1.1 Explain the importance of threat data and intelligence.

• Intelligence sources
• Confidence levels
• Indicator management
• Threat classification
• Threat actors
• Intelligence cycle
• Commodity malware
• Information sharing and analysis communities

1.2 Given a scenario, utilize threat intelligence to support organizational security.

• Attack frameworks
• Threat research
• Threat modeling methodologies
• Threat intelligence sharing with supported functions

1.3 Given a scenario, perform vulnerability management activities1. Vulnerability identification

• Vulnerability identification
• Validation
• Remediation/mitigation
• Scanning parameters and criteria
• Inhibitors to remediation

1.4 Given a scenario, analyze the output from common vulnerability assessment tools

• Web application scanner
• Infrastructure vulnerability scanner
• Software assessment tools and techniques
• Enumeration
• Wireless assessment tools
• Cloud infrastructure assessment tools

Explain the threats and vulnerabilities associated with specialized technology

• Mobile
• Internet of Things (IoT)
• Embedded
• Real-time operating system (RTOS)
• System-on-Chip (SoC)
• Field programmable gate array (FPGA)
• Physical access control
• Building automation systems
• Vehicles and drones
• Workflow and process automation systems
• Industrial control system
• Supervisory control and data acquisition (SCADA)

1.5 Explain the threats and vulnerabilities associated with operating in the cloud

• Cloud service models
• Cloud deployment models
• Function as a Service (FaaS)/serverless architecture
• Infrastructure as code (IaC)
• Insecure application programming interface (API)
• Improper key management
• Unprotected storage
• Logging and monitoring

1.6 Given a scenario, implement controls to mitigate attacks and software vulnerabilities

• Attack types
• Vulnerabilities

2.1Given a scenario, apply security solutions for infrastructure management.

• Cloud vs. on-premises
• Asset management
• Change management
• Containerization
• Segmentation
• Network architecture
• Virtualization
• Identity and access management
• Cloud access security broker (CASB)
• Honeypot
• Monitoring and logging
• Encryption
• Certificate management
• Active defense

2.2 Explain software assurance best practices.

• Platforms
• Software development life cycle (SDLC) integration
• DevSecOps
• Software assessment methods
• Secure coding best practices
• Static analysis tools
• Dynamic analysis tools
• Formal methods for verification of critical software
• Service-oriented architecture

2.3 Explain hardware assurance best practices

• Hardware root of trust
• eFuse
• Unified Extensible Firmware Interface (UEFI)
• Trusted foundry
• Secure processing
• Anti-tamper
• Self-encrypting drive
• Trusted firmware updates
• Measured boot and attestation
• Bus encryption

3.1 Given a scenario, analyze data as part of security monitoring activities

• Heuristics
• Trend analysis
• Endpoint
• Network
• Log review
• Impact analysis
• Security information and event management (SIEM) review
• Query writing
• E-mail analysis

3.2 Given a scenario, implement configuration changes to existing controls to improve security

• Permissions
• Whitelisting
• Blacklisting
• Firewall
• Intrusion prevention system (IPS) rules
• Data loss prevention (DLP)
• Endpoint detection and response (EDR)
• Network access control (NAC)
• Sinkholing
• Malware signatures
• Sandboxing
• Port security

3.3 Explain the importance of proactive threat hunting.

• Workflow orchestration
• Scripting
• Application programming interface (API) integration
• Automated malware signature creation
• Data enrichment
• Threat feed combination
• Machine learning
• Use of automation protocols and standards
• Continuous integration
• Continuous deployment/delivery

4.1 Explain the importance of the incident response process

• Communication plan
• Response coordination with relevant entities
• Factors contributing to data criticality

4.2 Given a scenario, apply the appropriate incident response procedure

• Preparation
• Detection and analysis
• Containment
• Eradication and recovery
• Post-incident activities

4.3 Given an incident, analyze potential indicators of compromise

• Network-related
• Host-related
• Application-related

4.4 Given a scenario, utilize basic digital forensics techniques

• Network
• Endpoint
• Mobile
• Cloud
• Virtualization
• Legal hold
• Procedures
• Hashing
• Carving
• Data acquisition

5.1 Understand the importance of data privacy and protection

• Privacy vs. security
• Non-technical controls
• Technical controls

5.2 Given a scenario, apply security concepts in support of organizational risk mitigation

• Business impact analysis
• Risk identification process
• Risk calculation
• Communication of risk factors
• Risk prioritization
• Systems assessment
• Documented compensating controls
• Training and exercises
• Supply chain assessment

5.3 Explain the importance of frameworks, policies, procedures, and controls

• Frameworks
• Policies and procedures
• Category
• Control type
• Audits and assessments