IBM Cybersecurity Analyst study guide
IBM Cybersecurity Analyst · Work through your exam, one topic at a time.
The IBM Cybersecurity Analyst Professional Certificate is an entry-level credential offered through IBM's online learning programs, aimed at people moving into a security analyst role or adding defensive security skills to an IT background. It is not a vendor-neutral certification on the level of Security+ and it is not a hands-on penetration testing credential; the emphasis is on the day-to-day work of monitoring, investigating, and responding, with a strong tilt toward IBM's own tooling and terminology. The IBM Cybersecurity Analyst study guide has 9 sections and about 2,338 words.
01Cybersecurity Foundations and Threat Landscape
Domain 1 tests how well you can explain security's purpose, name threat actors, and connect attacks to the CIA triad and common frameworks. Expect questions on malware families, social engineering, and the difference between a threat, vulnerability, and risk.
254 words, about 1 min02Network Security and Perimeter Defense
Domain 2 covers perimeter and internal network controls: firewalls, DMZs, IDS/IPS, VPNs, segmentation, and zero-trust thinking. The exam favors design reasoning over product names.
274 words, about 1 min03Endpoint Security and System Hardening
Domain 3 tests endpoint protection and hardening across Windows, macOS, Linux, and mobile. You should know baseline configuration, patching, endpoint detection and response (EDR), application control, and encryption.
273 words, about 1 min04Vulnerability Assessment and Management
Domain 4 covers the vulnerability management lifecycle: inventory, scan, validate, prioritize, remediate, and verify. The exam emphasizes risk-based prioritization rather than chasing every CVSS 10.
243 words, about 1 min05Incident Response and Digital Forensics
Domain 5 tests incident response phases and forensic handling. Use NIST SP 800-61 as the mental model: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity.
259 words, about 1 min06Security Operations, Monitoring, and SIEM
Domain 6 covers security operations center (SOC) work: log collection, SIEM correlation, alert triage, tuning, and reporting. The exam expects you to distinguish detection from response and to reason about signal quality.
275 words, about 1 min07Identity, Access, and Data Protection
Domain 7 covers identity and access management (IAM) and data protection. Expect authentication versus authorization, least privilege, privileged access management, federation, encryption, and data classification.
255 words, about 1 min08Cloud and Application Security
Domain 8 covers cloud shared responsibility and application security. Know IaaS, PaaS, and SaaS boundaries, secure SDLC, OWASP Top 10 risks, secrets management, and cloud posture tools.
266 words, about 1 min09Governance, Risk, Compliance, and Ethics
Domain 9 covers governance, risk, compliance, and ethics. Expect policy hierarchy, risk assessment, regulatory obligations, third-party risk, and professional conduct.
239 words, about 1 min