Incident Response Lifecycle (NIST SP 800-61)
The NIST lifecycle gives incident response a structure, and the order matters: prepare first, then detect and analyze, then contain, eradicate, and recover, and finally learn from it. Having roles and communication plans defined in advance is what keeps a real event from turning into confusion.
Exam tip. Restoring before you have eradicated the threat just invites reinfection. And when regulated data is exposed, notifying regulators and affected individuals inside the mandated timeframe is a time-critical obligation, even though it is not a technical one.
Digital Forensics and Evidence Handling
Forensics is about preserving and analyzing evidence so it still holds up in court. That means collecting the most volatile data first, working on verified copies rather than originals, and keeping an unbroken chain of custody. Everything here comes back to integrity and admissibility.
Exam tip. Always analyze a copy, never the original. Hashes that match before and after are what prove the evidence was not altered. And synchronized clocks through NTP are essential if you want to reconstruct a timeline.
Identity and Access Management (IAM, PAM, SSO, Federation)
IAM is how you manage digital identities, their authentication, and their authorization across the whole lifecycle. Privileged accounts need more than that, which is where PAM and just-in-time access come in. SSO and federation make life easier for users, but they concentrate a lot of risk at the identity provider.
Exam tip. The identity provider is a crown-jewel target, because it federates access to everything else. Protect its administrators with phishing-resistant MFA and tight PAM, and automate deprovisioning so orphaned accounts never linger.
Endpoint Security (EDR, AV, Host Firewall, Application Control)
Endpoint controls protect the individual device. Signature antivirus is the baseline, and EDR or XDR add behavioral detection and the ability to respond. On top of that, least privilege, allowlisting, disk encryption, and boot integrity are what harden a machine against modern threats.
Exam tip. Fileless and living-off-the-land attacks walk straight past signatures, so the answer there is behavioral EDR with rich script and command-line logging. And because attackers kill the agent first, tamper protection matters.
Log Management and SIEM
Centralized logging and correlation are what power detection and forensics. Protect the integrity of those logs by forwarding them off the host, keep clocks synchronized so events line up, and tune the rules so analysts are not drowning in alerts. UEBA and SOAR extend this into detection and response.
Exam tip. Forward logs off the host in real time, so an attacker cannot erase the local evidence. And because static thresholds miss low-and-slow activity, the answer there is UEBA correlating small anomalies over time.
Data Loss Prevention (DLP)
DLP inspects and controls sensitive data wherever it lives: on the endpoint, on the network, and in the cloud. It leans on classification and on detection techniques to know what it is looking at, and it has real blind spots, encrypted apps and images among them, so it has to be layered with other controls.
Exam tip. DLP has blind spots: images, screenshots, encrypted apps. Layer it with least privilege, monitoring, egress control, and awareness rather than relying on DLP by itself.
Mobile Device Security (MDM, MAM, BYOD)
Mobile security is a balancing act between corporate control and personal privacy, and that tension is sharpest on BYOD. MDM manages the whole device, while MAM and containerization manage only the corporate apps and data, which is what makes a selective wipe possible. Conditional access ties whether a device gets in to whether it is compliant.
Exam tip. On BYOD, the right answer is usually MAM with containerization and selective wipe, because you manage the corporate data rather than someone's entire personal phone. Conditional access is the Zero Trust practice applied to mobile.
Wireless Network Security (WPA2/WPA3, 802.1X)
Securing enterprise Wi-Fi comes down to three things: use WPA3 where you can, run Enterprise mode with 802.1X and RADIUS so authentication is per user, and make clients validate the server certificate so credentials cannot be harvested. Personal mode shares one passphrase, which leaves you with no accountability.
Exam tip. Enterprise mode is what gives you per-user accountability and the ability to revoke one person. And in EAP, clients must validate the RADIUS server certificate, otherwise a rogue server harvests credentials.
Backup, Recovery, and Resilience (3-2-1, RTO, RPO)
Recovery rests on your backups. The 3-2-1 rule, an offline or immutable copy, and restores you have actually tested are what make data recoverable, and that matters most against ransomware. RTO and RPO are two different metrics, and they drive two different design decisions.
Exam tip. Backing up more often improves your RPO but does nothing about a slow restore; only faster recovery capability fixes RTO. And because ransomware targets reachable backups, keep one copy offline and immutable.
Secure Software Development (SDLC, DevSecOps)
Secure development means building security into every phase rather than bolting it on at the end, which is what shift left refers to. Layer your testing types, keep secrets out of the code, enforce authorization on the server, and secure the pipeline with signing and gates. No single scanner catches everything.
Exam tip. No single scanner finds everything, so layer them. Enforce authorization server-side, keep secrets out of the code, and use security gates that block a noncompliant build.