Cybersecurity Systems, Cloud, and Application Security Syllabus

Systems, Cloud, and Application Security syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Systems, Cloud, and Application Security in Cybersecurity, not a summary of it.

1. 1

   Endpoint and Host Hardening

   4 topics

   • Operating System Hardening
   • Host-Based Firewalls and Antivirus
   • Patch and Configuration Management
   • Secure Boot and Trusted Platform Module (TPM)
2. 2

   Secure Software Development

   4 topics

   • Secure SDLC
   • Input Validation and Output Encoding
   • Code Review and SAST/DAST
   • Dependency and Supply Chain Security
3. 3

   Cloud Security

   4 topics

   • Cloud Service and Deployment Models
   • Shared Responsibility Model
   • Cloud Identity and Access Management
   • Cloud Misconfigurations and CASB
4. 4

   Virtualization and Container Security

   3 topics

   • Hypervisor Security and VM Escape
   • Container Security (Docker)
   • Kubernetes Security
5. 5

   Mobile and IoT Security

   4 topics

   • Mobile Device Management (MDM)
   • Mobile Application Security
   • IoT and Embedded Device Threats
   • OT and ICS/SCADA Security
6. 6

   Data Protection and Privacy

   4 topics

   • Data Classification and Labeling
   • Data Loss Prevention (DLP)
   • Encryption at Rest and in Transit
   • Data Sanitization and Destruction

Systems, Cloud, and Application Security flashcards for Cybersecurity

25 of 50 cards from the Systems, Cloud, and Application Security deck — real questions with worked answers.

1. What is operating system hardening?

   The process of reducing a system's attack surface by disabling unnecessary services, ports, and accounts, applying least privilege, removing default/unused software, enforcing strong configurations, and applying patches to make the OS more resistant to attack.

2. Name four core techniques used in OS hardening.

   Disabling/removing unneeded services and ports; removing default or unused accounts and changing default passwords; applying least-privilege permissions; enabling logging/auditing and applying security patches (often guided by CIS Benchmarks or a security baseline).

3. What is a security baseline (e.g., a CIS Benchmark)?

   A documented, standardized set of secure configuration settings for a system or application that defines the minimum acceptable security posture; systems are configured to and audited against this baseline.

4. How does a host-based firewall differ from a network firewall?

   A host-based firewall runs on and protects a single endpoint, filtering that host's inbound/outbound traffic (and can be application-aware), whereas a network firewall sits at a network boundary and protects many hosts at a choke point.

5. Contrast signature-based and heuristic/behavior-based antivirus detection.

   Signature-based detection matches files against a database of known malware signatures (fast, but misses new/zero-day threats); heuristic/behavior-based detection flags suspicious code patterns or runtime behavior, catching unknown malware but producing more false positives.

6. What is patch management and why is it critical?

   The lifecycle process of identifying, acquiring, testing, and deploying software/firmware updates. It is critical because unpatched known vulnerabilities (CVEs) are a leading cause of breaches; timely patching closes the exploit window.

7. What is configuration management in a security context?

   The practice of establishing and maintaining known-good, consistent system configurations through baselines, version control, and drift detection, so that changes are controlled and deviations from the secure baseline are detected and corrected.

8. What is configuration drift?

   The gradual, unmanaged divergence of a system's actual configuration from its approved secure baseline over time, caused by ad-hoc changes; it reintroduces vulnerabilities and is detected via configuration management/auditing tools.

9. What is UEFI Secure Boot and what does it protect against?

   A firmware feature that verifies the digital signature of each boot component (bootloader, kernel) against trusted keys before execution, ensuring only trusted, unmodified code boots. It protects against bootkits and boot-level rootkits.

10. What is a Trusted Platform Module (TPM)?

    A dedicated, tamper-resistant hardware chip (or firmware equivalent) that securely generates and stores cryptographic keys, performs crypto operations, and provides platform integrity measurements; used for full-disk encryption (e.g., BitLocker), device identity, and attestation.

11. What are TPM Platform Configuration Registers (PCRs) used for?

    PCRs store cryptographic hashes (measurements) of boot components in a way that can only be extended, not overwritten. They enable measured boot and remote attestation, and can seal secrets so keys are released only if the measured boot state is unchanged.

12. What is the Secure Software Development Life Cycle (Secure SDLC)?

    An approach that integrates security activities into every phase of software development (requirements, design, implementation, testing, deployment, maintenance) rather than bolting security on at the end—shifting security 'left.'

13. What does 'shift left' mean in secure development?

    Moving security activities (threat modeling, testing, static analysis, secure coding) earlier in the development lifecycle, because defects found earlier are cheaper and easier to fix than those found in production.

14. What is threat modeling and name a common framework?

    A structured process of identifying, enumerating, and prioritizing potential threats and mitigations for a system, typically during design. A common framework is STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege).

15. Why is input validation a fundamental security control?

    Because untrusted input is the root of many attacks (injection, XSS, buffer overflows); validating input ensures data conforms to expected type, length, format, and range before processing, reducing the attack surface.

16. Contrast allowlist (whitelist) and denylist (blacklist) input validation. Which is preferred?

    Allowlist validation accepts only known-good inputs matching a defined pattern; denylist rejects known-bad inputs. Allowlisting is preferred because it is far harder to bypass—denylists inevitably miss novel malicious inputs.

17. What is output encoding and which attack does it primarily prevent?

    Converting output data into a safe representation for its destination context (HTML, JavaScript, URL, SQL) so it is treated as data, not executable code. It primarily prevents Cross-Site Scripting (XSS) and other injection attacks.

18. What is the difference between static (SAST) and dynamic (DAST) application security testing?

    SAST analyzes source/byte code without executing it (white-box, finds flaws early like injection sinks), while DAST tests a running application from the outside (black-box, finds runtime/config issues but later in the cycle).

19. What is Interactive Application Security Testing (IAST)?

    A hybrid technique that instruments a running application (via agents) to observe code execution and data flow during testing, combining aspects of SAST and DAST for more accurate, lower-false-positive findings with runtime context.

20. What is a manual secure code review looking for that automated tools may miss?

    Business-logic flaws, authorization gaps, insecure design decisions, and context-dependent issues—problems requiring human understanding of intent that pattern-based SAST/DAST tools typically cannot detect.

21. What is a software supply chain attack?

    An attack that compromises software indirectly by targeting a trusted third-party component, dependency, build pipeline, or vendor update mechanism (e.g., SolarWinds, malicious npm packages), so the malicious code is delivered through legitimate distribution.

22. What is a Software Bill of Materials (SBOM)?

    A formal, machine-readable inventory of all components, libraries, and dependencies (with versions) that make up a piece of software, enabling organizations to track and respond to vulnerabilities in their dependencies.

23. What is Software Composition Analysis (SCA)?

    A tool/process that scans a project's open-source and third-party dependencies to identify known vulnerabilities (CVEs), license risks, and outdated components, key to managing supply chain risk.

24. What is a typosquatting / dependency confusion attack?

    Publishing malicious packages with names similar to popular ones (typosquatting) or with the same name as an internal package but a higher version in a public registry (dependency confusion), tricking build systems into pulling the attacker's code.

25. List the three primary cloud service models and what each provides.

    IaaS (Infrastructure as a Service): virtualized compute, storage, networking (e.g., EC2). PaaS (Platform as a Service): runtime/dev platform without managing OS (e.g., App Engine). SaaS (Software as a Service): complete application over the web (e.g., Gmail).

See more Systems, Cloud, and Application Security flashcards →

Planning Systems, Cloud, and Application Security for Cybersecurity

Systems, Cloud, and Application Security (Cybersecurity) FAQ