Security fundamentals and threat landscape
Security fundamentals and threat landscape tests whether you can reason about risk, not just name attacks. Expect questions that ask you to classify a threat actor, identify the attack vector, and select a control that addresses the actual weakness. The exam favors precise definitions and defensible reasoning over buzzwords.
Core rules and concepts
- The CIA triad - confidentiality, integrity, availability - is the baseline for judging impact. Authentication, authorization, and accounting support access decisions but do not replace CIA.
- A threat is a potential cause of harm; a vulnerability is a weakness; risk combines likelihood and impact. A control reduces likelihood, impact, or both.
- Threat actors range from opportunistic criminals and insiders to organized crime, nation-state actors, hacktivists, and script kiddies. Motivation and capability shape likely tactics.
- Malware categories overlap: virus needs a host and user action, worm self-propagates, trojan is disguised, ransomware extorts via encryption, spyware collects, rootkit provides stealth and persistence. A zero-day is an unpublished vulnerability, not a type of malware.
- Attack surface includes people, processes, technology, and third parties. Defense in depth layers preventive, detective, and corrective controls.
Worked example
A finance employee receives an email that appears to come from the CEO, clicks a link, and enters credentials on a lookalike portal. The threat is a phishing campaign, probably opportunistic or business-email-compromise focused; the vector is email plus a credential-harvesting site; the vulnerability is user trust and missing phishing-resistant MFA. Impact is account takeover and possible fraud. A proportionate response combines phishing-resistant MFA, email filtering, user reporting, and monitoring for impossible-travel sign-ins.
Traps that cost marks
Do not call a vulnerability a threat, or a risk a control. Do not assume encryption solves availability. Do not label every attacker a hacker when the question asks for actor type. Do not confuse a zero-day with a phishing email or a botnet.