1.1 Describe the CIAtriad

1.2 Compare security deployments

• Network, endpoint, and application securitysystems
• Agentless and agent-basedprotections
• Legacy antivirus andantimalware
• SIEM, SOAR, and logmanagement

1.3 Describe security terms

• Threat intelligence (TI)
• Threat hunting
• Malware analysis
• Threat actor
• Run book automation(RBA)
• Reverseengineering
• Sliding window anomalydetection
• Principle of leastprivilege
• Zerotrust
• Threat intelligence platform(TIP)

1.4 Compare security concepts

• Risk (risk scoring/risk weighting, risk reduction, riskassessment)
• Threat
• Vulnerability
• Exploit

1.5 Describe the principles of the defense-in-depthstrategy

1.6 Compare access controlmodels

• Discretionary accesscontrol
• Mandatory accesscontrol
• Nondiscretionary accesscontrol
• Authentication, authorization, accounting
• Rule-based accesscontrol
• Time-based accesscontrol
• Role-based accesscontrol

1.7 Describe terms as defined inCVSS

• Attack vector
• Attackcomplexity
• Privilegesrequired
• Userinteraction
• Scope

1.8 Identify the challenges of data visibility (network, host, and cloud) in detection
1.9 Identify potential data loss from provided traffic profiles
1.10 Interpret the 5-tuple approach to isolate a compromised host in a grouped set of logs
1.11 Compare rule-based detection vs. behavioral and statistical detection

2.1 Compare attack surface and vulnerability

2.2 Identify the types of data provided by these technologies

• TCPdump
• NetFlow
• Next-genfirewall
• Traditional statefulfirewall
• Application visibility andcontrol
• Web content filtering
• Email content filtering

2.3 Describe the impact of these technologies on datavisibility

• Access controllist
• NAT/PAT
• Tunneling
• TOR
• Encryption
• P2P
• Encapsulation
• Loadbalancing

2.4 Describe the uses of these data types in securitymonitoring

• Full packet capture
• Sessiondata
• Transactiondata
• Statisticaldata
• Metadata
• Alertdata

2.5 Describe network attacks, such as protocol-based, denial of service, distributed denialof service, andman-in-the-middle

2.6 Describe web application attacks, such as SQL injection, command injections, andcross- sitescripting

2.7 Describe social engineering attacks

2.8 Describe endpoint-based attacks, such as buffer overflows, command and control(C2), malware, andransomware

2.9 Describe evasion and obfuscation techniques, such as tunneling, encryption, andproxies

2.10 Describetheimpactofcertificatesonsecurity(includesPKI,public/privatecrossingthe network,asymmetric/symmetric)

2.11 Identify the certificate components in a givenscenario

• Cipher-suite
• 509certificates
• Keyexchange
• Protocolversion
• PKCS

3.1 Describe the functionality of these endpoint technologies in regard tosecurity monitoring

• Host-based intrusiondetection
• Antimalware andantivirus
• Host-basedfirewall
• Application-levelwhitelisting/blacklisting
• Systems-based sandboxing (such as Chrome, Java, AdobeReader)

3.2 Identify components of an operating system (such as Windows and Linux) in agiven scenario

Describe the role of attribution in aninvestigation

• Assets
• Threat actor
• Indicators ofcompromise
• Indicators ofattack
• Chain ofcustody

3.4 Identify type of evidence used based on providedlogs

• Bestevidence
• Corroborativeevidence
• Indirect evidence

3.5 Compare tampered and untampered diskimage

3.6 Interpret operating system, application, or command line logs to identify anevent

3.7 Interpret the output report of a malware analysis tool (such as a detonation chamber or sandbox)

• Hashes
• URLs
• Systems, events, andnetworking

4.1 Map the provided events to sourcetechnologies

• IDS/IPS
• Firewall
• Network applicationcontrol
• Proxylogs
• Antivirus
• Transaction data(NetFlow)

4.2 Compare impact and no impact for theseitems

• Falsepositive
• Falsenegative
• Truepositive
• Truenegative
• Benign

4.3 Compare deep packet inspection with packet filtering and stateful firewalloperation

4.4 Compare inline traffic interrogation and taps or trafficmonitoring

4.5 Compare the characteristics of data obtained from taps or traffic monitoringand transactional data (NetFlow) in the analysis of networktraffic

4.6 Extract files from a TCP stream when given a PCAP file andWireshark

4.7 Identify key elements in an intrusion from a given PCAPfile

• Sourceaddress
• Destinationaddress
• Sourceport
• Destinationport
• Protocols
• Payloads

4.8 Interpret the fields in protocol headers as related to intrusionanalysis

• Ethernet frame
• IPv4
• IPv6
• TCP
• UDP
• ICMP
• DNS
• SMTP/POP3/IMAP
• HTTP/HTTPS/HTTP2
• ARP

4.9 Interpret common artifact elements from an event to identify analert

• IP address (source /destination)
• Client and server portidentity
• Process (file or registry)
• System (APIcalls)
• Hashes
• URI /URL

4.10 Interpret basic regularexpressions

5.1 Describe managementconcepts

• Asset management
• Configurationmanagement
• Mobile devicemanagement
• Patchmanagement
• Vulnerabilitymanagement

5.2 Describe the elements in an incident response plan as stated inNIST.SP800-61

5.3 Apply the incident handling process (such as NIST.SP800-61) to anevent

5.4 Map elements to these steps of analysis based on theNIST.SP800-61

• Preparation
• Detection andanalysis
• Containment, eradication, andrecovery
• Post-incident analysis (lessonslearned)

5.5 Map the organization stakeholders against the NIST IR categories (CMMC, NIST.SP800- 61)

• Preparation
• Detection andanalysis
• Containment, eradication, andrecovery
• Post-incident analysis (lessonslearned)

5.6 Describe concepts as documented inNIST.SP800-86

• Evidence collectionorder
• Dataintegrity
• Data preservation
• Volatile data collection

5.7 Identify these elements used for network profiling

• Total throughput
• Session duration
• Ports used
• dCritical asset address space

5.8 Identify these elements used for server profiling

• Listening ports
• Logged in users/service accounts
• Running processes
• Running tasks
• Applications

5.9 Identify protected data in a network

• PII
• PSI
• PHI
• Intellectual property

5.10 Classify intrusion events into categories as defined by security models, such as Cyber Kill Chain Model and Diamond Model of Intrusion

5.11 Describe the relationship of SOC metrics to scope analysis (time to detect, time to contain, time to respond, time to control)