Cybersecurity
This domain tests the vocabulary and judgment behind protecting systems, data, and people. Expect questions on the CIA triad, identity and access management, threat types, network defenses, cryptography basics, and incident response. The exam favors applied reasoning: given a scenario, identify the asset, the threat, the control category, and the most appropriate next action.
Core rules and concepts
- CIA triad: confidentiality (only authorized readers), integrity (unchanged and accurate), availability (reachable when needed).
- Authentication vs authorization: authentication proves identity; authorization decides what that identity may do. MFA strengthens authentication; least privilege limits authorization.
- Control types: preventive (MFA, firewall rules), detective (logs, IDS alerts), corrective (restore backup, isolate host). Controls can also be administrative, technical, or physical.
- Risk: risk combines likelihood and impact; a vulnerability is a weakness, a threat is a potential actor or event, and risk is the combination with impact.
- Cryptography: symmetric encryption is fast and uses one shared key; asymmetric uses a public/private pair for key exchange or signatures; hashing is one-way and checks integrity, not confidentiality.
- Incident response: prepare, detect/analyze, contain, eradicate, recover, then lessons learned.
Worked example
An employee enters credentials on a look-alike login page. The attacker signs in from another country. Which CIA property is directly affected, which control would have prevented the credential theft, and what is the best immediate action?
Reasoning: stolen credentials allow reading of data, so confidentiality is directly at risk; integrity and availability may follow but are not the first effect. Phishing is a social-engineering attack, and MFA would have blocked the reused password even after theft. The immediate priority is containment: disable the account or revoke sessions, then reset credentials and review logs. Patching or a firewall rule is not the first action because the attacker is already authenticated.
Traps
Do not label encryption as hashing or say hashing keeps data secret. Do not call authentication 'authorization'. Do not choose 'restore from backup' as prevention. A firewall is not antivirus, and a vulnerability scan is not an exploit. 'Least privilege' means minimum necessary access, not no access. When a question asks for the first step, prefer containment over eradication.