Use this quick start guide to collect all the information about ISC2 SSCP Certification exam. This study guide provides a list of objectives and resources that will help you prepare for items on the SSCP ISC2 Systems Security Certified Practitioner exam. The Sample Questions will help you identify the type and difficulty level of the questions and the Practice Exams will make you familiar with the format and environment of an exam. You should refer this guide carefully before attempting your actual ISC2 Systems Security Certified Practitioner certification exam.
The ISC2 SSCP certification is mainly targeted to those candidates who want to build their career in Security Administrator domain. The ISC2 Systems Security Certified Practitioner (SSCP) exam verifies that the candidate possesses the fundamental knowledge and proven skills in the area of ISC2 Systems Security Certified Practitioner.
ISC2 SSCP Exam Summary:
| Exam Name | ISC2 Systems Security Certified Practitioner (SSCP) |
| Exam Code | SSCP |
| Exam Price | $249 (USD) |
| Duration | 180 mins |
| Number of Questions | 125 |
| Passing Score | 700 / 1000 |
| Books / Training |
Systems Security Certified Practitioner (Online Boot Camp) Systems Security Certified Practitioner (Online Self-Paced) Systems Security Certified Practitioner (Classroom) |
| Schedule Exam | Pearson VUE |
| Sample Questions | ISC2 SSCP Sample Questions |
| Practice Exam | ISC2 SSCP Certification Practice Exam |
ISC2 SSCP Exam Syllabus Topics:
| Topic | Details |
|---|---|
Security Concepts and Practices - 16% |
|
| Comply with codes of ethics |
- ISC2 Code of Ethics - Organizational code of ethics |
| Understand security concepts |
- Confidentiality - Integrity - Availability - Accountability - Non-repudiation - Least privilege - Segregation of duties (SoD) |
| Identify and implement security controls |
- Technical controls (e.g., firewalls, intrusion detection systems (IDS), access control list (ACL)) - Physical controls (e.g., mantraps, cameras, locks) - Administrative controls (e.g., security policies, standards, procedures, baselines) - Assessing compliance requirements - Periodic audit and review |
| Document and maintain functional security controls |
- Deterrent controls - Preventative controls - Detective controls - Corrective controls - Compensating controls |
| Support and implement asset management lifecycle (i.e., hardware, software, and data) |
- Process, planning, design and initiation - Development /Acquisition (e.g., DevSecOps, testing) - Inventory and licensing (e.g., open source, closed-source) - Implementation/Assessment - Operation/Maintenance/End Of Life (EOL) - Archival and retention requirements - Disposal and destruction |
| Support and/or implement change management lifecycle |
- Change management (e.g., roles, responsibilities, processes, communications, audit) - Security impact analysis - Configuration management (CM) |
| Support and/or implement security awareness and training (e.g., social engineering/phishing/tabletop exercises/awareness communications) | |
| Collaborate with physical security operations (e.g., data center/facility assessment, badging and visitor management, personal device restrictions) | |
Access Controls - 15% |
|
| Implement and maintain authentication methods |
- Single/Multi-factor authentication (MFA) - Single sign-on (SSO) (e.g., Active Directory Federation Services (ADFS), OpenID Connect) - Device authentication (e.g., certificate, Media Access Control (MAC) address, Trusted Platform Module (TPM)) - Federated access (e.g., Open Authorization 2 (OAuth2), Security Assertion Markup Language (SAML)) |
| Understand and support internetwork trust architectures |
- Trust relationships (e.g., 1-way, 2-way, transitive, zero) - Internet, intranet, extranet, and demilitarized zone (DMZ) - Third-party connections (e.g., application programming interface (API), app extensions, middleware) |
| Support and/or implement the identity management lifecycle |
- Authorization - Proofing - Provisioning/De-provisioning - Monitoring, Reporting, and Maintenance (e.g., role changes, new security standards) - Entitlement (e.g., inherited rights, resources) - Identity and access management (IAM) systems |
| Understand and administer access controls |
- Mandatory - Discretionary - Role-based (e.g., subject-based, object-based, Privileged Access Management (PAM)) - Rule-based - Attribute-based |
Risk Identification, Monitoring and Analysis - 15% |
|
| Understand risk management |
- Risk visibility and reporting (e.g., risk register, sharing threat intelligence, indicators of Compromise (IOC), Common Vulnerability Scoring System (CVSS), socialization, MITRE/ATT&CK model) - Risk management concepts (e.g., impact assessments, threat modeling, scope) - Risk management frameworks (e.g., International Organization for Standardization (ISO), National Institute of Standards and Technology (NIST)) - Risk tolerance (e.g., appetite, risk quantification) - Risk treatment (e.g., accept, transfer, mitigate, avoid, ignore) |
| Understand legal and regulatory concerns (e.g., jurisdiction, limitations, privacy) | |
| Perform security assessments and vulnerability management activities |
- Risk management frameworks implementation - Security testing - Risk review (e.g., internal, supplier, architecture) - Vulnerability management lifecycle (e.g., scanning, reporting, analysis, remediation) |
| Operate and monitor security platforms (e.g., continuous monitoring) |
- Source systems (e.g., applications, security appliances, network devices, hosts) - Events of interest (e.g., errors, omissions, anomalies, unauthorized changes, compliance violations, policy failures) - Log management (e.g., policy, integrity, preservation, architectures, configuration, aggregation, tuning) - Security information and event management (SIEM) (e.g., real-time monitoring, analysis, tracking, audit) |
| Analyze monitoring results |
- Security baselines and anomalies (e.g., correlation, noise reduction) - Visualizations, metrics, and trends (e.g., notifications, dashboards, timelines) - Event data analysis - Document and communicate findings (e.g., escalation) |
Incident Response and Recovery - 14% |
|
| Understand and support incident response lifecycle (e.g., National Institute of Standards and Technology (NIST), International Organization for Standardization (ISO)) |
- Preparation (e.g., defining roles, training programs) - Detection, analysis, and escalation (e.g., incident communication, public relations) - Containment - Eradication - Recovery (e.g., incident documentation) - Post incident activities (e.g., lessons learned, new countermeasures, continuous improvement) |
| Understand and support forensic investigations |
- Legal (e.g., civil, criminal, administrative) and ethical principles - Evidence handling (e.g., first responder, triage, chain of custody, preservation of scene) - Reporting of analysis - Organization Security Policy Compliance |
| Understand and support Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP) activities |
- Emergency response plans and procedures (e.g., information systems contingency, pandemic, natural disaster, crisis management) - Interim or alternate processing strategies - Restoration planning (e.g., Restore Time Objective (RTO), Restore Point Objectives (RPO), Maximum Tolerable Downtime (MTD)) - Backup and redundancy implementation - Testing and drills (e.g., playbook, tabletop, disaster recovery exercises, scheduling) |
Cryptography - 9% |
|
| Understand reasons and requirements for cryptography |
- Confidentiality - Integrity and authenticity - Data sensitivity (e.g., personally identifiable information (PII), intellectual property (IP), protected health information (PHI)) - Regulatory and industry best practice (e.g., Payment Card Industry Data Security Standards (PCI-DSS), International Organization for Standardization (ISO)) - Cryptography entropy (e.g., quantum cryptography, quantum key distribution) |
| Apply cryptography concepts |
- Hashing - Salting - Symmetric/Asymmetric encryption/Elliptic curve cryptography (ECC) - Non-repudiation (e.g., digital signatures/certificates, Hash-based Message Authentication Code (HMAC), audit trails) - Strength of encryption algorithms and keys (e.g., Advanced Encryption Standards (AES), Rivest-Shamir-Adleman (RSA) - Cryptographic attacks and cryptanalysis |
| Understand and implement secure protocols |
- Services and protocols (e.g., Internet Protocol Security (IPsec), Transport Layer Security (TLS), Secure/Multipurpose Internet Mail Extensions (S/MIME), DomainKeys Identified Mail (DKIM)) - Common use cases (e.g., credit card processing, file transfer, web client, virtual private network (VPN), transmission of PII data) - Limitations and vulnerabilities |
| Understand and support public key infrastructure (PKI) systems |
- Fundamental key management concepts (e.g., storage, rotation, composition, generation, destruction, exchange, revocation, escrow) - Web of Trust (WOT) (e.g., Pretty Good Privacy (PGP), GNU Privacy Guard (GPG), blockchain) |
Network and Communications Security - 16% |
|
| Understand and apply fundamental concepts of networking |
- Open Systems Interconnection (OSI) and Transmission Control Protocol/Internet Protocol (TCP/IP) models - Network topologies - Network relationships (e.g., peer-to-peer (P2P), client server) - Transmission media types (e.g., wired, wireless) - Software-defined networking (SDN) (e.g., Software-Defined Wide Area Network (SD-WAN), network virtualization, automation) - Commonly used ports and protocols |
| Understand network attacks (e.g., distributed denial of service (DDoS), man-in-the-middle (MITM), Domain Name System (DNS) cache poisoning) | - Countermeasures (e.g., content delivery networks (CDN), firewalls, network access controls, intrusion detection and prevention systems (IDPS)) |
| Manage network access controls |
- Network access controls, standards and protocols (e.g., Institute of Electrical and Electronics Engineers (IEEE) 802.1X, Remote Authentication Dial-In User Service (RADIUS), Terminal Access Controller Access-Control System Plus (TACACS+)) - Remote access operation and configuration (e.g., thin client, virtual private network (VPN)) |
| Manage network security |
- Logical and physical placement of network devices (e.g., inline, passive, virtual) - Segmentation (e.g., physical/logical, data/control plane, virtual local area network (VLAN), access control list (ACL), firewall zones, micro-segmentation) - Secure device management |
| Operate and configure network-based security devices |
- Firewalls and proxies (e.g., filtering methods, web application firewall (WAF), cloud access security broker (CASB)) - Intrusion detection systems (IDS) and intrusion prevention systems (IPS) - Routers and switches - Traffic-shaping devices (e.g., wide area network (WAN) optimization, load balancing) - Network Access Control (NAC) - Data Loss Prevention (DLP) - Unified Threat Management (UTM) |
| Secure wireless communications |
- Technologies (e.g., cellular network, Wi-Fi, Bluetooth, Near-Field Communication (NFC)) - Authentication and encryption protocols (e.g., Wi-Fi Protected Access (WPA), Extensible Authentication Protocol (EAP), Wi-Fi Protected Access 2 (WPA2), Wi-Fi Protected Access 3 (WPA3)) |
| Secure and monitor Internet of Things (IoT) (e.g., configuration, network isolation, firmware updates, End of Life (EOL) management) | |
Systems and Application Security - 15% |
|
| Identify and analyze malicious code and activity |
- Malware (e.g., rootkits, spyware, scareware, ransomware, trojans, virus, worms, trapdoors, backdoors, fileless, app/code/operating system (OS)/mobile code vulnerabilities) - Malware countermeasures (e.g., scanners, anti-malware, containment and remediation, software security) - Types of malicious activity (e.g., insider threat, data theft, distributed denial of service (DDoS), botnet, zero-day exploits, web-based attacks, advanced persistent threat (APT)) - Malicious activity countermeasures (e.g., user awareness/training, system hardening, patching, isolation, data loss prevention (DLP)) - Social engineering methods (e.g., SPAM email, phishing/smishing/vishing, impersonation, scarcity, whaling) - Behavior analytics (e.g., machine learning, Artificial Intelligence (AI), data analytics) |
| Implement and operate endpoint device security |
- Host-based intrusion prevention system (HIPS) - Host-based intrusion detection system (HIDS) - Host-based firewalls - Application whitelisting - Endpoint encryption (e.g., full disk encryption) - Trusted Platform Module (TPM) (e.g., hardware security module management) - Secure browsing (e.g., digital certificates) - Endpoint Detection and Response (EDR) |
| Endpoint detection and response (EDR) |
- Provisioning techniques (e.g., corporate owned, personally enabled (COPE), Bring Your Own Device (BYOD), Mobile Device Management (MDM)) - Containerization - Encryption - Mobile application management |
| Understand and configure cloud security |
- Deployment models (e.g., public, private, hybrid, community) - Service models (e.g., Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS)) - Virtualization (e.g., hypervisor, Virtual Private Cloud (VPC)) - Legal and regulatory concerns (e.g., privacy, surveillance, data ownership, jurisdiction, eDiscovery, shadow information technology (IT)) - Third-party/Outsourcing requirements (e.g., service-level agreement (SLA), data portability/ privacy/destruction/auditing) - Shared responsibility model - Data storage, processing, and transmission (e.g., archiving, backup, recovery, resilience) |
| Operate and maintain secure virtual environments |
- Hypervisor (i.e., Type 1 (e.g., bare metal), Type 2 (e.g., software)) - Virtual appliances - Containers - Continuity and resilience - Storage management (e.g., data domain) - Threats, attacks, and countermeasures (e.g., brute-force attack, virtual machine escape, threat hunting) |
To ensure success in ISC2 Systems Security Certified Practitioner certification exam, we recommend authorized training course, practice test and hands-on experience to prepare for ISC2 Systems Security Certified Practitioner (SSCP) exam.