ISC CISSP 考試大綱：

主題	簡介
主題 1	Security Operations: This domain encompasses the day-to-day running of a secure environment, including incident management, digital forensics, logging and monitoring, disaster recovery, patch management, and maintaining both physical and personnel security.
主題 2	Software Development Security: This domain integrates security practices into the software development lifecycle, covering secure coding standards, application security testing, development methodologies, and the assessment of third-party and open-source software for security risk.
主題 3	Security Architecture and Engineering: This domain addresses the design and implementation of secure systems using established engineering principles, cryptographic solutions, security models, and physical facility controls, spanning everything from cloud environments to embedded systems.
主題 4	Asset Security: This domain focuses on how organizations classify, handle, and protect their information and physical assets throughout the data lifecycle, from collection and storage through to secure destruction and disposal.
主題 5	Communication and Network Security: This domain covers the secure design and management of network architectures and communication channels, including protocols, segmentation strategies, wireless and cellular networks, and securing data in transit across diverse network environments.
主題 6	Security Assessment and Testing: This domain focuses on evaluating the effectiveness of security controls through vulnerability assessments, penetration testing, audits, and various testing methodologies, culminating in actionable reporting and remediation guidance.
主題 7	Identity and Access Management (IAM): This domain deals with controlling who can access what, covering authentication strategies, authorization mechanisms, federated identity, and the full lifecycle of managing user accounts and access privileges across systems and services.

參考：https://www.isc2.org/cissp/default.aspx

ISC CISSP 考試概覽:

認證廠商:	ISC2
考試名稱:	資訊系統安全專業認證（CISSP）
考試代碼:	CISSP
證照有效期限:	3年
支援語言:	德文, 西班牙文, 英文, 中文, 日文
相關認證:	ISC2 網路安全基礎認證（CC） ISC2 系統安全從業人員認證（SSCP） ISC2 雲端安全專業認證（CCSP）
考試形式:	電腦自適應測驗（CAT）, 進階創新型試題, 單選題
及格分數:	滿分1000分，及格分數為700分
實際考試題數:	100-150題
考試費用:	749美元
考試時間:	180 分鐘
範例考題:	ISC CISSP 範例考題
考試方式:	於Pearson VUE考場應試，採用電腦自適應測驗（CAT）模式
必備條件:	具備至少5年累積且受薪的工作經驗，並需涵蓋CISSP八大領域中至少兩個領域。持有相關領域四年制學位或ISC2認可的專業證照，可抵免一年的工作經驗要求。
官方大綱網址:	https://www.isc2.org/certifications/cissp/cissp-certification-exam-outline

最新的 ISC Certification CISSP 免費考試真題：

問題 #1

Which of the following is a PRIMARY advantage of using a third-party identity service?

A. Directory synchronization
B. Web based logon
C. Automated account management
D. Consolidation of multiple providers

顯示解答討論 0

答案：C 🗳️

說明：（僅 VCESoft 成員可見）

問題 #2

How does identity as a service (IDaaS) provide an easy mechanism for integrating identity service into individual applications with minimal development effort?

A. By allowing for internal provisioning of user accounts
B. By allowing the identification logic and storage of an identity's attributes to be maintained externally
C. By integrating internal provisioning procedures with external authentication processes
D. By keeping all user information in easily accessible cloud repositories

顯示解答討論 0

答案：B 🗳️

說明：（僅 VCESoft 成員可見）

問題 #3

Which of the following media is LEAST problematic with data remanence?

A. Dynamic Random Access Memory (DRAM)
B. Electrically Erasable Programming Read-Only Memory (BPRCM)
C. Magnetic disk
D. Flash memory

顯示解答討論 0

答案：A 🗳️

說明：（僅 VCESoft 成員可見）

問題 #4

Drag and Drop Question
Below are the common phases to creating a Business Continuity/Disaster Recovery (BC/DR) plan. Drag the remaining BC\DR phases to the appropriate corresponding location.