I85PREP
⌘ K
CFR-410 study materials
CFR-410 study resources

CFR-410: Address: Implementing Controls Across Data, Access, Software, Network, and Systems

CFR-410 · Work through your exam, one topic at a time.

All guide sections

Address: Implementing Controls Across Data, Access, Software, Network, and Systems

Domain 3 - Address

The Address domain tests whether you can select and sequence controls that actually break an observed attack chain - across data, access, software, network, and systems - and explain the tradeoff each control introduces.

Data

  • Classify first, then protect: encryption at rest (BitLocker, LUKS, transparent database encryption) and in transit (TLS 1.2 or later, SMB signing), data loss prevention for regulated content, and tokenization where the full value is never needed.
  • Backups follow 3-2-1 with at least one immutable or offline copy, and restores are tested. Ransomware only wins when backups are reachable from the compromised directory.

Access

  • Least privilege with just-in-time elevation, and separate administrative accounts (tiered administration) so a workstation compromise does not hand over domain admin.
  • MFA everywhere, phishing-resistant (FIDO2) for administrators. Push-based approval is defeated by MFA fatigue and real-time phishing proxies.
  • Remove legacy paths: disable LLMNR and NBT-NS to stop name-resolution poisoning, enforce SMB signing and disable SMBv1, use LAPS for local administrator passwords, and move service accounts to group managed service accounts to blunt Kerberoasting.

Software

  • Risk-based patch SLAs; application allowlisting (WDAC or AppLocker) with code signing; secure development practice including dependency scanning; endpoint detection with tamper protection and centralized logging so the agent cannot be quietly disabled.

Network

  • Segmentation and microsegmentation; deny-by-default egress with explicit allowlists; DNS filtering and sinkholing; proxy inspection of encrypted traffic where lawful. Egress control is the primary catcher of reverse shells, beaconing, and exfiltration.
  • Zero Trust framing: identity-aware access with no implicit trust derived from network location.

Systems

  • Hardened baselines, removal of unnecessary services, restricted PowerShell (script block logging 4104, constrained language mode), and off-host log forwarding so an intruder who clears the local log does not erase the evidence.

Worked example

After ransomware spread over SMB using stolen domain admin credentials, sequence the response: (1) contain - segment the affected range and disable compromised accounts; (2) remove the enabler - rotate the krbtgt account twice, reset privileged credentials, deploy LAPS; (3) break the spread path - disable SMBv1, require SMB signing, block lateral SMB at segment boundaries; (4) restore - from an immutable backup verified by hash; (5) detect next time - enable command-line auditing, deploy Sysmon, and forward logs off-host. Each step maps to a specific link in the observed chain rather than to generic best practice.

Traps

Treating prevention and detection as interchangeable; assuming antivirus satisfies endpoint protection; deploying MFA while leaving legacy protocols enabled; blocking inbound traffic while ignoring egress; and restoring backups before confirming attacker persistence has been removed.