Certified Information Systems Security Professional (CISSP) Security Operations Syllabus

Name the standards of proof from lowest to highest used in investigations/legal contexts.

Preponderance of the evidence (civil) < clear and convincing evidence < beyond a reasonable doubt (criminal).

What is the difference between configuration management and change management?

Configuration management establishes and maintains a known, documented baseline of systems; change management is the formal process for reviewing, approving, and tracking modifications to that baseline.

What is a 'baseline' in configuration management?

A documented, approved standard configuration (settings, software, patches) that systems must conform to, serving as the reference point for detecting unauthorized changes (configuration drift).

Define 'configuration drift'.

The gradual, often undocumented divergence of a system's actual configuration from its approved baseline, introducing security gaps and inconsistencies.

What are the typical steps of a formal change management process?

Request, review/impact analysis, approval (e.g., by a Change Advisory Board), testing, scheduling, implementation, verification, and documentation, with a rollback/back-out plan.

What is the purpose of a back-out (rollback) plan in change management?

To define how to safely revert a change to the prior known-good state if the change fails or causes problems, minimizing downtime and impact.

What is the difference between 'sanitization', 'purging', and 'destruction' of media?

Sanitization (clearing) removes data so it can't be recovered by normal means; purging removes data resistant to laboratory recovery (e.g., degaussing/crypto-erase); destruction physically renders media unusable (shredding/incineration).

Why is degaussing ineffective on solid-state drives (SSDs)?

SSDs store data in flash memory chips, not on magnetic media, so a magnetic field (degausser) does not erase them; cryptographic erasure or physical destruction is required instead.

What is 'data remanence'?

Residual data that remains on storage media after attempts to erase or delete it, which could be recovered if the media is not properly sanitized.

What is cryptographic erasure (crypto-shredding)?

Sanitizing data by destroying the encryption keys used to encrypt it, rendering the still-present ciphertext permanently unreadable. Useful for SSDs and cloud storage.

What is the purpose of asset classification and labeling in media management?

To assign sensitivity levels so that handling, storage, transmission, and disposal controls match the value/risk of the asset and meet protection requirements.

What does 'patch management' encompass in protecting infrastructure?

Identifying, acquiring, testing, deploying, and verifying software/firmware updates to remediate vulnerabilities and bugs across systems on a controlled schedule.

What is the difference between vulnerability management and patch management?

Vulnerability management is the broader cycle of identifying, assessing, prioritizing, and remediating weaknesses; patch management is one remediation method (applying updates) within that cycle.

What is a honeypot, and what is a honeynet?

A honeypot is a decoy system designed to attract and study attackers; a honeynet is a network of multiple honeypots simulating a realistic environment to observe attacker behavior.

What is the difference between whitelisting and blacklisting in application control?

Whitelisting (allow-listing) permits only explicitly approved applications and denies all else (default-deny); blacklisting (deny-listing) blocks only known-bad items and allows all else (default-allow).

List the phases of the incident response lifecycle (NIST SP 800-61 model).

1) Preparation, 2) Detection and Analysis, 3) Containment, Eradication, and Recovery, 4) Post-Incident Activity (lessons learned).

What are the (ISC)² seven steps of incident management?

Detection, Response, Mitigation, Reporting, Recovery, Remediation, and Lessons Learned.

What is the difference between an 'event' and an 'incident'?

An event is any observable occurrence in a system or network; an incident is an event (or series) that violates security policy or threatens the confidentiality, integrity, or availability of assets.

What is the difference between short-term and long-term containment in incident response?

Short-term containment quickly limits damage (e.g., isolating a host) without full remediation; long-term containment applies temporary fixes to keep systems running until eradication, often after evidence is preserved.

What is the purpose of the 'lessons learned' phase of incident response?

To review the incident and response, identify root causes and gaps, and improve detection, prevention, and response capabilities to reduce recurrence.

What is the difference between detective and preventive controls? Give an example of each.

Preventive controls stop incidents before they occur (e.g., firewalls, locks, encryption); detective controls identify incidents after/as they occur (e.g., IDS, audit logs, CCTV review, alarms).

How do corrective and compensating controls differ?

Corrective controls restore systems after an incident (e.g., restoring from backup, antivirus removal); compensating controls are alternative safeguards used when a primary control is not feasible.

What is 'defense in depth'?

A layered security strategy using multiple, overlapping controls (physical, technical, administrative) so that if one layer fails, others continue to protect the asset.

What is the difference between a CSIRT and a SOC?

A SOC (Security Operations Center) continuously monitors and detects security events; a CSIRT (Computer Security Incident Response Team) is the team that responds to and manages declared incidents.

What is threat intelligence and how does it support security operations?

Evidence-based knowledge about existing or emerging threats (TTPs, IOCs, actors); it informs detection rules, prioritization, hunting, and proactive defense.

Define RPO and RTO.

RPO (Recovery Point Objective) is the maximum acceptable amount of data loss measured in time (how far back the last good backup must be). RTO (Recovery Time Objective) is the maximum acceptable time to restore a system/process after disruption.

Compare full, incremental, and differential backups (what each copies and restore complexity).

Full copies all data. Incremental copies data changed since the last backup (any type), clearing the archive bit; fast backup, slower restore (needs full + all increments). Differential copies data changed since the last full backup, not clearing the archive bit; slower backup, faster restore (needs full + last differential).

In backup terms, what role does the 'archive bit' play in incremental vs differential backups?

Incremental backups reset (clear) the archive bit after copying, so each captures only new changes; differential backups do not clear it, so each captures all changes since the last full backup.

What is the 3-2-1 backup rule?

Keep at least 3 copies of data, on 2 different media types, with 1 copy stored offsite.

What is electronic vaulting versus remote journaling?

Electronic vaulting transfers batched backup copies of files/databases to a remote site periodically; remote journaling transmits only the transaction logs (journals) to the remote site in near real-time for faster, more current recovery.

Compare hot, warm, and cold recovery sites.

Cold site: space/power/HVAC only, no equipment or data—longest recovery, cheapest. Warm site: hardware and connectivity in place but data not current—moderate cost/recovery. Hot site: fully equipped and near-real-time data, ready almost immediately—fastest recovery, most expensive.

What is a mobile site and a reciprocal (mutual aid) agreement?

A mobile site is a transportable, prefitted recovery facility (e.g., trailer). A reciprocal agreement is a mutual arrangement where two organizations agree to host each other's operations during a disaster—cheap but legally weak and capacity-uncertain.

What is the difference between RAID 1, RAID 5, and RAID 6?

RAID 1 mirrors data across drives (full redundancy, 50% usable). RAID 5 stripes with single distributed parity (survives one drive failure). RAID 6 stripes with dual parity (survives two simultaneous drive failures).

What is the difference between high availability clustering and fault tolerance?

Fault tolerance keeps a system running without interruption despite a component failure (redundant hardware, no downtime). High-availability clustering minimizes downtime by failing over to another node, possibly with a brief interruption.

List common disaster recovery plan test types from least to most disruptive.

Checklist/read-through review, structured walk-through (tabletop), simulation, parallel test (recovery systems run alongside production), and full-interruption test (production is actually failed over).

What is the difference between a DRP and a BCP?

A BCP (Business Continuity Plan) is the overall strategy to keep the whole organization operating during/after a disruption; a DRP (Disaster Recovery Plan) is the IT-focused subset for recovering systems, data, and infrastructure.

During DRP execution, who typically decides to invoke the plan and to declare a disaster?

A designated senior individual/team with declaration authority (e.g., the incident/recovery manager or executive), based on predefined criteria for disaster declaration.

What CPTED principle uses environmental design to reduce crime, and name its three strategies?

CPTED (Crime Prevention Through Environmental Design). Its strategies are natural surveillance, natural access control, and natural territorial reinforcement.

What is a mantrap (access control vestibule) and what attack does it prevent?

A two-door entry system where one door must close/lock before the next opens, allowing one person through at a time. It prevents tailgating/piggybacking and controls entry to secure areas.

What is the difference between tailgating and piggybacking?

Tailgating is an unauthorized person following an authorized person through a controlled door without their knowledge; piggybacking occurs with the authorized person's consent/awareness. Both bypass access control.

What lighting and fencing facts should a security operations student know for physical deterrence?

A fence of 3-4 ft deters casual trespassers, 6-7 ft is too high to climb easily, and 8 ft with 3 strands of barbed wire deters determined intruders. Critical-area lighting should illuminate at least 8 ft high with 2 foot-candles of intensity.

In fire safety, what does the safety mnemonic prioritize, and why does it matter in personnel safety?

Human life/safety is always the top priority over assets and data. Evacuation and life safety take precedence over protecting equipment in any emergency.

What are the four classes of fire and the appropriate suppression for each (A, B, C, D)?

Class A: common combustibles (water/soda acid). Class B: flammable liquids/gases (CO2, foam, dry chemical). Class C: electrical fires (CO2, non-conductive agents—never water). Class D: combustible metals (dry powder).

Compare wet pipe, dry pipe, deluge, and preaction sprinkler systems.

Wet pipe: water always in pipes, fastest, risk of leaks/freezing. Dry pipe: pipes hold pressurized air, water released on valve open—prevents freezing. Deluge: like dry pipe but with open heads, releases large water volume at once. Preaction: combines dry/wet—water enters pipes on first trigger and releases only after a second (heat) trigger, reducing accidental discharge (best for data centers).

Why is FM-200 (or inert gas) used instead of Halon in modern data centers?

Halon is an effective clean agent but was banned under the Montreal Protocol for depleting the ozone layer; FM-200 and inert gases are ozone-safe clean agents that suppress fire without damaging electronics or harming personnel at design concentrations.

What is duress signaling and where is it used in personnel safety?

A covert way for personnel under coercion to silently signal for help (e.g., a duress code or panic button), used at access points, guard stations, and reception to alert security without alarming an attacker.

What two power conditioning/protection technologies guard against power fluctuations and outages?

A UPS (Uninterruptible Power Supply) provides immediate battery backup and conditioning to bridge short outages and ride-through to generators; backup generators supply longer-term power during extended outages.

Define brownout, blackout, sag, spike, and surge in power terms.

Blackout: total loss of power. Brownout: prolonged drop in voltage. Sag: momentary low voltage. Spike: momentary high voltage. Surge: prolonged high voltage.

What is the purpose of Service Level Agreements (SLAs) in operational security coordination?

SLAs define measurable performance and availability commitments (e.g., uptime, response times) between providers and customers, ensuring security and operational expectations are documented and enforceable.

What is the difference between MTBF and MTTR?

MTBF (Mean Time Between Failures) is the average operational time between failures of a repairable component (reliability). MTTR (Mean Time To Repair/Restore) is the average time to fix it and return it to service (recoverability).

What is the Maximum Tolerable Downtime (MTD) and how does it relate to RTO?

MTD (also MTPD) is the longest time a business process can be unavailable before causing unacceptable harm. RTO must be less than MTD; the difference accounts for restoring the work/data backlog (WRT).