I85PREP
⌘ K
SSCP study materials
SSCP study resources

SSCP practice questions

One question at a time. Build your SSCP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Concepts and Practices

Which security principle ensures that data is not modified or destroyed in an unauthorized way?

  1. Confidentiality
  2. Availability
  3. Non-repudiation
  4. Integrity Correct answer.

Explanation

Integrity focuses on protecting data from unauthorized alteration and ensuring it remains accurate and complete. Availability concerns timely access, confidentiality concerns unauthorized disclosure, and non-repudiation concerns proving an action occurred.

Question 2Security Concepts and Practices

A user types a username into a login prompt before entering any password. Which activity has occurred?

  1. Authorization
  2. Identification Correct answer.
  3. Authentication
  4. Accounting

Explanation

Identification is the act of claiming an identity, such as supplying a username. Authentication verifies that claim, authorization determines permitted actions, and accounting records activity.

Question 3Security Concepts and Practices

Which security service prevents a sender from later denying that a message was sent?

  1. Integrity
  2. Non-repudiation Correct answer.
  3. Confidentiality
  4. Availability

Explanation

Non-repudiation provides proof of origin and delivery so a party cannot deny involvement. Digital signatures are commonly used to bind a message to a signer's identity.

Question 4Security Concepts and Practices

Granting an employee only the access required to perform their assigned job illustrates which principle?

  1. Least privilege Correct answer.
  2. Job rotation
  3. Defense in depth
  4. Separation of duties

Explanation

Least privilege limits access rights to the minimum necessary for a job function. This reduces the potential damage from an error or compromised account.

Question 5Security Concepts and Practices

A fingerprint scanner authenticates users based on which type of factor?

  1. Something you have
  2. Something you are Correct answer.
  3. Somewhere you are
  4. Something you know

Explanation

Biometric traits such as fingerprints, iris patterns, and voice are categorised as something you are. Passwords and PINs are something you know, and tokens are something you have.

Question 6Security Concepts and Practices

Layering firewalls, endpoint protection, and access controls so that no single failure exposes the environment is best described as what?

  1. Separation of duties
  2. Single sign-on
  3. Defense in depth Correct answer.
  4. Least privilege

Explanation

Defense in depth uses multiple overlapping controls so an attacker must defeat several layers. If one control fails, others still provide protection.

Question 7Security Concepts and Practices

The combination of a threat exploiting a vulnerability and the resulting business impact is best described as what?

  1. A vulnerability
  2. An asset
  3. A threat
  4. Risk Correct answer.

Explanation

Risk expresses the likelihood that a threat will exploit a vulnerability and the resulting impact on the organisation. Vulnerabilities are weaknesses, threats are potential causes of harm, and assets are items of value.

Question 8Security Concepts and Practices

A sign warning that the premises are monitored by CCTV is which type of security control?

  1. Deterrent Correct answer.
  2. Compensating
  3. Corrective
  4. Detective

Explanation

A deterrent control discourages potential attackers by making the risk of detection apparent. It influences behaviour before an incident rather than detecting or repairing one.

Question 9Security Concepts and Practices

In mandatory access control, access decisions are based primarily on what?

  1. Assigned job roles
  2. The resource owner's discretion
  3. Directory group membership
  4. Comparing object labels with subject clearance Correct answer.

Explanation

Mandatory access control compares the security label of a resource with the clearance of the subject. The system enforces these labels, and users cannot override them.

Question 10Security Concepts and Practices

Assigning permissions to a job function rather than to named individuals is characteristic of which model?

  1. Role-based access control Correct answer.
  2. Mandatory access control
  3. Attribute-based access control
  4. Discretionary access control

Explanation

Role-based access control grants permissions to roles, and users receive permissions by being assigned to roles. This simplifies administration when people change positions.

Question 11Security Concepts and Practices

A biometric system mistakenly accepts an unauthorized person. Which metric increases?

  1. False rejection rate
  2. False acceptance rate Correct answer.
  3. Crossover error rate
  4. Enrollment rate

Explanation

The false acceptance rate measures how often an unauthorized user is incorrectly accepted. The false rejection rate measures valid users being denied, and the crossover error rate is where the two are equal.

Question 12Security Concepts and Practices

Which property makes a cryptographic hash useful for verifying file integrity?

  1. The digest can be reversed with a private key
  2. The hash uses a shared secret key
  3. The output length varies with the input
  4. A small change in the input alters the digest Correct answer.

Explanation

A hash function produces a fixed-length digest that changes substantially when the input changes, revealing modifications. Hashes are one-way and do not require a key for integrity checking.

Question 13Security Concepts and Practices

To create a digital signature, the signer performs which action?

  1. Generates a random session key and encrypts the hash with it
  2. Encrypts the hash with the recipient's public key
  3. Hashes the message and signs the hash with a private key Correct answer.
  4. Encrypts the message with the recipient's public key before sending

Explanation

A digital signature is created by hashing the message and encrypting that hash with the signer's private key. The recipient verifies it using the signer's public key, which proves origin and integrity.

Question 14Security Concepts and Practices

Kerberos provides authentication across a network primarily by using what?

  1. A shared directory of hashed passwords
  2. TLS client certificates on each host
  3. A trusted third party and time-limited tickets Correct answer.
  4. Public key certificates issued by a certificate authority

Explanation

Kerberos relies on a trusted key distribution centre that issues time-limited tickets for accessing services. The tickets reduce repeated password transmission and support single sign-on.

Question 15Security Concepts and Practices

What is the primary security risk of single sign-on?

  1. Users must remember a separate password for each system
  2. Authentication across systems becomes slower
  3. Administrative overhead increases significantly
  4. One credential compromise affects many systems Correct answer.

Explanation

With single sign-on, one authenticated session or credential can provide access to many resources. Compromise of that credential therefore has a broad impact, making strong authentication and monitoring essential.

Question 16Security Concepts and Practices

Requiring one employee to approve payments and a different employee to disburse them implements which control?

  1. Mandatory vacation
  2. Least privilege
  3. Separation of duties Correct answer.
  4. Job rotation

Explanation

Separation of duties divides a sensitive process among multiple people so no single individual can complete it alone. This reduces the opportunity for fraud or undetected error.

Question 17Security Concepts and Practices

What is the primary purpose of classifying data?

  1. To reduce the cost of storage media
  2. To determine the handling and protection it requires Correct answer.
  3. To encrypt all data at rest automatically
  4. To remove the need for access controls

Explanation

Data classification assigns sensitivity levels so that appropriate handling, storage, and access rules can be applied. The label drives the controls rather than the other way around.

Question 18Security Concepts and Practices

In the incident response life cycle, which phase immediately follows detection and analysis?

  1. Containment Correct answer.
  2. Lessons learned
  3. Preparation
  4. Recovery

Explanation

After an incident is detected and analysed, the team contains it to limit damage before eradicating the cause and recovering. Preparation comes first, and lessons learned comes after recovery.

Question 19Security Concepts and Practices

A business continuity plan focuses primarily on what?

  1. Restoring technology infrastructure after a disaster occurs
  2. Identifying threats to the organisation
  3. Keeping critical business functions operating during disruption Correct answer.
  4. Testing backup tapes on a fixed schedule

Explanation

Business continuity planning addresses sustaining essential business functions during and after a disruption. Disaster recovery planning is the narrower effort focused on restoring technology and data.

Question 20Security Concepts and Practices

An organisation purchases cyber insurance to address a identified risk. This is which risk treatment?

  1. Risk transference Correct answer.
  2. Risk avoidance
  3. Risk acceptance
  4. Risk mitigation

Explanation

Risk transference shifts the financial consequences of a risk to another party, such as an insurer. The risk itself remains, but the organisation is compensated for certain losses.

Question 21Security Concepts and Practices

An access control decision evaluates the user's department, the resource's sensitivity label, and the current time of day. Which model is being used?

  1. Discretionary access control
  2. Mandatory access control
  3. Role-based access control
  4. Attribute-based access control Correct answer.

Explanation

Attribute-based access control evaluates multiple attributes of the subject, resource, and environment before granting access. Role-based control uses job roles, discretionary control uses owner decisions, and mandatory control uses fixed labels and clearances.

Question 22Security Concepts and Practices

Which model forbids reading data at a higher classification and writing data to a lower classification?

  1. Clark-Wilson
  2. Bell-LaPadula Correct answer.
  3. Brewer-Nash
  4. Biba

Explanation

Bell-LaPadula protects confidentiality with no read up and no write down rules. Biba addresses integrity with the opposite orientation, while Clark-Wilson and Brewer-Nash address integrity and conflict-of-interest concerns respectively.

Question 23Security Concepts and Practices

In a hierarchical public key infrastructure, the trust anchor is which component?

  1. The end-entity certificate
  2. The registration authority
  3. The certificate revocation list distribution point
  4. The root certificate authority Correct answer.

Explanation

The root certificate authority anchors trust because all certificates in the hierarchy chain back to it. If the root is trusted, certificates signed through the chain can be validated.

Question 24Security Concepts and Practices

The crossover error rate of a biometric system is the point at which what occurs?

  1. Enrollment processing time is shortest
  2. False accept and false reject rates are equal Correct answer.
  3. False rejection rate is at its maximum value
  4. False acceptance rate is at its maximum value

Explanation

The crossover error rate occurs where the false acceptance rate and false rejection rate are equal. It is used to compare biometric systems, with a lower value indicating better accuracy.

Question 25Security Concepts and Practices

In a security programme, due diligence is best described as what?

  1. Purchasing the most comprehensive tool suite available
  2. Writing policies once and archiving them
  3. Ongoing verification that controls are effective Correct answer.
  4. Delegating all security tasks to the IT team

Explanation

Due diligence is the continuous effort to confirm that safeguards are appropriate and working, while due care is the application of those safeguards. It requires periodic review rather than one-time documentation.

Question 26Security Concepts and Practices

An attacker edits a stored bank statement file on a server so that the recorded balance differs from the true balance, and no one notices the change. Which element of the CIA triad is primarily affected?

  1. Non-repudiation
  2. Confidentiality
  3. Integrity Correct answer.
  4. Availability

Explanation

Integrity is the property that data remains accurate, complete, and unaltered except through authorised changes, so silent modification of a stored record is an integrity failure. Availability concerns timely access to data, and confidentiality concerns preventing unauthorised disclosure, neither of which is the primary issue here.

Question 27Security Concepts and Practices

After a ransomware outbreak encrypts a file server, the operations team wipes the server and restores the affected data from the previous night's backup. Which control type best describes the restoration activity?

  1. Detective
  2. Corrective Correct answer.
  3. Preventive
  4. Deterrent

Explanation

Controls are classified by function: preventive controls stop an event, detective controls identify it, and corrective controls reduce impact and restore normal operation after it occurs. Restoring from backup is performed after the incident to return systems to a known good state, which makes it corrective.

Question 28Security Concepts and Practices

A data centre faces a flood risk. A single flood is estimated to cause $200,000 in damage, and a flood of that severity is expected once every 20 years. What is the annualised loss expectancy (ALE)?

  1. $200,000
  2. $10,000 Correct answer.
  3. $4,000,000
  4. $20,000

Explanation

ALE equals single loss expectancy multiplied by annualised rate of occurrence. Here the SLE is $200,000 and the ARO is 1/20, or 0.05, so the ALE is $200,000 x 0.05 = $10,000.

Question 29Security Concepts and Practices

Management has approved a high-level statement requiring that sensitive data be encrypted at rest. A security manager must now specify the exact approved cipher suites that every system is required to use. Which type of document should carry that list?

  1. Guideline
  2. Standard Correct answer.
  3. Procedure
  4. Policy

Explanation

A standard is a mandatory, specific requirement that supports a policy, such as an approved algorithm list or configuration baseline. Policies state management intent at a high level, guidelines are recommended rather than mandatory, and procedures describe step-by-step task execution.

Question 30Access Controls

Which principle limits a user's access to only the resources required to complete assigned job duties?

  1. Mandatory access control
  2. Job rotation
  3. Least privilege Correct answer.
  4. Dual control

Explanation

Least privilege grants each identity the minimum set of rights needed for its current tasks and requires that those rights be reduced when duties change. It is a scope-of-access principle, not a mechanism for detecting fraud or enforcing labels.

Question 31Access Controls

In an access control decision, which of the following is the object?

  1. A user who authenticated with a smart card
  2. A process running on behalf of a user
  3. A file containing payroll records Correct answer.
  4. A program requesting a database connection

Explanation

Access control decisions involve a subject that requests access and an object that is the resource being accessed. Files, records, printers, and programs are typical objects, while users and the processes acting for them are subjects.

Question 32Access Controls

Which process confirms that a user is who they claim to be before any resource access is evaluated?

  1. Authorization
  2. Authentication Correct answer.
  3. Auditing
  4. Accounting

Explanation

Authentication validates a claimed identity using factors such as passwords, tokens, or biometrics. Only after identity is established can authorization determine what that identity is permitted to do.

Question 33Access Controls

Which access control model makes decisions by comparing security labels on objects against the clearance of the subject?

  1. Rule-based access control
  2. Mandatory access control Correct answer.
  3. Role-based access control
  4. Discretionary access control

Explanation

In mandatory access control, both subjects and objects carry labels, and the system enforces access by comparing them. Individuals cannot override the outcome, which distinguishes MAC from owner-discretion models.

Question 34Access Controls

Requiring two different employees to each approve a funds transfer is an example of which control?

  1. Implicit deny
  2. Need-to-know
  3. Separation of duties Correct answer.
  4. Least privilege

Explanation

Separation of duties splits a sensitive task into steps so that no single person can complete it alone, preventing fraud and undetected error. It differs from limiting the amount of access a person holds.

Question 35Access Controls

What does a default deny (implicit deny) rule mean in an access control system?

  1. Access is denied unless a rule explicitly permits it Correct answer.
  2. Access is granted unless a rule explicitly denies it
  3. Access is denied only after repeated failed logons
  4. Access is granted to every authenticated user automatically

Explanation

Implicit deny closes the system by default: any request not covered by an explicit allow rule is rejected. This prevents unanticipated access when no rule addresses a new resource.

Question 36Access Controls

Role-based access control grants permissions primarily according to which factor?

  1. The time of day and location of the request
  2. The job functions the user performs in the organization Correct answer.
  3. The object label compared with the user's clearance
  4. The user's ownership of each individual resource

Explanation

RBAC assigns permissions to roles and then assigns users to roles, so rights follow job function rather than the individual. This makes provisioning and review simpler when people change positions.

Question 37Access Controls

In an access control matrix, the column that corresponds to a single object is best described as which structure?

  1. A capability list
  2. An access control list Correct answer.
  3. An audit trail
  4. A role hierarchy

Explanation

Rows of an access control matrix represent subjects and columns represent objects. Reading down an object's column yields the subjects permitted to use it, which is exactly the content of an access control list.

Question 38Access Controls

A router filter that permits traffic only from a specified subnet is best classified as which type of access control?

  1. Discretionary access control
  2. Mandatory access control
  3. Rule-based access control Correct answer.
  4. Role-based access control

Explanation

Rule-based access control applies administrator-defined conditions, such as source address, protocol, or time window, to every request regardless of who the user is. The rule set itself, not identity or ownership, drives the decision.

Question 39Access Controls

Which model evaluates subject, resource, action, and environmental attributes together when making an access decision?

  1. Role-based access control
  2. Attribute-based access control Correct answer.
  3. Discretionary access control
  4. Mandatory access control

Explanation

Attribute-based access control writes policies over attributes of the requester, the resource, the requested action, and the context such as time or device posture. It is more granular than role membership alone.

Question 40Access Controls

Which set of properties must a reference monitor provide?

  1. It must be operated by an external identity provider
  2. It must be tamperproof, always invoked, and verifiable Correct answer.
  3. It must encrypt every object it mediates
  4. It must run in user mode on each endpoint

Explanation

A reference monitor is the abstract enforcement component that mediates every access, cannot be bypassed or altered by untrusted code, and is small enough to be rigorously tested. These properties are what make the enforcement trustworthy.

Question 41Access Controls

In the Clark-Wilson model, which rules require the system itself to enforce that constrained data items are changed only through approved transformation procedures?

  1. Certification rules
  2. Integrity verification procedures
  3. Enforcement rules Correct answer.
  4. Constrained data items

Explanation

Clark-Wilson separates certification rules, which state the integrity requirements a person must certify, from enforcement rules, which the system must mechanically apply. Enforcement rules force all modification of constrained data items to occur through validated transformation procedures.

Question 42Access Controls

The simple integrity property of the Biba model prevents a subject from doing which action?

  1. Writing to an object that has a higher integrity level
  2. Reading an object that has a higher integrity level
  3. Writing to an object that has a lower integrity level
  4. Reading an object that has a lower integrity level Correct answer.

Explanation

Biba's simple integrity property forbids reading downward, so a subject at a higher integrity level cannot be contaminated by lower-integrity data. The companion star integrity property handles writes by forbidding writing upward.

Question 43Access Controls

The star property of the Bell-LaPadula model prohibits which action?

  1. Writing to an object at a lower sensitivity level Correct answer.
  2. Accessing an object that carries no label
  3. Reading data above the subject's clearance
  4. Writing to an object at a higher sensitivity level

Explanation

The star property, also called the confinement property, forbids writing downward so that sensitive information cannot leak into less protected objects. Reading upward is governed separately by the simple security property.

Question 44Access Controls

In Kerberos, which component issues the ticket-granting ticket during initial authentication?

  1. The resource server that hosts the requested service
  2. The authentication service on each request for a resource
  3. The client workstation's local credential cache
  4. The key distribution center, after verifying the client's credentials Correct answer.

Explanation

The key distribution center combines the authentication service and the ticket-granting service. It validates the client's long-term credentials and returns a ticket-granting ticket that is later used to obtain service tickets.

Question 45Access Controls

Which statement correctly describes TACACS+?

  1. It encrypts the whole payload over TCP Correct answer.
  2. It works only with clients that are written for RADIUS
  3. It encrypts only the password field and runs over UDP
  4. It combines authentication and authorization into one service request

Explanation

TACACS+ encrypts the entire body of each packet and uses TCP, which suits it to device administration. It also separates authentication, authorization, and accounting into distinct functions rather than combining them.

Question 46Access Controls

Which standard carries authentication and authorization assertions from an identity provider to a service provider for web single sign-on?

  1. SAML Correct answer.
  2. Kerberos
  3. RADIUS
  4. CHAP

Explanation

SAML defines XML-based assertions that one trust domain sends to another so a user authenticated once can access federated services. Kerberos and RADIUS serve different purposes, and CHAP is only a challenge-response authentication method.

Question 47Access Controls

In a biometric system, the false acceptance rate expresses the probability that which event occurs?

  1. The sensor fails to capture a usable sample
  2. An unauthorized user is incorrectly accepted Correct answer.
  3. Two enrolled users share one template
  4. A legitimate user is incorrectly rejected

Explanation

False acceptance measures how often the system matches an impostor to an enrolled record, which is a security failure. False rejection measures how often a valid user is turned away, which is a usability failure.

Question 48Access Controls

An employee who has transferred between three departments still holds rights from every previous position. Which control most directly addresses this condition?

  1. Shortening idle session timeouts
  2. Increasing password complexity requirements
  3. Periodic entitlement reviews Correct answer.
  4. Requiring mandatory vacations

Explanation

Accumulated rights, sometimes called authorization creep, are removed only by regularly comparing each account's entitlements to current job needs and revoking the excess. Authentication hardening and session limits do not change stored permissions.

Question 49Access Controls

What is the primary purpose of giving each stored password hash a unique salt value?

  1. To increase the effective length of the password
  2. To satisfy password complexity policy requirements
  3. To make the hash reversible for verification
  4. To defeat precomputed rainbow table attacks Correct answer.

Explanation

A salt ensures that identical passwords produce different hashes, so an attacker cannot reuse a precomputed table of hashes. Salts must be stored alongside the hash but are not secret.

Question 50Access Controls

What is a recognized drawback of capability-based access control?

  1. It requires a central directory mapping every subject to a role
  2. Each subject must re-authenticate before every single access attempt
  3. Capabilities cannot be delegated to other processes
  4. Revoking access requires invalidating every issued capability Correct answer.

Explanation

A capability is a transferable token held by the subject, so the system cannot easily find every copy when access must be withdrawn. Revocation therefore requires tracking or expiring capabilities, which adds complexity.