How should I use these Security Operations and Administration practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

SSCP · topic practice

Security Operations and Administration practice questions

Q: Can I practise just Security Operations and Administration questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Security Operations and Administration domain.

Practise Systems Security Certified Practitioner SSCP Security Operations and Administration practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Security Operations and Administration

Practice 10 questions Browse domain →

What the exam tests

What to know about Security Operations and Administration

Security Operations and Administration questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Security Operations and Administration exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Security Operations and Administration questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Security Operations and Administration explanation →

A security analyst receives an alert that a user account has been locked out multiple times within 10 minutes. The analyst checks the account and finds it is a service account used for automated backups. What is the most likely cause?

Trap 1: The service account's certificate has expired.

Certificate expiration does not cause account lockouts; it affects authentication via certificates, not password-based lockouts.

Trap 2: A brute force attack is targeting the service account.

Brute force attacks typically target user accounts, not service accounts, and would generate many failed logins, not just lockouts.

Trap 3: The account password has expired and needs to be reset.

Password expiry does not cause lockouts; it prevents login.

Study all Security Operations and Administration common traps →

A
The service account's certificate has expired.
Why wrong: Certificate expiration does not cause account lockouts; it affects authentication via certificates, not password-based lockouts.
B
A brute force attack is targeting the service account.
Why wrong: Brute force attacks typically target user accounts, not service accounts, and would generate many failed logins, not just lockouts.
C
The account password has expired and needs to be reset.
Why wrong: Password expiry does not cause lockouts; it prevents login.
D
The service is using cached credentials that are out of sync with the domain controller.
Service accounts often cache credentials; if the password changes or becomes out of sync, repeated lockouts occur.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full Security Operations and Administration explanation →

A company implements a new policy requiring all privileged access requests to be approved by a manager. However, after deployment, analysts report that they cannot perform emergency changes outside business hours. What is the best solution?

Trap 1: Extend manager on-call hours to cover all times.

This is impractical and does not scale; it also creates burnout.

Trap 2: Remove the approval requirement for privileged access.

This undermines the security policy entirely.

Trap 3: Require analysts to call a manager for approval each time.

This is inefficient and not feasible for emergencies outside business hours.

Study all Security Operations and Administration common traps →

A
Extend manager on-call hours to cover all times.
Why wrong: This is impractical and does not scale; it also creates burnout.
B
Implement a break-glass procedure for emergency access.
Break-glass allows temporary privileged access with post-event review, balancing security and availability.
C
Remove the approval requirement for privileged access.
Why wrong: This undermines the security policy entirely.
D
Require analysts to call a manager for approval each time.
Why wrong: This is inefficient and not feasible for emergencies outside business hours.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full Security Operations and Administration explanation →

A security administrator is tasked with ensuring that only authorized software can run on company workstations. Which security control should be implemented?

Trap 1: Antivirus software

Antivirus detects known malware but does not prevent execution of unauthorized software.

Trap 2: Patch management

Patch management keeps software updated but does not control which software runs.

Trap 3: Host-based firewall

Firewall controls network traffic, not software execution.

Study all Security Operations and Administration common traps →

A
Antivirus software
Why wrong: Antivirus detects known malware but does not prevent execution of unauthorized software.
B
Patch management
Why wrong: Patch management keeps software updated but does not control which software runs.
C
Host-based firewall
Why wrong: Firewall controls network traffic, not software execution.
D
Application whitelisting
Whitelisting ensures only approved software can run, directly meeting the requirement.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Security Operations and Administration explanation →

An organization's security policy requires that all data at rest be encrypted. A database administrator objects, stating that encryption will degrade performance. What is the best response?

Trap 1: Remove the encryption requirement for databases.

This violates security policy and exposes data.

Trap 2: Encrypt only the backup files, not the live database.

This leaves live data unencrypted, violating policy.

Trap 3: Use column-level encryption on sensitive columns only.

Column-level encryption can be more complex and may still impact performance.

Study all Security Operations and Administration common traps →

A
Remove the encryption requirement for databases.
Why wrong: This violates security policy and exposes data.
B
Encrypt only the backup files, not the live database.
Why wrong: This leaves live data unencrypted, violating policy.
C
Use column-level encryption on sensitive columns only.
Why wrong: Column-level encryption can be more complex and may still impact performance.
D
Implement transparent data encryption (TDE) to minimize performance impact.
TDE encrypts the entire database transparently with low overhead.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full Security Operations and Administration explanation →

During a security audit, it is discovered that several employees have access to shared network drives containing sensitive HR data. The HR manager states that these employees no longer need access. What is the most efficient way to revoke access?

Trap 1: Delete the user accounts of the affected employees.

Deleting accounts is drastic and may affect other resources.

Trap 2: Reconfigure the shared drive to deny access to all users except HR.

This is a broader change that may disrupt legitimate access.

Trap 3: Manually remove each user's permissions on the shared drive.

Manual removal is time-consuming and error-prone.

Study all Security Operations and Administration common traps →

A
Remove the users from the security group that grants access to the drives.
Group-based management allows efficient revocation by modifying group membership.
B
Delete the user accounts of the affected employees.
Why wrong: Deleting accounts is drastic and may affect other resources.
C
Reconfigure the shared drive to deny access to all users except HR.
Why wrong: This is a broader change that may disrupt legitimate access.
D
Manually remove each user's permissions on the shared drive.
Why wrong: Manual removal is time-consuming and error-prone.

Full breakdown with real-world context →

Question 6easymultiple choice

Read the full Security Operations and Administration explanation →

A company wants to ensure that employees use strong passwords. Which policy is most effective?

Trap 1: Prohibit password reuse for the last 10 passwords.

This is good but not as effective as length.

Trap 2: Require password changes every 30 days.

Frequent changes encourage weak passwords and reuse.

Trap 3: Require a mix of uppercase, lowercase, numbers, and symbols.

Complexity requirements can lead to predictable patterns.

Study all Security Operations and Administration common traps →

A
Prohibit password reuse for the last 10 passwords.
Why wrong: This is good but not as effective as length.
B
Require password changes every 30 days.
Why wrong: Frequent changes encourage weak passwords and reuse.
C
Require a minimum password length of 12 characters.
Length is the most important factor for password strength.
D
Require a mix of uppercase, lowercase, numbers, and symbols.
Why wrong: Complexity requirements can lead to predictable patterns.

Full breakdown with real-world context →

Question 7mediummultiple choice

Read the full Security Operations and Administration explanation →

A security team is investigating a potential data exfiltration incident. They notice that a large amount of data was transferred to an external IP address during off-hours. What should be the first step?

Trap 1: Notify senior management of the incident.

Notification is important but does not stop the active exfiltration.

Trap 2: Block the external IP address at the firewall.

Blocking the IP may stop exfiltration but the system remains compromised.

Trap 3: Analyze the data transfer logs to determine the scope.

Analysis should follow containment to avoid further loss.

Study all Security Operations and Administration common traps →

A
Notify senior management of the incident.
Why wrong: Notification is important but does not stop the active exfiltration.
B
Block the external IP address at the firewall.
Why wrong: Blocking the IP may stop exfiltration but the system remains compromised.
C
Analyze the data transfer logs to determine the scope.
Why wrong: Analysis should follow containment to avoid further loss.
D
Isolate the affected system from the network.
Isolation stops the exfiltration immediately.

Full breakdown with real-world context →

Question 8hardmultiple choice

Read the full Security Operations and Administration explanation →

An organization uses role-based access control (RBAC). A user complains that they can access a resource they were previously denied. The security administrator finds that the user's role was recently changed. What is the most likely cause?

Trap 1: The user's previous role was not properly removed.

Role removal issues could cause lingering access, but the user was previously denied.

Trap 2: The RBAC implementation has a bug that grants excessive permissions.

While possible, the most likely cause is role inheritance.

Trap 3: The user was directly assigned permissions to the resource.

Direct assignment is less likely in a pure RBAC model.

Study all Security Operations and Administration common traps →

A
The user's previous role was not properly removed.
Why wrong: Role removal issues could cause lingering access, but the user was previously denied.
B
The RBAC implementation has a bug that grants excessive permissions.
Why wrong: While possible, the most likely cause is role inheritance.
C
The user's new role inherits permissions from multiple roles that collectively grant access.
In RBAC, roles can inherit permissions, leading to unintended access.
D
The user was directly assigned permissions to the resource.
Why wrong: Direct assignment is less likely in a pure RBAC model.

Full breakdown with real-world context →

Question 9easymultiple choice

Read the full Security Operations and Administration explanation →

Which of the following is the primary purpose of a security awareness program?

Trap 1: To evaluate the effectiveness of security technologies.

Technology evaluation is not a purpose of awareness programs.

Trap 2: To enforce security policies through penalties.

Enforcement is separate from awareness; awareness informs, not enforces.

Trap 3: To train employees on advanced technical security skills.

Technical skills are part of specialized training, not general awareness.

Study all Security Operations and Administration common traps →

A
To teach employees about security best practices and reduce human error.
This is the core purpose of awareness programs.
B
To evaluate the effectiveness of security technologies.
Why wrong: Technology evaluation is not a purpose of awareness programs.
C
To enforce security policies through penalties.
Why wrong: Enforcement is separate from awareness; awareness informs, not enforces.
D
To train employees on advanced technical security skills.
Why wrong: Technical skills are part of specialized training, not general awareness.

Full breakdown with real-world context →

Question 10mediummulti select

Read the full Security Operations and Administration explanation →

Which TWO of the following are valid reasons for implementing a separation of duties policy? (Choose two.)

Trap 1: To reduce the workload on individual employees.

Separation of duties often increases workload due to additional checks.

Trap 2: To simplify training requirements.

Separation of duties may complicate training as more people need to be trained.

Trap 3: To comply with regulatory requirements.

While compliance may drive it, the core reasons are fraud prevention and error detection.

Study all Security Operations and Administration common traps →

A
To reduce the workload on individual employees.
Why wrong: Separation of duties often increases workload due to additional checks.
B
To detect errors through independent verification.
Having different people perform related tasks allows for error detection.
C
To simplify training requirements.
Why wrong: Separation of duties may complicate training as more people need to be trained.
D
To comply with regulatory requirements.
Why wrong: While compliance may drive it, the core reasons are fraud prevention and error detection.
E
To prevent fraud by requiring collusion.
Separation of duties makes fraud more difficult as it requires multiple people to collude.

Full breakdown with real-world context →

Question 11hardmulti select

Read the full Security Operations and Administration explanation →

Which THREE of the following are essential elements of an effective incident response plan? (Choose three.)

Trap 1: Public relations and media notification

Media notification is secondary; not a core element of the plan.

Trap 2: Cyber insurance purchasing

Insurance is a financial risk management tool, not a response step.

Study all Security Operations and Administration common traps →

A
Containment, eradication, and recovery
These steps limit damage, remove threats, and restore operations.
B
Detection and analysis
Detection identifies incidents, and analysis determines scope.
C
Public relations and media notification
Why wrong: Media notification is secondary; not a core element of the plan.
D
Cyber insurance purchasing
Why wrong: Insurance is a financial risk management tool, not a response step.
E
Preparation and training
Preparation ensures the team is ready to respond.

Full breakdown with real-world context →

Question 12easymulti select

Read the full Security Operations and Administration explanation →

Which TWO of the following are examples of administrative controls? (Choose two.)

Trap 1: Firewall rules

Firewalls are technical controls.

Trap 2: Security guards

Guards are physical controls.

Trap 3: Encryption of data at rest

Encryption is a technical control.

Study all Security Operations and Administration common traps →

A
Firewall rules
Why wrong: Firewalls are technical controls.
B
Access control policies
Policies are administrative controls.
C
Security awareness training
Training is an administrative control.
D
Security guards
Why wrong: Guards are physical controls.
E
Encryption of data at rest
Why wrong: Encryption is a technical control.

Full breakdown with real-world context →

Question 13mediummultiple choice

Read the full Security Operations and Administration explanation →

Based on the exhibit, which type of attack is most likely occurring?

Exhibit

Refer to the exhibit.

[user@server ~]$ sudo cat /var/log/auth.log | grep 'Failed password' | tail -5
Mar 10 14:23:01 server sshd[1234]: Failed password for root from 10.0.0.5 port 22 ssh2
Mar 10 14:23:05 server sshd[1234]: Failed password for root from 10.0.0.5 port 22 ssh2
Mar 10 14:23:09 server sshd[1234]: Failed password for root from 10.0.0.5 port 22 ssh2
Mar 10 14:23:13 server sshd[1234]: Failed password for root from 10.0.0.5 port 22 ssh2
Mar 10 14:23:17 server sshd[1234]: Failed password for root from 10.0.0.5 port 22 ssh2

Trap 1: Man-in-the-middle attack

MITM would not generate auth.log entries like this.

Trap 2: Denial of service attack

DoS would show resource exhaustion, not repeated login attempts.

Trap 3: Social engineering attack

Social engineering is not directly observable in logs.

Study all Security Operations and Administration common traps →

A
Brute force attack
Repeated failed password attempts from same IP is classic brute force.
B
Man-in-the-middle attack
Why wrong: MITM would not generate auth.log entries like this.
C
Denial of service attack
Why wrong: DoS would show resource exhaustion, not repeated login attempts.
D
Social engineering attack
Why wrong: Social engineering is not directly observable in logs.

Full breakdown with real-world context →

Question 14hardmultiple choice

Read the full Security Operations and Administration explanation →

Based on the exhibit, which of the following best describes the firewall configuration?

Network Topology

Trap 1: The firewall allows only loopback traffic.

Loopback is allowed, but also traffic from internal subnet.

Trap 2: The firewall allows all traffic from the internal subnet.

Only specific ports are allowed, not all traffic.

Trap 3: The firewall allows all traffic from external sources.

The final rule drops all traffic not matching previous rules, including external.

Study all Security Operations and Administration common traps →

A
The firewall allows only loopback traffic.
Why wrong: Loopback is allowed, but also traffic from internal subnet.
B
The firewall allows all traffic from the internal subnet.
Why wrong: Only specific ports are allowed, not all traffic.
C
The firewall allows SSH, HTTP, and HTTPS from the internal subnet and drops all other traffic.
The rules show ACCEPT for ports 22, 80, 443 from 10.0.0.0/24, and a final DROP all.
D
The firewall allows all traffic from external sources.
Why wrong: The final rule drops all traffic not matching previous rules, including external.

Full breakdown with real-world context →

Question 15hardmultiple choice

Read the full Security Operations and Administration explanation →

You are the security administrator for a mid-sized financial company that processes credit card transactions. The company has a mix of on-premises servers and cloud-based services. Recently, the company experienced a data breach where an attacker exfiltrated customer data from a database server. The investigation reveals that the attacker used compromised credentials of a database administrator (DBA) account. The DBA account had been used by multiple administrators without proper auditing. The company wants to implement a solution to prevent such incidents in the future. The solution must: 1) ensure that each administrator has a unique account for database access, 2) require approval for privileged actions, 3) provide a full audit trail of all privileged activities, and 4) be cost-effective. Which of the following is the best course of action?

Trap 1: Enforce the use of a shared DBA account with a complex password…

Shared accounts defeat accountability and uniqueness.

Trap 2: Require multi-factor authentication for all database access without…

MFA enhances authentication but does not provide approval workflows or audit trails.

Trap 3: Install a database activity monitoring (DAM) solution that logs all…

DAM provides auditing but does not enforce unique accounts or approval.

Study all Security Operations and Administration common traps →

A
Enforce the use of a shared DBA account with a complex password that is changed monthly.
Why wrong: Shared accounts defeat accountability and uniqueness.
B
Implement a privileged access management (PAM) solution that provides just-in-time access and session recording.
PAM addresses all requirements: unique accounts (via vault), approval workflows, and full audit trails.
C
Require multi-factor authentication for all database access without any additional controls.
Why wrong: MFA enhances authentication but does not provide approval workflows or audit trails.
D
Install a database activity monitoring (DAM) solution that logs all SQL queries.
Why wrong: DAM provides auditing but does not enforce unique accounts or approval.

Full breakdown with real-world context →

Question 16mediummultiple choice

Read the full NAT/PAT explanation →

You work for a hospital that has recently transitioned to an electronic health record (EHR) system. The system stores protected health information (PHI) and must comply with HIPAA. The hospital's security policy requires that all access to PHI be logged and that any unauthorized access be detected promptly. The IT department has implemented logging on the EHR system, but the security team is overwhelmed by the volume of logs and cannot review them in a timely manner. Additionally, there have been incidents where employees accessed patient records without a legitimate need, but these were only discovered months later during random audits. The hospital needs to improve its detection capabilities. Which of the following is the most effective solution?

Trap 1: Retain logs for a longer period to allow more thorough audits.

Longer retention does not help with timely detection.

Trap 2: Assign additional staff to manually review logs on a daily basis.

Manual review is not scalable and still subject to delays.

Trap 3: Increase the verbosity of logging to capture more details.

More logs worsen the overload without automated analysis.

Study all Security Operations and Administration common traps →

A
Deploy a Security Information and Event Management (SIEM) system with automated alerting.
SIEM aggregates logs, detects anomalies, and alerts in real time, improving detection.
B
Retain logs for a longer period to allow more thorough audits.
Why wrong: Longer retention does not help with timely detection.
C
Assign additional staff to manually review logs on a daily basis.
Why wrong: Manual review is not scalable and still subject to delays.
D
Increase the verbosity of logging to capture more details.
Why wrong: More logs worsen the overload without automated analysis.

Full breakdown with real-world context →

Question 17mediumdrag order

Read the full VPN explanation →

Drag and drop the steps for establishing a VPN using IPsec in tunnel mode into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 18mediummatching

Read the full Security Operations and Administration explanation →

Match each network security device to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Filters traffic based on rules

Monitors and alerts on suspicious activity

Blocks malicious traffic in real-time

Manages encrypted tunnels

Question 19mediummultiple choice

Read the full Security Operations and Administration explanation →

A security administrator needs to ensure that only authorized personnel can reset user passwords in Active Directory. Which of the following is the BEST method to delegate this responsibility without granting unnecessary privileges?

Trap 1: Place the personnel in the Account Operators group.

Account Operators can create and manage user accounts, which is more than resetting passwords.

Trap 2: Add the personnel to the Domain Admins group.

Domain Admins have full control over the domain, far beyond password reset.

Trap 3: Give the personnel physical access to the domain controller.

Physical access does not grant administrative permissions and is a security risk.

Study all Security Operations and Administration common traps →

A
Place the personnel in the Account Operators group.
Why wrong: Account Operators can create and manage user accounts, which is more than resetting passwords.
B
Add the personnel to the Domain Admins group.
Why wrong: Domain Admins have full control over the domain, far beyond password reset.
C
Use Delegation of Control wizard to assign the 'Reset user passwords and force password change at next logon' permission.
This provides exactly the needed permission without extra rights.
D
Give the personnel physical access to the domain controller.
Why wrong: Physical access does not grant administrative permissions and is a security risk.

Full breakdown with real-world context →

Question 20easymultiple choice

Read the full Security Operations and Administration explanation →

An organization implements a new security policy requiring all portable storage devices to be encrypted. Which of the following is the MOST effective control to enforce this policy?

Trap 1: Distribute a memo to all employees about the policy.

Memos are not enforceable and rely on user compliance.

Trap 2: Enable auditing for removable drive usage.

Auditing detects but does not enforce encryption.

Trap 3: Enable BitLocker on all laptops.

BitLocker protects system drives, not necessarily portable storage.

Study all Security Operations and Administration common traps →

A
Distribute a memo to all employees about the policy.
Why wrong: Memos are not enforceable and rely on user compliance.
B
Configure Group Policy to require BitLocker encryption on removable drives.
Group Policy can enforce encryption for removable drives when supported.
C
Enable auditing for removable drive usage.
Why wrong: Auditing detects but does not enforce encryption.
D
Enable BitLocker on all laptops.
Why wrong: BitLocker protects system drives, not necessarily portable storage.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Security Operations and Administration sessions

Start a Security Operations and Administration only practice session

Every question in these sessions is drawn from the Security Operations and Administration domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Security Operations and Administration questions →Mixed SSCP session

Frequently asked questions

What does the SSCP exam test about Security Operations and Administration?: Security Operations and Administration questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Security Operations and Administration questions in a focused session?: Yes — the session launcher on this page draws every question from the Security Operations and Administration domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other SSCP topics?: Use the topic links above to move to related areas, or go back to the SSCP question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the SSCP exam covers. They are not copied from any real exam or dump site.

Security Operations and Administration only

10 questions 20 questions 30 questions 50 questions

Mixed SSCP session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All SSCP questions Security Operations and Administration domain overview SSCP exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Security Operations and Administration practice questions

What to know about Security Operations and Administration

Common Security Operations and Administration exam traps

Security Operations and Administration questions

A security analyst receives an alert that a user account has been locked out multiple times within 10 minutes. The analyst checks the account and finds it is a service account used for automated backups. What is the most likely cause?

A company implements a new policy requiring all privileged access requests to be approved by a manager. However, after deployment, analysts report that they cannot perform emergency changes outside business hours. What is the best solution?

A security administrator is tasked with ensuring that only authorized software can run on company workstations. Which security control should be implemented?

An organization's security policy requires that all data at rest be encrypted. A database administrator objects, stating that encryption will degrade performance. What is the best response?

During a security audit, it is discovered that several employees have access to shared network drives containing sensitive HR data. The HR manager states that these employees no longer need access. What is the most efficient way to revoke access?

A company wants to ensure that employees use strong passwords. Which policy is most effective?

A security team is investigating a potential data exfiltration incident. They notice that a large amount of data was transferred to an external IP address during off-hours. What should be the first step?

An organization uses role-based access control (RBAC). A user complains that they can access a resource they were previously denied. The security administrator finds that the user's role was recently changed. What is the most likely cause?

Which of the following is the primary purpose of a security awareness program?

Which TWO of the following are valid reasons for implementing a separation of duties policy? (Choose two.)

Which THREE of the following are essential elements of an effective incident response plan? (Choose three.)

Which TWO of the following are examples of administrative controls? (Choose two.)

Based on the exhibit, which type of attack is most likely occurring?

Exhibit

Based on the exhibit, which of the following best describes the firewall configuration?

Drag and drop the steps for establishing a VPN using IPsec in tunnel mode into the correct order.

Match each network security device to its function.

A security administrator needs to ensure that only authorized personnel can reset user passwords in Active Directory. Which of the following is the BEST method to delegate this responsibility without granting unnecessary privileges?

An organization implements a new security policy requiring all portable storage devices to be encrypted. Which of the following is the MOST effective control to enforce this policy?

Track your progress over time

Start a Security Operations and Administration only practice session

Related SSCP topic practice pages

Risk Identification, Monitoring and Analysis practice questions

Network and Communications Security practice questions

Systems and Application Security practice questions