Most SSCP practice questions you find free online are recycled CISSP items with the hard parts removed, and they teach you the wrong reflex. The SSCP is a practitioner exam. It asks what you would do at the console on a Tuesday afternoon, not how you would brief a board. The twenty SSCP practice questions below are written to the current ISC2 exam outline and spread across the seven domains in roughly their real proportions, so a weak run tells you something useful about where to spend your next fortnight.
Work through them closed-book and write your answers down before you read the explanations. The explanations matter more than the score, because each one says why the three wrong options are wrong. That is the skill the exam actually tests.
How to use these SSCP practice questions
Do not treat this as a mock exam. Twenty items cannot predict a 100 to 125 item adaptive exam, and a score out of twenty has a wide margin of error either way.
Treat it as a diagnostic instead:
- Answer all twenty in one sitting, timed at 24 minutes. That is the same per-item pace as the real exam.
- Mark each answer right or wrong, and note the domain.
- Any domain where you missed a question is a domain to revise, even if you got the other two right.
- Re-attempt the ones you guessed correctly. A lucky guess is a gap.
The last step catches the failure mode that sinks most first attempts. Candidates who revise only what they got wrong keep the questions they half-knew, and half-knowing is exactly what an adaptive exam is built to find.
What the SSCP exam looks like in 2026
The SSCP moved from a linear exam to Computerised Adaptive Testing (CAT) on 1 October 2025, which changes how you should read your practice results.
| Element | Current specification |
|---|---|
| Format | Computerised Adaptive Testing (CAT) |
| Items | 100 to 125 |
| Time limit | 2 hours |
| Item types | Multiple choice and advanced item types |
| Result | Pass or fail, no scaled score |
| Languages | English, Japanese, Spanish |
| Delivery | Pearson VUE test centre |
| Exam fee | 249 USD |
| Experience required | 1 year full-time in one or more of the seven domains |
Exam Tip: ISC2 no longer issues a numerical score for the SSCP. Older guides still quote 700 out of 1000 as the pass mark, which was the linear-exam figure. Under CAT the exam ends as soon as your ability estimate sits clear of the pass point with 95% statistical confidence, so a short exam is a decisive one in either direction.
Two rules catch people out. If the confidence rule has not ended your exam by item 125, ISC2 compares your final ability estimate against the standard and that is your result. And if you run out of time without answering 75 operational items and 25 pretest items, you fail automatically regardless of how well you were doing.
The seven domains and their weightings drive how many questions you see from each area:
| Domain | Weighting |
|---|---|
| 1. Security Concepts and Practices | 16% |
| 2. Access Controls | 15% |
| 3. Risk Identification, Monitoring and Analysis | 15% |
| 4. Incident Response and Recovery | 14% |
| 5. Cryptography | 9% |
| 6. Network and Communications Security | 16% |
| 7. Systems and Application Security | 15% |
Note that Domain 1 was renamed from Security Operations and Administration to Security Concepts and Practices with effect from 15 September 2024. Study material published before that date labels it the old way, and some of it still tests the old content mix.
SSCP practice questions: Domain 1, Security Concepts and Practices
1. A payroll clerk's role grants read access to the payroll database. She opens the records of employees in a region she has no involvement with. Which principle has been breached?
- A. Least privilege
- B. Need to know
- C. Separation of duties
- D. Mandatory vacation
Answer: B, need to know. Her role legitimately includes payroll read access, so least privilege is intact at the permission level. Need to know narrows that further to the specific records required for the task in hand, which is the control she bypassed. Separation of duties would be at issue only if she could also approve payments, and mandatory vacation is a fraud-detection control unrelated to record access.
2. Which of the following is the primary purpose of a configuration baseline?
- A. To record who approved each change
- B. To provide a known-good state that deviations can be measured against
- C. To prioritise patches by CVSS score
- D. To document the business owner of each asset
Answer: B. A baseline is the reference point. Without one you can detect that a host has 412 registry differences from its peers but cannot say which of them are wrong. Option A describes the change record, option C is vulnerability management and option D belongs in the asset inventory.
3. Under the ISC2 Code of Ethics, an SSCP discovers that an employer is quietly ignoring a regulatory reporting duty. Which canon takes precedence in resolving the conflict?
- A. Act honourably, honestly, justly, responsibly and legally
- B. Provide diligent and competent service to principals
- C. Protect society, the common good, necessary public trust and confidence, and the infrastructure
- D. Advance and protect the profession
Answer: C. The four canons are applied in the order they are written, and protecting society sits first. Duty to your employer, the principal in canon two, ranks below it. Candidates who pick B are reading the canons as a list of equal obligations rather than a priority order, and ISC2 tests that ordering directly.
SSCP practice questions: Domain 2, Access Controls
4. A defence contractor labels documents Secret and Top Secret. Users hold clearances, and the system prevents any user from granting access to a document, even one they created. Which access control model is in use?
- A. Discretionary access control
- B. Role-based access control
- C. Mandatory access control
- D. Attribute-based access control
Answer: C. The giveaway is that the owner cannot grant access. Under MAC the system enforces clearance against classification and the creator has no discretion. DAC is the opposite, the owner decides. RBAC groups permissions by job function without labels, and ABAC evaluates a policy over attributes such as device posture or time of day.
5. A user signs in to their corporate identity provider once and then reaches three third-party SaaS applications without re-entering credentials. Which protocol is most likely carrying the authentication assertion?
- A. RADIUS
- B. SAML
- C. OAuth 2.0
- D. Kerberos
Answer: B, SAML. SAML carries authentication assertions between an identity provider and service providers, which is the classic web single sign-on pattern. OAuth 2.0 is an authorisation framework that issues access tokens for resources and does not by itself authenticate a user. RADIUS handles network access authentication, and Kerberos is a ticket-based protocol used inside a realm rather than across the public internet.
6. Which combination represents genuine two-factor authentication?
- A. A password and the answer to a security question
- B. A fingerprint and a retina scan
- C. A smart card and a PIN
- D. A one-time code by SMS and a one-time code from an app
Answer: C. Two-factor requires two different categories: something you know, something you have, something you are. A smart card is a possession factor and a PIN is a knowledge factor. Options A, B and D each pair two items from the same category, which is multi-instance rather than multi-factor.
SSCP practice questions: Domain 3, Risk Identification, Monitoring and Analysis
7. A server is valued at 80,000 USD. A flood would destroy 25% of its value, and the site floods on average once every ten years. What is the annualised loss expectancy?
- A. 200 USD
- B. 2,000 USD
- C. 20,000 USD
- D. 80,000 USD
Answer: B, 2,000 USD. Single loss expectancy is asset value multiplied by exposure factor, so 80,000 x 0.25 = 20,000. Annualised loss expectancy is SLE multiplied by the annual rate of occurrence, so 20,000 x 0.1 = 2,000. Option C is the trap: it is the SLE, and candidates who stop one step early pick it.
8. An uncredentialed scan of a Linux fleet reports 40 missing patches. A credentialed scan of the same hosts reports 6. What is the most likely explanation?
- A. The credentialed scan is misconfigured
- B. The uncredentialed scan inferred versions from banners and produced false positives
- C. The hosts were patched between the two scans
- D. The uncredentialed scan found vulnerabilities the credentialed scan cannot see
Answer: B. Without credentials a scanner has to guess at installed versions from service banners and response fingerprints, and backported vendor patches leave the banner unchanged. The credentialed scan queries the package manager directly and is the more reliable of the two. This is the single most common source of false positives in a vulnerability report.
9. An organisation buys cyber insurance to cover the cost of a breach it has decided it cannot cost-effectively prevent. Which risk treatment is this?
- A. Avoidance
- B. Mitigation
- C. Transfer
- D. Acceptance
Answer: C, transfer. Insurance shifts the financial consequence to a third party. Avoidance would mean stopping the activity altogether, mitigation would mean adding controls to reduce likelihood or impact, and acceptance would mean carrying the loss with no offsetting arrangement. Note that transfer moves the cost, not the responsibility.
SSCP practice questions: Domain 4, Incident Response and Recovery
10. You are collecting evidence from a compromised host that is still powered on. Following the order of volatility, which source do you capture first?
- A. The contents of RAM
- B. CPU registers and cache
- C. Routing tables and ARP cache
- D. The disk image
Answer: B. Order of volatility runs from the most fleeting to the most persistent: registers and cache, then memory, then network state such as ARP and routing tables, then temporary files, then disk, then archival media. Registers and cache survive for microseconds, so they go first even though the practical yield is small. RAM is second, and it is where most candidates wrongly start.
11. A business states that it can tolerate losing at most 15 minutes of transactions, and that the service must be back within 4 hours. Which values are these?
- A. RTO 15 minutes, RPO 4 hours
- B. RPO 15 minutes, RTO 4 hours
- C. MTD 15 minutes, RTO 4 hours
- D. RPO 15 minutes, MTBF 4 hours
Answer: B. Recovery point objective is the tolerable amount of data loss, measured backwards from the incident, so 15 minutes of transactions is the RPO. Recovery time objective is how long restoration may take, so 4 hours is the RTO. RPO drives backup and replication frequency, RTO drives the recovery architecture, and mixing them up produces a design that fails one requirement while overspending on the other.
12. Ransomware is encrypting files on three servers on a flat network. What is the correct immediate action?
- A. Rebuild the affected servers from known-good images
- B. Isolate the affected servers from the network
- C. Identify the ransomware family and its encryption method
- D. Notify the regulator
Answer: B, isolate. Containment precedes eradication and recovery, and on a flat network every minute of connectivity extends the blast radius. Rebuilding first destroys the evidence you need and does nothing to stop lateral spread. Identification and notification both matter, but neither stops the encryption in progress.
SSCP practice questions: Domain 5, Cryptography
13. A supplier signs a purchase order with their private key. Which security service does the signature provide that a shared-key message authentication code cannot?
- A. Integrity
- B. Confidentiality
- C. Non-repudiation
- D. Availability
Answer: C, non-repudiation. A MAC gives integrity and origin authentication, but both parties hold the same key, so either could have produced the tag and neither can prove otherwise. Only the signer holds the private key behind a digital signature, so the supplier cannot credibly deny it. Note that a signature provides no confidentiality at all: the order is still readable by anyone.
14. A TLS connection is configured to use ephemeral Diffie-Hellman key exchange. What is the specific benefit?
- A. The handshake completes in fewer round trips
- B. Recorded traffic stays protected even if the server's private key is later compromised
- C. The session key is longer than with RSA key transport
- D. Certificate validation becomes unnecessary
Answer: B. This is perfect forward secrecy. Ephemeral exchange derives a fresh session key that is never transmitted and is discarded afterwards, so an attacker who steals the long-term private key years later cannot decrypt captured sessions. With RSA key transport the private key unlocks every recorded session, which is why static RSA key exchange was removed from TLS 1.3.
SSCP practice questions: Domain 6, Network and Communications Security
15. In an 802.1X deployment, which device acts as the authenticator?
- A. The laptop requesting access
- B. The access switch or wireless controller
- C. The RADIUS server
- D. The directory service holding the user accounts
Answer: B. The three roles are supplicant, authenticator and authentication server. The supplicant is the endpoint, the authenticator is the network device that gates the port and relays EAP messages, and the authentication server is typically RADIUS. Candidates often name the RADIUS server as the authenticator because it makes the decision, but its role name is authentication server.
16. WPA3-Personal replaces the WPA2 four-way handshake with Simultaneous Authentication of Equals. Which weakness does this specifically address?
- A. Weak RC4 encryption
- B. Offline dictionary attacks against a captured handshake
- C. Rogue access points advertising a legitimate SSID
- D. Deauthentication flooding
Answer: B. WPA2-PSK lets an attacker capture the handshake and grind passphrases offline at whatever rate their hardware allows. SAE is a password-authenticated key exchange, so a captured exchange yields nothing to grind against and every guess costs a live interaction. RC4 belongs to WEP and early TKIP, and rogue APs and deauthentication are addressed by other mechanisms such as PMF.
17. Where should a public-facing web server be placed in a screened subnet design?
- A. On the internal LAN with port 443 forwarded to it
- B. In the screened subnet, with the database it queries on the internal LAN
- C. In the screened subnet alongside its database server
- D. Outside the perimeter firewall
Answer: B. The web server needs inbound access from the internet, so it belongs in the screened subnet where a compromise is contained. Its database holds the data worth stealing and has no reason to accept internet traffic, so it stays internal and accepts only a tightly filtered connection from the web tier. Option C is the common real-world mistake, and it hands an attacker the database the moment the web server falls.
SSCP practice questions: Domain 7, Systems and Application Security
18. An analyst finds no malicious files on disk, but PowerShell is spawning from a Word process and pulling an encoded payload straight into memory. What is this best described as?
- A. A rootkit
- B. A logic bomb
- C. A fileless attack using living-off-the-land binaries
- D. A polymorphic virus
Answer: C. Nothing is written to disk and the attacker is using a signed, expected interpreter that is already present, which is what living off the land means. A rootkit hides at or below the operating system, a logic bomb waits for a trigger condition, and a polymorphic virus rewrites its own code between infections but still exists as a file.
19. Which control most directly prevents SQL injection?
- A. A web application firewall
- B. Parameterised queries with bound variables
- C. Removing detailed error messages from responses
- D. Encrypting the database at rest
Answer: B. Parameterised queries separate code from data, so input can never be parsed as SQL no matter what it contains. A WAF filters known patterns and is a useful compensating control, but it is pattern matching and it can be evaded. Suppressing error detail slows an attacker down without closing the hole, and encryption at rest protects stolen files rather than a live query path.
20. Two workloads must be isolated so that a kernel-level exploit in one cannot reach the other. Which option provides the stronger boundary?
- A. Two containers on the same host, each with its own namespace
- B. Two virtual machines on a type 1 hypervisor
- C. Two containers with seccomp profiles and dropped capabilities
- D. Two processes running under different service accounts
Answer: B. Containers share the host kernel, so a kernel exploit crosses namespace boundaries however carefully the profiles are written. Each virtual machine runs its own kernel, and the hypervisor boundary is the stronger control. Options A, C and D all reduce the attack surface, and C is genuinely good practice, but none of them survive a kernel compromise.
What your score on these SSCP practice questions actually tells you
Because the real exam is adaptive and pass or fail, there is no percentage to aim for. Use the pattern instead of the total:
| Result | What to do next |
|---|---|
| 17 to 20 correct, no domain missed twice | Move to full-length practice exams and work on pace |
| 13 to 16 correct | Revise the specific domains you missed, then re-test |
| 9 to 12 correct | You have content gaps, not exam-technique gaps. Go back to the material domain by domain |
| 8 or fewer | Do not book the exam yet. Work through the outline in order before testing again |
One more thing worth knowing: ISC2 does not publish an SSCP pass rate. Any figure you see quoted online is somebody's estimate, usually from a training provider with a reason to make the exam sound harder or easier than it is. Judge your readiness on consistent performance across all seven domains rather than on a number nobody can verify.
If you want considerably more than twenty items, the ISC2 SSCP course on CertCrush drills the full domain set with explanations in this format and tracks which domains you keep missing.
Frequently Asked Questions
How hard is the SSCP exam?
It is a practitioner-level exam, so the difficulty is breadth rather than depth. Seven domains span access control, cryptography, networking, incident response and application security, and the questions are scenario-based rather than definitional. Candidates who already work a security operations or system administration job usually find the content familiar and the phrasing the harder part.
Is the SSCP harder than the CISSP?
No. The CISSP requires five years of experience across two domains, runs to 3 hours and 100 to 150 items, and is pitched at a manager who has to weigh options. The SSCP requires one year and asks what a practitioner should do at the keyboard. If you are choosing between them, see our CISSP 12-week study plan for a sense of the step up.
What is the pass rate for the SSCP exam?
ISC2 does not publish pass rates for the SSCP or any of its other certifications. Figures circulating on forums and training sites are estimates with no official basis, so treat them as marketing rather than data.
Is the SSCP worth getting?
It carries real weight for SOC analyst, system administrator and network security roles, and it is the natural ISC2 credential for someone with a year or two of hands-on experience who is not yet eligible for the CISSP. Our full breakdown of the SSCP domains, cost and career value goes through the salary and eligibility detail.
How many CPE credits does the SSCP need?
Sixty CPE credits over a three-year cycle, which works out at about twenty a year, plus the 135 USD annual maintenance fee. If you passed the exam without the required year of experience you hold Associate of ISC2 status instead, which needs fifteen Group A credits every year and gives you two years to earn the experience.
Ready to Start Practising?
Twenty questions will show you which domain is weakest. Fixing it takes volume, and specifically volume with explanations, because the SSCP punishes recognition memory and rewards knowing why the other three options fail.
CertCrush runs the full ISC2 SSCP question bank with domain-level tracking, so you can see your Cryptography accuracy separately from your Access Controls accuracy and stop revising what you already know.
Create a free CertCrush account and start on the SSCP bank, or browse the ISC2 SSCP course to see what is covered.