Domain 1 — General Security Concepts (12%)
Security Control Categories
- Technical — firewalls, encryption, MFA, IDS/IPS
- Managerial — policies, risk assessments, security awareness training
- Operational — procedures, background checks, change management
- Physical — locks, cameras, badge readers, fencing
Control Types
Preventive
Detective
Corrective
Deterrent
Compensating
Directive
Cryptography Essentials
- Symmetric — same key for encrypt/decrypt (AES, 3DES). Fast, used for bulk data.
- Asymmetric — public/private key pair (RSA, ECC). Slower, used for key exchange and signatures.
- Hashing — one-way, integrity verification (SHA-256, MD5). Not encryption.
- Salting — random value added before hashing to prevent rainbow table attacks.
- Key stretching — bcrypt, PBKDF2 — makes brute force slower.
PKI & Certificates
- CA — Certificate Authority, issues and signs certificates
- CRL — Certificate Revocation List; OCSP — real-time revocation check
- Self-signed — not trusted by default; used internally
- Wildcard cert — covers *.domain.com
- SAN cert — Subject Alternative Name, covers multiple domains
Authentication Concepts
- MFA factors: Something you know / have / are / somewhere you are
- SSO — Single Sign-On; SAML — XML-based SSO standard
- OAuth 2.0 — authorization framework; OpenID Connect — identity layer on OAuth
- RADIUS / TACACS+ — AAA protocols for network access control
- Kerberos — ticket-based auth; uses KDC, TGT, service tickets
Domain 2 — Threats, Vulnerabilities & Mitigations (22%)
Malware Types
- Virus — attaches to files, requires user action to spread
- Worm — self-replicates across networks without user action
- Trojan — disguised as legitimate software
- Ransomware — encrypts files, demands payment
- Rootkit — hides malware at OS/firmware level
- Keylogger — captures keystrokes
- Spyware — collects data without consent
- Fileless malware — runs in memory, no disk footprint
Social Engineering
- Phishing — mass email; Spear phishing — targeted; Whaling — targets executives
- Vishing — voice/phone; Smishing — SMS
- Pretexting — fabricated scenario to gain trust
- Baiting — physical media (USB drop) or false promises
- Tailgating / Piggybacking — physical access by following authorized user
- Business Email Compromise (BEC) — impersonates executives to authorize transfers
Attack Types
- SQL Injection — malicious SQL in input fields; use parameterized queries
- XSS — injects scripts into web pages viewed by others
- CSRF — tricks authenticated user into submitting malicious request
- Buffer overflow — overwrites adjacent memory; can execute arbitrary code
- Pass-the-hash — uses captured hash without cracking it
- Man-in-the-Middle (MitM) — intercepts communication between two parties
- DoS / DDoS — overwhelms resources; DDoS uses botnet
- DNS poisoning — corrupts DNS cache to redirect traffic
Vulnerability Management
- CVE — Common Vulnerabilities and Exposures identifier
- CVSS — Common Vulnerability Scoring System (0–10)
- Zero-day — vulnerability with no available patch
- Patch management — test → approve → deploy → verify
- Credentialed scan — more thorough; uses valid credentials to log in
- Penetration testing phases: Recon → Scanning → Exploitation → Post-exploitation → Reporting
Threat Intelligence
- IOC — Indicator of Compromise (IP, hash, domain)
- STIX / TAXII — standards for sharing threat intelligence
- OSINT — Open Source Intelligence from public sources
- Dark web — monitored for stolen credentials and exploit sales
- TTPs — Tactics, Techniques, and Procedures (MITRE ATT&CK)
Domain 3 — Security Architecture (18%)
Network Security
- DMZ — buffer zone between public internet and internal network
- VLAN — logical network segmentation; limits broadcast domains
- NAC — Network Access Control; enforces policy before granting access
- Firewall types: Packet filtering → Stateful → Application (Layer 7) → NGFW
- IDS — detects and alerts; IPS — detects and blocks (inline)
- Proxy — intermediary for client requests; can filter and log
- Honeypot — decoy system to attract and study attackers
Zero Trust
- Never trust, always verify — no implicit trust based on network location
- Microsegmentation — granular network zones, limit lateral movement
- Least privilege — users get only the access they need
- Continuous verification — re-authenticate and re-authorize constantly
Cloud Security
- IaaS / PaaS / SaaS — shared responsibility model shifts with each layer
- CASB — Cloud Access Security Broker; enforces policy between users and cloud
- Serverless / containers — ephemeral; secure the image and pipeline
- Cloud misconfigurations — #1 cause of cloud breaches (open S3 buckets, etc.)
Secure Protocols
| Protocol | Port | Purpose |
|---|---|---|
| HTTPS | 443 | Encrypted web traffic (TLS) |
| SSH | 22 | Encrypted remote shell |
| SFTP | 22 | Encrypted file transfer |
| LDAPS | 636 | Encrypted directory services |
| DNSSEC | 53 | Signed DNS records |
| SRTP | — | Encrypted VoIP |
| SNMPv3 | 161 | Encrypted network management |
Domain 4 — Security Operations (28%)
Identity & Access Management
- IAM — manages who can access what resources
- PAM — Privileged Access Management; controls admin accounts
- RBAC — Role-Based Access Control; access by job role
- ABAC — Attribute-Based; uses attributes (dept, time, location)
- Account lifecycle: provisioning → review → deprovisioning
- Separation of duties — no single person controls entire process
- Least privilege — minimum access needed to do the job
Endpoint Security
- EDR — Endpoint Detection and Response; behavioral monitoring
- MDM — Mobile Device Management; enforce policy on mobile devices
- Application allowlisting — only approved apps can run
- FDE — Full Disk Encryption (BitLocker, FileVault)
- Hardening — disable unused services, close ports, apply patches
Incident Response
- IR Phases: Preparation → Identification → Containment → Eradication → Recovery → Lessons Learned
- Chain of custody — documented evidence handling for legal admissibility
- Forensic order of volatility: RAM → swap → disk → remote logs
- Tabletop exercise — discussion-based; no systems involved
- Playbook — predefined steps for specific incident types
Monitoring & SIEM
- SIEM — aggregates and correlates logs from multiple sources
- SOAR — Security Orchestration, Automation, and Response
- NetFlow — captures metadata about network traffic (not full packets)
- Syslog — standard log forwarding protocol (UDP 514)
- Baseline — normal behavior; anomalies trigger alerts
Domain 5 — Security Program Management & Oversight (20%)
Governance & Policy
- Policy — high-level statement of intent (what)
- Standard — specific mandatory requirements (how much)
- Procedure — step-by-step instructions (how)
- Guideline — recommended, not mandatory
- AUP — Acceptable Use Policy; defines allowed system use
Risk Management
- Risk = Threat × Vulnerability × Impact
- Risk responses: Accept / Transfer / Avoid / Mitigate
- SLE — Single Loss Expectancy = Asset Value × Exposure Factor
- ALE — Annual Loss Expectancy = SLE × ARO (Annual Rate of Occurrence)
- BIA — Business Impact Analysis; identifies critical systems and recovery priorities
- RTO — Recovery Time Objective; max downtime allowed
- RPO — Recovery Point Objective; max data loss allowed
Compliance & Frameworks
- NIST CSF — Identify, Protect, Detect, Respond, Recover
- ISO 27001 — international ISMS standard
- PCI-DSS — payment card data security
- HIPAA — US healthcare data privacy
- GDPR — EU data privacy regulation; 72-hour breach notification
- SOC 2 — service org controls audit (Trust Service Criteria)
Data Privacy & Classification
- Data classification: Public → Internal → Confidential → Restricted
- PII — Personally Identifiable Information
- PHI — Protected Health Information
- DLP — Data Loss Prevention; monitors and blocks unauthorized data movement
- Data retention — how long data must be kept per policy/regulation
- Right to be forgotten — GDPR requirement to delete personal data on request