Section 2
3- Fundamentals of security
What is information security?
What is CIA in CIA triad?
What is non-repudiation? And an example
4 – AAA of security
What is Authentication, Authorization and Accounting? And give example for each
What are security controls?
What is zero trust?
What is control plane?
What is data plane?
5 - Threats and vulnerabilities
What is a threat?
What is a vulnerability?
6 - confidentiality
Why confidentiality is important for a business? (2)
What is encryption and how does encryption ensure confidentiality? (1)
How does access controls ensure confidentiality? (1)
What is data masking? And a real-life example how it can ensure confidentiality? (1)
What is physical security measure? And an example of a physical security measure which can help
ensure confidentiality?
how does training and awareness ensure confidentiality?
7 - integrity
Why is integrity important for a business? (3)
What is hashing? And include things like hashing function, digest function and digital fingerprint
How does a digital signature ensure integrity and authenticity?
And how do you digitally sign a file? (include information such as hashing the file, hash
digest, encryption using a private key, changes to hash would invalidate the digital signature
etc)
A checksum is a method to verify integrity of data during what?
How does a checksum work?
Hint( Include information like the sender’s checksum of the transmitted data, receiver’s
calculated checksum for the received data, recipient can compute a new checksum for
received data and compare it to the provided checksum, if the two values match it means
that…, and if the two values don’t match this means alteration or corruption has happened)
Access controls and how they provide integrity?
1
,Regular audit and how they provide integrity?
8 – availability
Why is availability important to a business? (3)
What is redundancy?
What is server redundancy?
What is data redundancy?
What is network redundancy?
What is power redundancy?
9 – Non-repudiation
Advantage of non-repudiation? (individuals and entities in a communication cannot deny..)
How is a digital signature created? (Hashing a message, encrypting the hash digest with the
user’s private key using asymmetric encryption)
Example of how digital signature can be used? (emails)
Non-reputation is important for which reasons? (3 – Authenticity of digital transactions, integrity
of critical communications, providing accountability in digital processes)
10 – Authentication
What is authentication?
Authentication methods – something you know, something you have, something you are, something
you do, and somewhere you are (5)
What is MFA (Multi factor authentication) ?
Why is authentication important? (3) (prevent unauthorized access, protect user data and privacy,
ensure resource validity)
11 – Authorization
What is authorization? (1)
How authorization is used? (3) (protect sensitive data, maintain system integrity in organisations,
create more streamlined user experiences)
12 – Accounting
2
,What is accounting?
Advantages of an accounting system? (5) (Audit trail, regulatory compliance, forensic analysis,
resource optimization, user accountability).
Technologies which can be used to carry out accounting? (3) (syslog servers, network analysers,
security information and event management)
13 – Security control categories
What are technical security controls? And example?
What are managerial security controls? And example?
What are operational security controls? And example?
What are physical security controls? And example?
14 – Security control types
What are preventative controls? And example of one preventative control
What are deterrent controls? And example of one deterrent control
What are detective controls? And example of one detective control
What are corrective controls? And example of a corrective control
What are compensating controls? And an example of compensating controls
What are directive controls? And an example of directive control
15 – Zero trust
What is zero trust?
What is a control plane?
What is a data plane?
Adaptive identity element in control plane?
Threat scope reduction element in control plane?
Policy driven access control element in control plane?
Secured zones element in control plane?
What is a policy engine? And how does a control plane use a policy engine to make decisions about
access?
What is a policy administrator ad how does a control plane use a policy administrator to make
decisions about access?
What is a subject / system in a data plane? And an example
What is policy enforcement point in a data plane? And give an example
16 – Gap Analysis
What is gap analysis?
What happens on each of the gap analysis steps? (4) (Define the scope of the analysis, gather data on
the current state of the organisation, analyse the data to identify the gaps, develop a plan to bridge
the gap)
Example of gap analysis (can skip)
What is technical gap analysis? And an example?
3
, What is business gap analysis? And an example?
Plan of action and milestones (POA&M)?
Answers
Protecting data and information from unauthorized access, modification, disruption, disclosure,
corruption and destruction.
C = Confidentiality. information is only accessible by those who are authorized
I = integrity. Data remains accurate and unaltered, unless modification is required.
A = availability. Information and resources are accessible when required by authorized users.
Non-repudiation = an action or event has happened and cannot be denied by parties involved.
Example = sending an email and digitally signing it means you cannot deny having sent it
since your digital signature is attached.
Authentication = verifying the identity of a user or system.
For example, logging into your email with a username and password
Authorization = what actions or resources a user can access
You might be able to read from a database (read permissions), but not make changes to it.
(Write permissions)
Accounting = tracking user activities and resource usage.
For example, dates and times you logged into the company computer. What websites you
visited and when etc.
Mitigate risk and protect the CIA of information systems and their data.
Protects CIA of information system and their data.
Security model that operates on the principle that no one inside or outside should be trusted by
default.
Adaptive identity, threat scope reduction, policy driven access control and secured zones
secured zones, threat reduction, policy access control
4
3- Fundamentals of security
What is information security?
What is CIA in CIA triad?
What is non-repudiation? And an example
4 – AAA of security
What is Authentication, Authorization and Accounting? And give example for each
What are security controls?
What is zero trust?
What is control plane?
What is data plane?
5 - Threats and vulnerabilities
What is a threat?
What is a vulnerability?
6 - confidentiality
Why confidentiality is important for a business? (2)
What is encryption and how does encryption ensure confidentiality? (1)
How does access controls ensure confidentiality? (1)
What is data masking? And a real-life example how it can ensure confidentiality? (1)
What is physical security measure? And an example of a physical security measure which can help
ensure confidentiality?
how does training and awareness ensure confidentiality?
7 - integrity
Why is integrity important for a business? (3)
What is hashing? And include things like hashing function, digest function and digital fingerprint
How does a digital signature ensure integrity and authenticity?
And how do you digitally sign a file? (include information such as hashing the file, hash
digest, encryption using a private key, changes to hash would invalidate the digital signature
etc)
A checksum is a method to verify integrity of data during what?
How does a checksum work?
Hint( Include information like the sender’s checksum of the transmitted data, receiver’s
calculated checksum for the received data, recipient can compute a new checksum for
received data and compare it to the provided checksum, if the two values match it means
that…, and if the two values don’t match this means alteration or corruption has happened)
Access controls and how they provide integrity?
1
,Regular audit and how they provide integrity?
8 – availability
Why is availability important to a business? (3)
What is redundancy?
What is server redundancy?
What is data redundancy?
What is network redundancy?
What is power redundancy?
9 – Non-repudiation
Advantage of non-repudiation? (individuals and entities in a communication cannot deny..)
How is a digital signature created? (Hashing a message, encrypting the hash digest with the
user’s private key using asymmetric encryption)
Example of how digital signature can be used? (emails)
Non-reputation is important for which reasons? (3 – Authenticity of digital transactions, integrity
of critical communications, providing accountability in digital processes)
10 – Authentication
What is authentication?
Authentication methods – something you know, something you have, something you are, something
you do, and somewhere you are (5)
What is MFA (Multi factor authentication) ?
Why is authentication important? (3) (prevent unauthorized access, protect user data and privacy,
ensure resource validity)
11 – Authorization
What is authorization? (1)
How authorization is used? (3) (protect sensitive data, maintain system integrity in organisations,
create more streamlined user experiences)
12 – Accounting
2
,What is accounting?
Advantages of an accounting system? (5) (Audit trail, regulatory compliance, forensic analysis,
resource optimization, user accountability).
Technologies which can be used to carry out accounting? (3) (syslog servers, network analysers,
security information and event management)
13 – Security control categories
What are technical security controls? And example?
What are managerial security controls? And example?
What are operational security controls? And example?
What are physical security controls? And example?
14 – Security control types
What are preventative controls? And example of one preventative control
What are deterrent controls? And example of one deterrent control
What are detective controls? And example of one detective control
What are corrective controls? And example of a corrective control
What are compensating controls? And an example of compensating controls
What are directive controls? And an example of directive control
15 – Zero trust
What is zero trust?
What is a control plane?
What is a data plane?
Adaptive identity element in control plane?
Threat scope reduction element in control plane?
Policy driven access control element in control plane?
Secured zones element in control plane?
What is a policy engine? And how does a control plane use a policy engine to make decisions about
access?
What is a policy administrator ad how does a control plane use a policy administrator to make
decisions about access?
What is a subject / system in a data plane? And an example
What is policy enforcement point in a data plane? And give an example
16 – Gap Analysis
What is gap analysis?
What happens on each of the gap analysis steps? (4) (Define the scope of the analysis, gather data on
the current state of the organisation, analyse the data to identify the gaps, develop a plan to bridge
the gap)
Example of gap analysis (can skip)
What is technical gap analysis? And an example?
3
, What is business gap analysis? And an example?
Plan of action and milestones (POA&M)?
Answers
Protecting data and information from unauthorized access, modification, disruption, disclosure,
corruption and destruction.
C = Confidentiality. information is only accessible by those who are authorized
I = integrity. Data remains accurate and unaltered, unless modification is required.
A = availability. Information and resources are accessible when required by authorized users.
Non-repudiation = an action or event has happened and cannot be denied by parties involved.
Example = sending an email and digitally signing it means you cannot deny having sent it
since your digital signature is attached.
Authentication = verifying the identity of a user or system.
For example, logging into your email with a username and password
Authorization = what actions or resources a user can access
You might be able to read from a database (read permissions), but not make changes to it.
(Write permissions)
Accounting = tracking user activities and resource usage.
For example, dates and times you logged into the company computer. What websites you
visited and when etc.
Mitigate risk and protect the CIA of information systems and their data.
Protects CIA of information system and their data.
Security model that operates on the principle that no one inside or outside should be trusted by
default.
Adaptive identity, threat scope reduction, policy driven access control and secured zones
secured zones, threat reduction, policy access control
4
