Information Security, Cybersecurity and Privacy
What the exam tests
This domain tests the CIA triad, security controls, identity and access management, incident response and privacy principles. Expect questions on phishing, encryption, least privilege, breach response and data protection law.
Core rules and concepts
- Security protects confidentiality, integrity and availability. Risk treatment includes avoid, reduce, transfer and accept.
- Identity and access controls include authentication, multi-factor authentication, role-based access and least privilege. Encryption protects data at rest and in transit but does not replace access control.
- Layered controls include firewalls, patching, endpoint protection, email filtering, monitoring, backup and awareness training.
- Incident response covers preparation, detection, containment, eradication, recovery and lessons learned.
- Privacy principles include lawful basis, purpose limitation, data minimisation, accuracy, retention limits, security and data-subject rights. Nigeria's Data Protection Act 2023 requires breach notification to the Commission within 72 hours in specified cases.
Worked example
An employee clicks a phishing link and an attacker steals credentials. Controls include MFA, email filtering, least privilege, monitoring and user training. The incident team contains the account, resets credentials, checks lateral movement and reviews fraud. Reasoning: single controls fail, so layers matter. Privacy also applies: if customer data was exposed, assess risk and notify according to law.
Traps that cost marks
Security is not only confidentiality; integrity and availability count. Encryption does not stop an authorised user misusing data. Pseudonymisation is not anonymisation. Privacy is not identical to security. Compliance is not a one-time project.
Key points
- CIA stands for confidentiality, integrity and availability.
- Least privilege and MFA reduce account compromise.
- Incident response follows containment, eradication and recovery.
- Privacy requires lawful basis, minimisation and retention limits.
- Breach notification duties depend on risk and law.