Security, Compliance, and Risk Management
What this domain tests
This domain asks you to reason about threats, controls, and residual risk, and to know when a control is the right one for the threat rather than merely a familiar one.
Concepts to master
Understand the CIA triad (confidentiality, integrity, availability) and how controls trade them off. Know authentication vs authorisation, least privilege, separation of duties, defence in depth, and fail-safe defaults. Understand risk = likelihood × impact, and the response options: avoid, mitigate, transfer, accept. Distinguish vulnerability, threat, and risk. Know encryption at rest vs in transit, key management, hashing vs encryption, and why passwords are salted and hashed, never encrypted reversibly. Understand audit logging, non-repudiation, and data classification driving handling rules. Recognise common web threats - injection, broken access control, cross-site scripting - and their control families.
Traps in questions
Frequent traps: confusing authentication with authorisation; treating encryption as a substitute for access control; and choosing a control that addresses a different CIA leg. Another trap is accepting risk without authority - acceptance is a management decision, not a technical one.
Worked rule of thumb
Name the asset, the threat, and the CIA leg at risk, then pick the control that addresses that leg. If the stem asks who may decide to accept residual risk, the answer is business ownership, documented and signed - never the engineer who found the issue.
Compliance posture
Compliance is evidence of controls, not proof of security. Questions asking how to demonstrate compliance point to documented, auditable, repeatable controls with retained evidence.