Overview
Domain 7 covers securing the systems users and applications run on. It starts with identifying and analyzing malicious code and activity: malware types such as rootkits, ransomware, trojans, worms and fileless malware, malicious activity such as insider threats, botnets, zero-days and advanced persistent threats, social engineering methods, and behavior analytics using machine learning and AI. It covers endpoint security: host-based intrusion detection and prevention, host firewalls, application allowlisting, full disk encryption, TPM, secure browsing and endpoint detection and response (EDR). It covers mobile device administration with COPE, BYOD, MDM, containerization and mobile application management. It then covers cloud security, including deployment and service models, virtualization, legal concerns, third-party requirements and the shared responsibility model, and finally operating secure virtual environments.
The domain applies controls from Domains 1 and 2 to specific platforms. Its events feed Domain 3's monitoring, and its incidents are handled under Domain 4.
How it's tested
Questions describe symptoms on a system, a device ownership model, or a cloud or virtual environment, and ask which threat is present, which control is MOST effective, or who is responsible for a task. Expect hands-on scenarios typical of a systems administrator's day.
-
Name the malware or attack
Behavior is described, such as self-spreading, hiding from the operating system or demanding payment, and you must identify the threat type and response.
-
Pick the endpoint or mobile control
A device scenario is described, and you must choose between options such as HIDS, HIPS, EDR, allowlisting, MDM or MAM.
-
Cloud and virtualization responsibility
A cloud or virtual environment task is described, and you must decide whether the customer or the provider owns it, or which risk applies.
A company lets staff use personal phones for email but does not want to wipe or track their personal data. Full MDM enrollment is tempting because it gives complete control, but it reaches into personal data and is often resisted. Mobile application management with a work container controls and can wipe corporate apps and data while leaving personal content alone, which fits a BYOD model.
Subdomains 5
Official subdomains from the ISC2 outline, in outline order.
7.1 Identify and analyze malicious code and activityMalware, malicious activity, social engineering, countermeasures and behavior analytics.
- What it means
- This covers malware types (rootkits, spyware, scareware, ransomware, trojans, viruses, worms, trapdoors and backdoors, fileless malware, and code and OS vulnerabilities), countermeasures such as scanners and anti-malware, malicious activity (insider threats, data theft, DDoS, botnets, zero-day exploits, web-based attacks and APTs), social engineering methods (spam, phishing, smishing, vishing, impersonation, scarcity and whaling), and behavior analytics using machine learning, AI and data analytics.
- What to understand
- Viruses need a host and user action, worms spread on their own, trojans disguise themselves as legitimate software, and rootkits hide at deep system levels. Fileless malware lives in memory and legitimate tools, so signature scanning often misses it. Behavior analytics detect unusual activity that signatures cannot.
- How it shows up
- Behavior is described and you must identify the malware type or attack, or choose the most effective countermeasure.
- Common confusion
- Mixing up viruses and worms. A worm self-propagates across networks without user action, while a virus attaches to files and needs execution.
7.2 Implement and operate endpoint device securityHIDS, HIPS, host firewalls, allowlisting, encryption, TPM, secure browsing and EDR.
- What it means
- Endpoint security uses host-based intrusion detection (HIDS) and prevention (HIPS), host-based firewalls, application allowlisting, endpoint encryption such as full disk encryption, the Trusted Platform Module (TPM), secure browsing with digital certificates, and endpoint detection and response (EDR).
- What to understand
- Allowlisting permits only approved software, which blocks unknown malware but needs maintenance. Full disk encryption protects data on lost or stolen devices, often using the TPM to protect keys and check boot integrity. EDR records endpoint activity continuously and supports investigation and response, going beyond traditional antivirus.
- How it shows up
- Questions ask for the BEST control against unknown executables, for protecting data on a stolen laptop, or for investigating an endpoint compromise.
- Common confusion
- Expecting full disk encryption to protect a running, logged-in device. It protects data at rest when the device is off or locked.
7.3 Administer and manage mobile devicesProvisioning models, containerization, encryption and mobile application management.
- What it means
- Mobile device administration covers provisioning models such as corporate-owned, personally enabled (COPE) and bring your own device (BYOD), mobile device management (MDM), containerization to separate work and personal data, device encryption, and mobile application management (MAM).
- What to understand
- COPE gives the organization more control because it owns the device. BYOD raises privacy concerns, so containerization and MAM are often preferred to full device control. Remote wipe should be scoped to corporate data on personal devices.
- How it shows up
- Questions describe an ownership model and a privacy or control requirement and ask for the BEST management approach.
- Common confusion
- Assuming MDM and MAM are the same. MDM manages the whole device, and MAM manages specific corporate applications and their data.
7.4 Understand and configure cloud securityDeployment and service models, virtualization, legal concerns, storage, third parties and shared responsibility.
- What it means
- Cloud security covers deployment models (public, private, hybrid, community), service models (IaaS, PaaS, SaaS), virtualization including hypervisors and virtual private clouds, legal and regulatory concerns such as privacy, surveillance, data ownership, jurisdiction, eDiscovery and shadow IT, data storage, processing and transmission including backup and resilience, third-party requirements such as SLAs, portability, privacy, destruction and auditing, and the shared responsibility model.
- What to understand
- Responsibility shifts with the service model. In IaaS the customer secures the operating system, applications and data, and in SaaS mainly users, access and data. The customer always remains responsible for its data and access decisions. Shadow IT creates cloud use that security does not know about.
- How it shows up
- Questions ask who is responsible for patching, data protection or access in a given model, or what risk unsanctioned cloud services create.
- Common confusion
- Assuming the provider handles all security in SaaS. Configuration of sharing and access remains the customer's job.
7.5 Operate and maintain secure virtual environmentsHypervisors, virtual appliances, containers, resilience, storage and threats.
- What it means
- Virtual environment security covers Type 1 (bare-metal) and Type 2 (hosted) hypervisors, virtual appliances, containers, continuity and resilience, storage management, and threats and countermeasures such as brute-force attacks, virtual machine escape and threat hunting.
- What to understand
- Type 1 hypervisors have a smaller attack surface and are used for production. VM escape lets an attacker break out of a guest to the host, threatening every other guest, so hypervisor patching and isolation are critical. Containers share the host kernel, so they isolate less strongly than virtual machines. VM sprawl creates unmanaged, unpatched machines.
- How it shows up
- Questions ask which hypervisor type suits production, what VM escape threatens, or how containers differ from virtual machines in isolation.
- Common confusion
- Treating containers as fully isolated virtual machines. Containers share the host kernel, so a kernel vulnerability can affect them all.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Virus vs. worm vs. trojan
A virus attaches to files and needs execution. A worm self-propagates. A trojan disguises itself as legitimate software.
- Remember
- Worms spread without user action.
- Tested as
- Malware identification.
- Trap
- Calling a self-spreading threat a virus.
-
Rootkit
Malware that hides itself and gains privileged access at a deep system level.
- Remember
- Detection may need offline scanning or rebuilding from known-good media.
- Tested as
- Malware identification.
- Trap
- Trusting the infected operating system to report on itself.
-
Fileless malware
Malware that runs in memory and abuses legitimate tools without writing files.
- Remember
- Signature scanning often misses it, so behavior analytics and EDR help.
- Tested as
- Detection questions.
- Trap
- Relying on file-based antivirus alone.
-
Social engineering variants
Phishing uses email, smishing uses SMS, vishing uses voice, and whaling targets executives.
- Remember
- Urgency and scarcity are common pressure tactics.
- Tested as
- Attack identification.
- Trap
- Confusing spear phishing with whaling.
-
HIDS vs. HIPS
A HIDS detects and alerts on host activity. A HIPS can block it.
- Remember
- Prevention needs HIPS or another blocking control.
- Tested as
- Endpoint control selection.
- Trap
- Expecting a HIDS to stop an attack.
-
Application allowlisting
Only approved software is allowed to run.
- Remember
- It blocks unknown malware that signature tools miss, but needs maintenance.
- Tested as
- Unknown malware questions.
- Trap
- Choosing signature-based antivirus for zero-day threats.
-
EDR
Endpoint detection and response records endpoint activity and supports detection, investigation and response.
- Remember
- It goes beyond antivirus by capturing behavior over time.
- Tested as
- Investigation questions.
- Trap
- Treating it as a simple antivirus replacement.
-
Full disk encryption and TPM
FDE encrypts the whole drive. The TPM protects keys and checks boot integrity.
- Remember
- FDE protects data at rest, mainly on lost or stolen devices.
- Tested as
- Device loss questions.
- Trap
- Expecting it to protect a running, unlocked device.
-
MDM vs. MAM
MDM manages the whole device. MAM manages corporate apps and their data.
- Remember
- MAM with containerization suits BYOD privacy concerns.
- Tested as
- Mobile management questions.
- Trap
- Choosing full MDM for personal devices where privacy matters.
-
COPE vs. BYOD
COPE devices are owned by the company and allow personal use. BYOD devices are owned by employees.
- Remember
- Ownership drives how much control and monitoring is appropriate.
- Tested as
- Provisioning questions.
- Trap
- Applying COPE-level control to BYOD.
-
Shared responsibility
Cloud security duties are split between provider and customer according to the service model.
- Remember
- The customer always owns its data, identities and access decisions.
- Tested as
- Cloud questions.
- Trap
- Assuming SaaS needs no customer configuration.
-
VM escape
An attack that breaks out of a guest virtual machine to the hypervisor or host.
- Remember
- It threatens every guest on the host, so patch and isolate hypervisors.
- Tested as
- Virtualization threat questions.
- Trap
- Treating it as a single-VM issue.
-
Containers vs. virtual machines
Containers share the host kernel. Virtual machines each run their own operating system on a hypervisor.
- Remember
- Virtual machines provide stronger isolation.
- Tested as
- Isolation questions.
- Trap
- Assuming containers isolate as strongly as VMs.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
HIDS vs. HIPS vs. EDR vs. allowlisting
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| HIDS | Detects suspicious activity on a host | Alerts only | Expecting it to block |
| HIPS | Detects and blocks suspicious host activity | Prevents in real time | Deploying untuned and blocking legitimate tools |
| EDR | Records endpoint behavior and supports investigation and response | Visibility over time plus response actions | Treating it as basic antivirus |
| Application allowlisting | Allows only approved programs to run | Blocks unknown software by default | Neglecting maintenance as software changes |
MDM vs. MAM vs. containerization
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| MDM | Management of the whole device | Full control, including device wipe | Using it on personal devices where privacy matters |
| MAM | Management of corporate apps and their data | Controls only work applications | Expecting it to enforce device-wide settings |
| Containerization | A separate encrypted workspace for corporate data | Isolates work from personal data | Assuming it protects personal apps |
Type 1 vs. Type 2 hypervisor vs. containers
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Type 1 hypervisor | Runs directly on hardware | Smaller attack surface, used in production | Choosing Type 2 for servers |
| Type 2 hypervisor | Runs on a host operating system | Larger attack surface, suits desktops and testing | Using it for multi-tenant production |
| Containers | Isolated processes sharing the host kernel | Lightweight with weaker isolation than VMs | Assuming VM-level isolation |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Antivirus for zero-days
- What candidates pick
- Update antivirus signatures to stop unknown malware.
- Why it looks right
- Antivirus is the familiar malware control.
- Why it's wrong
- Signatures only catch known threats. Application allowlisting, behavior analytics and EDR address unknown and fileless malware.
Clue to watch for The threat is new, unknown or fileless.
-
HIDS to prevent
- What candidates pick
- Install a HIDS to stop malicious changes on a server.
- Why it looks right
- It is a host-based intrusion control.
- Why it's wrong
- A HIDS detects and alerts. Prevention needs a HIPS or other blocking control.
Clue to watch for The requirement says prevent or block.
-
MDM on personal phones
- What candidates pick
- Enroll all employee-owned phones in full MDM with device wipe.
- Why it looks right
- It gives maximum control.
- Why it's wrong
- It intrudes on personal data and staff often resist it. MAM with containerization protects corporate data while respecting privacy.
Clue to watch for The devices are personally owned and privacy is mentioned.
-
Provider secures SaaS
- What candidates pick
- Rely on the SaaS provider to prevent users sharing files publicly.
- Why it looks right
- The provider runs the application.
- Why it's wrong
- Sharing settings and access decisions are the customer's responsibility under shared responsibility.
Clue to watch for The scenario involves user permissions or data exposure in a SaaS tool.
-
Containers as VMs
- What candidates pick
- Run untrusted workloads in containers for the same isolation as virtual machines.
- Why it looks right
- Containers are lightweight and isolated.
- Why it's wrong
- Containers share the host kernel, so isolation is weaker. Virtual machines provide stronger separation.
Clue to watch for The workloads are untrusted or from different tenants.
-
Ask the infected system
- What candidates pick
- Run a scan on the suspected rootkit-infected system to confirm it is clean.
- Why it looks right
- Scanning is the normal way to find malware.
- Why it's wrong
- A rootkit can hide from the infected operating system. Offline scanning or rebuilding from known-good media is safer.
Clue to watch for The scenario mentions a rootkit or suspicion of a deep compromise.
Answer framework
For any Domain 7 scenario, work through these steps before choosing an answer.
- Identify the platform involved, whether an endpoint, a mobile device, a cloud service or a virtual environment, because the available controls differ for each.
- If malicious activity is described, classify it by behavior, such as self-spreading, hiding, disguised or memory-only, before choosing a response.
- Decide whether the requirement is to detect, to prevent or to investigate, and choose HIDS, HIPS, allowlisting or EDR to match.
- For mobile and cloud scenarios, check ownership and the service model to decide what the organization may control and what it must secure itself.
- For virtual environments, protect the hypervisor and host first, since a compromise there affects every guest machine and container.
Practice question
Want more like this? The SSCP practice test has questions for every domain.
Checklist
0 of 13
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with 7.1, because malware and social engineering identification produces many quick questions. Build a table of malware types by behavior, and practice identifying them from descriptions. Then add the social engineering variants and the role of behavior analytics.
Next, study endpoint security in 7.2. Focus on what each control does: detect, prevent, record or restrict. Most errors come from choosing a detection tool when prevention is required, or the reverse.
Then cover mobile devices in 7.3 and cloud security in 7.4 together, since both turn on who owns and controls what. Candidates commonly underestimate the legal and third-party items in 7.4, such as jurisdiction, eDiscovery, shadow IT and SLAs. Finish with virtual environments in 7.5, especially hypervisor types, VM escape and container isolation.
Afterwards, take mixed practice with Domains 3 and 4, since endpoint and malware scenarios lead into monitoring and incident response. Review every missed question by naming the exact distinction you got wrong.
FAQ
How much of the SSCP exam is Domain 7?
Systems and Application Security carries 15% under the outline effective 1 October 2025.
What is the difference between a virus and a worm?
A virus attaches to a host file and needs execution to spread. A worm spreads across networks by itself without user action.
Why is EDR emphasized over antivirus?
EDR records endpoint behavior over time, so it can detect and help investigate threats such as fileless malware that leave no files for antivirus to find.
Should personal phones be enrolled in MDM?
Often not fully. For BYOD, mobile application management with a work container protects corporate data while respecting personal privacy.
Who is responsible for security in the cloud?
Both provider and customer, split according to the service model. The customer always remains responsible for its data, identities and access decisions.
Are containers as secure as virtual machines?
Containers isolate less strongly because they share the host kernel. Virtual machines each run their own operating system on a hypervisor.
How does Domain 7 relate to Domain 3?
Endpoints, mobile devices and cloud workloads generate many of the events monitored and analyzed in Domain 3.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 7 knowledge
You have covered malware and social engineering, endpoint and mobile security, cloud responsibility and virtual environments. Test whether you can choose the right control for each platform under exam conditions.