Cambridge SC
Cambridge Security Check (SC)
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The Cambridge Security Check (SC) is a multiple-choice security certification aimed at candidates who need to demonstrate a broad, practical grasp of information security rather than deep specialisation in a single tool or vendor. It suits early-career security practitioners, IT administrators moving into security roles, and developers or operations staff who are expected to build and run systems defensibly. The syllabus is weighted across eight domains: security fundamentals and the threat landscape, access control and authentication, cryptography and data protection, network security, secure software development and operations, incident response and security operations, governance, risk and compliance, and privacy and data protection. The weighting rewards breadth: fundamentals, access control, cryptography and networking together make up the majority of the paper, so weaknesses in those areas cost more than gaps in the smaller domains. Preparation should combine a structured pass through each domain with hands-on practice - reading logs, tracing an authentication flow, reasoning about a TLS handshake, or walking through a contained incident. Candidates should also rehearse scenario-style questions, since the exam tests judgement about trade-offs rather than recall of definitions alone. This page is an independent study resource and is not affiliated with or endorsed by the awarding body; always confirm administrative details on the official site.
What you'll study
About Cambridge SC preparation
What is the exam format?
It is delivered as multiple choice, covering the eight published domains. Expect scenario-based items that ask you to choose the best control or the most likely cause of a symptom, not just to define a term. The official body publishes the current number of questions, so check its site rather than relying on second-hand figures.
How long is the exam and what does it cost?
Those details change and are set by the awarding body. The official site publishes the current duration, fee and any regional pricing. Do not plan around numbers quoted in forums or older study guides, and re-check shortly before you book so your scheduling assumptions are correct.
What score do I need to pass?
The passing score is set and published by the official body, and it may be revised. Check the current figure on its site. Practically, aim to be comfortable across every domain rather than perfect in a few, because the weighted domains carry the most marks and a single weak area can pull a borderline result down.
How difficult is it?
Candidates with a year or two of hands-on IT or security work generally find the concepts familiar but the question style demanding, because items ask for the best answer among plausible options. Pure memorisation is not enough. Expect to justify why one control beats another in a given context.
What happens if I fail - can I retake it?
Retake rules, waiting periods and any fees are set by the awarding body and are not fixed across time or region. The official site is the authoritative source. Before rebooking, review your weakest weighted domains first, since improving fundamentals, access control or cryptography usually moves a score more than polishing a small domain.
In what order should I study the domains?
Start with fundamentals and the threat landscape, because later domains assume that vocabulary. Then take access control and cryptography, which underpin network and application security. Move to network security, then secure development and operations, then incident response. Finish with governance, risk, compliance and privacy, which are easier once the technical material is solid.
What are the most common failure modes?
Three recur. First, skimming cryptography and confusing hashing with encryption or misreading key-management scenarios. Second, treating governance and privacy as trivia and losing easy marks. Third, answering from memory of a product rather than from the principle the question tests. Read the whole stem and eliminate options that solve the wrong problem.
Do I need practical experience, or is self-study enough?
Self-study can be sufficient, but the scenario questions reward familiarity with real systems. Reading authentication logs, tracing a certificate chain, or walking through a small incident gives you the context to spot the plausible-but-wrong option. If you have no operational background, build a small lab and practise the concepts you read about.
Is this page affiliated with the exam provider?
No. This is independent study material written to help you prepare. It is not endorsed by, affiliated with, or approved by the awarding body, and it does not reproduce any official question bank. For registration, policies and definitive exam details, use the official site.