ISC2 SSCP Practice Test

SSCP practice test: what's covered

• Systems Security Certified Practitioner

Free SSCP sample questions

1. A retail company encrypts customer credit-card numbers at rest, replicates the database across three regions, and signs every transaction log entry. Which leg of the CIA triad does the SIGNING of log entries MOST directly support?

   • A. Confidentiality — because signing scrambles the log contents
   • B. Integrity — because any tampering with a signed log entry invalidates the signature
   • C. Availability — because signatures replicate faster than encryption
   • D. Accountability — which is a fourth leg of the CIA triad
   Show answer

   Correct: B. Digital signatures detect modification; they do not hide content (confidentiality) or guarantee uptime (availability). Encryption-at-rest handles confidentiality; replication handles availability. Accountability is supported by signing+identity together but is NOT a leg of the CIA triad — that is the classic trap.

2. A new security policy document is approved by the CISO. The operations team asks for the EXACT firewall ruleset that implements it. Which document type should the operations team be handed?

   • A. A guideline
   • B. A standard
   • C. A procedure
   • D. Another policy
   Show answer

   Correct: C. Procedures are step-by-step "how to do it" documents — exactly what operations needs. Standards specify mandatory technologies/configurations (e.g., "TLS 1.2 minimum"). Guidelines are non-mandatory recommendations. Policies are high-level "what and why." The common trap is choosing "standard" because it sounds technical — but a standard mandates the WHAT, not the step-by-step HOW.

3. A help-desk technician resets a user password after the user calls and identifies themselves by name and employee ID only. Which element of AAA is WEAKEST in this workflow?

   • A. Authorization — the technician is not authorized to reset passwords
   • B. Authentication — name and employee ID are not authentication factors, they are identification claims
   • C. Accounting — the reset is not logged
   • D. Availability — the user could not access the password reset portal
   Show answer

   Correct: B. Identification is the CLAIM of identity; authentication is PROVING it. Name + employee ID are both identification — neither proves possession, knowledge, or inherence. A proper workflow demands at least one Type-I/II/III factor (e.g., a one-time code to a registered phone). Availability is irrelevant here.

4. Your organization is building an IT asset management programme. Which THREE attributes MUST be tracked per asset to support security operations? (Choose 3)

   • A. Asset owner / custodian
   • B. Information classification level handled
   • C. The asset's purchase invoice scan
   • D. Network location and exposure (internal, DMZ, public)
   • E. The colour of the device chassis
   Show answer

   Correct: A and B and D. Owner enables accountability and patching responsibility. Classification drives the required control set. Exposure determines threat profile and priority. Purchase invoices are finance artefacts (not security-operational). Chassis colour is irrelevant. SSCP common trap is to include the invoice because students confuse fixed-asset accounting with IT asset management.

5. A security awareness programme just launched. Six months later, the phishing-simulation click-rate has DROPPED from 28% to 12%. Which metric BEST quantifies the programme's success in measurable terms?

   • A. Number of training emails sent
   • B. Reduction in simulated-phish click-through rate (28%→12%, a 57% relative drop)
   • C. Number of slides in the training deck
   • D. Length of the policy document
   Show answer

   Correct: B. Awareness programmes are measured by behaviour change, not activity counts. Click-rate is the canonical KPI. Slide count and email count are output metrics (activity) — not outcome metrics. The trap is choosing "emails sent" because students confuse activity with effectiveness.

Last updated: 2026-10-19

SSCP practice test FAQ

Related practice tests

• CISSP practice test
• ISC2 CC practice test
• ISC2 CCSP practice test
• ISC2 CGRC practice test