SSCP Certification Cheat Sheet 2026

The 30 highest-yield SSCP Certification facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. In a Delphi risk assessment technique, a group of experts anonymously provide risk estimates in multiple rounds. What is the primary advantage of this approach? → It reduces groupthink and anchoring bias by anonymizing expert opinions
2. Which type of analysis involves examining memory dumps, disk images, and network captures after an incident to reconstruct what occurred? → Forensic analysis
3. A database administrator can modify any record but a separate auditor must approve deletions. This enforces which principle? → Separation of duties
4. Which type of malware hides its presence by modifying the operating system kernel to intercept and falsify system calls? → Rootkit
5. What is 'resilience' in the context of business continuity planning? → The organizational capacity to absorb disruptions and rapidly return to normal operations
6. Which NIST SP 800-61 incident response lifecycle phase involves activities such as installing patches and improving defenses to prevent recurrence? → Eradication and Recovery
7. Which endpoint security technology monitors and controls program execution based on a list of approved applications? → Application whitelisting
8. Which of the following is an illustration of hardening physical infrastructure? → Fire suppression system
9. Which TLS feature allows a server to include the CA's OCSP response in the TLS handshake, reducing client lookup latency? → OCSP stapling
10. What is the purpose of an identity governance and administration (IGA) solution? → Automate identity lifecycle, access requests, and compliance reporting
11. Which risk analysis method uses attack trees, scenarios, and threat modeling to systematically identify risk without assigning specific monetary values? → Qualitative risk analysis
12. Which network security device inspects traffic at Layer 7 and can block specific application-level threats such as SQL injection in web requests? → Web Application Firewall (WAF)
13. An attacker gains admin-level access by exploiting a vulnerability in a low-privilege process. This attack technique is called: → Vertical privilege escalation
14. Which fire class involves energized electrical equipment, and which extinguishing agent should be used? → Class C — CO2 or dry chemical
15. Recently, Jane discovered a security problem happening on her network. What should she do right now that should be her top priority? → Containment
16. An access control system that evaluates policies using attributes of the user, resource, environment, and action is best described as: → ABAC
17. What does the term 'object' refer to in the context of access control? → A passive resource such as a file, database, or device being accessed
18. Which concept describes the practice of granting users only the permissions necessary to perform their job functions? → Least privilege
19. Which mobile security control prevents an application from communicating with a fraudulent server even if the device trusts a rogue CA certificate? → Certificate pinning embedded in the application
20. Which of the following best describes 'indicator of compromise' (IoC)? → Forensic artifacts that suggest a system has been breached
21. Which incident response phase involves identifying the scope and impact of a security event after it has been detected? → Analysis / Identification
22. What is the purpose of a VLAN in network security? → To logically segment a network without requiring additional physical hardware
23. Which type of fire suppression system is most appropriate for a data center to minimize equipment damage? → Clean agent (e.g., FM-200) system
24. A security team wants to detect malware that uses domain generation algorithms (DGA) for command-and-control. Which tool is MOST useful? → DNS query log analysis with anomaly detection
25. What vulnerability does the Electronic Codebook (ECB) mode of operation have? → Identical plaintext blocks produce identical ciphertext blocks, leaking patterns
26. What distinguishes a stream cipher from a block cipher? → Stream ciphers encrypt one bit or byte at a time; block ciphers encrypt fixed-size chunks
27. Which access control model assigns permissions based on the sensitivity label of an object and the clearance level of a subject? → Mandatory Access Control (MAC)
28. In a Clark-Wilson integrity model, what are 'Transformation Procedures' (TPs)? → Well-formed transactions that are the only permitted operations on constrained data
29. A security engineer implements time-based one-time passwords (TOTP) for VPN access. Which attack does this MOST effectively mitigate? → Credential replay attacks using stolen static passwords
30. What is a 'logic bomb' in the context of malicious code? → Code that executes a malicious payload when a specific condition is met