Threat Intelligence & Actors 22% of Exam

• Nation-State — Most sophisticated, APT, long dwell time, geopolitical goals
• Hacktivists — Ideology-driven; DDoS, defacement
• Insider Threat — Malicious or unintentional; hardest to detect
• Script Kiddies — Low skill; use tools they don't understand
• Organized Crime — Financial motivation; ransomware, fraud
• APT — Advanced Persistent Threat — slow, stealthy, targeted
• IOC — Indicator of Compromise — evidence of breach (IP, hash, domain)
• TTP — Tactics, Techniques, Procedures — how attackers operate
• ISAC — Industry-specific threat sharing organization
• OSINT — Open Source Intelligence — publicly available info

Vulnerability Management

• CVE — Common Vulnerabilities and Exposures — unique ID for known vulns
• CVSS — Common Vulnerability Scoring System — 0–10 severity score
• NVD — National Vulnerability Database — NIST-maintained CVE database
• Zero-day — Vulnerability unknown to vendor; no patch exists
• Patch management — Identify → Test → Deploy → Verify cycle
• Credentialed scan — Authenticated; deeper, more accurate results
• Uncredentialed scan — External view; what an attacker sees
• False positive — Scanner reports vuln that doesn't exist
• False negative — Scanner misses real vulnerability (worse!)

Penetration Testing Phases

• Planning/Scoping — Define rules of engagement, scope, objectives
• Reconnaissance (OSINT) — Passive info gathering; no direct contact
• Scanning/Enumeration — Active scanning; identify open ports/services
• Exploitation — Attempt to compromise vulnerabilities found
• Post-Exploitation — Pivoting, privilege escalation, persistence
• Reporting — Document findings, risk ratings, remediation
• White box — Tester has full knowledge of environment
• Black box — No prior knowledge (simulates real attacker)
• Gray box — Partial knowledge (most common)

Network Security Architecture 18% of Exam

• DMZ — Demilitarized Zone — semi-trusted network for public-facing servers
• Segmentation — Divide network into zones to limit lateral movement
• VLAN — Virtual LAN — logical segmentation at Layer 2
• Microsegmentation — Fine-grained segmentation down to workload level (Zero Trust)
• Zero Trust — Never trust, always verify; no implicit trust by location
• SD-WAN — Software-defined WAN — centralized WAN management
• SASE — Secure Access Service Edge — cloud-delivered network security

Firewall Types

• Packet Filter — Layer 3/4; stateless; checks headers only
• Stateful Inspection — Tracks connection state; more secure than packet filter
• NGFW — Next-Gen Firewall — Layer 7 inspection, IPS, SSL inspection, app awareness
• WAF — Web Application Firewall — protects HTTP/S applications (SQLi, XSS)
• UTM — Unified Threat Management — all-in-one: FW + IPS + AV + proxy

Cloud Security

• Shared Responsibility — Provider secures infrastructure; you secure data/access
• CASB — Cloud Access Security Broker — visibility and control of cloud apps
• CSP — Cloud Service Provider (AWS, Azure, GCP)

Security Operations 28% of Exam

• SIEM — Security Info & Event Management — aggregate, correlate, alert on logs
• SOAR — Security Orchestration, Automation & Response — automate IR workflows
• EDR — Endpoint Detection & Response — behavioral endpoint monitoring
• XDR — Extended Detection & Response — cross-layer (endpoint + network + cloud)
• NDR — Network Detection & Response — analyze network traffic for threats
• IDS — Intrusion Detection System — alerts only, does not block
• IPS — Intrusion Prevention System — actively blocks threats inline
• HIDS/HIPS — Host-based — on the endpoint itself
• NIDS/NIPS — Network-based — monitor network traffic

Log Management & Monitoring

• Log aggregation — Centralize logs from all sources into SIEM
• Log retention — How long logs are kept (regulatory requirement)
• NTP sync — Critical! Ensures log timestamps are accurate for correlation
• Syslog — Standard protocol for log forwarding (port 514 UDP)
• NetFlow — Cisco protocol capturing network traffic metadata
• Baseline — Normal behavior profile used to detect anomalies
• UEBA — User & Entity Behavior Analytics — detect insider threats via anomalies

Digital Forensics Principles

• Order of Volatility — CPU cache → RAM → Swap → Disk → Remote logs → Backup
• Chain of Custody — Document who handled evidence and when
• Legal hold — Preserve all potentially relevant data
• Forensic copy — Bit-for-bit image of drive (dd, FTK Imager)
• Write blocker — Prevent any writes to source media
• Hash verification — MD5/SHA-256 proves copy matches original
• Steganography — Hiding data within other data (images, audio)

Risk Management 20% of Exam

• Risk = Threat × Vulnerability × Impact
• Threat — Potential cause of harm
• Vulnerability — Weakness that can be exploited
• Likelihood — Probability of threat exploitation
• Impact — Magnitude of damage if exploited
• Inherent risk — Risk before controls applied
• Residual risk — Risk remaining after controls
• Risk appetite — Amount of risk org is willing to accept

Risk Treatment Options:

• Avoid — Eliminate the activity creating the risk
• Mitigate — Apply controls to reduce likelihood/impact
• Transfer — Shift risk to third party (insurance, contracts)
• Accept — Acknowledge risk and do nothing (low risk)

Business Continuity & Disaster Recovery

• BCP — Business Continuity Plan — keep business running during disruption
• DRP — Disaster Recovery Plan — restore IT systems after disaster
• RTO — Recovery Time Objective — max acceptable downtime
• RPO — Recovery Point Objective — max acceptable data loss (time)
• MTTR — Mean Time to Repair — average repair time
• MTBF — Mean Time Between Failures — average uptime
• Hot site — Fully operational duplicate; failover in minutes
• Warm site — Partial equipment; recovery in hours/days
• Cold site — Space only; recovery in days/weeks
• Tabletop exercise — Discussion-based DR simulation
• Parallel test — Both systems run simultaneously
• Failover test — Actually switch to DR site

Data Classifications & Privacy

• Top Secret → Secret → Confidential → Unclassified (government)
• Restricted → Confidential → Internal → Public (corporate)
• PII — Personally Identifiable Information
• PHI — Protected Health Information (HIPAA)
• Data at rest — Stored data (encrypt with AES)
• Data in transit — Moving data (encrypt with TLS)
• Data in use — Being processed (encrypt with trusted execution env)
• DLP — Data Loss Prevention — prevents unauthorized data exfil
• Tokenization — Replace sensitive data with non-sensitive token
• Data masking — Obfuscate data for non-production use