Security Principles
What every control protects
Nearly every question resolves to confidentiality (only authorized eyes), integrity (only authorized changes, and detectable if they happen) and availability (access when needed), plus authentication, authorization and accounting (AAA) and non-repudiation - the inability to plausibly deny an action, usually delivered by digital signatures and tamper-evident logs. Privacy is a separate obligation about how personal data is collected and used, not merely whether it is secret.
Describe every control twice
By category: administrative/managerial (policies, training, background checks), technical/logical (firewalls, encryption, MFA), physical (locks, bollards, guards). By function: preventive (stops), detective (records or alerts), corrective (restores), deterrent (discourages), compensating (substitutes where a control cannot be applied), recovery. Defense in depth layers these so one failure is not fatal; least privilege and separation of duties cap the damage any single identity can do.
Risk vocabulary questions swap
A threat is a potential cause of harm (an attacker, a flood). A vulnerability is a weakness. Risk combines likelihood and impact if a threat exploits a vulnerability. A safeguard reduces risk; residual risk remains after controls and must be accepted by management, not by the technician.
Rule of thumb
Ask: does it stop, spot, or fix? A badge-reader door lock is physical and preventive; the weekly badge-log review is detective; restoring from backup after a disk failure is corrective. If the scenario concerns detecting unauthorized modification, hashing/HMAC is the answer, not encryption.