Security and Compliance
The Security and Compliance domain tests how you harden endpoints, protect data, and prove control effectiveness. Expect questions on encryption, endpoint protection, DLP, application control, patch compliance, conditional access, audit logging, data residency, and benchmark baselines. The exam treats security as layered: device, identity, data, network, and monitoring.
Core rules
- Harden to a baseline: disable unused services, enforce firewall, require disk encryption, restrict admin rights, and apply CIS or vendor benchmarks with documented exceptions.
- Protect data at rest and in transit. Encryption without key recovery is a support risk; DLP without classification creates noise.
- Enforce, then evidence. A compliance dashboard is not control evidence unless it records device state, policy version, and time.
- Use least privilege for support roles and audit administrative actions. Retain logs long enough for investigation and regulatory need.
Worked example
A laptop with customer data is lost. The device has BitLocker, a compliance policy requiring encryption, and conditional access blocking noncompliant devices. The admin confirms the volume is encrypted, revokes the user session, queues a remote wipe, and reviews sign-in logs for the account. The reasoning: encryption protects data at rest, session revocation limits live access, wipe reduces residual risk, and logs support the incident record. If encryption had not been enabled, the same response would be weaker.
Traps
Do not equate antivirus with full endpoint security. Do not create permanent policy exemptions for executives. Do not treat a failed compliance check as a failed control without checking check-in time. Do not collect logs without retention and access controls.