(ISC)2 SSCP - Systems Security Certified Practitioner - Access Controls Operations Risk Cryptography Networks Systems

By Sam Patel · Updated May 25, 2026

Questions25
Passing Score75%
Format100% Multiple Choice
Sessions Logged2,061
Your progressLog in / Register to track times taken, best score, questions mastered, and coverage on this quiz.
Rating
4.4 (40)

Topics covered

This quiz

Uncategorized25 (100%)

Uncategorized25 questions

Browse more · Report this quiz

Question catalog for this preview

Catalog listing of the 5 preview questions for this quiz.

Question 1

An organization implements a vulnerability management program. They use a vulnerability scanner that produces 3,000 vulnerabilities across 500 servers each month. How should the security team PRIORITIZE remediation?

Answer choices

  • A. Remediate all vulnerabilities in alphabetical order by CVE number

  • B. Prioritize based on: risk-based scoring combining CVSS severity + asset criticality + exploitability (public exploit available) + threat intelligence (is it being actively exploited in the wild?) — focus first on critical/high CVEs with public exploits on internet-facing or critical business systems

  • C. Remediate in the order the scanner reports vulnerabilities

  • D. Focus only on CVSS 10.0 vulnerabilities since lower scores are not significant risks

Question 2

An organization is evaluating network segmentation using VLANs vs. physical network separation for their most sensitive financial systems. What is the SECURITY difference?

Answer choices

  • A. VLANs and physical separation provide identical security

  • B. Physical separation provides stronger isolation — VLAN hopping attacks (double-tagging, switch spoofing) can potentially bypass VLAN segmentation; physical air gaps or dedicated switches eliminate shared-infrastructure attacks

  • C. VLANs are stronger than physical separation because they support encryption

  • D. Physical separation is less secure because it requires manual management

Question 3

A security analyst is reviewing user account access for a financial application. They discover that a user in the accounting department has both the ability to create purchase orders AND approve them. Which security principle is VIOLATED?

Answer choices

  • A. Least privilege — the user has too many permissions

  • B. Separation of duties (SoD) — the same user should not be able to both initiate and approve financial transactions, as this enables fraud without detection

  • C. Need-to-know — the user doesn't need purchase order access for their role

  • D. Defense in depth — multiple controls should be applied

Question 4

A security practitioner is implementing security controls for a web application that handles financial transactions. Which HTTP security header MOST directly prevents clickjacking attacks?

Answer choices

  • A. `Content-Security-Policy` (CSP) — restricts resource loading

  • B. `X-Frame-Options: DENY` or `Content-Security-Policy: frame-ancestors 'none'` — prevents the page from being embedded in iframes on other sites, blocking clickjacking

  • C. `Strict-Transport-Security` (HSTS) — forces HTTPS connections

  • D. `X-Content-Type-Options: nosniff` — prevents MIME type sniffing

Question 5

A security analyst is investigating a compromised system. They find a file named `system32.exe` in `C:\Users\Public\Downloads\`. What makes this suspicious?

Answer choices

  • A. The `.exe` extension is unusual for a system file

  • B. Legitimate Windows system files are located in `C:\Windows\System32\`, not in user directories — a file with a system-sounding name in a user-writable directory is a classic malware indicator (DLL hijacking or dropper)

  • C. The file size is unusually large

  • D. The file has a valid Microsoft digital signature