SSCP Night Before the Exam Review

Essential Decision Words

BEST: identify whether the stem asks for sequence, completeness, minimum authority, or most effective outcome.
MOST: identify whether the stem asks for sequence, completeness, minimum authority, or most effective outcome.
FIRST: identify whether the stem asks for sequence, completeness, minimum authority, or most effective outcome.
NEXT: identify whether the stem asks for sequence, completeness, minimum authority, or most effective outcome.
LEAST: identify whether the stem asks for sequence, completeness, minimum authority, or most effective outcome.
PRIMARY: identify whether the stem asks for sequence, completeness, minimum authority, or most effective outcome.
MOST EFFECTIVE: identify whether the stem asks for sequence, completeness, minimum authority, or most effective outcome.
MOST APPROPRIATE: identify whether the stem asks for sequence, completeness, minimum authority, or most effective outcome.

Critical Differences

Authentication vs Authorization
Option	Primary difference	Best use
Authentication	Proves or asserts identity	Passwords, MFA, certificates, federation
Authorization	Decides allowed actions	RBAC, ABAC, ACLs, policy rules

Exam clue: If the user is logged in but can access another user record, the issue is authorization, not authentication.

RBAC vs ABAC vs DAC vs MAC
Option	Primary difference	Best use
RBAC	Permissions from job roles	Stable job functions and least privilege groups
ABAC	Policies evaluate attributes	Device, time, clearance, label, department, location
DAC	Owner controls access	Flexible collaboration with owner accountability
MAC	System-enforced labels	High-assurance environments with strict classification

Exam clue: When many conditions drive a decision, ABAC is often stronger than trying to create endless roles.

Preventive vs Detective vs Corrective Controls
Option	Primary difference	Best use
Preventive	Stops or blocks	MFA, firewall deny rule, allowlisting
Detective	Finds or alerts	SIEM alert, IDS, audit review
Corrective	Restores or fixes	Backup restore, patch, account disablement

Exam clue: Do not call a monitoring control preventive unless it actually blocks the action.

Risk Avoidance vs Mitigation vs Transfer vs Acceptance
Option	Primary difference	Best use
Avoidance	Stop the risky activity	Retire a vulnerable unsupported system
Mitigation	Reduce likelihood or impact	Patch, segment, monitor, harden
Transfer	Shift financial or contractual impact	Cyber insurance, outsourcing terms
Acceptance	Approve residual risk	Documented owner decision within tolerance

Exam clue: Acceptance must be explicit and authorized; informal tolerance is not governance.

Symmetric vs Asymmetric Encryption
Option	Primary difference	Best use
Symmetric	Same key encrypts and decrypts	Bulk data protection
Asymmetric	Public/private key pair	Key exchange, signatures, certificates

Exam clue: Use the property needed: confidentiality, integrity, authenticity, or non-repudiation.

Hashing vs Encryption
Option	Primary difference	Best use
Hashing	One-way digest	Integrity checks and password verification
Encryption	Reversible with key	Confidentiality of data at rest or in transit

Exam clue: Hashing is not encryption. Do not choose hashing when the original value must be recovered.

IDS vs IPS
Option	Primary difference	Best use
IDS	Detects and alerts	Out-of-band or passive monitoring
IPS	Can block inline	Preventing known malicious traffic

Exam clue: If prevention is required, a passive IDS alone is not enough.

RTO vs RPO vs MTD
Option	Primary difference	Best use
RTO	How fast service must return	Restore-time target
RPO	How much data loss is acceptable	Backup/replication target
MTD	Maximum tolerable downtime	Business survival boundary

Exam clue: Backups prove RPO only when restores are tested; they do not automatically meet RTO.

Security Concepts To Understand

Authentication is not authorization.
Detection is not prevention.
Backups are not recovery until restores are tested.
Encryption is not access control.
Risk acceptance must be authorized and documented.
Cloud shared responsibility still leaves customer identity, data, configuration, and legal obligations.

Common Traps

Treating ethics questions as public relations questions instead of professional responsibility questions.
Selecting a tool when the issue is missing ownership, approval, or evidence.
Confusing backup existence with a complete asset lifecycle or retention decision.
Choosing an IAM user or static account when a role, federation, or managed identity is the safer pattern.
Assuming authentication proves authorization.
Ignoring inherited groups and stale entitlements during de-provisioning.
Patching purely by CVSS without considering exposure and business impact.
Treating log collection as monitoring when no one analyzes or escalates events.
Collecting data without checking privacy, retention, and jurisdiction.
Destroying evidence while trying to restore service.
Calling a backup strategy complete without restore tests.
Missing the words FIRST or NEXT and choosing a later remediation step.
Using encryption when the requirement is integrity, authenticity, or non-repudiation.
Treating hashing as reversible protection.
Ignoring key custody, rotation, and revocation while focusing only on algorithms.
Putting a passive IDS where prevention is required.
Relying on authentication while leaving management interfaces reachable from untrusted networks.
Treating IoT as harmless because it does not store sensitive records.
Assuming a cloud provider handles customer identity, data, and configuration.
Treating mobile management as only a device problem and ignoring application/data control.
Ignoring container runtime privilege because the image passed a vulnerability scan.

Certification Path

Passing the SSCP exam is not the same as becoming certified. Candidates generally need one year of qualifying security work in one or more SSCP domains, endorsement/application approval, agreement to the ISC2 Code of Ethics, AMF payment, and ongoing CPE maintenance.

Verify current experience, endorsement, AMF, and CPE requirements directly with ISC2.

Final Checklist

I can reason through Security Concepts and Practices scenarios. I can reason through Access Controls scenarios. I can reason through Risk Identification, Monitoring and Analysis scenarios. I can reason through Incident Response and Recovery scenarios. I can reason through Cryptography scenarios. I can reason through Network and Communications Security scenarios. I can reason through Systems and Application Security scenarios.

Night Before the SSCP Exam.