Préparation CISSP · Exam Outline ISC2 2024

Réussir le CISSP
du premier coup

Le guide complet de préparation au CISSP, en français : cours des huit domaines, examens blancs, drills et référentiel — plus de 1 200 questions corrigées.

Contenu: 30 chapitres · 8 domaines
Entraînement: Plus de 1 200 questions corrigées
Langue: Cours en français · questions en anglais

Commencer le chapitre 0 → · Télécharger le livre en PDF

Par Abdoulaye Dembélé — Directeur des Systèmes d'Information & RSSI

Partie IFondations

Partie IILes huit domaines

Partie IIIRévision et entraînement final

CouvertureCorrespondance avec l'Exam Outline ISC2 2024

Les 62 objectifs du CISSP Detailed Content Outline ISC2 (en vigueur depuis le 15 avril 2024), et le chapitre qui traite chacun. Couverture vérifiée : 62/62.

Domaine 1 · Security and Risk Management16%

1.1	Understand, adhere to, and promote professional ethics	ch. 1
1.2	Understand and apply security concepts	ch. 1
1.3	Evaluate and apply security governance principles	ch. 1
1.4	Understand legal, regulatory, and compliance issues that pertain to information security in a holistic context	ch. 1
1.5	Understand requirements for investigation types (i.e., administrative, criminal, civil, regulatory, industry standards)	ch. 2
1.6	Develop, document, and implement security policy, standards, procedures, and guidelines	ch. 2
1.7	Identify, analyze, assess, prioritize, and implement Business Continuity (BC) requirements	ch. 2
1.8	Contribute to and enforce personnel security policies and procedures	ch. 2
1.9	Understand and apply risk management concepts	ch. 3
1.10	Understand and apply threat modeling concepts and methodologies	ch. 3
1.11	Apply Supply Chain Risk Management (SCRM) concepts	ch. 3
1.12	Establish and maintain a security awareness, education, and training program	ch. 3

Domaine 2 · Asset Security10%

2.1	Identify and classify information and assets	ch. 4
2.2	Establish information and asset handling requirements	ch. 4
2.3	Provision information and assets securely	ch. 4
2.4	Manage data lifecycle	ch. 4
2.5	Ensure appropriate asset retention (e.g., End of Life (EOL), End of Support)	ch. 5
2.6	Determine data security controls and compliance requirements	ch. 5

Domaine 3 · Security Architecture and Engineering13%

3.1	Research, implement and manage engineering processes using secure design principles	ch. 6
3.2	Understand the fundamental concepts of security models (e.g., Biba, Star Model, Bell-LaPadula)	ch. 6
3.3	Select controls based upon systems security requirements	ch. 6
3.4	Understand security capabilities of Information Systems (IS) (e.g., memory protection, TPM, encryption/decryption)	ch. 6
3.5	Assess and mitigate the vulnerabilities of security architectures, designs, and solution elements	ch. 7
3.6	Select and determine cryptographic solutions	ch. 8
3.7	Understand methods of cryptanalytic attacks	ch. 8
3.8	Apply security principles to site and facility design	ch. 9
3.9	Design site and facility security controls	ch. 9
3.10	Manage the information system lifecycle	ch. 9

Domaine 4 · Communication and Network Security13%

4.1	Apply secure design principles in network architectures	ch. 10 · ch. 11
4.2	Secure network components	ch. 12
4.3	Implement secure communication channels according to design	ch. 12

Domaine 5 · Identity and Access Management (IAM)13%

5.1	Control physical and logical access to assets	ch. 13
5.2	Design identification and authentication strategy (e.g., people, devices, and services)	ch. 13
5.3	Federated identity with a third-party service	ch. 14
5.4	Implement and manage authorization mechanisms	ch. 14
5.5	Manage the identity and access provisioning lifecycle	ch. 15
5.6	Implement authentication systems	ch. 15

Domaine 6 · Security Assessment and Testing12%

6.1	Design and validate assessment, test, and audit strategies	ch. 16
6.2	Conduct security control testing	ch. 16
6.3	Collect security process data (e.g., technical and administrative)	ch. 17
6.4	Analyze test output and generate report	ch. 17
6.5	Conduct or facilitate security audits	ch. 17

Domaine 7 · Security Operations13%

7.1	Understand and comply with investigations	ch. 18
7.2	Conduct logging and monitoring activities	ch. 19
7.3	Perform Configuration Management (CM) (e.g., provisioning, baselining, automation)	ch. 19
7.4	Apply foundational security operations concepts	ch. 19
7.5	Apply resource protection	ch. 19
7.6	Conduct incident management	ch. 19
7.7	Operate and maintain detection and preventative measures	ch. 19
7.8	Implement and support patch and vulnerability management	ch. 20
7.9	Understand and participate in change management processes	ch. 20
7.10	Implement recovery strategies	ch. 20
7.11	Implement Disaster Recovery (DR) processes	ch. 20
7.12	Test Disaster Recovery Plans (DRP)	ch. 20
7.13	Participate in Business Continuity (BC) planning and exercises	ch. 21
7.14	Implement and manage physical security	ch. 21
7.15	Address personnel safety and security concerns	ch. 21

Domaine 8 · Software Development Security10%

8.1	Understand and integrate security in the Software Development Life Cycle (SDLC)	ch. 22
8.2	Identify and apply security controls in software development ecosystems	ch. 22
8.3	Assess the effectiveness of software security	ch. 23
8.4	Assess security impact of acquired software	ch. 23
8.5	Define and apply secure coding guidelines and standards	ch. 23

Comment utiliser ce livre

Suivre les chapitres dans l'ordre, au rythme du plan de 8 semaines détaillé au chapitre 0 (§ 0.5).
Jalon de progression : ≥ 80 % à chaque quiz avant de passer au chapitre suivant.
Le chapitre 24 est l'aide-mémoire des 7 derniers jours ; le chapitre 29 sert au re-drill ciblé après les examens blancs.
Chaque page s'imprime proprement (Cmd+P) pour réviser sur papier.

À propos de l'auteur

Abdoulaye Dembélé est Directeur des Systèmes d'Information et RSSI, membre de comité de direction. En quinze ans, il a dirigé et sécurisé des systèmes d'information critiques dans la santé, la protection sociale, les finances publiques et la banque — de la création d'une DSI (Carte Blanche Partenaires) à la doctrine API de la DGFiP, en passant par la transformation digitale d'un groupe de protection sociale (Audiens). Titulaire d'un Master of Science in Information Technology (SUPINFO Paris / London), il prépare les certifications CISSP et CISM. Il a écrit ce guide au fil de sa propre préparation.

abdoulayedembele.com · LinkedIn