How many Troubleshooting Scenario Questions questions are on this page?

This page has 9 Troubleshooting Scenario Questions scenario questions for the SSCP exam, each with detailed explanations and wrong-answer analysis.

How should I approach SSCP scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Systems Security Certified Practitioner SSCP questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Systems Security Certified Practitioner SSCP practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

SSCP

exam code

ISC2

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmultiple choice

Full question →

Your organization has a mixed environment of Windows and Linux servers. You receive an alert from the EDR that a Linux server is beaconing to a suspicious IP. The server runs a critical application that cannot be taken offline. The security team needs to investigate while maintaining availability. You have access to a jump box with network monitoring tools. Which course of action is most appropriate?

A
Immediately disconnect the server from the network to stop beaconing
Why wrong: Disconnecting would halt the critical application, violating availability.
B
Block the suspicious IP at the firewall and continue monitoring
Why wrong: Blocking the IP prevents further beaconing but does not remove the threat from the server.
C
Use packet capture on the server's network segment to analyze traffic, then use EDR to isolate the process
This allows investigation and containment without taking the server offline.
D
Reimage the server from a known good backup
Why wrong: Reimaging would cause significant downtime and may not be necessary if the threat can be contained.

Full breakdown with real-world context →

Question 2mediummultiple choice

Full question →

Refer to the exhibit. A user reports being unable to remote desktop (RDP) into a Windows server. Given the event log, what is the most likely cause?

Exhibit

Event 4625, Microsoft-Windows-Security-Auditing
Account For Which Logon Failed:
    Security ID:        S-1-5-21-123456789-123456789-123456789-1105
    Account Name:       jdoe
    Account Domain:     CORP
Failure Information:
    Failure Reason:     The user has not been granted the requested logon type at this computer.
    Status:             0xC000015B
    Sub Status:         0x0

A
The user does not have the 'Allow log on through Remote Desktop Services' user right
The failure reason clearly states the logon type is not granted; this user right is required for RDP access.
B
The user account is locked out
Why wrong: A locked account would show status 0xC0000234, not 0xC000015B.
C
The server is not a member of the domain
Why wrong: A non-domain server would show a different error, such as 'The computer is not trusted'.
D
The user's Kerberos ticket has expired
Why wrong: An expired ticket would result in a different failure reason related to credentials or authentication.

Full breakdown with real-world context →

Question 3hardmultiple choice

Full question →

A Windows workstation is unable to authenticate to a Kerberos-based application. The time on the workstation is 5 minutes ahead of the domain controller. What is the impact?

A
The user would be prompted for credentials but authentication would proceed
Why wrong: If time skew is exceeded, the Ticket Granting Server will reject the request, preventing authentication altogether.
B
Authentication will fail because the time difference exceeds the default Kerberos clock skew limit
Kerberos allows a maximum skew of 5 minutes by default; a 5-minute difference may cause rejection or succeed only if within tolerance.
C
Only NTLM authentication would be affected
Why wrong: NTLM is not time-sensitive; Kerberos is the protocol that requires time synchronization.
D
No impact; Kerberos can tolerate up to 10 minutes of skew
Why wrong: The default maximum skew in Windows is 5 minutes, not 10; a 5-minute difference may be at the limit.

Full breakdown with real-world context →

Question 4easymultiple choice

Full question →

A user reports they cannot access the internet. The network administrator verifies that the user's workstation has an IP address of 192.168.1.100/24 and a default gateway of 192.168.1.1. The administrator can ping the default gateway but cannot ping 8.8.8.8. What is the most likely cause?

A
Firewall is blocking outbound traffic to port 53
Why wrong: Port 53 is DNS, not ICMP.
B
DNS server is down
Why wrong: DNS is not required for pinging an IP address.
C
The default gateway has no route to the internet
Local connectivity works, external fails, indicating routing issue.
D
The workstation's subnet mask is incorrect
Why wrong: Incorrect subnet mask would affect local connectivity, but gateway is reachable.
E
The network cable is faulty
Why wrong: Faulty cable would prevent pinging the gateway.

Full breakdown with real-world context →

Question 5hardmultiple choice

Full question →

An organization uses a mantrap at its main entrance. An employee badges in, enters the first door, but then the second door fails to open. What should the employee do?

A
Return through the first door
Why wrong: The first door may lock behind them, trapping them.
B
Use the intercom to contact security
Proper procedure to get assistance without compromising security.
C
Force the second door open
Why wrong: Compromises security and may damage equipment.
D
Wait for someone to open from the other side
Why wrong: Not a secure practice; tailgating could occur.

Full breakdown with real-world context →

Question 6mediummulti select

Read the full DNS explanation →

A network administrator is troubleshooting a DNS poisoning attack. Which TWO countermeasures can help prevent such attacks? (Select two)

A
Implement DNSSEC to validate DNS responses
DNSSEC adds cryptographic signatures to DNS records.
B
Configure firewall rules to block UDP port 53
Why wrong: Blocking port 53 would break DNS entirely.
C
Disable DNS recursion on authoritative servers
Why wrong: Disabling recursion helps prevent cache poisoning on authoritative servers but does not prevent poisoning on resolvers.
D
Use secure DNS resolvers that enforce DNSSEC validation
Secure resolvers validate DNSSEC and block malicious responses.
E
Enable DHCP snooping on switches
Why wrong: DHCP snooping prevents rogue DHCP servers, not DNS poisoning.

Full breakdown with real-world context →

Question 7hardmultiple choice

Full question →

Refer to the exhibit. An administrator runs an OpenSSL s_client command and receives the output shown. What is the most likely cause of the 'unable to get local issuer certificate' error?

Exhibit

Refer to the exhibit.

```
openssl s_client -connect server.example.com:443
CONNECTED(00000003)
depth=0 C = US, ST = California, L = San Francisco, O = Example Inc, CN = server.example.com
verify error:num=20:unable to get local issuer certificate
---
Certificate chain
 0 s:/C=US/ST=California/L=San Francisco/O=Example Inc/CN=server.example.com
   i:/C=US/O=Example Root CA/CN=Example Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIBxTCCAS0CAQAwDQYJKoZIhvcNAQELBQAwHzENMAsGA1UEAwwEUm9vdDEPMA0G
A1UEChMGVGVzdCBDQTAeFw0yNDAxMDEwMDAwMDBaFw0yNTAxMDEwMDAwMDBaMD8x
CzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRIwEAYDVQQHDAlTYW4g
RnJhbmNpc2NvMQ0wCwYDVQQDDARUZXN0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB
iQKBgQC0Yj1J2K1F1L2y3Y4Z5X6Z7Q8a9b0c1d2e3f4g5h6i7j8k9l0m1n2o3p4
q5r6s7t8u9v0w1x2y3z4A5B6C7D8E9F0G1H2I3J4K5L6M7N8O9P0QCAwEAATAN
BgkqhkiG9w0BAQsFAAOBgQBmJ6k7L8P9Q0R1S2T3U4V5W6X7Y8Z9a0b1c2d3e4f5
g6h7i8j9k0l1m2n3o4p5q6r7s8t9u0v1w2x3y4z5A6B7C8D9E0F1G2H3I4J5K6L7
M8N9O0P1Q2R3S4T5U6V7W8X9Y0Z1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p7q8r
```

A
The server's private key is missing.
Why wrong: The s_client output does not indicate private key issues.
B
The client does not trust the issuing CA.
The 'unable to get local issuer certificate' error means the CA is not trusted.
C
The server certificate is self-signed.
Why wrong: The issuer is 'Example Root CA', not the server itself.
D
The server certificate has expired.
Why wrong: The certificate dates are within validity; no expiration error.

Full breakdown with real-world context →

Question 8hardmultiple choice

Full question →

A mid-sized company has deployed a web application that handles sensitive customer data. The application uses TLS to encrypt data in transit. Recently, the company received a penetration test report indicating that an attacker could potentially downgrade the TLS connection to an older, weaker version (e.g., TLS 1.0) by performing a man-in-the-middle attack. The application server runs on Windows Server 2022 with IIS 10. The security team wants to disable all versions of TLS below 1.2 on the server. However, after making registry changes to disable TLS 1.0 and 1.1, some legacy clients that only support TLS 1.0 are unable to connect. The business requires that these legacy clients still be able to access the application securely, but the security team insists on disabling weak protocols. The server currently has a valid certificate from a public CA. Which of the following is the most appropriate course of action?

A
Switch the application to use a VPN instead of TLS for legacy client access.
Why wrong: VPNs add complexity and may not address the legacy TLS requirement; also, downgrade attacks may still be possible.
B
Upgrade all legacy clients to support TLS 1.2 or later immediately.
Why wrong: Upgrading clients may be impractical or impossible in the short term.
C
Deploy a TLS-terminating reverse proxy that supports both strong and legacy TLS, placing it in front of the web server.
The proxy can negotiate strong TLS with the server and weaker TLS with legacy clients, isolating the server from weak protocols.
D
Re-enable TLS 1.0 and 1.1 on the server, as the business requirement outweighs security concerns.
Why wrong: Re-enabling weak protocols exposes the server to downgrade attacks and violates security policy.

Full breakdown with real-world context →

Question 9mediummultiple choice

Read the full VPN explanation →

A network engineer is troubleshooting a site-to-site VPN that is failing to establish. The pre-shared key is correct and both sides use IKEv2. The VPN logs show 'no proposal chosen'. What is the most likely cause?

A
Firewall blocking UDP port 500
Why wrong: A firewall block would prevent any IKE traffic, typically resulting in timeouts rather than proposal errors.
B
Incorrect peer IP address
Why wrong: An incorrect peer IP would typically result in a timeout or no response, not a proposal mismatch error.
C
Mismatched encryption algorithms
IKE negotiations require matching proposals; a mismatch in encryption, integrity, or DH group causes 'no proposal chosen'.
D
Expired certificates
Why wrong: Since a pre-shared key is used, certificates are not involved; expired certificates would be an authentication failure, not proposal mismatch.

Full breakdown with real-world context →

These SSCP practice questions are part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style SSCP questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related SSCP topic practice pages

Access Controls practice questions

Risk Identification, Monitoring, and Analysis practice questions

Incident Response and Recovery practice questions

Security Operations and Administration practice questions

Cryptography practice questions

Network and Communications Security practice questions

Systems and Application Security practice questions

SSCP fundamentals practice questions

SSCP scenario practice questions

SSCP troubleshooting practice questions

Practice scenarios

Refer to the exhibit. A user reports being unable to remote desktop (RDP) into a Windows server. Given the event log, what is the most likely cause?

Exhibit

A Windows workstation is unable to authenticate to a Kerberos-based application. The time on the workstation is 5 minutes ahead of the domain controller. What is the impact?

A user reports they cannot access the internet. The network administrator verifies that the user's workstation has an IP address of 192.168.1.100/24 and a default gateway of 192.168.1.1. The administrator can ping the default gateway but cannot ping 8.8.8.8. What is the most likely cause?

An organization uses a mantrap at its main entrance. An employee badges in, enters the first door, but then the second door fails to open. What should the employee do?

A network administrator is troubleshooting a DNS poisoning attack. Which TWO countermeasures can help prevent such attacks? (Select two)

Refer to the exhibit. An administrator runs an OpenSSL s_client command and receives the output shown. What is the most likely cause of the 'unable to get local issuer certificate' error?

Exhibit

A network engineer is troubleshooting a site-to-site VPN that is failing to establish. The pre-shared key is correct and both sides use IKEv2. The VPN logs show 'no proposal chosen'. What is the most likely cause?