TechclickCISSP Prep
☰

CISSP Domain 1 · 16% of the exam

Security and Risk Management

The largest domain. It is about governance: aligning security with business goals, managing risk with numbers and judgement, staying legal and ethical, and keeping the business running.

Practise Domain 1Domain 1 cheat sheet

Key concepts

Rule cards

AccountabilitySenior management / the board is ultimately responsible. The CISO runs the programme. Accountability can never be outsourced or transferred — only tasks can.
Document hierarchyPolicy (high-level, mandatory) → Standard (specific, mandatory) → Baseline (minimum configuration) → Procedure (step by step) → Guideline (optional advice).
Risk mathSLE = AV × EF (impact of one event) · ALE = SLE × ARO (yearly risk) · Safeguard value = ALE before − ALE after − annual cost of safeguard · EF is only an input %.
Risk responsesMitigate (controls) · Transfer/share (insurance, outsourcing — accountability stays) · Avoid (stop the activity) · Accept (documented and signed by the risk owner) · Reject/ignore = never acceptable.
Risk levelsInherent (before controls) · Residual (after controls) · Appetite (how much risk we want) > Tolerance (acceptable deviation) > Capacity (maximum we can survive).
Priority truthsPrimary goal of BCP / IR = human life · BCP success factor = senior management support · New CISO / new ISMS → understand the business and assess risk first · Prove compliance → independent auditor · New vendor → assess first (e.g., SOC 2 Type II).
Control typesDirective · Deterrent (warning banner, visible CCTV) · Preventive (SoD, locks, MFA) · Detective (IDS, logs, job rotation, mandatory vacation) · Corrective · Recovery · Compensating (alternative when the primary control is not possible).
Control categoriesAdministrative (policies, training) · Technical / logical (firewalls, encryption) · Physical (fences, guards).
Ethics (order matters)1. Protect society, the common good and the infrastructure → 2. Act honourably, honestly, justly, responsibly and legally → 3. Provide diligent and competent service to principals → 4. Advance and protect the profession. Watch for word-swaps in options.
Laws & regulationsGDPR: breach to the regulator within 72 h, fines up to €20M or 4% of turnover, controller is accountable · HIPAA: health privacy · HITECH: health breach notification · SOX: financial reporting integrity · GLBA: banks/financial privacy · PCI DSS: card data (industry standard, not law) · Wassenaar: crypto export.
Intellectual propertyPatent = invention (public, ~20 years) · Copyright = creative expression (life + 70 years) · Trademark = brand/logo (renewable while used) · Trade secret = kept secret (NDAs, no registration).
Legal systemsCommon law = precedent · Civil law = written codes · Customary = traditions · Religious = scriptures · Regulatory/administrative = agencies.
Investigation standardsCriminal = beyond reasonable doubt · Civil = preponderance of evidence (>50%) · Administrative = internal policy · Regulatory = regulator’s rules.
FrameworksISO 27001 (certifiable ISMS) / 27002 (controls) · NIST CSF 2.0: Govern, Identify, Protect, Detect, Respond, Recover · NIST RMF (800-37) · NIST 800-53 (control catalogue) · COBIT (IT governance) · SABSA/TOGAF (architecture).
NIST RMF (800-37)Prepare → Categorize → Select → Implement → Assess → Authorize → Monitor.
BCP (NIST 800-34)Policy → BIA → Preventive controls → Recovery strategies → Plan → Test / train / exercise → Maintain. RTO + WRT ≤ MTD.
Personnel securityBackground checks · NDAs · separation of duties · job rotation · mandatory vacation · least privilege · onboarding/offboarding · hostile termination → disable access as they are told.
AwarenessAwareness (everyone, what) → Training (job skills, how) → Education (deep understanding, why). Measure effectiveness (e.g., phishing simulation trends).

Hard words made simple

TermSimple meaningExample / analogyExam hook
Due diligenceResearching / finding out before you decideChecking a vendor’s SOC 2 before signing (pehle pata karo)research, investigate, assess → diligence
Due careActing like a responsible, prudent personActually fixing a known hazard (sahi kaam karo)lawsuit / negligence → failed due care
Prudent person ruleWhat a sensible, careful professional would doLocking the server roomCourts judge negligence with this test
Risk appetiteHow much risk the organisation is willing to takeA startup takes more risk than a bankSet by the board / senior management
Residual riskRisk left after controlsDoor locked, but a window remainsManagement formally accepts it
Exposure factor (EF)% of the asset lost in one incidentA fire destroys 40% of the server roomOnly an input; impact = SLE
KPI vs KRIKPI = how well controls perform now · KRI = early warning of future riskKPI: % patched in 30 days · KRI: rising phishing clicksCurrent performance → KPI; future warning → KRI
SubstantiateTo proveProve you comply with ISO 27001→ independent auditor
AmenabilityWillingness to comply“Ensure amenability” = ensure complianceDecode unusual words from context
CharterTo formally appoint or authoriseCharter an independent assessor—
Delphi techniqueAnonymous expert opinions repeated until they agreeExperts vote secretly on a risk levelQualitative method
STRIDE / DREAD / PASTASTRIDE categorises threats · DREAD rates them · PASTA is a 7-stage risk-centric modelSpoofing, Tampering, Repudiation, Info disclosure, DoS, ElevationCategorise → STRIDE; rate → DREAD; business risk → PASTA
Supply chain risk (SCRM)Risk from vendors, parts and software you buyA router tampered with before deliveryTrusted vendors + integrity checks + SBOM
Right to auditContract clause letting you inspect the vendorChecking your cloud vendor’s controlsVerifies vendor compliance
Enticement vs entrapmentLuring someone already intending to attack (legal) vs pushing an innocent person into a crime (illegal)Honeypot = enticementHoneypot → enticement

Read the full Domain 1 cheat sheet →

10 free Domain 1 practice questions

Try each question before opening the answer. The full bank has many more Domain 1 questions with filters and progress tracking.

Question 1 · FIRST

A manager asks a CISSP to hide a known safety-related security flaw from regulators to protect quarterly revenue. According to the ISC2 Code of Ethics, what should guide the CISSP's decision FIRST?

  1. Advance and protect the profession
  2. Provide diligent service to the employer
  3. Act honorably and legally
  4. Protect society, the common good and public trust
Show answer & explanation

Answer: D — Protect society, the common good and public trust

Canons in priority order: protect society → act honorably → serve principals → advance the profession. Society comes first.

Question 2 · NEXT

A security architect conducting a compliance assessment for a federal agency system has completed the 'Categorize Information System' step per NIST SP 800-37 Revision 2 (Risk Management Framework). Which RMF step must the architect execute IMMEDIATELY NEXT?

  1. Select Security Controls tailored to system categorization
  2. Authorize Information System operation via executive approval
  3. Implement Security Controls on baseline system images
  4. Assess Security Control implementation via independent audit
Show answer & explanation

Answer: A — Select Security Controls tailored to system categorization

The NIST RMF sequence is Prepare → Categorize → Select → Implement → Assess → Authorize → Monitor. Following system categorization, the security architect must Select baseline security controls from NIST SP 800-53. Option C is incorrect because control implementation occurs after selecting controls. Option D is incorrect because assessment takes place after implementation. Option B is incorrect because authorization is near the final step prior to continuous monitoring.

Question 3 · LEAST

Which security awareness activity is LEAST likely to change employee behaviour over the long term?

  1. A single annual poster campaign about strong passwords
  2. Leadership visibly following and talking about security policies
  3. Role-based training refreshed whenever job duties change
  4. Regular phishing simulations followed by short targeted coaching
Show answer & explanation

Answer: A — A single annual poster campaign about strong passwords

Lasting behaviour change needs repetition, relevance and leadership example. A one-off poster raises brief awareness but rarely changes habits.

Question 4 · NOT

All of the following are valid reasons to perform a quantitative risk analysis EXCEPT:

  1. To compare the cost of a safeguard with the loss it prevents
  2. To express potential losses in monetary terms for budgeting
  3. To remove the need for any management judgement in risk decisions
  4. To prioritise risks using annualized loss expectancy values
Show answer & explanation

Answer: C — To remove the need for any management judgement in risk decisions

Quantitative analysis supports decisions with numbers (SLE, ALE, cost-benefit) but never removes management judgement; estimates such as ARO and EF are themselves uncertain. The other options are genuine benefits.

Question 5 · BEST

A risk management director is preparing an assessment strategy for an enterprise cloud migration project. The director needs to explain the practical difference between qualitative and quantitative risk analysis to executive stakeholders. Which statement BEST highlights this difference?

  1. Qualitative risk analysis is mandatory for regulatory compliance, whereas quantitative analysis is legally prohibited
  2. Qualitative analysis relies on numerical calculations, whereas quantitative relies on High/Medium/Low rating scales
  3. Both methods yield identical monetary loss figures, differing only in the time required for data collection
  4. Quantitative analysis calculates objective financial values (SLE/ALE), whereas qualitative uses subjective risk ratings
Show answer & explanation

Answer: D — Quantitative analysis calculates objective financial values (SLE/ALE), whereas qualitative uses subjective risk ratings

Quantitative risk analysis assigns objective financial values ($ values, SLE, ALE) to risks, whereas qualitative analysis utilizes subjective scales (High/Medium/Low) based on expert opinion. Option B is wrong because it reverses the definitions of qualitative and quantitative analysis. Option C is wrong because qualitative analysis does not produce monetary figures. Option A is wrong because regulators permit both methodologies depending on data availability.

Question 6 · PRIMARY

During a corporate risk review, the Chief Risk Officer asks the disaster recovery team to distinguish between Business Continuity Planning (BCP) and Disaster Recovery Planning (DRP). What is the PRIMARY focus of a BCP?

  1. Restoring IT server clusters and network infrastructure following a data center outage
  2. Conducting forensic analysis on damaged server hardware to establish root cause failure
  3. Executing daily differential database backups to offsite cloud object storage buckets
  4. Ensuring critical business operations and core functions continue during and after a disaster
Show answer & explanation

Answer: D — Ensuring critical business operations and core functions continue during and after a disaster

The primary objective of a Business Continuity Plan (BCP) is ensuring that essential business processes and operational functions continue running during and after a disruption. Option A is incorrect because technical infrastructure restoration is the primary objective of Disaster Recovery (DR). Option C is incorrect because database backup execution is a tactical technical control. Option B is incorrect because root cause forensic investigation occurs during incident response.

Question 7 · MOST

A Chief Information Security Officer (CISO) needs to ensure that corporate security controls remain aligned with changing threat landscapes and infrastructure updates over time. Which practice provides the MOST effective mechanism for maintaining an accurate risk posture?

  1. Implementing continuous security monitoring coupled with periodic risk reassessments
  2. Relying exclusively on third-party software advisories to uncover internal security gaps
  3. Conducting a single comprehensive risk assessment during initial network deployment
  4. Adopting qualitative risk ratings exclusively to eliminate quantitative calculations
Show answer & explanation

Answer: A — Implementing continuous security monitoring coupled with periodic risk reassessments

Continuous security monitoring (per NIST SP 800-137) combined with periodic risk reassessments ensures controls dynamically adapt to infrastructure changes and evolving threats. Option C is incorrect because one-time assessments quickly become obsolete as environments change. Option B is incorrect because third-party vendor advisories do not evaluate internal network risks. Option D is incorrect because eliminating quantitative metrics degrades financial risk evaluation accuracy.

Question 8

A lead security auditor investigating financial controls discovers that a payroll supervisor has administrative authority to both create new vendor records and authorize wire transfers to those vendors. The auditor flags this as a critical finding because it violates:

  1. Principle of Least Privilege
  2. Separation of Duties
  3. Job Rotation requirement
  4. Need to Know access rule
Show answer & explanation

Answer: B — Separation of Duties

Separation of Duties (SoD) divides critical business tasks among distinct personnel so no single user has complete end-to-end control, mitigating internal fraud and error. Option A (Least Privilege) is incorrect because it restricts permissions to job roles but does not mandate multi-person workflow splitting. Option C (Job Rotation) is incorrect because it rotates employee duties over time to detect fraud. Option D (Need to Know) is incorrect because it limits access strictly to necessary data.

Question 9 · FIRST

A Chief Information Security Officer (CISO) is evaluating the risk of integrating a third-party Generative AI service into the corporate workflow. What is the MOST critical INITIAL step before approving data processing?

  1. Disable all network logging to protect user query privacy from internal auditors
  2. Conduct a formal vendor risk assessment and data privacy impact analysis
  3. Immediately deploy web application firewall rules to restrict outbound API calls
  4. Require all software developers to sign individual non-disclosure agreements
Show answer & explanation

Answer: B — Conduct a formal vendor risk assessment and data privacy impact analysis

Option B is correct because conducting a formal vendor risk assessment and privacy impact analysis ensures executive management understands how data is stored, trained, and protected by the vendor before data processing begins. Option C is incorrect because firewall rules do not address legal compliance or vendor data security posture. Option D is wrong because individual developer NDAs do not mitigate third-party vendor risk. Option A is incorrect because disabling logging violates auditing requirements and security governance principles.

Question 10 · NEXT

During a NIST SP 800-30 risk assessment, analysts have just estimated how often each threat is expected to exploit the identified weaknesses each year. What is the NEXT step?

  1. Determine the magnitude of impact
  2. Determine the overall risk
  3. Communicate the results to stakeholders
  4. Identify vulnerabilities and predisposing conditions
Show answer & explanation

Answer: A — Determine the magnitude of impact

'How often per year' = likelihood/ARO (done). SP 800-30: Threats → Vulnerabilities → Likelihood → IMPACT → Risk → Communicate. NEXT = Impact.

Ready for the full bank?

2,000+ explained questions, timed mocks and a CAT simulator that behaves like the real exam.

Practise freeSee plans