SSCP / Comparisons

Security concepts that look similar under pressure.

SSCP questions often make two answers seem technically possible. These comparisons help you pick the best operational answer.

Authentication vs Authorization

If the user is logged in but can access another user record, the issue is authorization, not authentication.

When many conditions drive a decision, ABAC is often stronger than trying to create endless roles.

Do not call a monitoring control preventive unless it actually blocks the action.

Acceptance must be explicit and authorized; informal tolerance is not governance.

Use the property needed: confidentiality, integrity, authenticity, or non-repudiation.

Hashing is not encryption. Do not choose hashing when the original value must be recovered.

If prevention is required, a passive IDS alone is not enough.

Backups prove RPO only when restores are tested; they do not automatically meet RTO.

Choose based on RTO/MTD and cost tolerance, not on the most impressive architecture.

Use both when possible; each sees a different class of risk.