SSCP Systems Security Certified Practitioner Exam Topics and Questions

At 16 percent of the exam, this topic sets the foundation for everything that follows. You are measured on how well you translate policy into action and maintain that action over time. The cost comes from the volume of ground covered and the need to distinguish between control types that look similar under pressure. Most candidates lose marks by treating this as light reading when it demands precision across ethics, asset lifecycle, and change impact.

– Ethics, core principles and control frameworks

The ISC2 Code of Ethics is ranked by canon, and the ranking decides conflicts. When two obligations pull in opposite directions, the higher canon wins. Organizational codes layer on top but cannot override the professional standard. Confidentiality, integrity and availability form the triad, but accountability, privacy, non-repudiation, least privilege and segregation of duties each govern a different decision point. Least privilege limits access to what the role requires. Segregation of duties splits a sensitive process so no single person completes it alone. Non-repudiation ties an action to an identity in a way that cannot be denied later. Each concept is tested through a scenario where applying the wrong one produces a plausible but incorrect answer. You need to know which principle governs which situation, not just what each one means.

– Control types and their operational roles

Technical controls include firewalls, intrusion detection systems and access control lists. Physical controls cover mantraps, cameras and locks. Administrative controls are policies, standards, procedures and baselines. Beyond the three categories, controls are also classified by function. Deterrent controls discourage an attempt. Preventative controls block it. Detective controls reveal it after the fact. Corrective controls repair the damage. Compensating controls fill a gap when the primary control cannot be deployed. The exam expects you to identify which functional type applies when a scenario describes a control in operation. Compliance assessment, periodic audit and review, and documentation of functional security controls are ongoing responsibilities. A control that is not documented or reviewed regularly loses its value in an audit or after an incident.

– Asset management and change lifecycle

Asset management begins with process, planning, design and initiation, then moves through development or acquisition. DevSecOps and testing belong here. Inventory and licensing cover both open-source and closed-source software. Implementation follows assessment. Operation and maintenance run until end of life, at which point archival, retention, disposal and destruction requirements apply. Every stage has a security implication, and the exam tests whether you can identify the correct stage for a given control or decision. Change management operates in parallel. Roles, responsibilities, processes, communications and audit form the structure. Security impact analysis precedes the change. Configuration management tracks what was changed and when. The two lifecycles intersect frequently, and questions often ask you to determine whether a control belongs to asset management, change management, or both.

– Awareness, training and physical security collaboration

Security awareness and training include social engineering scenarios, phishing exercises, tabletop exercises and awareness communications. The goal is behaviour change, and the exam expects you to recognise when training is the correct control and when it is not. Collaboration with physical security operations covers data centre and facility assessments, badging, visitor management and personal device restrictions. These are not peripheral concerns. Physical access can undermine every technical control in place, and the exam uses this fact to construct scenarios where the correct answer lies outside the network perimeter. Candidates who focus only on logical security miss these items.

How Security Concepts and Practices is tested

The 16 percent weighting means roughly one item in six comes from this topic, and those items span the entire domain. Expect questions that present a scenario involving a code of ethics conflict, a control classification problem, or a lifecycle decision point. The stem describes a situation and asks you to select the most appropriate action, control type, or stage. Wrong answers are drawn from adjacent concepts: a deterrent control instead of a preventative one, a change management step instead of an asset management step, or a principle that sounds relevant but does not govern the scenario. Candidates lose marks by choosing the answer that addresses part of the problem rather than the part the question isolates. Read carefully to identify whether the question asks about function, category, lifecycle stage, or ethical obligation. The correct answer is the one that fits the specific demand, not the one that would also help in a general sense.

Access controls account for 15 percent of the exam and shift the focus from broad policy to the mechanics of identity and authorisation. You move from knowing what a control is to implementing and maintaining it across authentication methods, trust architectures, identity lifecycle and access models. The challenge is not conceptual complexity but the precision required to distinguish between similar technologies and models under timed conditions. Candidates often confuse federation with single sign-on, or conflate role-based and rule-based access, and those errors cost marks.

– Authentication methods and federation

Single-factor and multi-factor authentication are baseline requirements, but the exam also tests single sign-on technologies such as Active Directory Federation Services and OpenID Connect. Device authentication relies on certificates, MAC addresses or Trusted Platform Module. Federated access uses OAuth2 or SAML to delegate authentication across trust boundaries. The distinction between SSO and federation is examinable: SSO allows one login to access multiple systems within a trust domain, while federation extends that access across domains that do not share a directory. Each technology solves a different problem, and the exam expects you to match the technology to the scenario. Wrong answers often present a valid authentication method that does not fit the trust relationship or the device type described in the stem.

– Trust architectures and third-party connections

Trust relationships can be one-way, two-way, transitive or zero. A one-way trust allows access in one direction only. A two-way trust is bidirectional. Transitive trust extends through intermediaries. Zero trust assumes no implicit trust and verifies every request. Internet, intranet, extranet and demilitarised zone each define a different boundary and a different trust posture. Third-party connections introduce APIs, app extensions and middleware, and each connection type carries its own risk profile. The exam tests whether you understand the implications of each architecture and can identify the correct trust model when a scenario describes access requirements, partner relationships or segmentation needs. Candidates who treat all external connections as equivalent miss the distinctions that separate correct answers from plausible distractors.

– Identity lifecycle and access control models

The identity lifecycle begins with authorisation and proofing, moves through provisioning, continues with monitoring, reporting and maintenance, and ends with de-provisioning. Role changes and new security standards trigger updates. Entitlement governs inherited rights and resource access. Identity and access management systems automate much of this, but the exam expects you to know which stage applies to a given scenario. Access control models include mandatory, discretionary, role-based, rule-based and attribute-based. Mandatory access control enforces policy centrally. Discretionary access control delegates decisions to the resource owner. Role-based access control assigns permissions by role, and can be subject-based, object-based or managed through privileged access management. Rule-based access control applies conditions. Attribute-based access control evaluates multiple attributes. The exam often asks you to identify which model is in use or which model best fits a requirement, and wrong answers exploit the overlap between models.

How Access Controls is tested

At 15 percent, this topic generates roughly one item in seven, and those items focus on implementation and administration rather than theory. A typical question describes an environment, a requirement or a problem, then asks you to select the authentication method, trust model, lifecycle stage or access control type that applies. The stem may describe a federated access scenario and ask whether OAuth2, SAML, SSO or device authentication is the correct answer. Another may present a role change and ask which identity lifecycle stage is triggered. Wrong answers are drawn from the same family of technologies or models, so the distractor is not obviously incorrect. Candidates lose marks by selecting an answer that would work in a different context or by confusing similar-sounding terms. The correct answer is the one that matches the specific requirement or stage described, not the one that sounds most comprehensive or secure in general.

This topic also carries 15 percent and moves from access control to the continuous work of identifying, measuring and responding to risk. You are expected to understand risk management frameworks, legal and regulatory concerns, vulnerability management, monitoring platforms and the analysis of monitoring results. The difficulty lies in the breadth of subtopics and the need to apply risk concepts in operational contexts rather than simply define them. Candidates often lose marks by selecting a risk treatment or monitoring action that sounds reasonable but does not align with the scenario's constraints or objectives.

– Risk management and treatment

Risk visibility and reporting rely on risk registers, threat intelligence sharing, indicators of compromise, the Common Vulnerability Scoring System and frameworks such as MITRE ATT&CK. Risk management concepts include impact assessments, threat modelling and scope definition. Risk management frameworks provide structure. Risk tolerance captures appetite and quantification. Risk treatment offers four options: accept, transfer, mitigate or avoid. Each option has a cost and a condition under which it is appropriate. The exam expects you to identify the correct treatment when a scenario describes a risk, a business context and a set of constraints. Accept is correct when the cost of mitigation exceeds the potential loss. Transfer is correct when insurance or outsourcing shifts the liability. Mitigate is correct when controls reduce the risk to an acceptable level. Avoid is correct when the activity can be stopped without unacceptable business impact. Wrong answers often present a treatment that addresses the risk but ignores the constraints.

– Legal, regulatory and assessment activities

Legal and regulatory concerns include jurisdiction, limitations and privacy requirements. These are not background material; they shape what you can monitor, where you can store data and how you must respond to an incident. Security assessments and vulnerability management activities include implementing risk management frameworks, conducting security testing, performing risk reviews of internal systems, suppliers and architectures, and managing the vulnerability lifecycle. Scanning, reporting, analysis and remediation form a cycle, and the exam tests whether you can identify which stage applies to a given action or finding. Candidates who treat vulnerability management as a one-time scan miss the lifecycle aspect and select answers that stop too early or skip a required step.

– Monitoring platforms and event management

Operating and monitoring security platforms means continuous monitoring of source systems such as applications, security appliances, network devices and hosts. Events of interest include errors, omissions, anomalies, unauthorised changes, compliance violations and policy failures. Log management covers policy, integrity, preservation, architectures, configuration, aggregation and tuning. Security information and event management systems provide real-time monitoring, analysis, tracking and audit. The exam expects you to understand the role of each component and the flow of data from source to SIEM. Questions may describe a log management problem and ask which configuration or tuning step resolves it, or present an event and ask whether it qualifies as an event of interest. Wrong answers often describe valid monitoring activities that do not address the specific problem or event type in the stem.

– Analysis and communication of findings

Analysing monitoring results begins with security baselines and anomaly detection, including correlation and noise reduction. Visualisations, metrics and trends appear in notifications, dashboards and timelines. Event data analysis identifies patterns and outliers. Documenting and communicating findings includes escalation when thresholds are crossed or when findings require action beyond the analyst's authority. The exam tests whether you can interpret a monitoring result, determine whether it represents a true positive or a false positive, and decide what action or escalation is appropriate. Candidates lose marks by escalating too early, by failing to correlate events, or by choosing an analysis technique that does not fit the data type or the question being asked.

How Risk Identification, Monitoring and Analysis is tested

The 15 percent weighting produces roughly one item in seven, and those items demand that you apply risk concepts rather than recall definitions. A typical question presents a scenario involving a vulnerability scan result, a monitoring alert, a risk register entry or a regulatory constraint, then asks you to select the correct treatment, analysis step, escalation path or compliance action. The stem provides enough context to eliminate one or two distractors, but the remaining options require you to distinguish between actions that differ only in timing, scope or authority. Wrong answers are plausible and often represent actions that would be correct in a slightly different scenario. Candidates lose marks by choosing the answer that sounds most proactive or comprehensive rather than the one that fits the specific constraints and objectives described. Read the scenario carefully to identify what is being asked: treatment, analysis, escalation or configuration.

Incident response and recovery accounts for 14 percent of the exam and tests your ability to support the incident lifecycle, forensic investigations, and business continuity and disaster recovery planning. The domain is narrower than the three that precede it, but the depth increases. You are expected to know not only what each stage or activity involves but also the legal and ethical constraints that govern how evidence is handled and how recovery objectives are set. Candidates often lose marks by selecting an action that is operationally sound but legally or procedurally incorrect.

– Incident response lifecycle

The lifecycle follows preparation, detection, analysis, escalation, containment, eradication, recovery and post-incident activities. Preparation includes defining roles and training programmes. Detection, analysis and escalation involve incident communication and public relations. Containment limits the spread. Eradication removes the cause. Recovery restores normal operations and includes incident documentation. Post-incident activities capture lessons learned, identify new countermeasures and drive continuous improvement. Each stage has a specific objective, and the exam expects you to identify which stage applies when a scenario describes an action or a decision point. Wrong answers often describe actions that belong to an adjacent stage or that would be appropriate later in the lifecycle but not at the point described in the stem.

– Forensic investigations and evidence handling

Forensic investigations operate under legal principles that may be civil, criminal or administrative, and ethical principles that govern professional conduct. Evidence handling begins with the first responder and includes triage, chain of custody and preservation of the scene. Reporting of analysis follows. Organisational security policy compliance ensures that forensic activity does not violate internal standards. The exam tests whether you understand the sequence and the constraints. A question may describe a first responder action and ask whether it preserves the chain of custody, or present an analysis report and ask what must be included to satisfy legal or policy requirements. Candidates lose marks by choosing an answer that completes the investigation but breaks the chain of custody or violates policy. The correct answer is the one that satisfies both the technical objective and the procedural or legal constraint.

– Business continuity and disaster recovery planning

Business continuity and disaster recovery planning includes emergency response plans and procedures for information system contingency, pandemic, natural disaster and crisis management. Interim or alternate processing strategies maintain operations when primary systems are unavailable. Restoration planning defines Recovery Time Objective, Recovery Point Objective and Maximum Tolerable Downtime. Backup and redundancy implementation supports those objectives. Testing and drills include playbooks, tabletop exercises, disaster recovery exercises and scheduling. The exam expects you to distinguish between RTO, RPO and MTD, to identify which backup or redundancy strategy satisfies a given objective, and to recognise when testing is required. Wrong answers often confuse the three time-based metrics or propose a backup strategy that does not meet the stated objective.

How Incident Response and Recovery is tested

At 14 percent, this topic generates roughly one item in seven. Questions present a scenario at a specific point in the incident lifecycle, during a forensic investigation, or in the context of a business continuity or disaster recovery requirement, then ask you to select the correct action, objective or procedural step. The stem provides enough detail to identify the stage or constraint, but the distractors are drawn from adjacent stages or from actions that would be correct if the constraint were different. A question may describe containment and offer eradication as a distractor, or describe a Recovery Time Objective and offer Recovery Point Objective as a distractor. Candidates lose marks by selecting the answer that sounds most complete or most secure rather than the one that matches the stage, objective or constraint described. The correct answer is the one that fits the specific point in the lifecycle or the specific metric or procedural requirement identified in the stem.

Cryptography carries 9 percent of the exam and is the lightest-weighted topic. You are tested on the reasons and requirements for cryptography, the application of cryptographic concepts, secure protocols, and public key infrastructure. The domain is more focused than the others, but the exam expects precision in distinguishing between hashing, encryption, digital signatures and key management practices. Candidates often lose marks by selecting a cryptographic control that provides confidentiality when the scenario requires integrity, or by confusing symmetric and asymmetric encryption in a protocol context.

– Reasons, requirements and cryptographic concepts

Cryptography serves confidentiality, integrity and authenticity. Data sensitivity classifications such as personally identifiable information, intellectual property and protected health information determine when encryption is required. Regulatory and industry best practice, including PCI-DSS and ISO standards, impose additional requirements. Cryptography entropy, quantum cryptography and quantum key distribution are emerging concerns. Applying cryptography concepts means understanding hashing, salting, symmetric and asymmetric encryption, elliptic curve cryptography, non-repudiation through digital signatures, certificates and HMAC, and the strength of encryption algorithms and keys such as AES and RSA. Cryptographic attacks and cryptanalysis are also in scope. The exam expects you to match the cryptographic control to the requirement. Hashing provides integrity but not confidentiality. Salting defends against precomputed attacks on hashes. Symmetric encryption is fast but requires secure key exchange. Asymmetric encryption solves the key exchange problem but is slower. Digital signatures provide non-repudiation. Each control has a purpose, and the exam tests whether you can identify which purpose the scenario demands.

– Secure protocols and public key infrastructure

Secure protocols cover services and protocols, common use cases such as credit card processing, file transfer, web client, VPN and transmission of PII data, and the limitations and vulnerabilities of each protocol. The exam expects you to recognise which protocol fits a given use case and what weaknesses it introduces. Public key infrastructure includes fundamental key management concepts: storage, rotation, composition, generation, destruction, exchange, revocation and escrow. Web of Trust models such as PGP, GPG and blockchain offer an alternative to hierarchical PKI. The exam tests whether you understand the difference between centralised PKI and decentralised Web of Trust, and whether you can identify the correct key management practice when a scenario describes a key lifecycle event or a compromise. Wrong answers often present a key management action that is valid in general but does not address the specific event or threat described in the stem.

How Cryptography is tested

The 9 percent weighting produces roughly one item in eleven, making this the lightest topic by volume. Questions present a scenario that describes a data protection requirement, a protocol selection decision, or a key management event, then ask you to select the correct cryptographic control, protocol or key management action. The stem provides enough context to eliminate options that address the wrong requirement, but the remaining distractors require you to distinguish between controls or practices that serve related but distinct purposes. A question may describe a need for integrity and offer encryption as a distractor, or describe a key compromise and offer rotation when revocation is required. Candidates lose marks by selecting the answer that provides the strongest protection in general rather than the one that matches the specific requirement or event. The correct answer is the one that satisfies the stated objective, not the one that does more than the scenario demands.

Network and communications security returns to a 16 percent weighting and is the broadest operational domain in the exam. You are tested on fundamental networking concepts, network attacks and countermeasures, network access controls, network security management, network-based security appliances and services, and wireless and IoT security. The volume of subtopics is high, and the exam expects you to apply networking knowledge in security contexts rather than simply recall protocol names or port numbers. Candidates lose marks by selecting a countermeasure or configuration that addresses a different attack or network segment than the one described.

– Networking fundamentals and attack countermeasures

Fundamental concepts include the OSI and TCP/IP models, network topologies, network relationships such as peer-to-peer and client-server, transmission media types including wired and wireless, software-defined networking, SD-WAN, network virtualisation, automation, and commonly used ports and protocols. The exam expects you to understand how these concepts interact and where security controls apply. Network attacks include distributed denial of service, man-in-the-middle, DNS poisoning and others. Countermeasures include content delivery networks and additional defences. The exam tests whether you can identify the correct countermeasure for a given attack type and whether you understand the limitations of each countermeasure. A CDN mitigates DDoS by distributing load, but it does not prevent man-in-the-middle attacks. Wrong answers often present a countermeasure that addresses a different attack or that mitigates only part of the threat.

– Network access controls and segmentation

Network access controls include standards and protocols such as IEEE 802.1X, RADIUS and TACACS+. Remote access operation and configuration cover thin client, VPN and virtual desktop infrastructure. Managing network security involves the logical and physical placement of network devices, whether inline, passive or virtual. Segmentation includes physical and logical separation, data and control plane separation, VLANs, ACLs, firewall zones and micro-segmentation. Secure device management ensures that network devices themselves are hardened and monitored. The exam expects you to identify which access control protocol fits a given authentication requirement, which segmentation technique satisfies a given isolation or compliance need, and where a device should be placed to enforce policy without disrupting traffic flow. Wrong answers often describe valid techniques that do not fit the specific requirement or that introduce unacceptable latency or complexity.

– Network-based security appliances and services

Operating and configuring network-based security appliances and services includes firewalls and proxies, with filtering methods, web application firewalls and cloud access security brokers. Network intrusion detection and prevention systems monitor and block threats. Routers and switches enforce policy at the infrastructure layer. Traffic-shaping devices include WAN optimisation and load balancing. Network access control, data loss prevention and unified threat management provide additional layers. Each appliance or service has a specific function and a specific placement. The exam tests whether you can match the appliance to the threat or requirement and whether you understand the difference between inline and passive deployment, between detection and prevention, and between filtering at the network layer and filtering at the application layer. Candidates lose marks by selecting an appliance that provides the wrong type of inspection or by placing it where it cannot see the traffic it is meant to inspect.

– Wireless communications and IoT security

Secure wireless communications cover technologies such as cellular networks, Wi-Fi, Bluetooth and Near-Field Communication. Authentication and encryption protocols include WPA, EAP, WPA2 and WPA3. The exam expects you to know which protocol is current, which is deprecated, and which provides both authentication and encryption. Securing and monitoring Internet of Things devices includes configuration, network isolation, firmware updates and end-of-life management. IoT devices often lack the compute power for strong cryptography and the update mechanisms for timely patching, so isolation and monitoring become primary controls. Questions may describe a wireless deployment and ask which protocol or configuration is required, or describe an IoT environment and ask which control mitigates the risk without breaking device functionality. Wrong answers often propose a control that is too strong for the device or too weak for the threat.

How Network and Communications Security is tested

The 16 percent weighting means roughly one item in six comes from this topic, and those items span networking fundamentals, attack countermeasures, access controls, segmentation, appliances and wireless or IoT security. A typical question describes a network environment, a threat, a compliance requirement or a deployment constraint, then asks you to select the correct protocol, countermeasure, appliance, placement or configuration. The stem provides enough detail to eliminate one or two distractors, but the remaining options require you to distinguish between techniques or devices that serve related purposes. A question may describe a man-in-the-middle attack and offer DDoS countermeasures as distractors, or describe a segmentation requirement and offer VLAN when micro-segmentation is required. Candidates lose marks by selecting the answer that addresses part of the problem or that would work in a different network context. The correct answer is the one that fits the specific threat, requirement or constraint identified in the stem.

The final topic carries 15 percent and closes the exam with systems and application security. You are tested on malicious code and activity, endpoint device security, mobile device management, cloud security, and secure virtual environments. The domain combines threat identification with the configuration and operation of endpoint and cloud controls. Candidates often lose marks by selecting a countermeasure that addresses the wrong threat vector or by confusing cloud service models and their respective security responsibilities.

– Malicious code, activity and countermeasures

Malware types include rootkits, spyware, scareware, ransomware, trojans, viruses, worms, trapdoors, backdoors, fileless malware, and vulnerabilities in applications, code, operating systems and mobile code. Malware countermeasures include scanners, anti-malware, containment, remediation and software security. Types of malicious activity include insider threat, data theft, DDoS, botnets, zero-day exploits, web-based attacks and advanced persistent threats. Malicious activity countermeasures include user awareness and training, system hardening, patching, isolation and data loss prevention. Social engineering methods include spam email, phishing, smishing, vishing, impersonation, scarcity and whaling. Behaviour analytics using machine learning, artificial intelligence and data analytics detect anomalies that signature-based tools miss. The exam expects you to identify the correct countermeasure for a given threat type and to recognise when user training is the correct control and when technical isolation or patching is required. Wrong answers often present a countermeasure that addresses a different threat or that mitigates only part of the attack chain.

– Endpoint and mobile device security

Implementing and operating endpoint device security includes host-based intrusion prevention systems, host-based intrusion detection systems, host-based firewalls, application whitelisting, endpoint encryption such as full disk encryption, Trusted Platform Module and hardware security module management, secure browsing with digital certificates, and endpoint detection and response. Each control has a specific purpose. HIPS blocks threats. HIDS detects them. Application whitelisting prevents unauthorised code execution. EDR provides visibility and response capability. Administering and managing mobile devices includes provisioning techniques such as corporate-owned personally-enabled, bring your own device, and mobile device management. Containerisation isolates corporate data. Encryption protects data at rest. Mobile application management controls which applications are installed and how they behave. The exam tests whether you can match the control to the threat or requirement and whether you understand the difference between HIPS and HIDS, between full disk encryption and containerisation, and between MDM and mobile application management.

– Cloud security models and shared responsibility

Understanding and configuring cloud security begins with deployment models: public, private, hybrid and community. Service models include Infrastructure as a Service, Platform as a Service and Software as a Service. Virtualisation includes hypervisors and Virtual Private Clouds. Legal and regulatory concerns include privacy, surveillance, data ownership, jurisdiction, eDiscovery and shadow IT. Data storage, processing and transmission cover archiving, backup, recovery and resilience. Third-party and outsourcing requirements include service-level agreements, data portability, privacy, destruction and auditing. The shared responsibility model divides security obligations between the cloud provider and the customer, and the division changes with the service model. In IaaS the customer is responsible for more. In SaaS the provider is responsible for more. The exam tests whether you can identify which party is responsible for a given control in a given service model, and whether you understand the legal and regulatory implications of data location and third-party processing. Wrong answers often assign responsibility to the wrong party or propose a control that is not available in the service model described.

– Virtual environment operations and threats

Operating and maintaining secure virtual environments includes hypervisors, both Type 1 bare metal and Type 2 software, virtual appliances, containers, continuity and resilience, and storage management including data domains. Threats, attacks and countermeasures include brute-force attacks, virtual machine escape and threat hunting. Hypervisor security is foundational because a compromise at the hypervisor layer affects all virtual machines. Virtual machine escape allows an attacker to break out of a guest and access the host or other guests. Threat hunting in virtual environments requires visibility into hypervisor logs, virtual network traffic and storage access patterns. The exam expects you to identify which hypervisor type applies to a given deployment, which threat is relevant to a given virtualisation architecture, and which countermeasure mitigates the threat without disrupting legitimate virtual machine operation. Candidates lose marks by selecting a countermeasure that applies to physical environments but not to virtual ones, or by confusing hypervisor types and their respective attack surfaces.

How Systems and Application Security is tested

The 15 percent weighting produces roughly one item in seven, and those items span malware, endpoint controls, mobile device management, cloud security and virtual environments. A typical question describes a threat, a deployment scenario or a configuration requirement, then asks you to select the correct countermeasure, control, provisioning technique, service model or hypervisor type. The stem provides enough context to eliminate one or two distractors, but the remaining options require you to distinguish between controls or models that serve related purposes. A question may describe ransomware and offer anti-malware when isolation is required, or describe a cloud service model and ask which party is responsible for a given control. Candidates lose marks by selecting the answer that addresses a different threat or by misapplying the shared responsibility model. The correct answer is the one that fits the specific threat, service model or virtualisation architecture described in the stem, not the one that provides the most comprehensive protection in general.