(ISC)² CC - Comprehensive Exam Cram Notes

(ISC)² CC — Comprehensive Exam Cram Notes

⚠️ FORMAT CORRECTION (Aug 2026) — READ FIRST

The exam is no longer the “100 multiple-choice” format most online guides describe.

• Format: CAT (Computerized Adaptive Testing) — 100–125 items, 2 hours, 700/1000 to pass
• Item types: MCQ + advanced types (drag-and-drop, scenario-based)
• No item review — once submitted, locked in forever
• 25 of the first 100 are UNSCORED pretest — you cannot tell which
• Delivery: Pearson VUE test center only (no online proctoring)
• Today’s sitting is on the current Oct 1, 2025 outline. A new outline (renamed domains, AI content) takes effect Sept 1, 2026 — does not apply to you.

Companion files: CC-CHEATSHEET.md (compact), research/00-MASTER-STRATEGY.md (action plan), research/01–04 (deep evidence base).

---

How to use this guide

This is a deep reference, not a scannable. It mirrors the official (ISC)² CC Exam Outline (Oct 1, 2025) subtask structure so you can find any topic in seconds. For each topic: definition → key facts → common traps → memory aid.

Suggested flow tonight:

1. Read §“The Manager Mindset” first (5 min) — this is the #1 thing that flips the pass rate.
2. Skim Domain 1 (Security Principles, 26%) — your highest-weight section. Pay attention to CIA + Risk + Code of Ethics.
3. Hit Domain 4 (Network Security, 24%) and Domain 3 (Access Controls, 22%) — together with Domain 1, that’s 72% of the exam.
4. Domain 5 (Security Operations, 18%) and Domain 2 (BC/DR/IR, 10%) are smaller but still scored.
5. End with the “Frequently Confused” pairs — those are the high-trap-density areas.

Don’t read this straight through. Use the table of contents. Jump to your weakest domain. Stop studying 90 min before the exam and never cram past midnight.

---

Exam Snapshot

Attribute	Value
Code	(ISC)² CC — Certified in Cybersecurity
Format	CAT, 100–125 items
Time	2 hours
Passing score	700 / 1000 (scaled)
Languages	EN, ZH-CN, JA, DE, ES
Delivery	Pearson VUE test centers only
Pre-reqs	None (16+ years old)
Cost	$199 (1MCC free offer closed for new signups May 20, 2026)
Endorsement window after passing	9 months
Annual fee (AMF)	$50/yr for CC-only
Renewal cycle	3 years · 45 Group A CPEs
Pretest items	25 of first 100, unscored, unidentified
Item review	None (CAT)

Domain Weights (current Oct 1, 2025 outline)

#	Domain	Weight
1	Security Principles	26%
2	Business Continuity, Disaster Recovery & Incident Response	10%
3	Access Controls Concepts	22%
4	Network Security	24%
5	Security Operations	18%

Domains 1 + 3 + 4 = 72% of the exam. Budget your study time accordingly.

---

🧠 The Manager Mindset (Read This First)

This is the single biggest differentiator between passers and failers. The (ISC)² CC is not a technical recall test. It’s a managerial judgment test where the “best” answer is what a CISO or security manager would choose, not a hands-on engineer.

When the question gives you a scenario and two or three options all look right, the “best” answer is the one that:

1. Aligns with more core principles (CIA, least privilege, defense in depth, separation of duties, non-repudiation)
2. Addresses more layers of the issue (people, process, technology)
3. Is the first step in a defined sequence (Preparation, BIA, Identify)
4. Maps to the most general principle (defense in depth beats a single strong control)

“You need to put yourself in the shoes of a manager, not a hacker. And for someone who comes from a pure CTF background like me, that’s not easy at all.” — dangkhoi.me, failed first, then passed

Trap pattern: if your background is hands-on technical (CTF, pentest, sysadmin, network engineering), your instinct is to pick the technically correct answer. (ISC)² wants the manager-correct answer. They are often the same, but when they differ, the manager answer wins.

---

Domain 1: Security Principles (26%)

The single highest-weight domain. If you only study one domain tonight, this one.

1.1 Information Assurance Concepts

The CIA Triad

The three pillars of information security. Every security decision ultimately comes back to one of these.

Pillar	Definition	When it’s at risk
Confidentiality	Prevent unauthorized disclosure	Data leaked, snooping, eavesdropping, social engineering
Integrity	Prevent unauthorized modification	Data altered, tampering, MITM, malware
Availability	Ensure timely access	DDoS, ransomware, hardware failure, natural disaster

Extended model — add-ons:

• Authenticity — proof of origin (digital signatures, certificates)
• Non-repudiation — proof an action occurred, can’t be denied (digital signatures, audit logs)
• Privacy — proper handling of personal data (PII, PHI)

Trap questions to watch:

• DDoS is availability, not confidentiality (it doesn’t leak data)
• “Data was modified” is integrity, not confidentiality
• “Person denies they did the action” is non-repudiation
• Confidentiality often uses encryption; integrity often uses hashing; non-repudiation uses digital signatures

Memory aid: Confidentiality = Close (kept secret) · Integrity = Intact (not altered) · Availability = Accessible (up and running)

Other IA Concepts

• Privacy — proper handling of PII/PHI per regulation (GDPR, HIPAA, PCI DSS)
• Authenticity — verifying the source of data (digital signatures)
• Non-repudiation — preventing denial of an action (digital signatures + audit trails)
• Accountability — ability to trace actions to a specific user (audit logs, unique IDs)

1.2 Risk Management

Core Definitions

• Asset — anything of value to the org (data, hardware, people, reputation)
• Threat — anything that can exploit a vulnerability (hacker, malware, flood, employee)
• Vulnerability — a weakness that can be exploited (unpatched software, weak password, unlocked door)
• Risk — the probability and impact of a threat exploiting a vulnerability
• Impact — the damage if the threat succeeds (financial, reputational, operational)
• Likelihood — the probability of the threat occurring
• Control / Safeguard / Countermeasure — anything that reduces risk
• Exposure — the potential loss if a threat exploits a vulnerability
• Total Risk = Threat × Vulnerability × Asset Value
• Residual Risk = Total Risk − Countermeasures (the risk that remains after controls)
• Inherent Risk = the risk before any controls

The Risk Formula

Risk = Threat × Vulnerability × Impact

• Risk is not just probability of occurrence — it’s the combination of threat, vulnerability, and consequence
• Reducing any one of the three reduces risk
• Common trap: confusing threat with risk. A threat is the actor/event; risk is the product of threat × vulnerability × impact

Risk Treatment (4 options)

Option	When to use	Example
Accept	Risk is low; cost of mitigation > cost of risk	Accept the risk of a laptop being lost on a 1-hour trip
Avoid	Eliminate the risk by removing the activity	Don’t launch a product with a known fatal flaw
Mitigate	Reduce likelihood or impact with controls	Patch software, train staff, deploy a firewall
Transfer	Shift the risk to a third party	Buy insurance, outsource to a managed security provider, sign a contract with liability clauses

“Risk transfer” does not mean “make it go away.” It means someone else is now on the hook. (Insurance = transfer; outsourcing = transfer.)

Memory aid: AAMT (Accept, Avoid, Mitigate, Transfer) or “MATT” (Mitigate, Accept, Transfer, Avoid — different sources order differently, but those are the 4)

Risk Assessment Process

1. Identify assets and their value
2. Identify threats and vulnerabilities
3. Assess likelihood and impact
4. Calculate risk
5. Treat risk (one of the 4 options)
6. Monitor and review continuously

Due Diligence vs Due Care

• Due Diligence — research and awareness (doing the homework on what risks exist)
• Due Care — acting on that awareness (applying the controls)
• Due care fails without due diligence. You can’t reasonably act on risks you haven’t researched.

1.3 Security Controls

3 Categories (also called “control types”)

Category	Also called	Examples
Administrative	Managerial / Procedural	Policies, procedures, training, background checks, security awareness
Physical	Operational	Locks, fences, cameras, guards, mantraps, bollards, lighting
Logical	Technical	Passwords, ACLs, encryption, firewalls, antivirus, MFA

4 Control Functions

Function	Purpose	Example
Preventive	Stop before it happens	Firewall, encryption, MFA, locks
Detective	Identify when it’s happening	IDS, CCTV, log monitoring, audit trail
Corrective	Fix after it happens	Backup restore, patch, incident response
Deterrent	Discourage the attempt	Warning signs, security guards, legal notices

Some sources also list Recovery (restore after incident) and Compensating (alternative when primary control isn’t feasible — e.g., a manual log review if you can’t deploy an SIEM).

Defense in Depth = layering multiple categories and functions. No single control is the whole answer. Almost always the right answer for “best” / “most complete” questions.

1.4 (ISC)² Code of Ethics

The 4 Canons (mnemonic: PAPA)

1. Protect society, the common good, necessary public trust and confidence, and the infrastructure
2. Act honorably, honestly, justly, responsibly, and legally
3. Provide diligent and competent service to principals
4. Advance and protect the profession

Rules:

• Lower-numbered canons take precedence when in conflict (Canon 1 trumps all)
• Canon I and II complaints may be filed by any member of the public
• Canon III complaints require a principal (employer or client) relationship
• Canon IV complaints are limited to other (ISC)² members

How the exam tests this: typically 3–5 questions. Either directly (“Which canon addresses X?”) or scenario-based (“A member is asked to do X. Which canon applies?”). Always use Canon 1 if a public-safety issue is involved.

1.5 Governance Elements

Security governance = the framework of policies, procedures, standards, and guidelines that direct an organization’s security posture.

Document	Mandatory?	Scope	Specificity
Policy	Yes (high-level mandate)	Organization-wide	High-level, why
Standard	Yes (mandatory)	Organization-wide	Specific, what
Procedure	Yes (mandatory steps)	Specific task	How (step-by-step)
Guideline	No (recommended)	Flexible	Advice, when to deviate

Order from most general → most specific: Policy > Standard > Procedure > Guideline

Senior management responsibility — security is a business issue, not just IT. The CISO reports up; the board owns risk.

---

Domain 2: Business Continuity, Disaster Recovery & Incident Response (10%)

The lightest domain on the exam, but every question here is testable because of “first/next step” wording.

2.1 Business Continuity

BCP (Business Continuity Plan) — keeps the business running during/after a disruption. It’s broader than DRP; it covers people, processes, facilities, supply chain.

BIA (Business Impact Analysis) — the FIRST step of BCP. Identifies:

• Critical business functions
• RTO and RPO for each
• Dependencies (people, systems, vendors)
• Financial / reputational impact of disruption

Order is critical:

1. BIA (identify what’s critical)
2. BCP (plan to keep it running)
3. DRP (plan to recover IT)
4. Test and maintain

2.2 Disaster Recovery

DRP (Disaster Recovery Plan) — restore IT infrastructure and data after a disaster. Subset of BCP, focused on technology.

Term	Question it answers
RTO (Recovery Time Objective)	How fast must systems be back? (downtime tolerance)
RPO (Recovery Point Objective)	How much data loss is acceptable? (time-based)
MTTR (Mean Time To Repair)	Average time to fix a failed component
MTBF (Mean Time Between Failures)	Average time between failures (reliability indicator)
MTTF (Mean Time To Failure)	Average time to failure (non-repairable items)

Trap: RTO is about downtime, RPO is about data loss. Different concepts.

DR Sites

Type	Description	Cost	RTO
Hot	Live mirror, current data, immediate failover	$$$	Minutes
Warm	Partial infrastructure + periodic data replication	$$	Hours
Cold	Empty facility, no data; must be provisioned	$	Days+
Mobile	Portable trailer with equipment	Varies	Varies
Cloud	Cloud-based DR (e.g., AWS, Azure as recovery site)	Variable	Variable

“Hot = High cost, High speed”

Backups

Type	What it backs up	Restore speed	Storage
Full	Everything	Fastest	Most
Incremental	Only changes since last backup of any type	Slowest	Least
Differential	Changes since last full backup	Medium	Medium

3-2-1 Rule — the gold standard:

• 3 copies of data
• 2 different media types
• 1 offsite (geographically separated)

Test backups regularly. An untested backup isn’t a backup.

RAID Levels

Level	Min Disks	Fault Tolerance	Use case
0	2	None — striping only	Performance, no redundancy
1	2	1 disk — mirroring	High-availability, low capacity need
5	3	1 disk — striping + single parity	General purpose
6	4	2 disks — striping + double parity	Better fault tolerance
10 (1+0)	4	1 per mirror — stripe of mirrors	Best performance + redundancy

Memory aid: “RAID 0 = speed, no safety. RAID 1 = safety, no space. RAID 5 = balance. RAID 6 = paranoia. RAID 10 = money.”

2.3 Incident Response

NIST IR Lifecycle (4 phases in current outline)

1. Preparation — policies, training, tools, runbooks (always first)
2. Detection & Analysis — confirm the incident, scope it, determine severity
3. Containment, Eradication & Recovery — stop the bleed, remove the threat, restore from clean backup
4. Post-Incident Activity — lessons learned, report, update procedures

Older 6-phase model (some sources still use): Preparation → Identification → Containment → Eradication → Recovery → Lessons Learned

“First step in IR” → always Preparation “First step in BCP” → always BIA

Order rule (containment before eradication before recovery):

• Contain (stop the spread) first
• Then eradicate (remove malware, close the access)
• Then recover (restore from clean backups, monitor)

IR Team Roles

• CSIRT / CIRT — Computer Security Incident Response Team
• Incident Handler / First Responder — first person on the scene
• CISO — final escalation, business decisions
• Legal / HR / PR — involved based on incident type
• Forensics — evidence collection (chain of custody!)

Chain of custody — documented, unbroken record of evidence handling. Critical for any incident that may go to court.

---

Domain 3: Access Controls (22%)

The terminology jungle. Many terms look similar. Master the distinctions.

3.1 Physical Access Controls

Type	Examples
Deterrents	Signs, lighting, visible cameras
Detective	Motion sensors, cameras, alarms, logs
Preventive / Delay	Fences, locks, doors, mantraps, bollards, guards, badges
Recovery	Backup facilities, environmental controls

Key physical security concepts:

• Mantrap — two doors, only one opens at a time (anti-piggybacking/tailgating)
• Bollards — short vertical posts to prevent vehicle ramming
• Faraday cage — blocks electromagnetic signals (prevents wireless attacks)
• Air gap — physically isolated network (no connection to other networks)
• Lockout / Tagout — ensures equipment can’t be accidentally powered on during maintenance

3.2 Logical Access Controls

3 Categories of Controls (Admin / Physical / Logical)

See §1.3. Logical is the technical kind: passwords, ACLs, encryption, etc.

6 Access Control Models

Model	Decision based on	Use case	Memory cue
DAC (Discretionary)	Owner’s discretion	Small/medium org, file ownership	“Owner decides”
MAC (Mandatory)	Labels & clearances (e.g., Top Secret)	Military, government, high-security	“Military / Mandatory”
RBAC (Role-Based)	Role / job function	Enterprises (most common)	“Role”
RuBAC (Rule-Based)	Rules (e.g., time-of-day, source IP)	Firewall ACLs, network gear	“Rule”
ABAC (Attribute-Based)	Multiple attributes (user, resource, env)	Fine-grained, dynamic, federated	“Attribute”
Risk-Based	Risk score / context (e.g., new device, new location)	Adaptive authentication	“Risk”

The “first-pass” DAC-vs-MAC rule:

• Scenario word “clearance,” “Top Secret,” “government,” “military” → MAC
• Scenario word “owner,” “file,” “creator decides” → DAC
• Scenario word “role” / “job function” → RBAC

Authentication vs Authorization vs Accounting (AAA)

Concept	Question it answers	Example
Authentication	“Are you who you say you are?”	Password, fingerprint, smart card
Authorization	“What are you allowed to do?”	File permissions, role-based access
Accounting (Auditing)	“What did you do?”	Audit logs, SIEM correlation

Trap: authentication is NOT authorization. Logging in with a valid password = authenticated. Having read access to a file = authorized. They’re separate steps.

Authentication Factors (5)

Factor	Type	Examples
Type 1	Something you know	Password, PIN, security question
Type 2	Something you have	Smart card, token, phone (SMS/app), USB key
Type 3	Something you are	Fingerprint, iris, retina, facial, voice, signature, gait
Type 4	Somewhere you are	Geolocation, IP address, GPS
Type 5	Something you do	Typing pattern, gait, behavioral biometric

MFA = 2+ different types of factors. Two passwords is not MFA; password + fingerprint is MFA.

Biometrics

Term	Definition	Want it LOW
FAR (False Acceptance Rate)	Impostor accepted	Lower is better
FRR (False Rejection Rate)	Legit user rejected	Lower is better
CER (Crossover Error Rate)	Where FAR = FRR	Lower is better — the headlining metric

Type 1 error = False Rejection (false negative); Type 2 error = False Acceptance (false positive).

Account / Password Management

• Account types: User, Privileged/Admin, Service, Guest, Shared
• Avoid shared accounts — they break accountability
• Privileged Access Management (PAM) — extra controls for high-privilege accounts (just-in-time access, vault)
• Service accounts — for machine-to-machine, no human, strong passwords
• Password best practices (modern NIST):
  • Length > complexity (8+ minimum, 12+ recommended)
  • No forced periodic rotation (only on compromise or known breach)
  • Screen against breach dictionaries (e.g., haveibeenpwned)
  • Salt + hash with bcrypt/Argon2 — never store plaintext
  • No password hints visible to others
• Hashing for password storage: MD5 (broken), SHA-1 (weak), SHA-256 (OK), bcrypt / Argon2 (best)

Core Access Principles

• Least Privilege — minimum access needed to do the job
• Need to Know — data on a strict need basis (subset of least privilege)
• Separation of Duties (SoD) — split critical tasks so no one person has end-to-end control
• Implicit Deny — default deny; allow only what’s explicitly permitted
• Privilege Creep — accumulation of unneeded permissions over time (audit periodically)
• Two-Person Rule / Dual Control — two people required to perform a sensitive action (e.g., nuclear launch, key ceremony)

---

Domain 4: Network Security (24%)

The technical-feeling domain. The exam asks the security-side framing of network concepts, not the network engineering framing.

4.1 Network Concepts

OSI 7 Layers (bottom to top)

Layer	Name	Unit	Protocols/Devices	Memory
7	Application	Data	HTTP, FTP, SMTP, DNS, SNMP	All People
6	Presentation	Data	TLS/SSL, encryption, MIME, ASCII	Seem
5	Session	Data	NetBIOS, RPC, SQL sessions	To
4	Transport	Segment	TCP, UDP, ports	Need
3	Network	Packet	IP, ICMP, routers	Data
2	Data Link	Frame	MAC, switches, ARP	Processing
1	Physical	Bit	Cables, hubs, electrical signals	Please

Memory aids (top-down): All People Seem To Need Data Processing Memory aid (bottom-up): Please Do Not Throw Sausage Pizza Away

TCP/IP 4 Layers

Link → Internet → Transport → Application

Common Ports (drill these — at least one question per port usually)

Port	Protocol	Secure?
20/21	FTP (data/control)	No (plaintext)
22	SSH	Yes
23	Telnet	No — never use
25	SMTP	No (plaintext, but TLS-wrapped for SMTPS)
53	DNS	No (plaintext), but DoH/DoT exist
67/68	DHCP	No
69	TFTP	No
80	HTTP	No
110	POP3	No (use POP3S on 995)
143	IMAP	No (use IMAPS on 993)
161/162	SNMP	No (use SNMPv3)
389	LDAP	No (use LDAPS on 636)
443	HTTPS	Yes (TLS)
445	SMB	Risky; often targeted
1433	MS SQL	Risky if exposed
3306	MySQL	Risky if exposed
3389	RDP	Risky if exposed; brute-force target

The exam may test secure vs insecure. Know which ports are encrypted by default.

IP Addressing (basic)

• IPv4: 32-bit, ~4.3B addresses
• IPv6: 128-bit, ~3.4×10^38 addresses
• Private IPv4 ranges (RFC 1918):
  • 10.0.0.0/8
  • 172.16.0.0/12
  • 192.168.0.0/16
• APIPA / link-local: 169.254.0.0/16
• Loopback: 127.0.0.1

4.2 Network Threats and Attacks

Attack Categories

Category	Examples
Reconnaissance	Port scanning, ping sweep, OS fingerprinting, dumpster diving
Access	Password attack, exploit, social engineering
DoS / DDoS	SYN flood, Smurf, Ping of Death, amplification
Web	SQL injection, XSS, CSRF, path traversal
Wireless	Evil twin, rogue AP, deauth, WEP/WPA cracking
Man-in-the-Middle	ARP poisoning, DNS poisoning, SSL stripping
Application	Buffer overflow, zero-day, malware
Insider	Privilege abuse, data theft, social engineering

Common Specific Attacks

• DoS / DDoS — overwhelm resources with traffic. Availability impact, not confidentiality.
• SYN Flood — half-open TCP connections exhaust server resources
• Smurf Attack — ICMP echo to broadcast with spoofed source; everyone replies to the victim
• Ping of Death — oversized ICMP packet
• Fraggle — like Smurf but with UDP
• ARP Poisoning — spoof MAC-to-IP mappings on the LAN
• DNS Poisoning / Spoofing — corrupt DNS cache, redirect to attacker site
• MITM (Man-in-the-Middle) — intercept and possibly alter communication
• Replay Attack — capture and resend a valid transmission
• Birthday Attack — exploit hash collisions
• Brute Force — try all possible passwords
• Dictionary Attack — try common words
• Rainbow Table — precomputed hash lookups
• Password Spraying — one common password against many accounts (avoid lockout)
• Credential Stuffing — leaked credentials from one site used on another
• Session Hijacking — steal or forge a session token
• Zero-Day — exploit for an unknown vulnerability
• Phishing — fake emails/sites to steal credentials
• Spear Phishing — targeted phishing
• Whaling — phishing targeting executives
• Vishing — voice phishing
• Smishing — SMS phishing
• Pretexting — invented scenario to steal info
• Tailgating / Piggybacking — following an authorized person through a door

4.3 Network Infrastructure

Devices

Device	OSI Layer	Function
Hub	1	Repeats to all ports (no intelligence)
Bridge	2	Filters/segments traffic between LANs
Switch	2	Uses MAC table; forwards to specific port
Router	3	Routes between networks via IP
Firewall	3-7	Filters traffic by rules
IDS	varies	Detects and alerts (passive)
IPS	varies	Detects and blocks (inline)
Proxy	varies	Intermediary; can cache, filter, anonymize
Load Balancer	varies	Distributes traffic across multiple servers
VPN Concentrator	varies	Termination point for VPN tunnels

Firewalls (4 types)

Type	Layer	Strength	Speed
Packet-Filtering (Stateless)	L3/L4	Weak (header only)	Fastest
Stateful Inspection	L3/L4	Better (tracks connection state)	Fast
Application-Layer (Proxy)	L7	Strongest (deep packet inspection)	Slowest
NGFW (Next-Gen)	L3-L7	Strong + IPS + app awareness	Medium

Implicit deny = default firewall posture. Block everything, allow only what’s explicitly needed.

IDS vs IPS

	IDS	IPS
Action	Detects, alerts	Detects, blocks
Placement	Out-of-band (passive)	Inline
Failure mode	Fail-open (lets traffic through)	Fail-closed (blocks)
Detection types	Signature-based, anomaly-based, stateful	Same as IDS

Trap: IDS = passive / detect only. IPS = inline / block. The “I” tells you what it does.

Segmentation Concepts

• VLAN — virtual LAN; logical segmentation on a switch
• DMZ — perimeter network for public-facing servers
• NAC (Network Access Control) — only allow compliant devices on the network
• Subnetting — divide a network into smaller sub-networks

4.4 Securing Network Communications

Encryption Basics

Type	Keys	Speed	Use
Symmetric	Same shared key	Fast	Bulk data, file/disk encryption
Asymmetric	Public + Private keypair	Slow	Key exchange, digital signatures
Hashing	None (one-way)	Fast	Integrity, password storage

Algorithms:

• Symmetric (modern): AES (128/192/256-bit), ChaCha20, 3DES (legacy, weak)
• Asymmetric (modern): RSA, ECC (Elliptic Curve), Diffie-Hellman
• Hashing (modern): SHA-256, SHA-3; legacy: MD5 (broken), SHA-1 (weak)
• Avoid: DES, 3DES, RC4, MD5, SHA-1

Confidentiality → encryption · Integrity → hash · Non-repudiation → digital signature

PKI (Public Key Infrastructure)

• CA (Certificate Authority) — issues and signs certificates
• CSR (Certificate Signing Request) — your key + identity, sent to CA
• X.509 — standard certificate format
• CRL (Certificate Revocation List) — list of revoked certs
• OCSP (Online Certificate Status Protocol) — real-time cert validation
• Self-signed certificate — issued by the entity itself; OK for internal/trusted contexts
• Chain of trust — Root CA → Intermediate CA → End-entity cert
• Wildcard cert — covers all subdomains (*.example.com)
• SAN (Subject Alternative Name) — cert covers multiple specific names

VPN

• Site-to-Site — between two networks (e.g., branch office to HQ)
• Remote Access — individual user to a network
• Tunneling protocols: PPTP (weak, avoid), L2TP, IPsec, OpenVPN, WireGuard
• IPsec — encryption at the network layer, often used for site-to-site
• SSL/TLS VPN (e.g., clientless via browser) — used for remote access
• Always-On VPN — mobile devices always tunnel traffic through corporate

Wireless Security

Standard	Status	Crypto
WEP	Broken, never use	RC4 (broken)
WPA	Outdated	TKIP (weak)
WPA2	Solid	AES-CCMP
WPA3	Best, current	SAE, forward secrecy

• WPA2-Personal = pre-shared key (home, small office)
• WPA2-Enterprise = 802.1X + RADIUS (corporate)
• SSID — network name; hiding it is not a security measure
• MAC filtering — easy to bypass; not real security
• Captive portal — login page required (airports, hotels)

Wireless attacks:

• Evil twin — fake AP with same SSID as legitimate
• Rogue AP — unauthorized AP attached to the network
• Deauth attack — kick clients off the network
• WPS PIN attack — brute-force the WPS PIN

---

Domain 5: Security Operations (18%)

The “everything else” domain. Wide but shallow on the CC level.

5.1 Data Security

Data States

• Data at rest — stored on disk, USB, in a database → protect with encryption (BitLocker, AES, DB TDE)
• Data in transit — moving across a network → protect with TLS, IPsec
• Data in use — actively being processed in memory → protect with secure enclaves, TPM

Data Lifecycle

Create → Store → Use → Share → Archive → Destroy

Each stage has controls:

• Create — classification, labeling, access controls
• Store — encryption, backups, access controls
• Use — DLP, access controls, monitoring
• Share — DLP, encryption, NDA
• Archive — encryption, retention policies
• Destroy — secure deletion (overwrite, degauss, physical destruction)

Data Classification

Level	Examples	Controls
Public	Marketing materials, public website	None
Internal	Org-wide docs, internal emails	Don’t share externally
Confidential	Customer data, financials	Need-to-know, encryption
Restricted / Regulated	PII, PHI, cardholder data, trade secrets	Strongest controls, regulatory compliance

Data Destruction Methods

• Clearing — overwriting (still recoverable with forensic tools)
• Purging — degauss / cryptographic erase (very hard to recover)
• Physical destruction — shred, incinerate, disintegrate (irrecoverable)
• For the CC level, just remember: more sensitive = more thorough destruction

5.2 Asset Management

• Asset inventory — know what you have (hardware, software, data)
• Asset classification — assign value/classification
• Asset tracking — by serial number, tag, or barcode
• Procurement & disposal — secure both ends
• Mobile devices: MDM (Mobile Device Management), BYOD, COPE
  • BYOD — bring your own device; risks include data leakage, mixed personal/work data
  • COPE — corporate-owned, personally enabled; more control
  • MDM — enforce policies (remote wipe, encryption, app restrictions)

5.3 Logging and Monitoring

• Audit log — who/what/when/where
• Audit trail — sequence of events for accountability
• SIEM (Security Information & Event Management) — correlation across sources, alerting
• SOAR (Security Orchestration, Automation, Response) — automated response
• NTP (Network Time Protocol) — critical for log correlation. All devices must be time-synced.
• Retention — depends on regulation, business need (often 1-7 years)
• What to log: auth events, privilege use, access to sensitive data, system changes, network connections
• What NOT to log (in some jurisdictions): passwords, PII unnecessarily

Trap: Logs are detective controls. They don’t prevent — they help you investigate after.

5.4 Encryption (operational)

See Domain 4 §4.4 for crypto algorithms. This section is about operational use.

Where to encrypt:

• Disks (full-disk encryption: BitLocker, FileVault, LUKS)
• Files (PGP, GPG, S/MIME for email)
• Databases (column-level, transparent data encryption)
• Removable media (USB, external drives)
• Backups (encrypted at rest)
• Network traffic (TLS, IPsec)

5.5 Configuration & Change Management

Configuration management — control changes to systems to maintain security baseline.

• Baseline — the known-good state
• Hardening — reducing attack surface (disable unnecessary services, close ports, remove default accounts)
• Default deny / least functionality — disable what you don’t need

Change management process:

1. Request
2. Review (impact analysis)
3. Approve (change board)
4. Test (in non-prod)
5. Implement (in prod, during change window)
6. Verify (post-implementation review)

Emergency changes still follow a process — just expedited.

Patch management — regular cycle of applying vendor security updates.

• Prioritize by CVSS (Common Vulnerability Scoring System) score
• Test before production deployment
• Critical patches: faster cycle

5.6 Security Policies & Awareness

Key Policies

• Acceptable Use Policy (AUP) — what users can/can’t do with company assets
• Password Policy — length, complexity (modern: just length + breach check)
• Data Classification Policy — how data is labeled and handled
• Incident Response Policy — who does what when
• BCP / DRP — continuity
• BYOD Policy — personal device rules
• Clean Desk Policy — sensitive info not left on desks

Awareness & Training

• New-hire orientation
• Annual refresher
• Phishing simulations
• Role-based training (developers, execs, helpdesk)
• Human is the weakest link

Cloud Models (Shared Responsibility)

Model	You manage	Provider manages
IaaS	OS, middleware, runtime, apps, data	Hardware, network, storage, virtualization
PaaS	Apps, data	Everything else (you use the platform)
SaaS	Just use it, your data	Everything

Shared responsibility principle:

• Security OF the cloud → provider’s job (the infrastructure)
• Security IN the cloud → your job (your data, configs, access)
• You always own your data, even in SaaS

Physical Security (operational)

Layer	Examples
Deter	Signs, lighting, visible cameras
Detect	Cameras, motion sensors, alarms
Delay	Fences, locks, mantraps, bollards
Respond	Guards, police, fire department

Special:

• Mantrap — two doors, only one opens at a time (anti-piggybacking)
• Bollards — vehicle barriers
• Faraday cage — blocks electromagnetic signals

Environmental Controls

Threat	Control
Fire	Detection (smoke/heat sensors), suppression
Temperature	HVAC (68-75°F / 20-24°C)
Humidity	HVAC (40-55%)
EMI	Shielding, Faraday cages
Power outage	UPS, generators

Fire suppression in server rooms:

• Water — damages equipment; don’t use in data centers
• Wet chemical — kitchens (Class K fires)
• Dry chemical (ABC) — general purpose
• Gas / clean agent (FM-200, Novec 1230, CO₂) — server rooms, no residue

Hot/cold aisles — data center airflow efficiency.

Penetration Testing

Type	Knowledge	Realism	Cost
Black box	None	Highest	Most expensive
Gray box	Partial	Medium	Medium
White box	Full	Lowest (most thorough)	Cheapest

Pen test phases:

1. Reconnaissance (passive/active)
2. Scanning / Enumeration
3. Gaining Access (exploitation)
4. Maintaining Access
5. Covering Tracks

You can never pen test without explicit written authorization. Always get a scope document and rules of engagement.

Vulnerability Management

1. Identify — vulnerability scan
2. Prioritize — CVSS score, asset value
3. Remediate — patch, config change, compensate
4. Verify — re-scan to confirm

Compliance & Privacy (brief)

Regulation	Scope	Key idea
GDPR	EU personal data	Data subject rights, consent, breach notification
HIPAA	US healthcare	PHI protection, business associate agreements
PCI DSS	Payment card data	12 requirements, segmented networks
SOX	US public company financials	Internal controls, audit trails
GLBA	US financial	Customer data privacy
FISMA	US federal agencies	Security controls for federal systems

PII (Personally Identifiable Information) — data that identifies a person PHI (Protected Health Information) — health data linked to a person

---

Cross-Domain: Frequently Confused

These pairs come up again and again. Get them right.

Pair	Key distinction
CIA vs AAA	CIA is the GOAL (what to protect). AAA is the MECHANISM (how to control access)
Authentication vs Authorization	“Who are you?” vs “What can you do?”
Symmetric vs Asymmetric	Same key (fast) vs public+private (slow)
Encryption vs Hashing	Two-way (recoverable) vs one-way (not recoverable)
Encryption vs Encoding	Encryption uses a key, encoding is just a public scheme (Base64 is encoding, not encryption)
IDS vs IPS	Detect (passive) vs block (inline)
DAC vs MAC	Owner decides (commercial) vs label/clearance (military)
RBAC vs ABAC	Role-based (static) vs attribute-based (dynamic, contextual)
RTO vs RPO	Downtime budget vs data-loss budget
Hot site vs Cold site	$$$ + minutes vs $ + days
Threat vs Risk	Actor/event vs probability × consequence
Vulnerability vs Threat	Weakness vs actor that exploits it
Policy vs Standard vs Procedure	Why vs What vs How
Hashing vs Digital Signature	Integrity only vs integrity + non-repudiation
BIA vs BCP vs DRP	Identify critical → plan continuity → restore IT
Containment vs Eradication vs Recovery	Stop → Remove → Restore
WEP vs WPA2 vs WPA3	Broken → OK → Best
SSL vs TLS	TLS is the modern version of SSL; people still say “SSL” out of habit
VPN site-to-site vs remote access	Network ↔ network vs user → network
Black box vs White box pen test	No knowledge vs full knowledge
Physical vs logical access control	Locks/cameras vs passwords/ACLs
Cloud IaaS vs PaaS vs SaaS	VM → Platform → App

---

Question Decoder: How to Read (ISC)² Questions

The exam is built around scenario + 4 options + “best answer.” Here’s the 4-step decoder:

Step 1: Find the qualifier (last sentence first)

Always read the last sentence of the question stem before the scenario. The qualifier is what decides your answer:

• BEST → pick the most complete / principle-aligned
• FIRST / NEXT → identify the first/next step in a defined sequence
• MOST / MOST LIKELY → pick the most probable / most appropriate
• PRIMARY → pick the most important / highest priority
• NOT / EXCEPT → the answer is the one that doesn’t fit (re-read carefully)
• LEAST → the answer is the one with the weakest effect

Step 2: Identify the CIA pillar

• “Data leaked/snooped” → Confidentiality
• “Data modified/tampered” → Integrity
• “Service down/DDoS” → Availability
• “Person denies action” → Non-repudiation

Step 3: Identify the principle being tested

• Access control question? → which model (DAC/MAC/RBAC/RuBAC/ABAC)?
• Risk question? → which treatment (accept/avoid/mitigate/transfer)?
• Process question? → which step (BIA, preparation, identify, contain)?
• Defense question? → which layer (people/process/technology)?

Step 4: Pick the principle-aligned “best” answer

When 2+ options all look right, the “best” is the one that:

• Aligns with more core principles (CIA, least privilege, defense in depth, separation of duties, non-repudiation)
• Is the most general (defense in depth beats single strong control)
• Is the first step in a defined sequence
• Matches a “FIRST/NEXT” cue if present
• Avoids absolute words (always, never, only) in answer text

Decision Shortcuts (from real candidate post-mortems)

Scenario word	Default answer
“Clearance,” “Top Secret,” “government,” “military”	MAC
“Owner,” “file,” “creator decides”	DAC
“Role,” “job function”	RBAC
“Time-of-day access”	RuBAC (or ABAC)
“DDoS” / “service unavailable”	Availability (NOT confidentiality)
“Data modified”	Integrity
“Data leaked”	Confidentiality
“First step in IR”	Preparation
“First step in BCP”	BIA
“WEP” anywhere	Always wrong (broken)
“WPA3”	Always right if comparing wireless
“Implicit deny” / “default deny”	Right answer for firewall/access defaults
“MFA,” “two factors”	Better than single-factor always
“Audit log” / “monitoring”	Detective control, not preventive
“Encryption at rest”	Confidentiality for stored data
“Pen test without written authorization”	Wrong (illegal)
“Salt + hash” for passwords	Right (best practice)
“Disable unused services”	Hardening, right answer for attack surface
“Default password”	Wrong (always change before deploy)

---

Test Center Logistics (Read the Night Before)

Item	What to bring / know
Arrival	30 min before your appointment
ID #1 (primary)	Government-issued, photo + signature, name matches registration EXACTLY
ID #2 (secondary)	Signature-bearing (credit card, bank card)
Palm-vein scan	Yes, part of check-in
Allowed in room	Nothing. Not even your watch.
Locker	Provided for essentials (keys, wallet, phone)
Phone	Off, in locker. Don’t touch it on breaks — proctored cameras
Water	At center’s discretion; usually none on the desk
Breaks	Not scheduled. Clock keeps running. Don’t ask unless emergency.
Late arrival	15+ minutes late = forfeit (and the fee)
What to do if you finish early	Don’t leave. Sit quietly, breathe. (You cannot review actual answers — CAT locks them in.)

---

Final Memory Aids (Mnemonic Bank)

Concept	Mnemonic
OSI 7 layers (top→bot)	All People Seem To Need Data Processing
OSI 7 layers (bot→top)	Please Do Not Throw Sausage Pizza Away
(ISC)² Code of Ethics	PAPA — Protect, Act, Provide, Advance
CIA Triad	Close, Intact, Accessible
AAA	AuthN, AuthZ, Accounting (Who, What, What did they do)
Risk formula	TVI = Threat × Vulnerability × Impact
4 Risk treatments	AAMT or MATT — Accept, Avoid, Mitigate, Transfer
4 IR phases	P-DEC-R — Prep, Detect, Contain/Eradicate/Recover, Post
Older 6 IR phases	PICERL — Prep, ID, Contain, Eradicate, Recover, Lessons
3 Categories of controls	APL — Admin, Physical, Logical
4 Control functions	PDCD — Prevent, Detect, Correct, Deter
3-2-1 Backup	3 copies, 2 media, 1 offsite
Auth factors	KHABD — Know, Have, Are, Be, Do
IDS vs IPS	IDS = Detect only, IPS = Prevent
4 Canons of Ethics	Lower number wins (Canon 1 trumps all)
Hot vs Warm vs Cold	Hot = $$, Warm = $$, Cold = $
Wireless strength	WPA3 > WPA2 > WPA > WEP
Encryption vs Hashing	Encryption = 2-way, Hashing = 1-way
9 AM + 4 PM = bad exam time	Peak: 11 AM - 1:30 PM
Read 2nd sentence of question first	Find qualifier (BEST/FIRST/MOST/NOT)
25 of 100 are pretest	Don’t panic on weird questions
Beyond Q100 = still alive	CAT engine not done with you
Pearson VUE only	No online proctoring
2 forms of ID	Primary (photo+sig), secondary (sig)

---

60-Second Final Checklist (Last Thing Before You Leave)

• ID #1 (photo + signature, exact name match) + ID #2 (signature) in pocket
• Confirmation email/number saved on phone
• Nothing else to bring (no watch, phone will be in locker)
• Ate protein + complex carbs 2 hours before
• Hydrated
• Slept 7-9 hours last night
• Done 4-7-8 breathing in the car
• Know: 25 pretest, no review, manager mindset, last-sentence-first
• 1.25-mile rule: if your brain is fried, fail and rebook. Don’t push through.

---

The One Sentence

The exam is not testing what you know — it’s testing how a security manager would think when two or three answers all look right. Read the last sentence of every question first, pick the principle-aligned “most correct” answer, and trust the process. Sleep last night. Go pass it.

---

You have the facts. You have the strategy. You have the decoder. The rest is showing up, reading carefully, and trusting your preparation. ✊