easyMultiple Select
SSCP Practice Question: Which TWO protocols are considered insecure and…
Which TWO protocols are considered insecure and should be replaced with secure alternatives? (Choose two.)
⚠ Common exam trap
ISC2 often tests the distinction between secure and insecure versions of protocols, where candidates mistakenly think SNMPv3 or IPsec are insecure because they confuse them with older versions (SNMPv1/v2c) or assume all VPN protocols are vulnerable.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Telnet
Both Telnet and FTP are considered insecure because they transmit data, including login credentials, in cleartext. Telnet (B) uses TCP port 23 and lacks encryption, making it vulnerable to packet sniffing and man-in-the-middle attacks. FTP (E) similarly transmits usernames and passwords over TCP port 21 in cleartext, and also allows anonymous access and passive data transfer issues. Secure alternatives include SSH for remote access (replacing Telnet) and SFTP or FTPS for file transfer (replacing FTP). IPsec (A), HTTPS (C), and SNMPv3 (D) are all considered secure protocols as they incorporate encryption and authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IPsec
Why it's wrong here
IPsec is a secure protocol suite, providing authentication and encryption at the network layer, so it is an alternative to insecure protocols rather than one itself. It is tempting because it operates at a low level alongside genuinely weak protocols such as Telnet, FTP and SNMPv1, which the question targets.
- ✓
Telnet
Why this is correct
Telnet transmits all data, including credentials, in cleartext, offering no encryption or integrity protection. This directly satisfies the stem's requirement for an insecure protocol needing replacement; SSH provides the secure alternative. Its lack of confidentiality makes it unsuitable for any authenticated administrative access across untrusted networks.
- ✗
HTTPS
Why it's wrong here
HTTPS wraps HTTP in TLS, providing encryption and server authentication, so it is the secure replacement rather than a protocol needing replacement. It is tempting because plain HTTP is insecure, and candidates may conflate the two, but the S in HTTPS denotes the secured variant.
- ✗
SNMPv3
Why it's wrong here
SNMPv3 adds authentication and encryption through its USM and VACM mechanisms, making it the secure replacement for SNMPv1 and v2c rather than an insecure protocol. It is tempting because earlier SNMP versions send community strings in cleartext, but v3 specifically addresses that weakness.
- ✓
FTP
Why this is correct
FTP transmits credentials and data in cleartext, offering no encryption, so anyone capturing traffic can read usernames, passwords and files. This directly violates the stem's requirement to replace insecure protocols with secure alternatives; FTPS or SFTP should be used instead.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.