Option C) thinking it is more targeted and thus less impactful, but they overlook that TDE is designed specifically to minimize performance impact by operating at the storage layer without requiring application changes.
How to eliminate wrong answers
Option A is wrong because removing the encryption requirement violates the security policy and leaves data at rest unprotected, which is not an acceptable response. Option B is wrong because encrypting only backup files leaves the live database unencrypted, failing to meet the policy's requirement that all data at rest be encrypted, and does not address the DBA's performance concern for the live database. Option C is wrong because column-level encryption can still cause significant performance overhead due to per-row encryption/decryption operations and requires application or schema changes, whereas TDE provides a more efficient, system-level solution.
A security analyst is configuring a SIEM to detect potential insider threats. Which TWO of the following data sources would be most relevant for detecting an employee exfiltrating sensitive data via email?
Email logs capture details of outgoing emails.
Why this answer
Email gateway logs capture metadata and content of outbound emails, including sender, recipient, subject, and attachments, enabling detection of anomalous data transfers. Data Loss Prevention (DLP) logs provide detailed policy violation alerts when sensitive data patterns (e.g., credit card numbers, classified text) are matched in email content, directly identifying exfiltration attempts.
Exam trap
The exam often tests the distinction between logs that show network-level activity (firewall, DNS) versus logs that inspect content or policy violations (email gateway, DLP), leading candidates to mistakenly choose firewall logs because they see 'outbound traffic' without considering content inspection.
Refer to the exhibit. A security administrator notices repeated events with the same failure reason for the Administrator account. What is the MOST likely type of attack?
Multiple failed attempts for one account is characteristic of brute force.
Why this answer
(Brute force) is correct because repeated failed logins for a single account (Administrator) indicate an attacker systematically trying different passwords. Option A (Spear phishing) is wrong; it involves targeted deceptive messages, not repeated login attempts. Option B (Password spraying) is wrong; it uses a few common passwords across many accounts, not many attempts on one account.
Option D (Denial of service) is wrong; it aims to disrupt service, not gain access.
During a security assessment, it is discovered that a Linux server has unnecessary services running, including Telnet and FTP. The server is also missing critical security patches. Which of the following is the MOST effective approach to harden this server according to industry best practices?
Disabling unnecessary services and patching are fundamental hardening steps.
In Linux, which command is used to change file permissions to restrict access so that only the owner can read and write, and the group and others have no access?
chmod 600 sets owner rw, group and others nothing.
Why this answer
The chmod command changes file permissions. The octal mode 600 sets read/write for owner, no permissions for group and others.
Which access control model enforces the principle of least privilege by granting permissions based on job functions and requires separation of duties?
RBAC is designed to support least privilege and separation of duties.
Why this answer
RBAC assigns permissions to roles, and users are assigned to roles, enabling least privilege and separation of duties through role design.
Which two of the following measures ensure the integrity of backup data? (Choose two.)
Offline/immutable backups prevent modification.
Why this answer
Regular backup testing verifies that backups are restorable. Keeping backups offline and immutable prevents tampering. Storing on the same drive risks loss.
Encryption protects confidentiality, not necessarily integrity.
Refer to the exhibit. A web server log shows two requests from the same IP. What type of attack is being attempted, and which mitigation is MOST effective?
The requests contain SQL injection patterns (OR 1=1 and DROP TABLE). Parameterized queries prevent SQL injection by separating code from data.
Why this answer
The requests contain SQL injection patterns (OR 1=1 and DROP TABLE). Parameterized queries prevent SQL injection. Option B is wrong because XSS would involve script tags.
Option C is wrong because CSRF would involve a different method and referrer. Option D is wrong because command injection would involve shell commands.
Which TWO components are essential for an effective disaster recovery plan (DRP)?
RPO defines maximum acceptable data loss.
Why this answer
The Recovery Point Objective (RPO) defines the maximum acceptable data loss measured in time, which directly determines the required backup frequency and data replication strategy. Without an RPO, the DRP cannot specify how much data can be lost, making it impossible to design appropriate backup and recovery mechanisms. This metric is essential because it drives the technical implementation of data protection, such as snapshot intervals or synchronous replication.
Exam trap
ISC2 often tests the distinction between essential DRP components (RPO and RTO) and supporting technologies or prerequisites (BIA, failover systems, RAID), leading candidates to confuse inputs or tools with the plan's core metrics.
An organization uses a mantrap at its main entrance. An employee badges in, enters the first door, but then the second door fails to open. What should the employee do?
Proper procedure to get assistance without compromising security.
Why this answer
The employee should not attempt to force the door; instead, they should use the intercom to contact security for assistance.
Which TWO of the following are common weaknesses in cryptographic implementations that an SSCP should be aware of? (Select exactly 2.)
Predictable random numbers can lead to key compromise.
Why this answer
Weak random number generation is a critical flaw because cryptographic keys, nonces, and initialization vectors rely on unpredictability. If an attacker can predict or reproduce the random values (e.g., due to a low-entropy source or a flawed PRNG like a linear congruential generator), they can derive secret keys or break session security. This undermines the entire cryptographic system regardless of the algorithm strength.
Exam trap
ISC2 often tests the misconception that 'using strong algorithms' or 'following standards' automatically guarantees security, when in fact implementation flaws like weak randomness or poor key management are the real vulnerabilities.
Drag and drop the steps for implementing mandatory access control (MAC) using security labels into the correct order.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
MAC relies on predefined labels; subjects and objects are labeled, then the reference monitor enforces rules like no read up, no write down.
Which of the following OWASP Top 10 vulnerabilities involves an attacker sending malicious data to an interpreter as part of a command or query?
Injection includes SQL, OS, and LDAP injection attacks.
Why this answer
Injection attacks, such as SQL injection, occur when untrusted data is sent to an interpreter. Broken Authentication refers to flaws in auth mechanisms. XSS injects scripts into web pages.
Security misconfiguration involves improper setup.
Given the exhibit, what is the most likely conclusion?
The pattern indicates successful compromise.
Why this answer
The exhibit shows a brute-force attack with multiple failed login attempts followed by a successful login from the same source IP. This pattern indicates that the attacker likely guessed or cracked the password, making the admin account compromised. Option D is correct because the sequence of events directly correlates with a successful brute-force attack.
Exam trap
The trap here is that candidates may dismiss the successful login as a false positive or coincidence, failing to recognize that the sequential pattern of failures followed by a success from the same source is the definitive signature of a successful brute-force attack.
How to eliminate wrong answers
Option A is wrong because the alert is not a false positive; the pattern of repeated failures followed by a success is a classic indicator of a successful brute-force attack, not a benign event. Option B is wrong because the authentication server logs are not misconfigured; they correctly recorded both the failed and successful logins, which is expected behavior. Option C is wrong because the successful login is not coincidental; it is directly linked to the preceding brute-force attempts, as evidenced by the same source IP and target account.
Which of the following is a key advantage of using a behavior-based detection approach in a User and Entity Behavior Analytics (UEBA) system?
UEBA excels at detecting unknown threats by identifying deviations.
Why this answer
Behavior-based detection in UEBA establishes a baseline of normal user and entity activity using machine learning and statistical models. It then identifies deviations from this baseline, enabling the detection of novel or previously unknown threats, such as zero-day exploits or insider threats, without relying on pre-defined signatures.
Exam trap
The trap here is that candidates often assume behavior-based detection is easier or produces fewer false positives, but the exam emphasizes that its key advantage is detecting unknown threats, not operational simplicity or accuracy.
How to eliminate wrong answers
Option B is wrong because behavior-based detection typically requires more data processing and computational resources than signature-based detection, which simply matches patterns against a static database. Option C is wrong because behavior-based systems are more complex to configure and maintain, requiring tuning of baselines and thresholds, whereas signature-based systems are simpler to update with new signatures. Option D is wrong because behavior-based detection often produces higher false positive rates due to legitimate but unusual activities being flagged as anomalous, while signature-based detection has lower false positives for known threats but misses unknown ones.
A cloud application uses OAuth 2.0 to authorize a third-party app to access user data. What is the primary purpose of the access token issued by the authorization server?
The access token contains scopes and is presented to the resource server to obtain access to protected resources.
Why this answer
In OAuth 2.0, the access token is a credential that represents the authorization granted to the client application by the resource owner. Its primary purpose is to allow the client to access specific, scoped resources on the resource server on behalf of the user, without exposing the user's credentials. This is defined in RFC 6749, where the token encapsulates the granted permissions and scope.
Exam trap
The trap here is that candidates often confuse authentication with authorization, mistakenly believing the access token authenticates the user to the resource server, when in fact it only authorizes the client to access resources on behalf of the user.
How to eliminate wrong answers
Option A is wrong because revoking the user's access to the client application is not a function of the access token; revocation is handled via token revocation endpoints or by the authorization server invalidating the token, not by the token itself. Option B is wrong because the access token does not encrypt data; it is a bearer token that is passed in HTTP headers, and encryption of data in transit is typically handled by TLS, not by the token. Option D is wrong because the access token is not used to authenticate the user to the resource server; authentication is performed by the authorization server during the authorization grant flow, and the token only authorizes access to resources, it does not prove the user's identity.
A security administrator needs to implement an access control model that grants access based on attributes of the user, resource, and environment, using policy rules. Which model is most appropriate?
ABAC uses attributes and policies for access decisions.
Why this answer
Attribute-Based Access Control (ABAC) uses policies that evaluate attributes of the subject, object, and environment to make access decisions, offering fine-grained and dynamic control.
During a vulnerability scan, a security team discovers that several virtual machine snapshots contain outdated software with known vulnerabilities. Which risk is most directly associated with this scenario?
Outdated snapshots can reintroduce old vulnerabilities when deployed.
Why this answer
VM snapshots, if left inactive and not patched, can reintroduce vulnerabilities when the snapshot is used to provision new VMs, as the software is outdated.
Which of the following is a common method for implementing multi-factor authentication (MFA) using something you have and something you know?
Smart card is something you have; PIN is something you know.
Why this answer
A smart card (something you have) combined with a PIN (something you know) is a classic MFA implementation.
A security analyst needs to verify that a downloaded file has not been tampered with. The publisher provides a SHA-256 hash. Which property of the hash function is being relied upon?
Second pre-image resistance is correct. Given the provided SHA-256 hash of the original file, the property ensures that an attacker cannot find a different file that produces the same hash, thus verifying integrity.
Why this answer
When relying on a provided hash to verify file integrity, the security analyst is using second pre-image resistance. This property ensures that given a hash value (the original file's hash), it is computationally infeasible to find another input (a tampered file) that produces the same hash. Thus, if the computed hash matches the provided hash, the file is authentic and unchanged.
Collision resistance is a stronger property but not directly required here; second pre-image resistance is the exact requirement for this scenario.
Exam trap
Candidates often incorrectly choose collision resistance because it is commonly associated with hash functions. However, the specific scenario of verifying a known hash relies on second pre-image resistance, not collision resistance. Collision resistance prevents finding any two inputs with the same hash, but here the attacker is given the hash of the original and must find a different input with that same hash, which is second pre-image resistance.
How to eliminate wrong answers
Option A is wrong because the avalanche effect describes how a small change in input drastically changes the output hash, but it does not directly prevent tampering; it is a property that contributes to security but is not the primary reliance for verifying file integrity. Option C is wrong because second pre-image resistance ensures that given a message and its hash, an attacker cannot find a different message with the same hash; while important, the scenario of verifying a downloaded file against a provided hash relies on collision resistance to prevent an attacker from creating any two messages with the same hash, not just finding a second pre-image for a known message. Option D is wrong because pre-image resistance ensures that given a hash, an attacker cannot find the original input; this is irrelevant for verifying that a file has not been tampered with, as the analyst already has the file and is checking its hash against the published one.
Which TWO of the following are key components of a configuration management database (CMDB)? (Select TWO)
CMDB tracks dependencies and relationships between CIs.
Why this answer
A CMDB is a repository that stores information about configuration items (CIs) and their relationships. Option C is correct because relationships between CIs are fundamental to understanding how changes affect the IT infrastructure. Option E is correct because hardware inventory details like serial numbers are typical attributes stored for each CI, enabling asset tracking and impact analysis.
Exam trap
The trap here is confusing the CMDB with other ITIL processes or data stores, leading candidates to select change request approvals (a change management artifact) or incident tickets (an incident management artifact) as CMDB components, when they are separate records linked to CIs but not stored within the CMDB itself.
During an incident response, a forensic analyst captures a memory dump from a compromised server. Which of the following is the MOST important step to ensure the integrity of the evidence?
Hashing preserves integrity by allowing verification that the evidence has not been modified.
Why this answer
Creating a cryptographic hash of the memory dump immediately after capture is the most important step to ensure evidence integrity, as it provides a unique fingerprint to verify that the data has not been altered. Write blockers are used for storage media, not memory captures. Storing the dump on the same server risks modification or loss.
Running antivirus is irrelevant and could alter the dump.
Which of the following best describes the purpose of a Hardware Security Module (HSM) in key management?
HSMs are designed to protect keys throughout their lifecycle.
Why this answer
A Hardware Security Module (HSM) is a dedicated, tamper-resistant hardware appliance designed to securely generate, store, and manage cryptographic keys throughout their lifecycle. By keeping keys within the HSM's physical and logical boundaries, it prevents unauthorized extraction even if the host system is compromised, which is the core purpose of an HSM in key management.
Exam trap
The trap here is that candidates confuse an HSM's ability to perform cryptographic operations (like encryption or signing) with its primary purpose, which is secure key storage and lifecycle management, not performance acceleration or replacing PKI.
How to eliminate wrong answers
Option B is wrong because an HSM does not replace Public Key Infrastructure (PKI); PKI is a framework of policies, roles, and software (e.g., Certificate Authorities) for managing digital certificates, while an HSM is a hardware device that can be used to protect the private keys within a PKI. Option C is wrong because accelerating network traffic encryption is not the primary purpose of an HSM; that function is typically performed by dedicated cryptographic accelerators or offload engines (e.g., Intel QAT), whereas an HSM focuses on secure key storage and limited cryptographic operations. Option D is wrong because while HSMs can generate random numbers, they are used for cryptographic purposes (e.g., key generation, nonces) and not for non-cryptographic use; general random number generation for non-cryptographic tasks is done by simpler PRNGs like those in standard OS libraries.
A security administrator is designing physical security for a high-security area. Which TWO controls are most effective for preventing unauthorized entry? (Select TWO)
Unique identification prevents unauthorized access.
Why this answer
Biometric readers and mantraps provide strong authentication and access control.
A system administrator needs to grant a temporary contractor access to a specific shared folder for two weeks. Which access control approach is most appropriate?
This provides time-limited access with minimal overhead.
Why this answer
Creating a temporary user account with an expiration date directly addresses the need for time-limited access. Granting NTFS permissions on the specific shared folder provides granular, least-privilege access control. This approach ensures the account is automatically disabled after two weeks, reducing administrative overhead and security risk.
Exam trap
The trap here is that candidates often choose role-based access control (RBAC) as a best practice, but fail to recognize that creating a new role for a single temporary user is an anti-pattern that violates role-based design principles and does not inherently enforce time limits.
How to eliminate wrong answers
Option A is wrong because creating a new role for a single temporary contractor violates the principle of role engineering—roles should be based on job functions, not individuals, and this approach adds unnecessary complexity without addressing the time limit. Option C is wrong because mandatory access control (MAC) uses system-wide security labels enforced by the operating system, which is overly rigid for a simple temporary access need and requires significant configuration overhead. Option D is wrong because discretionary access control (DAC) allows the resource owner to grant permissions, but relying on the contractor to request access introduces delays and lacks automatic expiration, leaving the folder exposed after the two-week period.
In the Bell-LaPadula model, which property prevents a subject from reading an object at a higher classification level?
This property prevents reading higher-level objects.
Why this answer
The Simple Security Property (no read up) ensures subjects cannot access objects above their clearance level, protecting confidentiality.
A company uses a cloud storage service that encrypts files with a key derived from the user's password (e.g., using PBKDF2). The security team recommends migrating to a separate key management service (KMS) that generates and manages encryption keys independently of user passwords. What is the most critical security advantage of using a KMS in this scenario?
When keys are separate from passwords, password changes can be handled without re-encrypting data.
Why this answer
When encryption keys are derived from a user's password (e.g., via PBKDF2), changing the password changes the derived key, requiring all files encrypted under the old key to be decrypted and re-encrypted with the new key. A separate KMS decouples key management from user credentials, allowing password changes without affecting the underlying encryption keys, thus avoiding costly and time-consuming re-encryption operations.
Exam trap
ISC2 often tests the misconception that KMS-generated keys are always cryptographically stronger than password-derived keys, when the real advantage is operational separation of key lifecycle from user credentials.
How to eliminate wrong answers
Option A is wrong because password-derived keys are not inherently weaker than KMS-generated keys; PBKDF2 with sufficient iterations and salt can produce strong keys, and the weakness often lies in poor password entropy rather than the derivation algorithm itself. Option C is wrong because KMS encryption/decryption speed is typically slower than local operations due to network latency and API overhead, especially for large files where envelope encryption is used. Option D is wrong because while KMS can provide audit logging, this is not the most critical advantage in this scenario; the primary security benefit is the separation of key management from user passwords, which directly addresses the re-encryption problem.
Refer to the exhibit. The firewall rule is attached to a database server. Which hosts can connect to the database?
The security group allows port 3306 traffic only from the 10.0.0.0/8 CIDR.
Why this answer
The firewall rule allows inbound traffic on the database port from the 10.0.0.0/8 range. Since the database server is in a private subnet with no public IP, only hosts within that RFC 1918 address space can reach it. Option D is correct because the rule explicitly permits only 10.0.0.0/8, which includes internal hosts in that range.
How to eliminate wrong answers
Option A is wrong because the security group rule permits traffic from 10.0.0.0/8, so some hosts can connect. Option B is wrong because internet hosts are not in the 10.0.0.0/8 range and cannot connect unless a public IP or NAT is involved, which is not indicated. Option C is wrong because the rule does not allow any host on the internet; it restricts source to a private IP range.
An organization is hardening a Linux server. Which TWO of the following are effective steps to reduce the attack surface?
This reduces the number of potential vulnerabilities.
Why this answer
Removing unnecessary services and software reduces potential vulnerabilities. Proper file permissions using chmod and chown enforce least privilege.
Which TWO of the following are examples of administrative controls in a security program? (Choose two.)
Policies are administrative directives.
Why this answer
Security policies (A) are administrative controls because they define the rules, responsibilities, and expected behaviors for users and administrators, forming the foundation of a security program. Employee background checks (D) are also administrative controls, as they are personnel vetting procedures that reduce insider risk and enforce trust before granting access. Both are non-technical, process-based measures that guide human actions rather than directly blocking or detecting threats.
Exam trap
ISC2 often tests the distinction between administrative, technical, and physical controls, and the trap here is that candidates confuse firewall rules or intrusion detection software (both technical controls) with administrative controls because they are part of a security program, but they are not process-based or policy-driven.
A network has multiple VLANs with an IDS deployed on the core switch using SPAN ports. The IDS is missing some packets during high traffic periods. What is the best course of action to improve packet capture reliability?
An inline IDS passes all traffic directly through the device, eliminating SPAN port drops and ensuring full visibility.
Why this answer
Deploying the IDS inline ensures that all traffic destined for the monitored segment must pass through the device, eliminating packet loss caused by oversubscription of SPAN ports during high traffic periods. SPAN ports rely on switch fabric replication, which can drop packets when the aggregate traffic exceeds the port's bandwidth or the switch's internal buffer capacity. Inline deployment places the IDS directly in the data path, guaranteeing that every packet is inspected without reliance on replication.
Exam trap
ISC2 often tests the misconception that increasing buffers or adding more SPAN sessions can solve packet loss, when the real issue is the inherent unreliability of SPAN port replication under high load, making inline deployment the only guaranteed solution.
How to eliminate wrong answers
Option B is wrong because NetFlow is a flow-based monitoring technology that provides statistical summaries and metadata, not full packet capture, so it cannot improve packet capture reliability. Option C is wrong because using multiple SPAN sessions does not address the root cause of packet loss; it only replicates the same oversubscribed traffic to additional ports, potentially worsening congestion. Option D is wrong because increasing the SPAN port buffer may temporarily reduce drops but does not solve the fundamental issue of the SPAN port being unable to handle peak traffic rates, as buffers can still overflow under sustained high load.
A company is implementing a change management process. Which THREE elements are essential for every change request? (Select THREE)
Necessary to understand what is being changed.
Why this answer
A description of the change is essential because it provides a clear, documented account of what will be modified, including systems, configurations, or procedures affected. Without a precise description, the change cannot be properly reviewed, approved, or audited, violating the principle of change traceability.
Exam trap
The trap here is that candidates confuse 'essential change request elements' with general business processes like HR reviews or financial approvals, but the SSCP focuses strictly on technical and operational controls for security and stability.
A security analyst is investigating an account compromise. The organization uses Kerberos for single sign-on. Which TWO of the following would help in tracking the source of the compromise?
AS logs show initial authentication attempts with source IPs.
Why this answer
Kerberos logs ticket requests and TGT usage, which can trace authentication events. TGT expiration and session key details are part of the protocol but less directly useful for source identification.
Refer to the exhibit. What security issue is present in this firewall policy?
Without a deny all, any unmatched traffic is allowed.
Why this answer
The exhibit shows a firewall policy with explicit permit rules but no explicit deny all rule at the bottom. Without a default deny rule, any traffic not matching an explicit permit may be implicitly allowed or handled unpredictably depending on the firewall platform, violating the security principle of least privilege. A proper firewall policy must end with an explicit deny all to block all unauthorized traffic.
Exam trap
ISC2 often tests the concept that a firewall policy without an explicit deny all rule at the bottom is inherently insecure, even if all other rules appear correct, because candidates may focus on specific rule content rather than the overall policy structure.
How to eliminate wrong answers
Option A is wrong because the exhibit does not show any rule allowing web traffic from any source; the policy may permit web traffic only from specific sources or to specific destinations. Option C is wrong because the exhibit does not indicate that all traffic on port 443 is allowed; port 443 traffic may be restricted by source or destination. Option D is wrong because the destination network being broad is not the primary security issue; while overly broad destinations can weaken security, the fundamental flaw is the missing default deny rule.
Option E is wrong because SSH being blocked for a specific subnet is a legitimate security control, not an issue; the problem is the absence of a catch-all deny rule.
Which TWO of the following are valid reasons for implementing a separation of duties policy? (Choose two.)
Having different people perform related tasks allows for error detection.
Why this answer
Separation of duties (SoD) is a security control that divides critical tasks among multiple individuals to prevent any single person from having excessive control. Option B is correct because independent verification is a core benefit: when one person performs a task and another reviews it, errors are more likely to be caught before they cause damage. This is especially important in financial transactions or system configuration changes where a single mistake could have significant consequences.
Exam trap
ISC2 often tests the distinction between compliance as a requirement versus a fundamental security reason; candidates mistakenly choose 'compliance' as a core reason when the question asks for the underlying security benefit.
A company deploys a web application that handles sensitive financial transactions. To protect data in transit, which protocol should be used?
TLS 1.2 is secure and appropriate for web applications.
Why this answer
TLS 1.2 is the correct choice because it is the industry-standard protocol for securing HTTP traffic, providing encryption, integrity, and authentication for data in transit. It is widely supported, has no known practical vulnerabilities (unlike SSL 3.0), and is specifically designed for web application protocols like HTTPS, making it ideal for protecting sensitive financial transactions.
How to eliminate wrong answers
Option A is wrong because SSH (Secure Shell) is a protocol for secure remote administration and file transfer (e.g., SFTP), not for securing web application traffic; it operates on a different application layer and does not integrate with HTTP. Option B is wrong because SSL 3.0 is deprecated due to critical vulnerabilities such as the POODLE attack (CVE-2014-3566), which allows plaintext recovery, and it is no longer considered secure for protecting sensitive data. Option C is wrong because IPsec in transport mode secures IP packets between two hosts (e.g., for VPNs or host-to-host communication), but it is not designed to protect application-layer web traffic like HTTP; it requires complex configuration and does not natively integrate with web browsers or servers.
An organization wants to implement multi-factor authentication (MFA) for remote access. Which combination represents something you have and something you are?
Smart card (something you have) and fingerprint (something you are) provide MFA.
Why this answer
Something you have (smart card) plus something you are (fingerprint) constitutes MFA using two different factors.
A cloud security team is implementing a Cloud Security Posture Management (CSPM) tool. What is the primary purpose of a CSPM solution?
CSPM focuses on configuration and compliance.
Why this answer
CSPM tools automate the detection of misconfigurations and compliance violations in cloud environments.
AES-128 is a strong, recommended encryption algorithm for IPsec.
Why this answer
AES encryption with a minimum key size of 128 bits is a best practice for IPsec VPNs because it provides strong, symmetric encryption that is resistant to known cryptographic attacks. AES-128 is approved by NIST and widely considered secure for protecting sensitive data over untrusted networks like the internet.
Exam trap
The trap here is that candidates often confuse pre-shared keys as a secure authentication method for IPsec, but the SSCP exam emphasizes that PSKs are weak compared to digital certificates or EAP methods, especially in enterprise environments.
A security analyst notices that a user’s account has been used to access sensitive files at 3:00 AM from an IP address outside the company’s country. The analyst suspects a compromised account. Which action should be taken FIRST?
Disabling the account stops all access from any source.
Why this answer
The first step in incident response is to isolate the threat. Disabling the account prevents further unauthorized access while the investigation proceeds.
During a vulnerability scan, a critical vulnerability is found on a publicly accessible web server. The server hosts a legacy application that cannot be patched immediately. What should the risk manager do first?
Compensating controls mitigate the vulnerability without patching, buying time for a permanent fix.
Why this answer
When a critical vulnerability cannot be patched immediately, implementing compensating controls is the appropriate first step to reduce risk while maintaining business operations. Compensating controls, such as a web application firewall (WAF) with custom rules to block exploit attempts or network segmentation with strict access control lists (ACLs), provide a temporary mitigation layer. This aligns with the risk management principle of reducing risk to an acceptable level without disrupting critical services.
Exam trap
ISC2 often tests the misconception that immediate removal from the network is always the correct first step, but the SSCP exam emphasizes balancing security with business continuity, making compensating controls the preferred initial action.
How to eliminate wrong answers
Option B is wrong because removing the server from the network would cause immediate denial of service for the legacy application, which may be critical to business operations, and is an extreme measure that should only be taken if the vulnerability is actively exploited and no other controls exist. Option C is wrong because notifying the application owner is a procedural step that should occur after or in parallel with implementing compensating controls; it does not directly address the immediate risk reduction required. Option D is wrong because accepting the risk without first attempting to mitigate it through compensating controls is premature and violates the risk management hierarchy, which prioritizes mitigation over acceptance when feasible.
During the detection and analysis phase, an analyst classifies an incident as P1 (critical) because it involves a breach of sensitive customer data. What is the IMMEDIATE next step the analyst should take?
P1 incidents require immediate escalation to management and legal for breach notification requirements.
Why this answer
When an incident is classified as P1 (critical) due to a breach of sensitive customer data, the immediate next step is to escalate to the incident response manager and legal counsel. This ensures that legal obligations (e.g., breach notification laws, regulatory reporting) and organizational authority are engaged before any technical actions that could alter evidence or violate chain-of-custody requirements. The detection and analysis phase prioritizes notification of key stakeholders to coordinate a lawful and effective response.
Exam trap
The trap here is that candidates often jump to containment (Option D) as the immediate technical step, but the SSCP exam emphasizes that for critical incidents involving sensitive data, escalation to management and legal must occur first to ensure legal and regulatory compliance before any technical action.
How to eliminate wrong answers
Option A is wrong because notifying affected customers prematurely, before legal counsel has assessed notification requirements (e.g., under GDPR or HIPAA), could violate data breach notification laws and expose the organization to liability. Option B is wrong because creating a forensic image is a step typically performed after escalation and authorization, and doing so without legal or managerial approval may compromise the chain of custody or violate data privacy regulations. Option D is wrong because beginning containment before escalation risks destroying volatile evidence or making unauthorized changes that could hinder forensic analysis and legal proceedings.
A security analyst is responding to a malware incident on a Windows server. Which TWO actions should be taken to properly collect volatile evidence?
Memory dump captures volatile data from RAM.
Why this answer
WinPmem is a dedicated memory acquisition tool that captures the contents of RAM, which contains critical volatile evidence such as running processes, open network connections, and injected code. Since volatile data is lost on power loss or reboot, capturing a memory dump before any other action preserves this evidence for forensic analysis.
Exam trap
The trap here is that candidates often confuse 'volatile evidence' with 'non-volatile evidence' and choose disk imaging (Option C) instead of memory capture, or mistakenly think rebooting (Option A) is a safe containment step.
PMF prevents deauthentication and disassociation attacks.
Why this answer
WPA3 uses Simultaneous Authentication of Equals (SAE) to resist offline dictionary attacks, mandates Protected Management Frames (PMF) to prevent deauth attacks, and offers 192-bit security for Enterprise mode.
Refer to the exhibit. An administrator applies this ACL to the external interface. What specific traffic is blocked?
The deny statement blocks all ICMP echo-request messages, i.e., ping requests.
Why this answer
The ACL is applied to the external interface and denies ICMP echo-request (type 8) packets while permitting ICMP echo-reply (type 0) packets. This blocks only ping requests (echo-requests) from entering the network, but allows ping replies (echo-replies) to return for outbound-initiated traffic. Therefore, option D is correct because the ACL specifically targets and blocks all ping requests.
Exam trap
The trap here is that candidates often assume 'ping' is a single protocol or that blocking ping requests also blocks replies, but Cisco tests the distinction between ICMP echo-request (type 8) and echo-reply (type 0) in ACLs.
How to eliminate wrong answers
Option A is wrong because the ACL only denies ICMP type 8 (echo-request) and permits ICMP type 0 (echo-reply), so ping replies are not blocked. Option B is wrong because the ACL explicitly permits ICMP echo-reply, so only ping requests are blocked, not replies. Option C is wrong because the ACL does not block all ICMP traffic; it only denies ICMP type 8 while permitting other ICMP types, such as echo-reply and potentially others depending on the implicit permit or explicit rules.
Which of the following wireless security protocols uses AES-CCMP and is based on the 802.11i standard?
WPA2 uses AES-CCMP per 802.11i.
Why this answer
WPA2 (Wi-Fi Protected Access 2) uses AES-CCMP encryption, as defined in 802.11i.
A security analyst detects unusual outbound traffic from a server to a known malicious IP. The server is running a critical business application. What should the analyst do FIRST?
Disconnecting provides quick containment to prevent further data exfiltration.
Why this answer
The first priority in incident response is containment. Disconnecting the server from the network immediately stops potential data exfiltration and prevents the attacker from causing further damage. Option A is too broad and would disrupt legitimate services.
Option B (running antivirus) delays containment and may not be effective against advanced threats. Option D (alerting the system administrator) is important but should not precede containment; containment must be performed first to minimize impact.
Exam trap
Candidates may think that alerting the system administrator is the first step, but in incident response, containment actions take precedence to stop active harm.
An organization is redesigning its DMZ to host a public web server and an internal file server. Which architecture provides the strongest security?
This isolates the file server and limits exposure.
Why this answer
It follows the principle of least privilege and defense in depth by placing the public-facing web server in the DMZ, where it can be accessed from the internet, while the internal file server remains on the internal network, isolated from direct external access. Only HTTP/HTTPS traffic is allowed from the web server to the file server, typically enforced by a stateful firewall or an application-layer gateway, which minimizes the attack surface and prevents lateral movement if the web server is compromised.
Exam trap
The trap here is that candidates often assume placing both servers in the DMZ (Option A) is simpler and sufficient, but they overlook that the DMZ is a semi-trusted zone and internal servers should never be directly exposed to the internet or to compromised DMZ hosts without strict access controls.
How to eliminate wrong answers
Option A is wrong because placing both servers in the DMZ with no firewall between them exposes the internal file server directly to the internet, allowing any attacker who compromises the web server to access the file server without additional barriers, violating the segmentation principle. Option B is wrong because placing the file server in the DMZ with a VPN still exposes it to the internet (VPN termination is in the DMZ), and the web server on the internal network would require inbound internet traffic to traverse the internal network, increasing risk; VPNs do not replace the need for proper DMZ segmentation. Option C is wrong because placing both servers on the internal network with a stateful firewall inspecting traffic still exposes the internal network to direct internet traffic destined for the web server, bypassing the DMZ's isolation and increasing the risk of internal network compromise.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
IPsec tunnel setup: IKE phase 1 (management SA), IKE phase 2 (IPsec SA), then apply to traffic.
A security awareness training program is being developed. Which topic is most important to include to reduce the risk of credential theft?
Phishing is a common vector for credential theft.
Why this answer
Phishing is the primary vector for credential theft, as attackers use deceptive emails or messages to trick users into revealing usernames and passwords. Training users to recognize phishing attempts—such as spoofed sender addresses, suspicious URLs, and urgent language—directly mitigates this risk by preventing credential disclosure at the point of attack. Unlike other topics, phishing awareness specifically targets the social engineering techniques most commonly used to steal credentials.
Exam trap
The trap here is that candidates may choose physical security procedures (Option B) because they associate credential theft with stolen hardware, but the SSCP exam emphasizes that the most common and effective method of credential theft is phishing, not physical access.
How to eliminate wrong answers
Option A is wrong because proper use of social media, while important for privacy, does not directly address credential theft; attackers typically harvest credentials through phishing rather than social media posts. Option B is wrong because physical security procedures, such as locking doors or securing badges, protect against physical theft of devices or documents but do not prevent remote phishing attacks that steal credentials via email or web forms. Option D is wrong because data backup procedures focus on recovering from data loss due to ransomware or hardware failure, not on preventing the initial compromise of credentials through social engineering.
An organization is implementing a software inventory management process. Which TWO of the following should be tracked for each software asset?
License tracking ensures compliance with vendor agreements.
Why this answer
License type and number of licenses are critical for ensuring compliance with software licensing agreements and avoiding legal or financial penalties. Tracking these allows the organization to verify that the number of installed copies does not exceed the purchased licenses, which is a core requirement of software asset management (SAM).
Exam trap
(ISC)² often tests the distinction between physical asset tracking (e.g., hardware serial numbers) and logical software inventory attributes, leading candidates to mistakenly select the serial number of installation media as a tracked item.
Which DR testing type involves running recovery systems in parallel with production systems to verify functionality without impacting live operations?
Correct. Parallel testing runs DR systems concurrently with production.
Why this answer
A parallel test is the correct DR testing type because it involves running the recovery systems concurrently with the production systems. This allows the organization to verify that the backup systems function correctly and can handle the workload without any impact on live operations, as the production environment remains untouched.
Exam trap
ISC2 often tests the distinction between a parallel test and a simulation test, where candidates mistakenly think a simulation involves actual system execution, but in reality, a simulation test is a theoretical exercise without any live system activation.
How to eliminate wrong answers
Option A is wrong because a full interruption test (also known as a full-scale or hot start test) requires shutting down the primary production systems and failing over entirely to the recovery site, which directly impacts live operations and is not a parallel run. Option B is wrong because a simulation test involves a walk-through or role-playing scenario where team members discuss their responses to a disaster without actually activating any recovery systems or processing live data. Option D is wrong because a tabletop exercise is a discussion-based session where participants review plans and procedures in a meeting room, with no actual execution of recovery systems or parallel processing.
A security engineer is designing a network segmentation strategy to isolate a DMZ containing public-facing web servers from the internal corporate network. Which TWO controls should be implemented? (Select two)
VLANs provide logical segmentation at Layer 2.
Which wireless security standard replaces WPA2 and mandates Protected Management Frames (PMF) to prevent certain types of attacks?
WPA3 requires PMF and uses SAE for secure key exchange.
Why this answer
WPA3 mandates PMF, making it resistant to offline dictionary attacks and key recovery attacks like KRACK.
After a ransomware attack, the recovery team restored systems from backups. However, some files remain encrypted. What is the most probable cause?
If the ransomware encrypted files on the backup repository before restoration, restored files would remain encrypted.
Why this answer
If backups were also encrypted, the recovery team would restore encrypted copies of the files, leaving them in an encrypted state after restoration. This occurs when the ransomware has sufficient privileges to encrypt the backup repository or when backups are stored on a mounted volume that the ransomware can access. The most probable cause is that the backup data itself was compromised, not that the restoration process failed.
Exam trap
ISC2 often tests the misconception that restoration process errors (like skipping file types) are the primary cause, when in reality the integrity of the backup source is the critical factor in ransomware recovery scenarios.
How to eliminate wrong answers
Option B is wrong because a compromised backup software would typically prevent restoration entirely or introduce new malware, not leave specific files encrypted after a successful restore. Option C is wrong because a delayed encryption mechanism would encrypt files after restoration, not leave them encrypted from the backup source. Option D is wrong because skipping file types during restoration would result in missing files, not files that are present but still encrypted.
Which of the following hash algorithms is considered cryptographically broken and should be avoided due to collision attacks?
MD5 is broken and collisions can be generated easily.
Why this answer
MD5 is known to have collision vulnerabilities and is no longer considered secure.
A system administrator notices that a server's certificate was issued by a CA that is not in the trusted root store of client machines. What is the most likely impact on clients connecting via TLS?
Untrusted CA causes a trust error, resulting in a warning or failure.
Why this answer
When a server presents a certificate issued by a Certificate Authority (CA) that is not in the client's trusted root store, the TLS handshake fails the trust chain validation. The client's TLS library (e.g., OpenSSL, Schannel) will either display a certificate warning to the user or terminate the connection with an error such as 'SEC_ERROR_UNKNOWN_ISSUER' in Firefox or 'ERR_CERT_AUTHORITY_INVALID' in Chrome, depending on the client's security policy.
Exam trap
The trap here is that candidates assume TLS connections will proceed with reduced security or a warning, but in strict implementations (e.g., many browsers and modern applications), the connection is completely blocked rather than just warned.
How to eliminate wrong answers
Option B is wrong because the server cannot automatically obtain a new certificate; certificate renewal or replacement requires manual intervention or an automated protocol like ACME, but the client's lack of trust does not trigger any automatic action on the server. Option C is wrong because TLS cipher strength is negotiated independently of certificate trust; a client will not downgrade ciphers due to an untrusted CA — the handshake will fail before cipher negotiation completes. Option D is wrong because clients enforce trust validation by default; they will not connect without a warning unless the user has explicitly disabled certificate validation (e.g., by adding an exception or using an insecure configuration like `CURLOPT_SSL_VERIFYPEER` set to false).
Practice SSCP by domain
Target a specific domain to shore up weak areas.