ECF Cybersecurity (Core) study guide
ECF Cybersecurity (Core) · Work through your exam, one topic at a time.
The ECF Cybersecurity (Core) is an entry-to-intermediate level credential for people who want to demonstrate practical, cross-cutting security competence rather than deep specialization in a single tool or vendor stack. It suits career changers entering IT or security, junior analysts and administrators, and non-security technologists such as developers or help-desk staff who need to reason about risk, controls, and incidents in their daily work. The ECF Cybersecurity (Core) study guide has 8 sections and about 3,297 words.
01Security Fundamentals and Risk Management
This domain tests whether you can turn security spending into a defensible business decision. Questions cluster around the CIA triad plus authenticity and non-repudiation, control classification, quantitative versus qualitative risk analysis, and the business-impact vocabulary (MTD, RTO, RPO) that continuity and incident plans depend on.
408 words, about 2 min02Network Security
Network Security questions test whether you can place a control at the right layer and justify it. Expect segmentation design, firewall and IDS/IPS behaviour, secure remote access, wireless authentication, and the classic interception attacks.
395 words, about 2 min03Identity and Access Management
IAM questions reward precision about the order of identity operations and the protocols behind federation. You must separate authentication from authorisation, choose an access model, and design joiner-mover-leaver flows that leave no orphaned accounts.
385 words, about 2 min04Endpoint and System Security
This domain tests hardening and detection on hosts: baselines, patching, application control, the difference between endpoint protection platforms and EDR, encryption of data at rest, and the secure boot and TPM chain that underpins it. Hardening baseline: remove unnecessary services, disable or rename default accounts, enforce least functionality, apply CIS Benchmarks or vendor STIGs, and measure configuration drift.
410 words, about 2 min05Cryptography and Data Protection
Cryptography questions test two things: choosing the right primitive for a stated goal, and the operational discipline of keys - generation, storage, rotation, destruction and agility. Symmetric ciphers (AES-GCM) are fast and, as AEAD modes, give confidentiality plus integrity.
424 words, about 2 min06Security Operations and Incident Response
This domain tests the operational loop: telemetry, detection, triage, response and learning. Questions ask for the correct lifecycle phase, the right first action, and correct handling of evidence.
409 words, about 2 min07Threat Intelligence and Vulnerability Management
This domain tests prioritisation: turning scanner output and adversary knowledge into a defensible remediation order, then proving the order worked. Asset inventory and ownership come first; unmanaged assets are invisible risk.
399 words, about 2 min08Governance, Compliance and Privacy
This domain tests the accountability layer: the policy hierarchy, who owns what, how third parties are overseen, and the privacy obligations that constrain technical choices. Document hierarchy: policy states management intent and is mandatory; standards set mandatory specifics (for example, AES-256 for data at rest); procedures give step-by-step instructions; guidelines are recommended.
467 words, about 2 min