ICYB study guide
ICYB · Work through your exam, one topic at a time.
The ICYB is an entry-level cybersecurity certification aimed at people moving into defensive security roles or adding a security credential to an IT, networking, or help-desk background. Its published blueprint is broad rather than deep: threats and the current attack landscape, network and perimeter defense, identity and authentication, endpoint hardening, data protection and cryptography, security operations and incident response, risk and governance, and secure architecture including cloud and development practices. The ICYB study guide has 8 sections and about 1,935 words.
01Cybersecurity Fundamentals and Threat Landscape
This domain tests how well you distinguish threats, vulnerabilities, and risk, and how you map adversary behavior to controls. Expect questions on the CIA triad, threat actors, attack frameworks, and vulnerability management.
261 words, about 1 min02Network Security and Perimeter Defense
This domain covers segmentation, firewalls, IDS/IPS, VPNs, and the shift from a hard outer perimeter to zero-trust access. Questions often test rule order, default-deny design, and where a control sits in the path.
243 words, about 1 min03Identity, Access, and Authentication
This domain tests authentication versus authorization, federation, MFA, and least-privilege access. Expect scenarios on SSO, OAuth/OIDC, SAML, role design, and credential attacks.
240 words, about 1 min04Endpoint and System Security
This domain covers hardening, patching, endpoint detection and response, application control, and protecting servers and workstations. Questions test baseline configuration and response actions.
236 words, about 1 min05Data Protection, Privacy, and Cryptography
This domain tests data classification, encryption, hashing, key management, and privacy obligations. Expect questions that distinguish confidentiality controls from integrity controls.
235 words, about 1 min06Security Operations, Monitoring, and Incident Response
This domain covers SOC workflows, log collection, SIEM detection, triage, and the incident-response lifecycle. Questions test what to do first and how to avoid destroying evidence.
238 words, about 1 min07Risk Management, Governance, and Compliance
This domain tests risk assessment, treatment, governance structures, and compliance frameworks. Expect questions on risk scoring, control selection, and business continuity.
243 words, about 1 min08Secure Architecture, Development, and Cloud
This domain covers secure design principles, secure SDLC, threat modeling, and cloud shared responsibility. Questions test where controls belong and who owns what.
239 words, about 1 min