Examius

🌍 Cybersecurity · subject

Cybersecurity Security Fundamentals and Governance Syllabus

The Security Fundamentals and Governance syllabus for Cybersecurity in full: 6 chapters and 23 topics, every one listed below, plus 51 Security Fundamentals and Governance flashcards with answers.

6Chapters
23Topics
51Flashcards

Security Fundamentals and Governance syllabus: all 6 chapters

Expand any chapter to see its topics and sub-topics.

  1. Core Security Concepts

     5 topics
    • CIA Triad
    • Authentication, Authorization, and Accounting (AAA)
    • Non-repudiation
    • Defense in Depth and Layered Security
    • Zero Trust Architecture

  2. Security Controls

     3 topics
    • Control Categories
    • Control Types
    • Least Privilege and Separation of Duties

  3. Risk Management

     4 topics
    • Risk Assessment and Analysis
    • Risk Treatment Strategies
    • Business Impact Analysis
    • Risk Register and Risk Appetite

  4. Governance, Compliance, and Frameworks

     4 topics
    • Security Policies, Standards, and Procedures
    • NIST Cybersecurity Framework
    • ISO/IEC 27001 and 27002
    • Regulations and Privacy Laws

  5. Identity and Access Management

     4 topics
    • Authentication Factors and MFA
    • Access Control Models
    • Single Sign-On and Federation
    • Privileged Access Management

  6. Security Awareness and Professional Ethics

     3 topics
    • Security Awareness Training
    • Acceptable Use and BYOD Policies
    • Code of Ethics and Legal Considerations

Cybersecurity Security Fundamentals and Governance flashcards — 51 questions with answers

  1. What three properties make up the CIA Triad in information security?

    Confidentiality (preventing unauthorized disclosure), Integrity (preventing unauthorized modification), and Availability (ensuring authorized access when needed).

  2. In the CIA Triad, which property is directly protected by encryption, and which is protected by hashing?

    Encryption primarily protects Confidentiality; hashing (message digests) primarily protects Integrity by detecting modification.

  3. What does the AAA framework stand for in security?

    Authentication (verifying identity), Authorization (granting rights/permissions), and Accounting (logging and auditing activity).

  4. In AAA, distinguish Authentication from Authorization.

    Authentication confirms who you are (identity verification); Authorization determines what you are permitted to do (access rights) after identity is established.

  5. What is non-repudiation and what mechanism typically provides it?

    Non-repudiation ensures a party cannot deny having performed an action or sent a message. It is provided mainly by digital signatures (and supported by audit logs).

  6. Define the security principle of Defense in Depth.

    Layering multiple independent, overlapping security controls so that if one control fails, others still protect the asset. Also called layered security.

  7. What is the core assumption of Zero Trust Architecture?

    Never trust, always verify: no user, device, or network is trusted by default, even inside the perimeter. Every access request must be authenticated, authorized, and continuously validated.

  8. In Zero Trust, what are the two logical planes described by NIST SP 800-207?

    The Policy Decision Point / control plane (Policy Engine + Policy Administrator making access decisions) and the Policy Enforcement Point / data plane (enforcing the decision on the connection).

  9. Name the three main security control categories (by nature/implementation).

    Technical (technological, e.g. firewalls, encryption), Managerial/Administrative (policies, risk assessments), and Physical/Operational (locks, guards, fences).

  10. List the six common security control TYPES by function.

    Preventive, Detective, Corrective, Deterrent, Compensating, and Directive.

  11. Give an example of a Detective control versus a Preventive control.

    Detective: IDS, security cameras, audit logs (identify an incident). Preventive: firewalls, locks, encryption (stop an incident before it happens).

  12. What is a Compensating control?

    An alternative control put in place when the primary/required control cannot be implemented, providing a comparable level of protection (e.g., extra monitoring when patching isn't possible).

  13. Define the principle of Least Privilege.

    Users, processes, and systems should be granted only the minimum access rights necessary to perform their legitimate function, and no more.

  14. Define Separation of Duties and its primary purpose.

    Dividing a critical task among multiple people so no single individual can complete it alone. Its purpose is to prevent fraud and error by requiring collusion to abuse the process.

  15. What is the difference between qualitative and quantitative risk analysis?

    Qualitative uses subjective ratings (e.g., high/medium/low) based on judgment; quantitative assigns numerical/monetary values (e.g., SLE, ALE) to risk.

  16. State the formula for Single Loss Expectancy (SLE).

    $$SLE = AV \times EF$$ where $AV$ is asset value and $EF$ is the exposure factor (percentage of asset lost in one incident).

  17. State the formula for Annualized Loss Expectancy (ALE).

    $$ALE = SLE \times ARO$$ where $SLE$ is single loss expectancy and $ARO$ is the annualized rate of occurrence.

  18. An asset worth \$200,000 has an exposure factor of 25% and an ARO of 2. Calculate the ALE.

    $SLE = 200000 \times 0.25 = 50000$; $ALE = 50000 \times 2 = 100000$. The ALE is $\$100{,}000$.

  19. In risk terms, what is the general conceptual relationship for risk?

    $$Risk = Threat \times Vulnerability \times Impact$$ (risk arises when a threat exploits a vulnerability, weighted by impact/likelihood).

  20. Name the four main risk treatment (response) strategies.

    Avoid (eliminate the risk activity), Transfer/Share (e.g., insurance, outsourcing), Mitigate/Reduce (apply controls), and Accept (retain the risk).

Show the other 31 Security Fundamentals and Governance flashcards

  1. What is residual risk?

    The risk that remains after security controls and treatments have been applied. It is the leftover risk the organization must accept or address further.

  2. Distinguish inherent risk from residual risk.

    Inherent risk is the risk level before any controls are applied; residual risk is what remains after controls are in place.

  3. What is Business Impact Analysis (BIA)?

    A process that identifies critical business functions and analyzes the operational and financial impact of their disruption, to prioritize recovery.

  4. Define RTO and RPO as used in a BIA.

    RTO (Recovery Time Objective): the maximum acceptable time to restore a function after disruption. RPO (Recovery Point Objective): the maximum acceptable amount of data loss measured in time.

  5. What do MTD, MTTR, and MTBF measure in continuity/BIA planning?

    MTD: Maximum Tolerable Downtime a function can be unavailable. MTTR: Mean Time To Repair/Recover. MTBF: Mean Time Between Failures (reliability).

  6. What is a risk register?

    A documented repository that records identified risks along with their descriptions, likelihood, impact, owners, treatment plans, and current status.

  7. Define risk appetite versus risk tolerance.

    Risk appetite is the broad amount of risk an organization is willing to accept in pursuit of its objectives; risk tolerance is the acceptable variation/threshold around a specific risk.

  8. Differentiate a policy, a standard, and a procedure.

    Policy: high-level management statement of intent (the 'why/what'). Standard: mandatory specific requirement supporting the policy. Procedure: detailed step-by-step instructions (the 'how').

  9. How does a guideline differ from a standard?

    A standard is mandatory and enforceable; a guideline is a recommended, optional best-practice suggestion that is not compulsory.

  10. Name the five core Functions of the NIST Cybersecurity Framework (CSF 1.1).

    Identify, Protect, Detect, Respond, and Recover.

  11. What additional core Function was added in NIST CSF 2.0 and what does it address?

    Govern (GV), which addresses organizational cybersecurity governance, strategy, roles, policy, and risk management oversight across the other functions.

  12. What are the three components/tiers of the NIST CSF structure?

    The Framework Core (functions/categories/subcategories), the Implementation Tiers (1 Partial to 4 Adaptive), and Profiles (current vs. target state).

  13. What is ISO/IEC 27001?

    An international standard specifying requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS); it is certifiable.

  14. How does ISO/IEC 27002 differ from ISO/IEC 27001?

    27001 states the mandatory ISMS requirements and is certifiable; 27002 is a guidance document providing a code of practice / catalog of information security controls (not certifiable itself).

  15. What management model underlies the ISO 27001 ISMS?

    The Plan-Do-Check-Act (PDCA) continual improvement cycle.

  16. What does GDPR regulate and who does it protect?

    The EU General Data Protection Regulation governs the processing of personal data and protects the privacy rights of EU/EEA data subjects, applying to any organization handling their data.

  17. Match these regulations to their domain: HIPAA, PCI DSS, SOX.

    HIPAA: protected health information (US healthcare). PCI DSS: payment card/cardholder data (industry standard). SOX (Sarbanes-Oxley): financial reporting integrity for public companies.

  18. What US law governs the privacy of consumer data in California and grants opt-out of data sale?

    The CCPA (California Consumer Privacy Act), as amended by the CPRA.

  19. Name the three categories of authentication factors.

    Something you know (knowledge, e.g., password), something you have (possession, e.g., token/phone), and something you are (inherence, e.g., biometric).

  20. Beyond the three classic factors, what two additional authentication factors are often cited?

    Somewhere you are (location) and something you do (behavioral, e.g., typing pattern/gait).

  21. What distinguishes true Multi-Factor Authentication (MFA) from two-step verification using two passwords?

    True MFA requires factors from two or more DIFFERENT categories (e.g., password + fingerprint). Two passwords are the same category (knowledge), so they do not constitute MFA.

  22. In biometrics, what are FAR, FRR, and CER?

    FAR (False Acceptance Rate): unauthorized users wrongly accepted. FRR (False Rejection Rate): authorized users wrongly rejected. CER (Crossover Error Rate): the point where FAR equals FRR, indicating overall accuracy (lower is better).

  23. Describe the DAC (Discretionary Access Control) model.

    Access is set at the discretion of the resource owner, who grants permissions to other users (e.g., typical file permissions/ACLs). Owner-controlled and flexible.

  24. Describe the MAC (Mandatory Access Control) model.

    Access is enforced by the system based on security labels/clearances and classifications (e.g., Top Secret, Secret). Users cannot alter permissions; common in military/high-security environments.

  25. Describe the RBAC (Role-Based Access Control) model.

    Access is assigned to roles based on job function, and users inherit permissions by being assigned to roles rather than being granted access individually.

  26. How does ABAC (Attribute-Based Access Control) determine access?

    Access decisions are made dynamically by evaluating policies against attributes of the subject, object, action, and environment/context (e.g., time, location, department).

  27. What is Rule-Based Access Control, and how does it differ from RBAC?

    Rule-Based control grants/denies access according to predefined rules/conditions applied system-wide (e.g., firewall ACLs, time-of-day rules), independent of user role identity; RBAC keys off assigned job roles.

  28. In MAC classifications, what does the 'need to know' principle add on top of a security clearance?

    Even with a sufficient clearance level, a subject may only access information required for their specific duties; clearance alone is not enough without need to know.

  29. What is the difference between a threat, a vulnerability, and an exploit?

    A threat is a potential danger/actor that could cause harm; a vulnerability is a weakness that could be exploited; an exploit is the actual method or code used to take advantage of a vulnerability.

  30. Within the NIST CSF, which core Function includes asset management and risk assessment activities?

    The Identify function, which develops organizational understanding of assets, systems, data, and risks to be managed.

  31. In Zero Trust, what does 'microsegmentation' accomplish?

    It divides the network into small, isolated zones with individual access controls, limiting lateral movement so a breach in one segment cannot spread freely to others.

Cybersecurity Security Fundamentals and Governance FAQ

What is in the Cybersecurity Security Fundamentals and Governance syllabus?

Cybersecurity Security Fundamentals and Governance is split into 6 chapters: Core Security Concepts, Security Controls, Risk Management, Governance, Compliance, and Frameworks, Identity and Access Management and Security Awareness and Professional Ethics. Together they contain 23 topics.

How many chapters are in Cybersecurity Security Fundamentals and Governance?

6 chapters, containing 23 topics. The largest chapter is Core Security Concepts, with 5 topics.

Are there flashcards for Cybersecurity Security Fundamentals and Governance?

Yes — a 51-card Security Fundamentals and Governance deck, printed in full in the flashcards section of this page and available in the Examius app with spaced repetition. The free plan covers one exam of your choice, including its flashcards; Examius Pro, a one-time purchase, unlocks every other exam and deck.