Security Operations

Data Classification, Handling and States

Protection must be proportionate to sensitivity, which is impossible until data is classified. Know the roles involved and the three states data can occupy.

Exam tip. Reuse of media means overwrite or secure erase. Disposal of sensitive media means destruction, and degaussing never works on SSDs.

Configuration, Change and Patch Management

Most outages and many breaches trace back to uncontrolled change. These three disciplines keep systems in a known, defensible state.

Exam tip. The rollback plan is the most tested element of change management.

Logging, Monitoring and SIEM

Logs provide the evidence for detection and investigation, but only if they survive the incident and can be correlated. Centralisation is the control that makes both possible.

Exam tip. Anomaly detection depends entirely on having defined normal first. That is what a baseline is for.

Security Awareness and Social Engineering Defence

Attacks increasingly target people rather than technology, so trained staff are a genuine control layer. The exam expects awareness programmes to be constructive rather than punitive.

Exam tip. Nobody legitimate ever asks for your one-time code. Any such request is an attack.

Encryption, Hashing and Password Storage

CC expects working familiarity rather than mathematics: which technique achieves which goal, and why passwords need something other than a plain hash.

Exam tip. Password storage always means a slow salted KDF, never a fast hash such as SHA-256 on its own.

Third-Party and Supply Chain Risk

Outsourcing a function does not outsource accountability. CC expects awareness that suppliers extend your attack surface.

Exam tip. Third-party accounts are a recurring source of orphaned access. They must be in the same review cycle as employees.

Secure Configuration and Hardening

Most systems ship configured for convenience rather than security. Hardening closes that gap and is heavily represented in operational questions.

Exam tip. Hardening questions usually have a cheapest-first answer. Changing defaults and disabling unused services come before buying anything.

Malware Types and Practical Defences

CC expects you to recognise malware by behaviour and to match it to the defence that actually addresses it.

Exam tip. No single product stops all malware. Answers claiming antivirus alone is sufficient are wrong.

Vulnerability Management and Patching

Finding weaknesses is easy; prioritising and fixing them safely is the discipline. CC tests the process rather than tooling.

Exam tip. For end-of-life software the answer is never patch. Expect replacement, isolation or a compensating control.

Data Retention, Archiving and Secure Disposal

Keeping data forever is a liability and deleting it too early breaches obligations. Retention policy resolves the tension, and disposal must match the media.

Exam tip. Ask first whether the media will be reused. That single question decides the method.

1. Why must classified information be labelled as well as classified?

• A. Labelling reduces the storage space the data occupies
• B. Anyone handling it needs to see the required handling rules without checking a registercorrect
• C. Labelling encrypts the data automatically
• D. Labels are required for data to be backed up

A classification that is not visible on the asset cannot influence behaviour. Labels tell the person holding a document, disk or email what they may do with it. Automated tools also use labels to enforce rules such as blocking an external send.

2. What is the purpose of a data classification scheme?

• A. To speed up network transfers
• B. To eliminate the need for backups
• C. To apply protection proportionate to the sensitivity of the informationcorrect
• D. To reduce the amount of storage required

Classification labels data by sensitivity so that handling, access and destruction requirements match the risk. Treating everything as highly sensitive is wasteful, and treating nothing as sensitive is dangerous.