Changelog · CISSP Pocket Trainer

20 Oct 2026

Feature — Quick Wins

Added a third "Before you test" tool: ⚡ Quick Wins — a static, same-for-everyone reference of the high-certainty, easy-points material worth memorizing cold: ISC2 Code of Ethics canon order, SOC report types, Cloud service model responsibilities, quantitative risk formulas, BCP/DRP recovery metrics, risk response options, due care vs due diligence, the control category/type matrix, OSI 7 layers, important port numbers, private IP ranges, wireless security evolution, a hash/cipher cheat list, and a grab bag of other quick facts — plus exam-day reminders. Subscriber feature, same as Cram Mode and Cheat Sheet

20 Oct 2026

Feature — Cram Mode and Cheat Sheet are subscriber features

Both now show locked during the free trial, with a prompt to subscribe — same pattern as the other trial limits (full-length exams, Notes, Pop Quiz)

20 Oct 2026

Feature — Tap to expand a Cheat Sheet entry

Cheat Sheet entries show a short preview by default; tapping one now expands it in place to show the full question and full explanation, then collapses back on a second tap

20 Oct 2026

Feature — More scannable Cheat Sheet entries

Cheat Sheet question and explanation text is now truncated to a short, word-boundary-safe one-liner per entry instead of showing the full text, so a page full of weak spots is easier to scan quickly. The underlying questions/explanations are unchanged everywhere else — this only affects how they're displayed on this one screen

20 Oct 2026

Fix — Stale stats bar and missing context in Cheat Sheet

Opening Settings, Profile, Admin, or Cheat Sheet right after finishing a session (e.g. Cram Mode) could leave the top stats bar (card count, got/again, progress) showing numbers from that just-finished deck instead of the real current one — now refreshed on open
Cheat Sheet entries showed only the topic label and the answer's explanation, reading like an answer key with no scenario attached. Each entry now also shows the actual question text, so there's context for what's being explained

20 Oct 2026

Change — Cram Mode counts toward progress again

Cram Mode briefly went read-only; answering a question during Cram Mode now updates "Your Coverage" again, same as a normal Quiz session

19 Oct 2026

Feature — Cram Mode and Cheat Sheet

Added a "Before you test" section to the Practice Exam setup screen with two new pre-exam tools: 🔥 Cram Mode, a quiz session built from your review and flagged questions (weakest domain first — a refresher pass that doesn't affect your scores), and 📋 Cheat Sheet, a read-only scan of the key facts (topic + explanation) behind those same weak spots, grouped by domain

19 Oct 2026

Feature — More Focus points per domain

"Where to focus" now lists up to 10 missed questions per domain instead of 3

18 Oct 2026

Fix — Reviewing a Test's questions double-counted progress

"Review Incorrect/All/Flagged" on the exam results screen re-scored each question a second time when answered during review, on top of the result finishTest() already recorded — skewing "Your Coverage" mastery stats. Reviewing a Test's own questions no longer touches progress; normal Flashcards/Quiz sessions (including their own "review missed" flow) are unaffected

17 Oct 2026

Feature — "Where to focus" hint animation

Since the section is collapsed by default, its header now gives a brief 3-second pulse when Test History loads, hinting that it can be tapped open

17 Oct 2026

Feature — Real topic labels for Focus points

"Focus points" under each domain now show a short topic label (e.g. "RAID 5 vs RAID 1 fault tolerance") naming the actual CISSP concept, instead of a truncated chunk of the raw question text

17 Oct 2026

Feature — "Where to focus" summary on Test History

Added a plain-English breakdown below the domain averages: a weakest-first rating per domain plus "Focus points" — the specific questions you've missed most in that domain, pulled from your Flashcards/Quiz/Test progress history

17 Oct 2026

Feature — Overall average on Test History

Added an "Overall average" card to Test History, pooled correct/total across every recorded exam (same methodology as the per-domain averages below it)

17 Oct 2026

Feature — Last login on admin Signups screen

Each user's row now shows their last login time (or "never" if they haven't signed back in since signing up)

17 Oct 2026

Feature — Free trial limitations

Practice Exam is capped at 25 questions during the free trial — 50/75/100/125 show locked with a prompt to subscribe for full-length exams
Notes and Pop Quiz are reserved for subscribers — both are fully available again the moment a trial converts to an active subscription
Admin Signups screen now flags trial accounts that share a signup IP with another account, as a heads-up for possible trial abuse (not an automatic block — shared IPs happen legitimately too)

17 Oct 2026

Feature — Next payment date on Account screen

Active subscribers now see when their next payment is due on the Account screen, alongside the existing "Active subscription — €9/mo" status

17 Oct 2026

Fix — Unescaped signup emails in admin dashboard

The Signups screen rendered each user's email straight into the page, including inside a button's click handler, without escaping it — a crafted signup email could have run script in the admin's browser. Emails and audit log entries are now HTML-escaped and action buttons read the user id/email from data attributes instead of inlining them into JS code

17 Oct 2026

Feature — Self-service account cancel/delete + admin audit log

Added a "Danger Zone" to the Account screen: "Cancel Account" (cancels your subscription and blocks access, keeps your data) and "Delete Account & All Data" (cancels your subscription and permanently deletes everything — requires typing your email to confirm)
Every cancel/delete action — self-service or admin-triggered — is now written to an audit log an admin can see on the Signups screen, so a permanently deleted account still leaves a record of who removed it and when

17 Oct 2026

Feature — Admin dashboard: subscription detail + revoke/delete

The Signups admin screen now shows each user's trial/renewal expiry date and payment status alongside their subscription state
Added two per-user admin actions: "Revoke access" (cancels their subscription and blocks access, but keeps their data) and "Delete permanently" (cancels their subscription and fully deletes their account and all data — requires typing their email to confirm)

16 Oct 2026

Feature — Way back from "Review Missed"

Reviewing your missed cards after a Flashcards/Quiz round previously had no way back to the full round summary — now a "← Back to round summary" link is shown while you're reviewing, and finishing the review naturally also returns you there automatically instead of a confusing mini-summary for just the missed cards

16 Oct 2026

Fix — Sync status wrapping awkwardly on narrow phones

The "● synced" text in the top bar was overflowing/wrapping on narrower phone screens. It now shows just the colored dot on narrow screens (tap-and-hold or hover for the full status), with the text label still shown on wider screens

16 Oct 2026

Feature — Weakest domains pre-selected on a new Test

A fresh Practice Exam setup now automatically checks whichever domains are below 70% (same list as the "Weakest domains" callout) instead of defaulting to All Domains
If you manually change the domain selection, it's respected — switching tabs and back won't reset your choice, only starting an actual test and later returning for a new one will

15 Oct 2026

Feature — Gold star confetti on a passing exam

Score 70% or higher on a Practice Exam and a shower of small golden stars plays over the results screen

15 Oct 2026

Fix — Pop Quiz still interrupting mid-decision in Test mode

The previous fix protected the one question that was on screen when Pop Quiz became due, but once you navigated away, the very next question — equally fresh, equally unconsidered — was immediately treated as fair game
It now requires the current question to both have an answer recorded AND have stayed on screen across two checks a few seconds apart, so it won't fire on a question you've just arrived at, however you navigate
Recall window increased from 10 to 20 seconds

15 Oct 2026

Content — Fixed mismatched pronouns in 4 scenario questions

A few questions referred to a scenario's named person with the wrong pronoun (e.g. "Steve" referred to as "her"). Swept the full question bank for every name/pronoun combination and fixed all 4 found

14 Oct 2026

Fix — Pop Quiz interrupting mid-decision in Test mode

Test mode has no "confirm answer" step, so a single tap on an option was being treated as "submitted," letting Pop Quiz interrupt even while you were still comparing choices or about to change your mind
It now waits until you've actually navigated away from the question that was on screen when it became due, not just until you've tapped something

12 Oct 2026

Polish — Pop Quiz visuals

The background now blurs and picks up a soft blue tint behind the card when a Pop Quiz pops up, so it stands out more clearly from whatever you were doing

12 Oct 2026

Feature — Pop Quiz

New opt-in setting (Settings → Pop Quiz): a random flashcard pops up every so often — anywhere except the Flashcards section — giving you 10 seconds to recall it before the answer is revealed and the popup closes on its own
Interval is configurable (2 / 5 / 10 / 15 minutes, or fully random between 1–15 minutes each time)
Pauses the study timer while it's up, and the exam countdown too if you're mid-Test; both resume automatically once you've answered. If you're answering a Quiz or Test question, it waits until you submit before popping up rather than interrupting mid-thought
Answering it (tap to flip, then rate) counts toward your real Flashcards progress, same as a normal review; letting it time out doesn't count as an attempt

09 Oct 2026

Fix — Notes button showing on the sign-in screen

The 📝 notes flyout was visible (and usable) even before signing in, since it sat on top of the sign-in/paywall overlay. It's now hidden until you're actually signed in, and auto-closes if you sign out while it's open

09 Oct 2026

Feature — Collapsible Coverage tables

The "Your Coverage" tables (Settings and Test setup screens) now start collapsed to a one-line summary — tap it to expand the full per-domain breakdown. Your preference is remembered, and each table (Flashcards / Quiz Questions) expands independently

09 Oct 2026

Content — Removed a copyrighted reference

A question referencing "RDA" and an "Avatar control system" (matching the mining corporation from the film Avatar) had slipped through earlier content-cleanup passes; replaced with an original company and system name

08 Oct 2026

Feature — Reset Review Items

A new "Reset Review Items" link on the Coverage screen clears only the negative-scored Quiz Questions back to new — useful for wiping out the stale "review" numbers left behind by the exam-scoring bug fixed earlier today, without touching your "mastered" progress, Flashcards, or Test History

08 Oct 2026

Feature — Weakest domains shown before starting a Practice Exam

The Test setup screen now shows your weakest domains (below 70%, from your last 10 exams) right away, instead of only inside Test History — so you can see where to focus before picking domains

08 Oct 2026

Fix — Practice Exams weren't crediting correct answers

Finishing an exam only ever penalized wrong answers; correct ones weren't recorded at all, so the Coverage view could show lots of "review" and almost nothing "mastered" even after a strong exam score
Correct exam answers now count toward mastery exactly like Quiz mode already does. Note: this only fixes it going forward — past exams already scored under the old behavior can't be retroactively corrected, since per-question detail from completed exams isn't stored

08 Oct 2026

Feature — Review all questions after a Practice Exam

A new "Review All" button on the exam results screen lets you flip back through every question from that exam, right or wrong
A perfect score no longer dead-ends at a congratulations screen with nothing else to do — it now offers "Review All Questions" too

08 Oct 2026

Feature — "Unseen only" option for Practice Exams

A new checkbox on the Test setup screen restricts the exam to questions you've never answered, still randomized and still respecting domain selection and Study Priority weights
Fixed a bug where tapping the text next to a domain checkbox (rather than the checkbox square itself) silently did nothing — it now toggles correctly either way

08 Oct 2026

Feature — Notes

A new 📝 tab on the right edge of the screen opens a notes drawer from any screen — Flashcards, Quiz, Test, Settings — without losing your place
Add, edit, and delete freeform notes; they sync to your account like the rest of your progress, so they follow you across devices

08 Oct 2026

Feature — Coverage stats on the Study Priority and Test setup screens

The settings (⚙) screen now shows a per-domain breakdown of how many Flashcards and Quiz Questions you've never answered, still need to review, or have mastered
The Practice Exam setup screen now shows the same breakdown for Quiz Questions, so you can see your coverage before picking domains and question count

07 Oct 2026

Feature — Study Priority weights now apply to Test mode

Previously, domain weights only affected Flashcards and Quiz sessions — Test exams pulled questions uniformly at random regardless of your settings
Test exams now give a higher-weighted domain a proportionally larger share of the questions, while still covering every selected domain

04 Oct 2026

Content — Fixed a corrupted character encoding

One question's text had a name mangled by a double-encoding bug ("AndrÃ©" instead of the intended name); fixed and standardized to the scenario name pool

03 Oct 2026

Content — 249 new practice questions added

Added two new batches of exam questions (125 complex scenario-based, 124 easy/mid difficulty) across all 8 domains, cleaned up and formatted to match the rest of the question bank

30 Sep 2026

Content — Unique names for each scenario

A handful of scenario questions had accidentally ended up sharing a company/setting name with a completely unrelated question; each now has its own distinct one

30 Sep 2026

Feature — Changelog restricted to admins

This page now checks your account before showing anything — only admin accounts can view it, and the "view changelog" link in the app's footer is hidden for everyone else

30 Sep 2026

Feature — Admin signup notifications and dashboard

The admin now gets an email the moment a new user signs up
Added a 👥 dashboard (visible only to admin accounts) listing every signed-up user with their signup date and subscription status

29 Sep 2026

Improvement — Weakest domains shows every domain under 70%

The "Weakest domains" callout in Test History previously capped at the 3 lowest-scoring domains; it now shows every domain still under the 70% passing threshold, wrapping to further rows as needed

28 Sep 2026

Feature — Weakest domains callout in Test History

Test History now highlights your weakest domains as quick-glance blocks right above the full domain averages table

27 Sep 2026

Improvement — "Review all" moved to the top

On the "Again (tap to review)" screen, the "Review all flashcard(s)/question(s) in order" button(s) now appear right at the top, before the individual card list, instead of below it

27 Sep 2026

Feature — Domains covered in Test History

Each attempt on the Test History list now shows which domains it covered, as small color-coded badges under the score

21 Sep 2026

Feature — Domain averages in Test History

The Test History screen now shows a "Domain averages" table pooling your score across every recorded exam, so weak domains stand out even if no single attempt covered them heavily

18 Sep 2026

Fix — PWA not picking up new versions

The offline service worker file hadn't changed since launch, so installed apps never went through an update check no matter how many times the site itself changed
Added a visible "Update available" banner with a Refresh button, and the app now checks for a new version on load and hourly instead of relying on the browser's own schedule

18 Sep 2026

Feature — Test History

Added a "View Test History" link on the Practice Exam screen and every results screen, showing your last 10 exams with date, score, and pass/fail
Tap any past attempt for its full domain breakdown, same as right after finishing it

16 Sep 2026

Feature — See what to focus on after a deck

The deck-complete screen now shows a "This round by domain" breakdown when a session spans more than one domain, and a "Focus on this round" list of every card you missed with its explanation right underneath
Added a "Review Missed" button that loads just those cards into a fresh round, so you can drill them immediately instead of restarting the whole deck

13 Sep 2026

Feature — Pause the study timer

Added a ⏸ button next to "Total study time" to manually pause/resume the timer for when you step away from your computer without switching tabs (which already paused it automatically)

13 Sep 2026

Feature — Review all "Again" cards in one go

The "Again (tap to review)" list now has "Review all flashcard(s)/question(s) in order" buttons that step through every card marked "Again" back-to-back, instead of tapping into the list one card at a time

13 Sep 2026

Fix — New accounts could inherit another account's study time

A brand-new account (or one whose study time hadn't synced yet) could show hours logged by whichever account last used that browser, instead of starting from zero
The study-time lookup now treats "no record yet" as zero instead of mistaking it for an error and falling back to a locally cached total that may belong to a different account

13 Sep 2026

Content — Domain 6: SOC report types

D6 (Security Assessment & Testing): +12 flashcards and +8 questions covering SOC 1 vs SOC 2 vs SOC 3, Type I vs Type II reports, the Trust Services Criteria, and the AICPA/SSAE 18 standard behind them
D6 grows to 188 questions and 53 flashcards

5 Sep 2026

Fix — Data could leak between accounts on a shared device

Signing out and into a different account could briefly (or, if a request was still in flight, persistently) show the previous account's progress, flags, study time, or in-progress exam, because cached data wasn't cleared or protected against slow-to-resolve requests from the account you just left
Signing out now wipes all locally cached study data, and every in-flight load is tagged to its session so a stale one can no longer overwrite the account you're actually signed into

5 Sep 2026

Feature — Dedicated Account page

Account info (email, subscription status, billing) moved out of Settings into its own screen, opened via a new 👤 button in the top nav
Added an explicit "Cancel Subscription" button that jumps straight to Stripe's cancellation flow, separate from "Manage Billing" (update card, view invoices)
Fixed password-reset links unlocking the app immediately instead of showing the "set a new password" form

5 Sep 2026

Feature — Accounts and subscriptions

Replaced the shared access password with individual accounts (email + password) — sign up, sign in, and reset your password from the app
New accounts get a 7-day free trial, no card required; after that a €9/mo subscription (via Stripe) is needed to continue
Manage or cancel billing anytime from Settings
Progress, flagged questions, study time, and in-progress exams are now private to your account instead of shared

2 Sep 2026

Feature — Test your flagged questions

Flagged questions now persist and sync across devices instead of resetting when an exam ends
Added a ⚑ Flag toggle to Quiz Mode cards, so you can build a flagged set during normal study, not just during an exam
The Test Mode setup screen has a new "Test N Flagged Questions" button that runs an exam built only from everything you've flagged (respects the timer toggle), plus a "Clear all flags" link

1 Sep 2026

Feature — Resumable exam sessions

An in-progress practice exam is now saved automatically as you go (answers, flags, current question, timer) and synced to Supabase
Leave mid-exam and come back — on this device or another — and Test Mode offers "Resume Exam" or "Discard & Start New" instead of losing your progress
The saved exam is cleared automatically once you submit

1 Sep 2026

Feature — 10-question option in Test Mode

Added a 10 button to the practice exam question-count selector for quick short sessions
Timer suggestion for exams of 15 or fewer questions is now 20 minutes instead of 60

1 Sep 2026

Feature — Wrong Test answers feed the Again review list

When you submit a practice exam, every question you got wrong or left unanswered is now marked "Again" — the same as missing it in Quiz mode
Those questions show up in the "Again (tap to review)" list (and the red Again counter), in addition to the existing post-test "Review Incorrect" screen

30 Aug 2026

Design — Muted accent color

Replaced the bright yellow accent color (#f7c34f) with a more subtle muted blue (#5b8dd6) across buttons, progress bars, selected states, links, and the app icon

30 Aug 2026

Feature — Flag review in Test Mode

Added a "→ Next flagged" button so you can jump directly between flagged questions during a test instead of paging through with Prev/Next
Added a "Review Flagged" button on the results screen (next to Review Incorrect) that opens all flagged questions in quiz mode for a second pass

29 Aug 2026

Content — 125 new questions for Domain 8

D8 (Software Development Security): +125 questions covering the ACID model, database integrity types (referential/semantic/entity), SDLC & security integration, Agile/Scrum/SAFe/DevOps/DevSecOps, CI/CD pipeline security, OWASP-style vulnerabilities (SQL injection, XSS, XXE, SSRF, buffer overflow), CMM/SAMM/BSIMM maturity models, open-source licensing, and secure coding practices
D8 grows from 119 to 244 questions, now comfortably ahead of its 11% exam weight
1 multi-select source question was rewritten as single-best-answer to match the app's format

29 Aug 2026

Content — 125 new questions for Domain 2

D2 (Asset Security): +125 questions covering data states (in use/at rest/in transit), data classification & labeling, data retention & de-identification, media/SSD/tape disposal and data remanence, CASB & cloud data security, memory types (ROM/PROM/EPROM/EEPROM/RAM/SRAM/DRAM), asset ownership & inventory management, data owner/custodian roles, and intellectual property protection
D2 grows from 91 to 216 questions, closing most of the gap versus its 10% exam weight
2 multi-select source questions were rewritten as single-best-answer to match the app's format

29 Aug 2026

Content — 125 new questions for Domain 5

D5 (Identity & Access Management): +125 questions covering DAC/MAC/RBAC/ABAC/rule-based access control, the IAAA model, biometric error rates (FAR/FRR/CER/FTER), SSO & federated identity (SAML), Kerberos/RADIUS/TACACS+/Diameter/SESAME/LDAP/CHAP/PEAP, smart cards & OTP tokens, password policy, PKI/CRL/registration authorities, access control types, account de-provisioning, and IDaaS
D5 grows from 117 to 242 questions, now comfortably ahead of its 13% exam weight
2 multi-select source questions were rewritten as single-best-answer to match the app's format

29 Aug 2026

Content — 123 new questions for Domain 6

D6 (Security Assessment & Testing): +123 questions covering red/blue teaming, penetration testing types (white/gray/black box), SOC 1/2/3 reports, CVSS/CWE/CWSS scoring, phishing & social engineering variants, audit types (structured/unstructured/compliance/internal/external), chaos engineering, continuous monitoring, and security control assessments
D6 grows from 57 to 180 questions, closing most of the gap versus its 12% exam weight
2 near-duplicate questions from the source set were dropped rather than risk fabricating content not present in the original material

29 Aug 2026

Content — 125 new scenario-based questions across all 8 domains

Added a large batch of longer, judgment-based scenario questions (executive/CISO decision-making style) spanning every domain: D1 +20, D2 +12, D3 +17, D4 +16, D5 +16, D6 +15, D7 +17, D8 +12
Question bank now totals 1,301 questions plus 527 flashcards

29 Aug 2026

Content — 20 more software development security questions (Domain 8)

D8 (Software Development Security): +20 questions on UEBA/EDR/MDR, ransomware response, APT zero-days, buffer overflow & TOC/TOU vulnerabilities, error-handling constructs, directory traversal, logic bombs, SQL injection (characters, parametrized queries, defences), cryptomalware, cross-site scripting, IP spoofing firewall rules, and malware classification (d8_q_088–107)

29 Aug 2026

Content — 20 new software development security questions (Domain 8)

D8 (Software Development Security): +20 questions on DevOps/DevSecOps, input validation, change management (request/release/configuration control), fail-secure vs. fail-open, SDLC models (iterative waterfall, Agile, SW-CMM), SAMM, database keys & referential integrity, aggregation/inference/polyinstantiation/contamination, ODBC, static vs. black-box testing, Gantt charts, COTS software, and transaction ACID properties (d8_q_068–087)

29 Aug 2026

Content — 20 new investigations & ethics questions (Domain 7)

D7 (Security Operations): +20 questions on computer crime categories (military/intelligence, financial, terrorist, grudge, thrill attacks), evidence handling & types (documentary, testimonial, best evidence, parol evidence), investigation standards, root cause analysis, the Electronic Discovery Reference Model (EDRM), log retention, search warrants, and the (ISC)² Code of Ethics & RFC 1087 (d7_q_296–315)

29 Aug 2026

Content — 20 new disaster recovery questions (Domain 7)

D7 (Security Operations): +20 questions on DRP vs. BCP scope, RPO/RTO/MTD/MTBF metrics, fault tolerance (RAID, load balancing), alternate site types (hot/warm/cold), remote mirroring & electronic vaulting, UPS/generators, DR test types (parallel, simulation, full-interruption), backup strategies (full/differential/incremental), software escrow, and restoration prioritisation (d7_q_276–295)

29 Aug 2026

Content — 20 more security operations questions (Domain 7)

D7 (Security Operations): +20 questions on incident management steps, basic security controls, audit trails & logging, Fraggle/Smurf DoS attacks, zero-day exploits, false positives/negatives, signature- vs. anomaly-based IDS, HIDS/NIDS/NIPS placement, mirrored switch ports, SIEM/SOAR, DLP egress monitoring, and threat hunting (d7_q_256–275)

29 Aug 2026

Content — 20 new security operations questions (Domain 7)

D7 (Security Operations): +20 questions on need-to-know vs. least privilege, privileged account management, segregation of duties, job rotation & mandatory vacations, SLAs, cloud service models (IaaS/PaaS/SaaS), system imaging, and change/patch/vulnerability management (d7_q_236–255)

29 Aug 2026

Content — 20 new security assessment & testing questions (Domain 6)

D6 (Security Assessment & Testing): +20 questions on network/vulnerability/web scanning tools (Nmap, Nessus, Metasploit, Nikto), port scan result triage, security assessment scope & reporting, TCP SYN scans, authenticated vs. unauthenticated scans, tabletop/red-blue-purple team exercises, fuzzing (mutation) & misuse case testing, interface testing, white-box pentesting, and SOC report types (d6_q_023–042)

29 Aug 2026

Content — 20 more identity & access management questions (Domain 5)

D5 (Identity & Access Management): +20 questions on access control models (DAC, MAC, RBAC, rule-based, risk-based, ABAC), the MAC lattice & environment types, access control matrices, OIDC/SSO, Kerberos & NTP time sync, RADIUS architecture, Linux root privilege management, and pass-the-hash/golden ticket attacks (d5_q_082–101)

29 Aug 2026

Content — 20 new identity & access management questions (Domain 5)

D5 (Identity & Access Management): +20 questions on federated identity, subjects vs. objects, password policy (NIST SP 800-63B), passphrases, synchronous authenticators, biometric accuracy (CER/false rejection/false acceptance), fingerprint minutiae, accountability & logging, Linux privilege roles, and account lifecycle management (termination, leave of absence, service accounts, access review) (d5_q_062–081)

29 Aug 2026

Content — 20 more networking & communications security questions (Domain 4)

D4 (Communication & Network Security): +20 questions on transparency vs. security controls, EAP methods, PBX/phreaking, multimedia collaboration, screened subnet DNS/NAT, remote access authentication protocols, QoS troubleshooting, RFC 1918 addressing, VPN linking, VLANs, port security, IPSec modes, and email security/retention (d4_q_142–161)

29 Aug 2026

Content — 20 new networking & communications security questions (Domain 4)

D4 (Communication & Network Security): +20 questions on TCP/UDP fundamentals, IPv4/IPv6 coexistence, TLS, VoIP network design, micro-segmentation, IoT wireless (Zigbee/cellular), CDN, ARP/MAC attacks, SAN deduplication, switches/bridges/routers, screened subnets, Faraday cages, NAC, EDR, and firewall types (d4_q_122–141)

29 Aug 2026

Feature — Adjustable study priority per domain

Added a settings screen (⚙ button in the nav bar) to view and change how strongly each domain is weighted in the spaced-repetition ordering used by Flashcards & Quiz
Weights are stored locally and persist across sessions, with a "Reset to Defaults" option
D3 (Security Architecture & Engineering) default weight raised from 2 to 3, matching D1/D4/D6, reflecting its growth to 201 questions this month
Fixed a race condition where the background progress sync could silently discard an open settings screen

26 Aug 2026

Content — 20 new physical & site security questions (Domain 3)

D3 (Security Architecture & Engineering): +20 questions on CPTED, facility/site design, security cameras, server room environmentals, media storage, cable plant management, fire suppression, physical access controls, and motion detectors (d3_q_182–201)

26 Aug 2026

Content — 20 new vulnerabilities, threats & countermeasures questions (Domain 3)

D3 (Security Architecture & Engineering): +20 questions on shared responsibility, mobile code, grid/cloud/distributed computing, SCADA/ICS, memory security, virtualisation & containerisation, embedded systems, edge/fog computing, and mobile device strategy (d3_q_162–181)

26 Aug 2026

Content — 20 new security models & TCB questions (Domain 3)

D3 (Security Architecture & Engineering): +20 questions on security models (Bell–LaPadula, Biba, Clark–Wilson), trusted computing base, reference monitor, security perimeter, Common Criteria, and authorisation to operate (d3_q_142–161)

25 Aug 2026

Content — 20 new asymmetric cryptography & PKI questions (Domain 3)

D3 (Cryptography): +20 questions on asymmetric cryptosystems (RSA, ElGamal, ECC), hashing, digital signatures, X.509/PKI, certificate formats, and cryptographic attacks (d3_q_122–141)

25 Aug 2026

Content — 100 new review questions across Domains 1–3

D1 (Security & Risk Management): +80 questions covering security concepts, personnel security, third-party/supply chain risk, risk assessment & response, threat modelling, BCP planning & BIA, and laws/regulations/compliance (d1_q_092–171)
D2 (Asset Security): +20 questions on data classification, data roles, data lifecycle & destruction, and DRM (d2_q_060–079)
D3 (Cryptography): +20 questions on symmetric key management, cipher modes, and algorithm selection (d3_q_102–121)
Multi-select source questions (choose two/all that apply) were reframed as single-best-answer to match the quiz engine's one-correct-option format

19 Aug 2026

Content — Abbreviation expansions across all explanations and flashcard backs

Added full name in brackets on first occurrence of every CISSP abbreviation across 354 question explanations and 255 flashcard backs
Covers 100+ abbreviations: ALE, ARO, SLE, EF, AV, BIA, BCP, DRP, RTO, RPO, MTD, MOR, CIA, DAD, STRIDE, DREAD, KPI, KRI, RACI, COBIT, NIST, ISO, SOX, HIPAA, GDPR, PII, PHI, TCSEC, EAL, IAAA, IAM, DAC, RBAC, ABAC, ACL, SSO, MFA, OTP, HOTP, TOTP, EAP, CHAP, PAP, RADIUS, TACACS, LDAP, SAML, OIDC, KDC, TGS, TGT, PAM, AES, DES, RSA, ECC, MD5, SHA, HMAC, PKI, CA, CRL, OCSP, PGP, IV, CBC, DSA, TCP, UDP, HTTP, HTTPS, FTP, SSH, SSL, TLS, DNS, DHCP, ARP, ICMP, SNMP, SMTP, BGP, OSPF, VPN, VLAN, LAN, WAN, DMZ, NAT, IPSec, IKE, ISAKMP, ESP, SA, SPI, WEP, WPA2, TKIP, CCMP, SSID, UTP, ASN, RIR, OSI, IDS, IPS, SIEM, SOAR, DLP, WAF, CDN, SCADA, ICS, PLC, RAID, UPS, HVAC, SDLC, CMM, BSIMM, RAD, SQL, DDL, XSS, CSRF, IDOR, ASLR, IGMP, IGRP, IPv4, IPv6, and many more
Context-aware handling for ambiguous terms: MAC expands to Mandatory Access Control, Media Access Control, or Message Authentication Code based on surrounding text; STP expands to Spanning Tree Protocol or Shielded Twisted Pair; AH only expands in IPSec context

17 Aug 2026

Feature — Test Mode (Practice Exam Simulator)

Added a new "Test" tab alongside Flashcards and Quiz — fully separate from existing modes, no changes to existing behaviour
Setup screen: choose question count (25 / 50 / 75 / 100 / 125), select which domains to include (D1–D8 checkboxes with per-domain question counts), and optionally enable a countdown timer
Exam screen: one question at a time, options shuffled, no right/wrong feedback shown during the test — simulates real CISSP exam conditions
Flag questions for review with ⚑ button; navigation shows answered/flagged counters
Timer auto-submits when time expires; warns at <5 minutes remaining
Results screen: percentage score with PASS/FAIL verdict (70% threshold), domain-by-domain breakdown with progress bars
Review Incorrect button loads missed questions directly into Quiz mode for immediate study

07 Aug 2026

D7 — BCP highest priority, DRP key element, BCP NOT-a-component (d7_q_167–169)

Added 3 questions: BCP highest priority = employee safety (not IT/data/assets); DRP key element = data backup (not training/fire prevention/IDS); legal and regulatory compliance is NOT a BCP component (backup+recovery, risk assessment, employee training are) (d7_q_167–169)

07 Aug 2026

D7 — BIA timeline: MTBF/MOR context, RPO backward window, WRT phases, full sequence

Added 6 questions: MTBF for spare-parts planning, MOR definition (min environmental + connectivity requirements), MOR at DR sites = no need for full-spec system, RPO runs backward from disaster to last backup, WRT = restore backups + systems testing, correct timeline sequence (d7_q_161–166)
Added 2 flashcards: MTBF/MTTR/MOR BIA context with relationships; BIA recovery timeline — full sequence from Normal Business to Resume Production with span of each metric (d7_fc_070–071)

07 Aug 2026

D7 — MTD, RTO, WRT: definitions, formula (MTD ≥ RTO + WRT), exam aliases for MTD

Added 6 questions: MTD = max tolerable downtime, RTO = hardware restore time, WRT = software config time, MTD ≥ RTO + WRT formula, RTO must not exceed MTD, exam term = MTD (not MAD/MTO/MAO/MTPoD), scenario: RTO+WRT=9h vs MTD=8h → plan fails (d7_q_155–160)
Added 1 flashcard: MTD/RTO/WRT definitions, formula, calculation example, exam aliases, and link to RPO for complete recovery picture (d7_fc_069)

07 Aug 2026

D7 — BIA and RPO: criticality classification, two BIA values, RPO drives backup frequency

Added 6 questions: BIA = identifies critical/non-critical systems; critical = disruption unacceptable / cost of recovery / law; RPO = max tolerable data loss; weekly backup → RPO = up to 1 week; BIA assigns 2 values per critical system (RPO + RTO); legal mandate → critical + near-zero RPO (d7_q_149–154)
Added 1 flashcard: BIA — what it is, criticality criteria (unacceptable disruption / cost / law), RPO definition, backup frequency link, and cross-reference to RTO (d7_fc_068)

07 Aug 2026

D7 — BCP sub-teams: Rescue (activation), Recovery (failover), Salvage (failback) — roles and system priority

Added 6 questions: 3 sub-team names, Rescue Team = during disaster (evacuate/notify/shut down/damage assessment), Recovery Team = most critical systems first at alternate site, Salvage Team = least critical first when returning to primary site, Recovery vs Salvage priority distinction, scenario — failback to rebuilt primary site = Salvage Team (d7_q_143–148)
Added 1 flashcard: all 3 BCP sub-teams with roles, triggers, and exam trap — Recovery (failover) = most critical first; Salvage (failback) = least critical first (d7_fc_067)

07 Aug 2026

D7 — DRP lifecycle: Mitigation, Preparation, Response, Recovery — definitions and pre/post-disaster

Added 6 questions: DRP 4 phases in order, Mitigation = reduce impact/likelihood, Preparation = build programs/procedures/tools, Recovery = reestablish functionality, pre-disaster (Mitigation+Preparation) vs post-disaster (Response+Recovery), scenario question — flood contained → enter Recovery phase (d7_q_137–142)
Added 1 flashcard: DRP lifecycle — all 4 phases with definitions, pre/post-disaster split, supporting elements (Education/Plans/Training → Preparation; DR/BCP/EOP → Response/Recovery) (d7_fc_066)

07 Aug 2026

D7 — BCP: definition, scope, sub-plans (COOP/DRP/ISCP), statistics, lifecycle phases

Added 6 questions: BCP definition, BCP scope = entire org not just IT, 43% never reopen / 29% close within 2 years, data classification NOT a BCP sub-plan, COOP = Continuity of Operations Plan, BCP lifecycle = Analysis → Solution Design → Implementation → Test & Acceptance → Maintenance (d7_q_131–136)
Added 1 flashcard: BCP full summary — definition, scope, why it matters (statistics), all 7 sub-plans, and 5-phase lifecycle (d7_fc_065)

07 Aug 2026

D7 — e-vaulting, server CPU non-redundancy, RAID striping minimum disk count

Added 3 questions: e-vaulting = automatic offsite incremental transfer for disaster recovery; CPUs are NOT commonly redundant in standard servers (vs power supplies, NICs, and hard drives which are); RAID striping minimum = 2 disks (d7_q_128–130)
Added 1 flashcard: e-vaulting — definition, how it works, key characteristics, and what distinguishes it from local backup (d7_fc_064)

07 Aug 2026

D7 — Continuity of Operations: RAID (0, 1, 5), disk mirroring vs striping, MTBF, MTTR

Added 9 questions: RAID acronym, RAID 0 (striping/no redundancy/2 disks), RAID 1 (mirroring/identical data/writes simultaneously), RAID 5 (block striping + distributed parity/3 disks/speed + redundancy), striping alone has no redundancy (need parity + 3 disks), same-manufacturer disk MTBF risk, MTBF definition, MTTR + SLA (4–8 hour vendor response), scenario: 2 disks fail before rebuild → tape restore (d7_q_119–127)
Added 2 flashcards: RAID 0/1/5 comparison with mirroring vs striping basics; MTBF vs MTTR definitions, same-manufacturer risk, and SLA context (d7_fc_062–063)

07 Aug 2026

D7 — Continuity of Operations: full, incremental, and differential backups

Added 6 questions: full backup = backs everything up, clears all archive bits, infrequent on large datasets, 1-tape restore; Thursday restore from Wednesday full = 1 tape; completeness vs time trade-off (d7_q_101–106)
Added 1 flashcard: full backup — scope, archive bits, 1-tape restore, weekly strategy (d7_fc_059)
Added 6 questions: incremental = backs up since last backup (any type), clears archive bits, fast to create; Thursday restore from Sunday full + daily incrementals = 4 tapes; restore disadvantage vs differential (d7_q_107–112)
Added 1 flashcard: incremental backup — scope, archive bits, 4-tape Thursday restore, fast create / slow restore (d7_fc_060)
Added 6 questions: differential = backs up since last FULL, does NOT clear archive bits, grows larger daily, always 2-tape restore; Thursday restore = Sunday full + Wednesday differential = 2 tapes; never mix incremental and differential on same data (d7_q_113–118)
Added 1 flashcard: differential backup — scope, archive bits NOT cleared, 2-tape restore, comparison table vs incremental (d7_fc_061)

06 Aug 2026

D7 — 0-day vulnerabilities, change management approval, configuration management (d7_q_098–100)

Added 3 quiz questions: 0-day = unknown to vendor / no patch exists (distinguished from 1-day/n-day), change management = process for approving alterations, configuration management = process ensuring changes are implemented efficiently and securely (d7_q_098–100)
Added 2 flashcards: 0-day vs 1-day/n-day vulnerability distinctions; change management (approving changes) vs configuration management (implementing changes) — how they differ (d7_fc_057–058)
D7 milestone: 100 questions total

06 Aug 2026

D7 — Change Management Process: PDCA cycle — Plan, Do, Check, Act phases and sub-steps

Added 6 quiz questions: CAB = Change Advisory Board, Plan phase steps (Request→Analyse→Approve), Do phase steps (plan implementation/communicate/implement and test), Check failure = rollback, Act phase = acceptance + lessons learned, overall cycle = PDCA (d7_q_092–097)
Added 1 flashcard: full PDCA change management process — all 4 phases with sub-steps, success vs failure paths (communicate vs rollback), and how lessons learned feeds back into Plan (d7_fc_056)

06 Aug 2026

D7 — Change Management: board composition, submitter requirements, approval threshold

Added 6 quiz questions: change management definition, board = IT + operational units, why non-IT included, submitter must provide reasons/pros/cons/related changes, board approval threshold with senior leadership escalation, scenario above threshold → recommend not approve (d7_q_086–091)
Added 1 flashcard: change management full breakdown — process, board composition, submitter requirements, approval threshold rule (d7_fc_055)

06 Aug 2026

D7 — Honeypot deployment levels, best honeypot use, application negative/positive list

Added 3 quiz questions: honeynet = highest deployment level, best honeypot use = gather attacker TTPs, application negative list = blacklist of prohibited apps (d7_q_083–085)
Added 2 flashcards: honeypot deployment levels low→high (low-interaction, high-interaction, production, honeynet), application negative list vs positive list with risk comparison (d7_fc_053–054)

06 Aug 2026

D7 — SIEM vs SOAR: cost not a reliable difference, SOAR components, SOAR primary benefit

Added 3 quiz questions: cost is NOT a reliable SIEM/SOAR difference, encryption is NOT a SOAR component (playbooks/case management/threat intel are), primary SOAR benefit = improved response times via automation (d7_q_080–082)
Added 1 flashcard: SOAR core components (playbooks, case management, threat intel, workflows) + what is NOT included (encryption) + primary benefit (d7_fc_052)

06 Aug 2026

D7 — SIEM inputs/outputs, SOAR AI response, integrations, defense-in-depth

Added 6 quiz questions: SIEM centralises all logs for holistic view, SIEM input (event correlation) vs output (file integrity monitoring), SOAR adds AI auto-response, SOAR integrations (VM/ITSM/Threat Intel), combined = defense-in-depth (d7_q_074–079)
Added 2 flashcards: SIEM inputs vs outputs (full capability lists), SOAR breakdown (AI response, integrations, case management, defense-in-depth purpose) (d7_fc_050–051)

06 Aug 2026

D7 — IDS: False Positive prevents authorized traffic, IDS as best detective control, IDS primary function

Added 3 quiz questions: False Positive = authorized traffic blocked, IDS = most effective detective control over firewall/ACL/virus scanner, IDS primary function = monitor and alert NOT prevent/encrypt/authenticate (d7_q_071–073)

06 Aug 2026

D7 — IDS alert states: True/False Positive/Negative scenarios and why false states matter

Added 6 quiz questions: True Positive (brute-force detected), True Negative (clean download, no action), False Positive (200 alerts all legitimate), why we focus on false states, False Negative more dangerous than False Positive, encrypted exfiltration missed = False Negative (d7_q_065–070)
Added 1 flashcard: False Positive vs False Negative — severity comparison, why false states require action, memory hook (boy who cried wolf vs wolf got in) (d7_fc_049)

06 Aug 2026

D7 — IDS/IPS/SIEM: detection vs prevention, network vs host-based, signature vs heuristic

Added 6 quiz questions: IDS alerts vs IPS blocks, network-based promiscuous mode, host-based on server/workstation, signature matching like antivirus, heuristic behavioral baseline, SIEM for full-picture correlation (d7_q_059–064)
No new flashcards — d7_fc_009–013 already cover all IDS/IPS/SIEM/SOAR concepts

06 Aug 2026

D7 — IR lifecycle: last 3 phases in order, least critical immediate step, Detection phase activities

Added 3 quiz questions: last 3 phases = Recovery→Remediation→Lessons Learned, post-incident review = least critical to immediate resolution, Detection phase = where events are analysed (d7_q_056–058)
Added 2 flashcards: Recovery vs Remediation distinction (restore service then fix root cause), Detection phase activities and goal (d7_fc_047–048)

06 Aug 2026

D7 — Lessons Learned: most overlooked phase, report to management, feeds Preparation

Added 6 quiz questions: lessons learned most overlooked IR phase, report goes to senior management, management is in charge and liable, outcomes feed into Preparation, top-down shift after major incidents, evaluates response quality not just the incident (d7_q_050–055)
Added 1 flashcard: Lessons Learned — what it evaluates, report structure, IT Security suggests but management decides, feed-back into Preparation, post-incident top-down momentum (d7_fc_046)

06 Aug 2026

D7 — Incident severity: Inconvenience, Emergency, Disaster, Catastrophe

Added 6 quiz questions: facility unusable 24h+ = disaster, server in cluster = inconvenience, loss of life/property = emergency, disaster vs catastrophe distinction, geographic diversity mitigates disasters, snowstorm = disaster by impact (d7_q_044–049)
Added 1 flashcard: severity ladder exam nuances — snowstorm trap (impact not cause), Disaster=unusable vs Catastrophe=destroyed, geographic redundancy mitigation (d7_fc_045)

06 Aug 2026

D7 — Event, Alert, Incident, Problem: definitions, thresholds, and examples

Added 6 quiz questions: event definition, event examples (system power-on), alert threshold trigger (75% traffic, 90% memory), incident = multiple adverse events, problem = incident with unknown cause, internet outage = problem (d7_q_038–043)
Added 1 flashcard: Event→Alert→Incident→Problem chain with threshold examples, the unknown-cause chain, and exam-level detail (d7_fc_044)

06 Aug 2026

D7 — Incident Management: purpose, training, 3 incident classes (Natural/Human/Environmental)

Added 6 quiz questions: incident management primary purpose, why ongoing training matters, power grid = environmental (not natural), human incidents = most common, intentional + unintentional both = human, natural vs environmental distinction (d7_q_032–037)
Added 2 flashcards: incident management definition and purpose, 3 incident classes with exam traps (power outage = environmental; accident and attack = both human) (d7_fc_042–043)

06 Aug 2026

D7 — Digital Forensics: purpose, imaging methods, Fourth Amendment and hack-back illegality

Added 3 quiz questions: primary purpose of digital forensics (evidence preservation, not repair/prevention), live imaging = least effective method, Fourth Amendment prohibits accessing attacker's system without legal authority (d7_q_029–031)
Added 3 flashcards: forensics primary purpose vs IR/recovery/analysts, imaging methods from most to least effective, Fourth Amendment 4 legal bypass methods (subpoena, search warrant, voluntary surrender, exigent circumstances) (d7_fc_039–041)

06 Aug 2026

D7 — Digital Forensics: bit-stream imaging, real evidence, integrity hashing, chain of custody

Added 6 quiz questions: forensic data sources, bit-stream vs file copy, real evidence = physical device not data, evidence integrity via hashing (before/after), why forensics on copies not originals, chain of custody purpose and 4 Ws (d7_q_023–028)
Added 4 flashcards: bit-stream imaging (what and why), real evidence vs digital evidence, evidence integrity hashing process (5-step), chain of custody 4 questions + admissibility implications (d7_fc_035–038)

06 Aug 2026

D7 — NDA scope, SoD as best fraud control, Least Privilege vs Need to Know distinction

Added 3 quiz questions: NDA most important factor = scope, SoD most effective fraud control vs background checks/access controls/physical security, LP vs NtK definitional difference (d7_q_020–022)
Added 2 flashcards: NDA key elements (scope first, then duration/penalties/parties), why SoD beats other fraud controls (continuous vs one-time, internal vs physical) (d7_fc_033–034)
No LP/NtK flashcard added — d7_fc_030 already covers the distinction

06 Aug 2026

D7 — Job rotation, mandatory vacations, insider threat combo (all 5 controls)

Added 5 quiz questions: job rotation primary security benefit, non-security benefit (burnout + business understanding), cost-prohibitive limitation, mandatory vacation no-advance-notice rule, all 5 controls = minimize insider threats (d7_q_015–019)
Added 2 flashcards: Job Rotation exam breakdown (all benefits + cost limitation), Mandatory Vacations exam nuances (accounts locked, audit, no advance notice, 5-control summary) (d7_fc_031–032)

06 Aug 2026

D7 — Administrative Personnel Security Controls: least privilege, need to know, separation of duties

Added 6 quiz questions: administrative security purpose, least privilege definition, need-to-know vs granted access, separation of duties purpose, PO + cheque classic scenario, compensating controls for small orgs (d7_q_009–014)
Added 2 flashcards: Least Privilege (definition, exam tip, PAM link), Need to Know vs Least Privilege (access layer vs behavioural layer with nurse example) (d7_fc_029–030)

05 Aug 2026

D2 — Large batch: scoping, memory types, data states, disposal, e-discovery, classification, EPROM, C-suite

Added 27 quiz questions covering: scoping, EPROM erasure (UV light), PROM write-once, EEPROM/Flash, DRAM volatility, attacks by data state (physical theft, cryptanalysis, eavesdropping), data disposal goal (remanence), backup retention rule, clean desk policy, protecting data at rest (encryption) vs in use (physical controls), encryption gap at data-in-use, stolen backup tape protection, end-to-end encryption, SSD shredding, full-spectrum encryption, damaged SSD incineration, e-discovery, US Gov classification (Unclassified/Confidential levels), CFO financial day-to-day role, sensitivity factors, flash drive memory type (d2_q_033–059)
Added 4 flashcards: ROM subtypes (PROM/EPROM/EEPROM/Flash erasure methods), US Government classification harm levels, e-discovery definition and legal hold, data sensitivity assignment factors (d2_fc_030–033)
Skipped 3 questions as duplicates: SSD shredding (→ d2_q_002), custodian backups (→ d2_q_003), data-in-use multi-select (→ d2_q_037)

05 Aug 2026

D2 — CASB benefits, DLP prerequisite, CASB vs DLP vs CSPM

Added 3 quiz questions: CASB primary benefit = data protection and compliance, data classification must happen before DLP works, CASB best addresses unauthorised cloud access (d2_q_030–032)
Added 2 flashcards: DLP prerequisite (data identification/classification first), CASB vs DLP vs CSPM vs BYOD comparison (d2_fc_028–029)

05 Aug 2026

D2 — Tailoring, certification, and accreditation

Added 3 quiz questions: tailoring = customising a standard to the organisation, certification = evaluating security controls before go-live, accreditation = formal approval to operate (d2_q_027–029)
Added 1 flashcard: certification and accreditation distractor terms to avoid confusing (provisioning, validation, verification, authorization) (d2_fc_027)

05 Aug 2026

D2 — Physical destruction levels, remanence, RAM volatility

Added 3 quiz questions: incineration = highest destruction level, encryption is LEAST acceptable for remanence, RAM is volatile (d2_q_024–026)
Added 2 flashcards: degaussing (how it works, what media, drive unusable after), why encryption does not address remanence (d2_fc_025–026)

05 Aug 2026

D2 — Data destruction: paper shredding, delete/format/overwrite, sanitization vs purge

Added 5 quiz questions: cross shredding vs strip shredding, deleting only removes file table entry, sanitization vs purge difference, soft destruction methods, overwriting = writing 0s/random chars (d2_q_019–023)
Added 2 flashcards: data destruction strength hierarchy (delete→format→overwrite→sanitization→purge), paper disposal why cross shredding is required (d2_fc_023–024)

05 Aug 2026

D2 — Business owner policies, custodian limits, vendor audit rights

Added 3 quiz questions: business owner sets data access policies, designing security controls is NOT a custodian duty, right to audit outsourced data processors (d2_q_016–018)
Added 2 flashcards: custodian do vs don't, data processor audit rights and GDPR accountability (d2_fc_021–022)

05 Aug 2026

D2 — Data ownership roles: mission owner, data owner, system owner, custodian, controller/processor

Added 5 quiz questions: mission owner makes policies, data owner assigns labels + backup frequency, system owner manages infrastructure, HR=controller/vendor=processor, custodian follows data owner (d2_q_011–015)
Added 1 flashcard: mission/business owner vs system owner — levels and responsibilities (d2_fc_020)

05 Aug 2026

D2 — Records retention, data classification hierarchy and sensitivity

Added 3 quiz questions: most important factor for retention policy (legal requirements), lowest classification level (Public), most important factor for classification scheme (sensitivity) (d2_q_008–010)
Added 2 flashcards: records retention policy primary driver with regulatory examples, data classification hierarchy lowest to highest (d2_fc_018–019)

05 Aug 2026

D2 — Data states: at rest, in motion, in use

Added 3 quiz questions: matching activities to data states, shoulder surfing as attack on data in use, internal network encryption gap (d2_q_005–007)
Added 2 flashcards: attacks by data state (at rest/motion/use), why internal traffic also needs encryption (d2_fc_016–017)

04 Aug 2026

D5 — Large batch: SIEM, MFA, tokens, access models, biometrics, CHAP, AD trusts (d5_q_034-061)

Added 3 questions: TGS primary function, RADIUS primary function (centralised AAA), first step of Kerberos (d5_q_034–036)
Added 25 questions from large batch covering: SIEM for log management, cookie-based MFA, key stretching vs brute force, salting least effective vs brute force, Type 1 auth (PINs/passwords), rainbow table structure, SMS OTP = MFA, weakest auth factor, SESAME/PKI fix, access control policy reference, AD trust types, IAAA identification = usernames, HOTP = something you have, lowering biometric sensitivity → FAR, lock account first, client sends authenticator to TGS, non-repudiation for accountability, FRR definition, TRAC not a real model, biometric can't be reissued, TOTP 30-second, CRR not a biometric metric, salting definition, swipe card = magnetic stripe, CHAP server-side credential risk (d5_q_037–061)
Added 6 flashcards: RADIUS AAA primary function, Kerberos KDC (AS/TGS roles), Kerberos 6-step flow, SIEM definition, AD trust types (reflective not real), smart card types (magnetic/contact/contactless), non-repudiation for accountability, Type 3 biometrics reissuability risk (d5_fc_046–051)

04 Aug 2026

D5 — Kerberos: KDC components and 6-step authentication flow

Added 5 quiz questions: KDC = AS + TGS, step 1 sends plaintext user ID only, step 2 AS returns session key + TGT, TGT purpose, step 6 mutual authentication via timestamp (d5_q_029–033)
Added 2 flashcards: KDC structure (AS and TGS roles), Kerberos 6-step flow with key facts (d5_fc_044–045)

04 Aug 2026

D5 — Identity provisioning lifecycle, entities, and IAM definition

Added 3 quiz questions: manual provisioning not part of a good lifecycle, identities = entities, IAM = unique identifier + authentication requirement (d5_q_026–028)
Added 2 flashcards: provisioning lifecycle good vs bad practices, IAM definition and scope (d5_fc_042–043)

03 Aug 2026

D5 — IAAA Access Management: biometrics, access models, passwords (slides batch)

Added 3 quiz questions: software token trade-offs, most secure auth method, single-factor vs MFA (d5_q_013–015)
Added 10 quiz questions from slides: FAR vs FRR severity, CER definition, nonce purpose, clipping levels, offline hash bypass, DAC owner control, MAC labels/clearance, RBAC role transfer, ABAC attributes, username+password not MFA (d5_q_016–025)
Added 6 flashcards: software token risks, authentication strength ranking, DAC mechanics, MAC labels/clearance/dominance rule, offline hash attacks bypassing clipping, ABAC attribute categories and alternative names (d5_fc_036–041)

02 Aug 2026

D3 — Cryptography, Hardware, Physical Security & Cloud (Large Batch)

Added 26 quiz questions covering salting/rainbow tables, antivirus types, demarc, multiprocessing, RC4 deprecation, logic bombs, PKI technologies, IaaS responsibility, digital signatures, motion sensors, PIR detectors, frequency analysis, WORM media, bollards, RIPEMD-160, ASTM gate classes, ALU, Clipper/Skipjack, CPU 4-step cycle, key escrow, IDEA, DCS, MAC, IPv6 IPSec, and reference monitor (d3_q_076–101)
Added 13 flashcards: antivirus types, demarc, multiprocessing vs multitasking, deprecated ciphers, PKI technology stack, IaaS/PaaS/SaaS responsibility matrix, WORM media, ASTM gate classes, CPU internals, Clipper/Skipjack, IDEA, MAC, IPv6 vs IPv4 IPSec (d3_fc_080–092)

02 Aug 2026

D3 — Emergency Response & Evacuation Planning

Added 3 quiz questions: human life first in emergencies, employee safety first in disasters, evacuation plans must include disabled employees (d3_q_073–075)
Added 1 flashcard: emergency response priority order and evacuation planning requirements (d3_fc_079)

02 Aug 2026

D3 — Fire Suppression, Smoke Detectors & HVAC

Added 3 quiz questions: sprinklers for detection + suppression, photoelectric detectors detect smoke, HVAC proper airflow as primary indicator (d3_q_070–072)
Added 2 flashcards: fire detector types (photoelectric vs ionisation, heat, flame), HVAC function and data center indicators (d3_fc_077–078)

02 Aug 2026

D3 — Power Surge, UPS Efficiency & CIA Triad Impact

Added 3 quiz questions: power surge = increased voltage/current, UPS efficiency = runtime, power fluctuations primarily compromise Availability (d3_q_067–069)
Added 1 flashcard: UPS efficiency metric and CIA triad impact of power fluctuations (d3_fc_076)

02 Aug 2026

D3 — Backup Strategies & Server Hardening

Added 3 quiz questions: offsite backups for disaster recovery, FTP not part of hardening, auto-updates not suitable for production (d3_q_064–066)
Added 2 flashcards: backup strategies + 3-2-1 rule, server hardening checklist (d3_fc_074–075)

02 Aug 2026

D3 — Site Threats, Flood Risk Analysis & UPS Load Balancing

Added 3 quiz questions: threats as primary design factor, risk analysis for flood-prone data center, UPS load distribution preventing cascading failure (d3_q_061–063)
Added 2 flashcards: site/facility threat-first security design, UPS load balancing and power redundancy (d3_fc_072–073)

02 Aug 2026

D3 — Physical Security: Perimeter Controls, Access Doors & Data Center Structure

Added 3 quiz questions: fences/gates as primary perimeter barrier, secured door stays locked as functionality indicator, slab-to-slab fire-rated data center construction (d3_q_058–060)
Added 2 flashcards: preventative vs detective physical controls, data center secure box requirements (d3_fc_070–071)

02 Aug 2026

D3 — SSL vs TLS, TCP 3-way Handshake & IPSec Tunnel Mode

Added 3 quiz questions: SSL older/less secure than TLS, SYN/SYN-ACK/ACK handshake order, IPSec tunnel mode most common (d3_q_055–057)
Added 2 flashcards: SSL vs TLS versions and differences, TCP 3-way handshake steps (d3_fc_068–069)

02 Aug 2026

D3 — IPSec: AH, ESP & VPNs

Added 4 quiz questions: AH does not provide confidentiality, ESP for encryption, IPSec for VPNs, choosing AH vs ESP (d3_q_051–054)
Added 1 flashcard: IPSec VPN use, IPv4 bolt-on security, AH + ESP together vs separately (d3_fc_067)

02 Aug 2026

D3 — MitM Attacks, Digital Signatures & Hash Collisions

Added 3 quiz questions: MitM as session hijacking, digital signatures for non-repudiation, MD5 collision vulnerability vs SHA-1/SHA-256/PBKDF2 (d3_q_048–050)
Added 11 flashcards: cloud deployment models, malware types, logic bomb vs backdoor, CPU instruction cycle + interrupts, ICS/SCADA vulnerabilities, IoT vulnerabilities, VM intra-host traffic security, salt vs nonce, MitM variants & mitigations, cryptanalysis techniques, mobile device security (d3_fc_056–066)

31 Jul 2026

D3 — Virtualization, Cloud Types, Service Models & Hash Functions

Added 12 quiz questions: hypervisor Ring -1, host vs guest, intra-host VM traffic, public/community/hybrid cloud models, IaaS/PaaS/SaaS definitions, salting passwords, nonces & initialization vectors (d3_q_036–047)

31 Jul 2026

D3 — Encryption, Malware, Systems, Side-Channel Attacks & Cryptanalysis

Added 24 quiz questions: asymmetric key counts, public key definition, symmetric vs asymmetric, ICS vulnerabilities, mobile malware, polyinstantiation, CPU instruction cycle, containerization, CPU interrupts, Trojans vs viruses, logic bombs, asymmetric vs symmetric benefits, acoustic/general/covert timing side-channel attacks, SaaS, Type 1 vs Type 2 hypervisors, IoT vulnerabilities, cryptanalysis, frequency analysis, transposition (d3_q_012–035)

31 Jul 2026

D3 — Security Models & Threat Modeling

Added 3 quiz questions: Bell-LaPadula primary goal, Clark-Wilson model (separation of duties & high-value transactions), STRIDE threat modeling (d3_q_009–011)

31 Jul 2026

Fix — Offline Authentication

App no longer shows login screen when offline and a valid session cookie exists — trusts the cookie instead of requiring a server round-trip
Password hash cached in localStorage after first online login so the app can be unlocked offline even if the cookie has expired

11 Aug 2026

D4 — Major batch: 30 questions covering VoIP/UDP, TCP, IP addresses, ports, protocols, topologies, OSI layers, QoS, IPv6, cables

Added 30 quiz questions: VoIP=UDP, TCP connection-oriented, L3 broadcast (255.255.255.255), 172.32.0.0 public, SFTP over SSH, ARIN (North America), E3 speed (34.368 Mbps), port 23=Telnet, port 25=SMTP, 172.15.11.45 public, DHCP port 67, DORA process, TCP 3-way handshake, port 137=NetBIOS name, port 138=NetBIOS datagram, ARP spoofing=L2 threat, APNIC (Asia-Pacific), IPv6=128 bits, STP vs UTP (EMI), IMAP=L7 not L3, Telnet=cleartext, fiber optic near power cables, multi-mode fiber for data center, L3 isolates broadcast domains, MAC sticky on switch, QoS=VoIP priority, port 143=IMAP4, port 110=POP3, bus topology break=stops traffic, IPv6 fe80 link-local (d4_q_092–121, Q10/Q23 reformulated as single-answer)
Added 8 flashcards: VoIP/UDP vs TCP, five RIRs and regions, NetBIOS ports 137/138, OSI layer threats, STP vs UTP, IPv6 key features, QoS and VoIP priority, MAC sticky command (d4_fc_102–109)

11 Aug 2026

D4 — CDN for large file delivery, IPSec suite overview, CHAP vs PAP authentication

Added 3 quiz questions: CDN as most efficient large-file delivery, IPSec as full integrity/authenticity/confidentiality suite, CHAP three-way handshake with hashed password (d4_q_089–091)
Added 2 flashcards: CDN definition and use cases, CHAP vs PAP authentication comparison (d4_fc_100–101)

11 Aug 2026

D4 — IPSec: Security Associations, SPI, Tunnel vs Transport mode, ISAKMP, IKE, ESP vs AH

Added 7 quiz questions: SA as simplex one-way connection, ESP = 2 SAs, AH+ESP = 4 SAs, SPI as 32-bit SA identifier, Tunnel mode (full packet) vs Transport mode (payload only), ISAKMP manages SA creation, IKE negotiates algorithm selection (d4_q_082–088)
Added 4 flashcards: SA count for ESP and AH+ESP combinations, Tunnel vs Transport mode, ISAKMP vs IKE roles, ESP vs AH capabilities (d4_fc_096–099)

11 Aug 2026

D4 — DCE vs DTE (modem), firewall as first external defence, fail-secure behaviour

Added 3 quiz questions: modem = most common DCE, firewall = first control for external threats, firewall = fail-secure device (d4_q_079–081)
Added 2 flashcards: DCE vs DTE with examples, fail-secure vs fail-open and why firewalls must fail-secure (d4_fc_094–095)

11 Aug 2026

D4 — Wireless security, Li-Fi, 802.11g frequency, ASN, switch vs router functions

Added 6 quiz questions: WPA2-Enterprise most secure wireless, Li-Fi most secure transmission technology, 802.11g = 2.4 GHz, ASN = Autonomous System Number (BGP), wireless router for wireless access, switch primary function = Layer 2 MAC forwarding (d4_q_073–078)
Added 5 flashcards: WPA2-Enterprise vs Personal vs WEP, Li-Fi security, 802.11 standards and frequency bands, ASN and BGP, switch/router/hub/gateway OSI layers and functions (d4_fc_089–093)

11 Aug 2026

D4 — SAN definition, network topologies (star/bus/ring/mesh), fiber optic primary disadvantage

Added 3 quiz questions: SAN = Storage Area Network, star topology for enterprise LANs, fiber optic first disadvantage = cost (d4_q_070–072)
Added 2 flashcards: SAN definition and SAN vs NAS, four network topologies and characteristics (d4_fc_087–088)

11 Aug 2026

D4 — Cables: fiber optic vs copper, single-mode vs multi-mode, WDM

Added 7 quiz questions: fiber uses light vs copper electricity, 1 Petabit/sec speed, 150+ mile distance, passive sniffing security advantage, single-mode for long-distance IP backbone, WDM definition, fiber cons (cost/fragility) (d4_q_063–069)
Added 3 flashcards: fiber optic pros vs cons vs copper, single-mode vs multi-mode fiber, WDM definition and use (d4_fc_084–086)

10 Aug 2026

D8 — Major batch: databases, SDLC methodologies, open source, acceptance testing, vulnerabilities (28 questions + 14 flashcards)

Added 28 quiz questions covering: relational DB terms (tuple/attribute/relation/schema), e-vaulting vs shadowing, semantic integrity, OAT vs production acceptance testing, XP daily stand-up NOT XP (Scrum), CASE 3 categories, open source (code + software), Scrum core roles, injection mitigation, GUI builders = RAD, partial disclosure, pseudo-random session IDs as security feature, IDOR, pair programming = XP, SaaS customer responsibility after application, Spiral model phases (no Initiation), database shadowing real-time copy, XML = document-oriented DB, OOAD OOD phase for constraints, crippleware, Oracle NOT open-source licence, Agile characteristics, CASE references NOT a category, Product Owner role, Bottom-up NOT an SDLC methodology, buffer overflow overwrites adjacent memory (not hard disk) (d8_q_040–067, skipped Q17 dup and Q26 dup)
Added 14 flashcards: DB terms, e-vaulting vs log shipping vs shadowing, OAT vs production AT vs UAT, XP core practices, CASE categories, IDOR, crippleware vs shareware vs freeware, disclosure types, RAD and GUI builders, Scrum roles, Spiral phases, XML + document-oriented DB, OOA vs OOD, open-source licences (d8_fc_047–060)

10 Aug 2026

D8 — AI/ML: ANN capabilities, AI-specific security protocols, machine learning in cybersecurity

Added 3 quiz questions: ANNs cannot think independently, AI security via differential privacy and adversarial training, ML primary use as malware classification (d8_q_037–039)
Added 3 flashcards: ANN structure and limitations, differential privacy vs adversarial training, ML uses in cybersecurity (d8_fc_044–046)

10 Aug 2026

D8 — Cloud service models, software procurement, and COTS vulnerability response

Added 8 quiz questions: IaaS/PaaS/SaaS responsibility boundaries, SaaS examples, customer control levels, PaaS for custom apps, software licence review before purchase, cost not being primary concern in software evaluation, COTS vulnerability top priority (update/patch) (d8_q_029–036)
Added 6 flashcards: IaaS/PaaS/SaaS management boundaries, SaaS interaction modes, choosing service model by control level, software licence pre-purchase checklist, third-party software evaluation criteria, COTS definition and vulnerability response (d8_fc_038–043)

10 Aug 2026

D8 — Cloud computing: 4 types (private/public/hybrid/community) and cloud outsourcing security rights

Added 5 quiz questions: public cloud shared tenancy, hybrid cloud for sensitive vs non-sensitive data, community cloud definition, private cloud single-org ownership, cloud outsourcing security rights (d8_q_024–028)
Added 3 flashcards: 4 cloud computing types, community vs public vs private distinction, cloud outsourcing audit/pentest/VA/compliance rights (d8_fc_035–037)

10 Aug 2026

D8 — Maturity models: CMM 5 levels, BSIMM software security benchmark, CMM vs CMMC vs BSIMM

Added 3 quiz questions: CMM Level 2 Repeatable, BSIMM purpose (software security benchmarking), CMM as software development process framework (d8_q_021–023)
Added 3 flashcards: CMM 5-level model, BSIMM 4 domains and 12 practices, CMM vs CMMC vs BSIMM comparison (d8_fc_032–034)

10 Aug 2026

D8 — Security: auth failures, XSS defence, broken access control, privilege escalation, backdoors, buffer overflows

Added 6 quiz questions: most common auth failure (user error), XSS defence (input validation), broken access control indicator (unauthorised access), privilege escalation first step (least privilege), backdoor appropriate use (development only), buffer overflow mechanics (d8_q_015–020)
Added 6 flashcards: auth failure forms, XSS mechanism and defence, broken access control, least privilege vs privilege escalation, backdoor lifecycle, buffer overflow causes and defences (d8_fc_026–031)

09 Aug 2026

D8 — Databases: data normalisation best practices, database integrity types, SQL DDL statements

Added 3 quiz questions: data normalisation (NOT allowing multiple formats), semantic integrity violation, SQL DDL commands CREATE/ALTER/DROP (d8_q_012–014)
Added 3 flashcards: normalisation best practices, four integrity types (semantic/entity/referential/user-defined), SQL DDL vs DML (d8_fc_023–025)

09 Aug 2026

D8 — SDLC methodologies: DevOps CI/CD deployment frequency, Sashimi overlapping phases, Waterfall for fixed requirements

Added 3 quiz questions: DevOps continuous deployment, Sashimi linear-with-overlap model, Waterfall for stable fixed-scope projects (d8_q_009–011)
Added 3 flashcards: DevOps CI/CD cadence, Sashimi vs Waterfall distinction, Waterfall best-fit criteria (d8_fc_020–022)

09 Aug 2026

D8 — Software licensing and SDLC: freeware vs shareware, reverse engineering, security controls in design phase

Added 3 quiz questions: freeware vs shareware distinction, assembly as hardest to reverse-engineer, SDLC design phase as first security control review (d8_q_006–008)
Added 3 flashcards: freeware vs shareware definitions, why assembly is hardest to reverse, SDLC security-by-design principle (d8_fc_017–019)

09 Jul 2026

D7 — Practice test: DR site recovery times, MOU, hot site protection level

Added 3 quiz questions: warm site 4hr–3 day RTO, MOU for staff disaster acknowledgement, hot site as highest DR protection (d7_q_205–207)
Added 2 flashcards: MOU definition and legal standing, warm vs hot site data migration gap (d7_fc_090–091)

07 Aug 2026

D7 — Practice test: 28 questions covering forensics, RAID, backups, incident management, IDS/IPS, EOC, 4th Amendment, and DR sites

Added 28 quiz questions spanning: environmental vs natural vs man-made disasters, hashing for forensic integrity, RAID 5 striping with parity, backup loss calculation (20-hour window), RAID 1 minimum disks, server clustering for fault tolerance, geographically redundant sites, differential+incremental conflict, write blocker usage, IT security event definition, incremental vs differential backup speed, OEP evacuation plan, last 3 incident management phases, MOR hardware specs, DR restore priority (least critical last), IDS vs IPS, copy backup (no archive bit clear), evidence alteration, 4th Amendment warrant exceptions, EOC command centre, catch-as-you-can network forensics, voluntary disclosure to government, IAAR forensics order, containment/response phase, subscription site mechanics, server motherboard redundancy, 3-hour recovery window (hot+redundant), and COOP for day-to-day operations (d7_q_208–235)
Added 6 flashcards: three disaster categories (natural/man-made/environmental), EOC definition and deployment, IAAR forensics order, 7-phase incident management lifecycle, copy backup vs full backup archive bit behaviour, catch-as-you-can network forensics (d7_fc_092–097)

09 Jul 2026

D7 — Improving the Plans: Review Cycle & Version Control

Added 4 quiz questions: 12-month review cycle, out-of-cycle triggers, old copy destruction, real disaster as trigger (d7_q_201–204)
Added 2 flashcards: review frequency and triggers, old copy destruction policy (d7_fc_088–089)

09 Jul 2026

D7 — Testing the Plans: Simulation, Parallel, Partial & Full Interruption

Added 5 quiz questions: Simulation vs Tabletop distinction, Parallel Processing, Partial Interruption, Full Interruption, full test order least-to-most disruptive (d7_q_196–200)
Added 2 flashcards: three physical test types, full 7-step test progression (d7_fc_086–087)

09 Jul 2026

D7 — Testing the Plans: DRP Review, Read-Through & Tabletop

Added 4 quiz questions: DRP Review purpose, Read-Through checklist, Tabletop/Walk-through, living documents rationale (d7_q_192–195)
Added 2 flashcards: three simulated test types, Tabletop exercise (d7_fc_084–085)

09 Jul 2026

D7 — BCP Sub-Plans: COOP, OEP & Cyber Incident Response

Added 4 quiz questions: COOP purpose and timeframe, OEP focus, BCP as overarching plan, Cyber IRP scope (d7_q_188–191)
Added 3 flashcards: COOP, OEP, BCP containing sub-plans (d7_fc_081–083)

09 Jul 2026

D7 — Recovery Strategies: Mobile Site, Subscription/Cloud Site & Comparison Matrix

Added 5 quiz questions: mobile site definition, only non-fixed site, subscription/cloud model, mirrored site zero setup time, cold site hardware/telecom (d7_q_183–187)
Added 3 flashcards: mobile site, subscription/cloud site, full 5-site comparison matrix (d7_fc_078–080)

09 Jul 2026

D7 — Recovery Strategies: Redundant & Hot Sites

Added 5 quiz questions: redundant site definition, geographic separation rationale, hot vs redundant site differences, most expensive site type, hot site failover characteristics (d7_q_178–182)
Added 2 flashcards: redundant vs hot site comparison, full 4-site ranking by speed and cost (d7_fc_076–077)

09 Jul 2026

D7 — Recovery Strategies: Warm, Cold & Reciprocal Agreement Sites

Added 5 quiz questions: warm vs hot site, cold site characteristics, reciprocal agreement, cost ranking, warm site recovery steps (d7_q_173–177)
Added 3 flashcards: hot/warm/cold comparison, reciprocal agreement risks, warm site details (d7_fc_073–075)

09 Jul 2026

D4 — IP Classes, LAN Devices, Wireless Security, Email Protocols & WAN Speeds

Added 12 quiz questions: IP class ranges, bridge vs router layers, attenuation, DMZ/screened subnet, WPA2, WPA2 Enterprise/RADIUS, LDAP-S port 636, S/MIME, repeater at L1, T-1 speed, backup CIA properties, bridge forwarding (d4_q_051–062)
Added 6 flashcards: IP class ranges/masks, LAN devices by OSI layer, WEP/WPA/WPA2 comparison, email security protocols, WAN/cabling speeds, wireless network modes (d4_fc_078–083)

09 Jul 2026

D4 — MAC Security Modes, Firewalls, IEEE 802 & SSH vs Telnet

Added 8 quiz questions: MAC dedicated/system-high modes, 4 firewall types and layers, IEEE 802 standards, 802.11i/WPA2, SSH vs Telnet (d4_q_043–050)
Added 5 flashcards: MAC security modes, firewall types, IEEE 802 standards, 802.11 variants, circuit vs application proxy (d4_fc_073–077)

09 Jul 2026

D4 — IPv4 bits, DHCP port, IPv6 benefits

Added 3 quiz questions from practice test: IPv4 address size, DHCP server port, IPv6 NOT a benefit (d4_q_040–042)
Added 2 flashcards: IPv4 vs IPv6 bit sizes, IPv6 key benefits (d4_fc_071–072)

09 Jul 2026

D4 — Email Protocols: MUA, MSA, MTA, MDA & MX Records

Added 4 quiz questions: DNS MX records, email delivery order, MTA role, POP3 vs IMAP retrieval (d4_q_036–039)
Added 3 flashcards: four email agent types, end-to-end email flow, DNS MX records (d4_fc_068–070)

09 Jul 2026

D4 — BOOTP, DHCP & DORA Process

Added 4 quiz questions: BOOTP purpose, DHCP DORA sequence, BOOTP/DHCP ports, DHCP Discovery broadcast reasoning (d4_q_032–035)
Added 3 flashcards: BOOTP vs DHCP, DORA process, why DHCP uses UDP (d4_fc_065–067)

09 Jul 2026

D4 — HTTP, HTTPS & HTML

Added 3 quiz questions: HTTP vs HTTPS security difference, alternate ports (8443), HTML vs HTTP distinction (d4_q_029–031)
Added 2 flashcards: HTTP/HTTPS ports including alternates, HTML vs HTTP/HTTPS (d4_fc_063–064)

08 Jul 2026

D4 — IPv4 Header Fields & MTU

Added 4 quiz questions: TTL purpose, fragmentation fields, MTU size, MTU exceeded behaviour (d4_q_025–028)
Added 3 flashcards: IPv4 header fields, TTL, MTU (d4_fc_060–062)

08 Jul 2026

D4 — IPv4/IPv6 Address Management & RIRs

Added 4 quiz questions: IANA role, IANA/ICANN relationship, AFRINIC region, RIPE NCC region (d4_q_021–024)
Added 3 flashcards: IANA/ICANN, all 5 RIRs and their regions, IP address management hierarchy (d4_fc_057–059)

08 Jul 2026

D4 — Ports, TCP vs UDP, Attacks & TCP/IP Model

Added 8 quiz questions: SSH/Telnet ports, FTP ports, UDP characteristics, Fraggle attack, SYN flood, TCP 3-way handshake, TCP/IP↔OSI mapping, port identification (d4_q_013–020)
Added 8 flashcards: SSH vs Telnet, FTP ports, email protocol ports, HTTP/HTTPS/RDP ports, TCP vs UDP, SYN flood, Fraggle attack, TCP/IP to OSI mapping (d4_fc_049–056)

07 Jul 2026

D4 — OSI Layers & TCP/IP PDUs

Added 3 quiz questions: physical security at OSI L1, SSL at presentation layer L6, frames/bits as TCP/IP link layer PDUs (d4_q_010–012)
Added 3 flashcards covering the same concepts (d4_fc_046–048)

05 Jul 2026

D1 — Large practice test batch: 29 questions + 5 flashcards

Added 29 quiz questions covering: least privilege, CIA triad, encryption attacks, ECPA, qualitative analysis, integrity factors, DDoS, COSO, IP protection, ALE, CIA opposites, risk appetite, MFA, ISC2 ethics, breach notification, liability, risk rejection, availability factors, ISO27799, real evidence, biometrics, integrity tradeoffs, risk matrix, due diligence, code injection, criminal court, physical controls, HIPAA rules (d1_q_063–091)
Added 5 flashcards: ECPA 1986, ISO27799, US breach notification laws, HIPAA three rules, risk appetite (d1_fc_041–045)

04 Jul 2026

D1 — BCP/DRP, Compliance, Risk Assessment & More

Added 12 questions: RPO, RTO, WRT, MTD formula, MTD scenario, MTBF, MTTR, MOR, MTD synonyms, weekly backup RPO, and BIA criticality (d1_q_051–062)
Added 6 questions: hacker types, DDoS vs CIA triad, phishing, BIA, BCP focus, and most critical BCP process (d1_q_045–050)
Added 3 questions: compliance definition, compliance as top governance principle, risk assessment vs risk management (d1_q_042–044)
Added 3 questions: risk transference, first step in risk management, SLE calculation (d1_q_039–041)

30 Jun 2026

D1 — Quantitative Risk Analysis Calculations

Added 6 calculation-based questions on AV, EF, SLE, ARO, and ALE (d1_q_033–038)
Scenarios include laptop theft, data center flooding, DDoS, data breach, and fire with ROI analysis

29 Jun 2026

D1 — Security Control Types

Added 3 questions on administrative, technical, and physical controls (annual training, highest-level control, background checks)

28 Jun 2026

D1 — Governance, Policy & Ethics (batch 2)

Added 9 questions covering digital forensics, IP/trademark law, HIPAA, GDPR, and ISC2 ethics canons
Added 3 questions on mission statements, security policy purpose, and policy vs guidelines

27 Jun 2026

PWA — Flashcard & Offline Improvements

Flashcards can now be flipped back by tapping again
Switched service worker to network-first for HTML — updates apply automatically on next open
Added version/changelog bar at bottom of screen

27 Jun 2026

D1 — Governance & Risk Management

Added 3 questions on good governance indicators, proactive vs reactive security, and security management function
Added 3 questions on IAAA model, authentication vs authorization, and passphrase type
Added 3 questions on CIA triad — data deletion, pharmaceutical confidentiality, over-enforcing confidentiality

27 Jun 2026

PWA Support

Added web app manifest and service worker for offline use
Added install banner on mobile devices
Added SVG icon for home screen

21 Jun 2026

Initial Release

275 flashcards across all 8 CISSP domains
76 quiz questions across all 8 CISSP domains
Supabase sync for progress and study time
Password-protected via Edge Function