Domain 6 Master Cheat Sheet

Security Assessment & Testing Fundamentals (12%)

Why Domain 6 Matters

Many organizations deploy excellent security controls but fail to verify whether those controls actually work.

Domain 6 teaches the "Trust, but Verify" principle.

A CISSP professional must determine:

• Are security controls correctly implemented?

• Are controls functioning as intended?

• Do controls meet business and regulatory requirements?

• Can management rely on security reports to make decisions?

• Are risks identified before attackers exploit them?

Unlike highly technical penetration testers, CISSP professionals evaluate the overall effectiveness of the security program from a governance and risk-management perspective.

CISSP Manager's Mindset

The CISSP exam is not about becoming the best penetration tester.

It is about determining:

Always think like:

• Security Manager

• CISO

• Security Consultant

• Auditor

• Risk Advisor

instead of

• Ethical Hacker

• System Administrator

• SOC Analyst

Domain 6 Objectives

Domain 6 focuses on six major areas:

Security Assessment Lifecycle

Every assessment follows a structured process.

Planning
      ↓
Scope Definition
      ↓
Rules of Engagement
      ↓
Data Collection
      ↓
Testing
      ↓
Analysis
      ↓
Reporting
      ↓
Risk Remediation
      ↓
Retesting
      ↓
Continuous Monitoring

Remember

Assessment is not complete until findings are remediated and verified.

Core Security Assessment Principles

Security assessments should be:

• Objective

• Repeatable

• Documented

• Risk-based

• Authorized

• Ethical

• Non-destructive whenever possible

Assessment vs Audit vs Test

One of the most frequently confused CISSP topics.

Remember

Assessment = How secure are we?

Audit = Are we compliant?

Testing = Does the control actually work?

Verification vs Validation

Extremely common CISSP question.

Verification

Checks whether the system was built correctly.

Question

Examples:

• Firewall configuration review

• Access control verification

• Configuration audit

Validation

Checks whether the system satisfies business needs.

Question

Examples

• Disaster recovery exercise

• Penetration testing

• Business continuity testing

Easy Memory Trick

Verification

Validation

Due Care vs Due Diligence

Although introduced in Domain 1, this concept frequently appears in Domain 6.

Due Care

Taking appropriate action.

Examples

• Installing MFA

• Encrypting laptops

• Deploying EDR

Due Diligence

Verifying controls continue to work.

Examples

• Penetration testing

• Security audits

• Vulnerability scanning

• Continuous monitoring

Types of Security Assessments

Administrative

Evaluates policies and governance.

Examples

• Security policies

• Risk assessments

• Security awareness

• Vendor reviews

Technical

Evaluates technology.

Examples

• Vulnerability scanning

• Penetration testing

• Configuration reviews

• Log analysis

Physical

Evaluates facilities.

Examples

• Badge access

• CCTV

• Guards

• Environmental controls

• Visitor management

Internal vs External Assessments

Internal Assessment

Performed by employees.

Advantages

• Lower cost

• Better knowledge

• Frequent assessments

Disadvantages

• Less objective

• Possible bias

External Assessment

Performed by independent experts.

Advantages

• Greater objectivity

• Industry expertise

• Regulatory acceptance

Disadvantages

• Higher cost

• Limited organizational knowledge

White Box, Gray Box, Black Box Testing

Frequently tested.

White Box

Tester receives

• Network diagrams

• Credentials

• Source code

• Architecture

Purpose

Deep security evaluation.

Gray Box

Tester receives limited information.

Most common commercial assessment.

Black Box

Tester starts with no knowledge.

Simulates an external attacker.

Security Metrics

Security cannot improve without measurement.

Good metrics are:

• Objective

• Measurable

• Repeatable

• Actionable

• Risk-based

Common Security Metrics

Examples include:

• Mean Time to Detect (MTTD)

• Mean Time to Respond (MTTR)

• Patch compliance percentage

• Critical vulnerabilities

• Failed login attempts

• Phishing success rate

• Incident response time

• Percentage of encrypted devices

KPIs vs KRIs

Frequently confused.

KPI

Measures performance.

Examples

• Systems patched within SLA

• Security awareness completion

• MFA deployment rate

KRI

Measures increasing risk.

Examples

• Critical vulnerabilities

• Unpatched systems

• Privileged accounts

• Third-party risks

Easy Memory Trick

KPI

Performance.

KRI

Risk.

Security Baselines

A baseline represents the minimum acceptable security configuration.

Examples

• CIS Benchmarks

• Microsoft Security Baselines

• NIST Secure Configuration Guides

Assessments compare systems against approved baselines.

Configuration Drift

Over time, systems deviate from approved configurations.

Causes include:

• Emergency changes

• Unauthorized modifications

• Software updates

• Human error

Continuous monitoring detects configuration drift before it becomes a significant risk.

Security Assessment Best Practices

✔ Define scope clearly.

✔ Obtain written authorization.

✔ Establish Rules of Engagement.

✔ Protect collected evidence.

✔ Minimize operational impact.

✔ Validate findings.

✔ Prioritize risks by business impact.

✔ Retest after remediation.

Common CISSP Exam Traps

Trap 1

Penetration testing always comes first.

Incorrect.

Perform a vulnerability assessment before attempting exploitation.

Trap 2

Audit and assessment are identical.

Incorrect.

Audits focus on compliance.

Assessments focus on overall security posture.

Trap 3

More vulnerabilities always mean higher risk.

Incorrect.

Risk depends on:

• Likelihood

• Impact

• Asset value

• Exposure

• Existing controls

Trap 4

Technical findings automatically become business risks.

Incorrect.

Business context determines risk.

Manager's Decision Framework

Before recommending any security assessment, ask:

1. What business objective are we supporting?

2. What risk are we evaluating?

3. What assessment method is most appropriate?

4. Will the assessment affect production?

5. Are the results actionable?

6. How will success be measured?

Domain 6 Memory Sheet

Remember

Assessment → Overall security posture

Audit → Compliance

Testing → Verify technical controls

Verification → Built correctly

Validation → Meets business needs

KPI → Performance

KRI → Risk

White Box → Full knowledge

Gray Box → Partial knowledge

Black Box → No knowledge

Due Care → Implement controls

Due Diligence → Verify controls

Baseline → Approved secure configuration

Configuration Drift → Deviation from baseline

Security Control Testing & Vulnerability Management

Security Control Testing Overview

Security controls must be continuously verified. Simply implementing a control does not guarantee it remains effective over time.

The primary goals of security control testing are to:

• Validate security control effectiveness.

• Identify weaknesses before attackers do.

• Ensure compliance with organizational policies and regulations.

• Reduce organizational risk.

• Improve the overall security posture.

Types of Security Controls

Administrative Controls

Administrative controls govern people and processes.

Examples:

• Security policies

• Standards

• Procedures

• Security awareness training

• Risk assessments

• Vendor security reviews

• Background checks

• Separation of duties

Testing Methods

• Policy review

• Interview personnel

• Documentation review

• Compliance verification

• Security awareness testing

Technical Controls

Technical controls protect systems using technology.

Examples

• Firewalls

• IDS/IPS

• MFA

• SIEM

• Encryption

• Endpoint Detection & Response (EDR)

• IAM

• DLP

Testing Methods

• Vulnerability scanning

• Configuration review

• Penetration testing

• Authentication testing

• Log analysis

• Secure configuration validation

Physical Controls

Protect facilities and physical assets.

Examples

• CCTV

• Badge systems

• Guards

• Locks

• Fences

• Biometrics

• Environmental monitoring

Testing Methods

• Physical inspection

• Access testing

• Tailgating exercises

• Badge audits

• Camera verification

• Disaster recovery inspections

Security Testing Lifecycle

Planning
      ↓
Scope Definition
      ↓
Authorization
      ↓
Rules of Engagement
      ↓
Information Gathering
      ↓
Testing
      ↓
Validation
      ↓
Reporting
      ↓
Remediation
      ↓
Retesting

Rules of Engagement (ROE)

Before any testing begins, organizations define Rules of Engagement.

A proper ROE includes:

• Scope

• Test schedule

• Allowed attack methods

• Restricted systems

• Emergency contacts

• Stop conditions

• Evidence handling

• Reporting procedures

Vulnerability Assessment

A vulnerability assessment identifies known weaknesses.

Purpose:

Examples

• Missing patches

• Weak configurations

• Default passwords

• Unsupported software

• Weak encryption

• Open ports

Vulnerability Assessment Process

Asset Discovery
      ↓
Scanning
      ↓
Validation
      ↓
Risk Prioritization
      ↓
Reporting
      ↓
Remediation
      ↓
Rescanning

Vulnerability Scanning

Automated tools compare systems against known vulnerabilities.

Common scanners include:

• Nessus

• Qualys VMDR

• Rapid7 InsightVM

• Microsoft Defender Vulnerability Management

• OpenVAS

• Tenable.sc

Authenticated vs Unauthenticated Scans

Exam Tip

Authenticated scans generally produce more comprehensive results.

False Positives vs False Negatives

False Positive

Scanner reports a vulnerability that does not exist.

Problem:

Wastes remediation effort.

False Negative

Scanner misses an actual vulnerability.

Problem:

Creates false confidence.

Vulnerability Prioritization

Not every vulnerability requires immediate remediation.

Prioritize based on:

• Business impact

• Asset value

• Likelihood of exploitation

• Threat intelligence

• Exposure

• Existing controls

• Regulatory requirements

Common Risk Scoring Inputs

Examples include:

• CVSS Base Score

• EPSS (Exploit Prediction Scoring System)

• CISA Known Exploited Vulnerabilities (KEV)

• Threat intelligence

• Internet exposure

• Critical business systems

Configuration Reviews

Configuration reviews compare systems against approved security baselines.

Examples:

• CIS Benchmarks

• Microsoft Security Baselines

• DISA STIGs

• Organizational standards

Common findings:

• Weak passwords

• Unnecessary services

• Open administrative ports

• Insecure protocols

• Default accounts

Penetration Testing

A penetration test attempts to exploit vulnerabilities to determine their real-world impact.

Purpose:

Penetration Testing Phases

Planning
      ↓
Reconnaissance
      ↓
Enumeration
      ↓
Vulnerability Identification
      ↓
Exploitation
      ↓
Privilege Escalation
      ↓
Post Exploitation
      ↓
Reporting

Vulnerability Assessment vs Penetration Testing

Remember

Assessment asks:

Pen Test asks:

Security Code Review

Application security includes reviewing source code.

Purpose:

• Detect coding flaws

• Improve software security

• Reduce vulnerabilities before production

Examples

• Injection flaws

• Authentication issues

• Authorization flaws

• Buffer overflows

• Race conditions

• Input validation errors

Static vs Dynamic Testing

Static Application Security Testing (SAST)

• Source code analysis

• No execution required

• Early SDLC

• Finds coding issues

Dynamic Application Security Testing (DAST)

• Tests running application

• Black-box approach

• Finds runtime issues

• Detects configuration weaknesses

Interactive Application Security Testing (IAST)

Combines

• SAST

• DAST

Provides runtime context while monitoring code execution.

Threat Modeling

Threat modeling identifies potential attack paths before implementation.

Common approaches:

• STRIDE

• PASTA

• Attack Trees

• MITRE ATT&CK mapping

Benefits:

• Early risk identification

• Secure design

• Reduced remediation cost

Security Architecture Review

Reviews whether security architecture aligns with:

• Business requirements

• Risk appetite

• Compliance

• Security principles

Examples

• Network segmentation

• IAM architecture

• Zero Trust

• Cloud security design

• Encryption architecture

Common Security Testing Deliverables

A professional report typically includes:

• Executive summary

• Scope

• Methodology

• Findings

• Risk ratings

• Evidence

• Business impact

• Recommended remediation

• Retest recommendations

Security Testing Best Practices

✔ Obtain written authorization.

✔ Minimize production impact.

✔ Validate scanner results.

✔ Prioritize business-critical assets.

✔ Document all findings.

✔ Protect collected evidence.

✔ Retest after remediation.

✔ Maintain confidentiality.

Common CISSP Exam Traps

Trap 1

Penetration testing replaces vulnerability scanning.

Incorrect.

Scanning identifies weaknesses first; penetration testing validates exploitability.

Trap 2

Highest CVSS always equals highest priority.

Incorrect.

Business context determines remediation priority.

Trap 3

Automated scanners eliminate the need for manual testing.

Incorrect.

Manual validation remains essential for accuracy and context.

Trap 4

Security testing ends when the report is delivered.

Incorrect.

Testing is complete only after remediation and verification.

Manager's Decision Framework

When choosing a testing approach, ask:

1. What business risk are we addressing?

2. Is automated scanning sufficient?

3. Is exploitation necessary to validate risk?

4. What is the potential impact on production?

5. How will findings be prioritized?

6. How will remediation be verified?

Domain 6 Memory Sheet

Administrative Controls

• Policies

• Procedures

• Awareness

• Governance

Technical Controls

• Firewalls

• MFA

• Encryption

• IDS/IPS

• SIEM

Physical Controls

• CCTV

• Locks

• Guards

• Biometrics

Vulnerability Assessment

• Identify

• Analyze

• Prioritize

Penetration Test

• Exploit

• Validate

• Demonstrate impact

SAST

• Static

• Source code

• Early SDLC

DAST

• Running application

• Runtime testing

IAST

• Hybrid static + dynamic

Security Audits, Compliance, Reporting & Continuous Assurance

Why Security Audits Matter

Security controls must not only work—they must also demonstrate compliance with:

• Laws

• Regulations

• Industry standards

• Internal policies

• Customer requirements

• Contractual obligations

An audit provides independent assurance that the organization is meeting these obligations.

Security Audit Objectives

A security audit determines whether:

• Security controls are properly implemented.

• Controls operate effectively.

• Policies are followed.

• Regulatory requirements are satisfied.

• Risks are appropriately managed.

• Evidence supports management's assertions.

Types of Audits

Internal Audit

Performed by the organization's internal audit function.

Purpose:

• Improve internal processes

• Evaluate compliance

• Prepare for external audits

Advantages

• Lower cost

• Frequent assessments

• Better organizational knowledge

Limitations

• Less independent

• Potential organizational bias

External Audit

Performed by independent third parties.

Purpose

• Regulatory compliance

• Customer assurance

• Certification

• Legal requirements

Examples

• ISO certification

• SOC examinations

• PCI DSS assessments

First-, Second-, and Third-Party Audits

Exam Tip

Third-party audits provide the highest level of independence.

Compliance vs Security

A common CISSP misconception.

Compliance

Answers:

Examples

• PCI DSS

• HIPAA

• SOX

• GDPR

Security

Answers:

An organization may be:

✔ Compliant

yet

✘ Not Secure

or

✔ Secure

yet

✘ Not Fully Compliant

Audit Lifecycle

Planning
      ↓
Define Scope
      ↓
Collect Evidence
      ↓
Interview Personnel
      ↓
Review Documentation
      ↓
Test Controls
      ↓
Analyze Findings
      ↓
Report Results
      ↓
Management Response
      ↓
Corrective Actions
      ↓
Follow-up Audit

Audit Planning

Planning determines:

• Objectives

• Scope

• Timeline

• Resources

• Standards

• Evidence required

• Sampling strategy

Good planning minimizes disruption to business operations.

Audit Scope

Defines:

Included

• Systems

• Networks

• Applications

• Facilities

• Business units

Excluded

• Out-of-scope assets

• Third-party systems

• Test environments (if specified)

Scope creep is a common audit risk.

Audit Evidence

Evidence supports audit conclusions.

Good evidence should be:

• Sufficient

• Reliable

• Relevant

• Objective

• Repeatable

Common Sources of Evidence

Examples include:

• Policies

• Procedures

• System configurations

• Access control lists

• Firewall rules

• Log files

• Change records

• Tickets

• Security awareness records

• Backup reports

• Risk registers

Types of Audit Evidence

Documentary

Examples

• Policies

• Standards

• Procedures

• Contracts

Physical

Examples

• Badge readers

• CCTV

• Locks

• Server rooms

Testimonial

Obtained through interviews.

Examples

• Administrators

• Managers

• Security personnel

Analytical

Generated through technical testing.

Examples

• Vulnerability scans

• Log analysis

• Configuration reviews

• Security dashboards

Sampling

Auditors rarely examine every record.

Instead, they use sampling.

Benefits

• Lower cost

• Faster

• Statistically valid

• Practical

Examples

• Random sampling

• Judgment sampling

• Statistical sampling

Observation vs Inspection vs Inquiry

Frequently tested.

Observation

Watching a process.

Example

Observe employee badge access.

Inspection

Examining evidence.

Example

Review firewall configuration.

Inquiry

Interviewing personnel.

Example

Ask administrator how privileged accounts are reviewed.

Audit Findings

Typical finding categories:

Critical

High

Medium

Low

Informational

Prioritization depends upon:

• Business impact

• Regulatory implications

• Likelihood

• Existing controls

Root Cause Analysis

A mature audit investigates:

Not only

"What happened?"

but

"Why did it happen?"

Common root causes:

• Weak processes

• Poor governance

• Lack of training

• Resource shortages

• Human error

• Inadequate monitoring

Corrective vs Preventive Actions

Corrective Action

Fixes existing problems.

Examples

• Patch vulnerability

• Remove excessive privileges

• Correct firewall rules

Preventive Action

Prevents recurrence.

Examples

• Improve change management

• Strengthen policy

• Additional automation

• Employee training

Compensating Controls

Sometimes primary controls cannot be implemented.

Examples

Cannot deploy MFA.

Alternative:

• Increased monitoring

• Stronger passwords

• Restricted network access

• Shorter session timeouts

Compensating controls reduce risk when primary controls are impractical.

Exception Management

Organizations occasionally accept temporary exceptions.

Good exception documentation includes:

• Business justification

• Risk assessment

• Approval

• Expiration date

• Compensating controls

• Review schedule

Security Reporting

Reports should be tailored to the audience.

Executive Report

Focus

• Risk

• Business impact

• Trends

• Budget implications

• Recommendations

Avoid excessive technical detail.

Technical Report

Focus

• Vulnerabilities

• Evidence

• Configuration details

• Logs

• Attack paths

• Remediation guidance

Regulatory Report

Focus

• Compliance

• Evidence

• Findings

• Required corrective actions

Effective Audit Report Structure

1. Executive Summary

2. Scope

3. Objectives

4. Methodology

5. Findings

6. Risk Ratings

7. Business Impact

8. Recommendations

9. Management Response

10. Follow-up Actions

Chain of Custody

Important when evidence may support legal or disciplinary action.

Chain of custody documents:

• Who collected evidence

• When it was collected

• Storage location

• Transfers

• Integrity verification

Maintaining chain of custody preserves evidence admissibility and credibility.

Security Governance Reporting

Executives typically care about:

• Risk trends

• Compliance status

• Critical vulnerabilities

• Incident trends

• Audit findings

• Third-party risks

• Budget priorities

They generally do not want detailed exploit information unless it directly affects business decisions.

Dashboard Metrics

Examples

Operational

• Patch compliance

• Vulnerability backlog

• Mean Time to Detect (MTTD)

• Mean Time to Respond (MTTR)

Governance

• Audit findings closed

• Policy compliance

• Risk acceptance

• Third-party assessment status

Continuous Assurance

Security is not a once-a-year activity.

Organizations require continuous assurance through:

• Continuous monitoring

• Automated scanning

• Threat intelligence

• Configuration management

• Log analysis

• Compliance dashboards

• Regular reassessments

Continuous Monitoring

Continuously evaluates:

• Security controls

• Configurations

• Vulnerabilities

• User activity

• Network traffic

• Compliance status

Benefits

• Faster detection

• Lower risk

• Improved resilience

• Better compliance

Common Continuous Monitoring Tools

Examples

• SIEM

• SOAR

• EDR/XDR

• Vulnerability Management Platforms

• Configuration Management Databases (CMDB)

• Cloud Security Posture Management (CSPM)

• Security Dashboards

Security Assessment Frequency

Not every control requires the same schedule.

Examples

Daily

• SIEM review

• Critical log monitoring

• Threat intelligence

Weekly

• Vulnerability scans

• Patch compliance

Monthly

• Privileged account review

• Configuration review

Quarterly

• Access recertification

• Risk assessment updates

Annually

• Full audit

• Disaster recovery exercise

• Penetration testing (or as required by risk/compliance)

Common CISSP Exam Traps

Trap 1

Audit equals penetration test.

Incorrect.

Audits evaluate compliance and governance.

Penetration testing evaluates exploitability.

Trap 2

Executives need technical details.

Incorrect.

Executives need business risk, trends, and strategic recommendations.

Trap 3

Collect as much evidence as possible.

Incorrect.

Collect evidence that is relevant, reliable, sufficient, and appropriate.

Trap 4

Audit ends after the report is issued.

Incorrect.

Management responses, corrective actions, and follow-up verification complete the audit cycle.

Memory Sheet

Audit

• Compliance

• Evidence

• Independence

Assessment

• Security posture

• Risk

• Controls

Evidence

• Documentary

• Physical

• Testimonial

• Analytical

Sampling

• Random

• Statistical

• Judgment

Corrective Action

• Fix current issue

Preventive Action

• Prevent recurrence

Compensating Control

• Alternative safeguard

Chain of Custody

• Preserve evidence integrity

Executive Report

• Risk

• Trends

• Business impact

Technical Report

• Evidence

• Vulnerabilities

• Remediation

CISSP Exam Tips

• Independence strengthens audit credibility—third-party audits provide the greatest assurance.

• Compliance does not automatically equal security. An organization can satisfy a standard while still having significant residual risk.

• Collect only evidence that is sufficient, relevant, and reliable. More evidence is not always better.

• Tailor reports to the audience. Executives need business-focused summaries; technical teams need implementation details.

• A mature security program emphasizes continuous assurance, using monitoring and follow-up activities rather than relying solely on annual audits.

Key Takeaways

• Audits provide independent assurance that security controls, policies, and regulatory obligations are being met.

• Evidence quality is fundamental—findings must be based on objective, reliable, and sufficient information.

• Corrective actions fix current problems; preventive actions reduce the chance of recurrence.

• Reporting should be audience-specific, translating technical findings into meaningful business decisions.

• Continuous assurance—through monitoring, reassessment, and follow-up—is the hallmark of a mature security program and a recurring theme throughout the CISSP exam.

Continuous Security Monitoring, Logging, Threat Hunting & Security Operations

Continuous Security Monitoring (CSM)

Continuous Security Monitoring (CSM) is the ongoing collection, analysis, and reporting of security-related information to maintain awareness of an organization's security posture.

Unlike annual audits or quarterly assessments, continuous monitoring provides real-time or near-real-time visibility into changing risks.

Objectives

• Detect attacks quickly

• Identify configuration drift

• Monitor control effectiveness

• Support compliance

• Improve incident response

• Reduce organizational risk

Continuous Monitoring Lifecycle

Collect
      ↓
Normalize
      ↓
Correlate
      ↓
Analyze
      ↓
Alert
      ↓
Investigate
      ↓
Respond
      ↓
Recover
      ↓
Improve

Continuous monitoring is a feedback loop rather than a one-time process.

Security Monitoring Architecture

A mature monitoring program typically includes:

• Endpoints

• Servers

• Network devices

• Firewalls

• IDS/IPS

• Cloud services

• Identity systems

• Applications

• Databases

• Threat Intelligence

• SIEM

• SOAR

All telemetry ultimately feeds centralized analysis.

Security Information and Event Management (SIEM)

A SIEM collects, normalizes, correlates, and analyzes security logs from multiple sources.

Primary Functions

• Log aggregation

• Event correlation

• Alert generation

• Dashboard reporting

• Compliance reporting

• Threat detection

• Forensic support

Examples

• Microsoft Sentinel

• Splunk Enterprise Security

• IBM QRadar

• Google Chronicle

• Elastic Security

Log Management

Logs are among the most valuable sources of security evidence.

Common Log Sources

Network

• Firewalls

• Routers

• Switches

• VPNs

Systems

• Windows Event Logs

• Linux Syslog

• Authentication logs

• Application logs

Security

• IDS/IPS

• Antivirus

• EDR

• IAM

• DLP

Cloud

• AWS CloudTrail

• Azure Activity Logs

• Microsoft 365

• Google Cloud Logging

What Makes a Good Log?

A useful log should contain:

• Timestamp

• Source

• Destination

• User

• Event

• Action

• Result

• Severity

Time Synchronization

One of the most overlooked topics.

Without synchronized clocks:

• Incident timelines become inaccurate.

• Correlation becomes difficult.

• Forensics becomes unreliable.

Organizations should synchronize systems using:

• NTP

• Secure NTP sources

• Authenticated time services

Log Retention

Retention depends upon:

• Regulations

• Business needs

• Legal requirements

• Storage capacity

Examples

• PCI DSS

• HIPAA

• SOX

• Organizational policy

Security Event vs Security Incident

Frequently tested.

Security Event

Any observable occurrence.

Examples

• Successful login

• File opened

• Service started

Security Incident

An event that threatens:

• Confidentiality

• Integrity

• Availability

Examples

• Malware infection

• Data breach

• Unauthorized access

• Privilege escalation

Indicators

Indicator of Compromise (IOC)

Evidence an attack has occurred.

Examples

• Malicious IP

• Malware hash

• Suspicious domain

• Registry modification

IOCs are reactive.

Indicator of Attack (IOA)

Behavior suggesting an attack is in progress.

Examples

• Credential dumping

• PowerShell abuse

• Lateral movement

• Privilege escalation

IOAs provide earlier detection.

Security Orchestration, Automation and Response (SOAR)

SOAR automates repetitive security operations.

Typical capabilities:

• Alert triage

• Playbooks

• Ticket creation

• Threat enrichment

• Automated containment

• Case management

Benefits

• Faster response

• Reduced analyst workload

• Consistent processes

Endpoint Detection and Response (EDR)

EDR continuously monitors endpoint behavior.

Capabilities

• Process monitoring

• Memory analysis

• Behavioral detection

• Isolation

• Threat hunting

• Rollback

Examples

• CrowdStrike Falcon

• Microsoft Defender for Endpoint

• SentinelOne

• Sophos Intercept X

Extended Detection and Response (XDR)

XDR extends visibility beyond endpoints.

Combines

• Endpoint

• Network

• Identity

• Email

• Cloud

• Applications

Provides unified detection.

User and Entity Behavior Analytics (UEBA)

UEBA identifies abnormal behavior.

Examples

• Impossible travel

• Privilege abuse

• Excessive downloads

• Insider threats

• Unusual login times

Uses machine learning to establish behavioral baselines.

Threat Intelligence

Threat intelligence helps prioritize defensive efforts.

Common sources

• Commercial feeds

• Government advisories

• ISACs

• Open-source intelligence (OSINT)

• Vendor intelligence

Intelligence Types

Strategic

Executive level.

Focus:

Business risk.

Tactical

Attacker techniques.

Examples

• MITRE ATT&CK

• TTPs

Operational

Specific campaigns.

Example

Nation-state activity.

Technical

Machine-readable.

Examples

• Hashes

• Domains

• IP addresses

Threat Hunting

Threat hunting proactively searches for hidden threats.

Unlike alerts, hunters assume attackers may already exist.

Typical process

Hypothesis
      ↓
Collect Data
      ↓
Analyze
      ↓
Investigate
      ↓
Contain
      ↓
Improve Detection

Purple Teaming

Combines

Red Team

Blue Team

Purpose

Improve detection and response.

Red Team

Simulates attackers.

Focus

Offensive capability.

Blue Team

Defends systems.

Focus

Detection

Response

Recovery

Purple Team

Collaborative improvement.

Goal

Better security—not competition.

Security Dashboards

Executives require meaningful metrics.

Examples

• Critical vulnerabilities

• Incident trends

• Patch compliance

• Mean Time to Detect

• Mean Time to Respond

• Phishing success rate

• Risk score

• Compliance score

Mean Time Metrics

MTTD

Mean Time to Detect

Lower is better.

MTTR

Mean Time to Respond

Lower is better.

MTTC

Mean Time to Contain

Measures containment speed.

MTTR (Recovery)

Sometimes used as

Mean Time to Recover.

Understand the context.

Security Metrics

Good metrics should be

• Objective

• Actionable

• Repeatable

• Meaningful

• Risk-focused

Avoid vanity metrics.

Configuration Drift Monitoring

Systems change continuously.

Examples

• Unauthorized firewall changes

• New administrator accounts

• Open ports

• Disabled logging

Continuous monitoring identifies drift rapidly.

Cloud Security Monitoring

Monitor

• IAM changes

• Public storage

• Encryption

• Security groups

• CloudTrail

• Activity logs

• API usage

Security Operations Center (SOC)

The SOC continuously monitors the enterprise.

Responsibilities

• Monitor alerts

• Investigate incidents

• Threat hunting

• Malware analysis

• Escalation

• Reporting

SOC Tiers

Tier 1

Alert triage.

Tier 2

Investigation.

Tier 3

Advanced analysis.

Threat hunting.

Digital Forensics Support

Monitoring assists investigations through:

• Log preservation

• Timeline reconstruction

• Chain of custody

• Evidence collection

Continuous Improvement

Every incident should improve security.

Lessons learned should update:

• Policies

• Detection rules

• Playbooks

• Monitoring

• Awareness

• Risk assessments

Common CISSP Exam Traps

Trap 1

SIEM prevents attacks.

Incorrect.

SIEM detects and correlates events.

It does not prevent attacks.

Trap 2

Every alert is an incident.

Incorrect.

Many alerts become false positives.

Trap 3

Threat hunting waits for alerts.

Incorrect.

Threat hunting is proactive.

Trap 4

More logs always improve security.

Incorrect.

Collect meaningful logs that support detection and investigation.

Trap 5

Automation replaces analysts.

Incorrect.

SOAR augments analysts; it does not replace human judgment.

Memory Sheet

SIEM

• Collect

• Correlate

• Analyze

SOAR

• Automate

• Orchestrate

• Respond

EDR

• Endpoint visibility

XDR

• Cross-platform visibility

IOC

• Evidence attack occurred

IOA

• Behavior indicates attack

Threat Hunting

• Proactive

UEBA

• Behavior analytics

MTTD

• Detect

MTTR

• Respond/Recover

SOC

• Continuous monitoring

Exam Tips

• Continuous monitoring provides assurance between formal assessments and audits.

• SIEM improves visibility, but skilled analysts are still essential for investigation and decision-making.

• Threat hunting is proactive; incident response is reactive.

• Behavior-based detection (IOAs, UEBA) often identifies sophisticated attacks earlier than signature-based indicators alone.

• Executives care about trends, business impact, and improvement—not raw alert counts.

Key Takeaways

• Continuous Security Monitoring provides ongoing visibility into the effectiveness of security controls and evolving threats.

• SIEM, SOAR, EDR, XDR, and UEBA are complementary technologies that enhance detection, investigation, and response.

• Threat hunting proactively searches for hidden adversaries rather than waiting for alerts.

• Meaningful metrics—such as MTTD, MTTR, and risk trends—help leadership evaluate security program performance.

• A mature security program continuously improves by feeding lessons learned from monitoring and incidents back into governance, architecture, detection, and response processes.

Final Review • Exam Strategy • Decision Framework • CISSP Memory Sheet

Domain 6 in One Sentence

Domain 6 Master Framework

Security Program
        │
        ▼
Security Controls
        │
        ▼
Assessment
        │
        ▼
Testing
        │
        ▼
Audit
        │
        ▼
Reporting
        │
        ▼
Remediation
        │
        ▼
Continuous Monitoring
        │
        ▼
Continuous Improvement

Top CISSP Domain 6 Facts

Security Assessment

✓ Assessment evaluates overall security posture.

✓ Audit measures compliance.

✓ Testing validates technical controls.

✓ Assessment is broader than testing.

✓ Assessments support risk management.

✓ Assessments should be risk-based.

✓ Assessments require management authorization.

✓ Assessments should be repeatable.

✓ Assessments should be documented.

✓ Findings require remediation verification.

Verification vs Validation

Verification

Validation

Due Care

Implement security.

Due Diligence

Verify security continues working.

Vulnerability Assessment

Purpose

Identify vulnerabilities.

Not exploitation.

Penetration Testing

Purpose

Demulate realistic attacks.

Validate exploitability.

Vulnerability Assessment comes BEFORE Pen Test

One of the most tested CISSP concepts.

White Box

Complete knowledge.

Gray Box

Partial knowledge.

Black Box

No knowledge.

Most realistic.

False Positive

Problem does NOT exist.

False Negative

Problem exists but scanner missed it.

More dangerous.

Administrative Controls

Policies

Training

Governance

Procedures

Technical Controls

Firewalls

IDS

IPS

MFA

Encryption

SIEM

EDR

Physical Controls

Locks

CCTV

Biometrics

Guards

Lighting

Audits

Internal

External

First Party

Second Party

Third Party

Third Party

Most independent.

Highest assurance.

Compliance

Meeting requirements.

Security

Protecting business.

Not always identical.

Evidence

Must be

Reliable

Relevant

Objective

Repeatable

Sufficient

Sampling

Improves efficiency.

Not every item requires inspection.

Corrective Action

Fix existing issue.

Preventive Action

Prevent recurrence.

Compensating Controls

Alternative safeguards.

Chain of Custody

Preserve evidence integrity.

SIEM

Collect

Correlate

Analyze

Alert

SOAR

Automate response.

EDR

Endpoint visibility.

XDR

Enterprise visibility.

UEBA

Behavior analytics.

IOC

Evidence attack occurred.

IOA

Evidence attack is occurring.

Threat Hunting

Proactive.

SOC

Continuous monitoring.

MTTD

Detection speed.

MTTR

Response speed.

Continuous Monitoring

Ongoing assurance.

High-Value Comparison Tables

Assessment vs Audit vs Testing

Vulnerability Assessment vs Pen Test

Verification vs Validation

Due Care vs Due Diligence

KPI vs KRI

White vs Gray vs Black Box

Event vs Incident

IOC vs IOA

SIEM vs SOAR

Internal vs External Audit

CISSP Manager Decision Trees

Which Assessment?

Need compliance?

↓

Audit

Need security posture?

↓

Assessment

Need technical verification?

↓

Testing

Need exploit validation?

↓

Penetration Test

Need identify weaknesses?

↓

Vulnerability Assessment

Which Report?

Executive?

↓

Business risk.

Technical Team?

↓

Evidence.

Compliance?

↓

Regulations.

Board?

↓

Strategic trends.

CISSP Memory Palace

Imagine walking through a secure building:

Lobby → Assessment

Reception → Audit

Security Guard → Testing

Metal Detector → Verification

Manager's Office → Validation

Camera Room → Continuous Monitoring

SOC → SIEM

Automation Console → SOAR

Server Room → EDR

Executive Boardroom → Reporting

Exit Door → Lessons Learned

This sequence mirrors the lifecycle from evaluation through continuous improvement.

Manager's Mindset

Always ask:

• Does this reduce business risk?

• Is it authorized?

• Is it documented?

• Is it measurable?

• Is it repeatable?

• Does it improve security?

• Does it support business objectives?