CISSP-ISSAP (ISSAP) Exam Syllabus

CISSP-ISSAP PDF, CISSP-ISSAP Dumps, CISSP-ISSAP VCE, Information Systems Security Architecture Professional Questions PDF, ISC2 Information Systems Security Architecture Professional VCE, ISC2 ISSAP Dumps, ISC2 ISSAP PDFUse this quick start guide to collect all the information about ISC2 CISSP-ISSAP Certification exam. This study guide provides a list of objectives and resources that will help you prepare for items on the ISC2 Information Systems Security Architecture Professional (CISSP-ISSAP) exam. The Sample Questions will help you identify the type and difficulty level of the questions and the Practice Exams will make you familiar with the format and environment of an exam. You should refer this guide carefully before attempting your actual ISC2 Information Systems Security Architecture Professional (CISSP-ISSAP) certification exam.

The ISC2 CISSP-ISSAP certification is mainly targeted to those candidates who want to build their career in Cybersecurity domain. The ISC2 Information Systems Security Architecture Professional (CISSP-ISSAP) exam verifies that the candidate possesses the fundamental knowledge and proven skills in the area of ISC2 ISSAP.

ISC2 CISSP-ISSAP Exam Summary:

Exam Name ISC2 Information Systems Security Architecture Professional (CISSP-ISSAP)
Exam Code CISSP-ISSAP
Exam Price $599 (USD)
Duration 180 mins
Number of Questions 125
Passing Score 700/1000
Schedule Exam Pearson VUE
Sample Questions ISC2 CISSP-ISSAP Sample Questions
Practice Exam ISC2 CISSP-ISSAP Certification Practice Exam

ISC2 ISSAP Exam Syllabus Topics:

Topic Details
Identity and Access Management Architecture 19%
Design Identity Management and Lifecycle - Identification and Authentication
- Centralized Identity and Access Management Architecture
- Decentralized Identity and Access Management Architecture
- Identity Provisioning Lifecycle (e.g., registration, issuance, revocation, validation)
- Authentication Protocols and Technologies (e.g., SAML, RADIUS, Kerberos, OATH)
Design Access Control Management and Lifecycle - Application of Control Concepts and Principles (e.g., discretionary/mandatory, segregation/ separation of duties, rule of least privilege)
- Access Control Governance
- Access Control Configurations (e.g., physical, logical, administrative)
- Authorization Process and Workflow (e.g., issuance, periodic review, revocation)
- Roles, Rights, and Responsibilities Related to System, Application, and Data Access Control (e.g., groups, Digital Rights Management (DRM), trust relationships)
- Authorization (e.g., single sign-on, rule-based, role-based, attribute-based)
- Accounting (e.g., logging, tracking, auditing)
- Access Control Protocols and Technologies (e.g., XACML, LDAP)
- Network Access Control
Security Operations Architecture 17%
Determine Security Operation Capability Requirements and Strategy - Determine Legal Imperatives
- Determine Organizational Drivers and Strategy
- Determine Organizational Constraints
- Map Current Capabilities to Organization Strategy
- Design Security Operations Strategy
Design Continuous Security Monitoring (e.g., SIEM, insider threat, enterprise log management, cyber crime, advanced persistent threat)
- Detection and Response
- Content Monitoring, Inspection, and Filtering (e.g., email, web, data, social media)
- Anomoly Detection (e.g., baseline, analytics, false positive reduction)
Design Continuity, Availability, and Recovery Solutions - Incorporate Business Impact Analysis (BIA) Information (e.g., legal, financial, stakeholders)
- Determine Security Strategies for Availability and Recovery
- Design Continuity and Recovery Solution
Define Security Operations (e.g., interoperability, scalability, availability, supportability)  
Integrate Physical Security Controls - Assess Physical Security Requirements
- Integrate Physical Security Products and Systems
- Evaluate Physical Security Solutions (e.g., test, evaluate, implement)
Design Incident Management Capabilities  
Secure Communications and Networks - Design the Maintenance Plan for the Communication and Network Architecture
- Determine Communications Architecture
- Determine Network Architecture
- Communication and Network Policies
- Remote Access
Infrastructure Security 19%
Determine Infrastructure Security Capability Requirements and Strategy
 
Design Layer 2/3 Architecture (e.g., access control segmentation, out-of-band management, OSI layers)
 
Secure Common Services (e.g., wireless, e-mail, VoIP, unified communications)  
Architect Detective, Deterrent, Preventative, and Control Systems - Design Boundary Protection (e.g., firewalls, VPNs, airgaps, BYOD, software defined perimeters)
- Secure Device Management (e.g., BYOD, mobile, server, endpoint)
Architect Infrastructure Monitoring - Monitor Integration (e.g., sensor placement, time reconciliation, span of control, record compatibility)
- Active/Passive Solutions (e.g., span port, port mirroring, tap, inline)
Design Integrated Cryptographic Solutions (e.g., Public Key Infrastructure (PKI), identity system integration)
- Determine Usage (i.e., in transit, at rest)
- Define Key Management Lifecycle
- Identify Cryptographic Design Considerations and Constraints
Architect for Governance, Compliance, and Risk Management 16%
Architect for Governance and Compliance - Auditability (e.g., regulatory, legislative, forensic requirements, segregation, verifiability of high assurance systems)
- Secure Sourcing Strategy
- Apply Existing Information Security Standards and Guidelines (e.g., ISO/IEC, PCI, SOX, SOC2)
- Governing the Organizational Security Portfolio
Design Threat and Risk Management Capabilities - Identify Security Design Considerations and Associated Risks
- Design for Compliance
- Assess Third Parties (e.g., auditing and risk registry)
Architect Security Solutions for Off-Site Data Use and Storage - Cloud Service Providers
- Third Party
- Network Solutions Service Providers (NSSP)
Operating Environment (e.g., virtualization, cloud computing)  
Security Architecture Modeling 14%
Identify Security Architecture Approach (e.g., reference architectures, build guides, blueprints, patterns)
- Types and Scope (e.g., enterprise, network, SOA)
- Frameworks (e.g., Sherwood Applied Business Security Architecture (SABSA), Service-Oriented Modeling Framework (SOMF))
- Industrial Control Systems (ICS) (e.g., process automation networks, work interdependencies, monitoring requirements)
- Security Configuration (e.g., baselines)
- Network Configuration (e.g., physical, logical, high availability)
- Reference Architectures
Verify and Validate Design (e.g., POT, FAT, regression)
- Validate Threat Model (e.g., access control attacks, cryptanalytic attacks, network)
- Identification of Gaps and Alternative Solutions
- Independent Verification and Validation
- Evaluate Controls Against Threats and Vulnerabilities
- Validation of Design Against Reference Architectures
Architect for Application Security 15%
Review Software Development Life Cycle (SDLC) Integration of Application Security Architecture (e.g., requirements traceability matrix, security architecture documentation, secure coding)
- Assess When to Use Automated vs. Manual vs. Static Secure Code Reviews Based on Risk
- Assess the Need for Web Application Firewalls (e.g., REST, API, SAML)
- Review the Need for Encryption between Identity Providers at the Transport and Content Layers
- Assess the Need for Secure Communications between Applications and Databases or other Endpoints
- Leverage Secure Code Repository
Review Application Security (e.g., custom, commercial off-the-shelf (COTS), in-house cloud)
 
Determine Application Security Capability Requirements and Strategy (e.g., open source, cloud service providers, SaaS/IaaS providers)
 
Design Application Cryptographic Solutions (e.g., cryptographic API selection, PRNG selection, software-based key management)
 
Evaluate Application Controls Against Existing Threats and Vulnerabilities  
Determine and Establish Application Security Approaches for all System Components (mobile, web, and thick client applications; proxy, application, and database services)
 

To ensure success in ISC2 ISSAP certification exam, we recommend authorized training course, practice test and hands-on experience to prepare for Information Systems Security Architecture Professional (CISSP-ISSAP) exam.

Rating: 4.9 / 5 (50 votes)