CISSP: Certified Information Systems Security Professional

CISSP Exam Mindset Rules

Target audience: Security engineers, senior ICs, architects, SOC leads, and GRC practitioners building end-to-end defensive judgment.

Human life safety always comes first: In any physical security, fire suppression, disaster recovery, or facility access scenario, protecting human life outranks confidentiality, integrity, availability, and hardware preservation.
Think like a Risk Advisor and Principal Architect before jumping into a terminal: If a question asks for the BEST or FIRST action on a strategic or governance problem, evaluate risk, consult policy, or verify scope before deploying a point tool or editing a firewall rule.
Controls must match the asset value and failure property: Never spend $100,000/year to prevent a $20,000/year Annualized Loss Expectancy (ALE) unless required by law or human safety. Match preventive, detective, and corrective controls to the specific CIA failure mode.
Follow formal lifecycles and preserve evidence: In incident response, forensics, SDLC, and change management, follow the structured phase order: preserve volatile evidence and verify authority before wiping hosts or pushing emergency changes.

DOMAIN 1 · 16% OF EXAM

Domain 1: Security and Risk Management

Confidentiality, integrity, and availability; security governance principles; compliance, legal, and regulatory obligations; professional ethics; security policies, standards, baselines, procedures, and guidelines; business continuity requirements; personnel security; quantitative and qualitative risk management; threat modeling; and supply-chain risk management.

Drill Domain 1 practice questions ↗

Objectives & Mapped Field Lessons

Objective 1.1: Understand, adhere to, and promote professional ethics and security concepts (CIA triad, authenticity, non-repudiation, ISC2 Code of Ethics)

Assets and the CIA triad: what we protect and how it fails (F1 · 8 min)
Law, ethics, and personnel security (R4 · 10 min)

Related practice & reference: Term: CIA triad · Term: Confidentiality · Term: Integrity · Term: Availability · Term: Non-repudiation

Objective 1.2: Evaluate and apply security governance principles, policy hierarchy, and compliance/regulatory frameworks

Security governance and the policy hierarchy (R5 · 9 min)
Outcomes before controls: using NIST CSF, CIS, ISO 27001, and ATT&CK together (F8a · 8 min)
Governance as an operating cadence: NIST CSF 2.0 Govern in practice (R3 · 11 min)
Privacy vs security: why an encrypted database can still violate privacy (P1 · 10 min)

Objective 1.3: Understand legal, regulatory, intellectual property, privacy, and personnel security policies

Law, ethics, and personnel security (R4 · 10 min)
Privacy vs security: why an encrypted database can still violate privacy (P1 · 10 min)

Objective 1.4: Understand and apply risk management concepts, quantitative/qualitative risk analysis, and Business Impact Analysis (BIA)

Threat, vulnerability, and risk: the core equation (F2 · 9 min)
Quantitative risk and BIA math: SLE, ALE, RTO, and RPO (R6 · 11 min)
Write the risk sentence: cause, asset, and business impact (R1 · 9 min)
Choose the control and its evidence: policies do not execute themselves (R2 · 10 min)

Objective 1.5: Apply threat modeling concepts, supply-chain risk management (SCRM), and security awareness/social engineering defenses

Phishing and social engineering: how attackers exploit workflow urgency (SE1 · 9 min)
Threat modeling a service: data flows, trust boundaries, and STRIDE (A1 · 9 min)
Direct and transitive dependencies: inherited code in your runtime (A2 · 9 min)

Related practice & reference: Term: Phishing · Term: Control · Term: Uncertainty

Domain 1 Rapid-Review Cheat Sheet

DOMAIN 2 · 10% OF EXAM

Domain 2: Asset Security

Identify and classify information and assets; information and asset handling requirements; data lifecycle across states (at rest, in transit, in use); data ownership and privacy roles (Owner, Controller, Processor, Custodian); data retention, data remanence, and NIST SP 800-88 media sanitization.

Drill Domain 2 practice questions ↗

Objectives & Mapped Field Lessons

Objective 2.1: Identify and classify information and assets across government and commercial classification tiers

Data lifecycle, classification, and governance roles (D2a · 10 min)
Assets and the CIA triad: what we protect and how it fails (F1 · 8 min)

Related practice & reference: Term: Asset · Term: Data classification

Objective 2.2: Establish information and asset handling requirements, data lifecycle controls, and data roles (Owner, Controller, Processor, Custodian, Steward)

Data lifecycle, classification, and governance roles (D2a · 10 min)
Privacy vs security: why an encrypted database can still violate privacy (P1 · 10 min)

Related practice & reference: Term: Data minimization · Term: Privacy · Term: DLP

Objective 2.3: Provision resources securely, manage data retention, prevent data remanence, and apply NIST SP 800-88 sanitization (Clear, Purge, Destroy)

Data remanence, retention, and NIST SP 800-88 sanitization (D2b · 10 min)
Data protection and resilience: why encryption is not a backup plan (F6 · 8 min)

Related practice & reference: Term: Encryption · Term: Backup

Domain 2 Rapid-Review Cheat Sheet

DOMAIN 3 · 13% OF EXAM

Domain 3: Security Architecture and Engineering

Secure design principles; formal security models (Bell-LaPadula, Biba, Clark-Wilson, Brewer-Nash); TCB, reference monitor, CPU rings, and memory protection; hardware security (TPM, HSM); cloud and virtualization architecture; symmetric/asymmetric cryptography, PKI, and quantum readiness; CPTED, physical facility security, environmental controls, and fire suppression.

Drill Domain 3 practice questions ↗

Objectives & Mapped Field Lessons

Objective 3.1: Research, implement, and manage engineering processes using secure design principles (least privilege, defense in depth, fail-safe/fail-secure, zero trust)

Least privilege, defense in depth, and Zero Trust boundaries (F5 · 8 min)
Cloud shared responsibility: what you rent vs what you still own (F6b · 9 min)
Security product categories are capabilities, not outcomes (F8b · 7 min)

Objective 3.2: Understand the fundamental concepts of formal security models (Bell-LaPadula, Biba, Clark-Wilson, Brewer-Nash, Take-Grant)

Formal security models: Bell-LaPadula, Biba, Clark-Wilson, and Brewer-Nash (AR1 · 11 min)

Objective 3.3: Assess and mitigate vulnerabilities in system architecture, hardware (CPU rings, TPM, HSM, TCB), virtualization, and cloud

Secure hardware, TCB, OS rings, and virtualization (AR2 · 11 min)
Cloud shared responsibility: what you rent vs what you still own (F6b · 9 min)

Related practice & reference: Term: CNAPP · Term: CSPM

Objective 3.4: Understand and apply cryptography: symmetric, asymmetric, cipher modes, hashing, digital signatures, PKI, and post-quantum migration

Symmetric and asymmetric cryptography: ciphers, modes, and hybrid envelopes (AR3 · 11 min)
Hashing, HMAC, digital signatures, and PKI lifecycle (AR4 · 11 min)
Two sides derive one secret: TLS 1.3 key exchange and name binding (F3b · 8 min)

Related practice & reference: Term: Encryption · Term: Hashing · Term: TLS · Term: Non-repudiation

Objective 3.5: Implement and manage physical security, CPTED, facility design, environmental controls, power conditioning, and fire suppression

Physical and facility security: CPTED, mantraps, and access zones (AR5 · 10 min)
Environmental controls: HVAC, power anomalies, and fire suppression (AR6 · 10 min)

Domain 3 Rapid-Review Cheat Sheet

Formal Security Models Matrix

Bell-LaPadula (Confidentiality): Simple Security = 'No Read Up'; *-Property (Star) = 'No Write Down'. Prevents secret data from leaking to lower levels.
Biba (Integrity): Simple Integrity = 'No Read Down'; *-Integrity = 'No Write Up'. Prevents untrusted data from contaminating higher-integrity levels.
Clark-Wilson (Commercial Integrity): Uses Well-Formed Transactions (WFTs) and Separation of Duties via Transformation Procedures (TPs) to protect Constrained Data Items (CDIs); Unconstrained Data Items (UDIs) must be validated by an Integrity Verification Procedure (IVP).
Brewer-Nash / Chinese Wall (Conflict of Interest): Dynamically updates access rules based on what a consultant has already accessed so they cannot read two competitors in the same conflict class.

Exam Trap: Bell-LaPadula cares ONLY about confidentiality (a subject can write up blindly, potentially corrupting higher-level data). Biba cares ONLY about integrity. If you see 'Well-Formed Transactions' or 'Triples (User, TP, CDI)', the answer is always Clark-Wilson.

Cryptography & PKI Essentials

Symmetric (Confidentiality, Fast, Shared Key): AES (128/192/256-bit, 128-bit block), ChaCha20. Modes: Avoid ECB (leaks patterns); prefer AES-GCM (authenticated encryption / AEAD).
Asymmetric (Key Exchange & Digital Signatures, Scalable, 2n Keys): RSA, ECDHE (ephemeral Diffie-Hellman provides Forward Secrecy), Ed25519/ECDSA.
Digital Signature: Sender hashes message → encrypts hash with Sender's PRIVATE key → Receiver verifies with Sender's PUBLIC key. Provides Authenticity, Integrity, and Non-Repudiation.
Quantum Impact: Shor's algorithm breaks RSA/ECC/DH; Grover's algorithm halves effective symmetric/hash bit strength (AES-256 remains quantum-safe).

Exam Trap: Signing uses the sender's PRIVATE key; encrypting for confidentiality uses the recipient's PUBLIC key. Never reverse them on the exam.

Fire Classes & Suppression Systems

Fire Classes: Class A (Ash/ordinary combustibles), Class B (Boil/flammable liquids), Class C (Current/electrical equipment), Class D (Combustible metals), Class K (Kitchen oils).
Water Pipe Types: Wet pipe (water stays in pipes), Dry pipe (compressed air holds valve shut until head opens), Deluge (wide open heads, high volume), Pre-action (two-stage: smoke/heat detector fills pipe first, then individual sprinkler head melts to release water, ideal for data centers).
Clean Agents (Gas): FM-200, Novec 1230, Inergen (remove heat or interrupt chemical chain reaction without leaving residue; Halon is ozone-depleting and banned for new installs).

Exam Trap: For a server room or data center, Pre-action is the best water-based system (prevents accidental pipe leaks), and Clean Agents (FM-200/Novec 1230) are the best gas-based systems. Fail-safe unlocks doors on power/fire alarm for human life safety; fail-secure locks doors to protect assets.

DOMAIN 4 · 13% OF EXAM

Domain 4: Communication and Network Security

OSI and TCP/IP models; secure network protocols (DNS, DNSSEC, HTTP, TLS 1.3, IPsec, SSH, SPF/DKIM/DMARC); network segmentation, firewalls, proxies, IDS/IPS, and zero trust network architecture; wireless security (WPA2/WPA3, 802.1X/EAP); RADIUS vs. TACACS+; SDN, SD-WAN, SASE, and network layer attacks.

Drill Domain 4 practice questions ↗

Objectives & Mapped Field Lessons

Objective 4.1: Apply secure design principles in network architectures (OSI 7-layer vs. TCP/IP models, encapsulation, protocol stacks, IPsec, TLS 1.3, email authentication)

OSI and TCP/IP layers, encapsulation, and protocol attacks (N1 · 11 min)
Networks in one request: DNS, TCP, TLS, and HTTP (F3 · 10 min)
Three packets to open a road: TCP SYN, SYN-ACK, and ACK (F3a · 8 min)
Two sides derive one secret: TLS 1.3 key exchange and name binding (F3b · 8 min)
Email authentication: what SPF, DKIM, and DMARC prove (and what they do not) (E1a · 8 min)
DMARC rollout: monitor with p=none, fix legitimate senders, then enforce (E1b · 8 min)

Related practice & reference: Term: DNS · Term: HTTP · Term: TLS · Term: Port · Term: IP address · Term: SPF · Term: DKIM · Term: DMARC

Objective 4.2: Secure network components: firewalls, proxies, WAF, NAC (802.1X), VLANs, microsegmentation, and RADIUS/TACACS+

Network segmentation, firewall generations, SASE, and NAC (N2 · 10 min)
OSI and TCP/IP layers, encapsulation, and protocol attacks (N1 · 11 min)

Related practice & reference: Term: WAF · Term: NDR · Term: Trust boundary

Objective 4.3: Implement secure communication channels: IPsec (AH/ESP, tunnel/transport), wireless (WPA2/WPA3, EAP), VPNs, SDN, ZTNA, and SASE

IPsec VPNs (AH vs ESP), WPA3 wireless, and converged networks (N3 · 11 min)

Related practice & reference: Term: ZTNA · Term: SSE · Term: SASE

Domain 4 Rapid-Review Cheat Sheet

OSI 7-Layer Reference Stack

Layer 7 Application (PDU: Data): HTTP, DNS, SMTP, SSH, TLS application interface.
Layer 6 Presentation (PDU: Data): Formatting, serialization, character encoding, compression.
Layer 5 Session (PDU: Data): Session setup/teardown, checkpoints, RPC, NetBIOS.
Layer 4 Transport (PDU: Segment [TCP] / Datagram [UDP]): TCP (connection-oriented, 3-way handshake, flow control), UDP (connectionless, low latency); Ports 0–65535.
Layer 3 Network (PDU: Packet): Logical IP addressing, routing (IP, ICMP, IPsec, BGP, OSPF); Routers & Layer 3 switches.
Layer 2 Data Link (PDU: Frame): Physical MAC addressing (LLC & MAC sublayers), VLAN tags (802.1Q), ARP, 802.1X; Bridges & Switches.
Layer 1 Physical (PDU: Bits): Cables, fiber, RF spectrum, hubs, repeaters.

Exam Trap: Know the exact PDU and layer for every attack: ARP spoofing and VLAN hopping happen at Layer 2 (Frames); ICMP Smurf and IP spoofing happen at Layer 3 (Packets); SYN floods happen at Layer 4 (Segments).

IPsec (AH vs. ESP & Tunnel vs. Transport)

AH (Authentication Header, IP Protocol 51): Provides integrity, origin authentication, and anti-replay over the entire packet (including immutable outer IP header), but NO confidentiality (no encryption) and breaks under NAT.
ESP (Encapsulating Security Payload, IP Protocol 50): Provides confidentiality (encryption), integrity, origin authentication, and anti-replay; works with NAT-T (UDP 4500).
Transport Mode: Encrypts only the payload, keeping original IP header (used for host-to-host inside an internal network).
Tunnel Mode: Encrypts the entire original IP packet and adds a new outer IP header (used for gateway-to-gateway / site-to-site VPNs).

Exam Trap: AH never encrypts. If the question asks for confidentiality + integrity in a site-to-site VPN, the answer is always IPsec ESP in Tunnel Mode.

DOMAIN 5 · 13% OF EXAM

Domain 5: Identity and Access Management (IAM)

Physical and logical access control; identification, authentication, authorization, and accountability (IAAA); federation, SSO, Kerberos, OAuth 2.0, OIDC, and SAML 2.0; access control models (DAC, MAC, RBAC, ABAC, RuBAC); biometrics and CER/FAR/FRR; PAM and identity lifecycle management.

Drill Domain 5 practice questions ↗

Objectives & Mapped Field Lessons

Objective 5.1: Control physical and logical access to assets, and separate identification, authentication, authorization, accountability, and recovery

Identity, authentication, authorization, and recovery (F4 · 9 min)
Kerberos, biometric CER math, NIST 800-63 assurance, and PAM lifecycle (IF4 · 11 min)

Objective 5.2: Design and validate federated identity with third-party services (SAML 2.0, OAuth 2.0, OpenID Connect, Kerberos)

Who holds the ticket: OAuth 2.0 roles and bearer token verification (IF1 · 10 min)
OAuth 2.0 Authorization Code + PKCE: front channel vs back channel (IF1a · 8 min)
OIDC and SAML assertions: signed identity claims are not admin permission (IF2 · 11 min)
Federation failure modes: five ways SSO and token trust break (IF3 · 11 min)
Kerberos, biometric CER math, NIST 800-63 assurance, and PAM lifecycle (IF4 · 11 min)

Objective 5.3: Implement and manage authorization mechanisms (DAC, MAC, RBAC, ABAC, RuBAC) and manage the identity and access provisioning lifecycle (IGA, PAM, service identities)

Access control models: DAC, MAC, RBAC, ABAC, and Rule-Based controls (IF5 · 10 min)
Least privilege, defense in depth, and Zero Trust boundaries (F5 · 8 min)
Agent tool identity: On-Behalf-Of delegation vs ambient service keys (A3b · 8 min)

Related practice & reference: Term: IAM · Term: PAM · Term: IGA · Term: Privilege creep · Term: Secrets management

Domain 5 Rapid-Review Cheat Sheet

Access Control Models (DAC, MAC, RBAC, ABAC)

DAC (Discretionary): Resource owner controls ACLs and can grant access to others (flexible, prone to privilege creep and Trojan horse inheritance).
MAC (Mandatory): System enforces access using clearance labels (hierarchical sensitivity) and compartments (need-to-know) defined by central policy; users cannot change permissions.
RBAC (Role-Based): Permissions are bound to job roles/groups rather than individual users; prevents direct user-ACL sprawl.
ABAC (Attribute-Based): Dynamic policy engine (XACML PDP/PEP) evaluates subject attributes, object tags, action, and environmental context (time, device posture, IP).

Exam Trap: Remember that 'Mandatory' in MAC does not just mean 'strict'; it specifically means the operating system/kernel enforces security labels and the resource creator cannot override them.

DOMAIN 6 · 12% OF EXAM

Domain 6: Security Assessment and Testing

Design and validate assessment, test, and audit strategies; SOC 1, SOC 2, and SOC 3 reports (Type I vs. Type II); vulnerability scanning vs. penetration testing; black-box, gray-box, and white-box testing; SAST, DAST, IAST, RASP, and fuzzing; code coverage metrics; synthetic transactions and continuous audit review.

Drill Domain 6 practice questions ↗

Objectives & Mapped Field Lessons

Objective 6.1: Design and validate assessment, test, and audit strategies (internal, external, third-party; SOC 1/2/3 Type I & II; NIST SP 800-53A)

Security audits, SOC 1 / 2 / 3 reports, and Type 1 vs Type 2 evidence (AT1 · 10 min)
Choose the control and its evidence: policies do not execute themselves (R2 · 10 min)

Objective 6.2: Conduct security control testing: vulnerability assessments, penetration testing (ROE, black/gray/white box), red/blue/purple exercises

Penetration testing, Rules of Engagement, and vulnerability validation (AT2 · 10 min)
Vulnerability prioritization: combining CVSS, KEV, EPSS, and asset exposure (S2 · 9 min)

Related practice & reference: Lab: Patch the right thing first · Term: Vulnerability · Term: Exploit · Term: CVSS · Term: EPSS · Term: KEV

Objective 6.3: Collect security process data and test software/interfaces (SAST, DAST, IAST, fuzzing, code coverage metrics, synthetic transactions)

Software testing: SAST, DAST, IAST, SCA, fuzzing, and coverage math (AT3 · 10 min)
Direct and transitive dependencies: inherited code in your runtime (A2 · 9 min)

Related practice & reference: Term: SAST · Term: DAST · Term: SCA

Domain 6 Rapid-Review Cheat Sheet

SOC 1 vs. SOC 2 vs. SOC 3 & Type I vs. Type II

SOC 1 (SSAE 18 / ISAE 3402): Focuses strictly on Internal Controls over Financial Reporting (ICFR).
SOC 2: Evaluates security operational controls against the 5 Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy); restricted distribution under NDA.
SOC 3: High-level public summary of a SOC 2 engagement (no detailed control testing descriptions; can be posted on a public website).
Type I: Evaluates control suitability and design at a single point in time.
Type II: Evaluates operating effectiveness of controls over a period of time (typically 6 to 12 months).

Exam Trap: When evaluating a SaaS or cloud vendor's real security posture, always ask for a SOC 2 Type II report. A SOC 1 report only covers financial reporting accuracy, and a Type I report only proves the control existed on one afternoon.

Penetration Testing Rules & Knowledge Levels

Rules of Engagement (ROE) & Written Authorization ('Get Out of Jail Free' letter): Must be signed by executive asset owners BEFORE any scanning or exploitation begins.
Zero-Knowledge (Black-Box): Simulate an external attacker with no internal architecture diagrams or source code.
Partial-Knowledge (Gray-Box): Simulate an authenticated user, partner, or contractor with limited credentials/documentation (best cost-to-depth ratio).
Full-Knowledge (White-Box / Crystal-Box): Full access to source code, architecture schematics, and configs (finds deep logic flaws fastest).

Exam Trap: If a penetration tester discovers active child exploitation material, criminal activity, or an active nation-state breach during a test, they must immediately halt testing on that system and notify the designated executive contact.

DOMAIN 7 · 13% OF EXAM

Domain 7: Security Operations

Understand and support investigations and digital forensics (Order of Volatility, chain of custody, write blockers); logging, SIEM, SOAR, and continuous monitoring; incident management lifecycle; vulnerability and patch management; change and configuration management; RAID, backup strategies (full, incremental, differential), DR recovery sites (cold, warm, hot), and DR testing.

Drill Domain 7 practice questions ↗

Objectives & Mapped Field Lessons

Objective 7.1: Understand and comply with investigations, digital forensics, Order of Volatility (RFC 3227), chain of custody, and evidence admissibility

Digital forensics: order of volatility, chain of custody, and legal evidence (S5 · 10 min)
Logs, alerts, and evidence: why an alert title is a hypothesis, not proof (F7 · 8 min)

Related practice & reference: Term: Evidence · Term: Log · Term: Audit trail

Objective 7.2: Conduct logging, continuous monitoring, alert triage, incident response lifecycle, and governed automation (SIEM, EDR, XDR, SOAR, Agentic SOC)

Identity alert triage: reconstructing who, what, and how across logs (S1 · 11 min)
Investigate, respond, and verify: why HTTP 200 or 504 is not containment proof (S3 · 10 min)
Agentic SOC architecture: autonomous triage vs human-gated containment (S4 · 10 min)
Vulnerability prioritization: combining CVSS, KEV, EPSS, and asset exposure (S2 · 9 min)

Objective 7.3: Implement and test disaster recovery (DR), backup types (Full, Incremental, Differential), RAID levels, recovery sites (Cold, Warm, Hot), and change/patch management

Continuity operations: recovery sites, backup strategies, RAID, and DR testing (S6 · 14 min)
Data protection and resilience: why encryption is not a backup plan (F6 · 8 min)

Related practice & reference: Term: Backup · Term: Ransomware · Term: Patch · Term: Blast radius

Domain 7 Rapid-Review Cheat Sheet

Recovery Site Tiers & DR Test Types

Cold Site: Power, HVAC, and floor space only; no servers or data (weeks to recover; lowest cost).
Warm Site: Pre-installed servers and network links, but data must be restored from backups (hours to days).
Hot Site: Fully redundant hardware, network, and near-real-time replicated data (minutes to hours; highest cost).
DR Test Progression: Checklist/Read-through → Structured Walkthrough (Tabletop) → Simulation → Parallel Test (runs DR site alongside live production without cutting over primary) → Full-Interruption Test (shuts down primary production; highest risk).

Exam Trap: In almost every exam scenario asking for the safest full operational test of a DR site without endangering live business operations, choose a Parallel Test over a Full-Interruption Test.

DOMAIN 8 · 10% OF EXAM

Domain 8: Software Development Security

Integrate security in the SDLC (Waterfall, Spiral, Agile, DevSecOps); software maturity models (CMMI, SAMM, BSIMM); CI/CD pipeline separation of duties, SBOM, and supply chain; database security (ACID, relational integrity, polyinstantiation, inference vs. aggregation); OWASP application and AI/LLM security (prompt injection, excessive agency, human oversight).

Drill Domain 8 practice questions ↗

Objectives & Mapped Field Lessons

Objective 8.1: Understand and integrate security in the SDLC, software maturity models, and CI/CD build/promotion pipelines

Software assurance: SDLC models, database integrity, and classic application attacks (A5 · 15 min)
CI/CD trust boundaries: writing code vs promoting to production (A3 · 9 min)
Agentic SDLC security: coding assistants, autonomous PRs, and build gates (A3a · 8 min)

Objective 8.2: Identify and apply security controls in software development ecosystems, API trust boundaries, databases (inference, aggregation, polyinstantiation), and OWASP Top 10

Application trust boundaries: why the client UI is never a security gate (F5b · 9 min)
Threat modeling a service: data flows, trust boundaries, and STRIDE (A1 · 9 min)
Software assurance: SDLC models, database integrity, and classic application attacks (A5 · 15 min)

Objective 8.3: Assess the effectiveness of software supply chain security (dependencies, SBOM) and AI/LLM agent security (prompt injection, excessive agency, human oversight)

Direct and transitive dependencies: inherited code in your runtime (A2 · 9 min)
SBOM evidence and priority: binding inventory to the running build (A4 · 7 min)
Prompt injection and untrusted retrieval (RAG): when data hijacks instructions (G1 · 10 min)
Excessive agency: why a model sentence is never an authorization decision (G2 · 10 min)
Human oversight gates and the NIST AI Risk Management Framework (G3 · 12 min)
Agent tool identity: On-Behalf-Of delegation vs ambient service keys (A3b · 8 min)
Agentic cybersecurity: the three-lane curriculum map (M1 · 7 min)

Domain 8 Rapid-Review Cheat Sheet

Database Security: Aggregation, Inference & Polyinstantiation

Aggregation: Combining multiple low-sensitivity data records that a user is authorized to read into a broader collection whose combined sensitivity is higher (for example, viewing every individual branch's sales to learn total unannounced corporate earnings).
Inference: Deductively reasoning a classified/restricted fact from innocent lower-level facts without ever reading the restricted record directly (for example, noticing 500 pizzas ordered to the Pentagon at midnight).
Polyinstantiation: Allowing two database rows to share the same Primary Key at different security classification levels so a lower-clearance user sees a cover story instead of learning through a 'duplicate key' error that a Top Secret mission exists.

Exam Trap: Polyinstantiation specifically prevents Inference attacks across multilevel security (MLS) databases.