Govern
Connect Risk to Accountability
Connect ethics, policy, risk, and legal duties to accountable business priorities.
Cybersecurity Advanced•CISSP Exam Preparation
Lead SecurityWith Confidence.Prepare AcrossAll Eight Domains.
Build connected security judgment across governance, assets, architecture, networks, identity, testing, operations, and software. Follow a guided learning path designed to help professionals prepare across all eight CISSP domains and lead complex security decisions with greater clarity.
$749 Tuition
12 Months of Access•
3 Payments of $266 Available
Cybersecurity Advanced Course Overview
Design
Challenge Security Architecture
Trace trust, data, identity, network, and software dependencies across the enterprise.
Assure
Validate Controls with Evidence
Plan assessments, test control effectiveness, and explain what the evidence proves.
Operate
Direct Resilient Security Operations
Coordinate monitoring, response, investigations, recovery, and operational improvement.
Connected Security Decisions
Build the Skills Behind Advanced Security Decisions
Advanced security work rarely stays inside one specialty. Governance shapes architecture, identity affects operations, and software defects can expose regulated data. The course keeps those relationships visible so decisions remain accountable, testable, and useful.
- 01Translate Security Into Accountable Business Decisions
Frame risk, authority, ownership, exceptions, and escalation in language leaders can act on.
- 02Evaluate Architecture and Engineering Trade-Offs
Compare trust boundaries, cryptography, resilience, segmentation, physical controls, and system dependencies.
- 03Validate Controls and Interpret Evidence
Connect assessment scope, testing methods, audit evidence, findings, limitations, and remediation priorities.
- 04Direct Operations, Response, and Recovery
Reason through monitoring, incident decisions, investigations, continuity, recovery, and secure software operations.
Eight-Domain Course Architecture
Eight Domains. One Connected Security System.
The course connects governance and assets, architecture and access, and assessment and operations so every domain is studied as part of one enterprise-security decision model.
12 lessonsGovernance, Risk & Asset Protection
Connect ethics, governance, legal obligations, risk, ownership, classification, retention, handling, and protection decisions.
- Security and Risk Management
- Asset Security
- Policy, ownership, classification
22 lessonsArchitecture, Networks & Access
Evaluate secure architecture, cryptography, platforms, communication paths, segmentation, identity, authentication, and authorization together.
- Security Architecture and Engineering
- Communication and Network Security
- Identity and Access Management
14 lessonsAssessment, Operations & Secure Software
Use testing evidence, operational response, resilience, investigations, and secure-development practices to validate and sustain protection.
- Security Assessment and Testing
- Security Operations
- Software Development Security
All eight domains remain individually searchable in the curriculum below. These three groups show how the knowledge areas connect.
The Security Decision Workflow
Solve Complex Security Scenarios in Five Deliberate Moves
Identify the decision level, connect the affected domains, test the evidence, compare trade-offs, and defend the response that best fits the risk.
Actionable Security Skills
Practice the Work Security Leaders Do
Move from isolated terms into connected work that makes security decisions accountable, testable, and useful.
Frame Risk and Accountability
Connect obligations, ownership, exceptions, business value, and residual risk.
- Clarify authority and ownership
- Connect policy to evidence
- Escalate material risk
Challenge the Security Design
Evaluate trust boundaries, cryptography, segmentation, resilience, identity, and dependencies.
- Trace attack paths and dependencies
- Compare design alternatives
- Document security requirements
Validate and Direct the Response
Use testing, monitoring, incident evidence, continuity, and recovery objectives.
- Interpret control effectiveness
- Prioritize remediation and response
- Verify recovery and follow-through
Governance · Engineering · Operations
Lead Across the Way Security Is Actually Delivered.
The same decision can look different from a governance, design, assurance, or operational perspective. The course keeps those perspectives connected.
Make Authority Explicit.
Use ethics, policy, legal duties, risk treatment, ownership, exceptions, compliance, and executive communication to make security decisions accountable.
- Define decision rights
- Document risk and evidence
- Escalate with context
Design for Trust and Resilience.
Use secure design principles, cryptography, physical security, segmentation, identity, resilience, and software-security requirements to reduce exposure.
- Map trust boundaries
- Compare control trade-offs
- Validate design assumptions
Prove and Sustain Control Effectiveness.
Use assessments, audits, monitoring, incident response, investigations, continuity, recovery, and secure operations to keep controls effective over time.
- Test what matters
- Interpret operational evidence
- Improve after events
Built for Active Learning
Everything You Need to Learn.
Move from a clear explanation into scenario work, retrieval practice, and targeted review. Keep the distinctions you need and return to the domains that require more attention.
Connected Learning Workspace
Study the Concept. Compare the Evidence. Defend the Response.
Guided lessons, flashcards, practice, scenario quizzes, notes, and course navigation support different parts of one learning cycle.
48 Guided Lessons
Detailed explanations establish the security context, responsibilities, constraints, and evidence behind each topic.
192 Scenario Quizzes
Each of the 192 structured sections closes with decision-oriented review that checks integrated understanding.
48 Practice Sets
Use targeted practice to identify where the reasoning is strong and where review is needed.
48 Flashcard Sets
Strengthen retrieval of definitions, distinctions, control purposes, roles, evidence, and response patterns.
Exportable Notes, Highlights, and Support
Preserve learner-specific review material. Use current live-training, office-hour, and support options where available.
Complete Curriculum Browser
See Exactly What You Will Learn
Choose a domain. Search a topic. Open a lesson. Review its verified scope, access path, and source-supported lesson detail.
48 lessons
No lessons match this search.
Try a broader term or choose All Domains.
Complete Curriculum Fallback
Review all 48 lessons without JavaScript. Every lesson below uses the supplied lesson, flashcard, and practice destinations and displays only Sections 1 through 4 from the attached CISSP Master Chapter Architecture.
Domain 1 — Security and Risk Management
Lesson 1.1 — Professional Ethics in Cybersecurity · Free Preview
Section 1 — Foundations of Professional Ethics
- Defining Ethics and Professional Conduct
- Ethics vs Law in Cybersecurity Practice
- Core Moral Principles and Ethical Theories
- Trust, Responsibility, and Stewardship in Security Roles
- Ethical Risk and Organizational Decision-Making
- Stakeholder Expectations and Public Trust
- Ethics as a Security Leadership Responsibility
- Applying Ethical Foundations in Real-World Security Environments
- Scenario-Based Quiz
Section 2 — The CISSP Code of Ethics Canon
- Origins and Purpose of the CISSP Code of Ethics
- Protecting Society, the Common Good, and Public Trust
- Acting Honorably, Honestly, Justly, Responsibly, and Legally
- Providing Diligent and Competent Service to Principals
- Advancing and Protecting the Security Profession
- Ethical Conflicts and Canon Prioritization
- Applying the Code of Ethics During Security Incidents
- Operationalizing Ethical Standards in Enterprise Security Programs
- Scenario-Based Quiz
Section 3 — Ethical Decision-Making in Security Leadership
- Foundations of Ethical Decision-Making Models
- Balancing Security Objectives with Business Needs
- Risk Acceptance and Ethical Accountability
- Ethical Leadership During Security Crises
- Bias, Pressure, and Conflicts in Decision Processes
- Transparency and Communication in Leadership Decisions
- Escalation, Reporting, and Whistleblower Considerations
- Applying Ethical Leadership in Enterprise Security Operations
- Scenario-Based Quiz
Section 4 — Organizational Ethics and Security Culture
- Defining Organizational Ethics and Culture
- Building a Culture of Security Responsibility
- Leadership Influence on Ethical Behavior
- Ethics Awareness and Security Training Programs
- Insider Threats and Toxic Organizational Culture
- Accountability, Reporting, and Behavioral Enforcement
- Ethics Metrics, Auditing, and Continuous Improvement
- Sustaining Ethical Security Culture Across Enterprise Environments
- Scenario-Based Quiz
Lesson 1.2 — Understanding and Applying Security Concepts · Free Preview
Section 1 — Confidentiality, Integrity, and Availability (CIA)
- Foundations of the CIA Triad
- Confidentiality Principles and Information Protection
- Integrity Controls and Trustworthiness of Data
- Availability Requirements and Resilience Strategies
- Balancing CIA Objectives in Enterprise Security
- Threats That Undermine Confidentiality, Integrity, and Availability
- Security Controls Supporting the CIA Triad
- Applying CIA Principles in Real-World Security Operations
- Scenario-Based Quiz
Section 2 — Non-Repudiation
- Foundations of Non-Repudiation
- Authentication and Identity Validation
- Digital Signatures and Cryptographic Assurance
- Logging, Auditing, and Transaction Verification
- Public Key Infrastructure and Trust Relationships
- Legal and Evidentiary Considerations of Non-Repudiation
- Threats Against Accountability and Attribution
- Applying Non-Repudiation Controls in Enterprise Environments
- Scenario-Based Quiz
Section 3 — Authentication, Authorization, and Accountability (AAA)
- Foundations of AAA Security Models
- Identification and Authentication Mechanisms
- Authorization Models and Access Decisions
- Accounting, Auditing, and Activity Tracking
- Multi-Factor Authentication and Identity Assurance
- Centralized Authentication Services and Protocols
- Threats Against AAA Systems and Controls
- Applying AAA Principles in Enterprise Security Architectures
- Scenario-Based Quiz
Section 4 — Gap Analysis
- Foundations of Gap Analysis Methodologies
- Identifying Current-State Security Capabilities
- Defining Desired-State Security Objectives
- Risk Assessment and Gap Prioritization
- Compliance and Control Gap Identification
- Resource Constraints and Remediation Planning
- Metrics, Reporting, and Continuous Improvement
- Applying Gap Analysis in Enterprise Security Programs
- Scenario-Based Quiz
Lesson 1.3 — Security Governance Principles · Free Preview
Section 1 — Foundations of Security Governance
- Defining Security Governance and Organizational Purpose
- Governance Objectives and Strategic Alignment
- Governance vs Management Responsibilities
- Security Governance Components and Structure
- Executive Leadership and Governance Accountability
- Governance Drivers, Risks, and Business Requirements
- Measuring Governance Effectiveness and Maturity
- Applying Security Governance in Enterprise Environments
- Scenario-Based Quiz
Section 2 — Governance Frameworks and Organizational Structure
- Foundations of Governance Frameworks
- Enterprise Governance Models and Hierarchies
- Governance Committees and Decision Authority
- Integrating Security into Organizational Structures
- Governance Frameworks and Industry Standards
- Centralized vs Decentralized Governance Models
- Governance Communication and Reporting Channels
- Applying Governance Structures in Complex Enterprises
- Scenario-Based Quiz
Section 3 — Roles, Responsibilities, and Accountability
- Defining Security Roles and Responsibilities
- Executive Leadership and Board Accountability
- Security Teams, Operational Roles, and Ownership
- Segregation of Duties and Conflict Prevention
- Third-Party Roles and Shared Responsibilities
- Accountability Mechanisms and Oversight Controls
- Role-Based Governance and Performance Measurement
- Applying Accountability Models in Enterprise Security Programs
- Scenario-Based Quiz
Section 4 — Policies, Standards, Procedures, and Guidelines
- Foundations of Security Documentation Hierarchies
- Security Policies and Organizational Direction
- Standards and Baseline Security Requirements
- Procedures, Processes, and Operational Consistency
- Guidelines, Recommendations, and Flexibility
- Documentation Lifecycle Management and Version Control
- Policy Enforcement, Exceptions, and Compliance Monitoring
- Applying Governance Documentation Across Enterprise Operations
- Scenario-Based Quiz
Lesson 1.4 — Legal, Regulatory, and Compliance Issues · Free Preview
Section 1 — Foundations of Legal and Regulatory Environments
- Foundations of Cybersecurity Law and Regulatory Systems
- Criminal, Civil, Administrative, and Regulatory Law
- Jurisdiction and Legal Authority in Cybersecurity
- National and International Legal Frameworks
- Organizational Liability and Legal Accountability
- Regulatory Oversight and Compliance Expectations
- Legal Documentation and Reporting Obligations
- Applying Legal Principles in Enterprise Security Environments
- Scenario-Based Quiz
Section 2 — Compliance Requirements and Governance Obligations
- Foundations of Compliance Management
- Regulatory Compliance Programs and Governance Structures
- Industry Regulations and Sector-Specific Requirements
- Mapping Security Controls to Compliance Obligations
- Compliance Auditing and Evidence Collection
- Executive Accountability and Regulatory Reporting
- Continuous Compliance Monitoring and Improvement
- Applying Compliance Governance Across Enterprise Operations
- Scenario-Based Quiz
Section 3 — Privacy and Data Protection Requirements
- Foundations of Privacy and Data Protection
- Personal Data Classification and Handling Requirements
- Privacy Regulations and Legal Obligations
- Consent, Transparency, and User Rights
- Data Minimization and Retention Requirements
- Cross-Border Data Transfer Challenges
- Privacy Incident Response and Breach Notifications
- Applying Privacy Governance in Enterprise Security Programs
- Scenario-Based Quiz
Section 4 — Intellectual Property and Licensing Considerations
- Foundations of Intellectual Property Protection
- Copyrights, Patents, and Trademarks
- Trade Secrets and Proprietary Information
- Licensing Agreements and Software Usage Rights
- Digital Rights Management and Content Protection
- Intellectual Property Theft and Insider Risks
- Enforcement, Litigation, and Legal Remedies
- Applying Intellectual Property Protections in Enterprise Environments
- Scenario-Based Quiz
Lesson 1.5 — Risk Management Concepts · Free Preview
Section 1 — Foundations of Risk Management
- Defining Risk and Organizational Exposure
- Threats, Vulnerabilities, and Impact Relationships
- Risk Management Objectives and Security Strategy
- Enterprise Risk Management Principles
- Security Governance and Risk Alignment
- Risk Ownership and Accountability
- Risk Communication and Organizational Awareness
- Applying Risk Management Principles in Enterprise Environments
- Scenario-Based Quiz
Section 2 — Risk Identification and Asset Valuation
- Foundations of Asset Identification and Classification
- Tangible and Intangible Asset Valuation
- Threat Modeling and Risk Discovery Processes
- Vulnerability Identification and Exposure Analysis
- Dependency Mapping and Critical Business Functions
- Data Classification and Information Sensitivity
- Risk Registers and Documentation Practices
- Applying Asset and Risk Identification in Enterprise Security Programs
- Scenario-Based Quiz
Section 3 — Risk Assessment and Analysis Methodologies
- Foundations of Risk Assessment Processes
- Qualitative Risk Analysis Methodologies
- Quantitative Risk Analysis Methodologies
- Likelihood, Impact, and Exposure Calculations
- Single Loss Expectancy and Annualized Loss Expectancy
- Scenario Analysis and Risk Modeling Techniques
- Prioritization and Risk Ranking Strategies
- Applying Risk Analysis in Enterprise Decision-Making
- Scenario-Based Quiz
Section 4 — Risk Treatment and Response Strategies
- Foundations of Risk Treatment Planning
- Risk Avoidance and Operational Changes
- Risk Mitigation and Security Control Selection
- Risk Transfer and Cyber Insurance Strategies
- Risk Acceptance and Executive Accountability
- Compensating Controls and Residual Risk
- Monitoring Treatment Effectiveness and Adjustments
- Applying Risk Response Strategies in Enterprise Security Programs
- Scenario-Based Quiz
Lesson 1.6 — Threat Modeling and Vulnerability Assessments
Section 1 — Foundations of Threat Modeling
- Defining Threat Modeling and Security Objectives
- Threat Actors, Motivations, and Capabilities
- Assets, Attack Surfaces, and Exposure Analysis
- Trust Boundaries and Data Flow Mapping
- Threat Enumeration and Risk Identification
- Security Assumptions and Architectural Weaknesses
- Threat Modeling Methodologies and Frameworks
- Applying Threat Modeling in Enterprise Security Programs
- Scenario-Based Quiz
Section 2 — Threat Intelligence and Adversarial Analysis
- Foundations of Threat Intelligence
- Indicators of Compromise and Threat Indicators
- Adversary Tactics, Techniques, and Procedures
- Intelligence Collection and Analysis Methods
- Operationalizing Threat Intelligence in Security Programs
- Threat Hunting and Proactive Defense Strategies
- Intelligence Sharing and Collaboration
- Applying Threat Intelligence to Enterprise Risk Reduction
- Scenario-Based Quiz
Section 3 — Vulnerability Identification and Enumeration
- Foundations of Vulnerability Management
- Vulnerability Scanning Technologies and Platforms
- Configuration Weaknesses and Misconfigurations
- Software Vulnerabilities and Exploitable Conditions
- Enumeration Techniques and Exposure Discovery
- False Positives, False Negatives, and Validation
- Documentation and Vulnerability Reporting
- Applying Vulnerability Identification Across Enterprise Environments
- Scenario-Based Quiz
Section 4 — Security Assessment and Analysis Techniques
- Foundations of Security Assessments
- Qualitative and Quantitative Assessment Approaches
- Penetration Testing and Exploitation Methodologies
- Red Team, Blue Team, and Purple Team Operations
- Attack Simulation and Adversarial Testing
- Risk Prioritization and Exposure Analysis
- Reporting Findings and Executive Communication
- Applying Assessment Techniques in Enterprise Security Operations
- Scenario-Based Quiz
Lesson 1.7 — Security Policies, Standards, Procedures, and Guidelines
Section 1 — Foundations of Security Documentation
- Purpose and Importance of Security Documentation
- Governance Hierarchies and Documentation Structures
- Organizational Objectives and Documentation Alignment
- Documentation Ownership and Accountability
- Security Communication Through Formal Documentation
- Regulatory and Legal Drivers for Documentation
- Documentation Lifecycle and Maintenance Processes
- Applying Governance Documentation in Enterprise Security Programs
- Scenario-Based Quiz
Section 2 — Security Policies and Organizational Direction
- Foundations of Security Policy Development
- Enterprise Security Policies and Governance Objectives
- Acceptable Use Policies and User Responsibilities
- Access Control and Identity Management Policies
- Data Protection and Information Handling Policies
- Incident Response and Operational Security Policies
- Policy Enforcement, Exceptions, and Accountability
- Applying Security Policies Across Enterprise Environments
- Scenario-Based Quiz
Section 3 — Standards and Baseline Security Requirements
- Foundations of Security Standards
- Technical Standards and Configuration Baselines
- Industry Standards and Regulatory Alignment
- Secure System and Network Baselines
- Cryptographic and Authentication Standards
- Standardization and Operational Consistency
- Compliance Validation and Standards Enforcement
- Applying Security Standards in Enterprise Operations
- Scenario-Based Quiz
Section 4 — Procedures and Operational Consistency
- Foundations of Security Procedures
- Step-by-Step Operational Process Design
- Change Management and Procedural Governance
- Incident Handling and Escalation Procedures
- Access Provisioning and Administrative Procedures
- Disaster Recovery and Continuity Procedures
- Procedure Testing, Validation, and Updates
- Applying Security Procedures in Operational Environments
- Scenario-Based Quiz
Domain 2 — Asset Security
Lesson 2.1 — Information and Asset Ownership and Protection
Section 1 — Foundations of Asset Security
- Defining Information Assets and Organizational Value
- Asset Ownership and Accountability Principles
- Information Lifecycle and Security Responsibilities
- Asset Classification and Sensitivity Levels
- Business Requirements and Asset Protection Objectives
- Threats Against Organizational Assets
- Governance and Regulatory Drivers for Asset Protection
- Applying Asset Security Principles in Enterprise Environments
- Scenario-Based Quiz
Section 2 — Data Classification and Ownership Models
- Foundations of Data Classification
- Classification Levels and Handling Requirements
- Roles and Responsibilities of Data Owners
- Custodians, Processors, and User Responsibilities
- Labeling and Identification Standards
- Regulatory Requirements for Data Classification
- Challenges in Maintaining Classification Accuracy
- Applying Classification Models Across Enterprise Operations
- Scenario-Based Quiz
Section 3 — Asset Inventory and Management
- Foundations of Asset Inventory Management
- Hardware, Software, and Information Asset Tracking
- Configuration Management and Asset Visibility
- Asset Tagging and Identification Mechanisms
- Lifecycle Tracking and Change Management
- Shadow IT and Unauthorized Asset Risks
- Inventory Auditing and Validation Processes
- Applying Asset Management Practices in Enterprise Security Programs
- Scenario-Based Quiz
Section 4 — Information Protection and Access Control
- Foundations of Information Protection
- Least Privilege and Need-to-Know Principles
- Access Control Mechanisms for Sensitive Assets
- Encryption and Data Protection Strategies
- Monitoring Access and Usage Activities
- Insider Threats and Unauthorized Disclosure Risks
- Data Sharing and Secure Collaboration Controls
- Applying Information Protection Controls in Enterprise Environments
- Scenario-Based Quiz
Lesson 2.2 — Retention, Handling, and Disposal of Assets
Section 1 — Foundations of Data Retention and Lifecycle Management
- Defining Data Retention and Lifecycle Concepts
- Regulatory and Business Drivers for Retention Policies
- Data Lifecycle States and Management Requirements
- Ownership Responsibilities Throughout the Lifecycle
- Storage, Preservation, and Availability Considerations
- Risks Associated with Excessive Data Retention
- Governance and Compliance Oversight Mechanisms
- Applying Lifecycle Management Across Enterprise Environments
- Scenario-Based Quiz
Section 2 — Secure Data Handling and Information Processing
- Foundations of Secure Data Handling
- Classification-Based Handling Procedures
- Secure Data Transmission and Transfer Controls
- Access Restrictions and Handling Responsibilities
- Encryption Requirements for Sensitive Information
- Monitoring and Auditing Information Usage
- Human Error and Mishandling Risks
- Applying Secure Handling Practices in Enterprise Operations
- Scenario-Based Quiz
Section 3 — Storage Security and Preservation Controls
- Foundations of Secure Storage Practices
- Physical and Digital Storage Protection Mechanisms
- Backup Storage and Redundancy Strategies
- Cloud Storage Security and Shared Responsibility
- Archiving Strategies and Long-Term Preservation
- Storage Integrity and Availability Requirements
- Storage Monitoring and Security Validation
- Applying Storage Security Controls Across Enterprise Environments
- Scenario-Based Quiz
Section 4 — Data Retention Policies and Compliance Requirements
- Foundations of Retention Policy Development
- Regulatory Retention Obligations and Legal Holds
- Industry Standards and Compliance Expectations
- Retention Schedules and Organizational Requirements
- Litigation Readiness and Evidence Preservation
- Auditing Retention Compliance and Documentation
- Exceptions, Waivers, and Governance Oversight
- Applying Retention Governance in Enterprise Security Programs
- Scenario-Based Quiz
Lesson 2.3 — Supply Chain Risk Management (SCRM)
Section 1 — Foundations of Supply Chain Risk Management
- Defining Supply Chain Risk and Organizational Exposure
- Third-Party Relationships and Dependency Risks
- Supply Chain Governance and Security Objectives
- Threat Actors Targeting Supply Chains
- Vendor Ecosystems and Shared Responsibility Models
- Regulatory and Compliance Drivers for SCRM
- Risk Communication and Stakeholder Coordination
- Applying SCRM Principles in Enterprise Security Programs
- Scenario-Based Quiz
Section 2 — Vendor Assessment and Third-Party Evaluation
- Foundations of Vendor Risk Assessments
- Due Diligence and Vendor Security Reviews
- Security Questionnaires and Evidence Validation
- Financial, Operational, and Technical Risk Factors
- Cloud Providers and Shared Responsibility Evaluations
- Contractual Obligations and Security Expectations
- Continuous Vendor Monitoring and Reassessment
- Applying Vendor Evaluation Processes Across Enterprise Environments
- Scenario-Based Quiz
Section 3 — Supply Chain Threats and Attack Vectors
- Foundations of Supply Chain Threats
- Hardware Tampering and Counterfeit Components
- Software Supply Chain and Dependency Risks
- Insider Threats Within Vendor Ecosystems
- Logistics, Transportation, and Physical Risks
- Nation-State and Advanced Persistent Threat Activity
- Third-Party Breaches and Cascading Impacts
- Applying Threat Analysis to Supply Chain Security Programs
- Scenario-Based Quiz
Section 4 — Contract Management and Legal Considerations
- Foundations of Security Contract Management
- Security Clauses and Vendor Obligations
- Service-Level Agreements and Accountability Measures
- Compliance Requirements and Regulatory Alignment
- Data Protection and Privacy Responsibilities
- Incident Notification and Breach Reporting Terms
- Legal Remedies, Liability, and Enforcement Actions
- Applying Contract Governance in Enterprise SCRM Programs
- Scenario-Based Quiz
Lesson 2.4 — Data Security Controls and Compliance Requirements
Section 1 — Foundations of Data Security Controls
- Defining Data Security Controls and Organizational Protection Objectives
- Information Sensitivity and Enterprise Data Exposure
- Data Security Governance and Control Objectives
- Threat Actors Targeting Sensitive Data
- Data Protection Ecosystems and Shared Responsibility Models
- Regulatory and Compliance Drivers for Data Security Controls
- Risk Communication and Stakeholder Coordination
- Applying Data Security Control Principles in Enterprise Security Programs
- Scenario-Based Quiz
Section 2 — Data Protection Control Assessment and Evaluation
- Foundations of Data Security Control Assessments
- Due Diligence and Data Protection Reviews
- Control Questionnaires and Evidence Validation
- Technical, Operational, and Compliance Risk Factors
- Cloud Data Protection and Shared Responsibility Evaluations
- Policy Obligations and Data Handling Expectations
- Continuous Control Monitoring and Reassessment
- Applying Data Protection Evaluation Processes Across Enterprise Environments
- Scenario-Based Quiz
Section 3 — Data Security Threats and Exposure Vectors
- Foundations of Data Security Threats
- Unauthorized Access and Data Exfiltration Risks
- Data Leakage Through Misconfiguration and Weak Controls
- Insider Threats and Privileged Data Misuse
- Storage, Transmission, and Processing Risks
- Nation-State and Advanced Persistent Threat Activity Targeting Data
- Third-Party Data Breaches and Cascading Impacts
- Applying Threat Analysis to Data Security Control Programs
- Scenario-Based Quiz
Section 4 — Compliance Management and Legal Considerations
- Foundations of Data Security Compliance Management
- Security Policies and Data Protection Obligations
- Control Requirements and Accountability Measures
- Compliance Requirements and Regulatory Alignment
- Privacy, Classification, and Data Handling Responsibilities
- Incident Notification and Breach Reporting Terms
- Legal Remedies, Liability, and Enforcement Actions
- Applying Compliance Governance in Enterprise Data Security Programs
- Scenario-Based Quiz
Lesson 2.5 — Asset Security Monitoring and Lifecycle Governance
Section 1 — Foundations of Supply Chain Risk Management
- Defining Supply Chain Risk and Organizational Exposure
- Third-Party Relationships and Dependency Risks
- Supply Chain Governance and Security Objectives
- Threat Actors Targeting Supply Chains
- Vendor Ecosystems and Shared Responsibility Models
- Regulatory and Compliance Drivers for SCRM
- Risk Communication and Stakeholder Coordination
- Applying SCRM Principles in Enterprise Security Programs
- Scenario-Based Quiz
Section 2 — Vendor Assessment and Third-Party Evaluation
- Foundations of Vendor Risk Assessments
- Due Diligence and Vendor Security Reviews
- Security Questionnaires and Evidence Validation
- Financial, Operational, and Technical Risk Factors
- Cloud Providers and Shared Responsibility Evaluations
- Contractual Obligations and Security Expectations
- Continuous Vendor Monitoring and Reassessment
- Applying Vendor Evaluation Processes Across Enterprise Environments
- Scenario-Based Quiz
Section 3 — Supply Chain Threats and Attack Vectors
- Foundations of Supply Chain Threats
- Hardware Tampering and Counterfeit Components
- Software Supply Chain and Dependency Risks
- Insider Threats Within Vendor Ecosystems
- Logistics, Transportation, and Physical Risks
- Nation-State and Advanced Persistent Threat Activity
- Third-Party Breaches and Cascading Impacts
- Applying Threat Analysis to Supply Chain Security Programs
- Scenario-Based Quiz
Section 4 — Contract Management and Legal Considerations
- Foundations of Security Contract Management
- Security Clauses and Vendor Obligations
- Service-Level Agreements and Accountability Measures
- Compliance Requirements and Regulatory Alignment
- Data Protection and Privacy Responsibilities
- Incident Notification and Breach Reporting Terms
- Legal Remedies, Liability, and Enforcement Actions
- Applying Contract Governance in Enterprise SCRM Programs
- Scenario-Based Quiz
Domain 3 — Security Architecture and Engineering
Lesson 3.1 — Security Awareness, Education, and Training Programs
Section 1 — Secure Engineering Processes and Design Principles
- Foundations of Secure Engineering Processes
- Threat Modeling and Secure Design Decision-Making
- Least Privilege and Segregation of Duties
- Defense in Depth and Layered Engineering Controls
- Secure Defaults, Fail Securely, and Simplicity in Design
- Zero Trust, Trust but Verify, and Continuous Validation
- Privacy by Design and Shared Responsibility
- Secure Access Service Edge and Modern Secure Architecture
- Scenario-Based Quiz
Section 2 — Security Models and Formal Design Concepts
- Foundations of Security Models
- Bell-LaPadula and Confidentiality Protection
- Biba and Integrity Protection
- Clark-Wilson and Well-Formed Transactions
- Brewer-Nash and Conflict of Interest Controls
- Access Control Models and Security Policy Enforcement
- State Machine, Lattice, and Information Flow Models
- Applying Security Models to Secure System Design
- Scenario-Based Quiz
Section 3 — System Security Requirements and Control Selection
- Foundations of System Security Requirements
- Business, Regulatory, and Risk-Based Security Requirements
- Control Selection and Requirement Traceability
- Preventive, Detective, and Corrective Control Alignment
- Administrative, Technical, and Physical Control Mapping
- Security Baselines and Minimum Control Expectations
- Control Effectiveness, Gaps, and Compensating Controls
- Applying Control Selection to Secure Architecture Decisions
- Scenario-Based Quiz
Section 4 — Information System Security Capabilities
- Foundations of Information System Security Capabilities
- Memory Protection and Secure Process Isolation
- Trusted Platform Module and Hardware Root of Trust
- Encryption, Decryption, and Cryptographic System Capabilities
- Secure Boot, Firmware Protection, and Platform Integrity
- Identity, Access, and Session Security Capabilities
- Logging, Monitoring, and Audit Capability Requirements
- Applying System Capabilities to Security Control Design
- Scenario-Based Quiz
Lesson 3.2 — Information and Asset Classification
Section 1 — Architecture Vulnerability Assessment Foundations
- Foundations of Architecture Vulnerability Assessment
- Threats Against Security Architectures and Designs
- Attack Surfaces Across System Components
- Trust Boundaries and Data Flow Weaknesses
- Design Flaws, Misconfigurations, and Control Gaps
- Security Architecture Review Methods
- Risk-Based Mitigation Planning
- Applying Vulnerability Assessment Across Solution Designs
- Scenario-Based Quiz
Section 2 — Traditional Enterprise System Vulnerabilities
- Client-Based System Vulnerabilities
- Server-Based System Vulnerabilities
- Database System Vulnerabilities
- Cryptographic System Vulnerabilities
- Authentication and Session Management Weaknesses
- Patch, Configuration, and Hardening Failures
- Logging, Monitoring, and Visibility Gaps
- Mitigating Enterprise System Vulnerabilities
- Scenario-Based Quiz
Section 3 — Cloud, Distributed, and Virtualized Systems
- Cloud-Based System Vulnerabilities
- SaaS, PaaS, and IaaS Security Boundaries
- Shared Responsibility and Cloud Control Ownership
- Distributed System Vulnerabilities
- Virtualized System Vulnerabilities
- Containerization and Orchestration Risks
- Serverless Architecture Vulnerabilities
- Mitigating Cloud and Distributed Architecture Risks
- Scenario-Based Quiz
Section 4 — Specialized and Emerging System Architectures
- Industrial Control Systems and Operational Technology Risks
- Internet of Things Security Vulnerabilities
- Embedded System Security Weaknesses
- Edge Computing System Vulnerabilities
- High-Performance Computing Security Risks
- Microservices and API Security Weaknesses
- Architecture Risks in Highly Connected Environments
- Applying Mitigation Strategies Across Specialized Systems
- Scenario-Based Quiz
Lesson 3.3 — Security Models and Security Capabilities of Information Systems
Section 1 — Foundations of Security Models
- Defining Security Models and Architectural Objectives
- Historical Evolution of Information Security Models
- Trust, Assurance, and Security Foundations
- Confidentiality, Integrity, and Availability in Security Models
- Policy Enforcement and Access Control Relationships
- Threats Against Secure System Architectures
- Governance and Compliance Drivers for Security Models
- Applying Security Models in Enterprise Information Systems
- Scenario-Based Quiz
Section 2 — Access Control Models and Security Frameworks
- Foundations of Access Control Models
- Discretionary Access Control (DAC)
- Mandatory Access Control (MAC)
- Role-Based Access Control (RBAC)
- Attribute-Based Access Control (ABAC)
- Rule-Based and Context-Aware Access Models
- Security Framework Integration and Enforcement
- Applying Access Control Models Across Enterprise Environments
- Scenario-Based Quiz
Section 3 — Trusted Computing and System Assurance
- Foundations of Trusted Computing
- Trusted Computing Base (TCB) Components
- Security Kernels and Reference Monitors
- Assurance Levels and Certification Concepts
- Evaluation Standards and Security Criteria
- Hardware Roots of Trust and Platform Integrity
- Threats Against Trusted Systems
- Applying Trusted Computing Principles in Enterprise Operations
- Scenario-Based Quiz
Section 4 — Information Flow and System Security Architecture
- Foundations of Information Flow Security
- Data Flow Models and Trust Boundaries
- Multi-Level Security Architectures
- Segmentation and Isolation Strategies
- Secure System Interconnections and Interfaces
- Monitoring and Validation of Information Flows
- Risks of Improper Information Flow Controls
- Applying Secure Architecture Principles Across Enterprise Systems
- Scenario-Based Quiz
Lesson 3.4 — Fundamentals of Cryptography
Section 1 — Foundations of Cryptography
- Defining Cryptography and Security Objectives
- Historical Evolution of Cryptographic Systems
- Confidentiality, Integrity, and Authentication Principles
- Cryptographic Terminology and Core Concepts
- Threats Against Cryptographic Systems
- Governance and Compliance Drivers for Cryptography
- Limitations and Operational Challenges of Encryption
- Applying Cryptographic Foundations in Enterprise Environments
- Scenario-Based Quiz
Section 2 — Symmetric Encryption Principles
- Foundations of Symmetric Cryptography
- Block Ciphers and Stream Ciphers
- Encryption Algorithms and Operational Modes
- Key Generation and Distribution Challenges
- Strengths and Weaknesses of Symmetric Encryption
- Performance and Scalability Considerations
- Threats Against Symmetric Cryptographic Systems
- Applying Symmetric Encryption Across Enterprise Operations
- Scenario-Based Quiz
Section 3 — Asymmetric Encryption Principles
- Foundations of Asymmetric Cryptography
- Public and Private Key Relationships
- Key Exchange and Secure Communications
- Digital Signatures and Authentication Mechanisms
- Strengths and Weaknesses of Asymmetric Encryption
- Trust Models and Public Key Infrastructure Concepts
- Threats Against Asymmetric Cryptographic Systems
- Applying Asymmetric Encryption in Enterprise Security Programs
- Scenario-Based Quiz
Section 4 — Hashing and Integrity Protection
- Foundations of Cryptographic Hashing
- Integrity Verification and Validation Mechanisms
- Hash Algorithms and Digest Generation
- Salting, Peppering, and Password Protection Techniques
- Collision Resistance and Cryptographic Weaknesses
- Message Authentication Codes and HMAC Concepts
- Threats Against Hashing Mechanisms
- Applying Hashing and Integrity Controls Across Enterprise Environments
- Scenario-Based Quiz
Lesson 3.5 — Cryptographic Applications and Implementations
Section 1 — Foundations of Cryptographic Implementations
- Defining Cryptographic Applications and Use Cases
- Operational Objectives of Cryptographic Systems
- Security Architecture Integration and Dependencies
- Threats Against Cryptographic Implementations
- Governance and Compliance Requirements
- Performance, Scalability, and Operational Constraints
- Secure Deployment and Configuration Considerations
- Applying Cryptographic Implementations in Enterprise Environments
- Scenario-Based Quiz
Section 2 — Public Key Infrastructure and Digital Certificates
- Foundations of Public Key Infrastructure
- Certificate Authorities and Trust Hierarchies
- Digital Certificates and Identity Validation
- Certificate Issuance, Renewal, and Revocation
- Certificate Validation and Trust Verification
- Risks Associated with PKI Mismanagement
- Monitoring and Governance of PKI Environments
- Applying PKI Solutions Across Enterprise Operations
- Scenario-Based Quiz
Section 3 — Secure Communication and Transport Encryption
- Foundations of Secure Communication Protocols
- TLS and Secure Session Establishment
- VPN Technologies and Encrypted Tunneling
- Secure Email and Messaging Encryption
- Wireless Encryption Standards and Protections
- Threats Against Encrypted Communications
- Monitoring and Validation of Secure Connections
- Applying Transport Encryption in Enterprise Security Programs
- Scenario-Based Quiz
Section 4 — Authentication and Cryptographic Identity Controls
- Foundations of Cryptographic Authentication
- Digital Signatures and Non-Repudiation Mechanisms
- Multi-Factor Authentication and Token Systems
- Smart Cards and Hardware-Based Authentication
- Federated Identity and Trust Relationships
- Threats Against Authentication Systems
- Monitoring Identity Assurance and Authentication Events
- Applying Cryptographic Identity Controls Across Enterprise Environments
- Scenario-Based Quiz
Lesson 3.6 — Physical Security Controls and Facility Security
Section 1 — Foundations of Physical Security
- Defining Physical Security and Facility Protection Objectives
- Threats Against Physical Environments and Assets
- Physical Security Governance and Organizational Responsibilities
- Layered Defense and Defense-in-Depth Principles
- Risk Assessment for Physical Security Programs
- Regulatory and Compliance Drivers for Facility Protection
- Physical Security Planning and Operational Coordination
- Applying Physical Security Principles Across Enterprise Environments
- Scenario-Based Quiz
Section 2 — Facility Design and Environmental Security
- Foundations of Secure Facility Design
- Site Selection and Geographic Risk Considerations
- Perimeter Protection and Boundary Controls
- Environmental Design and Crime Prevention Strategies
- HVAC, Water, and Utility Security Considerations
- Environmental Hazards and Safety Risks
- Monitoring and Maintenance of Environmental Controls
- Applying Secure Design Practices in Enterprise Facilities
- Scenario-Based Quiz
Section 3 — Access Control Systems and Entry Management
- Foundations of Physical Access Control
- Locks, Keys, and Mechanical Access Mechanisms
- Electronic Badge and Smart Card Systems
- Biometric Authentication for Physical Security
- Visitor Management and Escort Procedures
- Tailgating, Piggybacking, and Unauthorized Entry Risks
- Monitoring, Logging, and Audit Trails for Physical Access
- Applying Access Control Systems Across Enterprise Facilities
- Scenario-Based Quiz
Section 4 — Surveillance, Monitoring, and Detection Systems
- Foundations of Surveillance and Monitoring
- CCTV Systems and Video Monitoring Strategies
- Intrusion Detection and Alarm Technologies
- Motion Sensors and Environmental Monitoring Controls
- Security Guards and Human Monitoring Operations
- Incident Detection and Escalation Procedures
- Evidence Collection and Monitoring Retention Requirements
- Applying Surveillance Controls in Enterprise Security Programs
- Scenario-Based Quiz
Lesson 3.7 — Security Architecture and Engineering Requirements
Section 1 — Foundations of Security Architecture and Engineering
- Defining Security Architecture and Engineering Principles
- Security Objectives and Enterprise Design Requirements
- Threat Modeling and Architectural Risk Considerations
- Trust Boundaries and Security Domains
- Governance, Compliance, and Regulatory Drivers
- Security Architecture Documentation and Standards
- Security Engineering Roles and Responsibilities
- Applying Security Architecture Principles in Enterprise Environments
- Scenario-Based Quiz
Section 2 — Secure System Design and Trusted Architectures
- Foundations of Secure System Design
- Trusted Computing and Assurance Models
- Security Kernels and Reference Monitors
- Segmentation, Isolation, and Containment Strategies
- High Availability and Resilience Requirements
- Redundancy and Fault Tolerance Mechanisms
- Risks Associated with Poor Architectural Design
- Applying Trusted Architecture Concepts Across Enterprise Systems
- Scenario-Based Quiz
Section 3 — Hardware Security and Platform Protection
- Foundations of Hardware Security
- Trusted Platform Modules and Hardware Roots of Trust
- Secure Boot and Firmware Integrity Controls
- Processor Security Features and Memory Protections
- Hardware Security Modules and Cryptographic Processing
- Supply Chain Risks and Hardware Tampering Threats
- Monitoring and Validation of Platform Integrity
- Applying Hardware Security Controls Across Enterprise Operations
- Scenario-Based Quiz
Section 4 — Virtualization and Cloud Security Architecture
- Foundations of Virtualization Security
- Hypervisors and Virtual Machine Isolation
- Containerization and Orchestration Security
- Cloud Service Models and Shared Responsibility
- Multi-Tenant Risks and Segmentation Strategies
- Hybrid Cloud and Distributed Infrastructure Challenges
- Monitoring and Governance of Virtualized Environments
- Applying Secure Virtualization Architectures in Enterprise Programs
- Scenario-Based Quiz
Lesson 3.8 — Engineering Processes Using Secure Design Principles
Section 1 — Foundations of Secure Engineering Processes
- Defining Secure Engineering and Design Objectives
- Security by Design and Privacy by Design Principles
- Governance and Compliance Requirements for Engineering
- Threat Modeling and Risk-Informed Design Decisions
- Security Architecture and Engineering Coordination
- Secure Development Lifecycle Integration
- Challenges in Secure Engineering and Operational Constraints
- Applying Secure Engineering Principles Across Enterprise Environments
- Scenario-Based Quiz
Section 2 — Secure Design Principles and Architectural Concepts
- Foundations of Secure Design Principles
- Least Privilege and Separation of Duties
- Defense-in-Depth and Layered Security Strategies
- Fail-Safe Defaults and Secure Configuration Baselines
- Economy of Mechanism and Simplicity in Design
- Open Design and Security Transparency Concepts
- Trust Boundaries and Compartmentalization Strategies
- Applying Secure Design Principles Across Enterprise Systems
- Scenario-Based Quiz
Section 3 — Security Requirements and System Integration
- Foundations of Security Requirements Engineering
- Functional and Non-Functional Security Requirements
- Secure Integration of Systems and Components
- Identity, Access, and Authentication Integration
- Secure APIs and Interoperability Considerations
- Third-Party Components and Dependency Risks
- Validation and Verification of Security Requirements
- Applying Security Requirements in Enterprise Engineering Programs
- Scenario-Based Quiz
Section 4 — Secure Development Lifecycle and DevSecOps
- Foundations of Secure Development Lifecycles
- DevSecOps Principles and Continuous Security Integration
- Code Review and Secure Programming Practices
- Static and Dynamic Application Security Testing
- CI/CD Pipeline Security and Automation Controls
- Vulnerability Management During Development
- Governance and Compliance in Software Engineering
- Applying DevSecOps Practices Across Enterprise Environments
- Scenario-Based Quiz
Domain 4 — Communication and Network Security
Lesson 4.1 — Network Security Fundamentals
Section 1 — Foundations of Network Security
- Defining Network Security and Communication Objectives
- Network Architecture and Security Domains
- Confidentiality, Integrity, and Availability in Networking
- Threats Against Network Infrastructure and Communications
- Governance and Compliance Drivers for Network Security
- Security Roles and Responsibilities in Networking Environments
- Challenges of Securing Modern Networks
- Applying Network Security Principles Across Enterprise Environments
- Scenario-Based Quiz
Section 2 — Network Models and Communication Frameworks
- Foundations of Network Communication Models
- OSI Model and Layered Communication Concepts
- TCP/IP Architecture and Protocol Relationships
- Data Encapsulation and Packet Transmission
- Routing, Switching, and Network Segmentation Principles
- Trust Boundaries and Communication Zones
- Risks Associated with Weak Network Architecture
- Applying Network Models in Enterprise Security Programs
- Scenario-Based Quiz
Section 3 — Network Devices and Infrastructure Components
- Foundations of Network Infrastructure Security
- Routers, Switches, and Core Network Devices
- Firewalls and Boundary Protection Systems
- Proxies, Gateways, and Traffic Management Devices
- Wireless Infrastructure and Access Point Security
- Intrusion Detection and Prevention Systems
- Risks Associated with Misconfigured Network Devices
- Applying Infrastructure Security Controls Across Enterprise Networks
- Scenario-Based Quiz
Section 4 — Network Threats and Attack Vectors
- Foundations of Network Threats
- Denial-of-Service and Distributed Denial-of-Service Attacks
- Packet Sniffing and Traffic Interception Risks
- Spoofing, Poisoning, and Session Hijacking Techniques
- Malware Propagation Across Networks
- Insider Threats and Unauthorized Access Risks
- Advanced Persistent Threat Activity in Networks
- Applying Defensive Strategies Against Network Threats
- Scenario-Based Quiz
Lesson 4.2 — Network Security Design and Implementation
Section 1 — Foundations of Secure Network Design
- Defining Secure Network Architecture Objectives
- Principles of Defense-in-Depth in Network Design
- Security Requirements and Business Alignment
- Threat Modeling for Network Architectures
- Segmentation and Isolation Strategies
- Governance and Compliance Considerations in Design
- Challenges in Modern Network Security Implementations
- Applying Secure Design Principles Across Enterprise Networks
- Scenario-Based Quiz
Section 2 — Network Segmentation and Zone-Based Security
- Foundations of Network Segmentation
- VLANs and Logical Separation Techniques
- Security Zones and Trust Boundaries
- DMZ Architectures and External Service Protection
- Micro-Segmentation and Granular Isolation Strategies
- Risks Associated with Flat Network Architectures
- Monitoring and Managing Segmented Environments
- Applying Zone-Based Security Across Enterprise Operations
- Scenario-Based Quiz
Section 3 — Firewall Architecture and Boundary Protection
- Foundations of Firewall Technologies
- Packet Filtering and Stateful Inspection Firewalls
- Application-Aware and Next-Generation Firewalls
- Proxy Firewalls and Traffic Mediation
- Rule Management and Policy Enforcement
- Risks of Misconfigured Boundary Controls
- Monitoring, Logging, and Audit Readiness
- Applying Firewall Architectures Across Enterprise Networks
- Scenario-Based Quiz
Section 4 — Secure Routing and Switching Implementations
- Foundations of Secure Routing Concepts
- Dynamic Routing Protocol Security
- Layer 2 Switching Security and VLAN Protection
- Port Security and Access Restriction Mechanisms
- Routing Redundancy and High Availability Strategies
- Threats Against Routing and Switching Infrastructure
- Monitoring and Validation of Network Paths
- Applying Secure Routing and Switching Practices Across Enterprise Environments
- Scenario-Based Quiz
Lesson 4.3 — Securing Network Components
Section 1 — Foundations of Network Component Security
- Defining Network Component Security Objectives
- Threats Against Network Infrastructure Components
- Governance and Compliance Requirements for Network Devices
- Defense-in-Depth and Layered Infrastructure Protection
- Hardening Standards and Baseline Configuration Principles
- Operational Risks Associated with Misconfigured Devices
- Monitoring and Visibility Across Network Components
- Applying Network Component Security Across Enterprise Environments
- Scenario-Based Quiz
Section 2 — Router Security and Routing Protection
- Foundations of Router Security
- Securing Routing Protocols and Route Advertisements
- Administrative Access Control and Management Interfaces
- Control Plane Protection Mechanisms
- Access Control Lists and Traffic Filtering
- Risks of Route Manipulation and Spoofing
- Monitoring and Auditing Router Activities
- Applying Router Security Controls Across Enterprise Networks
- Scenario-Based Quiz
Section 3 — Switch Security and Layer 2 Protection
- Foundations of Switch Security
- VLAN Security and Segmentation Controls
- Port Security and MAC Address Restrictions
- Spanning Tree Protocol Security Mechanisms
- DHCP Snooping and ARP Inspection Controls
- Risks of Layer 2 Attacks and Broadcast Abuse
- Monitoring and Managing Switch Infrastructure
- Applying Layer 2 Security Controls Across Enterprise Operations
- Scenario-Based Quiz
Section 4 — Firewall and Boundary Device Security
- Foundations of Firewall Security
- Secure Rule Management and Policy Enforcement
- Next-Generation Firewall Capabilities and Controls
- Proxy Services and Application Filtering Mechanisms
- Boundary Defense and Traffic Inspection Strategies
- Risks Associated with Weak Firewall Configurations
- Monitoring, Logging, and Audit Readiness
- Applying Firewall Security Practices Across Enterprise Environments
- Scenario-Based Quiz
Lesson 4.4 — Wireless Security Principles
Section 1 — Foundations of Wireless Security
- Defining Wireless Communication and Security Objectives
- Wireless Networking Standards and Technologies
- Threats Against Wireless Networks and Devices
- Governance and Compliance Drivers for Wireless Security
- Wireless Risk Assessments and Security Planning
- Challenges in Securing Distributed Wireless Environments
- Security Roles and Responsibilities in Wireless Operations
- Applying Wireless Security Principles Across Enterprise Environments
- Scenario-Based Quiz
Section 2 — Wireless Network Architecture and Deployment
- Foundations of Wireless Network Design
- Access Point Placement and Coverage Planning
- Wireless Controllers and Centralized Management
- SSIDs, Segmentation, and Guest Network Isolation
- High Availability and Wireless Resilience Strategies
- Risks Associated with Poor Wireless Architecture
- Monitoring and Optimization of Wireless Environments
- Applying Secure Wireless Design Practices Across Enterprise Operations
- Scenario-Based Quiz
Section 3 — Wireless Encryption and Authentication Mechanisms
- Foundations of Wireless Encryption
- WPA2 and WPA3 Security Standards
- Enterprise Authentication and 802.1X Integration
- RADIUS and Centralized Authentication Services
- Pre-Shared Keys and Passphrase Management
- Risks Associated with Weak Wireless Authentication
- Monitoring and Validation of Wireless Security Controls
- Applying Wireless Authentication Controls Across Enterprise Environments
- Scenario-Based Quiz
Section 4 — Wireless Threats and Attack Techniques
- Foundations of Wireless Threats
- Rogue Access Points and Evil Twin Attacks
- Packet Sniffing and Wireless Eavesdropping Risks
- Deauthentication and Denial-of-Service Attacks
- MAC Spoofing and Unauthorized Device Access
- Bluetooth and Near-Field Communication Threats
- Advanced Persistent Threat Activity in Wireless Environments
- Applying Defensive Strategies Against Wireless Attacks
- Scenario-Based Quiz
Lesson 4.5 — Cloud and Virtualization Security
Section 1 — Foundations of Cloud and Virtualization Security
- Defining Cloud Computing and Virtualization Concepts
- Security Objectives in Cloud and Virtualized Environments
- Threats Against Cloud Infrastructure and Services
- Shared Responsibility Models and Governance Requirements
- Compliance and Regulatory Considerations in Cloud Security
- Risks Associated with Multi-Tenant Architectures
- Security Roles and Responsibilities in Cloud Operations
- Applying Cloud Security Principles Across Enterprise Environments
- Scenario-Based Quiz
Section 2 — Cloud Service and Deployment Models
- Foundations of Cloud Service Models
- Infrastructure as a Service (IaaS) Security Considerations
- Platform as a Service (PaaS) Security Responsibilities
- Software as a Service (SaaS) Security Risks and Controls
- Public, Private, Hybrid, and Multi-Cloud Deployments
- Governance Challenges Across Cloud Models
- Monitoring and Visibility in Cloud Environments
- Applying Secure Cloud Deployment Strategies Across Enterprise Operations
- Scenario-Based Quiz
Section 3 — Virtualization and Hypervisor Security
- Foundations of Virtualization Security
- Hypervisor Types and Security Architectures
- Virtual Machine Isolation and Segmentation Controls
- Secure Provisioning and Virtual Resource Management
- Risks of VM Escape and Hypervisor Exploitation
- Monitoring and Hardening Virtualized Infrastructure
- High Availability and Virtualization Resilience Strategies
- Applying Virtualization Security Practices Across Enterprise Environments
- Scenario-Based Quiz
Section 4 — Containerization and Cloud-Native Security
- Foundations of Container Security
- Container Runtime and Orchestration Security Concepts
- Kubernetes and Cluster Security Controls
- Image Integrity and Supply Chain Protection
- Secrets Management and Secure Configuration Practices
- Risks Associated with Misconfigured Containers
- Monitoring and Logging in Cloud-Native Environments
- Applying Container Security Across Enterprise Operations
- Scenario-Based Quiz
Lesson 4.6 — Secure Network Communications and Protocols
Section 1 — Foundations of Secure Communications
- Defining Secure Communications and Network Trust
- Security Objectives in Communication Protocols
- Threats Against Data in Transit
- Governance and Compliance Requirements for Secure Communications
- Authentication and Integrity in Network Communications
- Challenges in Securing Distributed Networks
- Roles and Responsibilities in Communication Security
- Applying Secure Communication Principles Across Enterprise Environments
- Scenario-Based Quiz
Section 2 — Transport and Session Security Protocols
- Foundations of Transport Layer Security
- SSL and TLS Protocol Evolution
- Secure Session Establishment and Handshakes
- Certificate Validation and Trust Relationships
- Risks Associated with Weak Cipher Suites and Protocols
- Perfect Forward Secrecy and Modern Cryptographic Standards
- Monitoring and Validation of Secure Sessions
- Applying Transport Security Controls Across Enterprise Networks
- Scenario-Based Quiz
Section 3 — Network and Tunneling Protocol Security
- Foundations of Secure Tunneling Protocols
- IPSec and Network Layer Encryption
- GRE and Encapsulation Techniques
- VPN Technologies and Secure Remote Connectivity
- Routing Security and Protected Network Paths
- Risks of Misconfigured Tunnels and VPNs
- Monitoring Tunnel Activity and Connection Integrity
- Applying Secure Tunneling Strategies Across Enterprise Operations
- Scenario-Based Quiz
Section 4 — Secure Application and Communication Protocols
- Foundations of Secure Application Protocols
- HTTPS and Secure Web Communications
- SSH and Secure Administrative Access
- Secure File Transfer and Data Exchange Protocols
- Secure Email and Messaging Protocols
- DNS Security and Encrypted Name Resolution
- Risks Associated with Legacy and Insecure Protocols
- Applying Secure Communication Protocols Across Enterprise Systems
- Scenario-Based Quiz
Lesson 4.7 — Remote Access and Endpoint Security
Section 1 — Foundations of Remote Access and Endpoint Security
- Defining Remote Access and Endpoint Security Objectives
- Threats Against Remote Users and Endpoint Devices
- Governance and Compliance Requirements for Endpoint Protection
- Security Responsibilities in Distributed Work Environments
- Defense-in-Depth for Remote Connectivity and Devices
- Risks Associated with Unmanaged Endpoints
- Monitoring and Visibility Across Endpoint Environments
- Applying Remote Access Security Principles Across Enterprise Operations
- Scenario-Based Quiz
Section 2 — Remote Access Technologies and Secure Connectivity
- Foundations of Remote Access Technologies
- VPN Solutions and Secure Tunneling Methods
- Zero Trust Network Access Principles
- Secure Remote Administration and Management Access
- Authentication and Access Validation Mechanisms
- Risks Associated with Weak Remote Connectivity Controls
- Monitoring and Logging Remote Access Activities
- Applying Secure Connectivity Controls Across Enterprise Environments
- Scenario-Based Quiz
Section 3 — Endpoint Hardening and Baseline Security
- Foundations of Endpoint Hardening
- Secure Configuration Baselines and Standards
- Operating System Hardening and Patch Management
- Application Control and Attack Surface Reduction
- Device Encryption and Data Protection Mechanisms
- Risks Associated with Misconfigured Endpoints
- Monitoring and Validation of Endpoint Configurations
- Applying Endpoint Hardening Practices Across Enterprise Operations
- Scenario-Based Quiz
Section 4 — Endpoint Detection and Response Technologies
- Foundations of Endpoint Detection and Response
- Endpoint Protection Platforms and Anti-Malware Controls
- Behavioral Analytics and Threat Detection Mechanisms
- Incident Containment and Automated Response Actions
- Threat Hunting Across Endpoint Environments
- Risks Associated with Advanced Malware and Fileless Attacks
- Monitoring, Logging, and SIEM Integration
- Applying EDR Strategies Across Enterprise Security Programs
- Scenario-Based Quiz
Lesson 4.8 — Network Defense and Monitoring Strategies
Section 1 — Foundations of Network Defense
- Defining Network Defense and Security Objectives
- Threats Against Enterprise Network Infrastructure
- Defense-in-Depth and Layered Security Principles
- Governance and Compliance Drivers for Network Defense
- Roles and Responsibilities in Security Operations
- Challenges in Defending Modern Distributed Networks
- Monitoring and Visibility Requirements
- Applying Network Defense Principles Across Enterprise Environments
- Scenario-Based Quiz
Section 2 — Intrusion Detection and Prevention Strategies
- Foundations of IDS and IPS Technologies
- Signature-Based and Behavioral Detection Methods
- Network-Based and Host-Based Detection Systems
- Intrusion Prevention and Automated Response Mechanisms
- Threat Intelligence Integration and Detection Tuning
- Risks of False Positives and Alert Fatigue
- Monitoring and Validation of Detection Systems
- Applying IDS and IPS Strategies Across Enterprise Networks
- Scenario-Based Quiz
Section 3 — SIEM and Centralized Monitoring Operations
- Foundations of Security Information and Event Management
- Centralized Logging and Event Aggregation
- Correlation Rules and Threat Detection Logic
- Dashboards, Metrics, and Operational Visibility
- Threat Hunting and Behavioral Analysis Activities
- Risks Associated with Incomplete Visibility and Logging Gaps
- Incident Escalation and Response Coordination
- Applying SIEM Operations Across Enterprise Security Programs
- Scenario-Based Quiz
Section 4 — Traffic Analysis and Network Visibility
- Foundations of Network Traffic Analysis
- Packet Capture and Deep Packet Inspection Techniques
- NetFlow, Telemetry, and Network Metadata Analysis
- Encryption Visibility and Secure Traffic Challenges
- Anomaly Detection and Behavioral Monitoring
- Risks Associated with Blind Spots and Shadow Traffic
- Monitoring High-Volume and Distributed Environments
- Applying Traffic Analysis Strategies Across Enterprise Networks
- Scenario-Based Quiz
Domain 5 — Identity and Access Management
Lesson 5.1 — Identity and Access Management (IAM) Concepts
Section 1 — Foundations of Identity and Access Management
- Defining Identity and Access Management Objectives
- Authentication, Authorization, and Accountability Principles
- Digital Identity and Trust Relationships
- Threats Against Identity and Access Systems
- Governance and Compliance Drivers for IAM
- Roles and Responsibilities in IAM Operations
- Challenges in Managing Enterprise Identities
- Applying IAM Principles Across Enterprise Environments
- Scenario-Based Quiz
Section 2 — Identity Lifecycle Management
- Foundations of Identity Lifecycle Processes
- Provisioning and Onboarding Workflows
- Access Modification and Role Transitions
- Deprovisioning and Identity Revocation Procedures
- Identity Synchronization Across Enterprise Systems
- Risks Associated with Orphaned and Excessive Accounts
- Monitoring Identity Lifecycle Events and Activities
- Applying Identity Lifecycle Management Across Enterprise Operations
- Scenario-Based Quiz
Section 3 — Authentication and Identity Verification
- Foundations of Authentication Mechanisms
- Password-Based Authentication Systems
- Multi-Factor Authentication and Identity Assurance
- Biometric and Hardware-Based Authentication Methods
- Adaptive and Risk-Based Authentication Strategies
- Risks Associated with Weak Authentication Controls
- Monitoring Authentication Events and Anomalies
- Applying Authentication Controls Across Enterprise Environments
- Scenario-Based Quiz
Section 4 — Authorization and Access Enforcement
- Foundations of Authorization Concepts
- Least Privilege and Need-to-Know Principles
- Role-Based and Attribute-Based Access Control
- Policy Enforcement and Access Decision Mechanisms
- Segregation of Duties and Privilege Restrictions
- Risks Associated with Excessive Access Rights
- Monitoring Authorization Activities and Violations
- Applying Access Enforcement Controls Across Enterprise Systems
- Scenario-Based Quiz
Lesson 5.2 — Access Control Models and Methods
Section 1 — Foundations of Access Control
- Defining Access Control Objectives and Principles
- Authentication, Authorization, and Accountability Relationships
- Threats Against Access Control Systems
- Governance and Compliance Requirements for Access Controls
- Security Roles and Responsibilities in Access Management
- Risks Associated with Weak Access Enforcement
- Monitoring and Visibility in Access Control Environments
- Applying Access Control Principles Across Enterprise Systems
- Scenario-Based Quiz
Section 2 — Discretionary Access Control (DAC)
- Foundations of Discretionary Access Control
- Ownership-Based Access Decisions and Permissions
- File System and Object-Level Access Mechanisms
- Delegation and Permission Inheritance Concepts
- Risks Associated with DAC Flexibility
- Monitoring and Auditing DAC Activities
- Governance Considerations for DAC Environments
- Applying DAC Models Across Enterprise Operations
- Scenario-Based Quiz
Section 3 — Mandatory Access Control (MAC)
- Foundations of Mandatory Access Control
- Classification Labels and Security Clearance Concepts
- Multi-Level Security and Information Flow Restrictions
- Bell-LaPadula and Confidentiality Enforcement Models
- Biba and Integrity Protection Models
- Risks Associated with Rigid Access Structures
- Monitoring and Managing MAC Environments
- Applying MAC Principles Across Enterprise Systems
- Scenario-Based Quiz
Section 4 — Role-Based and Attribute-Based Access Control
- Foundations of Role-Based Access Control
- Role Engineering and Permission Mapping
- Attribute-Based Access Control and Dynamic Decisions
- Policy-Driven Access Enforcement Mechanisms
- Context-Aware and Adaptive Access Controls
- Risks Associated with Complex Authorization Policies
- Monitoring and Managing RBAC and ABAC Systems
- Applying RBAC and ABAC Across Enterprise Operations
- Scenario-Based Quiz
Lesson 5.3 — Controlling Physical and Logical Access to Assets
Section 1 — Foundations of Physical and Logical Access Control
- Defining Physical and Logical Access Control Objectives
- Threats Against Organizational Assets and Access Systems
- Governance and Compliance Requirements for Access Controls
- Defense-in-Depth and Layered Access Protection
- Security Roles and Responsibilities in Access Management
- Risks Associated with Weak Access Restrictions
- Monitoring and Visibility Across Access Environments
- Applying Access Control Principles Across Enterprise Operations
- Scenario-Based Quiz
Section 2 — Physical Access Control Systems and Mechanisms
- Foundations of Physical Access Control
- Locks, Keys, and Mechanical Entry Systems
- Electronic Badge and Smart Card Access Mechanisms
- Biometric Authentication for Physical Security
- Visitor Management and Escort Procedures
- Tailgating, Piggybacking, and Unauthorized Entry Risks
- Monitoring, Logging, and Audit Trails for Physical Access
- Applying Physical Access Controls Across Enterprise Facilities
- Scenario-Based Quiz
Section 3 — Logical Access Control Mechanisms
- Foundations of Logical Access Controls
- User Authentication and Identity Verification
- Role-Based and Attribute-Based Authorization Models
- Session Management and Access Enforcement Techniques
- Privileged Access Restrictions and Least Privilege Principles
- Risks Associated with Excessive or Shared Accounts
- Monitoring and Auditing Logical Access Activities
- Applying Logical Access Controls Across Enterprise Systems
- Scenario-Based Quiz
Section 4 — Identity Verification and Authentication Methods
- Foundations of Identity Verification
- Password-Based Authentication Systems
- Multi-Factor Authentication and Identity Assurance
- Biometric and Hardware Token Authentication
- Adaptive and Risk-Based Authentication Strategies
- Risks Associated with Weak Authentication Mechanisms
- Monitoring Authentication Events and Anomalies
- Applying Authentication Controls Across Enterprise Operations
- Scenario-Based Quiz
Lesson 5.4 — Authentication, Authorization, and Accountability (AAA)
Section 1 — Foundations of AAA Frameworks
- Defining Authentication, Authorization, and Accountability
- Identity and Trust Relationships in AAA Systems
- Threats Against AAA Architectures and Services
- Governance and Compliance Drivers for AAA
- Security Roles and Responsibilities in AAA Operations
- Risks Associated with Weak Identity and Access Controls
- Monitoring and Visibility Across AAA Environments
- Applying AAA Principles Across Enterprise Systems
- Scenario-Based Quiz
Section 2 — Authentication Mechanisms and Identity Verification
- Foundations of Authentication Systems
- Password-Based Authentication Mechanisms
- Multi-Factor Authentication and Identity Assurance
- Biometric and Hardware Token Authentication
- Adaptive and Risk-Based Authentication Methods
- Risks Associated with Weak Authentication Practices
- Monitoring Authentication Events and Threat Indicators
- Applying Authentication Controls Across Enterprise Operations
- Scenario-Based Quiz
Section 3 — Authorization Models and Access Decisions
- Foundations of Authorization Principles
- Least Privilege and Need-to-Know Enforcement
- Role-Based and Attribute-Based Authorization Models
- Policy Enforcement and Access Decision Engines
- Segregation of Duties and Privilege Restrictions
- Risks Associated with Excessive Permissions
- Monitoring and Auditing Authorization Activities
- Applying Authorization Controls Across Enterprise Systems
- Scenario-Based Quiz
Section 4 — Accountability, Logging, and Auditing Mechanisms
- Foundations of Accountability in Security Operations
- Logging User Actions and Security Events
- Audit Trails and Evidence Preservation
- SIEM Integration and Event Correlation
- Metrics, Reporting, and Operational Visibility
- Threat Detection and Insider Activity Monitoring
- Compliance Auditing and Governance Reporting
- Applying Accountability Controls Across Enterprise Environments
- Scenario-Based Quiz
Lesson 5.5 — Federated Identity and Single Sign-On (SSO)
Section 1 — Foundations of Federated Identity and SSO
- Defining Federated Identity and Single Sign-On Concepts
- Trust Relationships and Identity Federation Objectives
- Threats Against Federated Identity Systems
- Governance and Compliance Requirements for Federation
- Identity Providers and Service Provider Relationships
- Risks Associated with Centralized Authentication Systems
- Monitoring and Visibility Across Federated Environments
- Applying Federated Identity Principles Across Enterprise Operations
- Scenario-Based Quiz
Section 2 — Federation Architectures and Trust Models
- Foundations of Federation Architectures
- Identity Providers and Service Providers
- Trust Establishment and Identity Assertion Mechanisms
- Cross-Domain Authentication and Interoperability
- Federated Trust Relationships and Certificate Management
- Risks Associated with Weak Trust Configurations
- Monitoring Federated Authentication Activities
- Applying Federation Architectures Across Enterprise Systems
- Scenario-Based Quiz
Section 3 — Single Sign-On Technologies and Implementations
- Foundations of Single Sign-On Concepts
- Centralized Authentication and Session Reuse
- Web-Based SSO and Enterprise Integration
- Desktop and Application SSO Mechanisms
- User Experience and Security Balance Considerations
- Risks Associated with SSO Misconfigurations
- Monitoring SSO Sessions and Authentication Events
- Applying SSO Technologies Across Enterprise Operations
- Scenario-Based Quiz
Section 4 — Federation Protocols and Standards
- Foundations of Federation Protocols
- Security Assertion Markup Language (SAML)
- OAuth and Delegated Authorization Concepts
- OpenID Connect and Modern Identity Integration
- WS-Federation and Legacy Federation Standards
- Risks Associated with Protocol Weaknesses and Misuse
- Monitoring and Validating Federation Transactions
- Applying Federation Standards Across Enterprise Environments
- Scenario-Based Quiz
Lesson 5.6 — Privileged Access Management (PAM) and Zero Trust Security
Section 1 — Foundations of Privileged Access and Zero Trust
- Defining Privileged Access and Zero Trust Principles
- Threats Against Privileged Accounts and Critical Systems
- Governance and Compliance Drivers for PAM and Zero Trust
- Least Privilege and Continuous Verification Concepts
- Trust Boundaries and Identity-Centric Security Models
- Risks Associated with Excessive Privileges and Implicit Trust
- Monitoring and Visibility Across Privileged Environments
- Applying PAM and Zero Trust Principles Across Enterprise Operations
- Scenario-Based Quiz
Section 2 — Privileged Access Management Architectures and Controls
- Foundations of Privileged Access Management
- Vaulting and Secure Credential Storage Mechanisms
- Privileged Session Management and Monitoring
- Just-In-Time and Just-Enough Access Strategies
- Administrative Account Segmentation and Isolation
- Risks Associated with Shared and Persistent Privileges
- Monitoring Privileged Activities and Access Violations
- Applying PAM Controls Across Enterprise Systems
- Scenario-Based Quiz
Section 3 — Zero Trust Architecture and Continuous Verification
- Foundations of Zero Trust Architecture
- Verify Explicitly and Continuous Authentication Principles
- Identity-Centric Access Decision Models
- Micro-Segmentation and Resource Isolation
- Device Trust and Endpoint Validation Mechanisms
- Risks Associated with Weak Trust Verification Processes
- Monitoring Access Decisions and Trust Evaluations
- Applying Zero Trust Strategies Across Enterprise Environments
- Scenario-Based Quiz
Section 4 — Privileged Identity and Administrative Security
- Foundations of Privileged Identity Security
- Administrative Account Management and Restrictions
- Multi-Factor Authentication for Privileged Users
- Secure Remote Administration and Jump Server Controls
- Separation of Duties and Administrative Accountability
- Risks Associated with Insider Threats and Privilege Abuse
- Monitoring Administrative Sessions and Audit Trails
- Applying Administrative Security Controls Across Enterprise Operations
- Scenario-Based Quiz
Domain 6 — Security Assessment and Testing
Lesson 6.1 — Security Assessment and Testing Methodologies
Section 1 — Foundations of Security Assessment and Testing
- Defining Security Assessment and Testing Objectives
- Threats and Risks Driving Security Validation Activities
- Governance and Compliance Requirements for Assessments
- Roles and Responsibilities in Security Testing Operations
- Security Assurance and Verification Principles
- Risks Associated with Inadequate Security Testing
- Monitoring and Visibility Across Assessment Programs
- Applying Security Assessment Principles Across Enterprise Environments
- Scenario-Based Quiz
Section 2 — Vulnerability Assessment Methodologies
- Foundations of Vulnerability Assessments
- Automated Scanning and Enumeration Techniques
- Authenticated and Unauthenticated Scanning Approaches
- Configuration Reviews and Baseline Validation
- Prioritization of Vulnerability Findings
- Risks Associated with False Positives and False Negatives
- Monitoring and Reporting Vulnerability Trends
- Applying Vulnerability Assessment Practices Across Enterprise Systems
- Scenario-Based Quiz
Section 3 — Penetration Testing and Adversarial Simulations
- Foundations of Penetration Testing
- Rules of Engagement and Testing Scope Definition
- Reconnaissance and Enumeration Techniques
- Exploitation and Post-Exploitation Activities
- Red Team, Blue Team, and Purple Team Exercises
- Risks Associated with Aggressive Testing Activities
- Reporting Findings and Executive Communication
- Applying Penetration Testing Strategies Across Enterprise Operations
- Scenario-Based Quiz
Section 4 — Security Control Validation and Verification
- Foundations of Security Control Validation
- Testing Preventive, Detective, and Corrective Controls
- Access Control Validation and Identity Security Testing
- Network Security Control Assessment Techniques
- Application and Endpoint Security Validation
- Risks Associated with Weak or Misconfigured Controls
- Monitoring and Tracking Control Effectiveness
- Applying Security Validation Practices Across Enterprise Programs
- Scenario-Based Quiz
Lesson 6.2 — Conducting Security Audits and Evaluations
Section 1 — Foundations of Security Auditing and Evaluations
- Defining Security Audits and Evaluation Objectives
- Governance and Compliance Drivers for Auditing
- Roles and Responsibilities in Audit Activities
- Risk Assessments and Audit Planning Principles
- Internal and External Audit Processes
- Risks Associated with Weak Audit Practices
- Monitoring and Visibility Across Audit Programs
- Applying Security Audit Principles Across Enterprise Environments
- Scenario-Based Quiz
Section 2 — Audit Planning and Scope Definition
- Foundations of Audit Planning
- Defining Audit Objectives and Scope Boundaries
- Regulatory and Compliance Audit Requirements
- Identifying Critical Systems and High-Risk Areas
- Resource Allocation and Scheduling Considerations
- Risks Associated with Poorly Defined Audit Scopes
- Monitoring Audit Progress and Readiness Activities
- Applying Audit Planning Practices Across Enterprise Operations
- Scenario-Based Quiz
Section 3 — Evidence Collection and Validation
- Foundations of Audit Evidence Collection
- Documentation Reviews and Policy Validation
- Configuration Reviews and Technical Verification
- Log Analysis and Security Event Examination
- Interviews and Observation-Based Assessments
- Risks Associated with Incomplete or Inaccurate Evidence
- Monitoring Evidence Integrity and Chain of Custody
- Applying Evidence Validation Practices Across Enterprise Programs
- Scenario-Based Quiz
Section 4 — Compliance Auditing and Regulatory Validation
- Foundations of Compliance Auditing
- Regulatory Requirements and Industry Standards
- Security Control Mapping and Validation
- Gap Analysis and Deficiency Identification
- Third-Party Compliance and Vendor Assessments
- Risks Associated with Non-Compliance Findings
- Monitoring Compliance Trends and Audit Metrics
- Applying Compliance Auditing Across Enterprise Environments
- Scenario-Based Quiz
Lesson 6.3 — Designing and Validating Assessment, Test, and Audit Strategies
Section 1 — Foundations of Assessment and Audit Strategy Design
- Defining Assessment and Audit Strategy Objectives
- Governance and Compliance Drivers for Validation Programs
- Risk-Based Security Testing and Assessment Planning
- Roles and Responsibilities in Strategy Development
- Aligning Testing Activities with Business Objectives
- Risks Associated with Weak Assessment Strategies
- Monitoring and Visibility Across Validation Programs
- Applying Assessment Strategy Principles Across Enterprise Environments
- Scenario-Based Quiz
Section 2 — Scope Definition and Risk Prioritization
- Foundations of Scope Definition
- Identifying Critical Assets and High-Risk Systems
- Threat Modeling and Risk-Informed Prioritization
- Regulatory and Compliance Scope Considerations
- Resource Allocation and Testing Constraints
- Risks Associated with Incomplete Assessment Coverage
- Monitoring Scope Changes and Operational Impact
- Applying Risk Prioritization Strategies Across Enterprise Operations
- Scenario-Based Quiz
Section 3 — Assessment Methodologies and Validation Techniques
- Foundations of Security Validation Methodologies
- Vulnerability Assessments and Technical Reviews
- Penetration Testing and Adversarial Simulations
- Configuration Validation and Baseline Assessments
- Application and Infrastructure Security Testing
- Risks Associated with Inconsistent Validation Processes
- Monitoring Testing Accuracy and Effectiveness
- Applying Validation Techniques Across Enterprise Systems
- Scenario-Based Quiz
Section 4 — Security Metrics and Performance Measurement
- Foundations of Security Metrics and KPIs
- Measuring Security Control Effectiveness
- Risk Scoring and Trend Analysis
- Operational Dashboards and Reporting Visibility
- Metrics for Compliance and Governance Oversight
- Risks Associated with Poorly Defined Measurements
- Monitoring Program Performance and Maturity
- Applying Security Metrics Across Enterprise Validation Programs
- Scenario-Based Quiz
Lesson 6.4 — Vulnerability Management and Penetration Testing
Section 1 — Foundations of Vulnerability Management
- Defining Vulnerability Management Objectives
- Threats, Vulnerabilities, and Risk Relationships
- Governance and Compliance Drivers for Vulnerability Programs
- Roles and Responsibilities in Vulnerability Operations
- Asset Visibility and Exposure Identification
- Risks Associated with Unmanaged Vulnerabilities
- Monitoring and Visibility Across Vulnerability Programs
- Applying Vulnerability Management Principles Across Enterprise Environments
- Scenario-Based Quiz
Section 2 — Vulnerability Identification and Scanning Techniques
- Foundations of Vulnerability Scanning
- Authenticated and Unauthenticated Scanning Methods
- Network, Application, and Cloud Vulnerability Assessments
- Enumeration Techniques and Exposure Discovery
- Configuration Reviews and Baseline Validation
- Risks Associated with False Positives and False Negatives
- Monitoring Vulnerability Trends and Security Gaps
- Applying Scanning Techniques Across Enterprise Systems
- Scenario-Based Quiz
Section 3 — Vulnerability Analysis and Risk Prioritization
- Foundations of Vulnerability Analysis
- CVSS and Risk Scoring Methodologies
- Threat Intelligence Integration and Contextual Risk Analysis
- Asset Criticality and Business Impact Assessments
- Exploitability and Adversarial Risk Evaluation
- Risks Associated with Poor Prioritization Decisions
- Monitoring Remediation Timelines and Exposure Windows
- Applying Risk Prioritization Across Enterprise Operations
- Scenario-Based Quiz
Section 4 — Remediation and Mitigation Strategies
- Foundations of Vulnerability Remediation
- Patch Management and Update Deployment Processes
- Compensating Controls and Temporary Mitigation Measures
- Configuration Hardening and Security Baseline Enforcement
- Change Management and Operational Coordination
- Risks Associated with Delayed Remediation Activities
- Monitoring Remediation Effectiveness and Validation
- Applying Mitigation Strategies Across Enterprise Security Programs
- Scenario-Based Quiz
Lesson 6.5 — Incident Response Planning and Execution
Section 1 — Foundations of Incident Response
- Defining Incident Response Objectives and Scope
- Threats and Risks Driving Incident Response Readiness
- Governance and Compliance Requirements for Incident Handling
- Roles and Responsibilities in Incident Response Teams
- Incident Classification and Prioritization Principles
- Risks Associated with Weak Response Capabilities
- Monitoring and Visibility Across Security Operations
- Applying Incident Response Principles Across Enterprise Environments
- Scenario-Based Quiz
Section 2 — Incident Preparation and Readiness
- Foundations of Incident Response Preparation
- Developing Response Plans and Playbooks
- Communication Channels and Escalation Procedures
- Security Tooling and Operational Readiness
- Training, Simulations, and Tabletop Exercises
- Risks Associated with Poor Preparation Activities
- Monitoring Readiness and Operational Effectiveness
- Applying Preparation Strategies Across Enterprise Security Programs
- Scenario-Based Quiz
Section 3 — Detection, Analysis, and Triage
- Foundations of Incident Detection and Analysis
- SIEM Integration and Alert Correlation
- Threat Intelligence and Indicator Analysis
- Incident Triage and Prioritization Processes
- Evidence Collection and Initial Investigation Activities
- Risks Associated with Delayed Detection and Misclassification
- Monitoring Security Events and Threat Indicators
- Applying Detection and Analysis Practices Across Enterprise Operations
- Scenario-Based Quiz
Section 4 — Containment, Eradication, and Recovery
- Foundations of Incident Containment Strategies
- Short-Term and Long-Term Containment Methods
- Malware Removal and Threat Eradication Processes
- System Recovery and Service Restoration Activities
- Validation of Recovery and Operational Readiness
- Risks Associated with Incomplete Eradication Efforts
- Monitoring Recovery Activities and System Stability
- Applying Recovery Strategies Across Enterprise Environments
- Scenario-Based Quiz
Domain 7 — Security Operations
Lesson 7.1 — Security Operations and Incident Management
Section 1 — Foundations of Security Operations
- Defining Security Operations Objectives and Responsibilities
- Threats Driving Modern Security Operations Activities
- Governance and Compliance Requirements for Security Operations
- Roles and Responsibilities in Security Operations Centers
- Defense-in-Depth and Operational Security Principles
- Risks Associated with Weak Operational Visibility
- Monitoring and Visibility Across Enterprise Environments
- Applying Security Operations Principles Across Enterprise Programs
- Scenario-Based Quiz
Section 2 — Security Operations Center (SOC) Functions and Structure
- Foundations of Security Operations Centers
- Tiered Analyst Roles and Responsibilities
- Event Monitoring and Alert Triage Processes
- SIEM Platforms and Security Visibility Mechanisms
- Threat Intelligence Integration and Correlation Activities
- Risks Associated with Alert Fatigue and Operational Overload
- Monitoring Operational Performance and Team Effectiveness
- Applying SOC Best Practices Across Enterprise Operations
- Scenario-Based Quiz
Section 3 — Incident Detection and Operational Triage
- Foundations of Incident Detection Processes
- Security Event Collection and Correlation Activities
- Threat Intelligence and Indicator Analysis
- Alert Prioritization and Escalation Procedures
- Incident Classification and Severity Determination
- Risks Associated with Delayed Detection and Misclassification
- Monitoring Detection Accuracy and Operational Efficiency
- Applying Triage Practices Across Enterprise Security Operations
- Scenario-Based Quiz
Section 4 — Operational Response and Incident Coordination
- Foundations of Operational Incident Response
- Containment and Defensive Mitigation Actions
- Communication and Escalation Coordination
- Evidence Collection and Investigation Support
- Recovery and Service Restoration Activities
- Risks Associated with Incomplete Response Actions
- Monitoring Recovery Activities and Operational Stability
- Applying Response Coordination Across Enterprise Environments
- Scenario-Based Quiz
Lesson 7.2 — Business Continuity and Disaster Recovery (BC/DR) Planning
Section 1 — Foundations of Business Continuity and Disaster Recovery
- Defining Business Continuity and Disaster Recovery Objectives
- Threats and Risks Driving Continuity Planning
- Governance and Compliance Requirements for BC/DR
- Roles and Responsibilities in Continuity Programs
- Operational Resilience and Recovery Principles
- Risks Associated with Weak Continuity Planning
- Monitoring and Visibility Across Recovery Programs
- Applying BC/DR Principles Across Enterprise Environments
- Scenario-Based Quiz
Section 2 — Business Impact Analysis and Risk Assessment
- Foundations of Business Impact Analysis
- Identifying Critical Business Functions and Dependencies
- Recovery Time and Recovery Point Objectives
- Operational, Financial, and Reputational Impact Assessments
- Threat Modeling and Risk Identification Activities
- Risks Associated with Incomplete Impact Analysis
- Monitoring Business Dependencies and Operational Priorities
- Applying Risk Assessment Strategies Across Enterprise Programs
- Scenario-Based Quiz
Section 3 — Continuity Planning and Recovery Strategy Development
- Foundations of Continuity Planning
- Developing Recovery Strategies and Playbooks
- Redundancy and High Availability Design Principles
- Alternate Sites and Disaster Recovery Facilities
- Backup Strategies and Data Recovery Processes
- Risks Associated with Weak Recovery Architectures
- Monitoring Recovery Preparedness and Readiness Activities
- Applying Continuity Strategies Across Enterprise Operations
- Scenario-Based Quiz
Section 4 — Disaster Recovery Operations and Service Restoration
- Foundations of Disaster Recovery Operations
- Incident Escalation and Recovery Activation Procedures
- System Restoration and Data Recovery Activities
- Coordination Between Technical and Business Teams
- Validation of Recovery and Operational Readiness
- Risks Associated with Incomplete Recovery Efforts
- Monitoring Recovery Timelines and Operational Stability
- Applying Recovery Operations Across Enterprise Environments
- Scenario-Based Quiz
Lesson 7.3 — Understanding and Complying with Investigations
Section 1 — Foundations of Security Investigations
- Defining Security Investigation Objectives and Scope
- Threats, Incidents, and Events Requiring Investigation
- Governance and Compliance Requirements for Investigations
- Roles and Responsibilities in Investigative Processes
- Legal Authority and Jurisdiction Considerations
- Risks Associated with Improper Investigative Procedures
- Monitoring and Visibility Across Investigative Activities
- Applying Investigation Principles Across Enterprise Environments
- Scenario-Based Quiz
Section 2 — Evidence Collection and Preservation
- Foundations of Digital Evidence Handling
- Chain of Custody and Evidence Integrity Requirements
- Evidence Acquisition and Preservation Techniques
- Volatile and Non-Volatile Data Collection Methods
- Documentation and Evidence Tracking Procedures
- Risks Associated with Mishandled or Altered Evidence
- Monitoring Evidence Storage and Access Activities
- Applying Evidence Preservation Practices Across Enterprise Investigations
- Scenario-Based Quiz
Section 3 — Investigative Procedures and Analysis Techniques
- Foundations of Investigative Methodologies
- Log Analysis and Timeline Reconstruction Techniques
- Malware Analysis and Threat Attribution Activities
- Interviewing and Fact-Finding Procedures
- Correlation of Security Events and Indicators
- Risks Associated with Incomplete Investigative Analysis
- Monitoring Investigative Progress and Findings
- Applying Investigative Analysis Practices Across Enterprise Operations
- Scenario-Based Quiz
Section 4 — Legal, Regulatory, and Compliance Considerations
- Foundations of Legal and Regulatory Investigation Requirements
- Privacy Laws and Employee Rights Considerations
- Regulatory Reporting and Notification Obligations
- Coordination with Legal Counsel and Compliance Teams
- Law Enforcement Engagement and External Coordination
- Risks Associated with Non-Compliance During Investigations
- Monitoring Legal and Compliance Requirements During Investigations
- Applying Legal and Regulatory Practices Across Enterprise Investigations
- Scenario-Based Quiz
Lesson 7.4 — Logging, Monitoring, and Security Operations Center (SOC) Management
Section 1 — Foundations of Logging and Monitoring
- Defining Logging and Monitoring Objectives
- Threats and Risks Driving Monitoring Requirements
- Governance and Compliance Requirements for Logging
- Roles and Responsibilities in Monitoring Operations
- Visibility, Telemetry, and Event Collection Principles
- Risks Associated with Inadequate Logging and Monitoring
- Monitoring and Visibility Across Enterprise Environments
- Applying Logging and Monitoring Principles Across Enterprise Programs
- Scenario-Based Quiz
Section 2 — Log Collection and Event Management
- Foundations of Log Collection and Aggregation
- Endpoint, Application, and Network Log Sources
- Centralized Logging and SIEM Integration
- Normalization and Event Correlation Techniques
- Log Retention and Evidence Preservation Requirements
- Risks Associated with Incomplete or Inaccurate Logging
- Monitoring Log Integrity and Collection Effectiveness
- Applying Event Management Practices Across Enterprise Operations
- Scenario-Based Quiz
Section 3 — SIEM Operations and Threat Detection
- Foundations of SIEM Platforms and Capabilities
- Correlation Rules and Detection Engineering
- Threat Intelligence Integration and Enrichment
- Behavioral Analytics and Anomaly Detection
- Alert Triage and Escalation Procedures
- Risks Associated with Alert Fatigue and False Positives
- Monitoring Detection Accuracy and Operational Efficiency
- Applying SIEM Operations Across Enterprise Security Programs
- Scenario-Based Quiz
Section 4 — Security Operations Center Structure and Management
- Foundations of SOC Management and Operations
- Tiered Analyst Roles and Operational Responsibilities
- Workflow Coordination and Escalation Management
- Metrics, Dashboards, and Operational Visibility
- Staffing, Training, and Workforce Development
- Risks Associated with Resource Constraints and Burnout
- Monitoring Team Performance and Operational Readiness
- Applying SOC Management Practices Across Enterprise Environments
- Scenario-Based Quiz
Lesson 7.5 — Malware, Ransomware, and Advanced Persistent Threats (APT) Defense
Section 1 — Foundations of Malware and Advanced Threat Defense
- Defining Malware, Ransomware, and Advanced Persistent Threats
- Threat Actors and Motivations Behind Malware Campaigns
- Governance and Compliance Requirements for Malware Defense
- Security Roles and Responsibilities in Threat Defense Operations
- Defense-in-Depth and Threat Mitigation Principles
- Risks Associated with Weak Malware Defense Strategies
- Monitoring and Visibility Across Enterprise Threat Environments
- Applying Malware Defense Principles Across Enterprise Operations
- Scenario-Based Quiz
Section 2 — Malware Types and Attack Techniques
- Foundations of Malware Categories and Behaviors
- Viruses, Worms, and Trojan Horse Attacks
- Fileless Malware and Living-Off-the-Land Techniques
- Spyware, Rootkits, and Keylogging Threats
- Botnets and Distributed Malware Infrastructure
- Risks Associated with Evasive Malware Techniques
- Monitoring Malware Activity and Indicators of Compromise
- Applying Defensive Strategies Against Malware Threats
- Scenario-Based Quiz
Section 3 — Ransomware Operations and Defensive Strategies
- Foundations of Ransomware Threats
- Initial Access Techniques and Delivery Mechanisms
- Encryption, Extortion, and Double-Extortion Tactics
- Backup Strategies and Recovery Preparedness
- Containment and Incident Response Coordination
- Risks Associated with Inadequate Recovery Capabilities
- Monitoring Ransomware Indicators and Lateral Movement
- Applying Ransomware Defense Strategies Across Enterprise Environments
- Scenario-Based Quiz
Section 4 — Advanced Persistent Threats and Nation-State Activity
- Foundations of Advanced Persistent Threat Operations
- Long-Term Persistence and Adversarial Objectives
- Reconnaissance and Intelligence Gathering Activities
- Privilege Escalation and Lateral Movement Techniques
- Data Exfiltration and Operational Disruption Strategies
- Risks Associated with Sophisticated Adversarial Campaigns
- Monitoring APT Indicators and Behavioral Patterns
- Applying APT Defense Strategies Across Enterprise Security Programs
- Scenario-Based Quiz
Lesson 7.6 — Forensic Investigations and Digital Evidence Handling
Section 1 — Foundations of Digital Forensics and Evidence Handling
- Defining Digital Forensics and Investigative Objectives
- Threats, Incidents, and Events Requiring Forensic Analysis
- Governance and Compliance Requirements for Digital Forensics
- Roles and Responsibilities in Forensic Investigations
- Evidence Integrity and Chain of Custody Principles
- Risks Associated with Mishandled Digital Evidence
- Monitoring and Visibility Across Investigative Activities
- Applying Digital Forensics Principles Across Enterprise Operations
- Scenario-Based Quiz
Section 2 — Evidence Collection and Preservation Techniques
- Foundations of Digital Evidence Acquisition
- Volatile and Non-Volatile Data Collection Methods
- Disk Imaging and Memory Capture Procedures
- Log Collection and Security Event Preservation
- Documentation and Evidence Tracking Requirements
- Risks Associated with Altered or Corrupted Evidence
- Monitoring Evidence Integrity and Access Activities
- Applying Evidence Preservation Practices Across Enterprise Investigations
- Scenario-Based Quiz
Section 3 — Forensic Analysis and Investigative Methodologies
- Foundations of Forensic Analysis Techniques
- Timeline Reconstruction and Event Correlation
- Malware Analysis and Threat Attribution Activities
- Network Forensics and Traffic Examination
- Endpoint and Application Forensic Investigations
- Risks Associated with Incomplete Forensic Analysis
- Monitoring Investigative Progress and Findings
- Applying Forensic Methodologies Across Enterprise Security Programs
- Scenario-Based Quiz
Section 4 — Legal, Regulatory, and Compliance Considerations in Forensics
- Foundations of Legal Requirements for Digital Forensics
- Privacy Laws and Employee Rights Considerations
- Regulatory Reporting and Evidence Retention Obligations
- Coordination with Legal Counsel and Compliance Teams
- Law Enforcement Coordination and External Investigations
- Risks Associated with Non-Compliance in Forensic Activities
- Monitoring Legal and Regulatory Requirements During Investigations
- Applying Compliance Practices Across Enterprise Forensic Operations
- Scenario-Based Quiz
Domain 8 — Software Development Security
Lesson 8.1 — Secure Software Development Lifecycle (SDLC) and Coding Practices
Section 1 — Foundations of Secure Software Development
- Defining Secure Software Development Objectives
- Threats and Risks Driving Secure Development Practices
- Governance and Compliance Requirements for Secure Development
- Roles and Responsibilities in Secure Software Engineering
- Security by Design and Privacy by Design Principles
- Risks Associated with Insecure Development Practices
- Monitoring and Visibility Across Development Environments
- Applying Secure Development Principles Across Enterprise Operations
- Scenario-Based Quiz
Section 2 — Secure Software Development Lifecycle (SDLC) Models
- Foundations of Secure SDLC Methodologies
- Waterfall, Agile, and DevSecOps Development Approaches
- Security Integration Across Development Phases
- Requirements Gathering and Security Planning Activities
- Change Management and Secure Release Processes
- Risks Associated with Weak SDLC Governance
- Monitoring Development Activities and Security Controls
- Applying Secure SDLC Practices Across Enterprise Development Programs
- Scenario-Based Quiz
Section 3 — Secure Coding Practices and Developer Responsibilities
- Foundations of Secure Coding Principles
- Input Validation and Output Encoding Techniques
- Secure Authentication and Session Management Practices
- Error Handling and Secure Logging Mechanisms
- Dependency Management and Third-Party Library Risks
- Risks Associated with Insecure Coding Techniques
- Monitoring Code Quality and Security Compliance
- Applying Secure Coding Practices Across Enterprise Software Projects
- Scenario-Based Quiz
Section 4 — Application Security Testing and Validation
- Foundations of Application Security Testing
- Static Application Security Testing Techniques
- Dynamic Application Security Testing Approaches
- Interactive and Runtime Security Validation Methods
- Penetration Testing and Adversarial Simulations
- Risks Associated with Weak Validation Activities
- Monitoring Security Findings and Remediation Progress
- Applying Security Testing Practices Across Enterprise Development Environments
- Scenario-Based Quiz
Lesson 8.2 — Application Security Controls and Testing
Section 1 — Foundations of Application Security Controls
- Defining Application Security Objectives and Principles
- Threats and Risks Against Modern Applications
- Governance and Compliance Requirements for Application Security
- Roles and Responsibilities in Application Protection
- Defense-in-Depth and Layered Application Security
- Risks Associated with Weak Application Controls
- Monitoring and Visibility Across Application Environments
- Applying Application Security Principles Across Enterprise Operations
- Scenario-Based Quiz
Section 2 — Authentication, Authorization, and Session Security
- Foundations of Application Authentication Mechanisms
- Multi-Factor Authentication and Identity Validation
- Role-Based and Attribute-Based Authorization Models
- Session Management and Secure Token Handling
- Access Enforcement and Privilege Restriction Mechanisms
- Risks Associated with Weak Session Security
- Monitoring Authentication and Authorization Activities
- Applying Access Security Controls Across Enterprise Applications
- Scenario-Based Quiz
Section 3 — Input Validation, Output Encoding, and Data Protection
- Foundations of Input Validation and Data Protection
- Injection Prevention and Secure Data Handling
- Output Encoding and Cross-Site Scripting Mitigation
- Encryption and Tokenization for Sensitive Data
- Secure Error Handling and Logging Practices
- Risks Associated with Weak Data Protection Controls
- Monitoring Application Data Flows and Security Events
- Applying Data Protection Controls Across Enterprise Applications
- Scenario-Based Quiz
Section 4 — Secure APIs and Web Application Security
- Foundations of API and Web Application Security
- REST and GraphQL API Security Considerations
- Authentication and Authorization for APIs
- Rate Limiting and Abuse Prevention Mechanisms
- Cross-Origin Security and Browser-Based Protections
- Risks Associated with Insecure APIs and Web Applications
- Monitoring API Traffic and Application Activity
- Applying Web Security Controls Across Enterprise Environments
- Scenario-Based Quiz
Lesson 8.3 — Software Security Vulnerabilities and Countermeasures
Section 1 — Foundations of Software Vulnerabilities and Exploitability
- Defining Software Vulnerabilities and Exploitation Concepts
- Threat Actors and Motivations Behind Software Attacks
- Governance and Compliance Requirements for Software Security
- Roles and Responsibilities in Vulnerability Management
- Attack Surfaces and Exposure Identification Principles
- Risks Associated with Insecure Software Systems
- Monitoring and Visibility Across Software Environments
- Applying Software Security Principles Across Enterprise Operations
- Scenario-Based Quiz
Section 2 — Injection Attacks and Input Manipulation Vulnerabilities
- Foundations of Injection-Based Vulnerabilities
- SQL Injection and Database Exploitation Techniques
- Command Injection and Operating System Abuse
- Cross-Site Scripting and Browser-Based Attacks
- Server-Side Request Forgery and API Exploitation Risks
- Risks Associated with Weak Input Validation
- Monitoring Injection Attempts and Exploitation Indicators
- Applying Defensive Measures Against Injection Attacks
- Scenario-Based Quiz
Section 3 — Authentication, Session, and Access Control Vulnerabilities
- Foundations of Authentication and Session Vulnerabilities
- Weak Credential Management and Password Attacks
- Session Hijacking and Token Manipulation Risks
- Broken Access Control and Privilege Escalation Techniques
- Insecure Direct Object References and Authorization Failures
- Risks Associated with Weak Identity Enforcement Mechanisms
- Monitoring Authentication and Access Abuse Indicators
- Applying Defensive Controls Against Access Vulnerabilities
- Scenario-Based Quiz
Section 4 — Memory Corruption and Low-Level Software Exploitation
- Foundations of Memory Corruption Vulnerabilities
- Buffer Overflow and Stack-Based Exploitation Techniques
- Heap Corruption and Arbitrary Code Execution Risks
- Race Conditions and Concurrent Execution Vulnerabilities
- Integer Overflow and Logic Manipulation Attacks
- Risks Associated with Unsafe Memory Management Practices
- Monitoring Exploitation Attempts and System Instability Indicators
- Applying Defensive Measures Against Memory Corruption Attacks
- Scenario-Based Quiz
Flexible Four-Stage Course Map
Build the Decision System in Focused Stages
Move from governance into architecture, assurance, operations, and secure software. Use the twelve-month access period to set the pace that fits your professional schedule.
Govern the Decision
Ethics, governance, law, compliance, risk treatment, policy, asset accountability, and supplier exposure.
Design the Control System
Security models, cryptography, physical controls, networks, identity, access, resilience, and secure engineering.
Validate What Matters
Assessment strategy, audits, testing, vulnerability management, penetration testing, and control evidence.
Operate and Improve
Monitoring, incident management, investigations, continuity, recovery, malware defense, forensics, and software security.
Designed for Advanced Security Responsibility
Choose the Path That Sounds Most Like You
Built for professionals who need broader enterprise fluency and candidates preparing across all eight CISSP domains.
Three-Minute Readiness Check
Find the Best Place to Start
Answer four quick questions. Your result will suggest whether to begin with Cybersecurity Essentials, use the five-lesson preview, or move into the full advanced course.
Flexible Access and Support
Choose the Support Path That Fits the Way You Learn.
The complete on-demand course stands on its own. Current live-support and organizational-enrollment options provide additional ways to use the same curriculum.
Individual Access
Self-Paced Advanced Security Study
Use the full twelve-month access period to move through lessons, section quizzes, practice, flashcards, notes, and targeted review.
3 Payments of $266→
Current Support Options
Live Instruction and Human Guidance
Contact Cyber Brain Academy for current live-training, office-hour, and learner-support availability. Live support complements rather than replaces independent study.
Finance My Training→
Group Enrollment
Teams, Employers, and Institutions
Discuss cohort access, centralized enrollment, learner support, and implementation needs for employers, universities, workforce programs, government organizations, and security teams.
Explore Partnership Options →Course Tuition
Invest in a Complete Security Decision System
One Year of Course Access
- 48 complete guided lessons
- 48 practice sets where published
- 48 flashcard sets where published
- 192 section scenario quizzes
- Exportable notes and highlights
- Course navigation and progress tools
- Completion documentation
- Five-lesson free preview
Exam registration is separate. Course completion does not award CISSP or guarantee an examination result.
What Is Included
- 01Full Course Access
All 48 lessons and eight domains for one year. - 02Retrieval and Scenario Practice
Flashcards, practice, and 192 section quizzes where published. - 03Flagship Curriculum Depth
192 Structured Sections and 1,536 Chapter Activities. - 04Notes and Highlights
Preserve the distinctions and review points you need later. - 05Free Preview
Evaluate Lessons 1.1 through 1.5 before enrollment.
CISSP Exam Preparation
The course supports exam preparation. ISC2 separately controls eligibility, the examination, endorsement, certification, and continuing requirements.
Employer or Cohort Enrollment
Build a Shared Security Language
Discuss enrollment for employers, universities, workforce programs, public-sector organizations, and security teams.
Explore Partnership EnrollmentQuestions Before Enrollment
Know What You Are Getting
Review course scope, access, free-preview lessons, exam preparation, support, payment options, and organizational enrollment before you decide.
01Who is Cybersecurity Advanced designed for?
The course is designed for security analysts, engineers, administrators, architects, auditors, risk and governance professionals, technical managers, security leaders, and experienced IT professionals preparing to work across all eight CISSP domains.
02Is this course appropriate for someone new to cybersecurity?
The course assumes foundational cybersecurity knowledge. A motivated beginner can use it, but learners who still need core terminology, networking, access-control, and risk foundations may benefit from starting with Cybersecurity Essentials.
03How much content is included?
Cybersecurity Advanced includes 48 lessons organized across eight domains. Each lesson uses four structured sections, which produces 192 lesson sections across the complete course.
04What is included in the five-lesson free preview?
The free preview includes Lessons 1.1 through 1.5. Signing in lets learners examine the writing depth, lesson structure, navigation, and available study tools before choosing paid access.
05How long will I have access?
Paid enrollment includes twelve months of on-demand course access.
06Are flashcards, practice, notes, and quizzes included?
The course includes guided lessons, flashcards, practice activities, scenario-based section quizzes, notes and highlights, domain navigation, progress tracking, and completion documentation where those resources are published in the learning platform.
07Are live classes required?
No. The core course is self-paced and on demand. Contact Cyber Brain Academy for current live-training, office-hour, or organizational-support options.
08Is a CISSP exam voucher included?
No exam voucher is included unless the selected checkout offer explicitly states otherwise. Course enrollment and ISC2 exam registration are separate.
09Does course completion award the CISSP credential?
No. Course completion documents training activity only. ISC2 controls exam registration, experience requirements, endorsement, certification decisions, and continuing requirements.
10What experience does ISC2 require for CISSP certification?
ISC2 currently states that candidates need five years of cumulative full-time experience in at least two CISSP domains, with limited waiver options. Requirements can change, so candidates should confirm the current rules directly with ISC2.
Your Next Security Decision Starts Here
Turn Eight Domains Into One Confident CISSP Decision.
Review all 48 lessons, 192 structured sections, and the complete eight-domain curriculum. Begin the one-year path when you are ready.
