CISSP – Study Plan

Topics

• CIA triad, confidentiality, integrity, availability
• Governance, policies, standards, procedures
• Risk management (identification, assessment, treatment)
• Compliance, legal, and regulatory issues

Activities

• Review the (ISC)² Code of Ethics.
• Perform a qualitative risk assessment for a sample scenario.
• Take ExamOS Rookie mode quiz (30 questions) on Security & Risk Management.

Topics

• Data classification (confidential, internal, public)
• Data lifecycle (creation, storage, use, sharing, archival, destruction)
• Retention policies and data sovereignty
• Privacy protection (PII, PHI)

Activities

• Create a data classification policy for a mock company.
• Review GDPR and CCPA requirements.
• Take ExamOS Challenger mode quiz on Asset Security.

Topics

• Secure design principles (defence in depth, least privilege, zero trust)
• Encryption (symmetric, asymmetric, hashing)
• PKI and certificate management
• Database, cloud, and web security models

Activities

• Design a secure network architecture diagram.
• Compare encryption algorithms and their use cases.
• Take ExamOS Challenger mode quiz on Security Architecture.

Topics

• OSI and TCP/IP models
• Secure network components (firewalls, IDS/IPS, VPN)
• Network attacks (DoS, MITM, sniffing)
• Wireless and remote access security

Activities

• Configure a simple firewall rule set (conceptual).
• Identify network attack vectors in a sample scenario.
• Take ExamOS Challenger mode quiz on Network Security.

Topics

• Authentication factors (something you know/have/are)
• Single sign‑on (SSO) and federation (SAML, OAuth, OpenID)
• Access control models (DAC, MAC, RBAC, ABAC)
• Identity lifecycle and provisioning

Activities

• Map an IAM solution to a business scenario (e.g., cloud migration).
• Compare RBAC vs. ABAC.
• Take ExamOS Challenger mode quiz on IAM.

Topics

• Vulnerability assessments vs. penetration testing
• Security audit and logging
• Test outputs (reports, remediation)
• Business continuity and disaster recovery testing

Activities

• Plan a vulnerability assessment program.
• Interpret a sample penetration test report.
• Take ExamOS Challenger mode quiz on Assessment & Testing.

Topics

• Incident response process (preparation, detection, containment, eradication, recovery, lessons learned)
• Forensics and evidence handling
• Patch and change management
• Physical security (facilities, access controls)

Activities

• Create an incident response plan template.
• Practice chain of custody documentation.
• Take ExamOS Challenger mode quiz on Security Operations.

Topics

• Secure SDLC (SSDLC)
• Common vulnerabilities (OWASP Top 10)
• Security testing (SAST, DAST, IAST)
• DevSecOps and CI/CD security

Activities

• Review OWASP Top 10 for a sample application.
• Map security activities to software development phases.
• Take ExamOS Challenger mode quiz on Software Security.

Topics

• Cumulative review of first 4 domains
• Time management for 125–175 questions (3 hours)

Activities

• Take ExamOS Challenger mode full quizzes (all domains) – at least 2.
• Review every incorrect answer.
• Repeat until you pass 2 Challenger quizzes in a row.

Topics

• Cumulative review of domains 5–8
• Time management

Activities

• Take ExamOS Challenger mode full quizzes (all domains) – at least 2.
• Identify persistent weak domains.
• Repeat until you pass 2 Challenger quizzes in a row.

Topics

• Full 3‑hour simulation (125–175 questions)
• Adaptive exam style (CAT – Computerised Adaptive Testing)

Activities

• Take ExamOS Legend mode full quizzes (80% hard) – at least 3.
• Simulate the full exam length.
• Review every incorrect answer.
• Once you pass Legend mode twice in a row, schedule your real exam.