1.2 Computerized Adaptive Testing, Scoring, and Retakes

ISC2 Systems Security Certified Practitioner SSCP

Track your progress as you read

Finished sections get a check mark.

1 Introduction and Exam Overview

1.1 Current Exam Facts 1.2 Computerized Adaptive Testing, Scoring, and Retakes 1.3 Eligibility, Associate Pathway, Endorsement, and Maintenance

2 Ethics and Security Concepts

2.1 Comply with Codes of Ethics 2.2 Understand Security Concepts 2.3 Identify and Implement Security Controls

3 Functional Controls, Assets, and Change Management

3.1 Document and Maintain Functional Security Controls 3.2 Support and Implement the Asset Management Lifecycle 3.3 Support and Implement the Change Management Lifecycle

4 Security Awareness and Physical Security Operations

4.1 Support and Implement Security Awareness and Training 4.2 Collaborate with Physical Security Operations

5 Authentication Methods and Trust Architectures

5.1 Implement and Maintain Authentication Methods 5.2 Federated Access with OAuth2, SAML, and OpenID Connect 5.3 Understand and Support Internetwork Trust Architectures

6 Identity Lifecycle and Access Control Models

6.1 Support and Implement the Identity Management Lifecycle 6.2 Mandatory, Discretionary, and Role-Based Access Control 6.3 Rule-Based, Attribute-Based, and Privileged Access Management

7 Risk Management, Visibility, and Legal Concerns

7.1 Risk Management Concepts and Treatment 7.2 Risk Visibility, Reporting, and Threat Intelligence 7.3 Legal and Regulatory Concerns

8 Assessments, Monitoring, and Analysis

8.1 Security Assessments and Vulnerability Management 8.2 Operate and Monitor Security Platforms 8.3 Analyze Monitoring Results

9 Incident Response and Forensic Investigations

9.1 Incident Response: Preparation, Detection, Analysis, and Escalation 9.2 Containment, Eradication, Recovery, and Lessons Learned 9.3 Understand and Support Forensic Investigations

10 Business Continuity and Disaster Recovery

10.1 Business Continuity and Emergency Response 10.2 Disaster Recovery and Restoration Metrics 10.3 Backup, Redundancy, Testing, and Drills

11 Cryptography Foundations

11.1 Reasons and Requirements for Cryptography 11.2 Hashing, Salting, Symmetric, Asymmetric, and ECC 11.3 Digital Signatures, HMAC, Algorithm Strength, and Cryptanalysis

12 Secure Protocols and Public Key Infrastructure

12.1 Understand and Implement Secure Protocols 12.2 Understand Public Key Infrastructure

13 Networking Fundamentals, Attacks, and Access Controls

13.1 Understand and Apply Fundamental Concepts of Networking 13.2 Understand Network Attacks and Countermeasures 13.3 Manage Network Access Controls

14 Network Security Operations, Wireless, and IoT

14.1 Manage Network Security 14.2 Operate and Configure Network-Based Security Appliances and Services 14.3 Secure Wireless Communications 14.4 Secure and Monitor Internet of Things

15 Malware, Malicious Activity, and Endpoint Security

15.1 Identify and Analyze Malicious Code 15.2 Malicious Activity, Social Engineering, and Behavior Analytics 15.3 Implement and Operate Endpoint Device Security

16 Mobile, Cloud, and Virtual Environments

16.1 Administer and Manage Mobile Devices 16.2 Cloud Security: Deployment, Service Models, and Shared Responsibility 16.3 Cloud Legal, Regulatory, and Third-Party Requirements 16.4 Operate and Maintain Secure Virtual Environments

1.2 Computerized Adaptive Testing, Scoring, and Retakes

Key Takeaways Explain This Topic AI

SSCP CAT presents at least 75 operational items plus 25 indistinguishable pretest items (100 items minimum) and may continue to 125 items inside a 2-hour limit.

Item review is not allowed: after you submit an answer you cannot change it, and content is not delivered in domain-order sections.

The exam ends by the 95% confidence-interval rule after 100 items, by the maximum-length rule at 125 items, or by the run-out-of-time rule; finishing with fewer than 75 operational plus 25 pretest items is an automatic fail.

Scoring is compensatory across domains against a 700/1000 scaled standard; pass/fail reports include no numerical score, and only failing candidates receive below/near/above domain proficiency.

Retakes require 30, then 60, then 90 test-free days, with a maximum of four SSCP attempts in any 12-month period; Peace of Mind Protection covers two attempts inside 180 days with that same first-retake wait.

Last updated: August 2026

Why CAT changes how you sit the exam

Computerized Adaptive Testing (CAT) is not a cosmetic skin on a linear quiz. Linear exams let many candidates skip, flag, and return. SSCP CAT does not. The computer estimates your ability after every submitted answer and then chooses a next item you should have about a 50% chance of answering correctly. High-ability and low-ability candidates both finish feeling that the last items were hard. That feeling is the targeting model, not proof that you failed.

ISC2 uses CAT for Certified in Cybersecurity (CC) , CISSP , Certified Cloud Security Professional (CCSP) , and SSCP worldwide. Once CAT is live for a program, the linear form is gone. You cannot request a paper-style SSCP. Prepare for a 2-hour session in which you commit once per item, protect the clock so you reach 100 items, and ignore the myth that "the last question was easy so I failed."

How the algorithm behaves

Every candidate starts with an item well below the passing standard. After you answer, the scoring algorithm re-estimates ability from the difficulty of all presented items and all of your answers. The item-selection algorithm then picks a next item near your current estimate. With each additional response the estimate tightens. ISC2's intent is a more precise measurement in fewer items than a fixed form, with stronger exam security because neighboring candidates are not sharing one booklet.

Content is not delivered in domain sections or in outline order. You may see a network segmentation item, then a backup restoration metric, then an access-review item. The session as a whole still complies with the official domain weights from Section 1.1, whether you stop at 100 items or continue to 125.

CAT building block SSCP rule
Minimum items 100
Maximum items 125
Operational (scored) items in the minimum path 75
Pretest (unscored) items in the minimum path 25
Distinguish pretest from operational? No — treat every item as scored
Item review after submit Not permitted
Domain order Random with respect to the outline; weights still apply
Clock 2 hours , including breaks
Passing scaled score 700 / 1000

To receive a pass or fail result you must answer 75 operational items plus 25 pretest items . Pretest items are being evaluated for future exams. Because you cannot tell them apart, a guess-and-skip strategy on "the experimental ones" does not exist. Give every stem a reasoned answer.

No item review follows from adaptivity. The next item's difficulty depends on the previous response. If you could go back and flip item 12 after seeing item 40, the ability estimate would be invalid. Practice that constraint now: when you use this guide's quizzes, pick an option and do not bargain with yourself after you click.

Loading diagram... SSCP CAT End-of-Exam Scoring Rules

The three stopping rules, in order

ISC2 applies three rules in this order :

Confidence Interval Rule. Once you have 100 items, the exam can stop as soon as your ability estimate excludes the pass point with 95% statistical confidence . Statistically above the standard is a pass. Statistically below is a fail. Stopping at 100 items is not a prize and not a scarlet letter. It only means the estimate was already precise.

Maximum-Length Exam Rule. If the confidence interval still includes the pass point, the exam may continue to 125 items. At maximum length, the computer compares your final ability estimate with the passing standard. At or above the standard is a pass; below is a fail. Nobody is randomly assigned a long form. Extra items exist so you can still demonstrate proficiency in domains that have not yet been measured cleanly.

Run-out-of-time (ROOT) Rule. If the clock hits two hours before a confidence-interval stop, the same ability-versus-standard comparison is used only if you already answered the minimum 75 operational plus 25 pretest items. If you have not answered those 100 items when time expires, you fail automatically , even if your early answers looked strong.

Passing proficiency is a scaled 700 out of 1000, not "70% of items correct." On CAT, almost everyone answers about half of the presented items correctly because items are targeted at 50% success. What matters is the difficulty of the items you get right.

Compensatory scoring, not seven mini-exams

ISC2 exams are compensatory . One pass/fail decision is computed from all operational items. You do not need "Above proficiency" in every domain. Strong performance in a heavily weighted domain can offset weaker performance in a lighter domain. There is no guarantee that a 16% domain will rescue a 9% domain, but the opposite myth — fail Cryptography, fail SSCP — is also false. Do not abandon Domain 5; do not treat Domain 5 as a veto either.

Failing candidates who completed the minimum item count receive diagnostic proficiency per domain: below , near , or above the passing standard. Passing candidates do not receive domain bars or a numerical scaled score on the pass/fail report. Plan your retake from those three labels, not from a guessed percentage.

Results at the Pearson VUE checkout are unofficial . ISC2 emails the official result. ISC2 may delay scoring for psychometric analysis when volume is low, and it may run forensic review even after an official email. Results are not released by phone.

Time, breaks, and ROOT failure modes

You have 120 minutes for 100 to 125 items. If the exam stops at 100, you had about 72 seconds per item. If it runs long, you have less. That is why breaks count against the clock . A restroom trip is allowed; a 15-minute hallway call is how ROOT happens.

ROOT trap: a candidate debates the first 40 items, writes mental essays, and hits two hours at item 92. Automatic fail — the algorithm never received 75 operational plus 25 pretest answers. Confidence-interval trap: a candidate panics because the exam "ended early" at 100 items. Early stop is not itself a fail. Difficulty trap: a candidate assumes the last items were easy and therefore a fail. At the end of CAT you are always near a 50% item. You cannot reliably classify items as easy or hard from the chair.

Pacing practice: answer, submit, move. If you truly do not know, eliminate what you can and pick. A blank item still consumes the slot and still informs the estimate as an incorrect response if time expires on it. You cannot park hard items at the end.

Retakes, Peace of Mind, and the 12-month cap

Two independent rules apply to each ISC2 certification program, including SSCP:

After this attempt Test-free days before the next SSCP attempt
First attempt 30 test-free days
Second attempt 60 test-free days from the most recent attempt
Third attempt and later 90 test-free days from the most recent attempt

Separately, you may attempt SSCP at most four times in any 12-month period . You may pursue other ISC2 programs on their own clocks. Waiting 30 days does not reset the four-attempt cap.

Peace of Mind Protection is an optional purchase from ISC2, not a Pearson add-on at the door. If you are eligible, you get two sittings inside 180 days of that purchase at no additional exam fee. Eligibility requires that you have not attempted that certification exam in the last 12 months . Both attempts must be administered inside those 180 days. The ordinary 30-day wait still applies after the first attempt, so you cannot sit Saturday and Sunday. Peace of Mind is not refundable. If you already failed SSCP this year, you cannot buy the protection to erase the wait; you use the standard retake table and you pay for the next attempt.

A standard exam code (without Peace of Mind) must be scheduled and administered within 365 days of purchase. Do not mix the two windows on your calendar.

Realistic candidate scenarios

Jordan passed CompTIA exams by flagging 20 items and returning in the last 15 minutes. On SSCP CAT, Submit is final. Jordan drills with a no-review rule: read the stem twice, decide, live with it. That habit is worth more than an extra practice bank that still allows backtracking.

Marcus is a SOC analyst who overthinks scenario stems. In a mock 2-hour session he reaches item 89 when the timer hits zero. Under official ROOT rules that is a fail regardless of how many of those 89 he believes he crushed. He rebuilds pacing checkpoints: item 25 by minute 30, item 50 by minute 60, item 75 by minute 90, item 100 before the clock dies.

Priya stops at 100 items and is convinced she failed because "everything felt 50/50." That is CAT working. She waits for the unofficial printout instead of decoding item difficulty in the parking lot. If she did fail, she uses the domain proficiency bars, waits 30 test-free days, and does not burn attempt four of twelve months on an unfocused retake.

Section takeaways

Protect the 100-item minimum, treat pretest items as real, and never plan to review. Know the three stopping rules so an early end or a long form does not surprise you. Score is compensatory against 700/1000, not seven separate gates. Calendar the 30/60/90 waits and the four-attempt cap before you spend another USD $249.