Free Practice Questions for ISC2 Systems Security Certified Practitioner (SSCP) Certification

» ISC2 Code of Ethics » Organizational code of ethics

» Confidentiality » Integrity » Availability » Accountability » Non-repudiation » Least privilege » Separation of duties (SoD)

» Technical controls (e.g., firewalls, intrusion detection systems (IDS), access control list (ACL)) » Physical controls (e.g., mantraps, cameras, locks) » Administrative controls (e.g., security policies, standards, procedures, baselines) » Assessing compliance requirements » Periodic audit and review

» Deterrent controls » Preventative controls » Detective controls » Corrective controls » Compensating controls

» Process, planning, design and initiation » Development /Acquisition (e.g., DevSecOps, testing) » Inventory and licensing (e.g., open source, closed-source) » Implementation/Assessment » Operation/Maintenance/End of Life (EOL) » Archival and retention requirements » Disposal and destruction

» Change management (e.g., roles, responsibilities, processes, communications, audit) » Security impact analysis » Configuration management (CM)

Support and/or implement security awareness and training (e.g., social engineering/phishing/tabletop exercises/awareness communications)

Collaborate with physical security operations (e.g., data center/facility assessment, badging and visitor management, personal device restrictions)

» Single/Multi-factor authentication (MFA) » Single sign-on (SSO) (e.g., Active Directory Federation Services (ADFS), OpenID Connect) » Device authentication (e.g., certificate, Media Access Control (MAC) address, Trusted Platform Module (TPM)) » Federated access (e.g., Open Authorization 2 (OAuth2), Security Assertion Markup Language (SAML))

» Trust relationships (e.g., 1-way, 2-way, transitive, zero) » Internet, intranet, extranet, and demilitarized zone (DMZ) » Third-party connections (e.g., application programming interface (API), app extensions, middleware)

» Authorization » Proofing » Provisioning/De-provisioning » Monitoring, Reporting, and Maintenance (e.g., role changes, new security standards) » Entitlement (e.g., inherited rights, resources) » Identity and access management (IAM) systems

» Mandatory » Discretionary » Role-based (e.g., subject-based, object-based, Privileged Access Management (PAM)) » Rule-based » Attribute-based

» Risk visibility and reporting (e.g., risk register, sharing threat intelligence, indicators of Compromise (IOC), Common Vulnerability Scoring System (CVSS), socialization, MITRE/ATT&CK model) » Risk management concepts (e.g., impact assessments, threat modeling, scope) » Risk management frameworks (e.g., International Organization for Standardization (ISO), National Institute of Standards and Technology (NIST)) » Risk tolerance (e.g., appetite, risk quantification) » Risk treatment (e.g., accept, transfer, mitigate, avoid, ignore)

Understand legal and regulatory concerns (e.g., jurisdiction, limitations, privacy)

» Risk management frameworks implementation » Security testing » Risk review (e.g., internal, supplier, architecture) » Vulnerability management lifecycle (e.g., scanning, reporting, analysis, remediation)

» Source systems (e.g., applications, security appliances, network devices, hosts) » Events of interest (e.g., errors, omissions, anomalies, unauthorized changes, compliance violations, policy failures) » Log management (e.g., policy, integrity, preservation, architectures, configuration, aggregation, tuning) » Security information and event management (SIEM) (e.g., real-time monitoring, analysis, tracking, audit)

» Security baselines and anomalies (e.g., correlation, noise reduction) » Visualizations, metrics, and trends (e.g., notifications, dashboards, timelines) » Event data analysis » Document and communicate findings (e.g., escalation)

» Preparation (e.g., defining roles, training programs) » Detection, analysis, and escalation (e.g., incident communication, public relations) » Containment » Eradication » Recovery (e.g., incident documentation) » Post incident activities (e.g., lessons learned, new countermeasures, continuous improvement)

» Legal (e.g., civil, criminal, administrative) and ethical principles » Evidence handling (e.g., first responder, triage, chain of custody, preservation of scene) » Reporting of analysis » Organization Security Policy Compliance

» Emergency response plans and procedures (e.g., information systems contingency, pandemic, natural disaster, crisis management) » Interim or alternate processing strategies » Restoration planning (e.g., Restore Time Objective (RTO), Restore Point Objectives (RPO), Maximum Tolerable Downtime (MTD)) » Backup and redundancy implementation » Testing and drills (e.g., playbook, tabletop, disaster recovery exercises, scheduling)

» Confidentiality » Integrity and authenticity » Data sensitivity (e.g., personally identifiable information (PII), intellectual property (IP), protected health information (PHI)) » Regulatory and industry best practice (e.g., Payment Card Industry Data Security Standards (PCI-DSS), International Organization for Standardization (ISO)) » Cryptography entropy (e.g., quantum cryptography, quantum key distribution)

» Hashing » Salting » Symmetric/Asymmetric encryption/Elliptic curve cryptography (ECC) » Non-repudiation (e.g., digital signatures/certificates, Hash-based Message Authentication Code (HMAC), audit trails) » Strength of encryption algorithms and keys (e.g., Advanced Encryption Standards (AES), Rivest-Shamir-Adleman (RSA) » Cryptographic attacks and cryptanalysis

» Services and protocols (e.g., Internet Protocol Security (IPsec), Transport Layer Security (TLS), Secure/Multipurpose Internet Mail Extensions (S/MIME), DomainKeys Identified Mail (DKIM)) » Common use cases (e.g., credit card processing, file transfer, web client, virtual private network (VPN), transmission of PII data) » Limitations and vulnerabilities

» Fundamental key management concepts (e.g., storage, rotation, composition, generation, destruction, exchange, revocation, escrow) » Web of Trust (WOT) (e.g., Pretty Good Privacy (PGP), GNU Privacy Guard (GPG), blockchain)

» Open Systems Interconnection (OSI) and Transmission Control Protocol/Internet Protocol (TCP/IP) models » Network topologies » Network relationships (e.g., peer-to-peer (P2P), client server) » Transmission media types (e.g., wired, wireless) » Software-defined networking (SDN) (e.g., Software-Defined Wide Area Network SD-WAN), network virtualization, automation) » Commonly used ports and protocols

» Countermeasures (e.g., content delivery networks (CDN), firewalls, network access controls, intrusion detection and prevention systems (IDPS))

» Network access controls, standards and protocols (e.g., Institute of Electrical and Electronics Engineers (IEEE) 802.1X, Remote Authentication Dial-In User Service (RADIUS), Terminal Access Controller Access-Control System Plus (TACACS+)) » Remote access operation and configuration (e.g., thin client, virtual private network (VPN), virtual desktop infrastructure)

» Logical and physical placement of network devices (e.g., inline, passive, virtual) » Segmentation (e.g., physical/logical, data/control plane, virtual local area network (VLAN), access control list (ACL), firewall zones, micro-segmentation) » Secure device management

» Firewalls and proxies (e.g., filtering methods, web application firewall (WAF), cloud access security broker (CASB)) » Intrusion detection systems (IDS) and intrusion prevention systems (IPS) » Routers and switches » Traffic-shaping devices (e.g., wide area network (WAN) optimization, load balancing) » Network Access Control (NAC) » Data Loss Prevention (DLP) » Unified Threat Management (UTM)

» Technologies (e.g., cellular network, Wi-Fi, Bluetooth, Near-Field Communication (NFC)) » Authentication and encryption protocols (e.g., Wi-Fi Protected Access (WPA), Extensible Authentication Protocol (EAP), Wi-Fi Protected Access 2 (WPA2), Wi-Fi Protected Access 3 (WPA3))

Secure and monitor Internet of Things (IoT) (e.g., configuration, network isolation, firmware updates, End of Life (EOL) management)

» Malware (e.g., rootkits, spyware, scareware, ransomware, trojans, virus, worms, trapdoors, backdoors, fileless, app/code/operating system (OS)/mobile code vulnerabilities) » Malware countermeasures (e.g., scanners, anti-malware, containment and remediation, software security) » Types of malicious activity (e.g., insider threat, data theft, distributed denial of service (DDoS), botnet, zero-day exploits, web-based attacks, advanced persistent threat (APT)) » Malicious activity countermeasures (e.g., user awareness/training, system hardening, patching, isolation, data loss prevention (DLP)) » Social engineering methods (e.g., SPAM email, phishing/smishing/vishing, impersonation, scarcity, whaling) » Behavior analytics (e.g., machine learning, Artificial Intelligence (AI), data analytics)

» Host-based intrusion prevention system (HIPS) » Host-based intrusion detection system (HIDS) » Host-based firewalls » Application whitelisting » Endpoint encryption (e.g., full disk encryption) » Trusted Platform Module (TPM) (e.g., hardware security module management) » Secure browsing (e.g., digital certificates)

Endpoint detection and response (EDR)

» Deployment models (e.g., public, private, hybrid, community) » Service models (e.g., Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS)) » Virtualization (e.g., hypervisor, Virtual Private Cloud (VPC)) » Legal and regulatory concerns (e.g., privacy, surveillance, data ownership, jurisdiction, eDiscovery, shadow information technology (IT)) » Third-party/Outsourcing requirements (e.g., service-level agreement (SLA), data portability/privacy/destruction/auditing) » Shared responsibility model » Data storage, processing, and transmission (e.g., archiving, backup, recovery, resilience)

» Provisioning techniques (e.g., corporate owned, personally enabled (COPE), Bring Your Own Device (BYOD), Mobile Device Management (MDM)) » Containerization » Encryption » Mobile application management » Hypervisor (i.e., Type 1 (e.g., bare metal), Type 2 (e.g., software)) » Virtual appliances » Containers » Continuity and resilience » Storage management (e.g., data domain) » Threats, attacks, and countermeasures (e.g., brute-force attack, virtual machine escape, threat hunting)