The 8 CISSP domains
The CISSP exam outline (effective 15 April 2024) covers eight domains. Each page below has the key concepts, exam traps and 10 free practice questions with explanations.
Security and Risk Management
The largest domain. It is about governance: aligning security with business goals, managing risk with numbers and judgement, staying legal and ethical, and keeping the business running.
DOMAIN 2 · 10% OF EXAMAsset Security
Know what you have, who owns it, how sensitive it is, and how to protect it through its whole lifecycle — including how to destroy it safely.
DOMAIN 3 · 13% OF EXAMSecurity Architecture and Engineering
How to design systems that are secure by default: design principles, formal security models, cryptography, cloud and embedded architectures, and physical security.
DOMAIN 4 · 13% OF EXAMCommunication and Network Security
Designing and protecting networks: the OSI model, secure protocols, segmentation, wireless, remote access and modern architectures like SD-WAN, SASE and zero trust.
DOMAIN 5 · 13% OF EXAMIdentity and Access Management
Controlling who (and what) can access which resources: identification, authentication factors, access control models, federation and the identity lifecycle.
DOMAIN 6 · 12% OF EXAMSecurity Assessment and Testing
Proving that controls work: assessment strategy, vulnerability scanning and penetration testing, code testing, audits and SOC reports, and the metrics that tell management the truth.
DOMAIN 7 · 13% OF EXAMSecurity Operations
Running security day to day: investigations and evidence, logging and monitoring, incident response, change and patch management, backups, recovery sites and disaster recovery.
DOMAIN 8 · 10% OF EXAMSoftware Development Security
Building security into software from requirements to retirement: SDLC models, secure coding, application and API attacks, databases, third-party code and AI-assisted development.
Ready for the full bank?
2,000+ explained questions, timed mocks and a CAT simulator that behaves like the real exam.