ExamFinch.com My Study

Cheat sheet

CISSP Cheat Sheet

Practice this exam

Security + Risk Management

  • 16% of exam
  • Governance Risk BCP Legal Ethics

Asset Security

  • 10% of exam
  • Classification Ownership Privacy Lifecycle Retention

Architecture + Engineering

  • 13% of exam
  • Models Crypto PKI Physical Design

Communication + Network

  • 13% of exam
  • OSI Segmentation Secure Channels Wireless Zero Trust

Identity + Access

  • 13% of exam
  • AAA Provisioning Federation MFA Access Models

Assessment + Testing

  • 12% of exam
  • Audit Vulnerability Pen Test Metrics Evidence

Security Operations

  • 13% of exam
  • Incident Forensics Logging Change DR

Software Security

  • 10% of exam
  • Secure SDLC Threat Modeling Code Review CI/CD DevSecOps

Quick Facts

  • Exam CISSP CAT
  • Items 100-150
  • Time 3 hours
  • Pass 700/1000
  • Domains 8
  • Experience 5 years
  • CPE 120/3 years
  • Mindset Risk first

Risk Flow RI

  • Asset + threat + weakness = risk
  • Owner accepts Controls mitigate Residual remains

Due Care vs Diligence RI

Due care

  • Act responsibly
  • Apply controls
  • Protect assets

Due diligence

  • Investigate first
  • Know risks
  • Verify facts
  • Act vs investigate

Risk Response RI

  • Risk too high → Mitigate ( Add controls )
  • Insurable loss → Transfer ( Contract/insurance )
  • Activity optional → Avoid ( Stop action )
  • Within appetite → Accept ( Owner signs )
  • Business impact unclear → BIA ( Prioritize )

Governance RI

  • CIA Core objectives
  • Due care Reasonable action
  • Due diligence Reasonable investigation
  • Policy Management direction
  • Standard Mandatory requirement
  • Procedure Step-by-step
  • Guideline Recommended practice
  • Risk owner Accepts risk

Risk + BCP RI

  • Asset value Business worth
  • Threat Potential harm
  • Vulnerability Weakness
  • Risk Threat exploits weakness
  • Mitigate Reduce risk
  • Transfer Share risk
  • BIA Impact prioritization
  • RTO Recovery time target

Owner vs Custodian AS

Owner

  • Classifies
  • Sets rules
  • Accepts risk

Custodian

  • Implements controls
  • Operates systems
  • Maintains data
  • Decides vs implements

Data Lifecycle AS

  • Owner Classifies data
  • Custodian Implements controls
  • User Follows rules
  • Classification Sensitivity label
  • Retention Required storage time
  • Remanence Residual data
  • Sanitization Data removal
  • DLP Leak prevention

Symmetric vs Asymmetric AR

Symmetric

  • One shared key
  • Fast bulk crypto
  • Key distribution issue

Asymmetric

  • Public/private keys
  • Slower
  • Supports signatures
  • Speed vs trust

Models AR

  • Bell-LaPadula Confidentiality model
  • Biba Integrity model
  • Clark-Wilson Well-formed transactions
  • Brewer-Nash Conflict of interest
  • Reference monitor Mediates access
  • TCB Trusted components
  • Fail secure Deny on failure
  • Defense-in-depth Layered controls

Crypto + PKI AR

  • Symmetric Shared secret
  • Asymmetric Key pair
  • Hash Integrity digest
  • HMAC Keyed hash
  • Digital signature Authenticity plus integrity
  • Certificate Public key binding
  • CA Certificate issuer
  • CRL/OCSP Revocation checks

Network Security NE

  • OSI 1 Physical
  • OSI 2 Data link
  • OSI 3 Network
  • TLS Transport encryption
  • IPsec Network encryption
  • VLAN Layer-2 segmentation
  • NAC Admission control
  • IDS/IPS Detect/prevent attacks

AAA IA

  • Identify, authenticate, authorize, account
  • Who claims Prove identity What allowed What logged

RBAC vs ABAC IA

RBAC

  • Role based
  • Job function
  • Simpler admin

ABAC

  • Attribute based
  • Context aware
  • Flexible rules
  • Role vs context

Access Model Picker IA

  • Job function access → RBAC
  • Label clearance → MAC
  • Owner discretion → DAC
  • Context rules → ABAC
  • High privilege → PAM

IAM IA

  • Identification Claim identity
  • Authentication Prove identity
  • Authorization Grant access
  • Accountability Trace actions
  • RBAC Role-based access
  • ABAC Attribute-based access
  • MAC Label-based access
  • DAC Owner-controlled access

Testing TE

  • Scan finds; pen test proves
  • Audit assures Code review inspects Metrics trend

Scan vs Pen Test TE

Scan

  • Find weaknesses
  • Automated
  • Broad coverage

Pen test

  • Exploit proof
  • Authorized attack
  • Limited scope
  • Find vs exploit

Assessment Picker TE

  • Need assurance → Audit
  • Find weaknesses → Vuln scan
  • Validate exploit → Pen test
  • Review source → Code review
  • Track risk trend → KRI

Assessment TE

  • Audit Independent assurance
  • Assessment Control review
  • Vulnerability scan Weakness discovery
  • Pen test Exploit validation
  • Code review Source inspection
  • Misuse case Abuse scenario
  • KPI Performance metric
  • KRI Risk indicator

Incident Cycle OP

  • Prepare, detect, contain, eradicate, recover
  • Lessons learned Evidence preserved Business informed

BCP vs DRP OP

BCP

  • Business continuity
  • Process survival
  • BIA driven

DRP

  • IT recovery
  • Systems restored
  • RTO/RPO driven
  • Business vs IT

Incident Picker OP

  • Detect event → Triage
  • Stop spread → Contain
  • Remove cause → Eradicate
  • Restore service → Recover
  • Improve process → Lessons learned

Operations OP

  • IR Incident response
  • Forensics Evidence handling
  • Chain custody Evidence history
  • SIEM Log correlation
  • Change control Approved modifications
  • Patch management Vulnerability reduction
  • Backup Data copy
  • DRP IT recovery plan

Software Security SD

  • Secure SDLC Security by phase
  • Threat modeling Design risk analysis
  • SAST Static code testing
  • DAST Runtime app testing
  • SBOM Component inventory
  • CI/CD Automated delivery
  • DevSecOps Security integrated delivery
  • Least privilege Minimum access

Common Traps

Technical vs managerial

  • CISSP favors governance ≠ Tools follow risk

Owner vs operator

  • Owner decides ≠ Custodian implements

Residual vs inherent

  • Inherent before controls ≠ Residual after controls

Authentication vs authorization

  • Authenticate proves identity ≠ Authorize grants access

Backup vs continuity

  • Backup stores data ≠ BCP keeps business

Hash vs encryption

  • Hash verifies integrity ≠ Encryption protects secrecy

Last Minute

  • 1. Think risk before tool
  • 2. Management owns risk appetite
  • 3. Data owner classifies
  • 4. Custodian implements controls
  • 5. BIA drives BCP priorities
  • 6. RTO = time target
  • 7. RPO = data loss
  • 8. Scan finds; pen proves
  • 9. Authenticate before authorize
  • 10. Residual risk needs acceptance

CISSP

  • Practice Questions 200 questions Study Guide 76 topics Cheat Sheet 80 facts Flashcards 50 cards Shorts 2 short s Videos 2 videos Blogs 2 blogs Free CE Podcast