LPI Security Essentials study plan

Define the CIA triad and map at least six concrete attack scenarios (phishing, ransomware, insider misuse, DDoS, physical theft, supply-chain compromise) to the property each one violates.

Distinguish threat, vulnerability, risk, and control, and write one risk statement per scenario that names asset, threat, likelihood, and impact.

Classify controls as preventive, detective, or corrective, and assign at least one control of each type to every scenario from goal 1.

Explain the difference between symmetric and asymmetric cryptography and state which one solves key distribution and which one solves bulk data confidentiality.

Describe how AES, RSA, and elliptic-curve cryptography differ in key size, speed, and typical use, and pick the right primitive for three stated use cases.

Explain hashing and demonstrate why hashes support integrity while encryption alone does not, using a concrete tampered-download example.

Compare HMAC with a digital signature and state which one proves origin authenticity to a third party and why.

Trace a TLS 1.3 handshake step by step and identify where key exchange, authentication, and record encryption occur.

Explain what a digital certificate binds, who signs it, and what a certificate authority failure would mean for a browser session.

Differentiate full-disk encryption, file-level encryption, and encrypted containers, and state the threat each does and does not mitigate.

Explain how disk encryption protects data at rest against a stolen laptop but not against malware running as the logged-in user.

Describe how TPM-backed measured boot and secure boot detect tampering with the boot chain.

Explain why key management, backup of keys, and key rotation matter more than the cipher choice in real deployments.

Identify at least four hardening steps for a workstation and justify each against a specific threat.

Describe how file permissions work on a Unix-like system and explain why least privilege on file modes limits damage from a compromised process.

Explain the principle of least privilege and apply it to three concrete accounts: a service account, a developer, and an administrator.

Compare password authentication, SSH keys, and hardware tokens for remote administrative access and state the residual risk of each.

Explain how sandboxing, containers, and mandatory access control constrain a compromised application.

Describe how mobile device management, screen locks, and remote wipe reduce the impact of a lost phone.

Explain the role of a firewall, state the difference between stateless and stateful filtering, and write three example rules that allow web traffic while denying the rest.

Describe how network segmentation limits lateral movement and give one concrete segmentation design for an office with guests, staff, and servers.

Explain what a VPN protects and what it does not protect, including the case of a malicious VPN provider.

Compare WPA2 and WPA3, and list the practical steps that make a home or small-office wireless network resistant to common attacks.

Explain how DNS resolution can be abused for data exfiltration or redirection, and name one mitigation.

Explain multi-factor authentication, distinguish knowledge, possession, and inherence factors, and identify why SMS codes are weaker than app-based or hardware tokens.

Describe how password managers reduce risk and what the master password still has to withstand.

Explain how phishing, credential stuffing, and session hijacking differ and what control stops each.

Describe what personal data minimization means in practice and give three examples of data that should not be collected.

Explain the purpose of privacy notices, consent, and data retention limits from the perspective of a user and of an administrator.

Explain how tracking cookies, browser fingerprints, and IP addresses contribute to online profiling, and describe one concrete countermeasure for each.

Describe the trade-offs of anonymity tools and state what metadata they cannot hide.

Explain how backups, tested restores, and an incident response plan reduce the impact of ransomware.

Draft a short incident response procedure covering detection, containment, eradication, recovery, and lessons learned.

Explain why security awareness training and clear reporting channels reduce phishing success more than filtering alone.

Re-derive the weakest domain from practice results and close the three highest-error topics with targeted review.

Explain each of the five domains in your own words in under two minutes per domain, without notes.

Work through timed practice covering all domains and review every wrong answer to its root cause.

Verify that you can justify, not just name, the standard control for each common scenario in the exam objectives.