Security Concepts
Security Concepts is the framing domain: it tests whether you can name the components of risk and map controls to them, rather than just listing attacks. LPI expects vendor-neutral vocabulary-asset, threat, vulnerability, exposure, risk, control-and the CIA triad: confidentiality, integrity, availability. You should also know defense in depth, least privilege, separation of duties, and the authentication factors (something you know, have, or are, plus location and behavior).
Risk is a calculation, not a label
Risk is usually expressed as likelihood × impact. A vulnerability is a weakness (missing patch, weak password); a threat is who or what can exploit it (criminal, worm, insider); exposure is whether the weakness is reachable. Controls reduce likelihood (patching, MFA) or impact (backups, segmentation). Residual risk is what remains after controls-you accept, transfer (insurance), mitigate, or avoid it.
Attacks you must distinguish
Phishing and social engineering target people; malware (virus, worm, trojan, ransomware) targets code execution; DoS/DDoS targets availability; on-path (MITM) attacks target confidentiality and integrity. Insider threats bypass perimeter controls, which is why least privilege and logging matter.
Worked example
A web server runs an outdated CMS on port 443, and an admin reuses the same password as a breached forum. Asset: server and data. Vulnerabilities: unpatched CMS, credential reuse. Threats: automated scanners and credential-stuffing bots. Likelihood is high because both are internet-facing; impact is high if the database holds customer records. Priority control: patch and use unique credentials with MFA, then add a WAF and backups. Reasoning: you fix reachable, high-impact weaknesses first, not the longest list.
Traps
Do not call a vulnerability a threat. Do not treat HTTPS as proof of a trustworthy site. Do not assume antivirus equals security. Do not ignore physical access and insiders.