ECF-GSF Core study guide
ECF-GSF Core · Work through your exam, one topic at a time.
ECF-GSF Core (Global Security Fundamentals Core) is an entry-level cybersecurity certification built around seven weighted domains: security fundamentals and risk management, network security and architecture, identity and access, data protection and cryptography, endpoint/application/cloud security, security operations and incident response, and governance, compliance and cyber law. It suits career-changers, junior analysts, IT generalists and students who need a single credential proving broad, vendor-neutral literacy before specialising. The ECF-GSF Core study guide has 7 sections and about 3,273 words.
01Security Fundamentals and Risk Management
Domain 1 supplies the vocabulary and arithmetic every later domain depends on: the CIA triad plus AAA, the distinction between threat, vulnerability and risk, the control taxonomy, and the risk-management process (identify, assess, treat, monitor). Expect definitional items and at least one quantitative annualized-loss question.
421 words, about 2 min02Network Security and Architecture
This domain checks how you place controls on a topology: zoning and segmentation, firewall and IDS/IPS behaviour, secure remote access, wireless authentication, and the move from perimeter thinking to zero trust. Zones : untrusted internet, DMZ/screened subnet for public-facing services, internal trusted zone, and a separate management network.
452 words, about 2 min03Identity, Access and Authentication
Identity is the practical perimeter. This domain verifies that you can separate identification, authentication, authorization and accounting, choose the correct factor or protocol, and design lifecycle and privileged-access controls.
387 words, about 2 min04Data Protection
Data Protection tests whether you can classify data, assign ownership, and select the right technique - encryption, masking, tokenization, DLP - across the lifecycle from creation to disposal. Classification drives handling : typically public, internal, confidential, restricted.
404 words, about 2 min05Cryptography and Privacy
This domain tests algorithm and key-usage selection, PKI trust, TLS behaviour, and the privacy principles that decide whether a processing activity is lawful. Symmetric : AES is the standard; GCM gives authenticated encryption.
414 words, about 2 min06Endpoint, Application and Cloud Security
This domain covers hardening endpoints, building secure software, and assigning responsibility correctly across cloud service models. Endpoint : asset inventory, patch SLAs by severity, CIS Benchmark hardening, application allowlisting, full-disk encryption, EDR with behavioural detection, USB control, and MDM compliance gating before access.
386 words, about 2 min07Security Operations, Monitoring and Incident Response
Security Operations tests the detection-and-response pipeline: collect, detect, triage, respond, and handle evidence in a defensible way. Logging : centralize into a SIEM.
809 words, about 4 min