Study ISC2 CISSP Security Operations: key concepts, common traps, and exam decision cues.
This domain tests whether you can run security under stress. CISSP wants operational decisions that preserve evidence, contain impact, restore service responsibly, and keep people and facilities safe.
| Lesson | Focus |
|---|---|
| 7.1 Incident Response | Learn how the exam orders detection, containment, investigation, and evidence preservation. |
| 7.2 Recovery & Resilience | Learn how CISSP tests recovery targets, site options, safety controls, and resilience planning. |
| If the question is really about… | Go first to… |
|---|---|
| incident phases, chain of custody, forensics, or evidence quality | 7.1 Incident Response |
| backups, DR sites, RTO/RPO, operational continuity, or physical protections | 7.2 Recovery & Resilience |