SSCP DOMAIN-BASED PRACTICE QUESTIONS | SYSTEMS SECURITY CERTIFIED
PRACTITIONER | LATEST UPDATE 2026/2027 | ACTUAL EXAM | EXAM REVIEW |
100% CORRECT ANSWERS | VERIFIED SOLUTIONS
This domain-organized practice resource is designed for information security professionals
preparing for the ISC2 Systems Security Certified Practitioner (SSCP) certification. Each of the
seven SSCP domains is addressed through targeted practice questions that reinforce the specific
technical knowledge and skills required for this practitioner-focused certification. Questions are
organized by domain to allow candidates to focus their study efforts on areas requiring
additional attention. Each question includes a detailed rationale explaining both the correct
answer and why alternative options are incorrect. By mastering these domain-specific questions,
candidates will build comprehensive technical proficiency across all SSCP knowledge areas and
develop the confidence required for first-attempt success on the examination.
Table of Contents
Domain 1: Security Operations and Administration (Questions 1-15)
Domain 2: Access Controls (Questions 16-30)
Domain 3: Risk Identification, Monitoring, and Analysis (Questions 31-45)
Domain 4: Incident Response and Recovery (Questions 46-60)
Domain 5: Cryptography (Questions 61-73)
Domain 6: Network and Communications Security (Questions 74-87)
Domain 7: Systems and Application Security (Questions 88-100)
,DOMAIN 1: SECURITY OPERATIONS AND ADMINISTRATION
Focus Areas: Security governance, policies and procedures, security baselines, change
management, asset management, data classification, security awareness, separation of duties,
least privilege, and professional ethics.
Question 1
A security administrator deploys a standard configuration across all workstations that disables
unused services, requires screen lock after 10 minutes, enforces full disk encryption, and
configures centralized logging. This standard configuration is documented and mandatory for all
endpoints. What is the term for this documented configuration?
A) Security policy
B) Security baseline
C) Risk assessment report
D) Incident response procedure
Correct Answer: B
A security baseline defines the minimum mandatory security configuration for systems. It ensures
consistent security posture across the organization. Policies (A) are higher-level governance
statements. Risk assessments (C) identify and evaluate risks. Incident response procedures (D)
guide response activities.
Question 2
An organization requires that all changes to production systems be requested through a formal
process, reviewed by a Change Advisory Board, tested in a non-production environment, and
scheduled before implementation. A critical zero-day vulnerability patch for the VPN appliance
is released. What should occur?
A) The patch should wait for the next scheduled CAB meeting
B) An emergency change process should be followed with expedited approval and post-
implementation review
C) The patch should be applied immediately without any process
D) The vulnerability should be accepted until the next maintenance window
,Correct Answer: B
Emergency changes for critical security patches follow an expedited but documented process.
They bypass normal lead times for approval but still require testing where feasible,
documentation, and post-implementation review. Waiting (A) leaves the organization exposed.
Question 3
What is the correct governance document hierarchy from most strategic to most tactical?
A) Procedure, Standard, Policy, Guideline
B) Policy, Standard, Procedure, Guideline
C) Guideline, Policy, Standard, Procedure
D) Standard, Policy, Guideline, Procedure
Correct Answer: B
Policy (high-level, mandatory management expectations) → Standard (specific, mandatory
technical requirements) → Procedure (step-by-step, mandatory instructions) → Guideline
(recommended, not mandatory). This hierarchy ensures consistent, enforceable security.
Question 4
An organization discovers that a terminated employee's network account was used to access
internal systems three days after the employee departed. What process failure does this
represent?
A) Account provisioning
B) Offboarding and deprovisioning
C) Password complexity enforcement
D) Periodic access certification
Correct Answer: B
Offboarding must include immediate revocation of all access upon termination. The delay
indicates the deprovisioning process failed. Automated integration between HR systems and
identity management prevents this security gap.
Question 5
An organization implements a policy requiring employees in finance roles to take at least five
consecutive business days of vacation annually, during which another employee performs their
, duties. What is the primary security purpose of this requirement?
A) To comply with labor laws regarding mandatory vacation
B) To detect fraudulent activities that might be concealed by the absent employee
C) To reduce payroll costs through forced time off
D) To provide cross-training opportunities for other staff
Correct Answer: B
Mandatory vacations create an opportunity for another person to review the absent employee's
activities and detect anomalies, fraud, or errors. It is a detective administrative control that
supports separation of duties and accountability.
Question 6
What does the principle of least privilege require?
A) All users should have administrative access to their workstations
B) Users and processes should be granted only the minimum access necessary to perform
authorized functions
C) Access rights should be determined by employee seniority and tenure
D) All employees in the same department should have identical access rights
Correct Answer: B
Least privilege limits access to what is strictly required. This minimizes potential damage from
compromised accounts, errors, or insider threats. It applies equally to users, applications,
services, and system processes.
Question 7
Which of the following is an example of an administrative detective control?
A) A network firewall blocking unauthorized inbound traffic
B) A quarterly user access certification review conducted by department managers
C) A biometric fingerprint reader at a data center entrance
D) Full disk encryption deployed on all corporate laptops
Correct Answer: B
Administrative controls are management-oriented (policies, procedures, reviews). Access
reviews are detective administrative controls—they identify inappropriate existing access.
PRACTITIONER | LATEST UPDATE 2026/2027 | ACTUAL EXAM | EXAM REVIEW |
100% CORRECT ANSWERS | VERIFIED SOLUTIONS
This domain-organized practice resource is designed for information security professionals
preparing for the ISC2 Systems Security Certified Practitioner (SSCP) certification. Each of the
seven SSCP domains is addressed through targeted practice questions that reinforce the specific
technical knowledge and skills required for this practitioner-focused certification. Questions are
organized by domain to allow candidates to focus their study efforts on areas requiring
additional attention. Each question includes a detailed rationale explaining both the correct
answer and why alternative options are incorrect. By mastering these domain-specific questions,
candidates will build comprehensive technical proficiency across all SSCP knowledge areas and
develop the confidence required for first-attempt success on the examination.
Table of Contents
Domain 1: Security Operations and Administration (Questions 1-15)
Domain 2: Access Controls (Questions 16-30)
Domain 3: Risk Identification, Monitoring, and Analysis (Questions 31-45)
Domain 4: Incident Response and Recovery (Questions 46-60)
Domain 5: Cryptography (Questions 61-73)
Domain 6: Network and Communications Security (Questions 74-87)
Domain 7: Systems and Application Security (Questions 88-100)
,DOMAIN 1: SECURITY OPERATIONS AND ADMINISTRATION
Focus Areas: Security governance, policies and procedures, security baselines, change
management, asset management, data classification, security awareness, separation of duties,
least privilege, and professional ethics.
Question 1
A security administrator deploys a standard configuration across all workstations that disables
unused services, requires screen lock after 10 minutes, enforces full disk encryption, and
configures centralized logging. This standard configuration is documented and mandatory for all
endpoints. What is the term for this documented configuration?
A) Security policy
B) Security baseline
C) Risk assessment report
D) Incident response procedure
Correct Answer: B
A security baseline defines the minimum mandatory security configuration for systems. It ensures
consistent security posture across the organization. Policies (A) are higher-level governance
statements. Risk assessments (C) identify and evaluate risks. Incident response procedures (D)
guide response activities.
Question 2
An organization requires that all changes to production systems be requested through a formal
process, reviewed by a Change Advisory Board, tested in a non-production environment, and
scheduled before implementation. A critical zero-day vulnerability patch for the VPN appliance
is released. What should occur?
A) The patch should wait for the next scheduled CAB meeting
B) An emergency change process should be followed with expedited approval and post-
implementation review
C) The patch should be applied immediately without any process
D) The vulnerability should be accepted until the next maintenance window
,Correct Answer: B
Emergency changes for critical security patches follow an expedited but documented process.
They bypass normal lead times for approval but still require testing where feasible,
documentation, and post-implementation review. Waiting (A) leaves the organization exposed.
Question 3
What is the correct governance document hierarchy from most strategic to most tactical?
A) Procedure, Standard, Policy, Guideline
B) Policy, Standard, Procedure, Guideline
C) Guideline, Policy, Standard, Procedure
D) Standard, Policy, Guideline, Procedure
Correct Answer: B
Policy (high-level, mandatory management expectations) → Standard (specific, mandatory
technical requirements) → Procedure (step-by-step, mandatory instructions) → Guideline
(recommended, not mandatory). This hierarchy ensures consistent, enforceable security.
Question 4
An organization discovers that a terminated employee's network account was used to access
internal systems three days after the employee departed. What process failure does this
represent?
A) Account provisioning
B) Offboarding and deprovisioning
C) Password complexity enforcement
D) Periodic access certification
Correct Answer: B
Offboarding must include immediate revocation of all access upon termination. The delay
indicates the deprovisioning process failed. Automated integration between HR systems and
identity management prevents this security gap.
Question 5
An organization implements a policy requiring employees in finance roles to take at least five
consecutive business days of vacation annually, during which another employee performs their
, duties. What is the primary security purpose of this requirement?
A) To comply with labor laws regarding mandatory vacation
B) To detect fraudulent activities that might be concealed by the absent employee
C) To reduce payroll costs through forced time off
D) To provide cross-training opportunities for other staff
Correct Answer: B
Mandatory vacations create an opportunity for another person to review the absent employee's
activities and detect anomalies, fraud, or errors. It is a detective administrative control that
supports separation of duties and accountability.
Question 6
What does the principle of least privilege require?
A) All users should have administrative access to their workstations
B) Users and processes should be granted only the minimum access necessary to perform
authorized functions
C) Access rights should be determined by employee seniority and tenure
D) All employees in the same department should have identical access rights
Correct Answer: B
Least privilege limits access to what is strictly required. This minimizes potential damage from
compromised accounts, errors, or insider threats. It applies equally to users, applications,
services, and system processes.
Question 7
Which of the following is an example of an administrative detective control?
A) A network firewall blocking unauthorized inbound traffic
B) A quarterly user access certification review conducted by department managers
C) A biometric fingerprint reader at a data center entrance
D) Full disk encryption deployed on all corporate laptops
Correct Answer: B
Administrative controls are management-oriented (policies, procedures, reviews). Access
reviews are detective administrative controls—they identify inappropriate existing access.
