Information Security
What the exam tests
Items test the security programme as a system: how confidentiality, integrity and availability objectives become controls, how identity is managed, and how vulnerabilities become risks. You are usually asked for the next action or the most appropriate control, so scope, ownership and asset criticality matter more than tooling brand names.
Core model
- CIA triad: confidentiality, integrity, availability. A control that protects one can harm another - aggressive key rotation without planning harms availability.
- AAA: authentication (who you are), authorization (what you may do), accounting/auditing (what you did). Authentication without authorization is a recurring gap.
- Least privilege, separation of duties and defence in depth remain the default design pattern; zero trust replaces the "trusted internal network" assumption with continuous verification.
- Identity lifecycle: joiner, mover, leaver. Access reviews are the detective control for the mover case, which is the most frequently missed.
- Cryptography: encryption in transit (TLS), at rest (disk or field level), and key management. Key custody and rotation are often the real control being tested.
Frameworks worth knowing
- ISO/IEC 27001:2022 Annex A contains 93 controls across four themes: organizational, people, physical, technological.
- NIST CSF 2.0 functions: Govern, Identify, Protect, Detect, Respond, Recover. Govern was added in version 2.0, so items that place risk management only under Identify reflect the older version.
Worked example
A scanner reports a CVSS 9.8 vulnerability on an internet-facing server that holds no personal data and is scheduled for decommissioning in two weeks. CVSS alone says patch immediately. A risk view says exposure is high but asset criticality is low and the fix window is short, so the response is a compensating control - a WAF rule plus network restriction - with a documented decision, an owner and an expiry date.
Traps
- Prioritizing remediation purely by CVSS score.
- Confusing authentication with authorization.
- Assuming encryption satisfies a compliance obligation without key management and access control.
- Relying on security by obscurity.
- Forgetting that logging and monitoring are controls, not optional extras.
- Overlooking third-party and supply-chain exposure, which sits in the Governance function of CSF 2.0.