Cambridge SC study guide
Cambridge SC · Work through your exam, one topic at a time.
The Cambridge Security Check (SC) is a multiple-choice security certification aimed at candidates who need to demonstrate a broad, practical grasp of information security rather than deep specialisation in a single tool or vendor. It suits early-career security practitioners, IT administrators moving into security roles, and developers or operations staff who are expected to build and run systems defensibly. The Cambridge SC study guide has 8 sections and about 2,543 words.
01Security fundamentals and threat landscape
Security fundamentals and threat landscape tests whether you can reason about risk, not just name attacks. Expect questions that ask you to classify a threat actor, identify the attack vector, and select a control that addresses the actual weakness.
356 words, about 2 min02Access control and authentication
Access control and authentication tests the path from proving an identity to enforcing least privilege. Questions often separate authentication - who you are - from authorization - what you may do - and accounting - what you did, then ask which control fits a scenario.
322 words, about 2 min03Cryptography and data protection
Cryptography and data protection tests whether you can choose the right primitive and protect keys, not just name algorithms. Expect scenarios about data in transit, at rest, and in use, plus password storage, digital signatures, and tokenization.
332 words, about 2 min04Network security
Network security tests segmentation, inspection, and trust boundaries. Questions ask you to place a control where it actually sees traffic and to distinguish detection from prevention.
328 words, about 2 min05Secure software development and operations
Secure software development and operations tests whether security is built into the lifecycle. Expect questions on secure coding, testing types, dependency risk, CI/CD controls, and production hardening.
306 words, about 2 min06Incident response and security operations
Incident response and security operations tests the lifecycle from preparation to lessons learned. Questions ask what to do first, what evidence to preserve, and which metric or tool supports the decision.
302 words, about 2 min07Governance, risk, and compliance
Governance, risk, and compliance tests how organizations set direction, measure risk, and prove control effectiveness. Expect questions on policy hierarchy, risk treatment, frameworks, audits, and continuity.
304 words, about 2 min08Privacy and data protection
Privacy and data protection tests how personal data is collected, used, retained, and shared. Expect scenarios on lawful basis, data subject rights, vendor roles, breach notification, and privacy by design.
293 words, about 1 min