CIA Triad and Core Security Principles
The CIA triad, Confidentiality, Integrity, and Availability, is the three core goals of information security. Supporting principles such as least privilege, separation of duties, and defense in depth are how you actually reach those goals. Expect several questions that hand you a scenario and ask which leg of the triad, or which principle, it maps to.
Exam tip. Ransomware mainly hits Availability, plus your assurance of integrity when you restore, and not necessarily Confidentiality. Encryption showing up in an attack does not automatically mean data was disclosed, so read for what was actually harmed.
Authentication Methods and Multifactor Authentication
Authentication proves who you are using factors drawn from different categories, and multifactor means combining two or more of those categories, which cuts account takeover dramatically. Phishing-resistant methods such as FIDO2 beat one-time codes, because they verify the origin of the site you are actually on.
Exam tip. Two passwords is not MFA, because they come from the same category. When the scenario is real-time relay phishing or MFA fatigue, the answer is phishing-resistant FIDO2 or number matching, not SMS and not a simple push.
Symmetric Cryptography (AES, DES, 3DES, RC4)
Symmetric cryptography uses one shared secret key for both encryption and decryption. That makes it fast, which is why it is what you reach for with bulk data, but it leaves you with the problem of getting that key to the other side securely. AES is the modern standard, and the older ciphers are deprecated.
Exam tip. Bulk data, one key, and speed all point to symmetric AES. If the scenario also needs tamper detection, pick an authenticated mode such as AES-GCM. ECB is always a trap answer, because identical blocks encrypt identically and leak the pattern.
Asymmetric Cryptography (RSA, ECC, Diffie-Hellman)
Asymmetric cryptography works with a pair of keys. The public key encrypts or verifies, and the private key decrypts or signs. That pairing is what solves key distribution and what makes digital signatures possible, but it is slow, so in practice you use it for key exchange and signing rather than for bulk data.
Exam tip. A key you can publish that encrypts, plus a secret key that decrypts, means asymmetric. And only a signature made with a private key gives non-repudiation; a shared symmetric key never can, because both sides hold it.
Hashing Algorithms and Password Storage
A cryptographic hash takes any input and turns it into a fixed-length fingerprint, and there is no way to run that process backward to recover the original. That is the key difference from encryption: hashing has no key and is not meant to be reversed, it exists purely to verify integrity. For passwords specifically, a fast hash alone is not enough. You need a slow, salted key derivation function that is deliberately expensive to compute at scale.
Exam tip. If a question asks how to store passwords, the answer is a slow, salted KDF, bcrypt, scrypt, or Argon2, never a fast hash on its own. Even SHA-256 unsalted falls to rainbow tables almost instantly.
PKI and Certificate Lifecycle
Public Key Infrastructure is the whole framework of certificate authorities, certificates, and policies that binds a public key to an identity. A certificate is requested with a CSR, issued by a CA, validated through a chain of trust, and revoked through a CRL or OCSP if it is compromised. Expect several questions on revocation and on trust.
Exam tip. Real-time status points to OCSP. Bandwidth concerns or offline checking point to a CRL. Privacy and performance together point to OCSP stapling. If a key is suspected compromised, you revoke now rather than waiting for expiration.
Access Control Models (RBAC, DAC, MAC, ABAC)
Access control models are about how a permission decision gets made, and the exam tests whether you can tell them apart from a scenario: who decides, and on what basis. ABAC is the most granular, MAC uses labels nobody can override, RBAC keys off job roles, and DAC leaves it to the owner.
Exam tip. When a single decision has to weigh several changing attributes, assignment, device, time of day, the answer is ABAC. The moment an owner can decide who gets in, it is DAC and not MAC. Clearances plus labels means MAC.
Security Frameworks (NIST CSF, RMF, ISO 27001, SOC 2)
Frameworks give you a structured way to manage security. What you need is to know what each one is for and how to tell them apart, because scenarios usually ask which framework or which report fits the need being described.
Exam tip. SOC 2 Type II means effectiveness over time, which is what customers want for assurance. ISO 27001 means a certifiable ISMS. And do not confuse 800-53, the controls catalog, with 800-61, incident response.
Physical Security Controls
Physical controls protect the facility and the equipment inside it. The exam classifies controls two ways, by function, meaning deterrent, preventive, detective, corrective, or compensating, and by type, meaning physical, technical, or administrative, then asks which one fits the scenario.
Exam tip. A visible camera deters, and its recording detects. Classify by the primary purpose the control is serving in that scenario. A vehicle threat means bollards; tailgating means an access control vestibule.