Courseiva
← Back to Systems Security Certified Practitioner SSCP questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise Systems Security Certified Practitioner SSCP practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice testRead exam guide
15
scenario questions
SSCP
exam code
ISC2
vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Related practice questions

Related SSCP topic practice pages

Scenario questions usually connect to one or more exam topics. Use these links to review the underlying concepts behind the scenario.

Access Controls practice questions

Practise SSCP questions linked to Access Controls.

Risk Identification, Monitoring, and Analysis practice questions

Targeted SSCP practice covering Risk Identification, Monitoring, and Analysis.

Incident Response and Recovery practice questions

Incident Response and Recovery practice questions for SSCP.

Security Operations and Administration practice questions

Sharpen your SSCP knowledge of Security Operations and Administration.

Cryptography practice questions

Cryptography practice questions for SSCP.

Network and Communications Security practice questions

Network and Communications Security practice questions for SSCP.

Systems and Application Security practice questions

Practise SSCP questions linked to Systems and Application Security.

SSCP fundamentals practice questions

Work through SSCP questions on SSCP fundamentals.

SSCP scenario practice questions

Work through SSCP questions on SSCP scenario.

SSCP troubleshooting practice questions

Targeted SSCP practice covering SSCP troubleshooting.

Practice set

Practice scenarios

Question 1mediummultiple choice
Full question →

Refer to the exhibit. A security analyst observes this event on a workstation. What is the MOST likely explanation?

Exhibit

Refer to the exhibit.

```
[Windows Security Log]
Event ID: 4688
Process Name: C:\Windows\System32\cmd.exe
Command Line: cmd.exe /c "echo %USERNAME% && whoami"
Parent Process: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
```
Question 2hardmultiple choice
Full question →

Refer to the exhibit. The firewall rule is attached to a database server. Which hosts can connect to the database?

Exhibit

{
  "SecurityGroupIngress": [
    {"IpProtocol": "tcp", "FromPort": 443, "ToPort": 443, "IpRanges": [{"CidrIp": "0.0.0.0/0"}]},
    {"IpProtocol": "tcp", "FromPort": 3306, "ToPort": 3306, "IpRanges": [{"CidrIp": "10.0.0.0/8"}]}
  ]
}
Question 3mediummultiple choice
Study the full ACL explanation →

Refer to the exhibit. An administrator applies this ACL to the external interface. What specific traffic is blocked?

Exhibit

access-list 100 deny icmp any any echo-request
access-list 100 permit ip any any
!
interface GigabitEthernet0/0
 ip access-group 100 in
Question 4mediummultiple choice
Full question →

Refer to the exhibit. A user reports being unable to remote desktop (RDP) into a Windows server. Given the event log, what is the most likely cause?

Exhibit

Event 4625, Microsoft-Windows-Security-Auditing
Account For Which Logon Failed:
    Security ID:        S-1-5-21-123456789-123456789-123456789-1105
    Account Name:       jdoe
    Account Domain:     CORP
Failure Information:
    Failure Reason:     The user has not been granted the requested logon type at this computer.
    Status:             0xC000015B
    Sub Status:         0x0
Question 5hardmultiple choice
Full question →

A security analyst reviews the firewall log exhibit. Which type of activity is indicated?

Exhibit

Refer to the exhibit.

Exhibit: Firewall log snippet
```
2024-03-15 10:23:45 ALLOW TCP 192.168.1.100:34567 -> 10.0.0.50:3389
2024-03-15 10:23:46 ALLOW TCP 192.168.1.100:34568 -> 10.0.0.50:3389
2024-03-15 10:23:47 ALLOW TCP 192.168.1.100:34569 -> 10.0.0.50:3389
2024-03-15 10:23:48 ALLOW TCP 192.168.1.100:34570 -> 10.0.0.50:3389
2024-03-15 10:23:49 ALLOW TCP 192.168.1.100:34571 -> 10.0.0.50:3389
```
Question 6hardmultiple choice
Full question →

Based on the exhibit, which of the following best describes the firewall configuration?

Network Topology
0 0 ACCEPT alllo * 0.0.0.0/010 840 ACCEPT tcp20 1680 ACCEPT tcp5 420 ACCEPT tcp0 0 DROP alleth0 * 0.0.0.0/0Refer to the exhibit.
Question 7hardmultiple choice
Open the full VLAN trunking answer →

A medium-sized company with 200 employees has a single office with a flat network topology. Recently, the IT team noticed that network performance has degraded significantly during peak hours. A network analysis reveals excessive broadcast traffic and a high number of ARP requests. Additionally, the security team is concerned about the lack of segmentation, as a workstation infected with malware was able to spread rapidly to other systems. The company uses a single /24 subnet (192.168.1.0/24) and all devices are connected to a layer 2 switch. The IT manager wants to improve both performance and security without purchasing new hardware. The existing switch is a managed layer 2 switch that supports VLANs, but the router is a basic home-grade device that does not support VLAN routing. The company's internet connection is provided by a cable modem. What is the BEST course of action to address both performance and security concerns?

Question 8mediummultiple choice
Full question →

A security analyst receives a user report about a workstation exhibiting unusual behavior, such as unexpected pop-ups and slow performance. The analyst first checks the antivirus logs and finds no alerts. What is the NEXT step in the detection and analysis phase?

Question 9hardmultiple choice
Full question →

Based on the exhibit, if the user attempts to upload (write) a file to the shared data repository corporate-data, what is the result?

Exhibit

Refer to the exhibit. The following IAM policy is attached to a user:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::corporate-data/*"
    },
    {
      "Effect": "Deny",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::corporate-data/*"
    }
  ]
}
Question 10hardmultiple choice
Full question →

Refer to the exhibit. An administrator runs an OpenSSL s_client command and receives the output shown. What is the most likely cause of the 'unable to get local issuer certificate' error?

Exhibit

Refer to the exhibit.

```
openssl s_client -connect server.example.com:443
CONNECTED(00000003)
depth=0 C = US, ST = California, L = San Francisco, O = Example Inc, CN = server.example.com
verify error:num=20:unable to get local issuer certificate
---
Certificate chain
 0 s:/C=US/ST=California/L=San Francisco/O=Example Inc/CN=server.example.com
   i:/C=US/O=Example Root CA/CN=Example Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIBxTCCAS0CAQAwDQYJKoZIhvcNAQELBQAwHzENMAsGA1UEAwwEUm9vdDEPMA0G
A1UEChMGVGVzdCBDQTAeFw0yNDAxMDEwMDAwMDBaFw0yNTAxMDEwMDAwMDBaMD8x
CzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRIwEAYDVQQHDAlTYW4g
RnJhbmNpc2NvMQ0wCwYDVQQDDARUZXN0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB
iQKBgQC0Yj1J2K1F1L2y3Y4Z5X6Z7Q8a9b0c1d2e3f4g5h6i7j8k9l0m1n2o3p4
q5r6s7t8u9v0w1x2y3z4A5B6C7D8E9F0G1H2I3J4K5L6M7N8O9P0QCAwEAATAN
BgkqhkiG9w0BAQsFAAOBgQBmJ6k7L8P9Q0R1S2T3U4V5W6X7Y8Z9a0b1c2d3e4f5
g6h7i8j9k0l1m2n3o4p5q6r7s8t9u0v1w2x3y4z5A6B7C8D9E0F1G2H3I4J5K6L7
M8N9O0P1Q2R3S4T5U6V7W8X9Y0Z1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p7q8r
```
Question 11mediummultiple choice
Full question →

Based on the exhibit, which security threat is likely being attempted?

Exhibit

Refer to the exhibit.

May 15 10:23:45 server1 sshd[12345]: Failed password for root from 192.168.1.100 port 22 ssh2
May 15 10:23:46 server1 sshd[12345]: Failed password for root from 192.168.1.100 port 22 ssh2
May 15 10:23:47 server1 sshd[12345]: Failed password for root from 192.168.1.100 port 22 ssh2
... (multiple entries within seconds)
Question 12hardmultiple choice
Read the full VPN explanation →

Refer to the exhibit. A network engineer is configuring a site-to-site VPN. The remote peer is using AES-256 encryption and SHA-1 for integrity. Which configuration parameter is likely misconfigured?

Exhibit

crypto isakmp policy 10
 encr aes 256
 authentication pre-share
 group 5
 lifetime 3600
crypto ipsec transform-set AES256-SHA esp-aes 256 esp-sha-hmac
crypto map CMAP 10 ipsec-isakmp
 set peer 198.51.100.1
 set transform-set AES256-SHA
 match address 101
Question 13mediummultiple choice
Full question →

Refer to the exhibit. A security analyst reviews a Windows Security event log entry showing multiple logon failures for user 'admin' from IP 10.0.0.100 within 5 minutes. What type of attack is most likely occurring?

Exhibit

Event ID 4625: An account failed to log on. Subject: Account Name: admin, Logon Type: 3, Source Network Address: 10.0.0.100, Workstation Name: WS-001. Failure Reason: Unknown user name or bad password. Count: 15 in 5 minutes.
Question 14mediummultiple choice
Full question →

Refer to the exhibit. An administrator implements this firewall rule. What is the intended effect?

Exhibit

Refer to the exhibit.

Windows Firewall Rule (PowerShell output):
```
Name        : Block SMB Outbound
DisplayName : Block SMB Outbound
Description : Blocks outbound SMB traffic to prevent lateral movement
Enabled     : True
Direction   : Outbound
Action      : Block
Profile     : Domain
LocalAddress: Any
RemoteAddress: Any
Protocol    : TCP
LocalPort   : Any
RemotePort  : 445
```
Question 15mediummultiple choice
Full question →

Refer to the exhibit. The analyst sees this IDS alert. What is the most likely outcome if the target web application is vulnerable?

Exhibit

Refer to the exhibit.
[IDS Alert]
Timestamp: 2025-02-18 14:23:45
Source IP: 10.10.10.5 -> Destination IP: 192.168.1.100
Signature: ET WEB_SPECIFIC SQL Injection Attempt
Payload: ' OR '1'='1' --

These SSCP practice questions are part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style SSCP questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.