Foundational Concepts and Terminology
This domain tests whether you can use security vocabulary precisely under pressure - not recite definitions, but classify a live situation into the correct term and then act on that classification.
The precision vocabulary set
- Asset, threat, threat actor, vulnerability, exposure, likelihood, impact, risk, residual risk.
- Control types: preventive, detective, corrective, compensating, deterrent. Control categories: administrative, technical, physical.
- CIA triad plus supporting properties: authenticity, non-repudiation, accountability.
- AAA: identification, authentication, authorization, accounting/auditing.
- Subject vs object, least privilege, separation of duties, defense in depth.
- Due care (acting correctly) vs due diligence (verifying that you did).
Worked example
An internet-facing Apache server holding customer PII runs an unpatched version with a known remote code execution flaw.
- Asset: the server and the PII on it.
- Vulnerability: the missing patch.
- Threat: an actor or event that could exploit it, such as a ransomware crew or an automated scanner.
- Risk: likelihood combined with business impact if exploitation occurs.
- Controls: patch management (preventive), WAF (preventive/detective), EDR and log alerting (detective), restore from backup (corrective).
Reasoning shown: you cannot patch a threat. You reduce the vulnerability or the impact. The patch is preventive; the backup is corrective; neither one is a risk, and a compensating control is not automatically corrective.
Traps that cost marks
- Naming a vulnerability a threat, or naming a control a risk.
- Declaring risk high without stating likelihood and impact.
- Treating due care and due diligence as synonyms.
- Forgetting that residual risk must be owned by someone with authority.