Introduction

(ISC)2 SSCP Systems Security Certified Practitioner Official Practice Tests, 2nd Edition is a companion volume to the SSCP (ISC)2 Systems Security Certified Practitioner Official Study Guide, 3rd Edition. If you're looking to test your knowledge before you take the SSCP exam, this book will help you by providing a combination of practice questions that cover the SSCP Common Body of Knowledge and easy-­to-­understand explanations of both right and wrong answers. This book as well as the 3rd edition of the Study Guide are updated according to the Exam Outline effective November 2021.

If you're just starting to prepare for the SSCP exam, we highly recommend that you use the SSCP (ISC)2 Certified Information Systems Security Professional Official Study Guide, 3rd Edition to help you learn about each of the domains covered by the SSCP exam. Once you're ready to test your knowledge, use this book to help find places where you may need to study more, or to practice for the exam itself.

Since this is a companion to the SSCP Study Guide, this book is designed to be similar to taking the SSCP exam. It contains multipart scenarios as well as standard multiple-­choice questions similar to those you may encounter in the certification exam itself. The book itself is broken up into 9 chapters: 7 domain-­centric chapters covering each domain, and 2 chapters that contain full-­length practice tests to simulate taking the exam itself.

SSCP Certification

The SSCP certification is offered by the International Information System Security Certification Consortium, or (ISC)2, a global nonprofit. The mission of (ISC)2 is to support and provide members and constituents with credentials, resources, and leadership to address cyber, information, software, and infrastructure security to deliver value to society. They achieve this mission by delivering the world's leading information security certification program. The SSCP is the entry-­level credential in this series and is accompanied by several other (ISC)2 programs:

• Certified Information Systems Security Professional (CISSP)
• Certified Authorization Professional (CAP)
• Certified Secure Software Lifecycle Professional (CSSLP)
• Certified Cyber Forensic Professional (CCFP)
• HealthCare Information Security Privacy Practitioner (HCISPP)
• Certified Cloud Security Professional (CCSP)

There are also three advanced CISSP certifications for those who wish to move on from the base credential to demonstrate advanced expertise in a domain of information security:

• Information Systems Security Architecture Professional (CISSP-­ISSAP)
• Information Systems Security Engineering Professional (CISSP-­ISSEP)
• Information Systems Security Management Professional (CISSP-­ISSMP)

The SSCP certification covers seven domains of information security knowledge. These domains are meant to serve as the broad knowledge foundation required to succeed in the information security profession. They include:

• Access Controls
• Security Operations and Administration
• Risk Identification, Monitoring, and Analysis
• Incident Response and Recovery
• Cryptography
• Network and Communications Security
• Systems and Application Security

Complete details on the SSCP Common Body of Knowledge (CBK) are contained in the Candidate Information Bulletin (CIB). The CIB, which includes a full outline of exam topics, can be found on the ISC2 website at www.isc2.org.

Taking the SSCP Exam

The SSCP exam is a 3-­hour exam that consists of 125 questions covering the seven domains. Passing requires achieving a score of at least 700 out of 1,000 points. It's important to understand that this is a scaled score, meaning that not every question is worth the same number of points. Questions of differing difficulty may factor into your score more or less heavily. That said, as you work through these practice exams, you might want to use 70 percent as a yardstick to help you get a sense of whether you're ready to sit for the actual exam. When you're ready, you can schedule an exam via links provided on the (ISC)2 website-­tests are offered in locations throughout the world.

The questions on the SSCP exam are all multiple choice questions with four answer options. You will be asked to select the one correct answer for each question. Watch out for questions that ask you to exercise judgement-­these are commonly used on (ISC)2 exams. You might be asked to identify the "best" option or select the "least" expensive approach. These questions require that you use professional judgement to come to the correct answer.

Computer-­Based Testing Environment

Almost all SSCP exams are now administered in a computer-­based testing (CBT) format. You'll register for the exam through the Pearson Vue website and may take the exam in the language of your choice. It is offered in English, Japanese, and Brazilian Portuguese.

You'll take the exam in a computer-­based testing center located near your home or office. The centers administer many different exams, so you may find yourself sitting in the same room as a student taking a school entrance examination and a healthcare professional earning a medical certification. If you'd like to become more familiar with the testing environment, the Pearson Vue website offers a virtual tour of a testing center: https://home.pearsonvue.com/test-­taker/Pearson-­Professional-­Center-­Tour.aspx.

When you sit down to take the exam, you'll be seated at a computer that has the exam software already loaded and running. It's a pretty straightforward interface that allows you to navigate through the exam. You can download a practice exam and tutorial from Pearson at: http://www.vue.com/athena/athena.asp.

Be aware that the testing software will not let you move back to questions that you previously saw. Each time a question is presented to you, you must provide your answer before moving on to the next question. Be sure to read each question carefully and thoroughly before advancing because you will not have any other opportunity to check your work.

Exam Retake Policy

If you don't pass the SSCP exam, you shouldn't panic. Many individuals don't reach the bar on their first attempt but gain valuable experience that helps them succeed the second time around. When you retake the exam, you'll have the benefit of familiarity with the CBT environment and SSCP exam format. You'll also have time to study up on the areas where you felt less confident.

After your first exam attempt, you must wait 30 days before retaking the computer-­based exam. If you're not successful on that attempt, you must then wait 60 more days before your third attempt and 90 more days before any additional attempt. You may only attempt the SSCP exam four times within any 12-­month period. For more information on the Retake Policy, see https://www.isc2.org/Exams/After-­Your-­Exam.

(ISC)2 exam policies are subject to change. Please be sure to check www.isc2.org for the current policies before you register and take the exam.

Work Experience Requirement

Candidates who wish to earn the SSCP credential must not only pass the exam but also demonstrate that they have at least one year of work experience in the information security field. Your work experience must cover activities in at least one of the seven domains of the SSCP program and must be paid employment.

You may be eligible to waive the work experience requirement based on your educational achievements. If you hold a bachelor's or master's degree in cybersecurity, you may be eligible for a degree waiver that covers one of those years. For more information see https://www.isc2.org/Certifications/SSCP/experience-­requirements.

If you haven't yet completed your work experience requirement, you may still attempt the SSCP exam. Individuals who pass the exam are designated Associates of (ISC)2 and have two years to complete the work experience requirement.

Recertification Requirements

Once you've earned your SSCP credential, you'll need to maintain your certification by paying maintenance fees and participating in continuing professional education (CPE). As long as you maintain your certification in good standing, you will not need to retake the SSCP exam. Currently, the annual maintenance fees for the SSCP credential are $125 per year.

To maintain your SSCP certification, you must earn at least 60 CPE credits during each three-­year renewal period. (ISC)2 provides an online portal where members may submit CPE completion for review and approval. The portal also tracks annual maintenance fee payments and progress toward recertification.

Using This Book to Practice

This book is composed of 9 chapters. Each of the first seven chapters covers a domain, with a variety of questions that can help you test your knowledge of real-­world, scenario, and best practices-based security knowledge. The final two chapters are complete practice exams that can serve as timed practice tests...