What is the primary purpose of a periodic audit and review of security controls?

To provide a one-time certification that never needs renewal

To eliminate the need for security awareness training

To replace all existing security controls with new ones

To evaluate the effectiveness of controls and ensure ongoing compliance

Which of the following is an example of a technical security control?

A security awareness training program for employees

A firewall that filters network traffic based on a rule set

A policy requiring strong passwords for all user accounts

A lock on the door to the server room

Which of the following is an example of an administrative security control?

A security policy that defines the rules for handling sensitive data

A biometric scanner that authenticates employees at the entrance

A firewall that blocks unauthorized network traffic

An organization is implementing a new access control system. Management wants to ensure that employees understand their responsibilities regarding password usage and that the system is configured to enforce strong passwords. Which approach combines administrative and technical controls to meet this goal?

Publish a security policy that defines password requirements and configure the system to enforce a minimum password length and complexity.

Implement a password manager for all employees and conduct regular security audits.

Create a standard for password changes and deploy an intrusion prevention system (IPS).

Provide annual security awareness training and install a firewall at the network perimeter.

What is the first step in assessing compliance requirements for an organization?

Conducting a penetration test on all systems

Purchasing compliance management software

Hiring an external auditor to review financial records

Identifying the applicable laws, regulations, and standards

Systems Security Certified Practitioner

Domain 1Objective 3

1.3 - Identify and Implement Security Controls SSCP Practice Questions (Page 2)

Part of the Security Concepts and Practices domain, which accounts for 16% of the SSCP exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

5concepts

16%of the exam

Questions 6–10

6foundation · easy
What is the primary purpose of a periodic audit and review of security controls?
Select an answer first
7foundation · easy
Which of the following is an example of a technical security control?
Select an answer first
8foundation · easy
Which of the following is an example of an administrative security control?
Select an answer first
9application · medium
An organization is implementing a new access control system. Management wants to ensure that employees understand their responsibilities regarding password usage and that the system is configured to enforce strong passwords. Which approach combines administrative and technical controls to meet this goal?
Select an answer first
10foundation · easy
What is the first step in assessing compliance requirements for an organization?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SSCP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “SSCP” is a trademark of its owner, used for identification only.