How to Pass Technical Screening Interviews for CISSP Certified Information Systems Security Professional
A complete step-by-step masterclass on passing CISSP technical screening interviews, (ISC)² 8 Security Domains, executive security governance, BCP/DRP planning, and risk management frameworks.
Summary: Master the (ISC)² 8 CISSP security domains, quantitative risk analysis (ALE = SLE x ARO), BCP/DRP recovery metrics (RTO/RPO), access control models (MAC/DAC/RBAC), and DevSecOps governance.
1. (ISC)² 8 CISSP Security Domains & Leadership Scope
The Certified Information Systems Security Professional (CISSP) by (ISC)² is the premier global credential for Chief Information Security Officers (CISOs) and Security Directors. 1. **Security and Risk Management (15% Weighting):** Confidentiality, Integrity, Availability, Compliance, Governance, Business Continuity, Ethics. 2. **Asset Security (10% Weighting):** Data classification, Ownership, Retention, Data security controls, Privacy. 3. **Security Architecture and Engineering (13% Weighting):** Security models (Bell-LaPadula, Biba), Cryptography, Physical security, System vulnerabilities. 4. **Communication and Network Security (13% Weighting):** Secure network architecture, Network components, Wireless security, Transmission channels. 5. **Identity and Access Management (IAM) (13% Weighting):** Physical & Logical access control, Single Sign-On (SSO), Kerberos, Federated access. 6. **Security Assessment and Testing (12% Weighting):** Vulnerability assessments, Penetration testing, Audit strategies, Log reviews. 7. **Security Operations (13% Weighting):** Incident response, Forensics, Patch management, Disaster recovery execution. 8. **Software Development Security (11% Weighting):** DevSecOps, OWASP mitigations, Software escrow, Code repositories.
2. Quantitative Risk Analysis (ALE = SLE x ARO) & Response Strategies
**Interview Scenario:** *"Walk me through the mathematical calculation for Quantitative Risk Analysis and explain when to choose Risk Transfer vs Risk Mitigation."* * **Quantitative Formula:** - **Single Loss Expectancy (SLE):** $\text{SLE} = \text{Asset Value (AV)} \times \text{Exposure Factor (EF)}$ - **Annualized Loss Expectancy (ALE):** $\text{ALE} = \text{SLE} \times \text{Annualized Rate of Occurrence (ARO)}$ * **Example:** If a datacenter server is valued at $100,000, a flood exposure factor is 50% ($ ext{SLE} = $50,000$), and flood frequency is once every 10 years ($ ext{ARO} = 0.1$), then $\text{ALE} = $5,000 / \text{year}$. * **4 Risk Response Strategies:** 1. **Risk Mitigation:** Implement security controls (e.g., firewalls, patch management). 2. **Risk Transfer:** Purchase cyber insurance or outsource liability to third-party MSSPs. 3. **Risk Avoidance:** Discontinue the risky project or technology entirely. 4. **Risk Acceptance:** Accept residual risk when control cost exceeds ALE.
3. Business Continuity Planning (BCP) & Disaster Recovery (DRP)
**Interview Scenario:** *"Differentiate between Business Continuity Planning (BCP) and Disaster Recovery Planning (DRP). How do RTO and RPO metrics guide site selection?"* * **BCP vs DRP:** BCP focuses on keeping the **overall business operational** during a crisis (people, process, facilities). DRP focuses specifically on **restoring IT systems, databases, and infrastructure** after a disaster. * **Key Metrics:** - **Recovery Time Objective (RTO):** Maximum acceptable duration IT systems can remain offline. - **Recovery Point Objective (RPO):** Maximum acceptable data loss duration measured in time. * **Alternate Site Selection:** - **Hot Site:** Fully equipped active datacenter with real-time data replication ($RTO \approx 0$, $RPO \approx 0$). Most expensive. - **Warm Site:** Equipped with hardware and network links, requiring data backups to be restored ($RTO = \text{hours}$). - **Cold Site:** Empty physical facility with power and HVAC, requiring hardware installation ($RTO = \text{days/weeks}$).
4. Security Architecture & Access Control Models (MAC, DAC, RBAC)
**Interview Scenario:** *"Compare Mandatory Access Control (MAC), Discretionary Access Control (DAC), and Role-Based Access Control (RBAC)."* * **DAC (Discretionary Access Control):** Data owner explicitly grants access permissions at their discretion (e.g. standard Linux file permissions `chmod`). Flexible but vulnerable to Trojan horses. * **MAC (Mandatory Access Control):** Central security policy assigns sensitivity labels (Top Secret, Secret) to objects and clearances to subjects. Enforced by OS kernel. Cannot be overridden by file owners. - **Bell-LaPadula Model:** Focuses on **Confidentiality**. "No Read Up, No Write Down". - **Biba Model:** Focuses on **Integrity**. "No Read Down, No Write Up". * **RBAC (Role-Based Access Control):** Access permissions assigned based on job roles (e.g. Accountant, Admin) enforcing Principle of Least Privilege.
5. Software Development Security & DevSecOps Lifecycle
**Interview Scenario:** *"How do you integrate security controls into an automated DevSecOps CI/CD pipeline?"* 1. **Static Application Security Testing (SAST):** Scans source code repositories during Git pull requests for vulnerabilities (SQLi, XSS) before compilation. 2. **Dynamic Application Security Testing (DAST):** Tests running staging applications from an external black-box perspective. 3. **Software Composition Analysis (SCA):** Audits open-source third-party dependencies against CVE vulnerability databases. 4. **Interactive Application Security Testing (IAST):** Instruments application runtime environments during integration testing.