CISSP study plan

Build a risk register with 8 identified threats, each scored for likelihood and impact and paired with a treatment option (mitigate, transfer, avoid, accept)

Write a four-row table distinguishing policy, standard, procedure, and guideline, with one original workplace example per row

Calculate ALE, SLE, and ARO for three scenarios and state which control investment is justified by the numbers

Draft a BCP/DRP outline naming the roles, the four test types (read-through, walkthrough, tabletop, full), and the metric used to set recovery targets

Map the ISC2 Code of Ethics canons to three original workplace dilemmas and state the required action for each

Classify 20 given artifacts (privacy notice, NDA, firewall rule sheet, audit log, retention schedule) as policy, standard, procedure, guideline, or record

Assign data ownership roles (owner, custodian, steward, user) for five sets of data and justify each assignment in one sentence

Construct a data classification scheme with four tiers and state the handling rules for each tier at rest, in transit, and at end of life

Sequence the steps of media sanitization and select the correct method (clear, purge, destroy) for three stated media types

Explain, in writing, how scoping and tailoring reduce the effort of a control framework baseline for a small organization

Contrast Bell-LaPadula, Biba, Clark-Wilson, and Brewer-Nash by writing one permitted and one blocked access example for each model

Select the appropriate symmetric or asymmetric algorithm and mode for six stated scenarios and justify each pick in a single sentence

Sketch a reference monitor diagram labeling subject, object, and the three properties the design must satisfy

Rank 10 physical security controls for a data center by layer (site perimeter, building interior, server room) and state the threat each addresses

Describe how a trusted computing base and its evaluation level affect the assurance argument for a system acquisition

Trace a single request from client to database, labeling the device and protocol data unit at each hop across the OSI and TCP/IP models

Differentiate TLS, IPsec, SSH, and S/MIME by layer, key exchange mechanism, and primary use case in a comparison table

Design a segmented network for a three-tier web application using a DMZ, VLANs, and a minimum 12-rule firewall ACL with written justification per rule

Identify eight network attacks (spoofing, on-path, ARP poisoning, DDoS, VLAN hopping, and similar) from flow descriptions and name the mitigating control for each

Compare the security properties of wired, wireless, and remote-access designs and state where each belongs in a defense-in-depth architecture

Separate identification, authentication, authorization, and accounting by producing a table with one concrete system example per function

Build a decision table showing how RBAC, ABAC, and MAC each evaluate the same five access requests differently

Evaluate four authentication factors (knowledge, possession, biometric, behavior) for strength, enrollment cost, and failure mode in writing

Sequence a federated identity flow (IdP, SP, assertion, trust) and state where SAML and OIDC each fit

Draft an access review and provisioning lifecycle procedure covering joiner, mover, and leaver events with the approval checkpoint at each stage

Write an incident response runbook for one scenario that names the preparation, detection, containment, eradication, recovery, and lessons-learned actions with an owner per step

Compare log source types (host, network, application, cloud) and specify one question each source can answer and one it cannot

Prioritize five vulnerabilities using asset criticality plus exploitability, then justify the patch order and any compensating control

Describe how change management, configuration baselines, and separation of duties combine to prevent unauthorized production changes

Differentiate the evidence-handling requirements for a forensic image, a memory capture, and a log export, including chain-of-custody fields

Design a test plan that names the coverage gap each technique fills (vulnerability scan, penetration test, code review, log review, audit) and when to schedule each

Distinguish a vulnerability assessment from a penetration test in writing, citing scope, authorization, and reporting differences

Interpret a sample scan report by separating false positives from true positives and writing a remediation ticket for each true finding

State the sampling and evidence requirements for an audit that must survive challenge, including how to handle incomplete populations

Draft three metrics that measure the effectiveness of a security control program rather than its activity level

Describe how secure development practices (threat modeling, code review, CI/CD gates, and testing type selection) reduce defect-driven risk, giving one example per practice

Identify the vulnerability class behind five code snippets and state the correct remediation for each

Re-take the missed-item log across all eight domains and clear every card at least once without a miss

Compose a 10-item personal weak-area list ranked by practice-exam miss rate, with a specific corrective action per item

Rehearse exam-day logistics and time budgeting by completing a timed 125-question session under exam conditions