CISSP Cram

Free flashcards & study tool for the 2024/2025 exam

EXAM PREP MODE

STUDY

Three phases to success

Designed around how your brain actually learns. Don't just read — actively test yourself.

Triage

Rate your confidence before seeing answers. Find your real knowledge gaps.

~20 mins • 35 cards

Drill

Quiz mode on weak areas. Wrong answers come back until you nail them.

~30-45 mins • Adaptive

Morning Refresh

Quick fire through everything. Build confidence before you walk in.

~15 mins • All cards

Cheat Sheet

All formulas, mnemonics and key facts. Print it or save to your phone.

Reference • Printable

Progress 0 / 0

0 solid

0 shaky

0 weak

Domain #1

Question goes here

Hint: Hint goes here

Space reveal · 1-5 rate · → next

CISSP Quick Reference

Print this or screenshot it. Glance at it before walking in.

Access Control Models

Bell-LaPadula = Confidentiality. No read up, no write down. "BLP Blocks Leaks"

Biba = Integrity. Opposite of BLP. No read down, no write up. "Biba Blocks Bad Input"

Clark-Wilson = Integrity via well-formed transactions. CDIs, UDIs, TPs, IVPs. Separation of duties.

Brewer-Nash = Chinese Wall. Conflicts of interest. Dynamic access based on history.

DAC=Owner, MAC=Labels, RBAC=Roles, ABAC=Attribute rules

Zero Trust = "Never trust, always verify". Verify every request. Assume breach.

Risk Formulas

SLE = Asset Value × Exposure Factor (Single Loss Expectancy)

ALE = SLE × ARO (Annualized Loss Expectancy)

Risk = Threat × Vulnerability × Impact

Qualitative = High/Med/Low (quick). Quantitative = £££ numbers (precise).

Risk treatment: ATMA = Avoid, Transfer, Mitigate, Accept

Residual Risk = Risk after controls. Management must formally accept.

BCP/DRP Metrics

RTO = Recovery Time Objective. Max acceptable downtime.

RPO = Recovery Point Objective. Max acceptable data loss.

MTD = Maximum Tolerable Downtime. Beyond this = business fails. RTO < MTD.

MTBF = Mean Time Between Failures (reliability, higher=better).

MTTR = Mean Time To Repair (maintainability, lower=better).

Sites: Hot=mins £££, Warm=hrs/days, Cold=weeks cheap

BCP=whole business. DRP=IT systems. DRP ⊂ BCP.

Cryptography

Symmetric (AES): 128/192/256 bits. Fast. Same key both sides.

Asymmetric (RSA): 2048+ bits. ECC: 256-384 bits. Slow, key exchange.

Secure hashes: SHA-256, SHA-3. Broken: MD5, SHA-1.

ECB is insecure — identical blocks = identical ciphertext. Use CBC, GCM, CTR.

Digital signature = Hash + PRIVATE key. Verify with PUBLIC.

Provides: Authentication, Integrity, Non-repudiation (not confidentiality!)

OSI Model

7 Application: HTTP, DNS, SMTP, FTP — WAF operates here

6 Presentation: SSL/TLS, encoding, encryption

5 Session: NetBIOS, RPC — session management

4 Transport: TCP, UDP, ports — TLS, port security

3 Network: IP, ICMP — Routers, Firewalls, IPSec

2 Data Link: Ethernet, MAC — Switches, 802.1X, VLANs

1 Physical: Cables, hubs — Locks, cameras

Mnemonic: Please Do Not Throw Sausage Pizza Away

OWASP Top 10 (2021)

A01: Broken Access Control (was #5, now #1)

A02: Cryptographic Failures

A03: Injection (SQL, OS, LDAP)

A04: Insecure Design (new)

A05: Security Misconfiguration

A06: Vulnerable Components

A07: Auth & Session Failures

A08: Software & Data Integrity (new)

A09: Logging & Monitoring Failures

A10: SSRF (new)

🛡️ Security Controls

Preventive: Firewalls, encryption, access controls (stop before)

Detective: IDS, SIEM, audit logs (find when occurs)

Corrective: Backups, patches, IR (fix after)

Deterrent: Signs, cameras. Compensating: Alternative control.

IDS=passive detection. IPS=active inline blocking.

Defense in Depth = Multiple overlapping layers

Least Privilege = Only minimum access needed for job

🔄 Incident Response

PICERL: Preparation → Identification → Containment → Eradication → Recovery → Lessons Learned

💻 Software Security

Security in every SDLC phase. Shift left = earlier = cheaper.

SAST=code (white-box). DAST=running app (black-box). IAST=both.

STRIDE: Spoofing, Tampering, Repudiation, Info disclosure, DoS, Elevation

Separation of duties: Dev ≠ Test ≠ Prod access

⚖️ Legal & Compliance

Due Diligence=knowing/research. Due Care=doing/action.

Criminal=prosecution/jail. Civil=lawsuit/£. Admin=regulator fines.

GDPR: EU data protection. Up to €20M or 4% global revenue.

PCI DSS: 12 requirements for payment card data.

🧠 CISSP Mindset

Think like a MANAGER, not a technician.

Priority: 1. Human life → 2. Assets → 3. CIA

Prevent → Detect → Respond. Policy before technology.

Risk-based decisions. Avoid extremes ("always", "never").

When stuck, pick the MOST comprehensive answer.

📊 2024/2025 Exam Format

CAT format: 100-150 questions, 3 hours max

Pass: 700/1000. Questions adapt to your level.

D1 Security & Risk: 16% (up) | D8 Software Dev: 10% (down)