What is change management?
A set of processes and procedures for managing changes to systems.
What does change management help prevent?
Downtime, confusion, and mistakes during changes.
What is the first step in the change management process?
Determining the scope of the change.
What factors should be considered when assessing the risk of a change?
Whether the change affects an entire operating system or a specific application.
What is a change control board?
A group responsible for analyzing, approving, and scheduling proposed changes.
What is the purpose of a backup plan in change management?
To restore systems to their previous state if a change fails.
What is onboarding?
The process of integrating a new hire into the organization.
What documents are typically provided during onboarding?
Employee handbook and acceptable use policies.
What needs to be created for a new user during onboarding?
New accounts with the correct rights and permissions.
What is offboarding?
The process of managing a user’s exit from the organization.
What should be considered during offboarding regarding user assets?
What happens to assigned hardware and stored data.
What is a playbook in a security context?
A defined set of steps to follow during a specific event.
What is an example of an event that might require a playbook?
Investigating a data breach.
What does SOAR stand for?
Security, Orchestration, Automation, and Response.
What is the benefit of using a SOAR platform?
To integrate diverse systems and automate mundane tasks.
What should organizations do to maintain security?
Continuously monitor and revise processes and procedures.
What is one way to strengthen a security posture?
Tightening the change control process.
What should be done if new technologies are integrated?
Create new playbooks or update existing ones.
What is the governance structure typically initiated by?
A board, such as a board of directors.
What is the role of committees in governance?
To implement broad objectives set by the board.
How do public sector governance policies differ from private sector?
They often involve legal, administrative, and political issues.
What are the two forms of governance?
Centralized and decentralized.
In centralized governance, who makes the decisions?
One group for the entire organization.
In decentralized governance, who typically makes decisions?
Individuals performing specific jobs.
-
1.1 Security Control Types and Categories31
-
1.2 The CIA Triad: A Study Guide22
-
1.2 Digital Signatures: Ensuring Integrity and Origin - Study Guide25
-
1.2 AAA Framework and Authorization26
-
1.2 IT Security Gap Analysis: A Comprehensive Study23
-
1.2 Zero Trust Networks and Adaptive21
-
1.2 Physical Security Controls: Methods and Technologies26
-
1.2 IT Security Deception and Disruption: Honeypots, Honeyfiles, and Honeytokens18
-
1.3 Formal Change Control Processes: A Study Guide21
-
1.3 The Technician's Role in Change Control Implementation33
-
1.4 Cybersecurity Cryptography: Encryption and Public Key Infrastructure23
-
1.4 Data Encryption and Its Algorithms31
-
1.4 Secure Key Exchange Methods22
-
1.4 Cryptography's Guardians: TPM, HSM, and Secure Enclaves10
-
1.4 Obfuscation and Hidden Data Techniques21
-
1.4 Cryptographic Hashes and Digital Signatures25
-
1.4 Blockchain Essentials21
-
1.4 Digital Certificates18
-
2.1 Understanding Threat Actors18
-
2.2 Navigating Threat Vectors and Attack Paths26
-
2.2 The Art of Phishing: Recognizing and Avoiding Scams17
-
2.2 The Impersonation Playbook: Scams, Fraud, and Prevention18
-
2.2 Cybersecurity Fundamentals: Watering Hole Attacks and Layered Defense20
-
2.2 The Digital Deception Playbook24
-
2.3 Malware Memory Injection: Understanding the Threat20
-
2.3 Buffer Overflow Attacks23
-
2.3 Race Conditions and TOCTOU Attacks20
-
2.3 Secure Software Updates32
-
2.3 Operating System Patching15
-
2.3 Understanding Code and SQL Injection Attacks19
-
2.3 Code Injection Attack20
-
2.3 Understanding Cross-Site Scripting (XSS) Attacks27
-
2.3 IoT Firmware and Device Lifecycle Security17
-
2.3 Virtual Machine Security Vulnerabilities21
-
2.3 Cloud Security: Understanding Threats and Vulnerabilities31
-
2.3 Supply Chain Security and Third-Party Risk29
-
2.3 Cybersecurity Vulnerabilities and Countermeasures25
-
2.3 Mobile Device Security: Risks and Countermeasures17
-
2.3 Zero-Day Vulnerabilities and Attacks23
-
2.4 Understanding Malware26
-
2.4 Understanding Computer Viruses and Worms27
-
2.4 Digital Intruders: Spyware and Bloatware19
-
2.4 Cybersecurity Threats: Keyloggers, Logic Bombs, and Rootkits22
-
2.4 DNS Poisoning and URL Hijacking27
-
2.4 Wireless Network Attacks: Deauthentication and RF Jamming22
-
2.4 Denial of Service (DoS) and Distributed Denial of Service (DDoS) Attacks21
-
2.4 On-Path and Man-in-the-Middle Attacks21
-
2.4 Replay Attacks and Session Hijacking24
-
2.4 Malicious Code Attacks and Defenses17
-
2.4 Application Security Fundamentals20
-
2.4 Cryptography's Vulnerabilities28
-
2.4 Password Hashes and Brute Force Attacks24
-
2.4 Indicators of Compromise and Security Best50
-
2.5 Network Segmentation and Access17
-
2.5 Cybersecurity Mitigation Techniques and Best Practices29
-
2.5 System and Endpoint Hardening Fundamentals28
-
3.1 Cloud Infrastructure11
-
3.1 Network Isolation, Virtualization, and Cloud Infrastructure22
-
3.1 IT Security Considerations and Infrastructure Technologies24
-
3.1 IT Infrastructure and Operational Resilience16
-
3.2 Network Security Zones and Attack Surfaces23
-
3.2 Intrusion Prevention and Detection Systems21
-
3.2 Network Appliances:16
-
3.2 Port Security25
-
3.2 Network Firewall Concepts23
-
3.2 Secure Network Communication Technologies (VPN, SD-WAN, and SASE)20
-
3.3 Data Types and Classifications17
-
3.3 States of Data, Security, and Sovereignty19
-
3.3 Data Protection Methods and Security Techniques22
-
3.4 High Availability and Resilience Architectures18
-
3.4 Cryptography's Vulnerabilities: Birthday Attacks and SSL Stripping19
-
3.4 A Beginner's Guide to Keeping Systems Running: Understanding Disaster Recovery16
-
3.4 Backup Strategies and Recovery21
-
3.4 Data Center Power and Backup Systems16
-
4.1 Application Security Baselines and Deployment10
-
4.1 System and Device Hardening22
-
4.1 Wireless Site Surveys and Mobile Device Management21
-
4.1 Wireless Network Security Protocols and Authentication17
-
4.1 Application Security Development and Testing24
-
4.2 Asset Management26
-
4.3 Vulnerability Scanning15
-
4.3 Threat Intelligence17
-
4.3 Penetration Testing20
-
4.3 Analyzing Vulnerabilities19
-
4.3 Vulnerability Remediation17
-
4.4 Security Monitoring21
-
4.4 Security Tools37
-
4.5 Firewalls32
-
4.5 Web Filtering22
-
4.5 Operating System Security11
-
4.5 Secure Protocols14
-
4.5 Email Security18
-
4.5 Monitoring Data19
-
4.5 Endpoint Security27
-
4.6 Identity and Access Management29
-
4.6 Access Controls17
-
4.6 Multifactor Authentication17
-
4.6 Password Security18
-
4.7 Scripting and Automation27
-
4.8 Incident Response20
-
4.8 Incident Planning17
-
4.8 Digital Forensics17
-
4.9 Log Data31
-
5.1 Security Policies18
-
5.1 Security Standards20
-
5.1 Security Procedures24
-
5.1 Security Considerations17
-
5.1 Data Roles and Responsibilities10
-
5.2 Risk Management14
-
5.2 Risk Analysis20
-
5.2 Risk Management Strategies24
-
5.2 Business Impact Analysis12
-
5.3 Third-party Risk Assessment24
-
5.3 Agreement Types12
-
5.4 Compliance20
-
5.4 Privacy15
-
5.5 Audits and Assessments11
-
5.5 Penetration Tests18
-
5.6 Security Awareness19
-
5.6 User Training22
