SABSA Chartered Foundation (SCF) Certification Practice Exam

What Is the SABSA Chartered Foundation (SCF) Certificate?

SCF is the entry level of the SABSA certification path. SABSA is a business-driven framework for enterprise security architecture: instead of starting with firewalls and tools, it starts with what the business needs, the risks to those needs, and then traces every security control back to a real requirement.

If you’ve ever had to justify a security investment to a board, SABSA’s approach will feel familiar. SCF proves you understand the framework well enough to use its language and models on real projects.

How Do You Earn SCF?

1. Attend an official SABSA Foundation course through an Accredited Education Provider.
2. Pass two exams: F1 and F2.

SABSA F1 and F2 Exam Format

75% is a high bar, and you need it on both modules. You can’t make up a weak F2 with a strong F1.

What Does the SCF Syllabus Cover?

• The SABSA Matrix: the six layers (Contextual, Conceptual, Logical, Physical, Component, Service Management) and the six questions (What, Why, How, Who, Where, When).
• Business Attributes Profiling: turning business goals into measurable security attributes. This is the heart of SABSA.
• Risk and opportunity management: SABSA treats risk as having an upside, not just threats to block.
• Traceability: linking every control back to a business requirement, and forward to how it’s measured.
• Security services and governance: policy architecture, domains, trust and the service management layer.
• Lifecycle: strategy and planning, design, implement, manage and measure.

Who Should Take SCF?

Security architects, enterprise architects working with TOGAF, senior security consultants, CISOs and risk managers. It’s also useful for anyone who needs to talk about security in business terms. Holders of CISSP or similar often add SCF to show architecture depth.

How to Prepare for SABSA F1 and F2

1. Learn the Matrix cold. Be able to say what lives in any cell without looking.
2. Practice attribute profiling on a business you know. It makes the abstract parts click.
3. Read questions slowly. SABSA questions often hinge on one word: “contextual” versus “conceptual”, “risk” versus “opportunity”.
4. Use the official terminology. The exam rewards SABSA’s exact vocabulary, not general security language.
5. Time yourself. 48 questions in 60 minutes is about 75 seconds each.

Common SCF Mistakes

• Answering from general security experience instead of the SABSA framework
• Confusing the Logical and Physical layers
• Treating business attributes as technical requirements
• Under-preparing for F2 after a comfortable F1

Where SCF Sits in the SABSA Path

SCF is the entry tier of the SABSA certification scheme run by The SABSA Institute. After it comes SABSA Chartered Practitioner (SCP), which goes deeper into applying the framework to real architectures. At the top is SABSA Chartered Master (SCM), awarded for proven expert practice. SCF shows you understand the method, while the higher tiers show you can use it.

Most candidates prepare through an accredited SABSA Foundation course, then sit the Foundation exams. The material rewards understanding over memorisation. Learn how the SABSA matrix links business attributes to security services, and how traceability runs from business drivers down to components. If you already work with enterprise architecture frameworks such as TOGAF, map the SABSA layers to what you know, because the two are often used together.

Related Practice Exams

• SABSA Chartered Practitioner (SCP)
• TOGAF Enterprise Architecture Practitioner 9.2

What’s in the CertsArea SABSA SCF Practice Pack?

• 300 practice questions with explanations covering F1 and F2 topics
• PDF plus practice test software for Windows, Mac and mobile
• Free updates for 180 days and instant download

Use it after your official course to test recall of the Matrix, attributes and lifecycle under time pressure.

What Comes After SCF?

SCF is the prerequisite for SABSA Chartered Practitioner (SCP), which requires an Advanced course and an assignment-based exam. After SCP comes SABSA Chartered Master (SCM), which adds a second Advanced module and a thesis.

Frequently Asked Questions About SABSA SCF

How many exams are needed for SCF?

Two: F1 and F2.

What’s the pass mark?

75% or higher in each module.

How long is each SABSA Foundation exam?

60 minutes for 48 multiple-choice questions, with 15 extra minutes available for non-native English speakers.

Do I have to attend a course?

Yes. SCF requires an official Foundation course through an accredited provider.

Is SABSA the same as TOGAF?

No. TOGAF is a general enterprise architecture framework; SABSA focuses on security architecture. They’re often used together.

Is SCF worth it?

If you design or approve security architecture, it gives you a recognised method and vocabulary that business stakeholders understand.