You are notified” and “failing which” and “legal proceedings
DOMAIN 4 28%
🔐 4.1 Security Administration on Computing Resources
🔹 Secure Baselines
A baseline is a predefined configuration for a system, meant to represent a “known good state”.
For the exam, understand that this is often created during system deployment and updated after major patches or config changes.
Example questions:
May ask about what’s considered a baseline or how it’s used in hardening.
🔹 Hardening Systems
Key concept:
Reduce attack surface
Disable anything not needed.Common missed concept:
Why we disable things like Telnet — because it’s unencrypted and vulnerable.MDM (Mobile Device Management) = Think of it as central control over mobile policy enforcement.
For IoT:
Many devices are “set-and-forget”, so they’re often outdated and unmonitored — a soft target for attackers.
🧠 Tip:
Know the differences between hardening for workstations, mobile, network, and IoT devices — each has unique risks and controls.
🖥️ 4.2 Asset Management and Lifecycle
🔹 Asset Inventory
You’ll be expected to know that tracking what you own is the foundation of security — you can’t protect what you don’t know exists.
Tagging, logging, and software inventory tools (like SCCM)
come into play.
🔹 Asset Lifecycle
Expect scenario-based questions like:
“An organization disposes of laptops without wiping data. What’s the risk?” ➜ Data exposure.Key distinction:
Clearing = Single overwrite (still recoverable).
Purging = Multiple overwrites, or tools like degaussers.
Destroying = Physical methods (shred, incinerate).
🧠 Tip:
Know which method is appropriate based on sensitivity of data.
🛡️ 4.3 Vulnerability Management
🔹 Vulnerability Scanning
Authenticated vs Unauthenticated Scans
Authenticated = more accurate; sees inside the system.
Unauthenticated = sees what an outsider would.
🔹 Managing Vulnerabilities
Risk = Likelihood × Impact
Prioritization is based on CVSS scores, asset value, and exploit availability.
🔹 Penetration Testing vs Scanning
This is a frequently tested distinction.
Pen Test = Simulated attack; must have written permission (rules of engagement).
Vuln Scan = Passive; just lists issues.
🧠 Tip:
Always think about compliance/legal risks during testing — unauthorized testing = violation.
🛰️ 4.4 Security Monitoring, Alerting, and Analysis
🔹 SIEM
Focus on correlation and alerting.
SIEMs take logs from multiple sources and look for patterns.
🔹 IDS vs IPS
IDS = Detect only.
IPS = Detect + Block.
Network-based vs Host-based IDS/IPS may come up too.
🔹 Security Tools
EDR = Watches endpoints (e.G., laptops, servers).
UBA = Identifies unusual behavior (e.G., employee accessing thousands of files at 3 a.M.).
DLP = Stops sensitive data from leaving (email, USB).
Honeytokens = Fake data to bait attackers (e.G., a fake password.Txt file).
🧠 Tip:
Know where each tool works (endpoint, network, cloud) and what kind of threat it helps detect.
🧑💼 4.5 Identity and Access Management (IAM)
🔹 Authentication Methods
MFA = Something you know (password), have (token), are (biometrics).
Kerberos = Ticket-based, used in Windows domains.
LDAP/LDAPS = Used for directories (like Active Directory).
SAML, OAuth2, OIDC = Federation/SSO. Know which ones do authN vs authZ.
🔹 Access Control Models
DAC = File owner decides (most flexible, least secure).
MAC = Enforced by system (used in classified gov’t systems).
RBAC = Based on roles (Finance, HR, Admin).
ABAC = Dynamic; looks at attributes like time of day, device type, job title.
🧠 Tip:
“Least privilege” shows up everywhere — make sure you know it’s about giving only what’s needed to do a job, nothing more.
⚙️ 4.6 Automation and Orchestration
🔹 Why Automate?
Speeds up response and reduces error (but needs oversight).
Example tools:
SOAR (Security Orchestration Automation and Response)
DevSecOps = Security embedded into software development lifecycle.
Think: Code analysis tools, automated security tests.
🧠 Tip:
Know examples like:
Auto-disabling accounts after termination.
Auto-patching on schedule.
Auto-response to alerts (e.G., isolate infected machine).
🚨 4.7 Incident Response (IR)
🔹 IR Process
Preparation – Have a plan, tools, and people in place.
Detection & Analysis – Recognize and classify the incident.
Containment – Short-term (isolate system) vs Long-term (segment network).
Eradication – Remove malware, backdoors.
Recovery – Restore systems to normal.
Lessons Learned – Post-incident review and documentation.
🔹 Containment Tips
Don’t immediately wipe systems — first gather forensic data.
Common containment:
Disable accounts, block IPs, disconnect systems.
🧠 Tip:
On the test, containment comes before eradication — control the damage first.
🔎 4.8 Digital Forensics and Investigations
🔹 Chain of Custody
Every handler and action must be documented to ensure evidence integrity.
🔹 Order of Volatility
CPU/Cache
RAM
Network connections
Disk
Backups
You must collect data in this order during forensics.
🔹 Forensic Best Practices
Always use a bit-for-bit image — never work on the original drive.
Log timestamps and findings — may be used in legal proceedings.
🧠 Tip:
If you mess with evidence or don’t follow procedure, it becomes inadmissible in court.
🚨 4.7 Incident Response (IR)
🔹 IR Process
Preparation – Have a plan, tools, and people in place.
Detection & Analysis – Recognize and classify the incident.
Containment – Short-term (isolate system) vs Long-term (segment network).
Eradication – Remove malware, backdoors.
Recovery – Restore systems to normal.
Lessons Learned – Post-incident review and documentation.
🔹 Containment Tips
Don’t immediately wipe systems — first gather forensic data.
Common containment: Disable accounts, block IPs, disconnect systems.
🧠 Tip:
On the test, containment comes before eradication — control the damage first.
🔎 4.8 Digital Forensics and Investigations
🔹 Chain of Custody
Every handler and action must be documented to ensure evidence integrity.
🔹 Order of Volatility
CPU/Cache
RAM
Network connections
Disk
Backups
You must collect data in this order during forensics.
🔹 Forensic Best Practices
Always use a bit-for-bit image — never work on the original drive.
Log timestamps and findings — may be used in legal proceedings.
🧠 Tip:
If you mess with evidence or don’t follow procedure, it becomes inadmissible in court.