CISMP (Certificate in Information Security Management Principles) Technical Security Controls Syllabus

Technical Security Controls syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Technical Security Controls in CISMP (Certificate in Information Security Management Principles), not a summary of it.

1. 1

   Protection from Malicious Software

   3 topics

   • Types of malware
     • Viruses, worms and trojans
     • Ransomware and spyware
   • Anti-malware controls
     • Detection and prevention technologies
     • Patch and update management
   • Defence in depth
     • Layered control strategy
2. 2

   Networks and Communications Security

   4 topics

   • Network security architecture
     • Segmentation and DMZ
     • Firewalls and gateways
   • Intrusion detection and prevention
     • IDS and IPS concepts
   • Secure remote access
     • VPNs and secure tunnelling
     • Wireless network security
   • Securing emerging technologies
     • Cloud computing security
     • Mobile and BYOD
     • Internet of Things
3. 3

   Cryptography

   4 topics

   • Cryptographic concepts
     • Symmetric encryption
     • Asymmetric (public key) encryption
     • Hashing and integrity
   • Key management
     • Key lifecycle and storage
   • Public Key Infrastructure and digital signatures
     • Certificates and certificate authorities
     • Digital signatures and non-repudiation
   • Applications of cryptography
     • Encryption at rest and in transit
4. 4

   System and Software Security

   4 topics

   • Secure system configuration
     • Hardening and baselines
     • Secure default settings
   • Secure software development
     • Security in the development lifecycle
     • Common application vulnerabilities
   • Change and configuration management
     • Controlling changes to operational systems
   • Monitoring and logging
     • Audit trails and log management

Technical Security Controls flashcards for CISMP (Certificate in Information Security Management Principles)

20 of 73 cards from the Technical Security Controls deck — real questions with worked answers.

1. What is malware?

   Malware (malicious software) is any software intentionally designed to cause damage, disrupt operations, gain unauthorised access, or otherwise harm a computer, server, network, or user data.

2. Distinguish between a computer virus and a worm.

   A virus attaches itself to a host file or program and requires user action (e.g. running the file) to execute and spread. A worm is self-replicating and self-propagating across networks without needing a host file or user interaction.

3. What is a Trojan (Trojan horse) in the context of malware?

   Malware disguised as legitimate or desirable software that, once executed by the user, performs hidden malicious actions such as opening a backdoor, stealing data, or downloading further payloads. It does not self-replicate.

4. What is ransomware and what are its two main types?

   Ransomware encrypts or locks a victim's data/system and demands payment for recovery. The two main types are crypto ransomware (encrypts files) and locker ransomware (locks access to the device/screen).

5. Define a rootkit and explain why it is dangerous.

   A rootkit is malware designed to gain privileged (root/administrator) access while hiding its presence and that of other malware, often at the kernel level. It is dangerous because it subverts the OS, making detection and removal very difficult.

6. What is spyware, and how does a keylogger relate to it?

   Spyware covertly gathers information about a user/system and sends it to a third party. A keylogger is a type of spyware that records keystrokes to capture passwords, card numbers, and other sensitive input.

7. What distinguishes a botnet and what is a 'bot' or 'zombie'?

   A botnet is a network of compromised computers (bots/zombies) controlled remotely by an attacker via a command-and-control (C2) server, commonly used for DDoS attacks, spam, or credential harvesting.

8. What is fileless malware?

   Malware that operates in memory and leverages legitimate system tools (e.g. PowerShell, WMI) rather than writing executable files to disk, making it harder for traditional signature-based antivirus to detect.

9. What is a logic bomb?

   Malicious code embedded in a system that lies dormant until triggered by a specific condition or event (e.g. a date, a user being removed from payroll), at which point it executes its payload.

10. Contrast signature-based and heuristic/behavioural anti-malware detection.

    Signature-based detection matches files against a database of known malware signatures (effective for known threats only). Heuristic/behavioural detection analyses code behaviour and characteristics to detect new, unknown, or polymorphic malware (zero-day capable).

11. Why must anti-malware signature definitions be kept up to date?

    Because signature-based detection can only identify malware whose signatures are in its database; without regular updates the scanner cannot recognise newly released threats, leaving the system exposed.

12. What is sandboxing as an anti-malware control?

    Executing suspicious files or code in an isolated, controlled environment (a sandbox) to observe their behaviour safely without risking the production system, used to detect unknown/zero-day malware.

13. List four practical controls (besides anti-malware software) that reduce malware risk.

    Patch/update management, user security awareness training, application allow-listing (whitelisting), least-privilege access, email/web filtering, and regular tested backups (any four).

14. Define 'defence in depth' as a security principle.

    A layered security strategy that applies multiple, overlapping controls (physical, technical, administrative) so that if one control fails or is bypassed, others continue to provide protection. Also called the castle approach.

15. How does defence in depth differ from a single 'perimeter' security model?

    A perimeter model relies on one strong boundary (hard shell, soft centre); once breached, the interior is exposed. Defence in depth assumes any single layer can fail and provides successive independent layers of protection throughout the system.

16. What is the principle of 'least privilege'?

    Granting users, processes, and systems only the minimum access rights and permissions necessary to perform their legitimate function, and no more, to limit the impact of compromise or misuse.

17. What is the purpose of network segmentation / zoning?

    Dividing a network into separate zones/segments (e.g. by trust level or function) to contain breaches, limit lateral movement, control traffic flow between zones, and apply zone-appropriate controls.

18. What is a DMZ (demilitarised zone) in network architecture?

    A perimeter network segment that sits between the untrusted external network (Internet) and the trusted internal network, hosting public-facing services (e.g. web, mail) so external users never directly access the internal LAN.

19. Compare a stateless packet-filtering firewall with a stateful inspection firewall.

    A stateless packet filter examines each packet independently against rules (source/dest IP, port, protocol). A stateful firewall tracks the state of active connections and allows packets only if they belong to a valid established session, providing stronger control.

20. What is an application-layer (proxy) firewall?

    A firewall operating at OSI Layer 7 that inspects the content of application traffic (e.g. HTTP), acting as an intermediary (proxy) between client and server, enabling deep content filtering and hiding internal hosts.

See more Technical Security Controls flashcards →

Planning Technical Security Controls for CISMP (Certificate in Information Security Management Principles)

Technical Security Controls (CISMP (Certificate in Information Security Management Principles)) FAQ