A software company has a small DevOps team. The team wants to automate deployments to production. The security team is concerned that a single compromised developer account could push malicious code. The company wants to reduce this risk without slowing down the deployment process. Which approach best addresses the concern?

Use a single shared deployment account with a strong password.

Grant all developers full administrative access to the production environment to speed up deployments.

Require two different developers to approve each production deployment, and use a service account with limited permissions for the deployment process.

Disable automated deployments and require manual deployment by a senior engineer.

A government agency is investigating a data breach. The agency needs to determine which user account was used to access a sensitive file and whether that access was intentional. The system has audit logging enabled. What additional control is most important to support the investigation?

Ensure each user has a unique account and that authentication events are logged with timestamps and source IPs.

Use a shared account for all users to simplify log analysis.

Disable logging for routine file access to reduce storage costs.

Encrypt the audit logs to protect them from unauthorized viewing.

A university's IT department manages student records. A new administrative assistant needs to update student contact information but must not be able to change grades or financial aid records. The system uses role-based access control (RBAC). What is the most appropriate way to configure the assistant's access?

Grant the assistant individual user-level permissions to all student record fields.

Give the assistant the same access as a faculty advisor, who can view and update all student records.

Add the assistant to the existing 'Registrar' role, which has full access to all student records.

Create a new role with update permission only on the contact-information fields and assign the assistant to that role.

Systems Security Certified Practitioner

Domain 1Objective 2

1.2 - Understand Security Concepts SSCP Practice Questions (Page 4)

Part of the Security Concepts and Practices domain, which accounts for 16% of the SSCP exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

7concepts

16%of the exam

Questions 16–20

16foundation · easy
Which security principle reduces the risk of fraud and error by requiring more than one person to complete a critical task?
Select an answer first
17expert · hard
A software company has a small DevOps team. The team wants to automate deployments to production. The security team is concerned that a single compromised developer account could push malicious code. The company wants to reduce this risk without slowing down the deployment process. Which approach best addresses the concern?
Select an answer first
18foundation · easy
Which security goal ensures that authorized users have reliable and timely access to systems and data when needed?
Select an answer first
19application · medium
A government agency is investigating a data breach. The agency needs to determine which user account was used to access a sensitive file and whether that access was intentional. The system has audit logging enabled. What additional control is most important to support the investigation?
Select an answer first
20application · medium
A university's IT department manages student records. A new administrative assistant needs to update student contact information but must not be able to change grades or financial aid records. The system uses role-based access control (RBAC). What is the most appropriate way to configure the assistant's access?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SSCP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “SSCP” is a trademark of its owner, used for identification only.

1.2 - Understand Security Concepts SSCP Practice Questions (Page 4)

Questions 16–20

Which security principle reduces the risk of fraud and error by requiring more than one person to complete a critical task?

Which security goal ensures that authorized users have reliable and timely access to systems and data when needed?

A government agency is investigating a data breach. The agency needs to determine which user account was used to access a sensitive file and whether that access was intentional. The system has audit logging enabled. What additional control is most important to support the investigation?

Keep studying — Security Concepts and Practices