Tools and Technology
Categories, not brands
Questions test what a class of tool does, where it sits, and what it cannot see. Be comfortable with the roles of firewalls, intrusion detection and prevention systems, endpoint protection, vulnerability scanners, log aggregation and monitoring, backup and recovery tooling, and identity providers.
Key distinctions
Know the difference between detection and prevention, between scanning (finding known weaknesses) and testing (attempting exploitation), and between logging (recording events) and monitoring (reviewing them for meaning). Understand that encryption protects data at rest and in transit but does not by itself ensure availability or integrity of the surrounding system.
Traps to watch
- Assuming a scanner proves exploitability; it reports potential weaknesses that require validation.
- Believing a firewall inspects encrypted payloads by default - it generally cannot without interception.
- Confusing backup with archival; backups support recovery, archives support retention.
- Treating alerts as incidents; alerts require triage.
- Assuming a tool covers assets it was never deployed to.
Rule of thumb
For any tool question, ask three things: What does it see? What does it act on? What does it miss? The third question is where most distractors live.
Worked example
A scanner reports an outdated library on a web server. That is a finding, not a confirmed breach. Validation confirms the version is reachable; change management schedules the patch; monitoring watches for exploitation attempts during the window. Each tool contributes one link in the chain - none of them alone closes the risk.