Cybersecurity Security Fundamentals and Governance Syllabus

Security Fundamentals and Governance syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Security Fundamentals and Governance in Cybersecurity, not a summary of it.

1. 1

   Core Security Concepts

   5 topics

   • CIA Triad
   • Authentication, Authorization, and Accounting (AAA)
   • Non-repudiation
   • Defense in Depth and Layered Security
   • Zero Trust Architecture
2. 2

   Security Controls

   3 topics

   • Control Categories
   • Control Types
   • Least Privilege and Separation of Duties
3. 3

   Risk Management

   4 topics

   • Risk Assessment and Analysis
   • Risk Treatment Strategies
   • Business Impact Analysis
   • Risk Register and Risk Appetite
4. 4

   Governance, Compliance, and Frameworks

   4 topics

   • Security Policies, Standards, and Procedures
   • NIST Cybersecurity Framework
   • ISO/IEC 27001 and 27002
   • Regulations and Privacy Laws
5. 5

   Identity and Access Management

   4 topics

   • Authentication Factors and MFA
   • Access Control Models
   • Single Sign-On and Federation
   • Privileged Access Management
6. 6

   Security Awareness and Professional Ethics

   3 topics

   • Security Awareness Training
   • Acceptable Use and BYOD Policies
   • Code of Ethics and Legal Considerations

Security Fundamentals and Governance flashcards for Cybersecurity

25 of 51 cards from the Security Fundamentals and Governance deck — real questions with worked answers.

1. What three properties make up the CIA Triad in information security?

   Confidentiality (preventing unauthorized disclosure), Integrity (preventing unauthorized modification), and Availability (ensuring authorized access when needed).

2. In the CIA Triad, which property is directly protected by encryption, and which is protected by hashing?

   Encryption primarily protects Confidentiality; hashing (message digests) primarily protects Integrity by detecting modification.

3. What does the AAA framework stand for in security?

   Authentication (verifying identity), Authorization (granting rights/permissions), and Accounting (logging and auditing activity).

4. In AAA, distinguish Authentication from Authorization.

   Authentication confirms who you are (identity verification); Authorization determines what you are permitted to do (access rights) after identity is established.

5. What is non-repudiation and what mechanism typically provides it?

   Non-repudiation ensures a party cannot deny having performed an action or sent a message. It is provided mainly by digital signatures (and supported by audit logs).

6. Define the security principle of Defense in Depth.

   Layering multiple independent, overlapping security controls so that if one control fails, others still protect the asset. Also called layered security.

7. What is the core assumption of Zero Trust Architecture?

   Never trust, always verify: no user, device, or network is trusted by default, even inside the perimeter. Every access request must be authenticated, authorized, and continuously validated.

8. In Zero Trust, what are the two logical planes described by NIST SP 800-207?

   The Policy Decision Point / control plane (Policy Engine + Policy Administrator making access decisions) and the Policy Enforcement Point / data plane (enforcing the decision on the connection).

9. Name the three main security control categories (by nature/implementation).

   Technical (technological, e.g. firewalls, encryption), Managerial/Administrative (policies, risk assessments), and Physical/Operational (locks, guards, fences).

10. List the six common security control TYPES by function.

    Preventive, Detective, Corrective, Deterrent, Compensating, and Directive.

11. Give an example of a Detective control versus a Preventive control.

    Detective: IDS, security cameras, audit logs (identify an incident). Preventive: firewalls, locks, encryption (stop an incident before it happens).

12. What is a Compensating control?

    An alternative control put in place when the primary/required control cannot be implemented, providing a comparable level of protection (e.g., extra monitoring when patching isn't possible).

13. Define the principle of Least Privilege.

    Users, processes, and systems should be granted only the minimum access rights necessary to perform their legitimate function, and no more.

14. Define Separation of Duties and its primary purpose.

    Dividing a critical task among multiple people so no single individual can complete it alone. Its purpose is to prevent fraud and error by requiring collusion to abuse the process.

15. What is the difference between qualitative and quantitative risk analysis?

    Qualitative uses subjective ratings (e.g., high/medium/low) based on judgment; quantitative assigns numerical/monetary values (e.g., SLE, ALE) to risk.

16. State the formula for Single Loss Expectancy (SLE).

    $$SLE = AV \times EF$$ where $AV$ is asset value and $EF$ is the exposure factor (percentage of asset lost in one incident).

17. State the formula for Annualized Loss Expectancy (ALE).

    $$ALE = SLE \times ARO$$ where $SLE$ is single loss expectancy and $ARO$ is the annualized rate of occurrence.

18. An asset worth \$200,000 has an exposure factor of 25% and an ARO of 2. Calculate the ALE.

    $SLE = 200000 \times 0.25 = 50000$; $ALE = 50000 \times 2 = 100000$. The ALE is $\$100{,}000$.

19. In risk terms, what is the general conceptual relationship for risk?

    $$Risk = Threat \times Vulnerability \times Impact$$ (risk arises when a threat exploits a vulnerability, weighted by impact/likelihood).

20. Name the four main risk treatment (response) strategies.

    Avoid (eliminate the risk activity), Transfer/Share (e.g., insurance, outsourcing), Mitigate/Reduce (apply controls), and Accept (retain the risk).

21. What is residual risk?

    The risk that remains after security controls and treatments have been applied. It is the leftover risk the organization must accept or address further.

22. Distinguish inherent risk from residual risk.

    Inherent risk is the risk level before any controls are applied; residual risk is what remains after controls are in place.

23. What is Business Impact Analysis (BIA)?

    A process that identifies critical business functions and analyzes the operational and financial impact of their disruption, to prioritize recovery.

24. Define RTO and RPO as used in a BIA.

    RTO (Recovery Time Objective): the maximum acceptable time to restore a function after disruption. RPO (Recovery Point Objective): the maximum acceptable amount of data loss measured in time.

25. What do MTD, MTTR, and MTBF measure in continuity/BIA planning?

    MTD: Maximum Tolerable Downtime a function can be unavailable. MTTR: Mean Time To Repair/Recover. MTBF: Mean Time Between Failures (reliability).

See more Security Fundamentals and Governance flashcards →

Planning Security Fundamentals and Governance for Cybersecurity

Security Fundamentals and Governance (Cybersecurity) FAQ