CISP-PTS study guide
CISP-PTS · Work through your exam, one topic at a time.
This independent study page provides practice for CISP-PTS. Its editorial learning areas include Assessment authorization, evidence, reporting and closeout; Reconnaissance, enumeration and confidence in observations; Web application and data-protection foundations; Host and middleware hardening foundations; Identity, access and cryptography; Operations, logs and response; Vulnerability discovery, severity and verification. The CISP-PTS study guide has 7 sections and about 3,888 words.
01Assessment authorization, evidence, reporting and closeout
A security assessment investigates specified questions about assets and controls. Discovering that a system is reachable does not grant permission to test it.
471 words, about 2 min02Reconnaissance, enumeration and confidence in observations
Reconnaissance develops an asset and dependency picture under the agreed purpose and scope. Reviewing third-party public records can be passive relative to the target, while querying the target’s authoritative services or opening its web application is direct contact.
451 words, about 2 min03Web application and data-protection foundations
This domain covers how applications fail and how data is classified and protected through its life. Questions often present a code behaviour or a data-handling scenario and ask for the correct control.
399 words, about 2 min04Host and middleware hardening foundations
This domain tests the hardening baseline of the hosts that hold the data, plus the operational discipline that keeps them hardened. Expect questions on permissions, services, patching and endpoint detection.
526 words, about 3 min05Identity, access and cryptography
This domain tests the identity lifecycle and the mechanisms that turn an identity into an authorised action. Expect questions that separate authentication from authorisation and that ask which access control model fits a scenario.
857 words, about 4 min06Operations, logs and response
This domain is about running security as a repeatable service rather than a series of heroic acts. Questions target process ownership, change control and the operational metrics that show the programme is working.
803 words, about 4 min07Vulnerability discovery, severity and verification
This domain tests whether you can turn a scanner report into a defensible remediation plan. It separates discovery, prioritisation and verification, and expects you to know the scoring systems and their limits.
381 words, about 2 min