Security Concepts
Domain 1 of the 200-201 blueprint, Security Concepts, carries roughly 20% of the exam. It tests precise use of risk vocabulary - naming the asset, threat, vulnerability and control in a scenario - and the models used to describe attacker behavior.
Vocabulary that earns marks
- Asset → threat → vulnerability → exploit → risk. Risk combines likelihood and impact; a vulnerability with no reachable threat is not automatically high risk.
- CIA triad: confidentiality (encryption, access control), integrity (hashing, signatures, file integrity monitoring), availability (redundancy, DDoS protection).
- Threat actors: script kiddies, hacktivists, organized crime, nation-state/APT, insider. Motivation shapes targeting and dwell time.
- Defense in depth, least privilege, zero trust: overlapping controls; no implicit trust from network location.
Models and metrics
- Cyber kill chain: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives. It is sequential; MITRE ATT&CK catalogs tactics and techniques and is better for mapping detection coverage.
- CVSS v3.1: base score 0.0–10.0; None 0.0, Low 0.1–3.9, Medium 4.0–6.9, High 7.0–8.9, Critical 9.0–10.0. Base metrics include attack vector, complexity, privileges required, user interaction, scope and C/I/A impact.
- Cryptography: symmetric (AES) for bulk data; asymmetric (RSA, ECC) for key exchange and signatures; hashing (SHA-256) for integrity, not confidentiality.
- Incident response (NIST SP 800-61): preparation; detection and analysis; containment, eradication and recovery; post-incident activity.
Worked example
A scanner reports a CVSS 9.8 vulnerability on a payroll server reachable only from a management VLAN with MFA. A second finding, CVSS 7.5, sits on an internet-facing VPN concentrator without MFA. Which first?
Reasoning: CVSS is severity, not risk. The 9.8 has high impact but constrained reachability and MFA; the 7.5 is internet-facing and lacks a compensating control. Risk ranking puts the VPN first, then the payroll server under a documented patching SLA. The control-aware answer beats the highest number.
Traps
- Treating vulnerability, exploit and malware as synonyms.
- Assuming encryption proves integrity, or that hashing encrypts.
- Equating CVSS score with business risk.
- Mixing kill-chain phases, such as delivery and exploitation.