I85PREP
⌘ K
ECF-GSF Core study materials
ECF-GSF Core study resources

ECF-GSF Core: Endpoint, Application and Cloud Security

ECF-GSF Core · Work through your exam, one topic at a time.

All guide sections

Endpoint, Application and Cloud Security

What this domain tests

This domain covers hardening endpoints, building secure software, and assigning responsibility correctly across cloud service models.

Core rules

  • Endpoint: asset inventory, patch SLAs by severity, CIS Benchmark hardening, application allowlisting, full-disk encryption, EDR with behavioural detection, USB control, and MDM compliance gating before access.
  • AppSec: secure SDLC, threat modelling (STRIDE), and the OWASP Top 10 - broken access control ranks first, followed by cryptographic failures, injection, insecure design and security misconfiguration. Validate input server-side, use parameterized queries, encode output, and enforce authorization on every request.
  • Testing: SAST is white-box analysis of source code, DAST is black-box testing of a running application, SCA inventories third-party dependencies. They are complementary, not substitutes.
  • Cloud shared responsibility: IaaS - provider secures facilities and hypervisor, customer secures the OS upward; PaaS - customer secures the application, data and identities; SaaS - customer secures data, identities and configuration.
  • Cloud tooling: CSPM for misconfiguration, CIEM for entitlements, CASB for shadow SaaS, secrets managers, container image scanning, account-level public-access blocks.

Worked example

An engineer makes an object-storage bucket public so a partner can download reports. Correct fix: enable the account-level public-access block, create a bucket policy scoped to the partner's role and a specific prefix, enable default encryption and access logging, and issue pre-signed URLs for temporary sharing. Reasoning: the root cause is a configuration default gap, so fix it at the account guardrail level first, then grant the narrowest access that meets the requirement. Rotating access keys would not help because the bucket was public.

Traps that cost marks

  • Assuming the provider patches the guest OS in IaaS.
  • Confusing SAST with DAST, or treating one scan as full coverage.
  • Believing a WAF replaces input validation and authorization checks.
  • Treating container immutability as a substitute for scanning the image and its dependencies.
  • Forgetting that identity configuration remains the customer's job in every cloud model.