Courseiva
← Back to Systems Security Certified Practitioner SSCP questions

Scenario-based practice

Hard Difficulty Questions

Practise Systems Security Certified Practitioner SSCP practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice testRead exam guide
20
scenario questions
SSCP
exam code
ISC2
vendor

Scenario guide

How to approach hard difficulty questions

These are the questions most candidates get wrong. They require connecting multiple concepts, reading tricky output, or knowing edge-case behaviour that isn't on most study cards. Practising them trains you to operate under uncertainty — a necessary skill on the real exam.

Quick answer

Hard Difficulty Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Related practice questions

Related SSCP topic practice pages

Scenario questions usually connect to one or more exam topics. Use these links to review the underlying concepts behind the scenario.

Access Controls practice questions

Practise SSCP questions linked to Access Controls.

Risk Identification, Monitoring, and Analysis practice questions

Targeted SSCP practice covering Risk Identification, Monitoring, and Analysis.

Incident Response and Recovery practice questions

Incident Response and Recovery practice questions for SSCP.

Security Operations and Administration practice questions

Sharpen your SSCP knowledge of Security Operations and Administration.

Cryptography practice questions

Cryptography practice questions for SSCP.

Network and Communications Security practice questions

Network and Communications Security practice questions for SSCP.

Systems and Application Security practice questions

Practise SSCP questions linked to Systems and Application Security.

SSCP fundamentals practice questions

Work through SSCP questions on SSCP fundamentals.

SSCP scenario practice questions

Work through SSCP questions on SSCP scenario.

SSCP troubleshooting practice questions

Targeted SSCP practice covering SSCP troubleshooting.

Practice set

Practice scenarios

Question 1hardmultiple choice
Study the full virtualization explanation →

During a security assessment, an analyst finds that multiple snapshots of a critical virtual machine are stored on the hypervisor host. Some snapshots are several months old. Which risk is MOST likely?

Question 2hardmultiple choice
Full question →

During an incident response, a forensic analyst captures a memory dump from a compromised server. Which of the following is the MOST important step to ensure the integrity of the evidence?

Question 3hardmultiple choice
Full question →

A company uses a SIEM to monitor security events. Recently, they are experiencing false positives from a new IDS rule. Which approach would best reduce false positives while maintaining detection?

Question 4hardmulti select
Full question →

A security architect is designing an access control system for a healthcare application that requires fine-grained access decisions based on user role, location, time of day, and patient consent. Which TWO access control models are best suited for this requirement?

Question 5hardmultiple choice
Full question →

A patch management process is being audited. Which finding indicates a critical gap in the process?

Question 6hardmultiple choice
Full question →

Refer to the exhibit. The firewall rule is attached to a database server. Which hosts can connect to the database?

Exhibit

{
  "SecurityGroupIngress": [
    {"IpProtocol": "tcp", "FromPort": 443, "ToPort": 443, "IpRanges": [{"CidrIp": "0.0.0.0/0"}]},
    {"IpProtocol": "tcp", "FromPort": 3306, "ToPort": 3306, "IpRanges": [{"CidrIp": "10.0.0.0/8"}]}
  ]
}
Question 7hardmultiple choice
Open the full VLAN trunking answer →

A network has multiple VLANs with an IDS deployed on the core switch using SPAN ports. The IDS is missing some packets during high traffic periods. What is the best course of action to improve packet capture reliability?

Question 8hardmultiple choice
Full question →

During incident analysis, a forensic examiner finds that the system logs were cleared using a command that writes null bytes. Which artifact is most likely preserved?

Question 9hardmulti select
Full question →

A security analyst is investigating an account compromise. The organization uses Kerberos for single sign-on. Which TWO of the following would help in tracking the source of the compromise?

Question 10hardmultiple choice
Full question →

A company uses Infrastructure as a Service (IaaS) for its production workloads. According to the shared responsibility model, which of the following security tasks is the customer responsible for?

Question 11hardmultiple choice
Full question →

A company's IDS generated an alert for a suspicious outbound connection to a known C2 server. The incident team discovers the host has been communicating for 2 weeks. Which containment strategy is most appropriate?

Question 12hardmultiple choice
Full question →

Your organization has a mixed environment of Windows and Linux servers. You receive an alert from the EDR that a Linux server is beaconing to a suspicious IP. The server runs a critical application that cannot be taken offline. The security team needs to investigate while maintaining availability. You have access to a jump box with network monitoring tools. Which course of action is most appropriate?

Question 13hardmultiple choice
Full question →

An organization is implementing a federated identity system to allow employees to access a partner's cloud application using their corporate credentials. The solution must support single sign-on and use XML-based assertions. Which technology should be used?

Question 14hardmultiple choice
Full question →

After a ransomware attack, the recovery team restored systems from backups. However, some files remain encrypted. What is the most probable cause?

Question 15hardmultiple choice
Full question →

A system administrator notices that a server's certificate was issued by a CA that is not in the trusted root store of client machines. What is the most likely impact on clients connecting via TLS?

Question 16hardmultiple choice
Full question →

A security analyst is reviewing traffic logs and sees that a host is sending ICMP echo requests to multiple external IPs. This behavior is most likely indicative of:

Question 17hardmulti select
Full question →

A security auditor is reviewing the cryptographic algorithms used in an organization. Which THREE of the following are considered insecure or deprecated and should be avoided? (Select THREE.)

Question 18hardmultiple choice
Full question →

You are the incident response lead for a medium-sized financial services company. The company uses a hybrid infrastructure with on-premises servers (Active Directory, file shares, and a SQL database) and cloud services (Office 365, Azure VMs). At 2:00 PM on a Tuesday, the helpdesk receives multiple calls that users cannot access the file shares. Simultaneously, the SOC alerts on unusual outbound traffic from the domain controller (DC) to an external IP on port 443. The DC is also running a scheduled antivirus scan. The file server (FS) shows no signs of compromise but is responding slowly. The backup system reports that last night's backup of the DC failed due to a 'volume shadow copy error'. The backup of the FS succeeded. You need to take immediate action. What should you do FIRST?

Question 19hardmultiple choice
Full question →

A security analyst reviews the firewall log exhibit. Which type of activity is indicated?

Exhibit

Refer to the exhibit.

Exhibit: Firewall log snippet
```
2024-03-15 10:23:45 ALLOW TCP 192.168.1.100:34567 -> 10.0.0.50:3389
2024-03-15 10:23:46 ALLOW TCP 192.168.1.100:34568 -> 10.0.0.50:3389
2024-03-15 10:23:47 ALLOW TCP 192.168.1.100:34569 -> 10.0.0.50:3389
2024-03-15 10:23:48 ALLOW TCP 192.168.1.100:34570 -> 10.0.0.50:3389
2024-03-15 10:23:49 ALLOW TCP 192.168.1.100:34571 -> 10.0.0.50:3389
```
Question 20hardmultiple choice
Read the full DNS explanation →

A financial firm has deployed network-based IDS/IPS sensors at key points to detect and prevent intrusions. During a recent security audit, it was discovered that an attacker exfiltrated sensitive data using DNS over HTTPS (DoH) queries. The IDS/IPS did not generate any alerts. The firm's network policy allows all outbound HTTPS traffic to any destination. To prevent such exfiltration in the future, what is the most effective corrective action?

These SSCP practice questions are part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style SSCP questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.