Printable reviewEight domainsCurrent reviewed track

CISSP cram sheet

Use this as a last-mile reasoning guide after full study. It condenses the distinctions, ownership rules, lifecycle ideas, and cross-domain patterns that commonly separate a good security answer from the best one.

Independent Zeph Tech study material. Not affiliated with or endorsed by ISC2. No recalled, leaked, copied, or live-exam questions.

Study guidePractice test
Current reviewed record

Check the official exam facts before exam day.

Use the registry summary for current timing, item policy, domain weights, experience rules, maintenance requirements, and official owner links. Do not rely on older CISSP pages that still describe previous CAT limits or previous domain weights.

Active

  • Exam: CISSP
  • Version: current outline effective April 15, 2024
  • Questions: 100–150 items
  • Item types: multiple-choice, advanced item types
  • Time: 180 minutes
  • Passing score: 700 out of 1000 points
  • Recommended background: Designed for experienced security practitioners, managers, architects, engineers, and leaders working across multiple security domains.
  • Renewal: Three-year certification cycle with 120 CPE credits required; ISC2 members holding CISSP currently pay a single U.S. $135 annual maintenance fee.

Last verified: 2026-10-01

Next review: 2026-11-01

Official certification page · Official exam objectives

Published domain weighting

  • Security and Risk Management16%
  • Asset Security10%
  • Security Architecture and Engineering13%
  • Communication and Network Security13%
  • Identity and Access Management (IAM)13%
  • Security Assessment and Testing12%
  • Security Operations13%
  • Software Development Security10%

Domain 1 — Security and Risk Management

  • Risk = asset + threat + vulnerability + likelihood + impact + context.
  • Business/risk owner accepts residual risk; security advises and implements.
  • Policy = direction; standard = mandatory requirement; procedure = steps; guideline = recommendation.
  • Due care = reasonable protective action; due diligence = ongoing effort to understand and manage risk.
  • BC keeps critical functions operating; DR restores technology and support services.
  • RTO = restoration time target; RPO = acceptable data-loss window in time.
  • Supply-chain risk remains an organizational governance responsibility even when operations are outsourced.

Domain 2 — Asset Security

  • Owner determines business classification and acceptable use; custodian implements handling controls.
  • Protect data through creation, use, sharing, storage, retention, archive, and disposal.
  • Minimize collection and retention when business or legal need does not justify more.
  • Masking, tokenization, encryption, anonymization, and access control solve different exposure problems.
  • Sanitization method must match media, sensitivity, reuse plans, and threat model.
  • Privacy includes purpose, lawful use, minimization, retention, rights, and transparency—not only secrecy.

Domain 3 — Architecture and Engineering

  • Design principles: least privilege, defense in depth, secure defaults, fail-safe behavior, isolation, separation of duties.
  • Bell-LaPadula emphasizes confidentiality; Biba emphasizes integrity.
  • Encryption is only as trustworthy as keys, implementation, access, rotation, revocation, and recovery.
  • Digital signatures can support integrity, origin authentication, and non-repudiation when validation is trustworthy.
  • Trace shared dependencies before calling a design redundant.
  • Cloud, containers, serverless, virtualization, IoT, ICS, and distributed systems change boundaries but not core security principles.

Domain 4 — Communication and Network Security

  • Segmentation reduces reachable attack paths and blast radius.
  • TLS protects a channel; it does not prove the endpoint, user, or application authorization is trustworthy.
  • VPN protects transport but may extend attacker reach if the endpoint or identity is compromised.
  • Identify the failing layer: physical, link, addressing, routing, DNS, transport, TLS, identity, application.
  • Network location alone is weak authorization; combine identity, device/workload context, and policy where appropriate.
  • Remote and wireless access need authentication, encryption, monitoring, configuration, and lifecycle control.

Domain 5 — IAM

  • Authentication = who; authorization = what they may do; accounting = what happened.
  • Least privilege limits permissions and duration to business need.
  • Separation of duties splits sensitive authority across identities.
  • RBAC maps permissions to roles; ABAC evaluates attributes and context.
  • Federation transfers identity assertions, not unlimited authorization.
  • Joiner/mover/leaver lifecycle prevents stale and excessive access.
  • Privileged access: stronger MFA, dedicated admin identities, just-in-time elevation, approval, logging, vaulting, break-glass controls.

Domain 6 — Assessment and Testing

  • Choose the test based on the assurance question.
  • Vulnerability assessment identifies weaknesses; penetration testing attempts controlled exploitation.
  • SAST inspects source/bytecode; DAST observes running behavior; SCA focuses on dependencies/components.
  • Testing requires authorization, scope, rules of engagement, data handling, and escalation.
  • Activity count is not effectiveness. Prefer coverage, recurrence, remediation time, verified control performance, and material risk reduction.
  • Independence improves assurance when the evaluator should not assess their own work.

Domain 7 — Security Operations

  • Incident flow: preparation → detection/analysis → containment → eradication → recovery → improvement.
  • Containment limits damage; eradication removes cause/persistence; recovery returns trusted service.
  • Preserve chain of custody and distinguish fact from hypothesis.
  • Change management protects reliability with approval, testing, rollback, monitoring, and evidence.
  • Secure baselines make unauthorized or accidental drift visible.
  • Backups matter only if restoration meets business objectives and is tested.
  • Logging must have useful sources, reliable time, protected access, retention, and review.

Domain 8 — Software Development Security

  • Security begins with requirements and architecture, not the final scan.
  • Threat-model code, APIs, dependencies, CI/CD, secrets, builds, deployment, and operations.
  • Protect repositories, build systems, signing keys, package sources, and deployment credentials.
  • No single testing technique proves software is secure; combine complementary methods.
  • Secure coding includes input handling, authorization, secrets, error handling, dependency hygiene, and safe defaults.
  • AI-generated code still requires review, testing, provenance awareness, and normal SDLC controls.

High-value distinctions

Risk owner vs security practitioner: security identifies, analyzes, recommends, implements, and monitors. An accountable business owner accepts residual risk because acceptance is a business decision.

Authentication vs authorization: successful login only establishes identity. The resource-owning service must still enforce what that identity is permitted to do.

Due care vs due diligence: due care is taking reasonable protective action; due diligence is the continuing effort to understand whether protections remain appropriate and effective.

BC vs DR: business continuity sustains critical business functions; disaster recovery restores technology and supporting capabilities. A continuity strategy can include manual workarounds while technology is unavailable.

RTO vs RPO: RTO measures the restoration-time objective. RPO measures the acceptable data-loss interval. A backup frequency that cannot meet RPO is insufficient even if restoration is fast.

Preventive vs detective vs corrective: preventive controls attempt to stop an event, detective controls reveal it, and corrective controls restore or fix conditions. One technology can serve multiple purposes depending on implementation.

Vulnerability assessment vs penetration test: an assessment identifies weaknesses broadly; a penetration test attempts controlled exploitation to demonstrate attack paths and impact within authorization.

Containment vs eradication vs recovery: containment limits attacker capability, eradication removes root cause or persistence, and recovery restores systems to trusted service and verifies normal operation.

Scenario decision checklist

Before choosing an answer, identify the asset, the business objective, the decision owner, the current lifecycle stage, the available evidence, and the constraint introduced by words such as FIRST, BEST, MOST, PRIMARY, or LEAST.

If the question is managerial, do not jump straight to a product. Ask whether a policy, risk decision, legal requirement, contract, architecture, or owner must be addressed first. If the question is technical, still ensure the proposed control solves the stated layer and does not violate governance.

When evidence is incomplete, prefer actions that increase confidence and preserve options unless immediate containment is necessary to prevent material harm. Investigations are weakened when destructive action removes logs, memory, persistence artifacts, or timeline evidence before collection.

When several answers are true, choose the one that is most complete at the requested level. A CISSP answer often integrates people, process, and technology rather than assuming one configuration setting resolves the full risk.

Exam-day checklist

  • Read every qualifier before evaluating options.
  • Identify who owns the decision.
  • State the control objective in plain language.
  • Eliminate answers from the wrong lifecycle phase or technical layer.
  • Prefer governance-compliant actions over unauthorized shortcuts.
  • Preserve evidence and reversibility when uncertainty remains.
  • For cloud or outsourced services, identify the responsibility boundary before assigning the fix.
  • For IAM, separate identity proof, authentication, authorization, lifecycle, and review.
  • For incidents, keep containment, eradication, and recovery distinct.
  • For software, treat dependencies and build systems as part of the attack surface.
  • Do not use a practice score as a pass guarantee.
  • Verify current exam logistics directly with ISC2 before your appointment.

Last-mile review method

Select ten topics you still hesitate on and reduce each to four lines: the definition, the security objective, one example, and one common confusion. This forces active recall and exposes where you only recognize terminology without understanding the decision.

Then connect pairs of domains. Link risk management to asset classification, architecture to network segmentation, IAM to logging, testing to software development, and operations to continuity. CISSP is easier to reason through when the domains form one operating model instead of eight separate lists.

Finally, practice explaining a recommendation to three audiences: a system administrator, a business owner, and an auditor. The underlying control may be the same, but each audience needs different evidence and language. That communication discipline reflects the management and technical breadth the credential is intended to assess.

Take the practice testReturn to the study guide