How many Select Two (Multi-Select) Questions questions are on this page?

This page has 20 Select Two (Multi-Select) Questions scenario questions for the SSCP exam, each with detailed explanations and wrong-answer analysis.

How should I approach SSCP scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Systems Security Certified Practitioner SSCP questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise Systems Security Certified Practitioner SSCP practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

SSCP

exam code

ISC2

vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediummulti select

Full question →

Which TWO of the following are key components of a Business Impact Analysis (BIA)?

A
Recovery time objective.
RTO specifies the maximum acceptable downtime for a process.
B
Vulnerability assessment.
Why wrong: Vulnerability assessment identifies weaknesses, not BIA.
C
Criticality analysis.
Criticality analysis determines the importance of business processes.
D
Likelihood estimation.
Why wrong: Likelihood is part of risk analysis, not BIA.
E
Threat modeling.
Why wrong: Threat modeling identifies potential threats, not BIA.

Select Two (Multi-Select) Questions

How to approach select two (multi-select) questions

Quick answer

Related SSCP topic practice pages

Access Controls practice questions

Risk Identification, Monitoring, and Analysis practice questions

Incident Response and Recovery practice questions

Security Operations and Administration practice questions

Cryptography practice questions

Network and Communications Security practice questions

Systems and Application Security practice questions

SSCP fundamentals practice questions

SSCP scenario practice questions

SSCP troubleshooting practice questions

Practice scenarios

Which TWO of the following are key components of a Business Impact Analysis (BIA)?

Which TWO are valid reasons to revoke a user's access? (Choose two.)

Which TWO of the following are key components of a configuration management database (CMDB)? (Select TWO)

Which TWO actions are part of the containment phase of incident response?

A security architect is designing an access control system for a healthcare application that requires fine-grained access decisions based on user role, location, time of day, and patient consent. Which TWO access control models are best suited for this requirement?

A security administrator is designing physical security for a high-security area. Which TWO controls are most effective for preventing unauthorized entry? (Select TWO)

An organization is hardening a Linux server. Which TWO of the following are effective steps to reduce the attack surface?

Which TWO of the following are examples of administrative controls in a security program? (Choose two.)

A company is implementing a change management process. Which THREE elements are essential for every change request? (Select THREE)

A security analyst is investigating an account compromise. The organization uses Kerberos for single sign-on. Which TWO of the following would help in tracking the source of the compromise?

An organization is implementing a new remote access VPN for employees using IPsec. Which TWO of the following are best practices for securing the IPsec VPN?

A security manager is evaluating log sources for a SIEM implementation. Which THREE of the following are considered log types that should be included?

An incident responder is collecting volatile evidence from a compromised Linux server. Which TWO of the following should be collected first? (Select two.)

Which TWO of the following are examples of key risk indicators (KRIs)?

Which THREE of the following are common methods for identifying risks? (Select three.)

A security auditor is reviewing the cryptographic algorithms used in an organization. Which THREE of the following are considered insecure or deprecated and should be avoided? (Select THREE.)

A company is migrating to a PaaS cloud environment. According to the shared responsibility model, which THREE security responsibilities remain with the customer? (Select THREE.)

Which TWO of the following are examples of administrative controls? (Choose two.)

A security analyst is reviewing network device logs and finds multiple failed SSH login attempts from a single external IP. Which three actions should the analyst take to mitigate this brute-force attack? (Choose three.)

A network administrator is configuring a VPN using IPsec. Which two protocols are used within IPsec to ensure data integrity and confidentiality? (Choose two.)