Practising Domains 7 and 8: security operations and software development security · CISSP-160 Lesson 8

Domains 7 and 8 complete the outline. Domain 7, security operations, carries about 13 % of the exam and covers the daily running of security: investigations, logging and monitoring, incident management, configuration and change management, patching, backup and recovery, disaster recovery and personnel safety. Domain 8, software development security, carries about 10 % in the 2024 outline and rises to about 11.2 % in 2027. It covers secure development life cycles, development methods, secure coding concepts, testing, the software supply chain and acquired software.

These two domains are where the manager's mindset and technical knowledge meet most often. Many Domain 7 items describe an incident and ask what to do first, which is a mindset question. Many Domain 8 items ask which practice or control fits a stage of development, which is a knowledge question. Tomás is strong in Domain 7 but needs to slow down on its FIRST items; Domain 8 is a priority for both learners.

Domain 7 at a glance

Area	Ideas that appear often	Course that taught it
Investigations	Types of investigation, evidence handling, chain of custody, admissibility, order of volatility as a concept	CISSP-116 lessons 2 to 3
Logging and monitoring	SIEM, continuous monitoring, threat intelligence, user and entity behaviour analytics	CISSP-116 lesson 4
Incident management	Phases of incident response, roles, communication, lessons learned	CISSP-116 lessons 5 to 6
Operations controls	Least privilege, need to know, separation of duties, job rotation, mandatory vacations, privileged account monitoring	CISSP-116 lesson 7
Configuration, change and patch management	Baselines, change advisory boards, emergency changes, vulnerability and patch management	CISSP-116 lessons 8 to 9
Recovery	Backup types, recovery sites, RTO and RPO, disaster recovery testing (read-through, walkthrough, simulation, parallel, full interruption)	CISSP-116 lessons 10 to 11
Personnel safety	Travel, duress, emergency management, insider threats	CISSP-116 lesson 12

Two sequences appear often enough to memorize exactly. The incident response life cycle, in the widely taught form, runs preparation, detection and analysis, containment, eradication, recovery and post-incident activity; the 2025 revision of NIST SP 800-61 maps these activities onto the functions of the Cybersecurity Framework 2.0, which CISSP-116 explained. Disaster recovery tests, from least to most disruptive, run read-through (checklist), walkthrough (tabletop), simulation, parallel and full interruption.

Disaster recovery test types, from least to most disruptive.

Domain 8 at a glance

Area	Ideas that appear often	Course that taught it
Development life cycles and methods	Waterfall, agile, DevOps and DevSecOps, maturity models (CMMI, SAMM), change and release management	CISSP-117 lessons 2 to 3
Security in the life cycle	Requirements, threat modelling, secure design, code review, testing, deployment, operation, retirement	CISSP-117 lessons 4 to 5
Development environments	Repositories, build pipelines, secrets management, segregation of environments	CISSP-117 lesson 6
Software weaknesses (concepts)	Injection, cross-site scripting, broken access control, insecure deserialization, memory safety, and the defensive patterns that prevent them	CISSP-117 lessons 7 to 9
Supply chain	Third-party components, software bills of materials, provenance, open-source governance	CISSP-117 lesson 10
Acquired software	Commercial software, SaaS, contracts, escrow, assessing vendors	CISSP-117 lesson 11

Domain 8 items usually ask about the right practice at the right stage. Security requirements belong at the start, threat modelling during design, code review and static analysis during development, dynamic testing and fuzzing when software runs, and monitoring and patching in operation. The cheapest place to fix a security flaw is early; the most expensive is in production. Items that ask how to reduce the cost of security defects almost always point to an earlier stage.

Practice items: Domain 7

Worked problem

Item 1: evidence on a live system

An investigator at Ridgeline must collect evidence from a running server suspected of unauthorized access. Which should be collected FIRST? (A) The contents of the hard drive. (B) Archived backups from last month. (C) Volatile data such as memory contents and active network connections. (D) Printed copies of the server's configuration manual.

Show solution

Stem: FIRST evidence to collect from a running system.
Recall the order of volatility: collect the most volatile, short-lived data before it disappears, then less volatile data.
Memory and active connections vanish when the system is shut down or changes; disks and backups persist.

Answer: C. Volatile data is collected first, following the order of volatility, with chain of custody documented throughout.

Worked problem

Item 2: chain of custody

Which practice BEST supports the admissibility of digital evidence in court? (A) Letting several analysts work on the original drive to save time. (B) Documenting every person who handled the evidence, when and why, and working on verified copies. (C) Deleting irrelevant files from the original to make review easier. (D) Storing the evidence on a shared drive for convenience.

Show solution

Stem: what supports admissibility.
Working on the original, altering it or storing it insecurely damages integrity and the record.
A documented chain of custody, verified hashes and working on forensic copies show the evidence was not altered.

Answer: B. A complete chain of custody and analysis of verified copies preserve admissibility.

Worked problem

Item 3: the least disruptive realistic test

Ridgeline wants to test its disaster recovery plan by actually bringing up systems at the recovery site and processing real transactions there, while the primary site keeps running. Which type of test is this? (A) Read-through. (B) Walkthrough. (C) Parallel test. (D) Full interruption test.

Show solution

Stem: recovery systems brought up and processing, primary still running.
Read-through and walkthrough do not activate systems.
A full interruption test shuts down the primary site, which is not the case here.
A parallel test runs recovery systems alongside the primary.

Answer: C. A parallel test activates the recovery site without interrupting the primary.

Worked problem

Item 4: preventing fraud by one person

Ridgeline discovers that one employee could both create a new supplier in the payments system and approve payments to it. Which control BEST addresses this? (A) Job rotation. (B) Separation of duties. (C) Mandatory vacation. (D) Need to know.

Show solution

Stem: one person can perform two steps that together allow fraud.
Job rotation and mandatory vacations help detect fraud after the fact; need to know limits information access.
Separation of duties splits incompatible tasks between people so that fraud requires collusion.

Answer: B. Separation of duties prevents one person controlling both steps.

Worked problem

Item 5: lessons learned

After a ransomware incident is contained and systems are restored, what should Ridgeline's incident response team do NEXT? (A) Close the ticket and return to normal work. (B) Hold a lessons-learned review and update plans and controls. (C) Delete the incident records to limit liability. (D) Publicly name the employee who opened the malicious email.

Show solution

Stem: NEXT step after recovery.
The final phase of incident response is post-incident activity: review what happened, what worked and what to improve.
C destroys records that may be needed; D is punitive and harmful; A skips improvement.

Answer: B. A lessons-learned review leads to improved plans, controls and training.

Practice items: Domain 8

Worked problem

Item 6: the cheapest place to fix flaws

Ridgeline's security team finds that most flaws in its payment API are discovered in penetration tests just before release, delaying launches. Which change would MOST reduce the cost of these flaws? (A) Run more penetration tests before release. (B) Add security requirements, threat modelling and code review earlier in the development life cycle. (C) Delay releases by a month as standard. (D) Buy a web application firewall.

Show solution

Stem: MOST reduce the cost of security flaws.
More late testing finds the same flaws at the same late stage. Delays and a firewall do not prevent flaws.
Moving security earlier finds and prevents flaws when they are cheapest to fix.

Answer: B. Building security into requirements, design and coding reduces cost most.

Worked problem

Item 7: preventing injection

A code review finds that an application builds database queries by joining user input into SQL strings. What is the BEST fix? (A) Hide error messages from users. (B) Use parameterized queries so that input is always treated as data. (C) Block single quote characters in input. (D) Encrypt the database.

Show solution

Stem: BEST fix for queries built from user input.
Hiding errors and blocking one character are partial and easily bypassed; encryption at rest does not stop injection.
Parameterized queries separate code from data, which prevents injection at the source.

Answer: B. Parameterized queries are the primary defence against SQL injection.

Worked problem

Item 8: knowing what is inside

A newly published vulnerability affects a widely used open-source library. Ridgeline needs to know quickly which of its applications include it. Which practice would help MOST? (A) Annual penetration tests. (B) Maintaining a software bill of materials (SBOM) for each application. (C) Banning all open-source software. (D) Reading vendor marketing material.

Show solution

Stem: quickly identify which applications contain a component.
An SBOM lists the components and versions in each application, so the affected ones can be found in minutes.
Banning open source is extreme and impractical; annual tests are too slow.

Answer: B. An SBOM makes component exposure searchable.

Worked problem

Item 9: buying software

Ridgeline plans to depend on a small vendor's software for a critical function. The vendor might go out of business. Which contractual control BEST protects Ridgeline's ability to maintain the software? (A) A non-disclosure agreement. (B) A source code escrow agreement with defined release conditions. (C) A longer warranty. (D) A discount for paying three years in advance.

Show solution

Stem: maintain the software if the vendor fails.
An NDA, a warranty and a discount do not give access to the code.
Source code escrow places the code with a third party, to be released to Ridgeline under agreed conditions such as vendor insolvency.

Answer: B. Source code escrow protects against vendor failure.

Worked problem

Item 10: secrets in code

A developer committed a cloud access key to a shared code repository. What should Ridgeline do FIRST? (A) Delete the commit and say nothing. (B) Revoke and replace the key, then review its use and follow the incident process. (C) Make the repository private and keep the key. (D) Ask the developer to promise not to do it again.

Show solution

Stem: FIRST action after a secret is exposed.
Deleting the commit does not undo exposure, because copies may exist. Making the repository private leaves a possibly compromised key in use.
Revoking the key removes the risk; reviewing logs shows whether it was misused; the incident process ensures proper handling and lessons learned, including better secrets management.

Answer: B. Revoke and rotate the key first, then investigate through the incident process.

A quick check on recovery objectives

Recovery items in Domain 7 often combine backup schedules with recovery point objectives. The program below checks whether three backup schedules meet a four-hour recovery point objective (RPO) for Ridgeline's payment ledger. The worst-case data loss for a schedule is roughly the interval between backups, plus any time needed to copy the backup off site.

# Do these backup schedules meet a 4-hour RPO? Worst-case loss is about interval + copy delay.
rpo_hours = 4
schedules = {
    "Nightly full backup": (24, 1),
    "Full nightly + incremental every 3 h": (3, 0.5),
    "Continuous replication (about 5 min lag)": (5 / 60, 0),
}
for name, (interval, copy_delay) in schedules.items():
    worst = interval + copy_delay
    verdict = "meets" if worst <= rpo_hours else "misses"
    print(f"{name:<42} worst-case loss {worst:5.2f} h  {verdict} RPO of {rpo_hours} h")

Output

Nightly full backup                        worst-case loss 25.00 h  misses RPO of 4 h
Full nightly + incremental every 3 h       worst-case loss  3.50 h  meets RPO of 4 h
Continuous replication (about 5 min lag)   worst-case loss  0.08 h  meets RPO of 4 h

The nightly backup misses the objective badly; the incremental schedule meets it with half an hour to spare; replication meets it easily but costs more. The exam may ask which strategy best meets a stated RPO at reasonable cost. Here the incremental schedule is the proportionate choice unless the business sets a tighter objective.

Patterns to remember

If the item asks...	The answer is usually...
What evidence to collect first from a running system	The most volatile data, following the order of volatility
What supports admissibility	Chain of custody and analysis of verified copies
Which DR test runs recovery systems alongside production	Parallel test
Which control stops one person controlling a whole transaction	Separation of duties
What follows recovery in incident response	Lessons learned and improvement
Where security flaws are cheapest to fix	Early: requirements, design and coding
The primary defence against SQL injection	Parameterized queries
How to find which applications use a vulnerable component	A software bill of materials

Common mistakes

MistakeCollecting disk images before memory on a running system.
InsteadFollow the order of volatility: memory and network state first.
MistakeConfusing a parallel test with a full interruption test.
InsteadA parallel test keeps the primary running; full interruption shuts it down.
MistakeChoosing job rotation to prevent fraud by one person.
InsteadSeparation of duties prevents it; rotation and vacations help detect it.
MistakeFixing injection by blocking particular characters.
InsteadUse parameterized queries and allow-list validation.
MistakeDeleting a commit that exposed a secret and moving on.
InsteadRevoke and rotate the secret, then investigate.

Summary and key terms

Domain 7 items often ask what to do first in an incident or investigation; apply the plan, preserve evidence and follow the order of volatility.
Know the incident response phases and the disaster recovery test types in order.
Separation of duties prevents one person controlling a whole process; job rotation and mandatory vacations help detect fraud.
Domain 8 items ask which practice fits which stage; security is cheapest to build in early.
Parameterized queries prevent injection; SBOMs reveal component exposure; escrow protects against vendor failure.
Exposed secrets must be revoked and rotated before anything else.

Order of volatility: The principle of collecting the most short-lived evidence first.
Chain of custody: A documented record of who handled evidence, when and why, from collection to presentation.
Parallel test: A disaster recovery test that activates recovery systems while the primary site continues operating.
Separation of duties: Dividing incompatible tasks among different people so that no one can complete a sensitive process alone.
Software bill of materials (SBOM): A list of the components, libraries and versions that make up a piece of software.
Source code escrow: An arrangement in which a vendor's source code is held by a third party and released under agreed conditions.

Practice problems

Work each problem on paper first, then reveal the answer to check.

List the disaster recovery test types from least to most disruptive.
Show answer
Read-through, walkthrough, simulation, parallel, full interruption.
Which incident response phase includes the lessons-learned review?
Show answer
Post-incident activity.
Which is collected first from a running system: memory or the hard drive?
Show answer
Memory, because it is more volatile.
Why is fixing security flaws in requirements cheaper than in production?
Show answer
Less work has been built on the flaw, so changes are smaller and do not require redeployment or incident handling.
What does a software bill of materials enable after a new library vulnerability is published?
Show answer
Quickly finding which applications include the affected library and version.
A backup runs every 6 hours and takes 1 hour to copy off site. Does it meet an RPO of 4 hours?
Show answer
No; worst-case loss is about 7 hours.