Use flashcards to practise decisions, not just definitions

CISSP questions test breadth across eight CBK domains. They are primarily multiple-choice and may use scenarios requiring risk-based decisions, governance awareness and security engineering judgement. A useful flashcard deck should therefore help you recall a concept and apply it to a situation—not just recite a glossary entry.

For each card, answer before turning it over. Then grade your recall honestly: use Again if you could not give the answer, Hard if it took effort or was incomplete, Good if you answered correctly without prompting, or Easy if it was immediate and clear. A correct answer reached by guessing is not secure knowledge; mark it Hard and revisit the reasoning.

This deck groups foundational ideas that recur across security scenarios. The answers are deliberately concise. In a written response, you may need to add the relevant asset, threat, business constraint and justification. The cards are study prompts, not a claim about the exact wording of any live exam question.

A MySummaries deck on CISSP fundamentals looks like this:

Cards — CISSP — Security foundations18 due

In the CIA triad, what does integrity protect?

Protection against unauthorised or improper modification or destruction of information.

All 18 cards
In the CIA triad, what does integrity protect?Protection against unauthorised or improper modification or destruction of information.
Who is accountable for classifying an information asset?The data owner; a custodian may handle the asset and implement the owner’s requirements.
What does least privilege require?Give each subject only the minimum access needed to perform its authorised tasks.
What does a preventive control do?It is intended to stop an unwanted event before it occurs, such as access restrictions.
What does a detective control do?It identifies or records events, such as an alert or audit log, so they can be investigated.
What does a corrective control do?It reduces the impact of an incident or restores a system after disruption, such as restoring a clean backup.
Name the four common risk response options.Avoid, mitigate, transfer, or accept the risk.
Does transferring risk remove the organisation’s accountability?No. A contract or insurance may transfer some financial exposure, but the organisation retains responsibility for managing its risk.
What does RTO specify?The target time within which a process or system should be restored after disruption.
What does RPO specify?The maximum targeted amount of data loss measured in time, such as the period between the last recoverable point and disruption.
Which takes priority in business continuity planning: life safety or service restoration?Life safety. Protect people before restoring business services.
What is the key difference between hashing and encryption?Encryption is reversible with the appropriate key; a cryptographic hash is designed to be one-way.
What key relationship does symmetric encryption use?The same shared secret key is used to encrypt and decrypt.
What does a digital signature generally provide?Evidence of origin and integrity; it is created with the signer’s private key and verified with the corresponding public key.
What is the purpose of a salt when storing password hashes?A unique random value added before hashing makes identical passwords produce different stored hashes and hinders precomputed-table attacks.
What is the core zero-trust principle?Do not grant implicit trust based only on network location; authenticate and authorise access to resources explicitly.
In an incident response, why contain an incident before eradication?Containment limits ongoing damage and spread while preserving a controlled basis for investigation and removal.
What is residual risk?The risk that remains after controls have been applied.

That is a MySummaries deck, filled with CISSP material. Yours is written from your own notes. Start free

Practise the cards as scenario decisions

Work through the 18 prompts in order once, then return to any card you graded Again or Hard. On the second attempt, give yourself a short scenario as well as the definition. For example, when answering the risk-transfer card, imagine a supplier contract: explain what exposure might be transferred and why the organisation still needs oversight. For the RTO and RPO cards, distinguish the restoration-time target from the data-loss target; they answer different planning questions.

The distinction between preventive, detective and corrective controls is especially useful in scenario questions. A firewall rule may be preventive; a monitoring alert is detective; restoring a clean backup is corrective. The actual control type depends on its intended function in context. Do not classify a control only by its technology or product name.

Likewise, a question about a control should prompt you to ask what risk it addresses and whether it is proportionate. The strongest choice is not automatically the newest or most technical option. Consider policy and governance, the asset’s value, the threat, operational constraints and residual risk. If a scenario leaves an assumption unclear, state a reasonable assumption before recommending a control.

A compact checklist drawn from this deck can help you check whether your recall covers the decisions that matter:

Must not miss coreCISSP — Security foundations
Classify information through the accountable data owner; give users only the access needed for authorised tasks.
Match control purpose to the risk: preventive stops, detective identifies, corrective limits impact or restores.
Choose a risk response—avoid, mitigate, transfer, or accept—and remember that transfer does not remove organisational accountability.
Separate continuity targets: RTO is the restoration-time target; RPO is the targeted maximum data loss measured in time.
Prioritise life safety, justify controls in governance and business context, and identify the residual risk.

Review missed marks as new prompts

A missed card is useful only if you can identify what caused the miss. Was the term unfamiliar, or did you know it but choose an answer that ignored business context? Those call for different revision. Relearn a missing definition; practise scenario comparisons when the concept was known but applied poorly.

For each miss, say the corrected answer aloud in one sentence, then add a brief example. For instance: “RPO is the targeted maximum data loss measured in time; if the recovery point is four hours before disruption, that represents four hours of potential data loss.” Keep the example consistent with the definition rather than treating a particular value as a universal requirement.

When the same idea costs you marks repeatedly, make the prompt more specific. Instead of asking only for a definition of risk acceptance, ask what an organisation should do when a residual risk remains after controls and an authorised decision-maker accepts it. This makes the card test application as well as recall. Revisit it later without looking at the answer; a quick reread is not the same as retrieval practice.

A repeated miss can be sent to a remediation tray as a focused prompt:

Remediation tray

You lost this mark twice: a supplier contract transfers some financial exposure after a breach. What responsibility does the organisation still retain, and what risk should it review?

Add cardDismiss

Do not try to memorise the cards as isolated phrases. Practise explaining the connection between them: identify the asset and risk, select a suitable response, choose controls, consider continuity and life safety, and state what risk remains. In scenario practice, compare plausible options and explain why one better fits governance, feasibility and business impact. That reasoning is more useful than selecting an answer because it sounds technically impressive.

How MySummaries helps

Build a revision board from your own CISSP study material, then generate flashcards from the concepts you have organised. Spaced-repetition review helps bring difficult cards back, while written mock exams can test how well you apply those concepts to scenarios and mark your answers against your notes. Open MySummaries.