How many Troubleshooting Scenario Questions questions are on this page?

This page has 14 Troubleshooting Scenario Questions scenario questions for the SSCP exam, each with detailed explanations and wrong-answer analysis.

How should I approach SSCP scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Systems Security Certified Practitioner SSCP questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Systems Security Certified Practitioner SSCP practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

SSCP

exam code

ISC2

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediummultiple choice

Read the full VPN explanation →

A network engineer is troubleshooting a site-to-site VPN that is failing to establish. The pre-shared key is correct and both sides use IKEv2. The VPN logs show 'no proposal chosen'. What is the most likely cause?

A
Firewall blocking UDP port 500
Why wrong: A firewall block would prevent any IKE traffic, typically resulting in timeouts rather than proposal errors.
B
Incorrect peer IP address
Why wrong: An incorrect peer IP would typically result in a timeout or no response, not a proposal mismatch error.
C
Mismatched encryption algorithms
IKE negotiations require matching proposals; a mismatch in encryption, integrity, or DH group causes 'no proposal chosen'.
D
Expired certificates
Why wrong: Since a pre-shared key is used, certificates are not involved; expired certificates would be an authentication failure, not proposal mismatch.

Full breakdown with real-world context →

Question 2hardmultiple choice

Full question →

Refer to the exhibit. An administrator runs an OpenSSL s_client command and receives the output shown. What is the most likely cause of the 'unable to get local issuer certificate' error?

Exhibit

Refer to the exhibit.

```
openssl s_client -connect server.example.com:443
CONNECTED(00000003)
depth=0 C = US, ST = California, L = San Francisco, O = Example Inc, CN = server.example.com
verify error:num=20:unable to get local issuer certificate
---
Certificate chain
 0 s:/C=US/ST=California/L=San Francisco/O=Example Inc/CN=server.example.com
   i:/C=US/O=Example Root CA/CN=Example Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIBxTCCAS0CAQAwDQYJKoZIhvcNAQELBQAwHzENMAsGA1UEAwwEUm9vdDEPMA0G
A1UEChMGVGVzdCBDQTAeFw0yNDAxMDEwMDAwMDBaFw0yNTAxMDEwMDAwMDBaMD8x
CzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRIwEAYDVQQHDAlTYW4g
RnJhbmNpc2NvMQ0wCwYDVQQDDARUZXN0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB
iQKBgQC0Yj1J2K1F1L2y3Y4Z5X6Z7Q8a9b0c1d2e3f4g5h6i7j8k9l0m1n2o3p4
q5r6s7t8u9v0w1x2y3z4A5B6C7D8E9F0G1H2I3J4K5L6M7N8O9P0QCAwEAATAN
BgkqhkiG9w0BAQsFAAOBgQBmJ6k7L8P9Q0R1S2T3U4V5W6X7Y8Z9a0b1c2d3e4f5
g6h7i8j9k0l1m2n3o4p5q6r7s8t9u0v1w2x3y4z5A6B7C8D9E0F1G2H3I4J5K6L7
M8N9O0P1Q2R3S4T5U6V7W8X9Y0Z1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p7q8r
```

A
The server's private key is missing.
Why wrong: The s_client output does not indicate private key issues.
B
The client does not trust the issuing CA.
The 'unable to get local issuer certificate' error means the CA is not trusted.
C
The server certificate is self-signed.
Why wrong: The issuer is 'Example Root CA', not the server itself.
D
The server certificate has expired.
Why wrong: The certificate dates are within validity; no expiration error.

Full breakdown with real-world context →

Question 3hardmultiple choice

Full question →

Your organization has a mixed environment of Windows and Linux servers. You receive an alert from the EDR that a Linux server is beaconing to a suspicious IP. The server runs a critical application that cannot be taken offline. The security team needs to investigate while maintaining availability. You have access to a jump box with network monitoring tools. Which course of action is most appropriate?

A
Immediately disconnect the server from the network to stop beaconing
Why wrong: Disconnecting would halt the critical application, violating availability.
B
Block the suspicious IP at the firewall and continue monitoring
Why wrong: Blocking the IP prevents further beaconing but does not remove the threat from the server.
C
Use packet capture on the server's network segment to analyze traffic, then use EDR to isolate the process
This allows investigation and containment without taking the server offline.
D
Reimage the server from a known good backup
Why wrong: Reimaging would cause significant downtime and may not be necessary if the threat can be contained.

Full breakdown with real-world context →

Question 4mediummultiple choice

Open the full VLAN trunking answer →

A security analyst is troubleshooting a network issue where users on VLAN 10 cannot reach a server on VLAN 20. The router has an ACL applied to the interface connected to VLAN 10. Which step should the analyst take first to isolate the problem?

A
Review the ACL configuration on the router interface
The ACL on the router interface can block traffic between VLANs; this is the first logical step.
B
Run a traceroute from a user machine to the server
Why wrong: Traceroute is useful but should be done after checking ACLs.
C
Check the ARP table for the server's MAC address
Why wrong: ARP is used to resolve MAC addresses, not to troubleshoot ACL issues.
D
Verify the VLAN configuration on the switch
Why wrong: VLAN configuration is important but the router's ACL is more likely the issue given the symptom.

Full breakdown with real-world context →

Question 5hardmultiple choice

Full question →

An organization uses role-based access control (RBAC). After a merger, a user account from the acquired company is migrated into the parent company's domain. The user is assigned to multiple roles, but is unable to access a critical application that requires a specific role. The administrator verified that the user's account is enabled and the application server is reachable. What is the MOST likely cause?

A
The user's group memberships are conflicting with the required role.
Why wrong: In RBAC, roles are additive; conflicts are rare.
B
The user's account was not assigned the required role.
Without the role, the user lacks the necessary permissions.
C
There is a firewall rule blocking traffic from the user's IP range.
Why wrong: If true, others in the same range would also be affected.
D
The application's session timeout is set too low.
Why wrong: Session timeout affects existing sessions, not initial access.

Full breakdown with real-world context →

Question 6mediummultiple choice

Read the full VPN explanation →

A company's VPN logs show that a user's account authenticated from two different geographic locations within a span of 10 minutes. The distances between locations make physical travel impossible. The security team investigates and finds that the user's password is complex and not shared. What is the MOST likely explanation?

A
The VPN server has a configuration error causing incorrect location logging.
Why wrong: Would affect multiple users, not just one.
B
The user's session token was stolen and used by an attacker.
A stolen session token allows reuse from a different location.
C
The user's account is being used by multiple people with permission.
Why wrong: This contradicts the password not being shared.
D
The user is using a VPN service to mask their true location.
Why wrong: That would show a single VPN IP, not two locations.

Full breakdown with real-world context →

Question 7hardmultiple choice

Full question →

During a security audit, it is discovered that a system administrator shared their personal credentials with a colleague to troubleshoot an issue after hours. This violates the company's policy regarding password sharing. Which control would BEST prevent this type of incident in the future?

A
Implement a two-person rule for administrative actions.
Why wrong: Two-person rule is for accountability, not preventing credential sharing.
B
Enforce a stricter password complexity policy.
Why wrong: Complexity does not address sharing.
C
Require multifactor authentication for all systems.
Why wrong: MFA reduces risk but sharing still possible.
D
Deploy a privileged access management (PAM) solution.
PAM allows temporary access without sharing credentials.

Full breakdown with real-world context →

Question 8mediummultiple choice

Full question →

An organization's help desk receives multiple reports of employees unable to access a critical internal application. The IT team confirms the application server is running. What is the FIRST step in the incident response process?

A
Verify the reports and confirm the scope of the issue
The incident response process begins with identification and verification.
B
Restore the application from the latest backup
Why wrong: Recovery happens after the incident is contained and eradicated.
C
Remove any malicious software from the server
Why wrong: Eradication is a later step in the process.
D
Isolate the affected systems from the network
Why wrong: Containment occurs after the incident has been confirmed.

Full breakdown with real-world context →

Question 9mediummultiple choice

Full question →

Refer to the exhibit. A security administrator is troubleshooting connectivity to a web server. Users report they can access the website via HTTP and HTTPS, but cannot establish new SSH connections. Which of the following best explains this issue?

Network Topology

A
The firewall is dropping SSH connections only when they are new, but established sessions may still be allowed.
Why wrong: This is a true statement but does not fully explain the symptom because users cannot establish new SSH connections, which matches the rule.
B
The firewall policy is set to ACCEPT on the INPUT chain, so SSH should work.
Why wrong: The policy is ACCEPT, but the specific DROP rule is evaluated first and overrides the default policy for matching packets.
C
The firewall is blocking all incoming traffic on port 22.
Why wrong: The rule only drops packets matching state NEW, not all packets on port 22.
D
The firewall is configured to drop new SSH connections, which prevents users from initiating new SSH sessions.
The DROP rule for tcp dpt:22 with state NEW explicitly drops new SSH connection attempts, explaining the inability to SSH.

Full breakdown with real-world context →

Question 10hardmultiple choice

Full question →

A Windows workstation is unable to authenticate to a Kerberos-based application. The time on the workstation is 5 minutes ahead of the domain controller. What is the impact?

A
The user would be prompted for credentials but authentication would proceed
Why wrong: If time skew is exceeded, the Ticket Granting Server will reject the request, preventing authentication altogether.
B
Authentication will fail because the time difference exceeds the default Kerberos clock skew limit
Kerberos allows a maximum skew of 5 minutes by default; a 5-minute difference may cause rejection or succeed only if within tolerance.
C
Only NTLM authentication would be affected
Why wrong: NTLM is not time-sensitive; Kerberos is the protocol that requires time synchronization.
D
No impact; Kerberos can tolerate up to 10 minutes of skew
Why wrong: The default maximum skew in Windows is 5 minutes, not 10; a 5-minute difference may be at the limit.

Full breakdown with real-world context →

Question 11mediummultiple choice

Full question →

Refer to the exhibit. A user reports being unable to remote desktop (RDP) into a Windows server. Given the event log, what is the most likely cause?

Exhibit

Event 4625, Microsoft-Windows-Security-Auditing
Account For Which Logon Failed:
    Security ID:        S-1-5-21-123456789-123456789-123456789-1105
    Account Name:       jdoe
    Account Domain:     CORP
Failure Information:
    Failure Reason:     The user has not been granted the requested logon type at this computer.
    Status:             0xC000015B
    Sub Status:         0x0

A
The user does not have the 'Allow log on through Remote Desktop Services' user right
The failure reason clearly states the logon type is not granted; this user right is required for RDP access.
B
The user account is locked out
Why wrong: A locked account would show status 0xC0000234, not 0xC000015B.
C
The server is not a member of the domain
Why wrong: A non-domain server would show a different error, such as 'The computer is not trusted'.
D
The user's Kerberos ticket has expired
Why wrong: An expired ticket would result in a different failure reason related to credentials or authentication.

Full breakdown with real-world context →

Question 12easymultiple choice

Full question →

A user reports they cannot access the internet. The network administrator verifies that the user's workstation has an IP address of 192.168.1.100/24 and a default gateway of 192.168.1.1. The administrator can ping the default gateway but cannot ping 8.8.8.8. What is the most likely cause?

A
Firewall is blocking outbound traffic to port 53
Why wrong: Port 53 is DNS, not ICMP.
B
DNS server is down
Why wrong: DNS is not required for pinging an IP address.
C
The default gateway has no route to the internet
Local connectivity works, external fails, indicating routing issue.
D
The workstation's subnet mask is incorrect
Why wrong: Incorrect subnet mask would affect local connectivity, but gateway is reachable.
E
The network cable is faulty
Why wrong: Faulty cable would prevent pinging the gateway.

Full breakdown with real-world context →

Question 13mediummultiple choice

Full question →

A network administrator is unable to ping the server at 10.2.2.100 from a host on the 192.168.1.0/24 network. Based on the exhibit, what is the most likely cause?

Exhibit

Refer to the exhibit.

Router# show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 10.1.1.2 to network 0.0.0.0

     10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks
C       10.1.1.0/24 is directly connected, GigabitEthernet0/0
O       10.2.2.0/24 [110/20] via 10.1.1.2, 00:05:12, GigabitEthernet0/0
S       10.3.3.0/24 [1/0] via 10.1.1.2
C       192.168.1.0/24 is directly connected, GigabitEthernet0/1

A
The static route to 10.3.3.0 is misconfigured.
Why wrong: The static route is present and not affecting 10.2.2.0.
B
The gateway of last resort is missing.
Why wrong: The default route is configured as 10.1.1.2.
C
The OSPF route for 10.2.2.0 is not in the routing table.
Why wrong: It is present as an OSPF route.
D
The OSPF neighbor relationship may be unstable, causing intermittent route flapping.
The route is learned but the age (00:05:12) may indicate recent instability.

Full breakdown with real-world context →

Question 14hardmultiple choice

Full question →

A mid-sized company has deployed a web application that handles sensitive customer data. The application uses TLS to encrypt data in transit. Recently, the company received a penetration test report indicating that an attacker could potentially downgrade the TLS connection to an older, weaker version (e.g., TLS 1.0) by performing a man-in-the-middle attack. The application server runs on Windows Server 2022 with IIS 10. The security team wants to disable all versions of TLS below 1.2 on the server. However, after making registry changes to disable TLS 1.0 and 1.1, some legacy clients that only support TLS 1.0 are unable to connect. The business requires that these legacy clients still be able to access the application securely, but the security team insists on disabling weak protocols. The server currently has a valid certificate from a public CA. Which of the following is the most appropriate course of action?

A
Switch the application to use a VPN instead of TLS for legacy client access.
Why wrong: VPNs add complexity and may not address the legacy TLS requirement; also, downgrade attacks may still be possible.
B
Upgrade all legacy clients to support TLS 1.2 or later immediately.
Why wrong: Upgrading clients may be impractical or impossible in the short term.
C
Deploy a TLS-terminating reverse proxy that supports both strong and legacy TLS, placing it in front of the web server.
The proxy can negotiate strong TLS with the server and weaker TLS with legacy clients, isolating the server from weak protocols.
D
Re-enable TLS 1.0 and 1.1 on the server, as the business requirement outweighs security concerns.
Why wrong: Re-enabling weak protocols exposes the server to downgrade attacks and violates security policy.

Full breakdown with real-world context →

These SSCP practice questions are part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style SSCP questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related SSCP topic practice pages

Risk Identification, Monitoring and Analysis practice questions

Network and Communications Security practice questions

Systems and Application Security practice questions

Security Operations and Administration practice questions

Incident Response and Recovery practice questions

Access Controls practice questions

Cryptography practice questions

SSCP fundamentals practice questions

SSCP scenario practice questions

SSCP troubleshooting practice questions

Practice scenarios

A network engineer is troubleshooting a site-to-site VPN that is failing to establish. The pre-shared key is correct and both sides use IKEv2. The VPN logs show 'no proposal chosen'. What is the most likely cause?

Refer to the exhibit. An administrator runs an OpenSSL s_client command and receives the output shown. What is the most likely cause of the 'unable to get local issuer certificate' error?

Exhibit

A security analyst is troubleshooting a network issue where users on VLAN 10 cannot reach a server on VLAN 20. The router has an ACL applied to the interface connected to VLAN 10. Which step should the analyst take first to isolate the problem?

During a security audit, it is discovered that a system administrator shared their personal credentials with a colleague to troubleshoot an issue after hours. This violates the company's policy regarding password sharing. Which control would BEST prevent this type of incident in the future?

An organization's help desk receives multiple reports of employees unable to access a critical internal application. The IT team confirms the application server is running. What is the FIRST step in the incident response process?

Refer to the exhibit. A security administrator is troubleshooting connectivity to a web server. Users report they can access the website via HTTP and HTTPS, but cannot establish new SSH connections. Which of the following best explains this issue?

A Windows workstation is unable to authenticate to a Kerberos-based application. The time on the workstation is 5 minutes ahead of the domain controller. What is the impact?

Refer to the exhibit. A user reports being unable to remote desktop (RDP) into a Windows server. Given the event log, what is the most likely cause?

Exhibit

A user reports they cannot access the internet. The network administrator verifies that the user's workstation has an IP address of 192.168.1.100/24 and a default gateway of 192.168.1.1. The administrator can ping the default gateway but cannot ping 8.8.8.8. What is the most likely cause?

A network administrator is unable to ping the server at 10.2.2.100 from a host on the 192.168.1.0/24 network. Based on the exhibit, what is the most likely cause?

Exhibit