Security Certifications

102 flashcards by MentisLibrary

The security certification landscape and the body of knowledge behind it: CISSP, the ISACA and CompTIA families, offensive and GIAC credentials, plus the risk, access control, operations and compliance material they share.

How do you choose a security certification?
Start from the role you want, then check what employers in that role actually list, then match the certification's experience requirement to where you are now. The credential should describe the job, not the study material you enjoyed.
How do entry, practitioner and advanced certifications differ?
Entry certifications assume no experience and test vocabulary and concepts. Practitioner certifications assume a few years and test applied judgement. Advanced certifications require years of documented experience and test design, management or specialist depth.
Knowledge-based vs performance-based exams
A knowledge-based exam asks multiple-choice or scenario questions about what you know. A performance-based exam puts you in a live environment and grades what you actually accomplish, often with a written report.
What are continuing professional education credits?
Recorded hours of ongoing learning that a certification body requires to keep a credential active, earned from training, conferences, writing, teaching and relevant work.
Why do security certifications expire?
Because the field changes: threats, technologies, laws and controls all move within a few years, so an unrefreshed credential quickly stops describing current competence.
How do experience requirements and waivers work?
Advanced credentials require a stated number of years of relevant paid work, verified by attestation. A relevant degree or an approved certification typically waives one year, and the rest must be genuine.
What is endorsement, and what does it involve?
After passing, a certified professional in good standing attests that your claimed experience is genuine. The body may also audit the submission before granting the credential.
What is an associate status, and why does it exist?
A designation for someone who passed the exam but has not yet met the experience requirement. It records the pass and gives a defined period to accumulate the required years.
What is DoD 8140, and why does it matter to certification choice?
A US Department of Defense workforce framework that lists approved certifications for cyber roles and levels. It replaced the older 8570 directive, and being on the list drives large amounts of hiring demand.
What does ANSI accreditation to ISO/IEC 17024 signify?
That the certification body's processes for developing, delivering and maintaining the exam meet an international standard for personnel certification. It speaks to process rigour, not exam difficulty.
Vendor-neutral vs vendor-specific certifications
Vendor-neutral credentials test principles applicable anywhere. Vendor-specific credentials test one product family and are valuable exactly where that product is deployed.
What does a certification not prove?
That you can do the job. It proves you met a standardized bar on a defined body of knowledge at one point in time, under exam conditions.
Why is exam confidentiality taken so seriously?
Every candidate signs a non-disclosure agreement, and sharing questions, using leaked question banks, or discussing specific items is grounds for revocation and a lifetime ban.
What is CISSP, and who issues it?
The Certified Information Systems Security Professional, issued by ISC2. It is a broad, management-oriented credential covering the whole security programme rather than one technical specialism.
Name the eight CISSP domains.
Security and Risk Management; Asset Security; Security Architecture and Engineering; Communication and Network Security; Identity and Access Management; Security Assessment and Testing; Security Operations; Software Development Security.
What mindset does the CISSP exam reward?
Answer as a risk manager advising the organization rather than as an engineer fixing the box. Prefer the option that addresses root cause, follows policy and protects people first.
What are the ISC2 code of ethics canons?
Protect society, the common good, necessary public trust and confidence, and the infrastructure; act honourably, honestly, justly, responsibly and legally; provide diligent and competent service to principals; advance and protect the profession.
What are the CISSP concentrations?
Three specialist add-ons for existing CISSP holders: ISSAP for architecture, ISSEP for engineering, and ISSMP for management.
What is the SSCP?
The Systems Security Certified Practitioner from ISC2: a hands-on operational credential for people who implement and administer security controls, with a much lower experience requirement than CISSP.
What is the CCSP, and what does it cover?
The Certified Cloud Security Professional from ISC2, covering cloud concepts and architecture, cloud data security, platform and infrastructure security, application security, cloud security operations, and legal, risk and compliance.
What is the CSSLP?
The Certified Secure Software Lifecycle Professional from ISC2, aimed at people who build security into the software development lifecycle rather than defending finished systems.
What is the Certified in Cybersecurity credential?
An entry-level ISC2 certification with no experience requirement, covering security principles, business continuity, access control, network security and security operations.
What is CISA, and what does it cover?
The Certified Information Systems Auditor from ISACA, covering the information systems auditing process; governance and management of IT; acquisition, development and implementation; operations and business resilience; and protection of information assets.
What is CISM, and what are its domains?
The Certified Information Security Manager from ISACA, with four domains: information security governance, information security risk management, information security program, and incident management.
What is CRISC?
The Certified in Risk and Information Systems Control from ISACA, focused on identifying, assessing and responding to IT risk and on the design and monitoring of controls.
What is CDPSE?
ISACA's Certified Data Privacy Solutions Engineer, covering privacy governance, privacy architecture and the data lifecycle. It is aimed at people who implement privacy requirements technically.
What are ISACA's experience and maintenance requirements?
Several years of relevant work experience, verified on application, plus twenty continuing education hours annually and one hundred and twenty over each three-year cycle, along with an annual maintenance fee.
What is COBIT?
ISACA's framework for the governance and management of enterprise information and technology. It separates governance objectives, which are the board's responsibility, from management objectives.
What is the three lines model?
A governance structure where the first line owns and manages risk in operations, the second line provides risk and compliance oversight, and the third line provides independent internal audit assurance to the board.
What is CompTIA Security+?
A vendor-neutral early-career credential covering general security concepts; threats, vulnerabilities and mitigations; security architecture; security operations; and security program management and oversight.