EXIN Information Security Essentials study guide
EXIN Information Security Essentials · Work through your exam, one topic at a time.
EXIN Information Security Essentials (often shortened to EXIN ISE) is an entry-level certification for people who need a working grasp of information security rather than a specialist engineering depth. Typical candidates are new IT staff, helpdesk and operations personnel, project members, HR and facilities staff, and managers who handle information day to day and must understand why controls exist. The EXIN Information Security Essentials study guide has 8 sections and about 3,336 words.
01Information and Information Security Concepts
This domain sets out the vocabulary every later EXIN Information Security Essentials domain assumes: what information and information assets are, the CIA triad, and how abstract properties become concrete requirements. Questions typically give a short scenario and ask which property is affected, or ask you to separate data from information and information security from IT security.
435 words, about 2 min02Information Security Threats and Risks
This domain tests whether you can separate three words candidates habitually blur - threat, vulnerability and risk - and whether you can choose a proportionate risk treatment. Expect scenario questions about malware, social engineering and insider behaviour, plus one simple risk calculation.
478 words, about 2 min03Information Security Policy and Governance
Governance is the direction and control exercised over information security at the top of the organisation; policy is management's written expression of intent. This domain tests the document hierarchy, who owns what, and how exceptions are handled.
433 words, about 2 min04Organizational and Human Security Measures
People are simultaneously the strongest control and the most exploited weakness. This domain tests the human-resources security lifecycle, segregation of duties and awareness, and how third parties are handled.
406 words, about 2 min05Technical Security Measures
This domain covers logical controls: access control, authentication, cryptography and network defence. Expect questions of the form which property does this control provide and what does this control not do - the second is where most marks are lost.
413 words, about 2 min06Physical and Environmental Security
Physical and environmental controls protect premises, rooms, equipment and media, and keep systems running when the environment misbehaves. The exam tests layered defence and the purpose of individual controls - particularly whether a control is preventive or detective.
383 words, about 2 min07Incident Management and Business Continuity
This domain separates handling an incident from keeping the business running, and tests the key time metrics. Questions frequently give a set of recovery requirements and ask whether the stated backup or site design satisfies them.
412 words, about 2 min08Compliance, Standards and Best Practices
Laws bind, standards guide, certifications give assurance. This domain tests which framework does what, and whether a stated compliance claim actually proves security.
376 words, about 2 min