Certified Information Systems Security Professional (CISSP) Security Operations Syllabus

Security Operations syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Security Operations in Certified Information Systems Security Professional (CISSP), not a summary of it.

1. 1

   Operational Foundations and Investigations

   3 topics

   • Foundational Operational Concepts
     • Need to know and least privilege in operations
     • Separation of duties and two-person control
     • Privileged account management and SCRM in operations
   • Logging and Monitoring
     • SIEM aggregation and correlation
     • Continuous monitoring and egress monitoring
     • User and entity behavior analytics (UEBA)
     • Threat intelligence feeds and indicators
   • Conducting Investigations
     • Digital forensics process and tools
     • Evidence collection and preservation
     • Reporting and documenting investigations
2. 2

   Resource Protection and Provisioning

   3 topics

   • Configuration and Change Management
     • Baselining and configuration drift
     • Change control process and approval
     • Patch and vulnerability management
   • Media and Asset Management
     • Media protection and handling
     • Asset inventory and lifecycle
   • Protecting Infrastructure
     • Hardening systems and applying security baselines
     • Cloud and virtualization resource protection
3. 3

   Incident Management

   3 topics

   • Incident Response Lifecycle
     • Detection and triage
     • Response, mitigation, and reporting
     • Recovery, remediation, and lessons learned
   • Detective and Preventive Measures
     • Firewalls, IDS/IPS, and sandboxing
     • Anti-malware and allowlisting
     • Honeypots, honeynets, and deception
     • Machine learning and AI-based detection
   • Operating Incident Response Programs
     • Incident response team structure
     • Playbooks and escalation procedures
     • Coordination with stakeholders and law enforcement
4. 4

   Disaster Recovery and Resilience

   3 topics

   • Backup and Recovery Strategies
     • Full, incremental, and differential backups
     • Backup rotation and offsite storage
     • Electronic vaulting and journaling
   • Recovery Sites and Fault Tolerance
     • Hot, warm, cold, and mobile sites
     • RAID, clustering, and redundancy
     • High availability and quality of service
   • Disaster Recovery Plan Execution
     • Response and personnel roles
     • Restoration and return to normal operations
     • DR testing and assessment
5. 5

   Physical and Personnel Operational Security

   3 topics

   • Physical Security Operations
     • Perimeter and internal security monitoring
     • Visitor and access logging
   • Personnel Safety and Security
     • Duress, travel, and emergency procedures
     • Security training and emergency management
   • Operational Security Coordination
     • Service-level agreements and operational metrics
     • Coordinating physical and logical access controls
     • Insider threat monitoring

Security Operations flashcards for Certified Information Systems Security Professional (CISSP)

22 of 71 cards from the Security Operations deck — real questions with worked answers.

1. What is the principle of 'least privilege' in security operations?

   Granting users, processes, and systems only the minimum access rights and permissions necessary to perform their assigned tasks, and nothing more.

2. What is the difference between 'need to know' and 'least privilege'?

   Need to know restricts access to specific data/information a person requires for their job; least privilege restricts the overall permissions/rights granted. Need to know is about data access; least privilege is about the breadth of rights.

3. What is 'separation of duties' (SoD) and why is it used?

   Dividing a critical task among multiple people so no single individual can complete it alone, preventing fraud and errors by requiring collusion to abuse the process.

4. What operational control requires two or more people to perform a sensitive task simultaneously?

   Dual control (also called two-person control or M of N control), e.g., requiring two operators to launch or access a critical resource together.

5. What is 'job rotation' and what security benefit does it provide?

   Periodically moving employees through different roles; it deters and detects fraud (a hidden scheme surfaces when someone new takes over) and reduces dependence on any single person.

6. What is the security purpose of 'mandatory vacations'?

   Requiring employees to take time off so another person covers their duties, exposing fraudulent or unauthorized activity that requires the original person's continuous presence to conceal.

7. Define 'privileged account management' (PAM).

   The processes and tools used to control, monitor, secure, and audit accounts with elevated rights (admin, root, service accounts), including check-out, session recording, and credential vaulting.

8. What is the difference between a SIEM and a SOAR platform?

   A SIEM (Security Information and Event Management) aggregates, correlates, and alerts on log/event data; a SOAR (Security Orchestration, Automation and Response) adds automated playbooks and orchestrated response actions to that data.

9. What three core functions does logging and monitoring support?

   Detection (identifying anomalies/attacks), deterrence (discouraging misuse), and accountability/forensics (attributing actions to users for investigation).

10. What is the purpose of clock synchronization (e.g., NTP) for logging?

    It ensures timestamps across systems are consistent so events can be accurately correlated and sequenced during monitoring and investigations.

11. What is the difference between a signature-based and an anomaly-based (behavior-based) IDS?

    Signature-based detects known attack patterns from a database (low false positives, misses novel attacks); anomaly-based flags deviations from a learned baseline (detects unknown attacks, higher false positives).

12. What is the difference between an IDS and an IPS?

    An IDS (Intrusion Detection System) only detects and alerts on suspicious activity; an IPS (Intrusion Prevention System) sits inline and can actively block or drop malicious traffic.

13. What is 'egress monitoring' and what does it help detect?

    Inspecting outbound traffic leaving a network; it helps detect data exfiltration, command-and-control communications, and DLP violations.

14. What is User and Entity Behavior Analytics (UEBA)?

    A monitoring technique that builds behavioral baselines for users and devices and uses analytics/machine learning to flag anomalous activity indicating insider threats or compromised accounts.

15. What are the four main types of evidence in an investigation?

    Real (physical objects), documentary (writings/logs/records), testimonial (witness statements), and demonstrative (illustrative aids like charts/models).

16. What is the 'best evidence rule'?

    A legal rule requiring the original document/evidence be presented in court rather than a copy, unless the original is unavailable for legitimate reasons.

17. State the 'chain of custody' and why it matters.

    A documented, unbroken record of who collected, handled, transferred, and stored evidence, including times and reasons. It proves evidence integrity and admissibility in court.

18. What is the difference between a forensic investigation that is 'operational' vs one that is 'criminal'?

    Operational/administrative investigations aim to fix or improve operations (lower proof bar); criminal investigations seek prosecution and must meet 'beyond a reasonable doubt' with strict evidence handling.

19. In forensic acquisition, why must investigators work from a bit-level image rather than the original drive?

    To preserve the original evidence unchanged; analysis is performed on a verified copy (validated by hashing) so the original integrity and admissibility are maintained.

20. What hash-based technique verifies that a forensic image matches the original media?

    Computing a cryptographic hash (e.g., SHA-256) of both the original and the image; matching hashes prove the copy is identical and unaltered.

21. Name the standards of proof from lowest to highest used in investigations/legal contexts.

    Preponderance of the evidence (civil) < clear and convincing evidence < beyond a reasonable doubt (criminal).

22. What is the difference between configuration management and change management?

    Configuration management establishes and maintains a known, documented baseline of systems; change management is the formal process for reviewing, approving, and tracking modifications to that baseline.

See more Security Operations flashcards →

Planning Security Operations for Certified Information Systems Security Professional (CISSP)

Security Operations (Certified Information Systems Security Professional (CISSP)) FAQ