Express Courses
Express Tabletop: The SaaS No One Approved Express Course
In this scenario-based course, learners investigate an unexpected risk signal linked to an unfamiliar external tool. They must assess uncertainty, ask the right questions and identify the appropriate next steps before acting.
DELIVERY METHOD: ON-DEMAND | TIME: 0.5 HOUR | CPE CREDITS: 0.5 | FOCUS AREA: CLOUD SECURITY, SECURITY OPERATIONS | PROFICIENCY LEVEL: INTERMEDIATE | LANGUAGE: ENGLISH | KNOWLEDGE AREA: OPERATIONS
A stable internet connection is required. To record your completion of the online learning experience, please ensure you are connected to the internet at all times.
Refunds are not provided for ISC2 learning experiences.
The exercise in this course places responders in an ambiguous scenario involving a third-party service that falls outside known organizational assets. With limited information and increasing pressure to act, participants must evaluate response options, determine what questions require answers first and decide how to proceed without clear visibility.
Across multiple decision points, learners practice slowing down responses, prioritizing understanding and distinguishing between governance concerns and situations that may require formal incident escalation. The exercise reinforces disciplined, evidence-aware thinking when organizational visibility is incomplete.
Learning Experience:
This course is designed for cybersecurity professionals seeking to move beyond reactive troubleshooting and develop investigative approaches that align with security management and incident response best practices. It is relevant for those in or considering roles of incident responder or security analyst who need to strengthen their ability to investigate anomalies or concerns.
Learners should have a foundational understanding of continuous monitoring and basic incident response practices.
Learners have 60 days from the date of purchase to complete the entire course. Those who successfully complete this course will receive a digital Validation of Completion and earn continuing professional education (CPE) credits. We recommend that you download and retain the Validation of Completion for your personal records.
To receive a Validation of Completion and earn CPE credits, learners must:| CPE Credits | Group A | 0.5 |
| Field of Study | Cloud Security, Security Operations | |
| Level | Intermediate | |
| Prerequisites | A foundational understanding of continuous monitoring and basic incident response practices. | |
| Access | Online | This is a digital product. The content will be available up to 60 days after purchase date. |
For more information, please refer to the ISC2 Certification Maintenance Handbook for additional CPE requirement details.
CPE credits earned from this learning experience will automatically be reported for ISC2 credentials on the first day of every month. Please allow up to 10 business days for processing.
CPE credits earned for this learning experience may also be eligible for continuing professional education credits for non-ISC2 certifications. Please visit the continuing education requirements established by the credentialing organization for eligibility.
For questions related to ISC2 CPE credits or the CPE portal not covered in the handbook, please contact us via our online form.
To purchase this course for someone or inquire about team discounts, please contact your regional office:
| Americas +1.866.331.4722 teamtraining@isc2.org |
EMEA +44.203.960.7800 teamtraining@isc2.org |
Asia-Pacific +852.5803.5662 teamtraining@isc2.org |
Purchase of exam(s) only.
Access periods:
Exam code must be scheduled and administered with 365 days of purchase.
Exam-only purchase with two attempts included in the purchase price.
Applies to Online Instructor-Led Training purchases without an exam.
Access periods:
Applies to Online Instructor-Led Training + Exam bundles.
Access periods:
Applies to Online Instructor-Led Training and Exam with Peace of Mind Protection bundles.
Access periods:
Peace of Mind Protection gives candidates two exam attempts at a lower cost than two single exams. Candidates have 180 days from purchase to sit both attempts, with a 30-day waiting period between attempts. Learn more
© Copyright 1996-2026. ISC2, Inc. All Rights Reserved.
All contents of this site constitute the property of ISC2, Inc. and may not be copied, reproduced or distributed without prior written permission. ISC2, CISSP, SSCP, CCSP, CGRC, CSSLP, HCISPP, ISSAP, ISSEP, ISSMP, CC, and CBK are registered marks of ISC2, Inc.
