Designing and Implementing Security
Defence in depth
Security design layers controls: physical, network (segmentation, firewalls, ACLs), host (hardening, patching, endpoint protection), identity (authentication, authorisation, least privilege), and data (encryption at rest and in transit). Candidates must know authentication versus authorisation, the principle of least privilege, separation of duties, and the difference between symmetric and asymmetric cryptography. Understand PKI basics: certificate authorities, certificate templates, revocation, and why time synchronisation matters to certificate validity.
Policy and access control
Be able to describe Group Policy security settings, password and lockout policy, and the use of security groups for resource access (A-G-DL-P: accounts into global groups, global into domain local, permissions on domain local). Know the role of auditing and logging in detection, and the concept of a security baseline.
Traps
Questions often present a control that sounds strong but addresses the wrong threat - e.g., encryption at rest offered as a fix for interception in transit. Another trap is confusing authentication with authorisation, or treating a firewall as sufficient protection for an internal service. Watch for items that ignore the effect of Group Policy inheritance and precedence (site, then domain, then OU; later-linked GPOs win on conflict unless enforced or blocked).
Worked example
A file share must be readable by one team and writable by another. Create global groups for each team, nest them into a domain local group that carries the NTFS permissions, and grant share permissions consistently. Do not assign permissions to individual users; the group nesting is the design.
Also know
Patch management cadence, privileged account management, and the principle that preventive, detective, and corrective controls are all needed.