ISC2 CISSP
ISC2's certification for experienced security practitioners, managers and leaders. Practice choosing what a security manager would do first across all eight domains, from risk management and asset security to architecture, networks, identity, testing, operations and secure software. Every question is original and maps to ISC2's current CISSP exam outline.
What you'll study
Every section follows the official CISSP exam outline. Click a domain to see its sections.
Professional ethics and core concepts, governance and roles, control frameworks, cybercrime, intellectual property and privacy law, policies and business continuity requirements, personnel security, risk analysis and response, threat modeling, supply chain risk and awareness programs.
Classifying and handling information and assets, ownership and inventory, data roles from owners to processors, data collection and location, retention, remanence and destruction, end of life, data states, scoping and tailoring, and protection with DRM, DLP and CASB.
Secure design principles and security models, vulnerabilities in client, server, database, ICS, cloud, IoT, container and serverless systems, the cryptographic life cycle, PKI, key management and cryptanalytic attacks, site and facility controls, and the information system lifecycle.
The OSI and TCP/IP models, IPv4 and IPv6, secure and converged protocols, traffic flows, physical, logical and micro-segmentation, wireless and cellular networks, CDN, SDN and VPC, transmission media, network access control and secure communication channels.
Physical and logical access, AAA and MFA, session management and identity proofing, federation and SSO, access control models from RBAC and MAC to ABAC and risk-based access, access reviews and provisioning, privilege escalation, service accounts and authentication systems.
Assessment, test and audit strategies, vulnerability assessment and penetration testing, log reviews and synthetic transactions, code review and interface testing, breach attack simulations, KPIs and KRIs, remediation and exceptions, ethical disclosure and conducting audits.
Investigations, evidence and digital forensics, logging, SIEM and threat intelligence, configuration, patch and change management, incident management, detective and preventive measures, recovery strategies, disaster recovery and continuity testing, and physical security and personnel safety.
Development methodologies and maturity models, SDLC operations, CI/CD and code repositories, SAST, DAST, SCA and IAST, judging software security, COTS, open-source and cloud-service risk, secure coding, and API security.
Study, Quiz, Exam
Read the concepts, practice in short rounds, then test yourself on a mock exam with targeted feedback on where you need to focus more. Every question is original and maps to the official CISSP outline.
Learn the concept first
Short study cards cover each section before you answer a single question.
ISC2 accepts complaints only from someone claiming injury, and the canon alleged decides who may file. A member who sees another member breach the Code must use the complaint procedure; silence can itself breach Canon IV. No principal can demand deceit, such as hiding findings from a report.
| Canon alleged | Who has standing |
|---|---|
| First two canons | Members of the public |
| Third canon | Principals only |
| Fourth canon | Other certified or licensed professionals |
Ten-question rounds
Every answer explained. Score 80% and the next section unlocks.
How should the consultant respond to the CFO's request to remove the finding?
Altering the report to mislead a regulator would breach the canon to act honorably, honestly, justly, responsibly and legally, so the consultant keeps the finding and explains why. Duty to a principal never extends to dishonest acts, and a side letter would still deceive the regulator. Sending the report to the regulator unasked bypasses the client, who owns the deliverable, when nothing yet requires disclosure.
Know exactly where to focus
Timed practice exams any time, with a study plan built from your mistakes.
What to expect on the CISSP
Made for security professionals ready to step up to leading a security program. Certification takes five years of paid work in at least two CISSP domains, but you can sit the exam before you have them: pass, and you're an Associate of ISC2 while you build the years.
Source: ISC2 CISSP Certification Exam Outline (effective April 15, 2024), checked October 16, 2026
Where this cert takes you
Real job titles where CISSP-level judgment is the day-to-day work.
- Information Security Analyst
- Security Engineer
- GRC Analyst
- Security Consultant
- IT Security Auditor
- Identity & Access Management Engineer
- Senior Security Analyst
- Security Architect
- Information Security Manager
- Senior Security Consultant
- Cyber Risk Manager
- Security Operations Manager
- Director of Information Security
- Chief Information Security Officer (CISO)
- Principal Security Architect
- Head of Governance, Risk & Compliance
- Enterprise Security Architect
- Security Program Director
Ranges based on BLS Occupational Employment & Wage Statistics (May 2025) for Information Security Analysts: 10th percentile $75,090, median $129,180, 90th percentile $199,850. Adjusted by metro. CISSP certification requires five years of security experience, so even the first column assumes a working security professional, not a new graduate. Director and CISO titles are often counted under other occupations and can pay more. The first role in each column is the most common entry point.
Recommended ProCourse
A good course to pair with your cert study for learning hard tech skills while you study for your cert
Cyber Security & Operations
Harden servers, hunt threats, investigate breaches. Learn nmap, tshark, auditd, and forensic analysis, then move into SOC operations, compliance frameworks, and security architecture. Defend systems that matter.
View CurriculumQuestions
Start practicing for CISSP
Included with an opnf.sh subscription, $15/month or $120/year.
Get CertPrepCISSP is a registered certification mark of ISC2, Inc. opnf.sh is not affiliated with, sponsored by or endorsed by ISC2. All practice questions are original and are not taken from any ISC2 exam.