Security Fundamentals and Threat Landscape
What this domain tests
Security Fundamentals and Threat Landscape asks you to define core security terms, classify attacks, and explain how layered controls on a Huawei USG address them. Expect definition-matching items and short scenarios such as 'which term describes a weakness in a service?'
Core rules and concepts
- CIA triad: confidentiality (encryption, access control), integrity (hashing, signatures), availability (anti-DDoS, redundancy).
- Vulnerability, threat, risk: a vulnerability is a weakness; a threat is an actor or event that can exploit it; risk is likelihood multiplied by impact. A threat without a vulnerability produces no risk.
- Attack lifecycle: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives. Controls are layered because each stage fails differently.
- Attack families: SYN/UDP/ICMP floods (DDoS), ARP and DNS spoofing, SQL injection, XSS, brute force, ransomware, phishing, APT, insider misuse.
- Huawei PDR model: Protection (firewall, ACL), Detection (IPS, anti-virus, logs), Response (alerts, blocking, forensics).
Worked example
A DMZ web server runs an unpatched CMS. An internet scanner probes it, then a botnet sends a SYN flood to the same server. Reasoning: the unpatched CMS is the vulnerability; the scanner and botnet are threats; the risk is high because the service is internet-facing. Correct controls: patch the CMS (remove the vulnerability), restrict exposure with a security policy, enable SYN flood protection, add an IPS signature for the CMS exploit, and keep logs for response.
Traps that cost marks
- Swapping 'risk' and 'vulnerability' in definition items.
- Calling phishing a network-layer attack; it is social engineering, usually by email.
- Confusing DoS (single source) with DDoS (distributed).
- Treating stateful filtering as detection; it is protection, not intrusion detection.