Your FREE SSCP Flashcards 2026 – 300+ Cards

Confidentiality, Integrity, Availability — the three core goals of information security.

Preventing unauthorized disclosure of data; enforced by encryption and access control.

Ensuring data is accurate and unaltered except by authorized parties; enforced by hashing and change control.

Ensuring authorized users have timely, reliable access; enforced by redundancy, backups, and fault tolerance.

Tying actions back to a specific identity through logging and monitoring.

Assurance a party cannot deny an action; achieved with digital signatures and logging.

Granting users and processes only the minimum access needed to do their job.

Limiting access to the specific information a person requires, even within their clearance.

Splitting a sensitive task so no single person can complete it alone.

Requiring two authorized people to act together to perform one sensitive operation.

Periodically moving staff between duties to detect fraud and reduce single-person dependence.

Requiring time off so hidden fraudulent activity can surface in an employee's absence.

Layering multiple, overlapping controls so one failure doesn't expose the asset.

A managerial control such as a policy, procedure, training, or background check.

A control implemented in technology, such as a firewall, encryption, or ACL.

A control protecting the environment, such as locks, guards, fences, or cameras.

A control that stops an incident before it happens (lock, MFA, input validation).

A control that identifies an incident in progress or after it (logs, IDS, CCTV).

A control that fixes or restores after an incident (backups, patches).

A control that discourages an attacker (warning signs, visible cameras).

An alternative control used when the primary control isn't feasible (extra monitoring).

A control that restores operations after a disruption (disaster recovery, backups).

Doing the research and developing the plans/policies needed to protect the organization.

Acting on due diligence by implementing and maintaining reasonable controls (prudent-person rule).

Applied in order: (1) protect society and the infrastructure; (2) act honorably; (3) provide diligent service to principals; (4) advance the profession.

Labeling data by sensitivity (public, confidential, secret) so the right protection is applied.

The senior business manager accountable for data who sets its classification.

The party (usually IT) that implements and maintains the controls protecting data day to day.

Residual data left on media after deletion or formatting that may be recoverable.

Overwriting media so it can be safely reused within the organization.

Degaussing or strong overwrite/crypto-erase so media can be released externally.

Physically shredding, pulverizing, or incinerating media for the most sensitive data.

A controlled process to request, evaluate, approve, test, and document system changes.

The group that reviews and approves proposed changes before they are implemented.

A documented minimum required level of security configuration for a system.

Educating users to recognize threats like phishing and follow security policy.

A high-level management statement of security intent and goals (mandatory).

A specific, mandatory requirement that supports a policy (e.g., 'use AES-256').

Detailed step-by-step instructions to carry out a task (mandatory).

A recommended, discretionary best practice (the only optional document type).

Tracking assets from acquisition through use, maintenance, and secure disposal.

Manipulating people into breaking security (phishing, pretexting, tailgating).

Confidentiality keeps data secret; integrity keeps data accurate and unaltered.

Disclosure, Alteration, Destruction — the opposite of (and threats to) the CIA triad.

Create, store, use, share, archive, and destroy — protect data at each stage.

Data moving across a network; protect it with TLS, IPsec, or a VPN.

Stored data; protect it with full-disk or database encryption.

Data being processed in memory; the hardest state to protect.

A policy defining how employees may use organizational systems and data.

Following an authorized person through a secure door without authenticating.

A social-engineering attack using a fabricated scenario to extract information.

An administrative, preventive control that vets personnel before granting access.

Top Secret, Secret, Confidential, and Unclassified levels.

Labels such as Confidential, Private, Sensitive, and Public.

Authentication, Authorization, and Accounting — prove identity, grant access, log activity.

A subject claiming an identity (e.g., a username) — the first step of access control.

Proving a claimed identity with a credential (knowledge, possession, or inherence).

Determining what an authenticated identity is permitted to access and do.

Logging and tracking what an identity did, for audit and forensics.

Using two or more factors from different categories (know, have, are).

A knowledge factor: password, PIN, or passphrase.

A possession factor: smart card, hardware token, or phone.

An inherence (biometric) factor: fingerprint, iris, or face.

How often a biometric wrongly accepts an impostor (Type II error) — the security risk.

How often a biometric wrongly rejects a real user (Type I error) — the usability problem.

The point where FAR equals FRR; a lower CER means a more accurate system.

Access decided by the data owner (e.g., file permissions, ACLs).

Access enforced by the system from labels and clearances; rigid and high-security.

Access granted by job role rather than the individual; scales well in enterprises.

Access decided by attributes and policy (user, resource, time, location); most granular.

Global rules applied to everyone (e.g., a firewall ruleset or time-of-day limits).

One authentication that grants access to multiple systems.

A symmetric-key SSO protocol using tickets and a Key Distribution Center (KDC).

An XML standard for exchanging authentication/authorization data — web SSO and federation.

An open standard for delegated authorization between applications and APIs.

An identity layer on top of OAuth that provides federated authentication.

A protocol that centralizes authentication, authorization, and accounting for network access.

A Cisco AAA protocol that separates authentication, authorization, and accounting (encrypts the full payload).

A protocol for querying and modifying a directory of users and resources.

Allowing identities from one trusted domain to access resources in another.

Trusting no user or device by default and verifying every access request continuously.

Securing, monitoring, and limiting accounts with elevated (admin) privileges.

Provisioning, periodic review/recertification, and prompt deprovisioning of accounts.

Promptly disabling/removing access when a user leaves to prevent orphan accounts.

Trust that flows through a chain — if A trusts B and B trusts C, A may trust C.

Creating accounts and granting initial access based on role and need.

Type I = false rejection (FRR); Type II = false acceptance (FAR) in biometrics.

How quickly a biometric system can process users (enrollment/verification speed).

A soldier with Secret clearance cannot open a Top Secret file regardless of the owner.

Disabling an account after repeated failed logins to deter brute-force attacks.

Rules for length, complexity, age, and reuse that strengthen knowledge factors.

A possession factor that generates or stores one-time or cryptographic credentials.

One-Time Password — a code valid for a single login or short window.

Both parties authenticate each other, not just the client to the server.

A list specifying which subjects may access an object and what they may do.

Restricting what a user can do by limiting the controls they can see/use.

The likelihood a threat exploits a vulnerability and the resulting impact on an asset.

Any potential event or actor that could cause harm by exploiting a vulnerability.

A weakness in a system, process, or control that a threat can exploit.

The percentage of an asset's value lost if a specific risk event occurs.

Expected loss from one event: SLE = Asset Value × Exposure Factor.

The expected number of times a risk event occurs in one year.

Expected yearly cost of a risk: ALE = SLE × ARO; used to cost-justify controls.

Subjective risk ranking (high/medium/low) — fast, but not in dollars.

Objective, dollar-based risk analysis using SLE, ARO, and ALE.

Reducing risk to an acceptable level by implementing controls.

Shifting the financial impact of a risk to a third party, such as insurance.

Eliminating a risk by ceasing the activity that creates it.

A documented, management-approved decision to tolerate a risk and its impact.

The risk that remains after controls are applied; management formally accepts it.

The amount and type of risk an organization is willing to accept to meet objectives.

The acceptable variation around the organization's risk appetite.

An automated check that identifies known weaknesses without exploiting them.

An authorized, simulated attack that actively exploits weaknesses to prove impact.

Common Vulnerabilities and Exposures — a unique identifier for a known vulnerability.

Common Vulnerability Scoring System — a 0–10 standard severity score for a vulnerability.

Security Information and Event Management — aggregates and correlates logs for detection.

An event is any observable occurrence; an incident is an event that harms or threatens security.

Linking related events across sources to reveal an attack that no single log shows.

Ongoing collection and analysis of security data to detect issues in near real time.

A picture of normal behavior used to spot anomalies.

A penetration test with no prior knowledge of the target (simulates an outsider).

A penetration test with full knowledge of the target's internals.

A penetration test with partial knowledge of the target.

An independent, systematic evaluation of controls against a standard or policy.

Personally Identifiable Information — data that can identify a specific individual.

The EU regulation governing the processing and protection of personal data.

U.S. law protecting the privacy and security of health information (PHI).

A security standard for organizations that handle payment card data.

The full lifecycle cost of a control or asset, used in risk decisions.

Comparing the cost of a control to the reduction in expected loss (ALE) it provides.

The risk present before any controls are applied.

The difference between the current and the desired level of risk reduction.

A benign event wrongly flagged as malicious — wastes analyst time.

A real threat that goes undetected — the more dangerous error.

Verifying systems are patched and configured to the secure baseline.

Systematically identifying and prioritizing threats to a system during design.

A documented inventory of identified risks, owners, and treatments.

An independent audit of an organization's security/availability controls.

Preparation; Detection & Analysis; Containment, Eradication & Recovery; Post-Incident (NIST 800-61).

Building the policy, the CSIRT, tooling, and training before an incident happens.

Identifying and confirming a real incident from events; determining scope and severity.

Limiting the spread and damage of an incident (short-term then long-term).

Removing the threat — malware, compromised accounts, and the root cause.

Restoring systems to validated normal operation and monitoring for recurrence.

The post-incident review that improves detection, controls, and the plan.

Computer Security Incident Response Team — the group that handles security incidents.

Documentation of who handled evidence and when, preserving its integrity for legal use.

Collect evidence by how fast it disappears — memory before disk before backups.

The collection, preservation, and analysis of digital evidence.

A plan to keep critical business functions operating during and after a disruption.

Processes and procedures to restore IT systems after a disruptive event.

Identifies critical functions and sets recovery objectives (MTD, RTO, RPO).

The longest a function can be unavailable before unacceptable harm occurs.

The target time to restore a function after a disruption; must be shorter than MTD.

The maximum acceptable data loss measured backward in time; drives backup frequency.

A fully equipped recovery site with near-real-time failover — fastest, most expensive.

A recovery site with hardware and connectivity; data restored on demand — moderate.

An empty recovery space with power/cooling only — cheapest, slowest to bring online.

A backup of all selected data; fastest to restore (one set).

Backs up changes since the last backup of any type; fast backup, slow restore.

Backs up changes since the last full backup; slower backup, faster restore.

Keep three copies of data, on two media types, with one stored off-site.

A discussion-based walkthrough of the incident or recovery plan.

Raising an incident to higher-level responders or management as severity grows.

After detection, the typical first technical step is containment — stop the spread.

Eradication removes the threat and root cause; recovery restores normal operations.

Tabletop is a discussion; full-interruption actually fails over to recovery systems.

Time to verify and restore data/functionality after systems are back online.

Hashing collected evidence proves it has not changed since collection.

A forensic tool that allows reading a drive without altering its contents.

The average time to restore a system after a failure.

A predefined set of steps for responding to a specific type of incident.

Choose hot/warm/cold based on the RTO and budget the BIA produced.

One shared secret key for both encrypt and decrypt (AES); fast, hard to distribute.

A public/private key pair (RSA, ECC); slower, solves key exchange, enables signatures.

The current symmetric block cipher standard (128/192/256-bit keys).

A widely used asymmetric algorithm for encryption and digital signatures.

An asymmetric method for two parties to agree on a shared secret over an insecure channel.

A one-way function producing a fixed-length digest to verify integrity (SHA-256).

Current secure hash algorithm families; use these instead of broken MD5/SHA-1.

A keyed hash providing both integrity and authenticity of a message.

Adding random data to a password before hashing so identical passwords differ.

Slowing password hashing with bcrypt, PBKDF2, scrypt, or Argon2 to resist cracking.

A hash of a message encrypted with the sender's private key; gives integrity, authenticity, non-repudiation.

Encrypt with the recipient's PUBLIC key (confidentiality); sign with YOUR PRIVATE key (authenticity).

Using asymmetric crypto to exchange a fast symmetric session key (e.g., TLS).

The framework of CAs, certificates, and policies that manages public keys and trust.

A trusted entity that issues and signs digital certificates.

A document binding a public key to a verified identity, signed by a CA.

Certificate Revocation List — a published list of certificates no longer trusted.

Online Certificate Status Protocol — a real-time check of a certificate's revocation status.

Storing a copy of a key with a trusted third party for recovery or legal access.

Hardware Security Module — a tamper-resistant device that generates and stores keys.

The protocol that secures application traffic (HTTPS) using hybrid cryptography.

A protocol suite that secures IP traffic at Layer 3 (AH for integrity, ESP for confidentiality).

A protocol for secure remote administration and file transfer.

An attack that exploits hash collision probability to find two inputs with the same digest.

An attacker secretly relays/alters communication between two parties.

A precomputed table of hashes used to crack unsalted password hashes quickly.

Block ciphers encrypt fixed-size blocks (AES); stream ciphers encrypt bit/byte by byte.

ECB encrypts blocks independently (insecure patterns); CBC chains blocks for security.

An authenticated encryption mode providing both confidentiality and integrity.

A legacy symmetric cipher applying DES three times; now deprecated for AES.

Elliptic Curve Cryptography — asymmetric crypto with strong security at small key sizes.

Session keys aren't compromised even if a long-term key is later exposed.

Generate, distribute, store, rotate, and destroy keys securely.

A number used once to prevent replay and ensure uniqueness in crypto operations.

Hiding data within other data (e.g., inside an image) rather than encrypting it.

Capturing and re-sending valid data to gain unauthorized access; nonces/timestamps defend.

Seven layers: Physical, Data Link, Network, Transport, Session, Presentation, Application.

Cables, signals, and hubs — raw bit transmission.

MAC addresses and switches; frames between adjacent nodes.

IP addressing and routers; IPsec operates here.

TCP and UDP; ports and end-to-end delivery.

TCP is connection-oriented and reliable; UDP is connectionless and fast.

A Layer 2 device that forwards frames by MAC address.

A Layer 3 device that forwards packets between networks by IP address.

A device/software that filters network traffic against a rule set.

Inspects each packet in isolation against rules; no memory of sessions.

Tracks the state of active connections; allows return traffic for known sessions.

Terminates and inspects traffic at the application layer on behalf of clients.

Web Application Firewall — protects web apps from attacks like SQL injection and XSS.

Intrusion Detection System — monitors and alerts but does not block (passive).

Intrusion Prevention System — sits inline and can block malicious traffic (active).

Detects threats by matching known attack patterns.

Detects threats by flagging deviations from a normal baseline.

HIDS runs on a host; NIDS watches network traffic.

A Virtual Private Network — an encrypted tunnel over an untrusted network.

A screened subnet hosting public-facing services, isolated from the internal network.

A logically segmented broadcast domain on a switch for isolation.

Checks a device's identity and posture before allowing it onto the network.

Network/Port Address Translation — maps private addresses to public ones.

Attacks that overwhelm a target to deny service; DDoS uses many sources.

Falsifying ARP replies to redirect traffic on a LAN (enables MITM).

Corrupting DNS data to redirect users to a malicious address.

Forging a source address or identity to impersonate a trusted entity.

The current Wi-Fi security standard with strong encryption and offline-attack protection.

A framework for port-based network access control and authentication.

An unauthorized wireless AP that creates an unsecured entry into the network.

A malicious AP impersonating a legitimate one to capture traffic.

Hardening internet-connected devices that often ship insecure by default.

Replace HTTP→HTTPS, FTP/Telnet→SFTP/SSH, WEP→WPA3, SNMPv1/2→SNMPv3.

Establishes, manages, and terminates sessions between applications.

Translates, encrypts, and compresses data (TLS sits around 6/7).

Where user-facing protocols live: HTTP, DNS, SMTP, FTP.

SYN, SYN-ACK, ACK — establishes a TCP connection.

HTTPS 443, HTTP 80, SSH 22, DNS 53, RDP 3389.

Dividing a network into smaller segments to improve control and isolation.

A proxy that sits in front of servers, handling and filtering inbound requests.

A decoy system used to detect, deflect, or study attackers.

Allowing only known hardware addresses onto a network (weak on its own).

Capturing network traffic to read unencrypted data; encryption defends against it.

Physically isolating a system from untrusted networks for high security.

Malicious software: viruses, worms, trojans, ransomware, rootkits, spyware, logic bombs.

Malware that attaches to a file and needs a user to run it to spread.

Self-replicating malware that spreads across networks with no user action.

Malware disguised as legitimate software to deliver a hidden payload.

Malware that encrypts a victim's data and demands payment for the key.

Malware with deep, privileged access that hides its presence from the OS.

Malware that secretly collects information about a user or system.

Malicious code that stays dormant until a trigger condition is met.

Malware that runs in memory using legitimate tools, leaving little on disk.

A social-engineering attack using fraudulent messages to steal data or deliver malware.

A targeted phishing attack aimed at a specific person or organization.

A stealthy, long-term, well-resourced intrusion, often state-sponsored.

Endpoint Detection and Response — continuously monitors endpoints to detect and respond.

Software that detects and removes malicious code on endpoints.

Permitting only approved programs to run; blocks everything else by default.

Acquiring, testing, and applying software updates to fix vulnerabilities.

Reducing the attack surface via secure config, removing unneeded services, and patching.

A firewall running on an individual endpoint to filter its traffic.

Software enforcing security policy on mobile devices (passcode, encryption, remote wipe).

Bring Your Own Device — using personal devices for work; needs containerization/policy.

Isolating work data and apps from personal data on a device.

Erasing a lost or stolen device's data remotely to protect it.

Cloud provider secures the infrastructure; the customer always owns its data and access.

Infrastructure as a Service — customer secures the OS, apps, and data.

Platform as a Service — customer secures apps and data; provider manages OS/runtime.

Software as a Service — provider secures most; customer manages data, access, settings.

A leading cloud breach cause (e.g., a public storage bucket) — on the customer's side.

Cloud Access Security Broker — enforces policy between users and cloud services.

Software that creates and runs VMs; Type 1 runs on bare metal, Type 2 on a host OS.

An attack that breaks out of a guest VM to reach the hypervisor or other VMs.

Uncontrolled growth of unmanaged virtual machines, increasing risk.

A lightweight, isolated package of an app and its dependencies sharing the host OS kernel.

Checking and sanitizing all user input to prevent injection attacks.

Inserting malicious SQL through unvalidated input to read or alter a database.

Malware that installs simply by visiting a compromised or malicious web page.

Compromising a site a target group frequently visits to infect them.

A vulnerability exploited before a patch exists; no signature yet to detect it.

A hidden method to bypass normal authentication and gain access.

A network of compromised machines controlled by an attacker (often for DDoS).

Host Intrusion Prevention System — blocks malicious activity on an endpoint.

A hardened, approved OS image deployed to ensure consistent, secure configuration.

Configuring systems to provide only essential capabilities, reducing attack surface.

Type 1 runs on bare metal; Type 2 runs as an app on a host OS.

VM snapshots may contain sensitive data and can revert security patches if restored.

Running untrusted code in an isolated environment to contain any harm.

Injecting malicious scripts into a web page viewed by other users.