SSCP study plan
SSCP · Give each week a clear focus.
8 weeks · About 6 hours per week
Security Concepts and Practices
Define each leg of the CIA triad and write two original workplace examples per leg
Arrange the ISC2 code of ethics canons in priority order and apply them to three short written scenarios
Sort 15 sample controls into administrative, physical, and technical categories and justify each placement
Distinguish due care from due diligence and describe one concrete action an organization would take for each
Diagram the relationship between vulnerability, threat, risk, and countermeasure in a single labeled sketch
Your checkpoint
One-page concept map plus a 40-term flashcard deck covering Domain 1 vocabulary; self-quiz until you score 80% or higher twice in a row
Security Concepts and Practices & Access Controls
Re-derive the confidentiality, integrity, and availability trade-offs from memory and correct your week-1 notes
Explain the three authentication factors and give two real-world examples of multi-factor combinations
Compare MAC, DAC, RBAC, and ABAC and assign the correct model to eight written access scenarios
Describe when each of RADIUS, TACACS+, Kerberos, SAML, and OAuth/OIDC would be selected and state one limitation of each
Walk through the identity lifecycle from provisioning to deprovisioning and identify the highest-risk step
Your checkpoint
20 self-written practice questions (with answer rationales) spanning Domains 1 and 2, scored at 80% or better on a closed-book attempt
Access Controls & Cryptography
Contrast symmetric and asymmetric encryption on key distribution, speed, and use case with one example each
Distinguish hashing from encryption and identify which properties (collision resistance, avalanche effect, one-way) matter for integrity
Reconstruct the PKI chain of trust from root CA to end-entity certificate without notes
Explain how a digital signature provides integrity, authentication, and non-repudiation
List the phases of key management and state what can fail at each phase
Your checkpoint
Hand-drawn PKI and digital-signature flow diagram reproduced from memory, then verbally explained in under five minutes without notes
Cryptography & Network and Communications Security
Map the seven OSI layers to their TCP/IP counterparts and name one security control or attack that operates at each layer
Summarize at least two cryptanalytic or implementation weaknesses relevant to each of: weak ciphers, poor key storage, and misconfigured TLS
Differentiate the major network attack families (sniffing, spoofing, MITM, DoS/DDoS, replay) by goal and by likely countermeasure
Match secure protocol replacements to the insecure protocol they retire (Telnet, FTP, HTTP, SNMPv1) and state the port/service
Describe how firewalls, VLAN segmentation, and DMZs differ in the protection they provide
Your checkpoint
A two-column reference sheet pairing 15 network attacks with a specific mitigation, checked against your notes for accuracy
Network and Communications Security & Systems and Application Security
Compare WPA2, WPA3, and open wireless risks and name the control that addresses each risk
Outline how VPN, IPsec, and TLS tunneling differ in what they protect and where they terminate
Explain how virtualization, cloud tenancy, and containerization each change the attack surface
Walk through the secure software development lifecycle and state one security activity performed at each stage
Describe how malware categories (virus, worm, trojan, ransomware, rootkit) differ in propagation and persistence
Your checkpoint
A written 10-row table mapping each of 10 attack types to the domain-level control that prevents or detects it, with no more than one row scored as uncertain
Systems and Application Security & Risk Identification, Monitoring and Analysis
Identify the inputs, outputs, and business purpose of a risk assessment and explain how likelihood and impact combine into a risk rating
Distinguish qualitative from quantitative risk analysis and compute a simple annualized loss expectancy from given figures
Compare risk mitigation, transfer, avoidance, and acceptance and assign the right response to five scenarios
Explain how log monitoring, SIEM correlation, and baselining support continuous risk identification
Interpret the purpose of a BIA and connect its outputs to recovery objectives
Your checkpoint
A one-page risk register with five realistic entries, each containing asset, threat, vulnerability, likelihood, impact, rating, and chosen response
Risk Identification, Monitoring and Analysis & Incident Response and Recovery
Order the incident response phases and name the key output of each phase
Write the first five actions you would take on discovering a suspected compromised host, and justify the sequence
Distinguish events, alerts, incidents, and breaches and classify six written examples
Explain the difference between RTO, RPO, and MTD and apply them to a stated backup scenario
Describe what makes evidence admissible and list the steps that preserve its integrity
Your checkpoint
A one-page incident response playbook for a single scenario (for example, ransomware on a file share) covering detection through lessons learned, with roles and evidence-handling steps
Security Concepts and Practices & Access Controls & Risk Identification, Monitoring and Analysis & Incident Response and Recovery & Cryptography & Network and Communications Security & Systems and Application Security
Re-take every self-written question set and log each miss by domain and root cause (knowledge gap vs. misread)
Re-teach your three weakest topics out loud in under three minutes each without notes
Complete two timed full-length practice sessions of at least 100 questions each and review every rationale
Consolidate the flashcard deck down to only the items you have missed twice or more and drill them to 100%
Draft a one-page exam-day strategy covering time per question, flagging, and how to handle scenario stems
Your checkpoint
A score tracker showing at least two full practice attempts, per-domain accuracy, and a final list of no more than 20 remaining weak items
Milestones
Week 2: Closed-book Domain 1 and 2 self-quiz at 80% or higher, with all missed items converted into flashcards
Week 4: Able to reproduce the OSI-to-TCP/IP mapping, the PKI chain of trust, and 15 attack-to-mitigation pairs from memory in one sitting
Week 6: Risk register completed with correct likelihood/impact reasoning, and a first full-length timed practice attempt scored with per-domain breakdown
Week 8: Two full timed practice attempts completed; every domain at or above 70% and no more than 20 unresolved weak items remaining