CCIS study guide
CCIS · Work through your exam, one topic at a time.
The Certified in Cybersecurity Specialist (CCIS) is a vendor-neutral credential aimed at practitioners who want to demonstrate working competence across the operational side of security: governance, network defense, identity, endpoints, cryptography, threat handling, risk, and day-to-day monitoring including cloud. It suits security analysts, administrators, and IT generalists moving into a dedicated security role, as well as early-career professionals who already hold foundational knowledge and want a structured, breadth-first validation of it. The CCIS study guide has 8 sections and about 3,238 words.
01Security Fundamentals and Governance
This domain tests whether you can connect security work to business objectives and show that controls are directed, owned, and measured. Expect questions on governance bodies, policy hierarchy, risk appetite and tolerance, roles and accountability, compliance obligations, third-party risk, and security metrics.
411 words, about 2 min02Network Security
This domain tests secure network design and operation: segmentation, least-access firewall rules, intrusion detection and prevention, remote access, name resolution, wireless, and monitoring. Questions often ask you to choose the control that limits lateral movement without breaking the business flow.
397 words, about 2 min03Identity and Access Management
This domain tests how identities are created, authenticated, authorized, reviewed, and removed. Expect questions on joiner-mover-leaver processes, federation and single sign-on, MFA, privileged access management, role design, and access certification.
398 words, about 2 min04Endpoint and Systems Security
This domain tests hardening and protecting hosts and workloads: baselines, patching, endpoint detection and response, application control, host firewalls, disk encryption, secure boot, logging, and container or serverless hardening. The exam favors controls that reduce attack surface and detect compromise, not just malware signatures.
388 words, about 2 min05Cryptography and Data Protection
This domain tests applied cryptography and data-centric controls: symmetric and asymmetric encryption, hashing, MACs, digital signatures, PKI, TLS, key management, classification, masking, tokenization, and DLP. The exam focuses on selecting the right primitive and protecting keys, not on proving mathematical theorems.
435 words, about 2 min06Threat Management and Incident Response
This domain tests how threats are anticipated, detected, and handled. Expect questions on threat intelligence, MITRE ATT&CK, detection coverage, incident response phases, containment, evidence handling, communications, and post-incident improvement.
407 words, about 2 min07Vulnerability and Risk Management
This domain tests how organizations find, prioritize, and reduce vulnerabilities and how they record and govern risk. Expect questions on scanning versus penetration testing, CVSS, exploit prediction, asset criticality, patch service levels, risk registers, exceptions, and threat modeling.
403 words, about 2 min08Security Operations, Monitoring, and Cloud Security
This domain tests continuous visibility and response across on-premises and cloud environments. Expect questions on SOC workflows, log sources, SIEM tuning, detection engineering, baselines, cloud shared responsibility, CSPM, CIEM, workload identity, and cloud-native logging.
399 words, about 2 min