CISSP Accelerator

21/09/2026

You can spend months preparing for CISSP and still feel like you're getting nowhere.

You're studying.
You're taking notes.
You're watching videos.
You're solving practice questions.

Yet somehow, you still feel stuck.

That’s exactly where Javed found himself before he cleared his CISSP exam.

So I had a conversation with him about his journey.

We talked about:

👉 Why he chose CISSP over other certifications

👉 How he managed exam preparation alongside a full-time job and family

👉 When he realised that self-study alone wasn't working for him

👉 What changed once he had a structured approach and guidance

👉 How his preparation strategy evolved as the exam got closer

👉 And the one thing he believes made the biggest difference in clearing the exam

If you're somewhere in the middle of your CISSP journey, or you've been thinking about starting but haven't been able to get yourself moving, I think you'll relate to this conversation.

🎥 Watch the full conversation below 👇
https://youtu.be/npwdw2K2_Xc

P.S. if you're struggling with where to start or how to structure your preparation, and need some help, feel free to book a 1:1 with me at https://calendly.com/hemantsajwan to know how I could help.

👋 Want to learn with me? Join my community:https://www.skool.com/h...

14/09/2026

I recently sat down (well, actually I was standing and he was sitting 😁) with one of the professionals I had the opportunity to mentor through his CISSP journey for an honest conversation about exactly that.

We spoke about what he found challenging, what helped him bring structure to his preparation, how his approach evolved, and what advice he would give to someone starting their own CISSP journey.

Hope you find something in this conversation that helps you move forward.

🎥 Watch the full conversation here:

👋 Want to learn with me? Join my community:https://www.skool.com/h...

28/08/2026

Too many control types in CISSP?

Here's a way to remember all of them without memorizing random definitions 👇

Start with one basic question:

Why do we implement controls, safeguards, or countermeasures?

👉 To reduce risk. Right?

Now think of controls as a logical flow, not isolated concepts.

1️⃣ Directive controls

Goal: Guide people toward secure behaviour before anything else

Examples: security policies, procedures, acceptable use agreements, security awareness training

Think of these as setting the rules of the game.

2️⃣ Preventive controls

Goal: Stop the bad thing from happening in the first place

Examples: firewalls, access controls, encryption, security guards

But let's be real. Not everything can be prevented. So we have...

3️⃣ Detective controls

Goal: Detect what slipped through

Examples: audit logs, IDS alerts, CCTV cameras

Once something is detected, the next question is obvious - how do we fix it? That's where we have...

4️⃣ Corrective controls

Goal: Fix the issue and limit the damage after an incident

Examples: patching a vulnerability after exploitation, quarantining an infected endpoint, removing malware

But sometimes the damage is bigger than a quick fix. So we use...

5️⃣ Recovery controls

Goal: Restore systems and operations after a serious incident

Examples: backups, system images, disaster recovery sites

Now, alongside these, there are two more categories CISSP loves to test 👇

6️⃣ Deterrent controls

Goal: Discourage attackers from even attempting an attack

Examples: warning signs, visible cameras, security guard presence, login banners

Note: a visible camera deters (Deterrent) and also records (Detective). Same control, two functions. The exam could test this.

7️⃣ Compensating controls

Goal: Provide an alternative when the primary control isn't feasible due to technical or business constraints, while still providing comparable protection.

Example: a hospital can't take a critical system offline to patch it, so they implement additional network monitoring and access restrictions as a compensating control until patching is possible

So instead of memorizing seven definitions, remember the story:

Direct → Prevent → Detect → Correct → Recover

And the two supporting players: Deter & Compensate

This is exactly how CISSP expects you to think through scenario-based questions, not "what is the definition of this control" but "which control fits this situation and why."

If you want to learn concepts like this the right way - structured, scenario-driven, and exam-focused, register for my upcoming 2-day CISSP Domain 1 Bootcamp. Here's the link: https://cisspaccelerator.com/free-bootcamp

12/08/2026

Most of us have heard the term VPN (Virtual Private Network).
But there's an interesting question:

If a VPN uses the Internet, which is a public network, why do we call it a "private" network?

Let's understand this from the problem VPN was originally designed to solve.

Imagine a company has its head office in Delhi and branch offices in Bangalore and Chennai.

Before VPNs became widely used, the organization could connect these offices using leased lines.

A leased line is essentially a dedicated communication link provided by an ISP.

Because the organization has leased that link, it is not shared with other customers.

So the company gets a private connection between its offices.

This private link gives 2 main benefits:

1: As it's a private connection of the company, it can also use private IP address ranges over this link without having the requirement to perform NAT.

2: Plus, no one else can look into your link (as it's your own dedicated link, not something shared with others).

But there's a catch.

Leased lines are expensive.

And generally, the greater the distance, the more expensive the connection becomes.

There is another problem too.

You pay for that dedicated link whether you're actively using it or not.

So organizations started asking:
Why can't we use the Internet, which is already available and much cheaper, instead of paying for dedicated private links?
The problem, of course, is that the Internet is public.

You don't want your private organizational traffic simply traveling across the Internet where anyone might be able to read it.

That's where the VPN concept comes in.

A VPN allows organizations to create a private connection over a public network.

But how's it a private connection when the underlying network is public?

There are two important concepts behind this:

1. Encapsulation / Tunneling
The original packet is encapsulated inside another packet so that it can travel across the public network. This basically means that, just like in leased lines, the organizations can continue to use private IP address ranges without having the requirement to NAT them.
That's where the term VPN tunnel comes from.

You're essentially putting one packet inside another packet and sending it through the Internet.

2. Encryption
Encapsulation (described above) alone doesn't necessarily make the contents confidential.

So VPN technologies can also use encryption to protect the traffic from being read by unauthorized parties.

Conceptually:

Original traffic → Encapsulation + Encryption → Internet → Decryption + De-encapsulation → Destination

And that's the meaning behind Virtual Private Network.

It's not a really private network like a leased line.

It's virtually private because we're creating a (sort of) private communication channel over a public network.

I've explained this concept in more detail in my YouTube video below, including the leased-line example and how tunneling/encapsulation fits into the picture.

https://youtu.be/cUFOr3aKLo8

Watch it, and if you find it useful, consider subscribing. :)

👋 Want to learn with me? Join my community:https://www.skool.com/h...

10/08/2026

IPsec is NOT a protocol.

This is something I see many CISSP aspirants getting confused about.

IPSec is a not a protocol in itself.

Rather, it's a framework. By framework, I mean it is a collection of protocols and mechanisms that work together to provide secure
communication over an IP network.

Now, why is IPsec not a single protocol?

Let's start with a simple situation.

You have two offices.
Office A is in Delhi.
Office B is in Bangalore.

Both offices need to communicate with each other, but their traffic has to travel over the Internet.

Now, the Internet is not a private cable between these two offices.

So you have a problem.

How do you make sure that the communication between the two offices is secure?

Well, several things need to happen.

First, the two sides need to establish a secure relationship.

So, they need to agree on things like:
How are we going to encrypt our communication?
How are we going to authenticate each other?
Which keys are we going to use?
How frequently should we rotate the keys?
etc.

And once all of that is sorted out, we still have another problem:
How do we protect the actual data travelling between the two offices (because so far, the two sites were just trying to secure their own communications)?

Now think about this.

Are all of these the same problem?

Not really.

Establishing trust is one problem.

Agreeing on how we're going to secure the communication is another.

Protecting the actual data is another.

It would be too much to expect one protocol to solve all these problems.

And that's where IPsec comes in.

IPsec is not one protocol.

It's a framework containing different protocols and mechanisms, where each one has a specific job in securing IP communication.

And this is where names like IKE, ISAKMP, AH, ESP come into the picture.

Don't worry about memorizing those names just yet.

The important thing is to first understand why we need different components in the first place.

Once you understand the problem we're trying to solve, the different IPsec components start making a lot more sense.

And this is one of the things I keep telling my CISSP students:
"Don't start by memorizing the acronym."

Start by understanding:
“What problem are we trying to solve?”

Once that becomes clear, the technology becomes much easier to understand.

P.S. If you're preparing for CISSP and this is the kind of learning approach you're looking for my next CISSP Accelerator - Domain 1 Bootcamp may be a good place to start. Register here: https://cisspaccelerator.com/free-bootcamp

09/07/2026

All CISSP aspirants know that you should encrypt sensitive data.

But few know what should happen to the key that does the encrypting.

This is where DEK and KEK come in - and it is a concept the CISSP exam could very well test you on.

Here is the problem.

You have a large database full of sensitive information.
You encrypt it using a key.
Now the data is protected.
But what about the key?
If someone gets hold of the key, they can decrypt everything.
So the key needs to be protected too.

That is where a second key comes in, and it's called KEK.

Here are the 2 keys involved.

👉 DEK - Data Encryption Key
This is the key that encrypts the actual data. It does the main job.

👉 KEK - Key Encryption Key
This is the key that encrypts the DEK. Its only job is to protect the first key.

So the data is protected by the DEK, and the DEK is protected by the KEK.

Now the obvious question: what protects the KEK?

In high-security environments, the KEK is generated and stored inside an HSM - a Hardware Security Module. This is dedicated hardware designed specifically to protect cryptographic keys.

Easy way to remember it:

DEK encrypts the data.
KEK encrypts the DEK.

01/07/2026

One CISSP topic that could prove to be confusing is memory addressing.

Not because it's difficult.

But because it's often explained using computer architecture terminology that makes it sound far more complicated than it really is.

At its core, memory addressing answers just one question:

How does the CPU know where the data is?

Once you understand that, the different addressing modes become much easier to remember.

In my latest YouTube video, I explain:

• Register Addressing
• Immediate Addressing
• Direct Addressing
• Indirect Addressing (Pointers)
• Base + Offset Addressing
..using simple examples instead of textbook definitions.

You can watch the video here:

https://youtu.be/HqBU9AacfXc?si=dVWLdI5V6yU1MiXN

I hope it helps make this topic a little clearer.

If you find the video helpful, consider subscribing!

If memory addressing has sounded confusing, this video is for you....

23/06/2026

Today's concept is from Domain 3 - and it's one of those ideas that sounds simple on the surface but has a security implication that the CISSP exam could absolutely test you on.

It's called transitive trust.

Here's the core idea.

If A trusts B, and B trusts C, then A automatically trusts C.
Not because A and C ever directly agreed to trust each other. But because the trust flows through B.

Here's a real-world example.

Active Directory

Domain A trusts Domain B. Domain B trusts Domain C.
Result: users in Domain A can access resources in Domain C - even though Domain A never explicitly established a trust relationship with Domain C. The trust travelled through Domain B automatically.

Now, this can be useful. It reduces administrative overhead and allows large organisations to share resources across domains without manually configuring every possible trust relationship.

But here's the problem.

What if you didn't want Domain A users accessing Domain C resources? The trust chain doesn't care. It allows it anyway. And if Domain B - the intermediate node - gets compromised by an attacker, that attacker doesn't just own Domain B. They potentially have a pathway into everything connected to the chain.

So what's the fix when you don't want transitive trust to operate?

Zero Trust.

Zero Trust eliminates transitive trust by requiring explicit authentication and authorisation for every single access attempt - regardless of who the user is, where they're coming from, or what existing trust relationships are in place.

No implicit trust.

No chain shortcuts.

Verify every time.

The exam will not ask you to define transitive trust. It will give you a scenario - a user accessing a resource they shouldn't be able to reach, or a compromised intermediate node creating a cascade of risk - and test whether you can identify what's happening and what should be done about it.

Now you can.

Hope that helps.

18/05/2026

🚨 In the CISSP exam, you risk getting copyright related questions wrong - not because you don't know the law, but because you could be carrying one false assumption into the exam.

Most people think copyright is something you apply for.
Something you register. Something that takes time and paperwork.

It doesn't.

The moment you create an original work - a book, a song, a photograph, a piece of code, a painting - you own the copyright.
Automatically.
No registration required.

While there is a formal process to obtain a copyright, officially registering a copyright is NOT a prerequisite for copyright enforcement.

That is one of the most important things to understand about copyright, and it's a concept the CISSP exam could very well test.

Now here's an act related to copyright that you should be aware of - DMCA.

DMCA - the Digital Millennium Copyright Act - is a US law that takes copyright protection into the digital world.

It makes it a crime to illegally copy digital copyright material.

Not that just, it also criminalizes the creation and use of tools or technology designed to bypass the protection mechanisms on that material.

Think of the copy protection on a DVD, or the license controls on software. Those are DRM - Digital Rights Management - controls.

DMCA makes it illegal to circumvent them. Not just the act of copying - but even building the tool that could do it.

Hope that helps.

04/05/2026

Pointer Dereferencing - one of those CISSP concepts that, once you understand, feels so simple, otherwise, you can get so easily confused in its questions.

Let’s simplify it.

Imagine your system’s memory like a set of lockers.

Locker address = where the data is stored
Value = what’s inside the locker

Now, instead of directly working with the value, programs sometimes store the address of that locker.

That’s called a pointer.

👉 Pointer = “Go to this address and fetch whatever is there”

So what is pointer dereferencing?

It’s simply:

👉 Going to that address
👉 And fetching the actual value

Pointer → address
Dereferencing → fetching the actual value at that address

Now here’s where things get interesting (and dangerous)

What if the pointer is pointing to…

👉 nothing (NULL value)?
👉 an empty location?
👉 an invalid value?

That’s when you get a "null pointer exception".

The program goes looking for a value…

…and finds nothing.

Result?

❌ Crash
❌ Unexpected behavior

Why does this matter for CISSP?

Because this is not just a programming concept.

It connects to:

- secure coding practices
- application reliability
- vulnerability prevention
- input validation and error handling

And yes… you can absolutely get questions around this.

Most people try to memorize terms like this.

But CISSP doesn’t test memory.

It tests whether you actually understand what’s happening behind the scenes.

If you’re serious about clearing CISSP…

And you want to actually understand concepts like these (instead of just cramming)…

I’m starting the next CISSP cohort from Domain 1 next week.

If you’d like to join, book a quick 1:1 call with me (at https://calendly.com/hemantsajwan ) and I’ll walk you through how the program works and whether it’s the right fit for you.

Let’s make this simple 👍

Welcome to my scheduling page. Please follow the instructions to add an event to my calendar.