Cybersecurity Foundation study guide
Cybersecurity Foundation · Work through your exam, one topic at a time.
The PECB Cybersecurity Foundation is an entry-level training course and certificate exam for people who need a working grasp of core cybersecurity principles and how a cybersecurity program is built and run. PECB positions the course as an in-depth exploration of core cybersecurity principles and concepts aligned with industry best practices such as ISO/IEC 27032 and the NIST Cybersecurity Framework. The target audience is broad: managers and consultants expanding their cybersecurity knowledge, professionals who want to familiarize themselves with cybersecurity management best practices, individuals who carry out cybersecurity activities inside their organization, and people pursuing a cybersecurity career. There are no prerequisites to participate in the training course. Topics on this exam: Fundamental cybersecurity principles and concepts and Cybersecurity program. The Cybersecurity Foundation study guide has 2 sections and about 826 words.
01Fundamental cybersecurity principles and concepts
This domain tests the vocabulary and reasoning behind every later control decision: how assets, threats, vulnerabilities, and risk relate; what confidentiality, integrity, and availability protect; and why controls are layered, scoped, and measured. Asset : anything of value, including data, systems, people, and reputation. Threat : an actor or event with the potential to cause harm, such as ransomware or a malicious insider. Vulnerability : a weakness that a threat can exploit, such as an unpatched service or an overly broad permission.
402 words, about 2 min02Cybersecurity program
This domain tests how the security function is governed, resourced, operated, and improved: who owns risk, how policies become practice, and how the program proves it works. Accountable ownership : an executive sponsor and a named owner for each risk; a security leader coordinates but does not absorb every risk. Risk management cycle : identify, assess, treat, accept, and monitor. A risk register records owner, treatment, due date, and residual risk.
424 words, about 2 min