GIAC (SANS)GIAC Information Security Professional
The GIAC Information Security Professional (GISP) certification validates a practitioner's understanding of the eight domains of cybersecurity knowledge that form the critical foundation of the CISSP® exam. Designed for security professionals, system and network administrators, and security managers, GISP demonstrates broad security domain fluency and offers a pragmatic alternative to CISSP, signaling expertise validated by a respected provider.
429 practice questions · Updated 2026-07-30
3Domains
8Objectives
81Concepts
429Questions
GISP Curriculum
Every domain, objective, and concept the GISP exam measures.
- Security Management Frameworks
- Risk Management Process
- Risk Assessment Methods
- Risk Response Strategies
- Security Policies and Procedures
- Security Governance
- Compliance and Legal Requirements
- Business Continuity and Disaster Recovery
- Security Awareness and Training
- Incident Management
- Security Metrics and Reporting
- Asset Management
- Third-Party Risk Management
- Security Roles and Responsibilities
- Asset Identification and Classification
- Asset Inventory Management
- Data Classification and Handling
- Information Lifecycle Management
- Privacy and Data Protection
- Ownership and Custodianship
- Asset Retention and Disposal
- Security Architecture Principles
- Security Models
- System Security Engineering
- Secure System Design
- Cryptographic Concepts
- Public Key Infrastructure (PKI)
- Identity and Access Management (IAM)
- Security Controls
- Secure Network Architecture
- Secure Software Architecture
- Security Evaluation and Assurance
- Physical Security Integration
- Security Operations Center (SOC) Roles and Responsibilities
- Incident Response Lifecycle
- Security Monitoring and Log Management
- Threat Intelligence and Indicators of Compromise (IoCs)
- Vulnerability Management and Patching
- Security Information and Event Management (SIEM)
- Intrusion Detection and Prevention Systems (IDPS)
- Endpoint Detection and Response (EDR)
- Security Orchestration, Automation, and Response (SOAR)
- Incident Triage and Escalation
- Forensics and Evidence Handling
- Business Continuity and Disaster Recovery in Operations
- Network Security Fundamentals
- OSI and TCP/IP Models
- Secure Network Protocols
- Network Attacks and Countermeasures
- Network Segmentation and Isolation
- Firewalls and Intrusion Detection/Prevention
- Virtual Private Networks (VPNs)
- Wireless Network Security
- Network Access Control (NAC)
- Secure Communication Channels
- Network Monitoring and Logging
- Cloud and Virtual Network Security
- IAM Fundamentals
- Authentication Methods
- Authorization Models
- Identity Lifecycle Management
- Federated Identity and SSO
- Privileged Access Management
- Access Control Implementation
- IAM Governance and Compliance
- Security Assessment and Testing Overview
- Vulnerability Assessment
- Penetration Testing
- Security Audits
- Security Testing Techniques
- Risk-Based Testing
- Reporting and Remediation
- Secure SDLC
- Threat Modeling
- Secure Coding Practices
- Security Testing
- Code Review
- Software Deployment Security
- DevSecOps
- Software Supply Chain Security
- Secure Maintenance and Disposal
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for GISP, so none is invented.