Free CISSP flashcards

How do the ISC2 Code of Ethics canons relate to a CISSP holder's employer code of conduct?

Holding the CISSP is a personal undertaking to abide by the ISC2 canons in every professional act, while an employer's code defines workplace duties owed to a principal. Both apply concurrently, and the canons set the floor while a lawful organisational code can add stricter expectations on top.

The employer's code of conduct overrides the ISC2 canons whenever the two appear to conflict in the workplace.

Tempting because employees normally follow employer policy, but a CISSP holder agreed to uphold the ISC2 canons as a condition of certification, so the canons are not displaced by internal policy.

How does defence in depth differ conceptually from zero trust as a guiding design principle?

Defence in depth layers independent controls so that the failure of any single control does not breach the asset, assuming controls will fail and building redundancy. Zero trust is a trust model that removes implicit trust based on network location and continuously verifies the identity, device, and context of every subject and request. They are complementary but distinct: one is about layering, the other is about not granting trust by location.

Does defence in depth replace perimeter firewalls with identity-aware proxies, while zero trust focuses on encrypting data at rest and in transit?

No. This inverts the two concepts. Identity-aware proxies are typical of zero trust enforcement, and ubiquitous encryption is a cryptographic control rather than the essence of either principle. Defence in depth is about layered independent controls.

At which OSI layers do TLS, IPsec, and IEEE 802.1X operate?

TLS sits above the transport layer and shields application payload without being the transport protocol itself. IPsec encapsulates whole IP packets at layer 3 using AH or ESP. IEEE 802.1X is a port-based access control at the data link layer that gates a port before frames are accepted. Mapping each control to the correct layer ensures controls are applied at the right choke point during architecture design.

TLS operates at the application layer and IPsec at the transport layer.

TLS is not an application protocol; it shields application payload but sits above transport (commonly framed as session or presentation). IPsec wraps whole IP packets at layer 3, not at transport, and 802.1X is a layer 2 port control rather than a network layer protocol. Memorising TLS as application because HTTPS uses it leads to wrong choke-point selection.

How does CISSP distinguish physical access controls from logical access controls?

Physical controls govern tangible barriers and environmental measures such as fences, guards, mantraps, and locks that protect spaces and devices. Logical controls operate inside information systems, using identification, authentication, authorisation, and accounting mechanisms such as permissions, ACLs, MFA, and encryption to mediate access to data, applications, and accounts. Both work together so that defeating one layer does not automatically defeat the other.

Physical controls protect the perimeter while logical controls protect only internal network segments.

This conflates network segmentation with the broader logical access category. Logical controls cover applications, databases, files, endpoints, and accounts, not just internal network zones, so confining them to internal segments is too narrow a definition.