The seven SSCP domains: a study guide built on the 2025 exam outline
This SSCP (Systems Security Certified Practitioner) study guide turns the seven exam domains — weighted 16, 15, 15, 14, 9, 16 and 15% in the outline effective 1 October 2025 — into items, minutes and a study order. Domains 1 and 6 carry 16% each and have full guides; the other five are summarised here.
01
The SSCP exam outline at a glance (effective 1 Oct 2025)
The document every SSCP study plan starts from is ISC2’s SSCP exam outline: seven domains, each with a weight and numbered sub-objectives from 1.1 to 7.5. It took effect on 1 October 2025 and, checked 12 October 2026, no newer version has been announced.
SSCP domain weights, exam outline effective 1 October 2025
Bar length is relative to the heaviest domain (16%). Weights total 100%.
What each domain is worth on a two-hour exam of 100–125 items
Domain
Weight
Items at 100
Items at 125
Minutes of 120
D1 Security Concepts and Practices
16%
16
20
19.2
D2 Access Controls
15%
15
about 19
18
D3 Risk Identification, Monitoring and Analysis
15%
15
about 19
18
D4 Incident Response and Recovery
14%
14
17–18
16.8
D5 Cryptography
9%
9
about 11
10.8
D6 Network and Communications Security
16%
16
20
19.2
D7 Systems and Application Security
15%
15
about 19
18
Items and minutes are arithmetic on the weights. ISC2 states only that every adaptive exam is built to these weights, whatever its length.
Read the table as a budget. Domains 1 and 6 together hold 32% of the exam: about 32 items and 38 minutes of your 120. Cryptography is the only domain under 14% — 9 items on a 100-item sitting, 11 on a 125-item one, under 11 minutes either way.
ISC2 Code of Ethics, CIA plus accountability and non-repudiation, least privilege and separation of duties, the five control types and three categories, asset lifecycle to disposal, change and configuration management, awareness training, physical security. Items ask you to classify a control or run a process step.
Single and multi-factor authentication, SSO and federation (SAML, OAuth2, OIDC), trust relationships, the identity lifecycle from proofing to de-provisioning, and MAC, DAC, role-, rule- and attribute-based models. Items ask which model or lifecycle step fits the access need.
Coming soon
D3
15%
Risk Identification, Monitoring and Analysis
Risk registers, CVSS and MITRE ATT&CK, risk treatment, legal and privacy concerns, security testing and vulnerability management, log management and SIEM, baselines and escalation. Items ask you to read a signal and decide what to escalate.
Coming soon
D4
14%
Incident Response and Recovery
The incident response lifecycle from preparation to lessons learned, forensic support and chain of custody, continuity and recovery planning with RTO, RPO and MTD, backups and drills. Items ask for the correct next step in the lifecycle.
Coming soon
D5
9%
Cryptography
Hashing and salting, symmetric versus asymmetric encryption, signatures and HMAC, the right protocol for each use case, PKI and the key lifecycle from generation to destruction, quantum topics. The lightest domain at 9%.
Coming soon
D6
16%
Network and Communications Security
OSI and TCP/IP, ports and protocols, attacks and countermeasures, 802.1X with RADIUS or TACACS+, segmentation, firewalls, IDS/IPS and proxies, wireless security, IoT. Items ask which device or setting works at which layer.
Malware and malicious activity, social engineering, endpoint controls from host firewalls to EDR, mobile device management, cloud shared responsibility, hypervisors and containers. Items ask which host-level control fits the threat.
Coming soon
03
What changed in the outline, and when
The domain content you study today dates from 15 September 2024; the weights are older still, unchanged since 15 November 2021. What changed on 1 October 2025 was the delivery: adaptive testing on the same syllabus. ISC2’s SSCP domain change FAQ records the earlier steps.
15 Nov 2021
Today’s weights set
The seven domains take the 16/15/15/14/9/16/15 split that is still in force.
15 Sep 2024
Content refresh
Domain 1 is renamed from Security Operations and Administration to Security Concepts and Practices. Sub-objective 6.7 (IoT) is added, privacy moves out of 1.2, and many verbs change from participate to support and/or implement. Weights unchanged.
1 Oct 2025
Adaptive format, same content
The exam becomes a computerized adaptive test in English, Japanese and Spanish. The domain text is the 2024 text with typo-level edits. Items, timing and stopping rules are on the SSCP exam format page.
Checked 12 Oct 2026
Still current
No newer SSCP outline has been announced on isc2.org.
04
How to study the seven domains: order and clock budget
Study the domains in an order that builds on itself: define the controls, apply them to identities and networks, harden the hosts, then monitor and respond. Each step below borrows vocabulary from the one before it, so a miss traced back usually lands one step earlier.
Step 01
D1 Security Concepts and Practices — 16%
Control types and categories, least privilege, separation of duties, change management. Every later domain uses these terms. Start with the Domain 1 guide.
Step 02
D2 Access Controls — 15%
Least privilege applied to people and devices: authentication factors, federation, provisioning and the five access-control models.
Step 03
D6 Network and Communications Security — 16%
Ports, segmentation, firewalls, 802.1X, wireless. Work through the Domain 6 guide before cryptography, because the next step lives inside these protocols.
Step 04
D5 Cryptography — 9%
TLS, IPsec, EAP and certificates, now with the protocols around them already in place. Short, but schedule it straight after D6.
Step 05
D7 Systems and Application Security — 15%
Endpoints, mobile, cloud and virtual machines: the hosts your network carries.
Step 06
D3 Risk Identification, Monitoring and Analysis — 15%
Logs, SIEM, baselines, vulnerability management: watching everything built in steps 1–5.
Step 07
D4 Incident Response and Recovery — 14%
Acting on what D3 detects: containment, chain of custody, RTO and RPO. Last, because its items assume the other six.
Splitting a fixed budget
Whatever time you have, split it first in the outline’s proportions: 16% of it to D1, 9% to D5, and so on. ISC2 publishes no figure for how long preparation takes, so work in shares of whatever time you have. Then let timed practice move the shares, using one rule.
RULE-04
Rebalance after every 25-item block
Right call
Trigger
one timed block of 25 items
Move
the domain with the most misses gets 1.5 times its weight share
Source
take it from the domain with the fewest misses
Floor
no domain below half its share — Cryptography never under 4.5%
A block of 25 at 57.6 seconds an item is 24 minutes; at 72 seconds it is 30. Run it on the clock, count misses by domain, then rebalance before the next block.
One two-hour rehearsal on the exam’s clock
123456
0306090120
10:00Block 1: 25 items at the 57.6-second pace
20:24Read the reasoning on every item you missed
30:50Block 2: 25 items, same pace, no going back
41:14Notes again, then count misses by domain
51:40Rebalance the shares with RULE-04
62:00Stop. Next session opens on the weakest domain
Fifty items in 48 minutes is the exam’s 125-item pace. Holding it twice in one sitting is the stamina the real two hours ask for.
If you sit the exam and fail, ISC2 shows each domain as below, near or above the proficiency standard. That report replaces your own miss counts: put every below domain at 1.5 times its share for the next round, and any near one at its full share.
05
What a good SSCP study guide or book should cover
A good SSCP study guide matches the 2025 outline section for section and practises the adaptive format. Run any book, course workbook or set of study notes through these checks before you give it your budget.
Domain 1 is titled Security Concepts and Practices; the older name means a pre-2024 text
All seven domains, with sub-objectives numbered to match the outline, including 6.7 (IoT)
The five control types the SSCP outline lists: deterrent, preventative, detective, corrective, compensating
HMAC credited with integrity and authenticity, never with non-repudiation
RPO treated as a data-loss limit, not a downtime target
The exam described as adaptive, with no item review
700 out of 1000 explained as a scaled standard, never a percentage
Practice items by domain, in roughly the 16/15/15/14/9/16/15 mix
An explanation for every option, not only the key
The date check matters more than the format. As of October 2026, the SSCP books still widely sold carry 2022 publication dates and follow the 2021 outline. The concepts mostly carry over, but the domain names, the IoT sub-objective and any timing advice do not. Pair an older book with the free outline and mark what it lacks.
If you searched for an SSCP syllabus, the outline is that document. It is 12 pages, free, and lists every sub-objective; a guide is only as current as its match to it. The 60 SSCP practice questions on this site are written to the 2025 outline, with option-by-option reasoning.
06
Self-study or a course?
Self-study works when you already hold part of the outline from your job; a course earns its fee when you need a schedule or start cold in several domains. The SSCP requires a year of experience in at least one domain — the rules are on the SSCP overview — so most candidates arrive strong in one or two domains and new to the rest.
Self-study vs an instructor-led course
Self-study
Instructor-led course
Order and pace
yours: you set the sequence and the deadline
the trainer’s: fixed sessions in a set order
Fits when
you work in 1–2 domains and need the other 5 filled in
you need a deadline, or 3 or more domains are new
Typical gap
Cryptography skimmed; untimed practice
class pace replaces your own exam pace
What it costs
the materials you pick
a course fee on top of the exam fee
The exam is the same either way: 100–125 adaptive items in 2 hours, no review.
ISC2 itself sells online self-paced SSCP training with 90- or 180-day access, plus instructor-led options; prices show in its cart, not on the page (checked October 2026). Whichever route you take, finish it the same way: timed blocks of 25 items at 57.6 to 72 seconds each, because no course or book sits the two hours for you.
07
Warm-up: one item from each domain
Seven original practice items below, one per domain, in outline order. Pick an option (click it, or press 1–4 or A–D on the focused item) and it locks: the key gets a magenta box, a wrong pick gets struck through, and the panel explains why each option is right or wrong. The pace meter compares your average seconds per item with the 58–72 second budget. Restart clears it; nothing is stored and no score is predicted.
7 SSCP warm-up items, one per domain
Budget: 2 h = 7,200 s. ÷ 125 items = 57.6 s, ÷ 100 items = 72 s, so the meter holds you to 58–72 s an item. Practice arithmetic only — it predicts no score.
0/7 answered · 0 pass
Paceclock runs from when the log came into view
Item
01/7
Domain
D1
Area
Security Concepts and Practices
Weight
16%
Status
Open
A critical vulnerability remains unpatched six months after being documented in the Plan of Action and Milestones. Which administrative flaw most likely caused this delay?
Pick A–D or press 1–4, then give this panel ten seconds: the verdict, and why each of the four options is right or wrong.
A Plan of Action and Milestones (POA&M) is used to track the remediation of security weaknesses. For a POA&M entry to be enforceable and effective, it must include specific elements such as a targeted completion date, necessary resources, and crucially, an assigned responsible owner and verification steps. Without a designated owner, remediation efforts typically stall because no individual is held accountable.
ACorrect: a POA&M item without an accountable owner and verification steps has no one driving it, so remediation stalls.
BA network schematic adds context, but its absence does not stop a patch from being applied.
CA tool upgrade could cause a brief hiccup, not a six-month delay.
DHow the record is stored has nothing to do with whether the patch gets done.
More below: why each option is right or wrong — scroll this panel
Item
02/7
Domain
D2
Area
Access Controls
Weight
15%
Status
Open
An incident response team traces unauthorized lateral movement to a user account belonging to a developer who recently transferred from the IT operations department. What is the most likely root cause of this vulnerability?
Pick A–D or press 1–4, then give this panel ten seconds: the verdict, and why each of the four options is right or wrong.
A common pitfall in dynamic environments is failing to update or audit ACLs and capability tokens after role or personnel changes. When users change departments, lingering historical access rights are often left active, directly causing privilege creep. This excess access can be heavily exploited for lateral movement.
ACorrect: when the developer moved, old operations rights were not reviewed and removed; that privilege creep gave the attacker extra reach.
BComplex ABAC policies can cause errors, but the clue here is leftover rights from a transfer.
CDelegation may add risk, but the clear clue is the recent job change.
DMAC labels are rare in corporate environments and unrelated to a role transfer.
More below: why each option is right or wrong — scroll this panel
Item
03/7
Domain
D3
Area
Risk Identification, Monitoring and Analysis
Weight
15%
Status
Open
Which specific SIEM query structure will provide the highest fidelity detection for network lateral movement while simultaneously minimizing the generation of excessive false positive alerts?
Pick A–D or press 1–4, then give this panel ten seconds: the verdict, and why each of the four options is right or wrong.
Analysts should use multi-field correlation over single-field anomalies for high signal-to-noise ratios. Single anomalies cause false positives due to benign baseline shifts. Correlating attributes reduces noise and increases detection fidelity by ensuring multiple behaviors match an expected attack pattern.
ASingle deviations are noisy; benign changes trigger them constantly.
BNew domains appear legitimately all the time; alerting on each is noise.
CCorrect: correlating several fields over time matches the shape of lateral movement and filters out benign one-off anomalies.
DIsolated access events lack context and produce many false positives.
More below: why each option is right or wrong — scroll this panel
Item
04/7
Domain
D4
Area
Incident Response and Recovery
Weight
14%
Status
Open
A risk analyst calculates the Annualized Loss Expectancy (ALE) for a $500,000 asset. The asset faces a threat with an Annualized Rate of Occurrence (ARO) of 0.1. The analyst mistakenly enters the 25% Exposure Factor as the whole number 25, resulting in an ALE of $1,250,000. What is the correct ALE?
Pick A–D or press 1–4, then give this panel ten seconds: the verdict, and why each of the four options is right or wrong.
The formula for Single Loss Expectancy (SLE) is Asset Value (AV) multiplied by the Exposure Factor (EF). The Annualized Loss Expectancy (ALE) is SLE multiplied by the Annualized Rate of Occurrence (ARO). The correct EF for 25% is 0.25.
Therefore, SLE = $500,000 * 0.25 = $125,000. The correct ALE = $125,000 * 0.1 = $12,500. The analyst's error of using 25 instead of 0.25 inflated the result by a factor of 100.
A$250,000 is twice the SLE; no step of the formula gives this figure.
B$1,250,000 is the analyst's error, using 25 instead of 0.25.
C$125,000 is the SLE ($500,000 × 0.25) before the ARO is applied.
DCorrect: SLE = $500,000 × 0.25 = $125,000; ALE = SLE × ARO = $125,000 × 0.1 = $12,500.
More below: why each option is right or wrong — scroll this panel
Item
05/7
Domain
D5
Area
Cryptography
Weight
9%
Status
Open
During a security review, an engineer notices a custom protocol establishes a shared secret using a post-quantum Key Encapsulation Mechanism (KEM) and immediately applies this raw output as the AES key for payload encryption. Which critical cryptographic step is missing from this implementation?
Pick A–D or press 1–4, then give this panel ten seconds: the verdict, and why each of the four options is right or wrong.
In modern cryptography, the raw shared secret output from a Key Encapsulation Mechanism (KEM) or key exchange protocol is typically not uniformly random enough or appropriately sized to be used directly as a symmetric encryption key. A Key Derivation Function (KDF) must be applied to the shared secret to securely derive the final symmetric keys used for encryption and authentication. Using the raw KEM output directly undermines the overall security guarantees of the hybrid encryption scheme.
AAES keys have fixed lengths; padding a secret does not make it a proper key.
BAn IV is needed for many modes, but the step missing for the KEM output is key derivation.
CRevocation checking concerns certificate trust, not turning a shared secret into a key.
DCorrect: a KDF such as HKDF turns the raw shared secret into properly derived, purpose-bound symmetric keys.
More below: why each option is right or wrong — scroll this panel
Item
06/7
Domain
D6
Area
Network and Communications Security
Weight
16%
Status
Open
A junior engineer concludes that a captured IPsec packet is operating in tunnel mode because the payload is encrypted and the overall packet size has increased. Why is this assessment flawed?
Pick A–D or press 1–4, then give this panel ten seconds: the verdict, and why each of the four options is right or wrong.
Relying solely on packet size or the presence of encryption is a common pitfall. Both transport mode and tunnel mode encrypt the payload and increase the overall packet size via ESP headers and trailers. The definitive method to distinguish modes is inspecting protocol numbers and header layering.
ATunnel mode encrypts the whole original packet, header included, and adds a new outer header.
BESP also adds headers and trailers, so AH is not the only protocol that changes size.
CCorrect: transport-mode ESP also encrypts the payload and adds headers and trailers, so size and encryption do not reveal the mode.
DIPsec always adds overhead; packet size never stays the same.
More below: why each option is right or wrong — scroll this panel
Item
07/7
Domain
D7
Area
Systems and Application Security
Weight
15%
Status
Open
A Dynamic Application Security Testing (DAST) tool reports a reflected Cross-Site Scripting (XSS) vulnerability. Which condition in the HTTP response log best confirms this finding is a true positive?
Pick A–D or press 1–4, then give this panel ten seconds: the verdict, and why each of the four options is right or wrong.
To validate DAST exploitability, you must verify whether the reported payload reached an exploitable sink and whether the response demonstrates a security impact. For reflected XSS, seeing the unmodified payload reflected directly in the HTTP response output is the primary indicator of a true positive vulnerability.
AAn encrypted session says nothing about whether the payload is reflected.
BCorrect: if the injected script comes back unencoded in the response, the browser runs it; that confirms reflected XSS.
CA strict Content Security Policy makes exploitation harder, pointing away from a true positive.
DA generic error suggests the input was rejected rather than reflected.
More below: why each option is right or wrong — scroll this panel
Seven items point to where to look first. For a reading worth acting on, run the 60-item SSCP practice log with its domain filter tabs, in blocks of 25, and apply RULE-04 after each block.
08
SSCP study guide questions
What are the 7 domains of SSCP?
Security Concepts and Practices (16%), Access Controls (15%), Risk Identification, Monitoring and Analysis (15%), Incident Response and Recovery (14%), Cryptography (9%), Network and Communications Security (16%), and Systems and Application Security (15%), per the outline effective 1 October 2025.
Is there a study guide for the SSCP exam?
Yes. Several books are on sale, ISC2 sells training, and the exam outline is free on isc2.org. Check any guide against the 2025 outline first: the checklist above takes a few minutes. This page is a free, independent domain-by-domain guide.
How long should you study for the SSCP?
ISC2 publishes no figure, and any hour count depends on which domains your job already covers. Measure readiness instead: timed 25-item blocks at 57.6 to 72 seconds an item, with misses spread across domains rather than piled in one.
What is the SSCP CBK?
CBK stands for Common Body of Knowledge, ISC2’s term for the field of knowledge a credential draws on. For the SSCP it is organised into the same seven domains. What the exam tests is set by the narrower exam outline, so study to the outline.
What is the hardest SSCP domain?
ISC2 publishes no per-domain difficulty data. The domain that costs the most is the one you miss most in timed practice, weighted by its share: a weak 16% domain like D1 or D6 costs nearly twice a weak 9% Cryptography.
Is the SSCP syllabus the same as the exam outline?
Yes, in practice. ISC2 publishes no separate syllabus; the exam outline lists the domains, weights and sub-objectives the exam is built from.
Log a few items every day
The app keeps the same rhythm on your iPhone; the full log stays free on this site.