Cybersecurity Fundamentals and Threat Landscape
Domain 1 - Cybersecurity Fundamentals and Threat Landscape
This domain tests how well you distinguish threats, vulnerabilities, and risk, and how you map adversary behavior to controls. Expect questions on the CIA triad, threat actors, attack frameworks, and vulnerability management.
Core rules
- Confidentiality, integrity, and availability are separate objectives; a control can help one and hurt another.
- A threat is a potential cause; a vulnerability is a weakness; risk combines threat, vulnerability, and impact.
- Threat actors range from commodity criminals to insiders, hacktivists, and nation-states; motivation and capability change the control mix.
- The Cyber Kill Chain describes stages from reconnaissance to actions on objectives. MITRE ATT&CK describes tactics and techniques observed in real intrusions.
- Vulnerability scanning finds candidates; exploitation or validated evidence confirms real exposure. Prioritize by exploitability and business impact, not raw CVSS alone.
Worked example
A finance user opens an invoice attachment, enables macros, and the host beacons to an external IP. The attachment is delivery; macro execution is execution; the beacon is command-and-control. Controls include email filtering and attachment sandboxing, macro blocking by policy, egress filtering to unknown destinations, and EDR behavioral detection. Patching the browser would not address this chain.
Traps
Calling a missing patch a threat rather than a vulnerability; treating phishing as lateral movement; assuming CVSS 10 is always the top business risk; and forgetting that risk requires an impact to the organization.