CISSP Dumps To Pass ISC Exam in 24 Hours – It-Tests
Buy Latest CISSP Exam Q&A PDF – One Year Free Update
ISC2 CISSP Exam Syllabus Topics:
| Topic | Details |
Security and Risk Management – 15% |
|
| Understand, adhere to, and promote professional ethics | – (ISC)2 Code of Professional Ethics – Organizational code of ethics |
| Understand and apply security concepts | – Confidentiality, integrity, and availability, authenticity and nonrepudiation |
| Evaluate and apply security governance principles | – Alignment of the security function to business strategy, goals, mission, and objectives – Organizational processes (e.g., acquisitions, divestitures, governance committees) – Organizational roles and responsibilities – Security control frameworks – Due care/due diligence |
| Determine compliance and other requirements | – Contractual, legal, industry standards, and regulatory requirements – Privacy requirements |
| Understand legal and regulatory issues that pertain to information security in a holistic context | – Cybercrimes and data breaches – Licensing and Intellectual Property (IP) requirements – Import/export controls – Transborder data flow – Privacy |
| Understand requirements for investigation types (i.e., administrative, criminal, civil, regulatory, industry standards) | |
| Develop, document, and implement security policy, standards, procedures, and guidelines | |
| Identify, analyze, and prioritize Business Continuity (BC) requirements | – Business Impact Analysis (BIA) – Develop and document the scope and the plan |
| Contribute to and enforce personnel security policies and procedures | – Candidate screening and hiring – Employment agreements and policies – Onboarding, transfers, and termination processes – Vendor, consultant, and contractor agreements and controls – Compliance policy requirements – Privacy policy requirements |
| Understand and apply risk management concepts | – Identify threats and vulnerabilities – Risk assessment/analysis – Risk response – Countermeasure selection and implementation – Applicable types of controls (e.g., preventive, detective, corrective) – Control assessments (security and privacy) – Monitoring and measurement – Reporting – Continuous improvement (e.g., Risk maturity modeling) – Risk frameworks |
| Understand and apply threat modeling concepts and methodologies | |
| Apply Supply Chain Risk Management (SCRM) concepts | – Risks associated with hardware, software, and services – Third-party assessment and monitoring – Minimum security requirements – Service level requirements |
| Establish and maintain a security awareness, education, and training program | – Methods and techniques to present awareness and training (e.g., social engineering, phishing, security champions, gamification) – Periodic content reviews – Program effectiveness evaluation |
Asset Security – 10% |
|
| Identify and classify information and assets | – Data classification – Asset Classification |
| Establish information and asset handling requirements | |
| Provision resources securely | – Information and asset ownership – Asset inventory (e.g., tangible, intangible) – Asset management |
| Manage data lifecycle | – Data roles (i.e., owners, controllers, custodians, processors, users/subjects) – Data collection – Data location – Data maintenance – Data retention – Data remanence – Data destruction |
| Ensure appropriate asset retention (e.g., End-of-Life (EOL), End-of-Support (EOS)) | |
| Determine data security controls and compliance requirements | – Data states (e.g., in use, in transit, at rest) – Scoping and tailoring – Standards selection – Data protection methods (e.g., Digital Rights Management (DRM), Data Loss Prevention (DLP), Cloud Access Security Broker (CASB)) |
Security Architecture and Engineering – 13% |
|
| Research, implement and manage engineering processes using secure design principles | – Threat modeling – Least privilege – Defense in depth – Secure defaults – Fail securely – Separation of Duties (SoD) – Keep it simple – Zero Trust – Privacy by design – Trust but verify – Shared responsibility |
| Understand the fundamental concepts of security models (e.g., Biba, Star Model, Bell-LaPadula) | |
| Select controls based upon systems security requirements | |
| Understand security capabilities of information systems (IS) (e.g., memory protection, Trusted Platform Module (TPM), encryption/decryption) | |
| Assess and mitigate the vulnerabilities of security architectures, designs, and solution elements | – Client-based systems – Server-based systems – Database systems – Cryptographic systems – Industrial Control Systems (ICS) – Cloud-based systems (e.g., Software as a Service (SaaS), Infrastructure as a Service (IaaS), Platform as a Service (PaaS)) – Distributed systems – Internet of Things (IoT) – Microservices – Containerization – Serverless – Embedded systems – High-Performance Computing (HPC) systems – Edge computing systems – Virtualized systems |
| Select and determine cryptographic solutions | – Cryptographic life cycle (e.g., keys, algorithm selection) – Cryptographic methods (e.g., symmetric, asymmetric, elliptic curves, quantum) – Public Key Infrastructure (PKI) – Key management practices – Digital signatures and digital certificates – Non-repudiation – Integrity (e.g., hashing) |
| Understand methods of cryptanalytic attacks | – Brute force – Ciphertext only – Known plaintext – Frequency analysis – Chosen ciphertext – Implementation attacks – Side-channel – Fault injection – Timing – Man-in-the-Middle (MITM) – Pass the hash – Kerberos exploitation – Ransomware |
| Apply security principles to site and facility design | |
| Design site and facility security controls | – Wiring closets/intermediate distribution facilities – Server rooms/data centers – Media storage facilities – Evidence storage – Restricted and work area security – Utilities and Heating, Ventilation, and Air Conditioning (HVAC) – Environmental issues – Fire prevention, detection, and suppression – Power (e.g., redundant, backup) |
Communication and Network Security – 13% |
|
| Assess and implement secure design principles in network architectures | – Open System Interconnection (OSI) and Transmission Control Protocol/Internet Protocol (TCP/IP) models – Internet Protocol (IP) networking (e.g., Internet Protocol Security (IPSec), Internet Protocol (IP) v4/6) – Secure protocols – Implications of multilayer protocols – Converged protocols (e.g., Fiber Channel Over Ethernet (FCoE), Internet Small Computer Systems Interface (iSCSI), Voice over Internet Protocol (VoIP)) – Micro-segmentation (e.g., Software Defined Networks (SDN), Virtual eXtensible Local Area Network (VXLAN), Encapsulation, Software-Defined Wide Area Network (SD WAN)) – Wireless networks (e.g., Li-Fi, Wi-Fi, Zigbee, satellite) – Cellular networks (e.g., 4G, 5G) – Content Distribution Networks (CDN) |
| Secure network components | – Operation of hardware (e.g., redundant power, warranty, support) – Transmission media – Network Access Control (NAC) devices – Endpoint security |
| Implement secure communication channels according to design | – Voice – Multimedia collaboration – Remote access – Data communications – Virtualized networks – Third-party connectivity |
Identity and Access Management (IAM) – 13% |
|
| Control physical and logical access to assets | – Information – Systems – Devices – Facilities – Applications |
| Manage identification and authentication of people, devices, and services | – Identity Management (IdM) implementation – Single/multi-factor authentication (MFA) – Accountability – Session management – Registration, proofing, and establishment of identity – Federated Identity Management (FIM) – Credential management systems – Single Sign On (SSO) – Just-In-Time (JIT) |
| Federated identity with a third-party service | – On-premise – Cloud – Hybrid |
| Implement and manage authorization mechanisms | – Role Based Access Control (RBAC) – Rule based access control – Mandatory Access Control (MAC) – Discretionary Access Control (DAC) – Attribute Based Access Control (ABAC) – Risk based access control |
| Manage the identity and access provisioning lifecycle | – Account access review (e.g., user, system, service) – Provisioning and deprovisioning (e.g., on /off boarding and transfers) – Role definition (e.g., people assigned to new roles) – Privilege escalation (e.g., managed service accounts, use of sudo, minimizing its use) |
| Implement authentication systems | – OpenID Connect (OIDC)/Open Authorization (Oauth) – Security Assertion Markup Language (SAML) – Kerberos – Remote Authentication Dial-In User Service (RADIUS)/Terminal Access Controller Access Control System Plus (TACACS+) |
Security Assessment and Testing – 12% |
|
| Design and validate assessment, test, and audit strategies | – Internal – External – Third-party |
| Conduct security control testing | – Vulnerability assessment – Penetration testing – Log reviews – Synthetic transactions – Code review and testing – Misuse case testing – Test coverage analysis – Interface testing – Breach attack simulations – Compliance checks |
| Collect security process data (e.g., technical and administrative) | – Account management – Management review and approval – Key performance and risk indicators – Backup verification data – Training and awareness – Disaster Recovery (DR) and Business Continuity (BC) |
| Analyze test output and generate report | – Remediation – Exception handling – Ethical disclosure |
| Conduct or facilitate security audits | – Internal – External – Third-party |
Security Operations – 13% |
|
| Understand and comply with investigations | – Evidence collection and handling – Reporting and documentation – Investigative techniques – Digital forensics tools, tactics, and procedures – Artifacts (e.g., computer, network, mobile device) |
| Conduct logging and monitoring activities | – Intrusion detection and prevention – Security Information and Event Management (SIEM) – Continuous monitoring – Egress monitoring – Log management – Threat intelligence (e.g., threat feeds, threat hunting) – User and Entity Behavior Analytics (UEBA) |
| Perform Configuration Management (CM) (e.g., provisioning, baselining, automation) | |
| Apply foundational security operations concepts | – Need-to-know/least privilege – Separation of Duties (SoD) and responsibilities – Privileged account management – Job rotation – Service Level Agreements (SLAs) |
| Apply resource protection | – Media management – Media protection techniques |
| Conduct incident management | – Detection – Response – Mitigation – Reporting – Recovery – Remediation – Lessons learned |
| Operate and maintain detective and preventative measures | – Firewalls (e.g., next generation, web application, network) – Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) – Whitelisting/blacklisting – Third-party provided security services – Sandboxing – Honeypots/honeynets – Anti-malware – Machine learning and Artificial Intelligence (AI) based tools |
| Implement and support patch and vulnerability management | |
| Understand and participate in change management processes | |
| Implement recovery strategies | – Backup storage strategies – Recovery site strategies – Multiple processing sites – System resilience, High Availability (HA), Quality of Service (QoS), and fault tolerance |
| Implement Disaster Recovery (DR) processes | – Response – Personnel – Communications – Assessment – Restoration – Training and awareness – Lessons learned |
Download the Latest CISSP Dump – 2023 CISSP Exam Question Bank: https://www.it-tests.com/CISSP.html
Related Links: fortunetelleroracle.com www.stes.tyc.edu.tw www.stes.tyc.edu.tw learn.csisafety.com.au www.stes.tyc.edu.tw www.stes.tyc.edu.tw