🧠 CISSP 80/20 Study Focus: Hard-to-Remember Topics Outline

🧠 CISSP 80/20 Study Focus: Hard-to-Remember Topics Outline

If you're already comfortable with most of the CISSP content, consider take a Pareto (80/20) approach: focus on the 20% of topics that tend to cause 80% of exam errors, especially for people who are already experienced professionals.

These are the "high cognitive load" areas — theory-heavy, abstract, and nuanced.

🔐 DOMAIN 3: Security Architecture and Engineering

Spend ~25% of your time here

🔸 Cryptography (MOST misunderstood topic)

  • Symmetric vs Asymmetric encryption (uses, speed, when to choose which)

  • Block cipher modes (CBC, ECB, GCM, CTR – when to use each)

  • PKI (X.509, CRL, OCSP, digital signatures vs certificates)

  • Key management lifecycle (generation, distribution, escrow, destruction)

  • Hashing vs Encryption vs Encoding vs Salting

  • TLS/SSL, VPN protocols (IPSec modes: tunnel vs transport)

🔸 Security Models (more theory-based)

  • Bell-LaPadula (confidentiality-focused)

  • Biba (integrity-focused)

  • Clark-Wilson, Brewer-Nash, Graham-Denning

  • Multilevel security and MAC models

🧰 DOMAIN 4: Communication and Network Security

Spend ~20% of your time here

🔸 Protocol Stack Concepts

  • OSI vs TCP/IP – mapping protocols to layers

  • Secure protocols: SSH, HTTPS, SFTP, IPSec

  • Ports and services (e.g., what runs on 443 vs 22)

🔸 Firewalls & VPNs

  • Stateful vs stateless filtering

  • Proxy vs NAT vs packet-filtering firewalls

  • VPN tunneling (SSL vs IPSec, split tunneling concerns)

📜 DOMAIN 5: Identity and Access Management (IAM)

Spend ~10% of your time here

🔸 Access Control Models

  • DAC, MAC, RBAC, ABAC – how they differ and when they apply

  • Federated identity vs single sign-on (SAML, OAuth, OpenID)

  • Authentication factors and attacks (replay, man-in-the-middle, phishing)

🧮 DOMAIN 6: Security Assessment and Testing

Spend ~10% of your time here

🔸 Testing Types (easy to mix up)

  • Vulnerability assessment vs penetration testing

  • Static vs dynamic code analysis

  • White-box vs black-box vs gray-box testing

🛠 DOMAIN 7: Security Operations

Spend ~10% of your time here

🔸 Logging & Monitoring

  • SIEMs, log retention, incident response steps

  • BCP vs DRP vs IRP – when to use each

🔸 Forensics Basics

  • Chain of custody

  • Order of volatility (registers > memory > disk > remote logs)

🏛 DOMAIN 1 & 2: Security & Risk Management / Asset Security

Spend ~10% of your time here, but master key frameworks

🔸 Governance & Legal Stuff

  • Data classification schemes (public, internal, confidential, etc.)

  • Due care vs due diligence

  • Privacy laws (GDPR, HIPAA, PCI-DSS, etc.)

  • Risk calculations (ALE = SLE × ARO)

⚠️ Key Memory Traps

  1. Encryption protocol purpose/usage

  2. Security models & frameworks

  3. Access control types and acronyms

  4. Key lifecycle terminology

  5. Difference between security testing types

🧩 How to Study These Effectively:

  • Use mnemonics, flashcards, and scenario-based questions.

  • Skim easier stuff just once or twice, deep-dive repeatedly on the hard stuff.

  • Schedule short 20–30 min review sessions for just encryption, access control, and networking.


Comments

Post a Comment

Popular posts from this blog

🧭 CISSP Study Note: Guidelines

🧭 CISSP Study Note: Guidelines 🔍 Definition Guidelines are suggested practices, recommendations, or expectations that help individuals or teams perform tasks effectively and consistently to achieve organizational goals, standards, and strategic objectives . Unlike policies or standards, guidelines are not mandatory —they offer flexibility while still encouraging best practices. 🧠 Why It Matters in Cybersecurity In a security framework, not every situation can be addressed with a rigid rule . Guidelines fill that gap by offering direction without strict enforcement , helping professionals: Make informed decisions Handle exceptions responsibly Align behavior with organizational goals Maintain consistency across teams They also support user education, secure configurations, and best practices adoption without limiting operational flexibility. 📋 Guidelines vs. Policies vs. Standards Term Binding? Purpose Policy ✅ Mandatory Defines what must be...
Read more

💸 CISSP Study Note: Risk Transference

 💸 CISSP Study Note: Risk Transference 🔍 Definition Risk Transference is the process of shifting the financial or operational impact of a risk to a third party , typically through contracts, insurance, or outsourcing agreements . While the risk itself doesn’t disappear, its burden is transferred , meaning someone else becomes responsible for managing or absorbing the consequences . 🧠 Why It Matters in Cybersecurity Not all risks are feasible to mitigate or avoid directly—especially high-cost, low-probability events . Risk transference allows organizations to: Focus on their core competencies Offload specialized or high-risk tasks Limit financial exposure Improve recovery options without investing heavily in in-house controls 📌 Transference does NOT eliminate the risk—it shifts the responsibility or financial impact. 🧾 Common Methods of Risk Transference Method Description Cybersecurity Insurance Transfers financial losses from cyberattack...
Read more

📏 CISSP Study Note: Standards

📏 CISSP Study Note: Standards 🔍 Definition Standards are specific, mandatory rules or technical specifications that define how policies must be implemented and how performance or behavior must conform to meet organizational or regulatory expectations. They are non-negotiable , measurable, and enforceable, often serving as the baseline for procedures and audits . While policies tell you what to do, standards tell you exactly how it must be done. 🧠 Why It Matters in Cybersecurity Standards are critical for ensuring consistency , reliability , and compliance across systems, teams, and departments. They help: Reduce ambiguity in control implementation Align practices with compliance frameworks Support repeatable, auditable processes Simplify training, onboarding, and cross-team coordination 🧩 Standards in the Policy Hierarchy Level Purpose Policy High-level directive—“What must be done” Standard ✅ Mandatory specification—“How it must ...
Read more