SSCP Exam Objectives (2026): Every Domain, Weight and What Gets Asked
The SSCP blueprint has 7 domains and they are nowhere near equal. Here is the exact weighting, roughly how many questions each is worth, and the kind of question each domain actually produces.
The SSCP blueprint at a glance
Every block below is sized to its share of the exam. The point of drawing it this way is simple: most candidates spread their study time evenly across domains, and the blueprint is not even. Security Concepts & Practices alone is 16% of your score.
Block size is proportional to domain weight. ISC2 publishes these as average weights, so individual exam forms vary slightly.
Domain by domain: what actually gets asked
Weights tell you how much a domain matters. They do not tell you what the questions feel like. This is the part most objective lists leave out.
Security Concepts & Practices
16%~20 questionsDefinitions and governance basics — CIA triad, least privilege, ethics, and the risk vocabulary. The most memorisable domain, so bank the marks.
Network & Communications Security
16%~20 questionsPorts, protocols, segmentation, wireless security and common network attacks. If you have run a firewall or VLAN in anger this domain reads easily.
Access Controls
15%~19 questionsAuthentication factors, identity lifecycle, and the model families — DAC, MAC, RBAC, ABAC. Expect "which model fits this requirement" rather than definitions alone.
Risk Identification, Monitoring & Analysis
15%~19 questionsRunning the monitoring loop: what to log, how to baseline, and how to turn alerts into an assessed risk with an owner.
Systems & Application Security
15%~19 questionsEndpoint and malware defence, virtualisation and cloud workload security, and hardening. Broad but practical.
Incident Response & Recovery
14%~18 questionsThe IR lifecycle, first-responder forensics discipline (do not contaminate evidence), and BCP/DR concepts including RTO and RPO.
Cryptography
9%~11 questionsThe lightest domain but the most conceptual: symmetric vs asymmetric, hashing, PKI and certificate handling, and key management hygiene.
The study order the weights imply
Sequencing by weight is not the only valid approach — but it is the one that protects your score if you run out of time.
Do first · 47% of the exam
- Security Concepts & Practices (16%)
- Network & Communications Security (16%)
- Access Controls (15%)
Then · 30%
- Risk Identification, Monitoring & Analysis (15%)
- Systems & Application Security (15%)
Last · 23%
- Incident Response & Recovery (14%)
- Cryptography (9%)
One caveat worth stating: a low-weight domain you know nothing about is still a guaranteed loss of those marks. Aim for competence everywhere and depth in the heavy domains, rather than ignoring the tail entirely.
Practise SSCP the way it is actually asked
Exam-style questions weighted to the real blueprint, with an explanation on every answer.
Estimated question counts
Based on a 125-question form. Use it to set a target for how many practice questions per domain you should be getting right.
| Domain | Weight | Approx. questions | Miss all of it and you lose |
|---|---|---|---|
| Security Concepts & Practices | 16% | ~20 | 16 points |
| Network & Communications Security | 16% | ~20 | 16 points |
| Access Controls | 15% | ~19 | 15 points |
| Risk Identification, Monitoring & Analysis | 15% | ~19 | 15 points |
| Systems & Application Security | 15% | ~19 | 15 points |
| Incident Response & Recovery | 14% | ~18 | 14 points |
| Cryptography | 9% | ~11 | 9 points |
FAQ
How many domains are on the SSCP exam?
7. The heaviest is Security Concepts & Practices at 16% and the lightest is Cryptography at 9%. Weights are averages, so the exact split shifts a little between exam forms.
How many questions come from each SSCP domain?
On a 125-question form, multiply the weight by the total: Security Concepts & Practices at 16% is roughly 20 questions. Treat these as planning estimates, not guarantees.
Which SSCP domain should I study first?
Start with Security Concepts & Practices and Network & Communications Security and Access Controls. Together they are about 47% of the exam, so early progress there moves your score more than anything else.
Do the SSCP objectives change?
Yes. ISC2 revises the blueprint periodically and weights move with it. Always download the current exam outline from ISC2 before you build a study plan, and check the version date against any course you buy.
ExamCert Team — we build exam-style practice banks for 90+ certifications. Domain weights here come from the current ISC2 exam outline; question-count figures are estimates derived from those weights.
Related: SSCP exam guide · Is SSCP worth it in 2026?