Examers.io
ExamsOrganizationsHow it worksPricingHelp & FAQ
Sign inStart free
ISC2

Systems Security Certified Practitioner

SSCP

The ISC2 Systems Security Certified Practitioner (SSCP) certification validates your hands-on ability to implement, monitor, and administer IT infrastructure in active security operations roles. Designed for professionals with at least one year of experience, it proves you can execute security operations under real-world conditions—implementing controls, responding to incidents, and maintaining security infrastructure. Earning the SSCP demonstrates operational capability that employers trust, including recognition under the U.S. DoD 8140 framework.

Practice Free Questions

1035 practice questions · Updated 2026-07-30

7Domains
36Objectives
267Concepts
1035Questions

SSCP Curriculum

Every domain, objective, and concept the SSCP exam measures.

1.1 - Comply with codes of ethics

2 concepts · 21 questions
  1. ISC2 Code of Ethics
  2. Organizational code of ethics

1.2 - Understand security concepts

7 concepts · 29 questions
  1. Confidentiality
  2. Integrity
  3. Availability
  4. Accountability
  5. Non-repudiation
  6. Least privilege
  7. Segregation of duties

1.3 - Identify and implement security controls

5 concepts · 30 questions
  1. Technical Controls
  2. Physical Controls
  3. Administrative Controls
  4. Assessing Compliance Requirements
  5. Periodic Audit and Review

1.4 - Document and maintain functional security controls

7 concepts · 28 questions
  1. Deterrent controls
  2. Preventative controls
  3. Detective controls
  4. Corrective controls
  5. Compensating controls
  6. Documenting functional security controls
  7. Maintaining functional security controls

1.5 - Support and implement asset management lifecycle (i.e., hardware, software, and data)

9 concepts · 33 questions
  1. Asset lifecycle phases
  2. Planning and initiation
  3. Development and acquisition
  4. Inventory and licensing
  5. Implementation and assessment
  6. Operation and maintenance
  7. End of life (EOL) management
  8. Archival and retention
  9. Disposal and destruction

1.6 - Support and/or implement change management lifecycle

7 concepts · 32 questions
  1. Change Management Roles and Responsibilities
  2. Change Management Processes
  3. Change Management Communications
  4. Change Management Audit
  5. Security Impact Analysis
  6. Configuration Management (CM)
  7. CM Integration with Change Management

1.7 - Support and/or implement security awareness and training (e.g., social engineering/phishing/tabletop exercises/awareness communications)

9 concepts · 33 questions
  1. Security Awareness Program Fundamentals
  2. Social Engineering Techniques
  3. Phishing and Spear Phishing
  4. Phishing Prevention and Response
  5. Tabletop Exercises
  6. Awareness Communications
  7. Training Program Implementation
  8. Measuring Awareness Effectiveness
  9. Continuous Improvement of Awareness

1.8 - Collaborate with physical security operations (e.g., data center/facility assessment, badging and visitor management, personal device restrictions)

4 concepts · 25 questions
  1. Data Center and Facility Assessment
  2. Badging and Access Control Systems
  3. Visitor Management Procedures
  4. Personal Device Restrictions

2.1 - Implement and maintain authentication methods

7 concepts · 29 questions
  1. Single/Multi-factor Authentication
  2. MFA Implementation
  3. Single Sign-On (SSO)
  4. SSO Technologies (ADFS, OpenID Connect)
  5. Device Authentication
  6. Federated Access
  7. Federated Protocols (OAuth2, SAML)

2.2 - Understand and support internetwork trust architectures

3 concepts · 17 questions
  1. Trust relationships
  2. Network trust architectures
  3. Third-party connection mechanisms

2.3 - Support and/or implement the identity management lifecycle

6 concepts · 27 questions
  1. Authorization
  2. Identity Proofing
  3. Provisioning and De-provisioning
  4. Monitoring, Reporting, and Maintenance
  5. Entitlement and Inherited Rights
  6. Identity and Access Management (IAM) Systems

2.4 - Understand and administer access controls

6 concepts · 17 questions
  1. Mandatory Access Control (MAC)
  2. Discretionary Access Control (DAC)
  3. Role-Based Access Control (RBAC)
  4. Privileged Access Management (PAM)
  5. Rule-Based Access Control
  6. Attribute-Based Access Control (ABAC)

3.1 - Understand risk management

5 concepts · 24 questions
  1. Risk Visibility and Reporting
  2. Risk Management Concepts
  3. Risk Management Frameworks
  4. Risk Tolerance
  5. Risk Treatment

3.3 - Perform security assessments and vulnerability management activities

9 concepts · 35 questions
  1. Risk Management Frameworks Implementation
  2. Security Testing Types
  3. Internal Risk Review
  4. Supplier Risk Review
  5. Architecture Risk Review
  6. Vulnerability Scanning
  7. Vulnerability Reporting
  8. Vulnerability Analysis
  9. Vulnerability Remediation

3.4 - Operate and monitor security platforms (e.g., continuous monitoring)

9 concepts · 25 questions
  1. Source Systems Identification
  2. Event Types and Classification
  3. Log Management Policy
  4. Log Integrity and Preservation
  5. Log Architectures and Aggregation
  6. Log Configuration and Tuning
  7. SIEM Real-Time Monitoring
  8. SIEM Analysis and Correlation
  9. SIEM Tracking and Auditing

3.5 - Analyze monitoring results

13 concepts · 44 questions
  1. Security baselines
  2. Anomaly detection
  3. Correlation of events
  4. Noise reduction
  5. Visualizations
  6. Metrics and trends
  7. Notifications
  8. Dashboards
  9. Timelines
  10. Event data analysis
  11. Document findings
  12. Communicate findings
  13. Escalation procedures

4.1 - Understand and support incident response lifecycle (e.g., National Institute of Standards and Technology (NIST), International Organization for Standardization (ISO))

8 concepts · 32 questions
  1. Incident Response Lifecycle Frameworks
  2. Preparation Phase
  3. Detection and Analysis
  4. Escalation and Communication
  5. Containment Strategies
  6. Eradication
  7. Recovery and Documentation
  8. Post-Incident Activities

4.2 - Understand and support forensic investigations

7 concepts · 30 questions
  1. Legal and Ethical Principles in Forensics
  2. First Responder Procedures
  3. Triage and Prioritization of Evidence
  4. Chain of Custody
  5. Preservation of the Scene
  6. Forensic Analysis Reporting
  7. Compliance with Organizational Security Policies

4.3 - Understand and support business continuity plan (BCP) and disaster recovery plan (DRP)

5 concepts · 27 questions
  1. Emergency Response Plans and Procedures
  2. Interim or Alternate Processing Strategies
  3. Restoration Planning Metrics (RTO, RPO, MTD)
  4. Backup and Redundancy Implementation
  5. Testing and Drills

5.1 - Understand reasons and requirements for cryptography

6 concepts · 26 questions
  1. Confidentiality
  2. Integrity and Authenticity
  3. Data Sensitivity
  4. Regulatory and Industry Best Practices
  5. Cryptography Entropy
  6. Quantum Cryptography and Quantum Key Distribution

5.2 - Apply cryptography concepts

11 concepts · 25 questions
  1. Hashing
  2. Salting
  3. Symmetric Encryption
  4. Asymmetric Encryption
  5. Elliptic Curve Cryptography (ECC)
  6. Digital Signatures and Certificates
  7. Hash-based Message Authentication Code (HMAC)
  8. Audit Trails
  9. Strength of Encryption Algorithms and Keys
  10. Cryptographic Attacks
  11. Cryptanalysis

5.3 - Understand and implement secure protocols

8 concepts · 28 questions
  1. Secure protocol services
  2. Common secure protocols
  3. Credit card processing security
  4. Secure file transfer
  5. Secure web client communication
  6. Virtual private network (VPN) protocols
  7. Transmission of PII data
  8. Protocol limitations and vulnerabilities

5.4 - Understand public key infrastructure (PKI)

11 concepts · 35 questions
  1. Key Storage
  2. Key Rotation
  3. Key Composition
  4. Key Generation
  5. Key Destruction
  6. Key Exchange
  7. Key Revocation
  8. Key Escrow
  9. Web of Trust Model
  10. PGP and GPG
  11. Blockchain in PKI

6.1 - Understand and apply fundamental concepts of networking

13 concepts · 43 questions
  1. OSI Model Layers
  2. TCP/IP Model Layers
  3. OSI vs. TCP/IP Comparison
  4. Network Topologies
  5. Peer-to-Peer (P2P) Networks
  6. Client-Server Networks
  7. Wired Transmission Media
  8. Wireless Transmission Media
  9. Software-Defined Networking (SDN)
  10. SD-WAN
  11. Network Virtualization
  12. Network Automation
  13. Common Ports and Protocols

6.2 - Understand network attacks (e.g., distributed denial of service (DDoS), man-in-the-middle (MITM), Domain Name System (DNS) cache poisoning)

9 concepts · 31 questions
  1. DDoS attacks
  2. DDoS countermeasures
  3. MITM attacks
  4. MITM countermeasures
  5. DNS cache poisoning
  6. DNS security countermeasures
  7. Network access controls
  8. Intrusion detection and prevention systems (IDPS)
  9. Firewalls as countermeasures

6.3 - Manage network access controls

8 concepts · 34 questions
  1. IEEE 802.1X
  2. RADIUS
  3. TACACS+
  4. Network Access Control (NAC)
  5. Remote Access Operation
  6. VPN Configuration
  7. Thin Client
  8. Virtual Desktop Infrastructure (VDI)

6.4 - Manage network security

8 concepts · 24 questions
  1. Logical and Physical Placement of Network Devices
  2. Network Segmentation Fundamentals
  3. Data and Control Plane Separation
  4. VLANs and Segmentation
  5. Access Control Lists (ACLs)
  6. Firewall Zones
  7. Micro-segmentation
  8. Secure Device Management

6.5 - Operate and configure network-based security appliances and services

12 concepts · 39 questions
  1. Firewall filtering methods
  2. Proxy servers and their functions
  3. Web application firewall (WAF)
  4. Cloud access security broker (CASB)
  5. Network intrusion detection and prevention systems (IDS/IPS)
  6. Router security configuration
  7. Switch security configuration
  8. WAN optimization and traffic shaping
  9. Load balancing
  10. Network Access Control (NAC)
  11. Data Loss Prevention (DLP)
  12. Unified Threat Management (UTM)

6.6 - Secure wireless communications

8 concepts · 32 questions
  1. Cellular Network Technologies
  2. Wi-Fi Technologies
  3. Bluetooth Technologies
  4. Near-Field Communication (NFC) Technologies
  5. WPA Authentication and Encryption
  6. WPA2 Authentication and Encryption
  7. WPA3 Authentication and Encryption
  8. Extensible Authentication Protocol (EAP)

6.7 Secure and monitor Internet of Things (IoT) (e.g., configuration, network isolation, firmware updates, End of Life (EOL) management)

4 concepts · 27 questions
  1. IoT device configuration
  2. Network isolation for IoT
  3. Firmware update management
  4. End of Life (EOL) management

7.1 - Identify and analyze malicious code and activity

7 concepts · 25 questions
  1. Malware Types
  2. Malware Characteristics
  3. Malware Countermeasures
  4. Malicious Activity Types
  5. Malicious Activity Countermeasures
  6. Social Engineering Methods
  7. Behavior Analytics

7.2 - Implement and operate endpoint device security

8 concepts · 27 questions
  1. Host-based intrusion prevention system (HIPS)
  2. Host-based intrusion detection system (HIDS)
  3. Host-based firewalls
  4. Application whitelisting
  5. Endpoint encryption (full disk encryption)
  6. Trusted Platform Module (TPM)
  7. Secure browsing (digital certificates)
  8. Endpoint detection and response (EDR)

7.3 - Administer and manage mobile devices

5 concepts · 24 questions
  1. Provisioning models
  2. Mobile Device Management (MDM)
  3. Containerization
  4. Mobile encryption
  5. Mobile Application Management (MAM)

7.4 - Understand and configure cloud security

8 concepts · 26 questions
  1. Cloud Deployment Models
  2. Cloud Service Models
  3. Virtualization and Hypervisors
  4. Virtual Private Cloud (VPC)
  5. Legal and Regulatory Concerns in Cloud
  6. Data Storage, Processing, and Transmission in Cloud
  7. Third-Party and Outsourcing Requirements
  8. Shared Responsibility Model

7.5 - Operate and maintain secure virtual environments

7 concepts · 29 questions
  1. Hypervisor Types
  2. Virtual Appliance Deployment
  3. Container Security
  4. Virtual Environment Continuity and Resilience
  5. Virtual Storage Management
  6. Threats to Virtual Environments
  7. Countermeasures and Threat Hunting
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Practice Free Questions

Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for SSCP, so none is invented.