All certifications / SSCP / Lessons
SSCP Oct 2025 outline lessons
Study SSCP for free
A week-by-week plan with every lesson, quizzes, checkpoint tests, a practice exam and hands-on labs.
Open the SSCP study planA week-by-week plan with every lesson, quizzes, checkpoint tests, a practice exam and hands-on labs.
Domain 1: Security concepts & practices
- ISC2 Code of Ethics: preamble and the four canons, in priority order
- CIA triad, authenticity, non-repudiation and privacy
- Least privilege, need to know, separation of duties, job rotation, mandatory vacation
- Defense in depth, due care vs due diligence
- Control categories (technical, administrative, physical) and types (preventive, detective, corrective, deterrent, compensating, directive)
- Documenting and verifying functional security controls, baselines
- Asset management lifecycle: inventory, ownership, classification, retention, secure disposal
- Data roles: owner, custodian, user; media sanitization (clear, purge, destroy)
- Change and configuration management: request, impact analysis, approval, backout, emergency changes
- Security awareness and training: phishing simulations, measuring effectiveness
- Physical security operations: perimeter, badges, access control vestibules, CCTV, visitor logs
Domain 2: Access controls
- Authentication factors: know, have, are; MFA vs multi-step
- Biometrics: FAR, FRR, CER
- Single sign-on, Kerberos, device authentication
- Federation and trust: SAML, OAuth 2.0, OpenID Connect, one-way/two-way and transitive trusts
- Internetwork trust: extranets, third-party connections, zero trust
- Identity lifecycle: provisioning, proofing, maintenance, entitlement, deprovisioning
- Access reviews, recertification and privilege creep
- Privileged access management, service accounts
- Access control models: DAC, MAC, RBAC, rule-based, ABAC
- Physical vs logical access controls
Domain 3: Risk identification, monitoring & analysis
- Risk terms: asset, threat, vulnerability, likelihood, impact
- Qualitative vs quantitative analysis: SLE, ARO, ALE
- Risk treatment: avoid, mitigate, transfer, accept; residual risk and risk registers
- Frameworks: NIST RMF / SP 800-30, ISO 27005
- Legal and regulatory concerns: privacy laws, breach notification, data residency
- Security assessments: vulnerability scanning (credentialed vs non-credentialed), pen testing, audits
- Vulnerability management: CVE/CVSS, prioritization, false positives, remediation tracking
- Monitoring platforms: SIEM, log sources, time synchronization, log integrity
- Baselines, anomalies and alert tuning
- Analyzing and reporting monitoring results; escalation
Domain 4: Incident response & recovery
- Incident lifecycle: preparation, detection & analysis, containment, eradication, recovery, lessons learned
- Events vs incidents, triage and escalation
- Incident response plan, roles and communications
- Forensics: order of volatility, evidence handling, chain of custody
- Forensic imaging, write blockers, hash verification
- Legal considerations in investigations
- Business impact analysis: MTD, RTO, RPO
- BCP vs DRP; recovery sites: hot, warm, cold, cloud
- Backup types (full, incremental, differential) and restore testing
- Plan testing: checklist, tabletop, simulation, parallel, full interruption
Domain 5: Cryptography
- Why cryptography: confidentiality, integrity, authentication, non-repudiation; data at rest, in transit, in use
- Symmetric (AES) vs asymmetric (RSA, ECC) and hybrid key exchange
- Hashing, salting, HMAC and digital signatures
- Key management: generation, distribution, storage, rotation, escrow, destruction; HSM and TPM
- Secure protocols: TLS, SSH, IPsec, S/MIME, SFTP
- Forward secrecy and cipher suite choices
- PKI: CAs, certificates, CSRs, chain of trust, CRL and OCSP
- Web of trust vs hierarchical trust
Domain 6: Network & communications security
- OSI and TCP/IP models, common ports and protocols, IPv4/IPv6
- Network attacks: ARP poisoning, DNS poisoning, DoS/DDoS, SYN flood, on-path, spoofing
- Countermeasures: DAI, DNSSEC, SYN cookies, rate limiting
- Network access control: 802.1X, RADIUS/TACACS+, NAC posture checks, port security
- Segmentation: VLANs, DMZ/screened subnets, micro-segmentation, zero trust
- VPNs and IPsec (AH vs ESP, tunnel vs transport)
- Security devices: firewalls (packet, stateful, NGFW, WAF), IDS/IPS, proxies, load balancers
- Firewall rule design and implicit deny
- Wireless security: WPA2/WPA3, enterprise vs personal, rogue APs and evil twins
- Converged networks and VoIP security
Domain 7: Systems & application security
- Malware types: virus, worm, trojan, ransomware, rootkit, logic bomb, fileless
- Malicious activity and indicators: beaconing, persistence, privilege escalation
- Countermeasures: antimalware, sandboxing, allow-listing, user training
- Endpoint security: HIDS/HIPS, EDR, host firewalls, hardening, patch management
- Mobile device management: MDM/UEM, BYOD vs COPE, containerization, remote wipe
- Cloud models and shared responsibility (IaaS, PaaS, SaaS)
- Cloud security: IAM, encryption, CSPM, misconfigured storage, data residency
- Virtualization: hypervisors, VM escape, VM sprawl, snapshots
- Secure application basics: input validation, OWASP Top 10