SSCP study guide
SSCP · Work through your exam, one topic at a time.
The SSCP (Systems Security Certified Practitioner) is ISC2's certification for hands-on security operations professionals - ISC2 markets it as "The Premier Security Administrator Certification." Unlike entry-level credentials that test foundational knowledge, the SSCP is built to validate operational capability: the demonstrated ability to implement, monitor and administer IT infrastructure using cybersecurity best practices, respond to incidents, and keep security infrastructure in a ready state. ISC2 states that candidates should have at least one year of work experience in security operations, and positions the credential for roles such as network security engineer, systems administrator, security analyst, systems engineer, security administrator, security consultant/specialist, and systems/network analyst. The SSCP study guide has 7 sections and about 2,394 words.
01Security Concepts and Practices
Domain 1 supplies the definitions the exam reuses everywhere else. Start with the CIA triad: confidentiality (encryption, access controls, classification), integrity (hashing, change control, logs), and availability (redundancy, backups, DDoS defenses).
315 words, about 2 min02Access Controls
Every access control question fits a four-step chain: identification (claiming an identity, e.g., a username), authentication (proving it), authorization (what you may do), and accountability/auditing (logging what you did). When a question asks "what is this?", decide which link in the chain is being described.
365 words, about 2 min03Risk Identification, Monitoring and Analysis
Risk management starts with identification: assets, threats, vulnerabilities, and the resulting risk. Qualitative assessment (high/medium/low, matrices) is fast and subjective.
345 words, about 2 min04Incident Response and Recovery
Use the NIST SP 800-61 lifecycle: preparation ; detection and analysis ; containment, eradication and recovery ; post-incident activity . Questions love asking what comes first - stopping a spreading infection generally outranks capturing every last artifact, but preserve volatile data whenever it is safe to do so.
345 words, about 2 min05Cryptography
Symmetric cryptography uses one shared key: fast, but scaling is n(n-1)/2 keys and distribution is the hard part. AES (128/192/256-bit) is the standard; DES and 3DES are deprecated.
369 words, about 2 min06Network and Communications Security
Map every control to an OSI layer. Data link: 802.1X, NAC, port security, VLANs.
306 words, about 2 min07Systems and Application Security
System security means baselines and configuration management, patch management (test, then deploy), least functionality (remove unused services and ports), host firewalls and HIPS, full-disk encryption, endpoint detection and response, application allow-listing and sandboxing. Malware families to distinguish: virus (needs a host and user action), worm (self-propagating across networks), trojan (disguised as useful), rootkit (hides at kernel or firmware level), spyware/keylogger, ransomware, logic bomb, botnet/zombie, and fileless attacks that live in memory or abuse PowerShell.
349 words, about 2 min