View Full ISC SSCP Exam Dumps and Practice Test Dumps.

 

Question 1

An organization wants to ensure that employees can access only the information required for their assigned duties. Which security principle should be applied?

1. Separation of duties
2. Least privilege
3. Defense in depth
4. Open access

Correct Answer: 2

Explanation

The principle of least privilege ensures that users receive only the permissions necessary to perform their assigned responsibilities. Applying this principle reduces the potential impact of compromised accounts, accidental misuse, and unauthorized access. Security administrators should regularly review permissions, remove unnecessary privileges, and adjust access when employees change roles. Least privilege applies to users, applications, service accounts, and administrative functions. Although separation of duties and defense in depth also strengthen security, they address different objectives. Least privilege specifically limits the scope of access granted to each identity, helping organizations reduce their overall exposure to security incidents.

Question 2

A security administrator needs to confirm that a user’s identity is genuine before granting access to a corporate system. Which security function performs this verification?

1. Authorization
2. Accounting
3. Authentication
4. Auditing

Correct Answer: 3

Explanation

Authentication verifies the identity of a user, device, or service before access is granted. It commonly relies on credentials such as passwords, cryptographic keys, biometric characteristics, or multifactor authentication methods. Authentication is distinct from authorization, which determines what an authenticated identity is permitted to do. Accounting and auditing record or review activities rather than directly establishing identity. Organizations should select authentication mechanisms appropriate to the sensitivity of their systems and information. Strong authentication, particularly multifactor authentication for privileged or remote access, helps reduce the risk of unauthorized entry resulting from stolen or guessed credentials.

Question 3

A company wants to prevent a single employee from initiating, approving, and completing a sensitive financial transaction. Which control should be implemented?

1. Separation of duties
2. Data masking
3. Network segmentation
4. Single sign-on

Correct Answer: 1

Explanation

Separation of duties divides sensitive responsibilities among different individuals or roles so that one person cannot independently complete an entire critical process. In financial operations, one employee might initiate a transaction while another reviews or approves it. This arrangement reduces opportunities for fraud, unauthorized changes, and undetected errors. The organization should define responsibilities clearly, enforce approval workflows, and retain audit records of each action. Data masking protects information visibility, network segmentation separates network zones, and single sign-on simplifies authentication. None of these directly addresses the concentration of critical duties in one individual.

Question 4

A security team needs to protect confidential files stored on laptops in case the devices are lost or stolen. Which control is most appropriate?

1. Screen timeout
2. Network firewall
3. Intrusion detection
4. Full-disk encryption

Correct Answer: 4

Explanation

Full-disk encryption protects information stored on a laptop by encrypting the contents of its storage device. If the device is lost or stolen, an unauthorized person who cannot satisfy the required authentication or recovery conditions should be unable to read the protected data directly from the disk. Organizations should manage encryption keys securely, enforce strong device authentication, and verify that encryption is enabled on all applicable endpoints. Screen timeouts and firewalls provide useful complementary protections, but they do not encrypt stored files. Intrusion detection monitors suspicious activity and does not independently protect data at rest.

Question 5

An organization wants to identify weaknesses in its network before attackers exploit them. Which activity systematically examines systems for known security vulnerabilities?

1. Business impact analysis
2. Vulnerability assessment
3. Disaster recovery testing
4. Security awareness training

Correct Answer: 2

Explanation

A vulnerability assessment systematically identifies and evaluates known weaknesses in systems, applications, network devices, and configurations. It may use automated scanning tools, configuration reviews, and manual validation to identify outdated software, insecure settings, missing patches, or exposed services. Findings should be prioritized according to factors such as severity, exposure, exploitability, and business impact. A vulnerability assessment is not identical to a penetration test, which attempts to demonstrate how weaknesses can be exploited within an authorized scope. Business impact analysis, recovery testing, and awareness training serve different security and continuity objectives.

Question 6

A company wants to maintain essential business operations after a major disruption to its primary data center. Which plan primarily addresses restoring technology services and infrastructure?

1. Disaster recovery plan
2. Acceptable use policy
3. Data classification policy
4. Security awareness plan

Correct Answer: 1

Explanation

A disaster recovery plan defines how an organization restores critical technology services, systems, data, and infrastructure after a major disruption. It typically identifies recovery responsibilities, alternate processing arrangements, backup requirements, communication procedures, and restoration priorities. Recovery time objectives and recovery point objectives help establish the expected restoration timeframe and acceptable data loss. A disaster recovery plan should be tested periodically to verify that documented procedures are practical and that dependencies are understood. Acceptable use, data classification, and awareness policies are important governance controls, but they do not provide the detailed technology restoration procedures required after a disaster.

Question 7

A security analyst receives an alert indicating repeated unsuccessful login attempts against a privileged account. What should the analyst do first?

1. Delete the account immediately
2. Disable all authentication services
3. Investigate the alert and verify the associated activity
4. Ignore the alert unless a user complains

Correct Answer: 3

Explanation

The analyst should investigate the alert and verify the associated activity before deciding on an appropriate response. Repeated unsuccessful login attempts may indicate password guessing, credential stuffing, a misconfigured application, or a legitimate user experiencing access problems. Relevant evidence includes timestamps, source addresses, targeted accounts, authentication logs, and related security events. If the activity indicates an active threat, the analyst should follow the incident response process and apply proportionate containment measures. Immediately deleting an account or disabling all authentication services could disrupt business operations without resolving the underlying cause. Ignoring the alert would leave a potentially serious threat unexamined.

Question 8

An organization wants to ensure that sensitive information is disclosed only to individuals with a legitimate business need. Which information security objective does this support?

1. Availability
2. Confidentiality
3. Integrity
4. Nonrepudiation

Correct Answer: 2

Explanation

Confidentiality ensures that information is accessible only to authorized individuals, systems, or processes. Organizations support confidentiality through access controls, encryption, data classification, secure handling procedures, and appropriate employee training. The required safeguards depend on the sensitivity of the information and the potential consequences of unauthorized disclosure. Availability concerns timely access to information and services, while integrity protects information against unauthorized or improper modification. Nonrepudiation provides evidence that an action or transaction occurred and can be attributed to a particular party. Confidentiality is the objective most directly associated with preventing unauthorized disclosure of sensitive information.

Question 9

A company discovers that several servers are running outdated operating systems with publicly documented vulnerabilities. Which activity should be prioritized to reduce this exposure?

1. Apply appropriate security patches after testing
2. Increase the number of user accounts
3. Disable audit logging
4. Remove the organization’s incident response plan

Correct Answer: 1

Explanation

Applying appropriate security patches after testing is a key vulnerability remediation activity. Updates can correct known flaws that attackers may otherwise exploit to compromise systems, escalate privileges, or disrupt services. Before deployment, organizations should assess patch applicability, operational dependencies, compatibility, and potential service impact. Critical systems may require staged updates, maintenance windows, or compensating controls when immediate patching is not feasible. Increasing user accounts and disabling audit logging do not remediate software vulnerabilities, while removing incident response procedures would weaken preparedness. A managed patch process should also verify successful installation and track systems that remain exposed.

Question 10

A security team needs to determine which business processes would be most affected if a critical application became unavailable. Which assessment should it conduct?

1. Penetration test
2. Password audit
3. Business impact analysis
4. Configuration baseline review

Correct Answer: 3

Explanation

A business impact analysis identifies the consequences of disruptions to business processes and the resources they depend on. It helps determine critical activities, operational impacts, recovery priorities, and acceptable periods of interruption. The analysis may consider financial losses, regulatory obligations, customer effects, dependencies, and reputational consequences. Its findings inform business continuity and disaster recovery planning, including recovery time objectives and recovery point objectives. A penetration test evaluates security weaknesses, a password audit reviews credential practices, and a configuration baseline review checks system settings. These activities may support resilience, but they do not replace a business impact analysis.

Question 11

A company wants to prevent malware on one internal network segment from easily spreading to sensitive servers on another segment. Which architectural control is most suitable?

1. Data compression
2. Network segmentation
3. Password expiration
4. File deduplication

Correct Answer: 2

Explanation

Network segmentation divides a network into separate zones and applies controls to regulate communication between them. By isolating sensitive servers from general user networks, an organization can limit unnecessary connectivity and reduce opportunities for malware or attackers to move laterally. Segmentation may be implemented through firewalls, virtual networks, access control lists, and other traffic enforcement mechanisms. Rules should permit only required communications and should be reviewed as business needs change. Data compression and file deduplication improve storage or transmission efficiency, while password expiration is an identity-related control. These measures do not provide the same network isolation function.

Question 12

An organization wants to determine whether its employees understand how to recognize phishing messages and report suspicious activity. Which security program should be evaluated?

1. Database normalization
2. Hardware lifecycle management
3. Network address planning
4. Security awareness training

Correct Answer: 4

Explanation

Security awareness training educates employees about common threats, safe handling of information, and their responsibilities in protecting organizational resources. Phishing awareness should explain warning signs such as unexpected attachments, suspicious links, unusual requests, and attempts to create urgency. Employees should also know how to report suspected messages through approved channels. Organizations can evaluate training through knowledge checks, simulations, reporting metrics, and follow-up education. Database normalization, hardware lifecycle management, and network address planning serve technical or operational purposes, but they do not directly establish employee readiness to identify and report social engineering attempts.

Question 13

A security administrator wants to ensure that users cannot alter audit records to conceal their own activities. Which safeguard is most appropriate?

1. Restrict and separate access to audit logs
2. Allow all employees to edit logs
3. Store logs only on user workstations
4. Disable log integrity monitoring

Correct Answer: 1

Explanation

Restricting and separating access to audit logs helps prevent users from altering records of their own activities. Log management should ensure that only authorized personnel or services can administer logging systems, while ordinary users have no ability to modify or delete relevant records. Centralized collection, access monitoring, retention controls, and integrity protections can further strengthen the reliability of audit evidence. Allowing broad editing rights or storing logs only on user-controlled workstations creates opportunities for tampering or loss. Disabling integrity monitoring would reduce the organization’s ability to detect unauthorized changes to important security records.

Question 14

A company needs to verify that a backup can actually restore a critical database to a usable state. Which procedure provides this evidence?

1. Review the backup filename
2. Check the storage device’s color label
3. Perform a restoration test
4. Increase the database user count

Correct Answer: 3

Explanation

A restoration test verifies whether backup data can be recovered and used to restore the required system or information. A backup job reporting success does not necessarily prove that the resulting data is complete, consistent, or recoverable. Testing should follow documented procedures and assess restoration time, data integrity, application functionality, and dependencies. Organizations should conduct tests periodically and after significant changes to backup infrastructure or recovery procedures. Reviewing filenames or storage labels offers limited evidence of recoverability, while increasing database users is unrelated. Restoration testing helps identify problems before an actual outage makes recovery essential.

Question 15

A security team is selecting controls for a system that processes highly sensitive customer information. Which approach best supports a risk-based decision?

1. Choose controls solely because they are inexpensive
2. Identify threats, vulnerabilities, likelihood, and potential impact
3. Apply identical controls regardless of system purpose
4. Avoid documenting security decisions

Correct Answer: 2

Explanation

A risk-based approach begins by identifying relevant threats, vulnerabilities, likelihood, and potential impact. This enables the organization to select safeguards that address the system’s actual exposure and the consequences of compromise. The assessment should consider business requirements, legal obligations, data sensitivity, existing controls, and the cost and effectiveness of potential treatments. Inexpensive controls may be appropriate in some situations, but cost alone does not establish whether risk is adequately managed. Applying identical safeguards to every system can overlook important differences. Documenting decisions supports accountability, review, and future reassessment as risks change.

Question 16

A company wants to ensure that an employee who administers user accounts cannot independently approve their own elevated access request. Which control is most directly applicable?

1. Data encryption
2. Network monitoring
3. File integrity checking
4. Separation of duties with an independent approval process

Correct Answer: 4

Explanation

Separation of duties with an independent approval process prevents one individual from controlling both the request and approval of sensitive access. An employee who administers accounts may be able to implement permissions, but an independent authorized reviewer should approve elevated access based on documented business need. The organization should retain records of requests, approvals, implementation, and periodic access reviews. Encryption protects information, network monitoring observes traffic, and file integrity checking detects unauthorized changes. Those controls can support security overall, but they do not directly prevent an administrator from approving their own privilege escalation.

Question 17

A security analyst must preserve evidence from a suspected compromised workstation for a formal investigation. Which practice is essential?

1. Maintain evidence integrity and document chain of custody
2. Reinstall the operating system immediately
3. Allow multiple users to modify the evidence
4. Delete suspicious files before recording them

Correct Answer: 1

Explanation

Maintaining evidence integrity and documenting chain of custody are essential when preserving material for a formal security investigation. The organization should record who collected, handled, transferred, stored, and examined the evidence, along with relevant dates and times. Appropriate forensic procedures should be used to minimize changes to the original device or data. Evidence should be stored securely, and access should be restricted to authorized personnel. Reinstalling the operating system or deleting suspicious files can destroy valuable information, while allowing uncontrolled modification undermines reliability. Proper evidence handling supports repeatable analysis and helps establish the credibility of investigative findings.

Question 18

An organization wants to ensure that a critical security control continues to operate as intended after system changes. Which activity provides ongoing verification?

1. Rename the system
2. Conduct periodic control testing and monitoring
3. Remove the control documentation
4. Disable security alerts

Correct Answer: 2

Explanation

Periodic control testing and monitoring help verify that a security control remains effective as systems, threats, and business requirements change. Testing can confirm that the control is configured correctly, performs its intended function, and produces appropriate evidence. Continuous or scheduled monitoring can identify failures, configuration drift, or unusual behavior between formal assessments. The frequency and depth of verification should reflect the control’s importance and associated risk. Renaming systems, removing documentation, or disabling alerts does not demonstrate control effectiveness. Results should be documented, and identified deficiencies should be assigned for remediation and follow-up validation.

Question 19

A company wants to reduce the risk that a stolen password alone will allow an attacker to access a privileged account. Which safeguard should be implemented?

1. Shared administrator passwords
2. Longer session timeout only
3. Multifactor authentication
4. Publicly displaying account names

Correct Answer: 3

Explanation

Multifactor authentication requires users to provide more than one type of authentication evidence, reducing reliance on a password alone. For privileged accounts, it can help limit the impact of stolen, reused, or guessed passwords. Factors may include something the user knows, possesses, or is, such as a password combined with a hardware security key or an approved authenticator method. Organizations should select methods appropriate to the risk and protect recovery procedures from becoming a weaker alternative. Shared passwords and public account-name disclosure can increase exposure, while session timeouts do not independently provide a second authentication factor.

Question 20

A security manager is reviewing an incident response capability and wants to confirm that teams understand their roles during a major security event. Which activity is most useful?

1. Change workstation wallpaper
2. Remove incident contact information
3. Suspend all security reporting
4. Conduct an incident response exercise

Correct Answer: 4

Explanation

An incident response exercise allows teams to practice their responsibilities, communication procedures, decision-making, and coordination during a simulated security event. Exercises can reveal unclear authority, missing contacts, procedural gaps, and dependencies that may not be apparent from reviewing documentation alone. Scenarios should reflect plausible threats and the organization’s operational context. Lessons learned should be recorded, assigned to responsible owners, and incorporated into updated procedures and training. Changing wallpaper, removing contact information, or suspending reporting would undermine preparedness. Regular exercises help maintain response readiness and provide evidence that the incident response process is understood and usable.