ISC2 CISSP Certified Information Systems Security Professional Official Study Guide E-Book
Mike Chapple
53,99 €
Mehr erfahren.
- Herausgeber: John Wiley & Sons
- Kategorie: Wissenschaft und neue Technologien
- Serie: Sybex Study Guide
- Sprache: Englisch
CISSP Study Guide - fully updated for the 2024 CISSP Body of Knowledge
ISC2 Certified Information Systems Security Professional (CISSP) Official Study Guide, 10th Edition has been completely updated based on the latest 2024 CISSP Detailed Content Outline. This bestselling Sybex Study Guide covers 100% of the CISSP objectives. You'll prepare smarter and faster with Sybex thanks to expert content, knowledge from our real-world experience, access to the Sybex online interactive learning environment, and much more. Reinforce what you've learned with key topic Study Essentials and chapter review questions.
The book’s co-authors bring decades of experience as cybersecurity practitioners and educators, integrating real-world expertise with the practical knowledge you'll need to successfully prove your CISSP mastery. Combined, they've taught cybersecurity concepts to millions of students through their books, video courses, and live training programs.
Along with the book, you also get access to Sybex's superior online interactive learning environment that includes:
- Over 900 practice test questions with complete answer explanations. This includes all of the questions from the book plus four additional online-only practice exams, each with 125 unique questions. You can use the online-only practice exams as full exam simulations. Our questions will help you identify where you need to study more.
- More than 1000 Electronic Flashcards to reinforce your learning and give you last-minute test prep
- A searchable glossary in PDF to give you instant access to the key terms you need to know
- Audio Review. Author Mike Chapple reads the Study Essentials for each chapter providing you with more than 2 hours of up-to-date audio review for yet another way to reinforce your knowledge as you prepare.
Coverage of all of the CISSP topics in the book means you'll be ready for:
- Security and Risk Management
- Asset Security
- Security Architecture and Engineering
- Communication and Network Security
- Identity and Access Management (IAM)
- Security Assessment and Testing
- Security Operations
- Software Development Security
Sie lesen das E-Book in den Legimi-Apps auf:
Seitenzahl: 2384
Veröffentlichungsjahr: 2024
Ähnliche
Table of Contents
Cover
Table of Contents
Title Page
Copyright
Dedication
Acknowledgments
About the Authors
About the Technical Editors
Introduction
Overview of the CISSP Exam
The Elements of This Study Guide
Interactive Online Learning Environment and Test Bank
Study Guide Exam Objectives
Objective Map
How to Contact the Publisher
Assessment Test
Answers to Assessment Test
Chapter 1: Security Governance Through Principles and Policies
Security 101
Understand and Apply Security Concepts
Security Boundaries
Evaluate and Apply Security Governance Principles
Manage the Security Function
Security Policy, Standards, Procedures, and Guidelines
Threat Modeling
Supply Chain Risk Management
Summary
Study Essentials
Written Lab
Review Questions
Chapter 2: Personnel Security and Risk Management Concepts
Personnel Security Policies and Procedures
Understand and Apply Risk Management Concepts
Social Engineering
Establish and Maintain a Security Awareness, Education, and Training Program
Summary
Study Essentials
Written Lab
Review Questions
Chapter 3: Business Continuity Planning
Planning for Business Continuity
Project Scope and Planning
Business Impact Analysis
Continuity Planning
Plan Approval and Implementation
Summary
Study Essentials
Written Lab
Review Questions
Chapter 4: Laws, Regulations, and Compliance
Categories of Laws
Laws
State Privacy Laws
Compliance
Contracting and Procurement
Summary
Study Essentials
Written Lab
Review Questions
Chapter 5: Protecting Security of Assets
Identifying and Classifying Information and Assets
Establishing Information and Asset Handling Requirements
Data Protection Methods
Understanding Data Roles
Using Security Baselines
Summary
Study Essentials
Written Lab
Review Questions
Chapter 6: Cryptography and Symmetric Key Algorithms
Cryptographic Foundations
Modern Cryptography
Symmetric Cryptography
Cryptographic Life Cycle
Summary
Study Essentials
Written Lab
Review Questions
Chapter 7: PKI and Cryptographic Applications
Asymmetric Cryptography
Hash Functions
Digital Signatures
Public Key Infrastructure
Asymmetric Key Management
Hybrid Cryptography
Applied Cryptography
Cryptographic Attacks
Summary
Study Essentials
Written Lab
Review Questions
Chapter 8: Principles of Security Models, Design, and Capabilities
Secure Design Principles
Techniques for Ensuring CIA
Understand the Fundamental Concepts of Security Models
Select Controls Based on Systems Security Requirements
Understand Security Capabilities of Information Systems
Summary
Study Essentials
Written Lab
Review Questions
Chapter 9: Security Vulnerabilities, Threats, and Countermeasures
Shared Responsibility
Data Localization and Data Sovereignty
Assess and Mitigate the Vulnerabilities of Security Architectures, Designs, and Solution Elements
Client-Based Systems
Server-Based Systems
Industrial Control Systems
Distributed Systems
High-Performance Computing (HPC) Systems
Real-Time Operating Systems
Internet of Things
Edge and Fog Computing
Embedded Devices and Cyber-Physical Systems
Microservices
Infrastructure as Code
Immutable Architecture
Virtualized Systems
Containerization
Mobile Devices
Essential Security Protection Mechanisms
Common Security Architecture Flaws and Issues
Summary
Study Essentials
Written Lab
Review Questions
Chapter 10: Physical Security Requirements
Apply Security Principles to Site and Facility Design
Implement Site and Facility Security Controls
Implement and Manage Physical Security
Summary
Study Essentials
Written Lab
Review Questions
Chapter 11: Secure Network Architecture and Components
OSI Model
TCP/IP Model
Analyzing Network Traffic
Common Application Layer Protocols
Transport Layer Protocols
Domain Name System
Internet Protocol (IP) Networking
ARP Concerns
Secure Communication Protocols
Implications of Multilayer Protocols
Segmentation
Edge Networks
Wireless Networks
Satellite Communications
Cellular Networks
Content Distribution Networks (CDNs)
Secure Network Components
Summary
Study Essentials
Written Lab
Review Questions
Chapter 12: Secure Communications and Network Attacks
Protocol Security Mechanisms
Secure Voice Communications
Remote Access Security Management
Multimedia Collaboration
Monitoring and Management
Load Balancing
Manage Email Security
Virtual Private Network
Switching and Virtual LANs
Network Address Translation
Third-Party Connectivity
Switching Technologies
WAN Technologies
Fiber-Optic Links
Prevent or Mitigate Network Attacks
Summary
Study Essentials
Written Lab
Review Questions
Chapter 13: Managing Identity and Authentication
Controlling Access to Assets
The AAA Model
Implementing Identity Management
Managing the Identity and Access Provisioning Life Cycle
Summary
Study Essentials
Written Lab
Review Questions
Chapter 14: Controlling and Monitoring Access
Comparing Access Control Models
Implementing Authentication Systems
Zero-Trust Access Policy Enforcement
Understanding Access Control Attacks
Summary
Study Essentials
Written Lab
Review Questions
Chapter 15: Security Assessment and Testing
Building a Security Assessment and Testing Program
Performing Vulnerability Assessments
Testing Your Software
Training and Exercises
Implementing Security Management Processes and Collecting Security Process Data
Summary
Exam Essentials
Written Lab
Review Questions
Chapter 16: Managing Security Operations
Apply Foundational Security Operations Concepts
Address Personnel Safety and Security
Provision Information and Assets Securely
Apply Resource Protection
Managed Services in the Cloud
Perform Configuration Management (CM)
Manage Change
Manage Patches and Reduce Vulnerabilities
Summary
Study Essentials
Written Lab
Review Questions
Chapter 17: Preventing and Responding to Incidents
Conducting Incident Management
Implementing Detection and Preventive Measures
Logging and Monitoring
Automating Incident Response
Summary
Study Essentials
Written Lab
Review Questions
Chapter 18: Disaster Recovery Planning
The Nature of Disaster
Understand System Resilience, High Availability, and Fault Tolerance
Recovery Strategy
Recovery Plan Development
Training, Awareness, and Documentation
Testing and Maintenance
Summary
Study Essentials
Written Lab
Review Questions
Chapter 19: Investigations and Ethics
Investigations
Major Categories of Computer Crime
Ethics
Summary
Study Essentials
Written Lab
Review Questions
Chapter 20: Software Development Security
Introducing Systems Development Controls
Establishing Databases and Data Warehousing
Storage Threats
Understanding Knowledge-Based Systems
Summary
Study Essentials
Written Lab
Review Questions
Chapter 21: Malicious Code and Application Attacks
Malware
Malware Prevention
Application Attacks
Injection Vulnerabilities
Exploiting Authorization Vulnerabilities
Exploiting Web Application Vulnerabilities
Application Security Controls
Secure Coding Practices
Summary
Study Essentials
Written Lab
Review Questions
Appendix A: Answers to Review Questions
Chapter 1: Security Governance Through Principles and Policies
Chapter 2: Personnel Security and Risk Management Concepts
Chapter 3: Business Continuity Planning
Chapter 4: Laws, Regulations, and Compliance
Chapter 5: Protecting Security of Assets
Chapter 6: Cryptography and Symmetric Key Algorithms
Chapter 7: PKI and Cryptographic Applications
Chapter 8: Principles of Security Models, Design, and Capabilities
Chapter 9: Security Vulnerabilities, Threats, and Countermeasures
Chapter 10: Physical Security Requirements
Chapter 11: Secure Network Architecture and Components
Chapter 12: Secure Communications and Network Attacks
Chapter 13: Managing Identity and Authentication
Chapter 14: Controlling and Monitoring Access
Chapter 15: Security Assessment and Testing
Chapter 16: Managing Security Operations
Chapter 17: Preventing and Responding to Incidents
Chapter 18: Disaster Recovery Planning
Chapter 19: Investigations and Ethics
Chapter 20: Software Development Security
Chapter 21: Malicious Code and Application Attacks
Appendix B: Answers to Written Labs
Chapter 1: Security Governance Through Principles and Policies
Chapter 2: Personnel Security and Risk Management Concepts
Chapter 3: Business Continuity Planning
Chapter 4: Laws, Regulations, and Compliance
Chapter 5: Protecting Security of Assets
Chapter 6: Cryptography and Symmetric Key Algorithms
Chapter 7: PKI and Cryptographic Applications
Chapter 8: Principles of Security Models, Design, and Capabilities
Chapter 9: Security Vulnerabilities, Threats, and Countermeasures
Chapter 10: Physical Security Requirements
Chapter 11: Secure Network Architecture and Components
Chapter 12: Secure Communications and Network Attacks
Chapter 13: Managing Identity and Authentication
Chapter 14: Controlling and Monitoring Access
Chapter 15: Security Assessment and Testing
Chapter 16: Managing Security Operations
Chapter 17: Preventing and Responding to Incidents
Chapter 18: Disaster Recovery Planning
Chapter 19: Investigations and Ethics
Chapter 20: Software Development Security
Chapter 21: Malicious Code and Application Attacks
Index
End User License Agreement
List of Tables
Chapter 2
TABLE 2.1 Comparison of quantitative and qualitative risk analysis
TABLE 2.2 Quantitative risk analysis formulas
Chapter 5
TABLE 5.1 Securing email data
TABLE 5.2 Unmodified data within a database
TABLE 5.3 Masked data
Chapter 6
TABLE 6.1 AND operation truth table
TABLE 6.2 OR operation truth table
TABLE 6.3 NOT operation truth table
TABLE 6.4 Exclusive OR operation truth table
TABLE 6.5 Using the Vigenère system
TABLE 6.6 The encryption operation
TABLE 6.7 Symmetric and asymmetric key comparison
TABLE 6.8 Comparison of symmetric and asymmetric cryptography systems
TABLE 6.9 Symmetric encryption memorization chart
Chapter 7
TABLE 7.1 Hash algorithm memorization chart
TABLE 7.2 Digital certificate formats
Chapter 8
TABLE 8.1 Subjects and objects
TABLE 8.2 Fail terms' definitions related to physical and digital products
TABLE 8.3 An access control matrix
TABLE 8.4 Common Criteria evaluation assurance levels
Chapter 10
TABLE 10.1 Static voltage and damage
TABLE 10.2 Fire extinguisher classes
Chapter 11
TABLE 11.1 IP classes
TABLE 11.2 IP classes' default subnet masks
TABLE 11.3 802.11 wireless networking amendments
TABLE 11.4 UTP categories
Chapter 12
TABLE 12.1 Common load-balancing scheduling techniques
TABLE 12.2 Circuit switching vs. packet switching
TABLE 12.3 Bandwidth levels of SDH and SONET
List of Illustrations
Chapter 1
FIGURE 1.1 The CIA Triad
FIGURE 1.2 The five elements of AAA services
FIGURE 1.3 Strategic, tactical, and operational plan timeline comparison
FIGURE 1.4 An example of diagramming to reveal threat concerns
FIGURE 1.5 A risk matrix or risk heat map
Chapter 2
FIGURE 2.1 Former employees must return all company property.
FIGURE 2.2 The cyclical relationships of risk elements
FIGURE 2.3 The six major elements of quantitative risk analysis
FIGURE 2.4 The categories of security controls in a defense-in-depth impleme...
FIGURE 2.5 The elements of the risk management framework (RMF) (from NIST SP...
Chapter 3
FIGURE 3.1 Earthquake hazard map of the United States
Chapter 5
FIGURE 5.1 Data classifications
FIGURE 5.2 Clearing a hard drive
Chapter 6
FIGURE 6.1 Challenge-response authentication protocol
FIGURE 6.2 The magic door
FIGURE 6.3 Symmetric key cryptography
FIGURE 6.4 Asymmetric key cryptography
Chapter 7
FIGURE 7.1 Asymmetric key cryptography
FIGURE 7.2 Steganography tool
FIGURE 7.3 Image with embedded message
Chapter 8
FIGURE 8.1 Transitive trust
FIGURE 8.2 The TCB, security perimeter, and reference monitor
FIGURE 8.3 The take-grant model's directed graph
FIGURE 8.4 The Bell–LaPadula model
FIGURE 8.5 The Biba model
FIGURE 8.6 The Clark–Wilson model
Chapter 9
FIGURE 9.1 The four-layer protection ring model
FIGURE 9.2 The life cycle of an executed process
FIGURE 9.3 Types of hypervisors
FIGURE 9.4 Application containers versus a hypervisor
Chapter 10
FIGURE 10.1 A smartcard's ISO 7816 interface
FIGURE 10.2 Hot and cold aisles
FIGURE 10.3 The fire triangle
FIGURE 10.4 The four primary stages of fire
FIGURE 10.5 A secure physical boundary with a person trap and a turnstile
Chapter 11
FIGURE 11.1 The OSI model
FIGURE 11.2 OSI model encapsulation
FIGURE 11.3 The OSI model peer layer logical channels
FIGURE 11.4 OSI model layer-based network container names
FIGURE 11.5 Comparing the OSI model with the TCP/IP model
FIGURE 11.6 The TCP three-way handshake
FIGURE 11.7 An RFID antenna
FIGURE 11.8 The configuration dialog boxes for a transparent (left) versus a...
FIGURE 11.9 A ring topology
FIGURE 11.10 A linear bus topology and a tree bus topology
FIGURE 11.11 A star topology
FIGURE 11.12 A mesh topology
Chapter 12
FIGURE 12.1 IPSec's encryption of a packet in transport mode
FIGURE 12.2 IPSec's encryption of a packet in tunnel mode
FIGURE 12.3 Two LANs being connected using a tunnel-mode VPN across the Inte...
FIGURE 12.4 A client connecting to a network via a remote-access/tunnel VPN ...
Chapter 13
FIGURE 13.1 Hardware authenticator
FIGURE 13.2 Software authenticator
FIGURE 13.3 Graph of FRR and FAR errors indicating the CER point
FIGURE 13.4 YubiKey passkey
Chapter 14
FIGURE 14.1 Role-based access control
FIGURE 14.2 A representation of the boundaries provided by lattice-based acc...
FIGURE 14.3 NIST Zero-Trust core trust logical components
FIGURE 14.4 Wireshark capture
Chapter 15
FIGURE 15.1 Nmap scan of a web server run from a Linux system
FIGURE 15.2 Default Apache server page running on the server scanned in Figu...
FIGURE 15.3 Nmap scan of a large network run from a Mac system using the Ter...
FIGURE 15.4 Network vulnerability scan of the same web server that was port ...
FIGURE 15.5 Web application vulnerability scan of the same web server that w...
FIGURE 15.6 Scanning a database-backed application with Sqlmap
FIGURE 15.7 Penetration testing process
FIGURE 15.8 The Metasploit Framework automated system exploitation tool allo...
FIGURE 15.9 Fagan inspections follow a rigid formal process, with defined en...
FIGURE 15.10 Prefuzzing input file containing a series of 1s
FIGURE 15.11 The input file from Figure 15.10 after being run through the zz...
Chapter 16
FIGURE 16.1 Cloud shared responsibility model
FIGURE 16.2 Creating and deploying images
FIGURE 16.3 Web server and database server
Chapter 17
FIGURE 17.1 Incident management
FIGURE 17.2 SYN flood attack
FIGURE 17.3 A man-in-the-middle attack
FIGURE 17.4 Intrusion prevention system
FIGURE 17.5 Viewing a log entry
Chapter 18
FIGURE 18.1 Seismic hazard map
FIGURE 18.2 Flood hazard map for Miami–Dade County, Florida
FIGURE 18.3 Failover cluster with network load balancing
Chapter 20
FIGURE 20.1 RStudio Desktop IDE
FIGURE 20.2 Security vs. user-friendliness vs. functionality
FIGURE 20.3 The iterative life cycle model with feedback loop
FIGURE 20.4 The spiral life cycle mode
FIGURE 20.5 Software Assurance Maturity Model
FIGURE 20.6 The IDEAL model
FIGURE 20.7 Gantt chart
FIGURE 20.8 The DevOps model
FIGURE 20.9 Hierarchical data model
FIGURE 20.10 Customers table from a relational database
FIGURE 20.11 ODBC as the interface between applications and a backend databa...
Chapter 21
FIGURE 21.1 Account number input page
FIGURE 21.2 Account information page
FIGURE 21.3 Account information page after blind SQL injection
FIGURE 21.4 Account creation page
FIGURE 21.5 Example web server directory structure
FIGURE 21.6 Message board post rendered in a browser
FIGURE 21.7 XSS attack rendered in a browser
FIGURE 21.8 Web application firewall
FIGURE 21.9 SQL error disclosure
Guide
Cover
Title Page
Copyright
Dedication
Acknowledgments
About the Authors
About the Technical Editors
Introduction
Table of Contents
Begin Reading
Appendix A: Answers to Review Questions
Appendix B: Answers to Written Labs
Index
End User License Agreement
Pages
iii
iv
v
vii
ix
xi
xxxv
xxxvi
xxxvii
xxxviii
xxxix
xl
xli
xlii
xliii
xliv
xlv
xlvi
xlvii
xlviii
xlix
l
li
lii
liii
liv
lv
lvi
lvii
lviii
lix
lx
lxi
lxii
lxiii
lxiv
lxv
lxvi
lxvii
lxviii
lxix
lxx
lxxi
lxxii
lxxiii
lxxiv
lxxv
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
ISC2® CISSP®Certified Information Systems Security ProfessionalOfficial Study Guide
Tenth Edition
Mike Chapple, CISSP
James Michael Stewart, CISSP
Darril Gibson, CISSP
Copyright © 2024 by John Wiley & Sons, Inc. All rights reserved.
Published by John Wiley & Sons, Inc., Hoboken, New Jersey.
Published simultaneously in Canada and the United Kingdom.
ISBNs: 9781394254699 (paperback), 9781394254712 (ePDF), 9781394254705 (ePub)
No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning, or otherwise, except as permitted under Section 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 750-4470, or on the web at www.copyright.com. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at www.wiley.com/go/permission.
Trademarks: WILEY, the Wiley logo, and the Sybex logo are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates, in the United States and other countries, and may not be used without written permission. ISC2 and CISSP are trademarks or registered trademarks of International Information Systems Security Certification Consortium, Inc. All other trademarks are the property of their respective owners. John Wiley & Sons, Inc. is not associated with any product or vendor mentioned in this book.
Limit of Liability/Disclaimer of Warranty: While the publisher and authors have used their best efforts in preparing this book, they make no representations or warranties with respect to the accuracy or completeness of the contents of this book and specifically disclaim any implied warranties of merchantability or fitness for a particular purpose. No warranty may be created or extended by sales representatives or written sales materials. The advice and strategies contained herein may not be suitable for your situation. You should consult with a professional where appropriate. Further, readers should be aware that websites listed in this work may have changed or disappeared between when this work was written and when it is read. Neither the publisher nor authors shall be liable for any loss of profit or any other commercial damages, including but not limited to special, incidental, consequential, or other damages.
For general information on our other products and services, please contact our Customer Care Department within the United States at (800) 762-2974, outside the United States at (317) 572- 3993. For product technical support, you can find answers to frequently asked questions or reach us via live chat at https://sybexsupport.wiley.com.
Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic formats. For more information about Wiley products, visit our web site at www.wiley.com.
Library of Congress Control Number: 2024935047
Cover image: © Getty Images Inc./Jeremy WoodhouseCover design: Wiley
To Darril Gibson, my friend and co-author of many years. You made a tremendous impact on the cybersecurity field and we will be eternally grateful for your contributions.
—Mike Chapple
To Cathy, I continue to love threading the zigzaggednesses of life with you.
—James Michael Stewart
Acknowledgments
We'd like to express our thanks to Sybex for continuing to support this project. Extra thanks to the tenth edition developmental editor, Kelly Talbot, and technical editors, Shahla Pirnia and Rae Baker, who performed amazing feats in guiding us to improve this book.
We also owe a debt of gratitude to our literary agent, Carole Jelen of Waterside Productions, for continuing to assist in nailing down these projects. Thanks for all your hard work herding us authors.
We also want to express our condolences to the family and friends of Darril Gibson. Darril, you are missed.
—Mike and Michael
Special thanks go to my many friends and colleagues in the cybersecurity community who provided hours of interesting conversation and debate on security issues that inspired and informed much of the material in this book.
I would like to thank the team at Wiley who provided invaluable assistance throughout the book development process. My coauthors, James Michael Stewart and Darril Gibson, were great collaborators and I'd like to thank them both for their thoughtful contributions to my chapters over the years.
I'd also like to thank the many people who participated in the production of this book but whom I never had the chance to meet: the graphics team, the production staff, and all of those involved in bringing this book to press.
—Mike Chapple
Thanks to Mike Chapple for continuing your excellent contribution to this project. Thanks also to all my CISSP course students who have provided their insight and input to improve my training courseware and ultimately this tome. To my adoring wife, Cathy: every year is another wonderful experience with you. To Slayde and Remi: always remember that you are loved no matter where you go or what you become. To my mom, Johnnie: it is wonderful to have you close by. To Mark: no matter how much time has passed or how little we see each other, I have been and always will be your friend. And finally, as always, to Elvis: I've heard that when you make a sandwich, it's called a peanut butter and banana “Hunka Hunka Burning Lunch”!
—James Michael Stewart
About the Authors
Mike Chapple, PhD, CISSP, Security+, CySA+, PenTest+, CISA, CISM, CCSP, CIPP/US, is a teaching professor of IT, analytics, and operations at the University of Notre Dame. In the past, he was chief information officer of Brand Institute and an information security researcher with the National Security Agency and the U.S. Air Force. His primary areas of expertise include network intrusion detection and access controls. Mike is the author of more than 200 books and video courses, including the companion book to this study guide: CISSP Official ISC2 Practice Tests, the CompTIA CySA+ Study Guide, the CompTIA Security+ (SY0-701) Study Guide, and Cyberwarfare: Information Operations in a Connected World. Mike offers study groups for the CISSP, SSCP, CCSP, Security+, and other major certifications on his website at www.certmike.com.
James Michael Stewart, CISSP, CEH, CHFI, ECSA, CND, ECIH, CySA+, PenTest+, CASP+, Security+, Network+, A+, CTT+, CEI, and CFR, has been writing and training for more than 25 years, with a focus on security. He has been teaching CISSP training courses since 2002, not to mention other courses on internet security and ethical hacking/penetration testing. He is the author of and contributor to more than 80 books on security certification, Microsoft topics, and network administration. Michael is the author of the official online virtual lab sets for CompTIA's Security+, CASP+, and PenTest+, as well as hundreds of other labs focusing on Microsoft Windows, Linux, internet, and security concepts. More information about Michael can be found at his website at www.impactonline.com.
Darril Gibson, CISSP (1958–2022), was the CEO of YCDA, LLC and regularly wrote and consulted on a wide variety of technical and security topics and held numerous other certifications, including MCSE, MCDBA, MCSD, MCITP, ITIL v3, and Security+. He authored or coauthored more than 30 books, including multiple prior editions of the CISSP Study Guide. Darril was greatly respected in the cybersecurity, training, and education fields and will be missed.
About the Technical Editors
Rae Baker is a senior open source intelligence analyst, public speaker, licensed private investigator, and Wiley author specializing in maritime intelligence and OSINT training. She is the owner of OSINT training company Kase Scenarios and she holds several prominent industry certificates, including SANS GOSI and Associate of ISC2 (CISSP). More information about Rae can be found at http://raebaker.net.
Shahla Pirnia is a freelance technical editor and proofreader with a focus on cybersecurity and certification topics. She currently serves as a technical editor for CertMike.com. Shahla earned BS degrees in computer and information science and psychology from the University of Maryland Global Campus and an Associate of Arts in information systems from Montgomery College, Maryland. Shahla's IT certifications include CompTIA Security+, Network+, A+, and ISC2 CC.
Introduction
The ISC2®CISSP®Certified Information Systems Security Professional Official Study Guide, Tenth Edition, offers you a solid foundation for the Certified Information Systems Security Professional (CISSP) exam. By purchasing this book, you've shown a willingness to learn and a desire to develop the skills you need to achieve this certification. This introduction provides you with a basic overview of this book and the CISSP exam.
This book is designed for readers and students who want to study for the CISSP certification exam. If your goal is to become a certified security professional, then the CISSP certification and this CISSP Study Guide are for you. The purpose of this book is to adequately prepare you to take the CISSP exam.
The information presented here in this Introduction was based on the publicly available documentation from ISC2 as of April 15, 2024. However, these details and exam parameters are subject to change at any time based upon ISC2 operational decisions. Please consult isc2.org to confirm, verify, or learn about updated exam specifics.
Before you dive into this book, you need to have accomplished a few tasks on your own. You need to have a general understanding of IT and of security. You should have the necessary five years of cumulative full-time work experience (or four years if you have a college degree) in two or more of the eight domains covered by the CISSP exam. Part-time work and internship experience is also acceptable with conditions; see www.isc2.org/certifications/cissp/cissp-experience-requirements. If you are qualified to take the CISSP exam according to ISC2, then you are sufficiently prepared to use this book to study for it. For more information on ISC2, see the next section.
Alternatively, ISC2 allows for a one-year reduction of the five-year experience requirement if you have earned one of the approved certifications from the ISC2 prerequisite pathway. As of Q1 2024, the qualified certifications are:
AWS Certified Security - Specialty
Certified in Governance, Risk and Compliance (CGRC)
Certified Cloud Security Professional (CCSP)
Certified Computer Examiner (CCE)
Certified Ethical Hacker v8 or higher
Certified Information Security Manager (CISM)
Certified Information Systems Auditor (CISA)
Certified Internal Auditor (CIA)
Certified Protection Professional (CPP) from ASIS
Certified in Risk and Information Systems Control (CRISC)
Certified Secure Software Life cycle Professional (CSSLP)
Certified Wireless Security Professional (CWSP)
Cisco Certified CyberOps Associate/Professional
Cisco Certified Internetwork Expert (CCIE) Security
Cisco Certified Network Associate Security (CCNA Security)
Cisco Certified Network Professional Security (CCNP Security)
CIW Web Security Professional
CIW Web Security Specialist
CompTIA Advanced Security Practitioner (CASP+)
CompTIA CySA+
CompTIA Security+
Computer Hacking Forensic Investigator (CHFI)
CSA Certificate of Cloud Security Knowledge (CCSK)
EC-Council Certified Security Specialist (ECSS)
EC-Council Certified SOC Analyst (CSA)
GIAC Certified Enterprise Defender (GCED)
GIAC Certified Incident Handler (GCIH)
GIAC Certified Intrusion Analyst (GCIA)
GIAC Cyber Threat Intelligence (GCTI)
GIAC Global Industrial Cyber Security Professional (GICSP)
GIAC Information Security Fundamentals (GISF)
GIAC Information Security Professional (GISP)
GIAC Security Essentials Certificate (GSEC)
GIAC Security Leadership Certification (GSLC)
GIAC Strategic Planning, Policy, and Leadership (GSTRT)
GIAC Systems and Network Auditor (GSNA)
HealthCare Information Security and Privacy Practitioner (HCISPP)
Information Security Management Systems Lead Auditor (IRCA)
Information Security Management Systems Principal Auditor (IRCA)
Juniper Networks Certified Internet Expert (JNCIE-SEC)
Microsoft Identity and Access Management
Microsoft Security Operations Analyst
Microsoft Certified Cybersecurity Architect
Offensive Security Certified Professional/Expert (OSCP/E)
Systems Security Certified Practitioner (SSCP)
For the complete and current list of qualifying certifications, visit www.isc2.org/certifications/cissp/cissp-experience-requirements.
You can use only one of the experience reduction measures, either a college degree or a certification, not both.
ISC2 offers an entry program known as an Associate of ISC2. This program allows someone without any or enough experience to qualify as a CISSP applicant to take the CISSP exam anyway and then obtain experience afterward. Associates are granted six years to obtain five years of security experience. Only after providing proof of such experience, usually by means of endorsement (discussed later), can the individual be awarded the full CISSP certification.
If you are just getting started on your journey to CISSP certification and do not yet have the work experience, then our book can still be a useful tool in your preparation for the exam. However, you may find that some of the topics covered assume knowledge that you don't have. For those topics, you may need to do some additional research using other materials, and then return to this book to continue learning about the CISSP topics.
ISC2
The CISSP exam is governed by the International Information System Security Certification Consortium ISC2. ISC2 is a global nonprofit organization. It has the mission of “ISC2 strengthens the influence, diversity and vitality of the field through advocacy, expertise and workforce empowerment that accelerates cyber safety and cybersecurity in an interconnected world.”
ISC2 is operated by a board of directors elected from the ranks of its certified practitioners.
ISC2 supports and provides a wide variety of certifications, including CISSP, ISSAP, ISSMP, ISSEP, SSCP, CCSM, CCSP, CGRCSM, and CSSLP. These certifications are designed to verify the knowledge and skills of IT security professionals across all industries. You can obtain more information about ISC2 and its other certifications from its website at isc2.org.
The CISSP credential is for security professionals “with the knowledge, skills and abilities to lead an organization's information security program.”
Topical Domains
The CISSP certification covers material from the eight topical domains. These eight domains are as follows:
Domain 1: Security and Risk Management
Domain 2: Asset Security
Domain 3: Security Architecture and Engineering
Domain 4: Communication and Network Security
Domain 5: Identity and Access Management (IAM)
Domain 6: Security Assessment and Testing
Domain 7: Security Operations
Domain 8: Software Development Security
These eight domains provide a vendor-independent overview of a common security framework. This framework is the basis for a discussion on security practices that can be supported in all types of organizations worldwide.
Prequalifications
ISC2 has defined the qualification requirements you must meet to become a CISSP. First, you must be a practicing security professional with at least five years’ work experience or with four years’ experience and a recent IT or IS degree or an approved security certification (as mentioned previously). Professional experience is defined as security work performed (with or without pay) within two or more of the eight CISSP domains.
Second, you must agree to adhere to a formal code of ethics. The ISC2 Code of Ethics is a set of guidelines ISC2 wants all certification candidates to follow to maintain professionalism in the field of information systems security. You can find the ISC2 Code of Ethics at isc2.org/ethics.
Overview of the CISSP Exam
The CISSP exam focuses on security from an overview perspective; it deals more with theory and concept than implementation and procedure. It is very broad but not very deep. To successfully complete this exam, you'll need to be familiar with every domain but not necessarily be a master of each domain.
The CISSP exam is in an adaptive format that ISC2 calls CISSP CAT (Computerized Adaptive Testing). For complete details of this form of exam presentation, please see www.isc2.org/certifications/CISSP/CISSP-CAT.
The CISSP CAT exam has a minimum of 100 questions and a maximum of 150. Not all items (i.e., questions) presented count toward your proficiency level, competency requirements, or passing status. There are 25 unscored questions that are called pre-test or unscored items by ISC2, whereas the scored questions are called operational items. The questions are not labeled on the exam as to whether they are scored (i.e., operational items) or unscored (i.e., pre-test questions). Test candidates will receive 25 unscored items on their exam, regardless of whether they achieve a passing rank at question 100 or see all of the 150 questions. However, an exam's pass/fail report is determined by only the last 75 operational items answered by the test candidate.
The CISSP CAT grants a maximum of three (3) hours to take the exam. If you run out of time before achieving a passing rank, you will automatically fail.
The CISSP CAT does not allow you to return to a previous question to change your answer. Your answer selection is final once you leave a question by submitting your answer selection.
To pass the CISSP CAT exam, you must score 700 out of a possible 1000 points, within the last 75 operational items (i.e., questions). If you do not achieve the minimum passing score after submitting your answer to question 150, then you fail. If you run out of time, then you fail.
If you do not pass the CISSP exam on your first attempt, you are allowed to retake the CISSP exam under the following conditions:
You can take the CISSP exam a maximum of four times per 12-month period. (Note that on the CISSP CAT FAQ the limit is defined as 3 times per a 12-month period.)
You must wait 30 days after your first attempt before trying a second time.
You must wait an additional 60 days after your second attempt before trying a third time.
You must wait an additional 90 days after your third or subsequent attempts before trying again.
The exam retake policy may be updated; you can read the most current version of the official policy here: www.isc2.org/Exams/After-Your-Exam.
You will need to pay full price for each additional exam attempt. However, ISC2 offers promotions from time to time that may allow you to retake an exam at no additional cost. This promotion has been called “Peace of Mind Protection,” but could be renamed. It is limited to first-time test-takers only and has time restrictions. Be sure to read the fine print before acting on any such promotional offers.
The CISSP CAT exam is available in English, Chinese, German, Japanese, and Spanish.
For more details and the most up-to-date information on the CISSP exam direct from ISC2, please visit www.isc2.org/Certifications/CISSP and download the CISSP Ultimate Guide and visit www.isc2.org/certifications/cissp/cissp-certification-exam-outline to download the CISSP Exam Outline. You might also find useful information on the ISC2 Insights blog at www.isc2.org/Insights.
The total number of questions you may see on the exam, the total number of questions that count toward your score, the means and methods of scoring, and the time limit for the test are things that ISC2 reevaluates and changes from time to time. The best advice for preparing is to always recheck the ISC2 website for up to date exam specifications and policies.
CISSP Exam Question Types
Most of the questions on the CISSP exam are four-option, multiple-choice questions with a single correct answer. Some are straightforward, such as asking you to select a definition. Some are a bit more involved, asking you to select the appropriate concept or best practice. And some questions present you with a scenario or situation and ask you to select the best response.
You must select the one correct or best answer and mark it. In some cases, the correct answer will be obvious to you. In other cases, several answers may seem correct. In these instances, you must choose the best answer for the question asked. Watch for general, specific, universal, superset, and subset answer selections. In other cases, none of the answers will seem correct. In these instances, you'll need to select the least incorrect answer.
Some multiple-choice questions may require that you select more than one answer; if so, these will state what is necessary to provide a complete answer.
In addition to the standard multiple-choice question format, the exam may include a few advanced question formats, which ISC2 calls advanced innovative questions. These include drag-and-drop questions and hotspot questions. These types of questions require you to place topics or concepts in order of operations, in priority preference, or in relation to proper positioning for the needed solution. Specifically, the drag-and-drop questions require the test taker to move labels or icons to mark items on an image. The hotspot questions require the test-taker to pinpoint a location on an image with a crosshair marker. These question concepts are easy to work with and understand, but be careful about your accuracy when dropping or marking.
ISC2 introduced the advanced innovative questions in 2014. They maintained a page describing these questions until 2017. While they still use this phrase to reference the question concepts, they no longer provide an explanation or examples of these questions on their website.
Advice on Taking the Exam
The CISSP exam consists of two key elements. First, you need to know the material from the eight domains. Second, you must have good test-taking skills. You have a maximum of 3 hours to achieve a passing standard with the potential to see up to 150 questions. Thus, you will have on average just over a minute for each question, so it is important to work quickly, without rushing, but also without wasting time.
Question skipping is not allowed on the CISSP CAT exam. You cannot return to view or change a previous question, and you're also not allowed to jump around, so one way or another, you have to come up with your best answer on each question as it is presented to you. If you don't know how to answer a question, then we recommend that you attempt to eliminate as many answer options as possible before making a guess. Then you can make educated guesses from a reduced set of options to increase your chance of getting a question correct. Since you have to answer every question presented, and you might not know the answer to some questions, you should develop a guessing strategy to select an answer promptly to minimize further wasting time.
Also note that ISC2 does not disclose if there is partial credit given for multiple-part questions if you get only some of the elements correct. So, pay attention to questions with checkboxes, and be sure to select as many items as necessary to properly address the question.
You will be provided with a dry-erase board and a marker to jot down thoughts and make notes. But nothing written on that board will be used to alter your score. That board must be returned to the test administrator prior to departing the test facility.
To maximize your test-taking activities, here are some general guidelines:
Read each question carefully, then read the answer options, and then reread the question.
Eliminate wrong answers before selecting the correct one.
Watch for double negatives.
Pay attention to universal terms, such as always or never.
Look for relationships between answer options, such as similes, antonyms, sets, groups, parent/child, category/example, etc.
Be sure you understand what the question is asking.
Manage your time. You can take breaks during your test, but this will consume some of your test time. You might consider bringing a drink and snacks, but your food and drink will be stored for you away from the testing area, and that break time will count against your test time limit. Be sure to bring any medications or other essential items, but leave all things electronic at home or in your car. You should avoid wearing anything on your wrists, including watches, fitness trackers, and jewelry. You are not allowed to bring any form of noise-canceling headsets or earbuds, although you can use foam earplugs. We also recommend wearing comfortable clothes and taking a light jacket with you (some testing locations are a bit chilly).
You may want to review the ISC2 CISSP Glossary document at www.isc2.org/certifications/cissp/cissp-student-glossary.
Finally, ISC2 exam policies are subject to change. Please be sure to check isc2.org for the current policies before you register and take the exam.
Study and Exam Preparation Tips
We recommend planning for a month or so of nightly intensive study for the CISSP exam. Here are some suggestions to maximize your learning time; you can modify them as necessary based on your own learning habits:
Take one or two evenings to read each chapter in this book.
Read and understand the Study Essentials for each chapter.
Complete the written labs from each chapter.
Answer all the review questions for each chapter.
Be sure to research each question that you get wrong in order to learn what you didn't know.
Review ISC2's Exam Outline to make sure you understand each listed item.
Use the flashcards included with the online study tools to reinforce your understanding of concepts.
Take the 4 full-length bonus practice exams provided in the online test engine.
We recommend spending about half of your study time reading and reviewing concepts and the other half taking practice exams. Students have reported that the more time they spent taking practice exams, the better they retained test topics. In addition to the practice tests with this Study Guide, Sybex also publishes ISC2 CISSP Certified Information Systems Security Professional Official Practice Tests, 4th Edition (ISBN: 978-1-394-25507-8). It contains 100 or more practice questions for each domain and four additional full-sized practice exams. Like this Study Guide, it also comes with an online version of the questions.
Completing the Certification Process
Once you have been informed that you successfully passed the CISSP certification, there is one final step before you are actually awarded the CISSP certification. That final step is known as endorsement. Basically, this involves getting someone who holds any ISC2 certification in good standing and is familiar with your work history to endorse you. Endorsement is the evaluation of your prerequisite qualifications (i.e., work experience) and the recommendation to ISC2 to award you the certification. Once you pass the CISSP exam, you will receive an email with instructions. However, you can review the endorsement application process at isc2.org/Endorsement. This URL is also where you initiate the endorsement process. You will need to know the ISC2 membership number of the person who will endorse you.
If you registered for CISSP, then you must complete endorsement within nine months of your exam. If you registered for Associate of ISC2, then you have six years from your exam data to complete endorsement. Once ISC2 accepts your endorsement, the certification process will be completed and you will be sent a welcome packet with confirmation of the certification achieved. You should also receive an email confirmation of the endorsement process’s completion and another when the certification is awarded to you.
Once you have achieved your CISSP certification, you must maintain it. You will need to earn 120 Continuing Professional Education (CPE) credits by your third-year anniversary. For details on earning and reporting CPEs, please consult the ISC2 Continuing Professional Education (CPE) Handbook (www.isc2.org/-/media/Project/ISC2/Main/Media/documents/members/CPE-Handbook-2023.pdf) and the CPE Opportunities page (www.isc2.org/members/cpe-opportunities). You will also be required to pay an annual maintenance fee (AMF) upon earning your certification and at each annual anniversary. For details on the AMF, please see the ISC2 CPE Handbook, www.isc2.org/Policies-Procedures/AMFs-Overview, and www.isc2.org/Policies-Procedures/Member-Policies.
The Elements of This Study Guide
Each chapter includes common elements to help you focus your studies and test your knowledge. Here are descriptions of those elements:
Tips and Notes Throughout each chapter you will see inserted statements that you should pay additional attention to. These items are often focused details related to the chapter section or related important material.
Summaries The summary is a brief review of the chapter to sum up what was covered.
Study Essentials The Study Essentials highlight topics that could appear on the exam in some form. This section reinforces significant concepts that are key to understanding the concepts and topics of the chapter. The Study Essentials point out specific knowledge you want to retain from a chapter.
Written Labs Each chapter includes written labs that synthesize various concepts and topics that appear in the chapter. These raise questions that are designed to help you put together various pieces you've encountered individually in the chapter and assemble them to propose or describe potential security strategies or solutions. We highly encourage you to write out your answers before viewing our suggested solutions in Appendix B.
Chapter Review Questions Each chapter includes practice questions that have been designed to measure your knowledge of key ideas that were discussed in the chapter. After you finish each chapter, answer the questions; if some of your answers are incorrect, it's an indication that you need to spend some more time studying the corresponding topics. The answers to the practice questions can be found in Appendix A.
Interactive Online Learning Environment and Test Bank
Studying the material in the ISC2 CISSP: Certified Information Systems Security Professional Official Study Guide, Tenth Edition is an important part of preparing for the Certified Information Systems Security Professional (CISSP) certification exam, but we provide additional tools to help you prepare. The online Test Bank will help you understand the types of questions that will appear on the certification exam.
The sample tests in the Test Bank include all the questions in each chapter as well as the questions from the Assessment test in this Introduction section. In addition, there are four bonus practice exams that you can use to evaluate your understanding and identify areas that may require additional study. These four additional practice exams include 125 questions each and cover the breadth of domain topics in a similar percentage ratio as the real exam. They can be used as real exam simulations to evaluate your preparedness.
The online flashcards will push the limits of what you should know for the certification exam. The questions are provided in digital format. Each online flashcard has one question and one correct answer.
The downloadable PDF glossary is a searchable list of key terms from this exam guide that you should know for the CISSP certification exam.
A downloadble audio review is available where Mike Chapple reads aloud the Study Essentials from each chapter. You can listen to the audio review to keep your knowledge skills sharp as you go about your day. Its another means to sneak in a few more minutes of study time.
