How many questions are on the ISC2 SSCP exam?

The ISC2 SSCP exam has 125 questions, and the vendor's published description is: 100-125 questions (CAT, 2 hours).

How long do you have to complete the ISC2 SSCP exam?

You get 180 minutes, which is about 86 seconds per question. The published format is: 100-125 questions (CAT, 2 hours).

What score do you need to pass the ISC2 SSCP exam?

The passing score is 70% (700/1,000 scaled score).

How should I use the domain weights when revising?

Weight by percentage, not by domain. 9% is the one where lost points cost you the most, and Certilum scores you per domain so you can see exactly where that is.

Does Certilum have practice questions for the ISC2 SSCP exam?

Yes: 125 questions in our bank for this certification, each tagged to the exam domain it belongs to, with the official domain weights applied.

Exam format

ISC2 SSCP Exam Format

SSCP

Everything the official exam blueprint specifies: question count, time limit, scoring and the weight each domain carries. The SSCP certification validates that security practitioners possess the operational knowledge to design, implement, and monitor secure systems. It covers the ISC2 Common Body of Knowledge (CBK) domains with a strong emphasis on practical security administration. SSCP holders understand how to implement access controls, analyze risk, monitor for threats, respond to security incidents, deploy cryptographic protections, secure network communications, and harden systems and applications. The certification demonstrates that a professional can handle the day-to-day responsibilities of protecting organizational assets and is not solely focused on high-level security strategy. SSCP is globally recognized and helps candidates stand out in the security operations job market, serving as a solid credential for those who want to prove their technical and operational security skills.

125 questions

180 min

70% to pass

7 domains

certilum

Exam facts at a glance

The published specifications for this certification.

Specification	Value
Questions	125
Time limit	180 minutes (86s per question)
Passing score	70% — 700/1,000 scaled score
Domains	7
Level	Professional
Question bank here	125 questions
Published format	100-125 questions (CAT, 2 hours)
Source	Official exam specification, published by the vendor

Official domain weights

The percentage of the exam each domain carries. Weight your revision by these numbers, not by what you find hardest.

Domain	Weight	Topics	Practice Qs
Cryptography	9%	Cryptographic concepts: encryption, decryption, hashing, salt, and nonce Symmetric algorithms and modes of operation Asymmetric cryptography and key exchange +4 more	11
Access Controls	15%	Identification, authentication, and authorization concepts Authentication mechanisms: passwords, biometrics, certificates, and MFA Identity lifecycle management: provisioning, recertification, and deprovisioning +4 more	19
Incident Response and Recovery	14%	Incident response lifecycle: preparation, detection, containment, eradication, recovery, and lessons learned Incident classification, severity levels, and escalation procedures Forensic collection, preservation, and chain of custody +4 more	17
Security Concepts and Practices	16%	Fundamental security concepts: confidentiality, integrity, availability, and non-repudiation Security governance, policies, and organizational roles Risk management principles, including risk assessment, mitigation, and residual risk +4 more	20
Systems and Application Security	15%	Operating system hardening for Windows, Linux, and Unix Endpoint protection, patch management, and configuration management Virtualization and container security +5 more	19
Network and Communications Security	16%	Network architecture models, protocols, and OSI/TCP-IP layers Secure network design: segmentation, segregation, and zones Network security devices: firewalls, IDS/IPS, proxies, and gateways +5 more	20
Risk Identification, Monitoring and Analysis	15%	Risk management lifecycle: asset identification, threat modeling, vulnerability analysis, and risk response Security monitoring concepts: baselines, alerting, and continuous monitoring Security information and event management (SIEM) systems +4 more	19

The heaviest domain is Cryptography at 9%, and that is where lost points cost you the most. Certilum scores you per domain so you can see the difference between a knowledge gap and a formatting problem.

Note from the vendor record: Exam outline effective 2025-10-01; scaled score 0-1,000, passing 700. Official exam page

More about the ISC2 SSCP exam

Explore the rest of this page series: format, cost, difficulty, requirements and how to prepare.

Exam costPrice, retakes and total budget Pass rateThe score you need Who can take itRequirements and prerequisites Study planHow to prepare, by domain

Related certifications

Explore other certifications in the same category and see how they stack up.

Microsoft Certified: Cybersecurity Architect Expert

Microsoft

AWS Certified Security – Specialty

Amazon Web Services

Arista Network Detection & Response Specialist

Arista

Azure Security Engineer Associate

Microsoft

CCNP Security

Cisco

Certificate of Cloud Security Knowledge v5

Cloud Security Alliance

Frequently asked questions

Everything you need to know about the ISC2 SSCP exam.

There are 7 domains: Cryptography, Access Controls, Incident Response and Recovery, Security Concepts and Practices, Systems and Application Security, Network and Communications Security, Risk Identification, Monitoring and Analysis. The official weights are Cryptography 9%, Access Controls 15%, Incident Response and Recovery 14%, Security Concepts and Practices 16%, Systems and Application Security 15%, Network and Communications Security 16%, Risk Identification, Monitoring and Analysis 15%.