Overview
Protection of Information Assets covers the security controls an IS auditor evaluates. Its 15 sub-topics span asset security and control (security frameworks and standards, physical and environmental controls, identity and access management, network and end-point security, data loss prevention, encryption, public key infrastructure, cloud and virtualized environments, and mobile, wireless and IoT devices) and security event management (awareness training, attack methods, security testing, security monitoring, incident response, and evidence collection and forensics).
Candidates must understand each control well enough to judge whether it fits the risk and whether it actually operates, without needing to configure it. Data classification and ownership from Domain 2 decide how much protection each asset needs, and the logs and incident processes from Domain 4 feed the monitoring and response covered here. The audit methods of Domain 1 apply directly to access reviews, security testing and forensic evidence.
How it's tested
Questions describe a security arrangement, an attack or an incident and ask for the BEST control, the GREATEST risk, or what to do FIRST. Several options are real security measures; the right one addresses the specific threat or weakness in the scenario and, where relevant, preserves evidence or business ownership. Some questions test precise technical facts such as key usage.
-
Control-to-threat fit
Several controls are offered for one threat. Choose the control that directly addresses the stated risk, such as nonrepudiation needing a digital signature, not encryption.
-
Ownership and least privilege
Access scenarios ask who approves, reviews or removes access. Data owners approve and review; security administrators implement.
-
Incident and evidence sequence
Response scenarios test order: contain before eradicating, preserve evidence before analysis, involve legal before evidence is handled for prosecution.
Ransomware is spreading across a file server, and options include restoring from backup, isolating affected systems, notifying law enforcement or running a full scan. Reasoning: the incident is active, so the first priority is containment to stop further damage. Restoration comes after eradication, notification follows the response plan, and scanning while the malware spreads leaves more systems exposed. Isolation is the first action.
Sub-topics 15
Official sub-topics from the ISACA outline, in outline order.
5.1 Information Asset Security Frameworks, Standards, and GuidelinesUsing recognized frameworks to structure and assess an information security program.
- What it means
- Frameworks and standards such as ISO/IEC 27001 (requirements for an information security management system), ISO/IEC 27002 (control guidance), the NIST Cybersecurity Framework and the CIS Controls give organizations a structured, auditable basis for their security program.
- What to understand
- The organization selects and tailors a framework to its risk and regulatory needs; the auditor checks that the security policy, controls and metrics follow from it and that roles such as the information security manager are defined. Frameworks also provide criteria the auditor can test against.
- How it shows up
- A question asks what should guide control selection in a new security program; a risk assessment applied through a recognized framework is the answer, not a list of popular tools.
- Common confusion
- Treating ISO/IEC 27002 as certifiable; certification is against ISO/IEC 27001, while 27002 provides control guidance.
5.2 Physical and Environmental ControlsProtecting facilities and equipment from unauthorized access and environmental hazards.
- What it means
- Physical controls include perimeter security, badge and biometric entry, mantraps or access vestibules, guards, visitor logs and video surveillance. Environmental controls include uninterruptible power supplies, generators, cooling, humidity control, water detection and fire detection and suppression.
- What to understand
- Fire suppression choice matters: clean gaseous agents protect equipment and are safe for people at design concentration, dry-pipe and pre-action sprinklers reduce accidental water discharge, and wet-pipe sprinklers are reliable but risk water damage. Access to computer rooms should be limited to those who need it and reviewed regularly.
- How it shows up
- A scenario asks which fire suppression system BEST protects a data center while minimizing equipment damage, or the greatest concern with tailgating at an entrance.
- Common confusion
- Choosing a wet-pipe system for a data center because it is most reliable; pre-action systems are preferred because they require two triggers before water flows.
5.3 Identity and Access ManagementIdentification, authentication, authorization and the access life cycle.
- What it means
- Identity and access management (IAM) establishes who a user is (identification), proves it (authentication with something you know, have or are), decides what they may do (authorization) and manages accounts from provisioning through change to removal.
- What to understand
- Access follows least privilege and need-to-know, is approved by the data owner, and is reviewed periodically by owners. Privileged accounts need extra controls such as vaulting, session recording and just-in-time elevation. For biometrics, the false acceptance rate is the key security measure, and a lower crossover error rate means a more accurate system overall.
- How it shows up
- A question asks who should perform periodic access reviews or what the greatest risk is in an IAM process; owner reviews and timely removal at termination are frequent answers.
- Common confusion
- Treating the security administrator as the approver of access; they implement what the owner approves.
5.4 Network and End-Point SecurityFirewalls, segmentation, intrusion detection, remote access and endpoint protection.
- What it means
- Network security uses firewalls (packet filtering, stateful inspection, application-level proxies and next-generation firewalls), segmentation and demilitarized zones, intrusion detection and prevention systems, and encrypted virtual private networks. Endpoint security hardens devices and uses anti-malware and endpoint detection and response tools.
- What to understand
- Firewall rule sets should deny by default, be reviewed periodically and be changed only through change management. Segmentation limits lateral movement after a breach, and zero trust approaches verify each access request rather than trusting network location.
- How it shows up
- A scenario shows a flat network where a compromised workstation can reach the payment database and asks for the best recommendation, which is network segmentation.
- Common confusion
- Assuming an intrusion detection system blocks attacks; detection systems alert, while prevention systems sit inline and can block.
5.5 Data Loss PreventionDetecting and preventing unauthorized movement of sensitive data.
- What it means
- Data loss prevention (DLP) tools discover sensitive data at rest, monitor it in use on endpoints, and inspect it in motion across networks, email and cloud services, applying policies to alert, block or encrypt.
- What to understand
- DLP depends on data classification and defined policies; without knowing what is sensitive, rules either miss data or flood staff with false positives. Deployment usually starts in monitoring mode, is tuned, then moves to blocking, and alerts need an owner to respond.
- How it shows up
- A question asks what must be in place before DLP can be effective; a data classification scheme and inventory of sensitive data is the answer.
- Common confusion
- Expecting DLP to stop a determined insider completely; it reduces accidental and careless leakage and raises detection, but encryption, access control and monitoring are still needed.
5.6 Data EncryptionSymmetric and asymmetric encryption, hashing, digital signatures and key management.
- What it means
- Symmetric encryption, such as AES, uses one shared key and is fast for bulk data. Asymmetric encryption, such as RSA or elliptic curve cryptography, uses a public and private key pair. Hashing produces a fixed-length digest that shows whether data changed. A digital signature is a hash encrypted with the sender's private key.
- What to understand
- To send confidentially, encrypt with the recipient's public key; to sign, use the sender's private key, and the recipient verifies with the sender's public key. Signatures provide integrity, authentication and nonrepudiation but not confidentiality. Key management, including generation, storage, rotation and destruction, is the most critical part of any encryption scheme.
- How it shows up
- A question asks which key is used to create a digital signature or to ensure only the recipient can read a message.
- Common confusion
- Saying the sender encrypts with its own public key for confidentiality, or believing a hash alone proves who sent the data.
5.7 Public Key InfrastructureCertificate authorities, registration authorities and certificate life cycle.
- What it means
- Public key infrastructure (PKI) binds public keys to identities through digital certificates issued by a certificate authority (CA). A registration authority (RA) verifies the requester's identity before the CA issues a certificate, and revoked certificates are published through revocation lists or online status checks.
- What to understand
- Trust in the whole PKI depends on protecting the CA's private key, typically in a hardware security module, and on rigorous identity verification at registration. Relying parties must check certificate validity, including expiry and revocation status, before trusting it.
- How it shows up
- A scenario asks for the greatest risk in a PKI or the role that verifies identity; compromise of the CA private key and the RA's verification role are frequent answers.
- Common confusion
- Thinking the CA verifies identity in every design; many separate that task into a registration authority.
5.8 Cloud and Virtualized EnvironmentsShared responsibility, hypervisor security and cloud governance.
- What it means
- Cloud services follow infrastructure, platform and software service models with a shared responsibility model: the provider secures more of the stack as you move from infrastructure toward software as a service. Virtualization runs multiple virtual machines on a hypervisor that controls their isolation.
- What to understand
- The customer always remains responsible for its data, identities and access configuration, even in software as a service. Hypervisor compromise affects every guest, so management interfaces need strong access control, and virtual machine sprawl creates unpatched, unmonitored systems. Data location and provider assurance reports matter for compliance.
- How it shows up
- A question asks who is responsible for configuring user access in a software-as-a-service application; the customer is, regardless of the provider's security.
- Common confusion
- Assuming moving to the cloud transfers all security responsibility to the provider.
5.9 Mobile, Wireless, and Internet-of-Things DevicesSecuring mobile endpoints, wireless networks and connected devices.
- What it means
- Mobile device management enforces policies such as encryption, passcodes, remote wipe and separation of business and personal data on corporate and personal devices. Wireless security relies on strong protocols such as WPA3 or WPA2-Enterprise with individual authentication. Internet-of-Things devices are often hard to patch and ship with default credentials.
- What to understand
- Because mobile devices are easily lost or stolen, device encryption and remote wipe are key controls. Rogue access points can bypass perimeter controls. IoT devices should be inventoried, have default credentials changed and be placed on segmented networks.
- How it shows up
- A scenario shows staff using personal phones for company email and asks for the BEST control; mobile device management with containerization and remote wipe is the usual answer.
- Common confusion
- Relying on hiding the wireless network name as a security control; it is easily discovered and offers little protection.
5.10 Security Awareness Training and ProgramsBuilding secure behavior through training, testing and measurement.
- What it means
- Awareness programs teach staff to recognize and report threats such as phishing and social engineering, delivered at onboarding, periodically and by role, and reinforced through simulations and communication.
- What to understand
- Program effectiveness is measured by behavior, such as phishing simulation click and report rates and the number of incidents reported, not by course completion alone. Content should be updated as threats change and tailored to roles such as administrators or finance staff.
- How it shows up
- A question asks for the BEST indicator that an awareness program is effective; a rise in staff reporting of suspicious emails or a fall in simulation failures beats completion percentages.
- Common confusion
- Treating a 100% training completion rate as proof the program works.
5.11 Information System Attack Methods and TechniquesCommon attacks and the controls that address them.
- What it means
- Attacks include phishing and social engineering, malware and ransomware, denial of service, injection attacks such as SQL injection, cross-site scripting, man-in-the-middle interception, password attacks, privilege escalation and supply chain compromise.
- What to understand
- Map each attack to its main control: input validation and parameterized queries for SQL injection, output encoding for cross-site scripting, multi-factor authentication for credential theft, offline backups and segmentation for ransomware, and encrypted, authenticated sessions for interception.
- How it shows up
- A scenario describes an attack's symptoms and asks which control would have prevented it.
- Common confusion
- Choosing a firewall to stop SQL injection; it travels over permitted web traffic, so input validation in the application is the effective control.
5.12 Security Testing Tools and TechniquesVulnerability scanning, penetration testing and configuration review.
- What it means
- Vulnerability scanning automatically identifies known weaknesses; penetration testing actively exploits weaknesses to show real impact; configuration reviews compare settings with baselines. Tests can be black box (no prior knowledge), gray box or white box (full knowledge).
- What to understand
- Penetration tests require written authorization and agreed rules of engagement defining scope, timing and limits before they start. Scanning is frequent and broad, penetration testing is periodic and deep, and results must be validated for false positives and tracked to remediation.
- How it shows up
- A question asks what is MOST important before a penetration test begins; formal management authorization and defined scope is the answer.
- Common confusion
- Treating a clean vulnerability scan as proof a system cannot be compromised; scans find known issues, not logic flaws or chained attacks.
5.13 Security Monitoring Tools and TechniquesSIEM, intrusion detection, behavioral analytics and alert handling.
- What it means
- Security monitoring collects events from systems, networks and applications into tools such as a security information and event management (SIEM) platform, correlates them to detect attacks, and routes alerts to analysts, often in a security operations center.
- What to understand
- Monitoring only works if relevant sources are connected, rules are tuned to reduce false positives, alerts have owners and response times, and coverage is reviewed as systems change. User and entity behavior analytics detect unusual activity that signature rules miss.
- How it shows up
- A scenario shows a SIEM generating thousands of unreviewed alerts and asks for the greatest concern; the risk is that real attacks go unnoticed.
- Common confusion
- Equating log collection with monitoring; collection without correlation, tuning and response is not effective detection.
5.14 Security Incident Response ManagementPreparing for, detecting, containing and recovering from security incidents.
- What it means
- Incident response follows phases such as preparation, detection and analysis, containment, eradication, recovery and post-incident review. A documented plan defines roles, escalation, communication, legal and regulatory notification, and coordination with continuity plans.
- What to understand
- Containment comes before eradication and recovery, to limit damage. Preparation, including a trained team and tested plan, has the greatest effect on response quality. Lessons learned feed improvements to controls and the plan.
- How it shows up
- Questions ask what to do FIRST after confirming an active intrusion; containment, while preserving evidence, is the usual answer.
- Common confusion
- Jumping to restoration from backup before the threat is contained and eradicated, which can lead to reinfection.
5.15 Evidence Collection and ForensicsPreserving and analyzing digital evidence so it remains admissible.
- What it means
- Digital forensics identifies, preserves, collects, analyzes and reports on evidence. Investigators take bit-stream images using write blockers, compute hash values to prove integrity, and work on copies rather than originals.
- What to understand
- Chain of custody documents every person who handled evidence, when and why, so it can be relied on in legal proceedings. Volatile data such as memory is collected before less volatile data, following the order of volatility. Legal counsel should be involved early when prosecution or litigation is possible.
- How it shows up
- A question asks what is MOST important to ensure evidence is admissible; maintaining chain of custody and integrity through hashing is the answer.
- Common confusion
- Analyzing the original drive directly or shutting a system down before capturing volatile memory, which can destroy evidence.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Digital signature key usage
The sender hashes the message and encrypts the hash with its own private key; the recipient decrypts the hash with the sender's public key and compares it with a fresh hash of the message.
- Remember
- Signing uses the sender's private key and provides integrity, authentication and nonrepudiation, but not confidentiality.
- Tested as
- Key-usage questions are among the most precise technical items in this domain.
- Trap
- Choosing the recipient's public key, which is used for confidentiality, not for signing.
-
Confidentiality with asymmetric keys
To ensure only the intended recipient can read a message, the sender encrypts it, or a symmetric session key, with the recipient's public key.
- Remember
- Only the recipient's private key can decrypt it.
- Tested as
- Paired with signature questions to test which key does which job.
- Trap
- Encrypting with the sender's private key, which anyone holding the public key could reverse.
-
Symmetric vs. asymmetric encryption
Symmetric encryption uses one shared secret key and is fast for bulk data; asymmetric uses key pairs, solves key distribution and enables signatures, but is slower.
- Remember
- Hybrid systems use asymmetric encryption to exchange a symmetric session key, then symmetric encryption for data.
- Tested as
- Questions ask which method suits bulk data, key exchange or nonrepudiation.
- Trap
- Expecting symmetric encryption to provide nonrepudiation; both parties hold the same key.
-
Hashing
A one-way function producing a fixed-length digest; any change in input produces a different digest.
- Remember
- Hashing proves integrity but not origin unless combined with a key, as in a digital signature or message authentication code.
- Tested as
- Appears in integrity, forensics and signature questions.
- Trap
- Describing hashing as encryption that can be reversed.
-
Biometric error rates
The false acceptance rate measures impostors wrongly accepted, the false rejection rate measures valid users wrongly rejected, and the crossover or equal error rate is where the two meet.
- Remember
- A lower crossover error rate means a more accurate device; false acceptance is the critical measure for security.
- Tested as
- Questions ask which metric matters most or which device is best.
- Trap
- Choosing the device with the lowest false rejection rate because users complain less.
-
Least privilege and access reviews
Users get only the access needed for their role, approved by the data owner and reviewed periodically by owners to remove access no longer needed.
- Remember
- Owners approve and review; administrators implement.
- Tested as
- Access control questions often turn on who reviews and how often.
- Trap
- Accepting a review performed by the security administrator who granted the access.
-
Shared responsibility model
In cloud services, the provider secures more of the stack from infrastructure to platform to software as a service, but the customer always remains responsible for its data, identities and access configuration.
- Remember
- Accountability for data protection never transfers to the provider.
- Tested as
- Cloud questions ask who must perform a specific control.
- Trap
- Assuming the provider manages user access in a software-as-a-service application.
-
Firewall types
Packet-filtering firewalls check addresses and ports, stateful firewalls track connection state, application-level proxies inspect application content, and next-generation firewalls add application awareness and intrusion prevention.
- Remember
- Higher layers mean deeper inspection and more processing.
- Tested as
- Questions ask which type can inspect content or best protects a specific service.
- Trap
- Expecting a packet filter to detect malicious content inside allowed traffic.
-
Penetration test authorization
Written approval from management and agreed rules of engagement define scope, timing, methods and contacts before testing begins.
- Remember
- Testing without authorization is an attack, not an audit procedure.
- Tested as
- Asked as the most important prerequisite for a penetration test.
- Trap
- Choosing the selection of tools or testers as the first priority.
-
Incident response order
Preparation, detection and analysis, containment, eradication, recovery and lessons learned.
- Remember
- Contain first to limit damage, then eradicate, then recover.
- Tested as
- Sequencing questions ask what comes next after detection.
- Trap
- Restoring systems before eradication, which risks reinfection.
-
Chain of custody
A documented record of who collected, handled, transferred and stored evidence, when and for what purpose.
- Remember
- Without it, evidence may be inadmissible even if it is accurate.
- Tested as
- Forensics questions ask what preserves admissibility.
- Trap
- Focusing on analysis tools instead of the custody record.
-
Order of volatility
Collect the most short-lived evidence first, such as CPU registers, cache and memory together with network connections and running processes, then temporary files and disk contents, then archival media.
- Remember
- Powering off a system destroys memory evidence.
- Tested as
- Asked in evidence collection sequencing questions.
- Trap
- Shutting down the system immediately to stop the attack before capturing volatile data.
-
Pre-action fire suppression
A sprinkler system whose pipes stay dry until a detection system triggers, then fill with water that is released only when sprinkler heads activate.
- Remember
- It requires two events, reducing accidental water damage in equipment rooms.
- Tested as
- Asked as the best water-based option for data centers.
- Trap
- Choosing a wet-pipe system for its reliability despite the risk of leaks or accidental discharge.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Encryption vs. hashing vs. digital signature
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Encryption | Transforms data so only key holders can read it | Provides confidentiality and is reversible with the right key | Assuming it proves who sent the data |
| Hashing | One-way fixed-length digest of data | Provides integrity only and cannot be reversed | Thinking a hash alone proves origin |
| Digital signature | Hash encrypted with the sender's private key | Provides integrity, authentication and nonrepudiation | Assuming it also keeps the message confidential |
Vulnerability scanning vs. penetration testing
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Vulnerability scanning | Automated identification of known weaknesses | Broad, frequent and non-exploitative | Treating a clean scan as proof of security |
| Penetration testing | Authorized attempt to exploit weaknesses and show impact | Deep, periodic, needs rules of engagement | Starting without written authorization and scope |
IDS vs. IPS vs. SIEM
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Intrusion detection system | Monitors traffic or hosts and alerts on suspicious activity | Passive: alerts but does not block | Expecting it to stop attacks |
| Intrusion prevention system | Inline system that can block detected attacks | Active: can drop traffic, so false positives can disrupt service | Ignoring the availability impact of false positives |
| SIEM | Aggregates and correlates logs from many sources | Enterprise-wide correlation and alerting, not a sensor itself | Assuming collection alone means events are reviewed |
False acceptance rate vs. false rejection rate vs. crossover error rate
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| False acceptance rate | Share of impostors wrongly accepted | Most important for security | Tolerating it to improve user convenience |
| False rejection rate | Share of valid users wrongly rejected | Affects usability and productivity | Treating it as a security failure |
| Crossover error rate | Point where false acceptance equals false rejection | Lower value means a more accurate device overall | Thinking a higher value is better |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Encryption for nonrepudiation
- What candidates pick
- Encrypt the message with a strong symmetric algorithm to prove who sent it.
- Why it looks right
- Encryption is the most familiar protection and sounds strong.
- Why it's wrong
- Both parties share a symmetric key, so either could have created the message; only a private-key signature binds it to one sender.
Clue to watch for Words such as cannot deny sending or prove origin point to a digital signature.
-
Advanced tool over basic control
- What candidates pick
- Deploy a new monitoring or DLP product to solve a problem.
- Why it looks right
- Technology looks decisive and modern.
- Why it's wrong
- If the root cause is missing classification, ownership or an access review, a tool will not work properly without it.
Clue to watch for Look for no classification scheme, unclear owners or stale access in the scenario.
-
Restore first
- What candidates pick
- Restore the affected systems from backup immediately after detecting ransomware.
- Why it looks right
- It returns the business to operation fastest.
- Why it's wrong
- Without containment and eradication, restored systems can be reinfected, and evidence may be lost.
Clue to watch for Active or spreading in the scenario points to containment first.
-
Shut it down
- What candidates pick
- Power off a compromised server immediately to stop the attack.
- Why it looks right
- It stops activity at once.
- Why it's wrong
- Powering off destroys volatile evidence and may disrupt the business; isolation from the network contains the threat while preserving memory.
Clue to watch for If evidence or investigation is mentioned, preserve volatile data and isolate rather than power off.
-
Provider is responsible
- What candidates pick
- Rely on the cloud provider to manage user access and data protection for a software-as-a-service application.
- Why it looks right
- The provider runs the platform and advertises strong security.
- Why it's wrong
- Under the shared responsibility model the customer always owns its data, identities and access configuration.
Clue to watch for Questions about user access, data classification or configuration in the cloud point to the customer.
-
Completion equals effectiveness
- What candidates pick
- Use training completion rates as the best measure of awareness program success.
- Why it looks right
- Completion is easy to measure and report.
- Why it's wrong
- Completion shows attendance, not changed behavior.
Clue to watch for Look for behavioral measures such as reporting rates or phishing simulation results.
-
Scan before authorization
- What candidates pick
- Begin a penetration test with automated scanning to save time, and obtain formal approval later.
- Why it looks right
- Scanning is low risk and speeds the engagement.
- Why it's wrong
- Any testing without written authorization and agreed scope can disrupt systems and has no legal basis.
Clue to watch for FIRST or MOST important before testing points to authorization and rules of engagement.
Answer framework
For a protection-of-assets question, match the control to the specific threat and confirm that ownership, evidence and sequence are respected.
- Name the asset and the security property at risk in the scenario: confidentiality, integrity, availability, authentication or nonrepudiation.
- Check whether the foundations exist, such as data classification, named owners and a recognized framework; if not, those come before any new tool.
- Select the control that directly addresses the threat described, and verify technical details such as which key signs and which key encrypts.
- For access, confirm owner approval, least privilege, periodic owner review and timely removal; for cloud, confirm the customer's retained responsibilities.
- For incidents and testing, follow the sequence: authorize before testing, contain before eradicating, preserve evidence and chain of custody before analysis.
Practice question
Want more like this? The CISA practice test has questions for every domain.
Checklist
0 of 15
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Study the asset security and control half first, starting with frameworks, IAM and encryption, because they generate the most precise questions. Spend dedicated time on key usage until you can answer which key does what without hesitation, then cover PKI, network and endpoint security, DLP, cloud and virtualization, and mobile, wireless and IoT devices.
Then study security event management in the order of an incident's life: awareness, attack methods, testing, monitoring, incident response and forensics. Build a single table linking each attack method to its preventive control, its detective control and the evidence you would collect.
Commonly underestimated areas are physical and environmental controls, which feel non-technical but produce specific questions on fire suppression and access, and the shared responsibility model for cloud services.
High-priority concepts include digital signatures, least privilege with owner review, biometric error rates, penetration test authorization, containment before recovery, and chain of custody.
After studying, practice mixed question sets and, for each wrong answer, ask whether you chose a powerful tool instead of the control that fits the stated threat. Because this domain carries 26% of the exam, plan a second review pass close to exam day alongside Domain 4.
FAQ
Is Domain 5 the most technical CISA domain?
It contains the most technical content, such as encryption and network security, but questions are written from an auditor's perspective. You need to know what a control does and when it fits, not how to configure it.
How many questions come from Domain 5?
ISACA does not publish per-domain counts. Applying the 26% weight to 150 questions gives a planning estimate of about 39.
How much cryptography do I need?
Know symmetric versus asymmetric encryption, hashing, digital signatures, which key performs each function, PKI roles and why key management matters. Mathematical detail of algorithms is not the focus.
What is the difference between Domain 4 incident management and Domain 5 incident response?
Domain 4 covers IT service incidents and problems generally, focusing on restoring service. Domain 5 covers security incidents, adding containment, eradication, evidence preservation and legal considerations.
Who should review user access rights?
The data or system owner should review access periodically, because they know who needs it. Security administrators implement changes but should not certify their own work.
Does the exam cover cloud security in depth?
The current outline includes cloud and virtualized environments as a sub-topic. Expect questions on the shared responsibility model, hypervisor risk and the customer's retained duties rather than provider-specific services.
How long should I study Domain 5?
A planning estimate is 45 to 60 hours within a roughly 200-hour plan. Candidates new to security may need more time for encryption and network topics.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CISSP Same subject: Domain 2: Asset Security (10%)
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CompTIA Security+ Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 5 knowledge
Test whether you can pick the right key for a signature, match controls to attacks, and follow the correct order in incident response and evidence handling.