📘 Domain 1: Security and Risk Management

🔑 What you MUST know

CIA Triad

• What is it: Core principles of security
• What: Confidentiality, Integrity, Availability
• When:
  • Data leak → Confidentiality
  • Data change → Integrity
  • Downtime → Availability

---

Risk (Threat × Vulnerability)

• What is it: Measurement of potential loss
• What: Risk only exists if both threat and vulnerability exist
• When: Prioritizing controls

---

SLE / ARO / ALE

• What is it: Financial risk model
• What: Calculates expected yearly loss
• When: Cost/benefit analysis

---

Governance vs Management

• What is it: Strategy vs execution
• What: Governance = direction, Management = implementation
• When: Responsibility questions

---

Policies, Standards, Procedures

• What is it: Organizational control hierarchy
• What: Policy → Standard → Procedure
• When: “What comes first?” → Policy

---

Compliance (e.g. GDPR)

• What is it: Legal requirements
• When: Handling regulated data

---

🧠 Mindset (HOW TO THINK)

👉 You are the CISO, not the engineer

Decision rules:

• ALWAYS pick risk reduction, not elimination
• ALWAYS consider cost vs benefit
• ALWAYS align with business objectives

Question patterns:

• If answer = technical fix first → ❌ wrong
• If answer = risk assessment first → ✅ correct
• If answer skips policy → ❌ wrong
• If answer starts with policy/governance → ✅ correct

Trick recognition:

• “Best” ≠ most secure → it means most balanced
• “First” → almost always risk analysis or policy

---

📘 Domain 2: Asset Security

🔑 What you MUST know

Data Classification

• What is it: Assign sensitivity labels
• When: Before applying controls

---

Data Ownership

• What is it: Accountability for data
• When: Responsibility questions

---

Data Lifecycle

• What is it: Data from creation to destruction
• When: Handling data

---

Data Retention

• What is it: How long data is stored
• When: Legal/compliance

---

Data Disposal

• What is it: Secure destruction
• When: End-of-life

---

Privacy Principles

• What is it: Protect personal data
• When: Privacy scenarios

---

🧠 Mindset

👉 Data drives everything

Decision rules:

• FIRST → classify
• SECOND → apply controls

Question patterns:

• “What should you do first?” → classification
• “What protection?” → depends on classification

Trick recognition:

• Overprotecting low-value data → ❌
• Underprotecting sensitive data → ❌
• Matching control to sensitivity → ✅

---

📘 Domain 3: Security Architecture & Engineering

🔑 What you MUST know

Bell-LaPadula

• What is it: Confidentiality model
• When: Prevent data leaks

---

Biba

• What is it: Integrity model
• When: Prevent corruption

---

Cryptography

• What is it: Data protection methods
• When: Protecting data

---

Symmetric vs Asymmetric

• What is it: Encryption types
• When: Secure communication

---

TCB

• What is it: Trusted system components
• When: Architecture

---

Secure Design Principles

• What is it: Secure system design
• When: System creation

---

🧠 Mindset

👉 Fixing later = wrong answer

Decision rules:

• Choose design over patching
• Choose architecture over tools
• Choose preventive over detective

Question patterns:

• “Best solution?” → design change
• “Most effective?” → built-in security

Trick recognition:

• Add firewall after breach → ❌
• Redesign system securely → ✅

---

📘 Domain 4: Communication and Network Security

🔑 What you MUST know

OSI Model

• What is it: Communication layers
• When: Protocol/device questions

---

Network Segmentation

• What is it: Divide networks
• When: Limit spread

---

DMZ

• What is it: Isolated public zone
• When: Internet-facing systems

---

Secure Protocols

• What is it: Encrypted communication
• When: Data in transit

---

IDS vs IPS

• What is it: Detect vs prevent
• When: Threat detection

---

Network Attacks

• What is it: Threats like MITM
• When: Attack scenarios

---

🧠 Mindset

👉 The network is NOT trusted

Decision rules:

• Always encrypt data in transit
• Always segment networks
• Always limit exposure

Question patterns:

• “Best protection?” → segmentation + encryption
• “Reduce impact?” → isolation

Trick recognition:

• Trust internal network → ❌
• Zero trust approach → ✅

---

📘 Domain 5: Identity and Access Management

🔑 What you MUST know

IAAA

• What is it: Access flow
• When: Access questions

---

MFA

• What is it: Multiple factors
• When: Strong authentication

---

Access Models

• What is it: Access control types
• When: Authorization

---

Provisioning / Deprovisioning

• What is it: Grant/remove access
• When: User lifecycle

---

SSO & Federation

• What is it: Shared login systems
• When: Multi-system access

---

🧠 Mindset

👉 Access = risk

Decision rules:

• Grant minimum access
• Remove access immediately
• Verify identity strongly

Question patterns:

• “Best control?” → least privilege
• “After employee leaves?” → disable account

Trick recognition:

• Keeping access “just in case” → ❌
• Immediate removal → ✅

---

📘 Domain 6: Security Assessment and Testing

🔑 What you MUST know

Vulnerability Assessment

• What is it: Find weaknesses
• When: Regular scanning

---

Penetration Testing

• What is it: Exploit weaknesses
• When: Validate risk

---

Audit

• What is it: Compliance check
• When: Regulations

---

Logging & Monitoring

• What is it: Track activity
• When: Detection

---

Metrics

• What is it: Measure effectiveness
• When: Management

---

🧠 Mindset

👉 Never assume security works

Decision rules:

• Always test controls
• Prefer continuous monitoring
• Measure everything

Question patterns:

• “Ensure effectiveness?” → testing
• “Improve security?” → metrics

Trick recognition:

• One-time testing → ❌
• Continuous validation → ✅

---

📘 Domain 7: Security Operations

🔑 What you MUST know

Incident Response

• What is it: Handle incidents
• When: After detection

---

SIEM

• What is it: Log analysis
• When: Monitoring

---

Backups

• What is it: Data recovery
• When: Data loss

---

RTO / RPO

• What is it: Recovery targets
• When: DR planning

---

Patch Management

• What is it: Fix vulnerabilities
• When: Maintenance

---

Chain of Custody

• What is it: Evidence tracking
• When: Forensics

---

🧠 Mindset

👉 Assume compromise

Decision rules:

• Detect fast
• Contain quickly
• Recover safely

Question patterns:

• “During incident?” → contain first
• “After incident?” → lessons learned

Trick recognition:

• Jump to recovery too fast → ❌
• Follow IR phases → ✅

---

📘 Domain 8: Software Development Security

🔑 What you MUST know

Secure SDLC

• What is it: Secure development process
• When: Always

---

SAST / DAST

• What is it: Testing methods
• When: Development/testing

---

Secure Coding

• What is it: Writing safe code
• When: Development

---

OWASP Top 10

• What is it: Common vulnerabilities
• When: Web apps
  → OWASP

---

Environment Separation

• What is it: Dev/Test/Prod separation
• When: Prevent leaks

---

🧠 Mindset

👉 Security must be built, not fixed

Decision rules:

• Fix issues early
• Never expose real data
• Enforce secure coding

Question patterns:

• “Best fix?” → early SDLC
• “Reduce vulnerabilities?” → secure design

Trick recognition:

• Fix after deployment → ❌
• Secure by design → ✅

---

🔥 FINAL EXAM STRATEGY (CRITICAL)

When stuck:

Step 1

Eliminate answers that:

• Are purely technical
• Ignore process
• Ignore business

Step 2

Choose answer that:

• Reduces risk
• Follows order:
  Policy → Design → Implement → Monitor

Step 3

Ask:
👉 “What would a CISO do?”

• Not fix → but govern, reduce risk, and control impact