ISC2 Certified Information Systems Security Professional (CISSP) (2024) Cert Prep

Overview of the CISSP exam scope, purpose, and candidate considerations.

Explains registration, exam environment, question types, and computerized adaptive testing.

Practical study tips and recommendations for practice tests to ready candidates.

Describes professional experience, endorsement, and continuing education requirements for CISSP.

Introduces the Security and Risk Management domain and its key themes.

Covers core principles such as the five pillars of information security and related concepts.

Examines alignment of security with business objectives and organizational control frameworks.

Addresses legal, privacy, and ethical issues including GDPR and other data-protection topics.

Discusses security policy frameworks and how to craft and manage security policies.

Covers business continuity planning, high availability, and fault-tolerance strategies.

Reviews hiring, termination, privacy, and personnel-related security controls.

Explains risk analysis, quantitative assessment, treatment, and continuous monitoring processes.

Introduces threat intelligence, hunting, and methods for identifying and modeling threats.

Covers vendor management, agreements, and cloud-audit considerations for supply-chain risks.

Focuses on designing and measuring security awareness and compliance training programs.

Introduces the Asset Security domain and principles for protecting information assets.

Explores data security policies, roles, lifecycle, and limits on data collection.

Discusses baselines, standards, cloud storage security, classification, and DLP techniques.

Covers change-management processes, configuration controls, and physical asset handling.

Introduces security architecture and engineering principles for secure systems design.

Reviews secure-design principles, models, secure defaults, and privacy-by-design concepts.

Explains cloud concepts, deployment and service models, virtualization, and containerization security.

Covers hardware and firmware protections, memory protection, and hardware encryption topics.

Addresses server and database security, NoSQL considerations, and distributed computing risks.

Discusses IoT and industrial control security, securing smart and embedded devices.

Introduces cryptographic goals, algorithms, and the cryptographic lifecycle.

Covers symmetric algorithms, modes, and historical ciphers such as DES and AES families.

Explains RSA, PGP/GnuPG, elliptic-curve topics and considerations for quantum threats.

Discusses key exchange, escrow, stretching, and hardware security modules for key lifecycle management.

Covers PKI concepts, certificates, authorities, signing, and revocation mechanics.

Reviews attack types against cryptography including brute-force, implementation, and eavesdropping attacks.

Discusses site design, environmental controls, access control, and data-center protections.

Introduces architectural topics such as SOAP/REST, SOA, and microservices security considerations.

Introduces network and communication security domain concepts and scope.

Covers TCP/IP fundamentals, addressing, DNS, ports, ICMP, and multilayer protocols.

Explores secure network architectures, segmentation, VLANs, security zones, and device placement.

Reviews routers, firewalls, IDS/IPS, VPNs, proxies, load balancers, and related devices.

Covers access restriction, firewall rule management, monitoring, logging, and availability practices.

Addresses telephony, multimedia collaboration, and storage-network security topics.

Explains TLS/SSL, IPsec, and secure remote access mechanisms.

Covers wireless fundamentals, encryption, authentication, and signal propagation considerations.

Discusses mobile MDM, tracking, app security, BYOD, and deployment models.

Covers OS security, malware prevention, application management, and host-based controls.

Introduces IAM concepts and scope within CISSP.

Discusses identification processes including identity proofing and biometric considerations.

Covers authentication factors, MFA, protocols like Kerberos/LDAP, SAML, OAuth, and passwordless methods.

Examines session management, logging, and accountability mechanisms for user actions.

Covers provisioning, deprovisioning, password policies, roles, and account-monitoring practices.

Explains access control models, ACLs, database access controls, and advanced authorization concepts.

Reviews social-engineering vectors, impersonation, identity fraud, and physical social engineering tactics.

Introduces assessment and testing practices for identifying security weaknesses.

Explains vulnerability-management concepts, scan configuration, and report analysis.

Covers pen-testing methodology, ethical disclosure, bug-bounty programs, and exercises.

Discusses logging, SIEM, continuous monitoring, and endpoint telemetry review.

Covers code review, fuzz testing, test coverage, and interface and misuse-case testing.

Addresses backups, recovery sites, testing BC/DR plans, and after-action reporting.

Covers collecting process data, audits, metrics, and control-management review procedures.

Introduces operations topics including monitoring, response, and operational controls.

Reviews forensic processes, types of evidence, network and file forensics, and chain-of-custody.

Discusses least-privilege models and privileged-account management practices.

Outlines building incident-response programs, identification, escalation, containment, and recovery steps.

Covers emergency management and personnel safety considerations during operations and incidents.

Introduces application and development security topics and their role in CISSP.

Covers development methodologies, SDLC models, automation, and DevOps security concerns.

Reviews common application attacks including OWASP Top Ten and prevention techniques.

Covers input validation, parameterized queries, output encoding, and secure error-handling practices.

Final guidance on preparing for the exam and suggested next steps for study.