SC study guide
SC · Work through your exam, one topic at a time.
The SC designation is a vendor-neutral certification for security practitioners who want to demonstrate breadth across the full security discipline rather than depth in a single product or platform. It suits security analysts, engineers, administrators, and consultants who already touch several domains in their day-to-day work and want a credential that reflects that range, as well as candidates moving from a narrow technical role into a broader security position. The SC study guide has 8 sections and about 2,162 words.
01Security and Risk Management
This domain is the governance backbone of the exam. Know the difference between a policy (management intent), standard (mandatory requirement), procedure (step-by-step), and guideline (recommendation).
296 words, about 1 min02Asset Security
Asset security is about classifying, handling, and retaining information appropriately. Know the data classification levels (public, internal/private, confidential, restricted/secret) and that classification drives handling controls.
280 words, about 1 min03Security Architecture and Engineering
This domain covers secure design principles and cryptography. Know least privilege, separation of duties, defense in depth, fail-safe/fail-secure, simplicity, and zero trust .
256 words, about 1 min04Communication and Network Security
Know the OSI and TCP/IP models and which attacks map to which layer (e.g., ARP spoofing at Layer 2, IP spoofing at Layer 3, TLS at Layer 4-7). Understand core protocols and their security posture: TLS for transport confidentiality, IPsec (AH = integrity, ESP = confidentiality + integrity), and DNSSEC for origin authentication of DNS data (not confidentiality).
299 words, about 1 min05Identity and Access Management
Know the AAA triad: authentication, authorization, accounting. Distinguish the factors : something you know, have, are (plus location and behavior).
256 words, about 1 min06Security Assessment and Testing
Know the assessment types: vulnerability scanning (identify weaknesses), penetration testing (exploit to prove impact), audit (verify against criteria), and code review . Understand test methodologies (black-box, white-box, gray-box) and that scope and rules of engagement must be authorized in writing before testing.
270 words, about 1 min07Security Operations
This domain is broad: incident response, business continuity, forensics, and monitoring. Know the incident response lifecycle : preparation, detection/analysis, containment, eradication, recovery, lessons learned.
239 words, about 1 min08Software Development Security
Know the SDLC phases and where security fits: requirements, design, development, testing, deployment, maintenance. Understand secure coding practices and the OWASP-style risk categories conceptually: injection, broken access control, cryptographic failures, insecure design.
266 words, about 1 min