🌊 SYO-701 Content
Reference sheet
1.0 General Security Concepts
1.1 Compare and contrast various types of security controls.- Categories
- Technical
- Managerial
- Operational
- Physical
- Control types
- Preventive
- Deterrent
- Detective
- Corrective
- Compensating
- Directive
- Categories
- Technical
- Managerial
- Operational
- Physical
- Control types
- Preventive
- Deterrent
- Detective
- Corrective
- Compensating
- Directive
1.2 Summarise fundamental security concepts.- Confidentiality, Integrity, and Availability (CIA)
- Non-repudiation
- Authentication, Authorisation, and Accounting (AAA)
- Authenticating people
- Authenticating systems
- Authorisation models
- Gap analysis
- Zero Trust
- Control Plane
- Adaptive identity
- Threat scope reduction
- Policy-driven access control
- Policy Administrator
- Policy Engine
- Data Plane
- Implicit trust zones
- Subect/System
- Policy Enforcement Point
- Physical security
- Bollards
- Access control vestibule
- Fencing
- Video surveillance
- Security guard
- Access badge
- Lighting
- Sensors
- Infrared
- Pressure
- Microwave
- Ultrsonic
- Deception and disruption technology
- Honeypot
- Honeynet
- Honeyfile
- Honeytoken
- Confidentiality, Integrity, and Availability (CIA)
- Non-repudiation
- Authentication, Authorisation, and Accounting (AAA)
- Authenticating people
- Authenticating systems
- Authorisation models
- Gap analysis
- Zero Trust
- Control Plane
- Adaptive identity
- Threat scope reduction
- Policy-driven access control
- Policy Administrator
- Policy Engine
- Data Plane
- Implicit trust zones
- Subect/System
- Policy Enforcement Point
- Physical security
- Bollards
- Access control vestibule
- Fencing
- Video surveillance
- Security guard
- Access badge
- Lighting
- Sensors
- Infrared
- Pressure
- Microwave
- Ultrsonic
- Deception and disruption technology
- Honeypot
- Honeynet
- Honeyfile
- Honeytoken
1.3 Explain the importance of change management processes and the impact to security.- Business processes impacting security operation
- Approval process
- Ownership
- Stakeholders
- Impact analysis
- Test results
- Backout plan
- Maintenance window
- Standard operating procedure
- Technical implications
- Allow lists/deny lists
- Restricted activities
- Downtime
- Service restart
- Application restart
- Legacy applications
- Dependencies
- Documentation
- Updating diagrams
- Updating policies/procedures
- Version Control
- Business processes impacting security operation
- Approval process
- Ownership
- Stakeholders
- Impact analysis
- Test results
- Backout plan
- Maintenance window
- Standard operating procedure
- Technical implications
- Allow lists/deny lists
- Restricted activities
- Downtime
- Service restart
- Application restart
- Legacy applications
- Dependencies
- Documentation
- Updating diagrams
- Updating policies/procedures
- Version Control
1.4 Explain the importance of using appropriate cryptographic solutions.- Public key infrastructure (PKI)
- Public key
- Private key
- Key escrow
- Encryption
- Level
- Full-disk
- Partition
- File
- Volume
- Database
- Record
- Transport/communication
- Asymmetric
- Symmetric
- Key exchange
- Algorithms
- Key length
- Tools
- Trusted Platform Module (TPM0
- Hardware security module (HSM)
- Key management system
- Secure enclave
- Public key infrastructure (PKI)
- Public key
- Private key
- Key escrow
- Encryption
- Level
- Full-disk
- Partition
- File
- Volume
- Database
- Record
- Transport/communication
- Asymmetric
- Symmetric
- Key exchange
- Algorithms
- Key length
- Tools
- Trusted Platform Module (TPM0
- Hardware security module (HSM)
- Key management system
- Secure enclave
- Obfuscation
- Steganography
- Tokenisation
- Data masking
- Hashing
- Salting
- Digital signatures
- Key stretching
- Blockchain
- Open public ledger
- Certificates
- Certificate authorities
- Certificate revocation lists (CRLs)
- Online Certificate Status Protocol (OCSP)
- Self-signed
- Third-party
- Root of trust
- Certificate signing request (CSR) generation
- Wildcard
- Obfuscation
- Steganography
- Tokenisation
- Data masking
- Hashing
- Salting
- Digital signatures
- Key stretching
- Blockchain
- Open public ledger
- Certificates
- Certificate authorities
- Certificate revocation lists (CRLs)
- Online Certificate Status Protocol (OCSP)
- Self-signed
- Third-party
- Root of trust
- Certificate signing request (CSR) generation
- Wildcard
2.0 Threats, Vulnerabilities, and Mitigations.
2.1 Compare and contrast common threat actors and motivations.- Threat actors
- Nation-state
- Unskilled attacker
- Hacktivist
- Insider threat
- Organised crime
- Shadow IT
- Attributes of actors
- Internal/external
- Resources/funding
- Level of sophistication/capability
- Motivations
- Data exfiltration
- Espionage
- Service disruption
- Blackmail
- Financial gain
- Philosophical/political beliefs
- Ethical
- Revenge
- Disruption/chaos
- War
- Threat actors
- Nation-state
- Unskilled attacker
- Hacktivist
- Insider threat
- Organised crime
- Shadow IT
- Attributes of actors
- Internal/external
- Resources/funding
- Level of sophistication/capability
- Motivations
- Data exfiltration
- Espionage
- Service disruption
- Blackmail
- Financial gain
- Philosophical/political beliefs
- Ethical
- Revenge
- Disruption/chaos
- War
2.2 Explain common threat vectors and attack surfaces.- Message-based
- Email
- Short Message Service (SMS)
- Instant messaging (IM)
- Image-based
- File-based
- Voice call
- Removable device
- Vulnerable software
- Client-based vs agentless
- Unsupported systems and applications
- Unsecure networks
- Wireless
- Wired
- Bluetooth
- Open service ports
- Default credentials
- Supply chain
- Managed service providers (MSPs)
- Vendors
- Suppliers
- Human vectors/social engineering
- Phishing
- Vishing
- Smishing
- Misinformation/disinformation
- Impersonation
- Business email compromise
- Pretexting
- Watering hole
- Brand impersonation
- Typosquatting
- Message-based
- Short Message Service (SMS)
- Instant messaging (IM)
- Image-based
- File-based
- Voice call
- Removable device
- Vulnerable software
- Client-based vs agentless
- Unsupported systems and applications
- Unsecure networks
- Wireless
- Wired
- Bluetooth
- Open service ports
- Default credentials
- Supply chain
- Managed service providers (MSPs)
- Vendors
- Suppliers
- Human vectors/social engineering
- Phishing
- Vishing
- Smishing
- Misinformation/disinformation
- Impersonation
- Business email compromise
- Pretexting
- Watering hole
- Brand impersonation
- Typosquatting
2.3 Explain various types of vulnerabilities.- Application
- Memory injection
- Buffer overflow
- Race conditions
- Time-of-check (TOC)
- Time-of-use (TOU)
- Malicious update
- Operating system (OS)-based
- Web-based
- Structured Query Language Injection (SQLi)
- Cross-site scripting (XSS)
- Hardware
- Firmware
- End-of-life
- Legacy
- Virtualisation
- Virtual machine (VM) escape
- Resource reuse
- Cloud-specific
- Supply chain
- Service provider
- Hardware provider
- Software provider
- Cryptographic
- Misconfiguration
- Mobile device
- Side loading
- Jailbreaking
- Zero-day
2.4 Given a scenario, analyse indicators of malicious activity. - Malware attacks
- Ransomware
- Trojan
- Worm
- Spyware
- Bloatware
- Virus
- Keylogger
- Logic bomb
- Rootkit
- Physical attacks
- Brute force
- Radio frequency identification (RFID) cloning
- Environmental
- Network attacks
- Distributed denial-of-service (DDoS)
- Amplified
- Reflected
- Domain Name System (DNS) attacks
- Wireless
- On-path
- Credential replay
- Malicious code
- Application attacks
- Injection
- Buffer overflow
- Replay
- Privilege escalation
- Forgery
- Directory traversal
- Cryptographic attacks
- Downgrade
- Collision
- Birthday
- Password attacks
- Spraying
- Brute force
- Indicators
- Account lockout
- Concurrent sessions usage
- Blocked content
- Impossible travel
- Resource consumption
- Resource inaccessibility
- Out-of-cycle logging
- Published/documented
- Missing logs
2.5 Explain the purpose of mitigation techniques used to secure the enterprise.- Segmentation
- Access control
- Access control list (ACL)
- Permissions
- Application allow list
- Isolation
- Patching
- Encryption
- Monitoring
- Least privilege
- Configuration enforcement
- Decommissioning
- Hardening techniques
- Encryption
- Installation of endpoint protection
- Host-based firewall
- Host-based intrusion prevention system (HIPS)
- Disabling ports/protocols
- Default password changes
- Removal of unnecessary software
- Application
- Memory injection
- Buffer overflow
- Race conditions
- Time-of-check (TOC)
- Time-of-use (TOU)
- Malicious update
- Operating system (OS)-based
- Web-based
- Structured Query Language Injection (SQLi)
- Cross-site scripting (XSS)
- Hardware
- Firmware
- End-of-life
- Legacy
- Virtualisation
- Virtual machine (VM) escape
- Resource reuse
- Cloud-specific
- Supply chain
- Service provider
- Hardware provider
- Software provider
- Cryptographic
- Misconfiguration
- Mobile device
- Side loading
- Jailbreaking
- Zero-day
2.4 Given a scenario, analyse indicators of malicious activity.
- Malware attacks
- Ransomware
- Trojan
- Worm
- Spyware
- Bloatware
- Virus
- Keylogger
- Logic bomb
- Rootkit
- Physical attacks
- Brute force
- Radio frequency identification (RFID) cloning
- Environmental
- Network attacks
- Distributed denial-of-service (DDoS)
- Amplified
- Reflected
- Domain Name System (DNS) attacks
- Wireless
- On-path
- Credential replay
- Malicious code
- Application attacks
- Injection
- Buffer overflow
- Replay
- Privilege escalation
- Forgery
- Directory traversal
- Cryptographic attacks
- Downgrade
- Collision
- Birthday
- Password attacks
- Spraying
- Brute force
- Indicators
- Account lockout
- Concurrent sessions usage
- Blocked content
- Impossible travel
- Resource consumption
- Resource inaccessibility
- Out-of-cycle logging
- Published/documented
- Missing logs
2.5 Explain the purpose of mitigation techniques used to secure the enterprise.
- Segmentation
- Access control
- Access control list (ACL)
- Permissions
- Application allow list
- Isolation
- Patching
- Encryption
- Monitoring
- Least privilege
- Configuration enforcement
- Decommissioning
- Hardening techniques
- Encryption
- Installation of endpoint protection
- Host-based firewall
- Host-based intrusion prevention system (HIPS)
- Disabling ports/protocols
- Default password changes
- Removal of unnecessary software
3.0 Security Architecture
3.1 Compare and contrast security implications of different architecture models.- Archictecture and infrastructure concepts
- Cloud
- Responsibility matrix
- Hybrid considerations
- Third-party vendors
- Infrastructure as code (IaC)
- Serverless
- Microservices
- Network infrastructure
- Physical isolation
- Air-gapped
- Logical segmentation
- Software-defined networking (SDN)
- On-premises
- Centralised vs. decentralised
- Containerisation
- Virtualisation
- IoT
- Industrial control systems (ICS)/supervisory control and data acquisition (SCADA)
- Real-time operation system (RTOS)
- Embedded systems
- High availability
- Considerations
- Availability
- Resilience
- Cost
- Responsiveness
- Scalability
- Ease of deployment
- Risk transference
- Ease of recovery
- Patch availability
- Inability to patch
- Power
- Compute
- Archictecture and infrastructure concepts
- Cloud
- Responsibility matrix
- Hybrid considerations
- Third-party vendors
- Infrastructure as code (IaC)
- Serverless
- Microservices
- Network infrastructure
- Physical isolation
- Air-gapped
- Logical segmentation
- Software-defined networking (SDN)
- On-premises
- Centralised vs. decentralised
- Containerisation
- Virtualisation
- IoT
- Industrial control systems (ICS)/supervisory control and data acquisition (SCADA)
- Real-time operation system (RTOS)
- Embedded systems
- High availability
- Considerations
- Availability
- Resilience
- Cost
- Responsiveness
- Scalability
- Ease of deployment
- Risk transference
- Ease of recovery
- Patch availability
- Inability to patch
- Power
- Compute
3.2 Given a scenario, apply security principles to secure enterprise infrastructure.- Infrastructure considerations
- Device placement
- Security zones
- Attack surface
- Connectivity
- Failure modes
- Fail-open
- Fail-closed
- Device attribute
- Active vs. passive
- Inline vs. tap/monitor
- Network appliances
- Jump server
- Proxy server
- Intrusion prevention system (IPS)/Intrusion detection system (IDS)
- Load balancer
- Sensors
- Port security
- 802.1X
- Extensible Authentication Protocol (EAP)
- Firewall types
- Web application firewall (WAF)
- Unified threat management (UTM)
- Next-generation firewall (NGFW)
- Layer 4/Layer 7
- Secure communication/access
- Virtual private network (VPN)
- Remote access
- Tunneling
- Transport Layer Security (TLS)
- Internet protocol security (IPSec)
- Software-defined wide area network (SD-WAN)
- Secure access service edge (SASE)
- Selection of effective controls
- Infrastructure considerations
- Device placement
- Security zones
- Attack surface
- Connectivity
- Failure modes
- Fail-open
- Fail-closed
- Device attribute
- Active vs. passive
- Inline vs. tap/monitor
- Network appliances
- Jump server
- Proxy server
- Intrusion prevention system (IPS)/Intrusion detection system (IDS)
- Load balancer
- Sensors
- Port security
- 802.1X
- Extensible Authentication Protocol (EAP)
- Firewall types
- Web application firewall (WAF)
- Unified threat management (UTM)
- Next-generation firewall (NGFW)
- Layer 4/Layer 7
- Secure communication/access
- Virtual private network (VPN)
- Remote access
- Tunneling
- Transport Layer Security (TLS)
- Internet protocol security (IPSec)
- Software-defined wide area network (SD-WAN)
- Secure access service edge (SASE)
- Selection of effective controls
3.3 Compare and contrast concepts and strategies to protect data.- Data types
- Regulated
- Trade secret
- Intellectual property
- Legal information
- Financial information
- Human-and non-human-readable
- Data classifications
- Sensitive
- Confidential
- Public
- Restricted
- Private
- Critical
- General data considerations
- Data states
- Data at rest
- Data in transit
- Data in use
- Data sovereignty
- Geolocation
- Methods to secure data
- Geographic restrictions
- Encryption
- Hashing
- Masking
- Tokenisation
- Obfuscation
- Segmentaion
- Permission restrictions
- Data types
- Regulated
- Trade secret
- Intellectual property
- Legal information
- Financial information
- Human-and non-human-readable
- Data classifications
- Sensitive
- Confidential
- Public
- Restricted
- Private
- Critical
- General data considerations
- Data states
- Data at rest
- Data in transit
- Data in use
- Data sovereignty
- Geolocation
- Methods to secure data
- Geographic restrictions
- Encryption
- Hashing
- Masking
- Tokenisation
- Obfuscation
- Segmentaion
- Permission restrictions
3.4 Explain the importance of resilience and recovery in security architecture.- high availability
- Load balancing vs clustering
- Site considerations
- Hot
- Cold
- Warm
- Geographic dispersion
- Platform diversity
- Multi-cloud systems
- Continuity of operations
- Capacity planning
- People
- Technology
- Infrastructure
- Testing
- Tabletop exercises
- Fail over
- Simulation
- Parallel processing
- Backups
- Onsite/offsite
- Frequency
- Encryption
- Snapshots
- Recovery
- Replication
- Journaling
- Power
- Generators
- Uninterruptible power supply (UPS)
- high availability
- Load balancing vs clustering
- Site considerations
- Hot
- Cold
- Warm
- Geographic dispersion
- Platform diversity
- Multi-cloud systems
- Continuity of operations
- Capacity planning
- People
- Technology
- Infrastructure
- Testing
- Tabletop exercises
- Fail over
- Simulation
- Parallel processing
- Backups
- Onsite/offsite
- Frequency
- Encryption
- Snapshots
- Recovery
- Replication
- Journaling
- Power
- Generators
- Uninterruptible power supply (UPS)
4.0 Security Operations
4.1 Given a scenario, apply common security techniques to computing resources.- Secure baselines
- Establish
- Deploy
- Maintain
- Hardening targets
- Mobile devices
- Workstations
- Switches
- Routers
- Cloud infrastructure
- Servers
- ICS/SCADA
- Embedded systems
- RTOS
- IoT devices
- Wireless devices
- Installation considerations
- Site surveys
- Heat maps
- Mobile solutions
- Mobile device management (MDM)
- Deployment models
- Bring your own device (BYOD)
- Corporate-owned, personally enabled (COPE)
- Choose your own device (CYOD)
- Connection methods
- Cellular
- Wi-Fi
- Bluetooth
- Wireless security settings
- Wi-Fi Protected Access 3 (WPA3)
- AAA/Remote Authentication Dial-In User Service (RADIUS)
- Cryptographic protocols
- Authentication protocols
- Application security
- Input validation
- Secure cookies
- Static code analysis
- Code signing
- Sandboxing
- Monitoring
4.2 Explain the security implications of proper hardware, software, and data asset management. - Acquisition/procurement process
- Assignment/accounting
- Ownership
- Classification
- Monitoring/asset tracking
- Inventory
- Enumeration
- Disposal/decommissioning
- Sanitisation
- Destruction
- Certification
- Data retention
4.3 Explain various activities associated with vulnerability management.- Identification methods
- Vulnerability scan
- Application security
- Static analysis
- Dynamic analysis
- Package monitoring
- Threat feed
- Open-source intelligence (OSINT)
- Proprietary/third-party
- Information-sharing organisation
- Dark web
- Penetration testing
- Responsible disclosure program
- Bug bounty program
- System/process audit
- Analysis
- Confirmation
- False positive
- False negative
- Prioritise
- Common Vulnerability Enumeration (CVE)
- Vulnerability classification
- Exposure factor
- Environmental variables
- Industry/organisational impact
- Risk tolerance
- Vulnerability response and remediation
- Patching
- Insurance
- Segmentation
- Compensating controls
- Exceptions and exemptions
- Validation of remediation
- Rescanning
- Audit
- Verification
- Reporting
4.4 Explain security alerting and monitoring concepts and tools.- Monitoring computing resources
- Systems
- Applications
- Infrastructure
- Activities
- Log aggregation
- Alerting
- Scanning
- Reporting
- Archiving
- Alert response and remediation/validation
- Quarantine
- Alert tuning
- Tools
- Security Content Automation Protocol (SCAP)
- Benchmarks
- Agents/agentless
- Security information and event management (SIEM)
- Antivirus
- Data loss prevention (DLP)
- Simple Network Management Protocol (SNMP) traps
- NetFlow
- Vulnerability scanners
4.5 Given a scenario, modify enterprise capabilities to enhance security. - Firewall
- Rules
- Access lists
- Ports/protocols
- Screened subnets
- IDS/IPS
- Trends
- Signatures
- Web filter
- Agent-based
- Centralised proxy
- Universal Resource Locator (URL) scanning
- Content categorisation
- Block rules
- Reputation
- Operating system security
- Group Policy
- SELinux
- Implementation of secure protocols
- Protocol selection
- Port selection
- Transport method
- DNS filtering
- Email security
- Domain-based Message Authentication Reporting and Conformance (DMARC)
- DomainKeys Identified Mail (DKIM)
- Sender Policy Framework (SPF)
- Gateway
- File Integrity Monitoring
- DLP
- Network access control (NAC)
- Endpoint detection and response (EDR)/extended detection and response (XDR)
- User behaviour analytics
4.6 Given a scenario, implement and maintain identity and access management.- Provisioning/de-provisioning user accounts
- Permission assignments and implications
- Identity proofing
- Federation
- Single sign-on (SSO)
- Lightweight Directory Access Protocol (LDAP)
- Open authorisation (OAuth)
- Security Assertions Markup Language (SAML)
- Interoperability
- Attestation
- Access controls
- Mandatory
- Discretionary
- Role-based
- Rule-based
- Attribute-based
- Time-of-day restrictions
- Least privilege
- Multifactor authentication
- Implementations
- Biometrics
- Hard/soft authentication tokens
- Security keys
- Factors
- Something you know
- Something you have
- Something you are
- Somewhere you are
- Password concepts
- Password best practices
- Length
- Complexity
- Reuse
- Expiration
- Age
- Password managers
- Passwordless
- Privilege access management tools
- Just-in-time permissions
- Password vaulting
- Ephemeral credentials
4.7 Explain the importance of automation and orchestration related to secure operations.- Use cases of automation and scripting
- User provisioning
- Resource provisioning
- Guard rails
- Security groups
- Ticket creation
- Escalation
- Enabling/disabling services and access
- Continuous integration and testing
- Integrations and Application programming interfaces (APIs)
- Benefits
- Efficiency/time saving
- Enforcing baselines
- Standard infrastructure configurations
- Scaling in a secure manner
- Employee retention
- Reaction time
- Workforce multiplier
- Other considerations
- Complexity
- Cost
- Single point of failure
- Technical debt
- Ongoing supportability
4.8 Explain appropriate incident response activities. - Process
- Preparation
- Detection
- Analysis
- Containment
- Eradication
- Recovery
- Lessons learned
- Training
- Testing
- Tabletop exercise
- Simulation
- Root cause analysis
- Threat hunting
- Digital forensics
- Legal hold
- Chain of custody
- Acquisition
- Reporting
- Preservation
- E-discovery
4.9 Given a scenario, use data sources to support an investigation. - Log data
- Firewall logs
- Application logs
- Endpoint logs
- OS-specific security logs
- IPS/IDS logs
- Network logs
- Metadata
- Data resources
- Vulnerability scans
- Automated reports
- Dashboards
- Packet captures
- Secure baselines
- Establish
- Deploy
- Maintain
- Hardening targets
- Mobile devices
- Workstations
- Switches
- Routers
- Cloud infrastructure
- Servers
- ICS/SCADA
- Embedded systems
- RTOS
- IoT devices
- Wireless devices
- Installation considerations
- Site surveys
- Heat maps
- Mobile solutions
- Mobile device management (MDM)
- Deployment models
- Bring your own device (BYOD)
- Corporate-owned, personally enabled (COPE)
- Choose your own device (CYOD)
- Connection methods
- Cellular
- Wi-Fi
- Bluetooth
- Wireless security settings
- Wi-Fi Protected Access 3 (WPA3)
- AAA/Remote Authentication Dial-In User Service (RADIUS)
- Cryptographic protocols
- Authentication protocols
- Application security
- Input validation
- Secure cookies
- Static code analysis
- Code signing
- Sandboxing
- Monitoring
4.2 Explain the security implications of proper hardware, software, and data asset management.
- Acquisition/procurement process
- Assignment/accounting
- Ownership
- Classification
- Monitoring/asset tracking
- Inventory
- Enumeration
- Disposal/decommissioning
- Sanitisation
- Destruction
- Certification
- Data retention
4.3 Explain various activities associated with vulnerability management.
- Identification methods
- Vulnerability scan
- Application security
- Static analysis
- Dynamic analysis
- Package monitoring
- Threat feed
- Open-source intelligence (OSINT)
- Proprietary/third-party
- Information-sharing organisation
- Dark web
- Penetration testing
- Responsible disclosure program
- Bug bounty program
- System/process audit
- Analysis
- Confirmation
- False positive
- False negative
- Prioritise
- Common Vulnerability Enumeration (CVE)
- Vulnerability classification
- Exposure factor
- Environmental variables
- Industry/organisational impact
- Risk tolerance
- Vulnerability response and remediation
- Patching
- Insurance
- Segmentation
- Compensating controls
- Exceptions and exemptions
- Validation of remediation
- Rescanning
- Audit
- Verification
- Reporting
4.4 Explain security alerting and monitoring concepts and tools.
- Monitoring computing resources
- Systems
- Applications
- Infrastructure
- Activities
- Log aggregation
- Alerting
- Scanning
- Reporting
- Archiving
- Alert response and remediation/validation
- Quarantine
- Alert tuning
- Tools
- Security Content Automation Protocol (SCAP)
- Benchmarks
- Agents/agentless
- Security information and event management (SIEM)
- Antivirus
- Data loss prevention (DLP)
- Simple Network Management Protocol (SNMP) traps
- NetFlow
- Vulnerability scanners
4.5 Given a scenario, modify enterprise capabilities to enhance security.
- Firewall
- Rules
- Access lists
- Ports/protocols
- Screened subnets
- IDS/IPS
- Trends
- Signatures
- Web filter
- Agent-based
- Centralised proxy
- Universal Resource Locator (URL) scanning
- Content categorisation
- Block rules
- Reputation
- Operating system security
- Group Policy
- SELinux
- Implementation of secure protocols
- Protocol selection
- Port selection
- Transport method
- DNS filtering
- Email security
- Domain-based Message Authentication Reporting and Conformance (DMARC)
- DomainKeys Identified Mail (DKIM)
- Sender Policy Framework (SPF)
- Gateway
- File Integrity Monitoring
- DLP
- Network access control (NAC)
- Endpoint detection and response (EDR)/extended detection and response (XDR)
- User behaviour analytics
4.6 Given a scenario, implement and maintain identity and access management.
- Provisioning/de-provisioning user accounts
- Permission assignments and implications
- Identity proofing
- Federation
- Single sign-on (SSO)
- Lightweight Directory Access Protocol (LDAP)
- Open authorisation (OAuth)
- Security Assertions Markup Language (SAML)
- Interoperability
- Attestation
- Access controls
- Mandatory
- Discretionary
- Role-based
- Rule-based
- Attribute-based
- Time-of-day restrictions
- Least privilege
- Multifactor authentication
- Implementations
- Biometrics
- Hard/soft authentication tokens
- Security keys
- Factors
- Something you know
- Something you have
- Something you are
- Somewhere you are
- Password concepts
- Password best practices
- Length
- Complexity
- Reuse
- Expiration
- Age
- Password managers
- Passwordless
- Privilege access management tools
- Just-in-time permissions
- Password vaulting
- Ephemeral credentials
4.7 Explain the importance of automation and orchestration related to secure operations.
- Use cases of automation and scripting
- User provisioning
- Resource provisioning
- Guard rails
- Security groups
- Ticket creation
- Escalation
- Enabling/disabling services and access
- Continuous integration and testing
- Integrations and Application programming interfaces (APIs)
- Benefits
- Efficiency/time saving
- Enforcing baselines
- Standard infrastructure configurations
- Scaling in a secure manner
- Employee retention
- Reaction time
- Workforce multiplier
- Other considerations
- Complexity
- Cost
- Single point of failure
- Technical debt
- Ongoing supportability
4.8 Explain appropriate incident response activities.
- Process
- Preparation
- Detection
- Analysis
- Containment
- Eradication
- Recovery
- Lessons learned
- Training
- Testing
- Tabletop exercise
- Simulation
- Root cause analysis
- Threat hunting
- Digital forensics
- Legal hold
- Chain of custody
- Acquisition
- Reporting
- Preservation
- E-discovery
4.9 Given a scenario, use data sources to support an investigation.
- Log data
- Firewall logs
- Application logs
- Endpoint logs
- OS-specific security logs
- IPS/IDS logs
- Network logs
- Metadata
- Data resources
- Vulnerability scans
- Automated reports
- Dashboards
- Packet captures
5.0 Security Program Management and Oversight
5.1 Summarise elements of effective security governance.- Guidelines
- Policies
- Acceptable use policy (AUP)
- Information security policies
- Business continuity
- Disaster recovery
- Incident response
- Software development lifecycle (SDLC)
- Change management
- Standards
- Passwords
- Access control
- Physical security
- Encryption
- Procedures
- Change management
- Onboarding/offboarding
- Playbooks
- External considerations
- Regulatory
- Legal
- Industry
- Local/regional
- National
- Global
- Monitoring and revision
- Types of governance structures
- Boards
- Committees
- Government entities
- Centralised/decentralised
- Roles and responsibilities for systems and data
- Owners
- Controllers
- Processors
- Custodians/stewards
- Guidelines
- Policies
- Acceptable use policy (AUP)
- Information security policies
- Business continuity
- Disaster recovery
- Incident response
- Software development lifecycle (SDLC)
- Change management
- Standards
- Passwords
- Access control
- Physical security
- Encryption
- Procedures
- Change management
- Onboarding/offboarding
- Playbooks
- External considerations
- Regulatory
- Legal
- Industry
- Local/regional
- National
- Global
- Monitoring and revision
- Types of governance structures
- Boards
- Committees
- Government entities
- Centralised/decentralised
- Roles and responsibilities for systems and data
- Owners
- Controllers
- Processors
- Custodians/stewards
5.2 Explain elements of the risk management process.- Risk Identification
- Risk assessment
- Ad hoc
- Recurring
- One-time
- Continuous
- Risk analysis
- Qualitative
- Quantitative
- Single loss expectancy (SLE)
- Annualised loss expectancy (ALE)
- Annualised rate of occurence (ARO)
- Probability
- Likelihood
- Exposure factor
- impact
- Risk register
- Key risk indicators
- Risk owners
- Risk threshold
- Risk tolerance
- Risk appetite
- Expansionary
- Conservative
- Neutral
- Risk management strategies
- Transfer
- Accept
- Exemption
- Exception
- Avoid
- Mitigate
- Risk reporting
- Business impact analysis
- Recovery time objective (RTO)
- Recovery point objective (RPO)
- Mean time to repair (MTTR)
- Mean time between failures (MTBF)
- Risk Identification
- Risk assessment
- Ad hoc
- Recurring
- One-time
- Continuous
- Risk analysis
- Qualitative
- Quantitative
- Single loss expectancy (SLE)
- Annualised loss expectancy (ALE)
- Annualised rate of occurence (ARO)
- Probability
- Likelihood
- Exposure factor
- impact
- Risk register
- Key risk indicators
- Risk owners
- Risk threshold
- Risk tolerance
- Risk appetite
- Expansionary
- Conservative
- Neutral
- Risk management strategies
- Transfer
- Accept
- Exemption
- Exception
- Avoid
- Mitigate
- Risk reporting
- Business impact analysis
- Recovery time objective (RTO)
- Recovery point objective (RPO)
- Mean time to repair (MTTR)
- Mean time between failures (MTBF)
Comments
Post a Comment