A company's code of ethics requires employees to report any suspected violations. A security analyst suspects that a manager is involved in fraudulent activities but has no concrete evidence. The analyst is worried about retaliation if the report is unfounded. What should the analyst do?

Confront the manager directly with the suspicion

Wait until there is concrete evidence before reporting

Report the suspicion through the appropriate internal channel, such as an ethics hotline

Ignore the suspicion because there is no concrete evidence

A security professional is asked by their supervisor to provide a false statement in a report to a client about the security posture of a system. The professional knows the statement is inaccurate and could mislead the client. According to the ISC2 Code of Ethics, what should the professional do?

Provide the statement as requested because the supervisor has authority

Provide the statement but add a footnote indicating it is not fully accurate

Quit the job to avoid having to make the false statement

Refuse to provide the false statement and report the issue to the appropriate authority

According to the ISC2 Code of Ethics, an SSCP professional who discovers a vulnerability in a client's system should:

Report the vulnerability to the client and assist in mitigating it.

Disclose the vulnerability publicly to warn other organizations.

Exploit the vulnerability to test the client's security posture.

Keep the vulnerability confidential to avoid damaging the client's reputation.

A security professional is asked to provide a reference for a former colleague. The professional knows that the colleague was terminated for unethical behavior. What should the professional do?

Provide a reference that omits the unethical behavior

Provide an honest reference that includes the unethical behavior

Provide a positive reference to help the colleague find a new job

An organization's code of ethics requires employees to protect the organization's assets. A security administrator discovers that a colleague is using company software for personal projects. What should the administrator do?

Use the company software for personal projects as well

Ignore the issue because it is a minor violation

Report the misuse of company assets to the appropriate authority

Confront the colleague and ask them to stop

Systems Security Certified Practitioner

Domain 1Objective 1

1.1 - Comply with Codes of Ethics SSCP Practice Questions (Page 2)

Part of the Security Concepts and Practices domain, which accounts for 16% of the SSCP exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

2concepts

16%of the exam

Questions 6–10

6expert · hard
A company's code of ethics requires employees to report any suspected violations. A security analyst suspects that a manager is involved in fraudulent activities but has no concrete evidence. The analyst is worried about retaliation if the report is unfounded. What should the analyst do?
Select an answer first
7application · medium
A security professional is asked by their supervisor to provide a false statement in a report to a client about the security posture of a system. The professional knows the statement is inaccurate and could mislead the client. According to the ISC2 Code of Ethics, what should the professional do?
Select an answer first
8foundation · easy
According to the ISC2 Code of Ethics, an SSCP professional who discovers a vulnerability in a client's system should:
Select an answer first
9application · medium
A security professional is asked to provide a reference for a former colleague. The professional knows that the colleague was terminated for unethical behavior. What should the professional do?
Select an answer first
10application · medium
An organization's code of ethics requires employees to protect the organization's assets. A security administrator discovers that a colleague is using company software for personal projects. What should the administrator do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SSCP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “SSCP” is a trademark of its owner, used for identification only.