State the Quantitative Risk Analysis formulas for Single Loss Expectancy (SLE), Annualized Rate of Occurrence (ARO), and Annualized Loss Expectancy (ALE).

1. `SLE = AV * EF`, where `AV` is Asset Value ($) and `EF` is Exposure Factor (percentage of asset value lost in a single incident, from `0.0` to `1.0`). 2. `ARO` is the estimated number of times the threat event will occur in one year (e.g., once every 4 years = `0.25`). 3. `ALE = SLE * ARO` (expected annual financial loss).

Define the Business Impact Analysis (BIA) continuity metrics: RPO, RTO, WRT, and MTD (MTPD), and state the inequality connecting RTO, WRT, and MTD.

RPO (Recovery Point Objective): Maximum acceptable amount of DATA LOSS measured backward in time (dictates backup/replication frequency, e.g., 15 minutes). RTO (Recovery Time Objective): Maximum target time to restore a system/hardware after an outage. WRT (Work Recovery Time): Time needed after RTO to verify data integrity, sync backlog transactions, and resume normal business operations. MTD / MTPD (Maximum Tolerable Downtime): Total downtime beyond which the business suffers irreparable harm. Inequality: `RTO + WRT <= MTD`.

Compare Data Loss Prevention (DLP) across Endpoint DLP, Network DLP, and Storage/Cloud DLP, and explain Exact Data Matching (EDM) vs Regex/Lexicons.

Endpoint DLP: Agent monitors USB drives, clipboard, printing, and local file transfers. Network DLP: Inspects egress email (SMTP) and web uploads at the perimeter/SWG. Storage/Cloud DLP: Scans data at rest in file shares, databases, and SaaS drives via CASB. Regex/Pattern matching looks for structural patterns (e.g., 16-digit Luhn-valid credit cards or SSNs, prone to false positives); Exact Data Matching (EDM) and Document Fingerprinting hash actual rows from production customer databases to detect exfiltration with near-zero false positives.

Under GDPR and privacy engineering, what are the differences between Data Controller vs Data Processor, and Anonymization vs Pseudonymization?

Data Controller: The entity that determines the purposes ('why') and means ('how') of processing personal data (holds primary regulatory liability). Data Processor: A third party (e.g., AWS or payroll vendor) that processes personal data strictly on behalf of and under instructions from the Controller. Pseudonymization replaces direct identifiers with a reversible alias/token (data STILL falls under GDPR scope). Anonymization irreversibly strips or aggregates identifiers (e.g., k-anonymity, differential privacy) so individuals can never be re-identified (no longer personal data under GDPR).

What are the NIST SP 800-88 R1 three methods of Media Sanitization: Clear, Purge, and Destroy?

Clear: Applies logical techniques (overwriting all user-addressable storage locations with zeros/random patterns) to protect against simple non-invasive keyboard/OS recovery (suitable when reusing media internally). Purge: Applies physical or cryptographic techniques—such as Degaussing (magnetic tapes/HDDs only—useless on SSDs!) or Cryptographic Erase (destroying the SED's internal encryption key in flash)—rendering data unrecoverable even against state-of-the-art laboratory forensics. Destroy: Physical disintegration, incineration, shredding, or smelting (mandatory for failed drives leaving top-secret facilities).

Compare CSPM, CWPP, CIEM, and CNAPP in Cloud-Native Security.

CSPM (Cloud Security Posture Management): Continuously audits cloud control-plane APIs (AWS/Azure/GCP) for misconfigurations (e.g., public S3 buckets, open `0.0.0.0/0` security groups, missing MFA) and compliance drift. CWPP (Cloud Workload Protection Platform): Protects the runtime workloads themselves (VMs, containers, Kubernetes pods, serverless functions) via vulnerability scanning and runtime eBPF behavioral monitoring. CIEM (Cloud Infrastructure Entitlement Management): Detects over-privileged IAM roles and enforces least privilege. CNAPP (Cloud-Native Application Protection Platform): Unifies CSPM, CWPP, CIEM, and IaC scanning from code to cloud.

Compare Vulnerability Scanning (Credentialed vs Non-Credentialed) and Penetration Testing, and explain SCAP (`OVAL`, `XCCDF`, `CPE`).

Vulnerability Scanning is an automated, continuous breadth search identifying missing patches and misconfigurations; Credentialed (Authenticated) scans log into hosts via SSH/WMI to inspect installed package versions and registry keys with far fewer false positives than Non-Credentialed network banner scans. Penetration Testing is a goal-oriented, active exploitation engagement chaining flaws to prove business impact. SCAP (Security Content Automation Protocol) standardizes automated compliance checking using `XCCDF` (checklists), `OVAL` (vulnerability assessment logic), and `CPE` (product naming).

Work through a Quantitative Risk Analysis & Safeguard Cost-Benefit calculation: An asset worth $200,000 faces a threat that destroys 50% of its value once every 5 years. A control costs $12,000/year and reduces ARO to 0.05. Is the safeguard worth buying?

1. `SLE = AV * EF = $200,000 * 0.50 = $100,000`. 2. `ALE_prior = SLE * ARO_prior = $100,000 * (1/5 = 0.20) = $20,000/year`. 3. `ALE_post = $100,000 * 0.05 = $5,000/year`. 4. `Net Value of Safeguard = (ALE_prior - ALE_post) - Annual Cost of Safeguard = ($20,000 - $5,000) - $12,000 = +$3,000/year`. Because the net value is positive (+$3,000/year saved), the safeguard IS financially justified.

What are CPTED (Crime Prevention Through Environmental Design), Mantraps (Access Control Vestibules), Faraday Cages, and TEMPEST?

CPTED uses natural architectural design—Natural Surveillance (clear sightlines, lighting), Natural Access Control (bollards, landscaping paths), and Territorial Reinforcement (fencing, signage)—to deter physical crime. A Mantrap (Access Control Vestibule) uses two interlocking doors where the first must close and verify identity/weight before the second opens to prevent tailgating. A Faraday Cage blocks electromagnetic fields/RF signals. TEMPEST is the NSA specification for shielding equipment against eavesdropping via unintentional electromagnetic emanations (Van Eck phreaking).

Compare Fire Suppression classes (Class A, B, C, D, K) and Data Center Wet Pipe, Dry Pipe, Pre-Action, and Clean Agent (FM-200 / Novec 1230) systems.

Fire Classes: A (ordinary combustibles: wood/paper -> water); B (flammable liquids -> foam/CO2); C (energized electrical equipment -> non-conductive gas/clean agent); D (combustible metals); K (kitchen oils). Data Center sprinklers: Wet Pipe keeps water in pipes up to the head (risk of water damage if bumped); Pre-Action (ideal for server rooms) holds water back behind a valve until BOTH a smoke/heat detector triggers AND the sprinkler fusible link melts. Clean Agents (FM-200, Novec 1230 / FK-5-1-12, Inergen) extinguish electrical fires via heat absorption/chemical interruption without damaging electronics or depleting oxygen like legacy Halon/CO2.

Classify Security Controls by Type (Preventive, Detective, Corrective, Deterrent, Compensating, Directive) and by Implementation (Technical, Managerial, Operational, Physical).

Preventive: Stops an incident from occurring (firewall block, MFA, mantrap). Detective: Identifies and alerts on active/past incidents (IDS, SIEM, CCTV, audit logs). Corrective: Restores systems after an incident (backups, EDR quarantine, patching). Deterrent: Discourages attackers (`Warning` banners, lighting, visible guards). Compensating: Alternative control used when a primary requirement (e.g., PCI DSS on legacy mainframe) cannot be met directly. Directive: Administrative policies and acceptable use guidelines.

What are key Container and Kubernetes security hardening controls (Docker & K8s)?

1. Never run containers as `root` (`runAsNonRoot: true`, drop Linux `CAP_SYS_ADMIN` capabilities) or in `--privileged` mode (which exposes the host kernel and devices); 2. Mount the container root filesystem as read-only (`readOnlyRootFilesystem: true`); 3. Scan base images for CVEs and verify cryptographic signatures (Cosign); 4. Restrict pod-to-pod East-West traffic using Kubernetes `NetworkPolicies`; 5. Enforce Pod Security Standards (`Restricted` profile), RBAC least privilege, and encrypt `etcd` Secrets at rest.

Compare the 4 phases of the NIST SP 800-61 Incident Response Lifecycle with the 6 phases of the SANS PICERL model.

NIST SP 800-61 combines intermediate steps into 4 phases: 1. Preparation; 2. Detection and Analysis; 3. Containment, Eradication, and Recovery; 4. Post-Incident Activity (Lessons Learned). SANS PICERL explicitly separates them into 6 sequential phases: 1. Preparation; 2. Identification; 3. Containment; 4. Eradication; 5. Recovery; 6. Lessons Learned.

What is User and Entity Behavior Analytics (UEBA), and how does it detect Insider Threats and compromised credentials?

Unlike static rule-based SIEM correlation, UEBA applies machine learning and statistical profiling to establish baselines of normal behavior for every human user and machine entity (service accounts, IoT, hosts). When an employee's account suddenly downloads 50 GB of source code from GitHub at 3:00 AM or queries unusual SMB shares laterally, UEBA raises the entity's risk score even though no malware signature was triggered.

Compare SIEM, SOAR, EDR, and XDR in modern Security Operations Centers (SOCs).

SIEM (Security Information and Event Management): Aggregates, normalizes, and correlates logs/events from across the enterprise (firewalls, AD, cloud, endpoints) for compliance, alerting, and threat hunting. SOAR (Security Orchestration, Automation, and Response): Executes automated playbooks/runbooks (e.g., enriching phishing indicators via VirusTotal API, opening a Jira ticket, and isolating a host) to reduce MTTR. EDR (Endpoint Detection and Response): Kernel/user telemetry agent on endpoints recording process trees, memory injections, and allowing remote containment. XDR: Unifies telemetry across Endpoint, Network (NDR), Cloud, and Email into a single vendor-integrated detection and response platform.

Explain the Cloud Shared Responsibility Model across IaaS, PaaS, and SaaS.

In all cloud models, the Customer is ALWAYS responsible for their own Data, Endpoints, Identities/Access Management (IAM), and Classification. IaaS (EC2, Compute Engine): Provider secures physical data center, hardware, storage, and hypervisor; Customer secures Guest OS patching, host firewall, network configuration, runtime, and application code. PaaS (RDS, App Engine): Provider also manages Guest OS and runtime patching; Customer manages application code/configuration and data. SaaS (Microsoft 365, Salesforce): Provider manages the full application stack; Customer manages data, user permissions, and SaaS security posture.

How do you maintain Forensic Integrity and Chain of Custody when acquiring a disk image?

1. Document the Chain of Custody log (who handled the evidence, what item/serial number, when, where stored, and why at every transfer); 2. Connect physical storage through a Hardware Write Blocker so the investigator's OS cannot alter timestamps or metadata; 3. Capture a bit-for-bit forensic image (`dd`, `dcfldd`, FTK Imager, E01 format) including unallocated slack space and deleted sectors; 4. Compute SHA-256 cryptographic hashes of the original drive and the forensic image to prove mathematical identity, and perform all analysis exclusively on a working copy.

Differentiate between NDA, SLA, MSA, MOU/MOA, BPA, and ISA in third-party vendor governance.

NDA (Non-Disclosure Agreement): Legally binds parties to protect confidential information. MSA (Master Service Agreement): Umbrella contract establishing overarching legal terms for future work. SLA (Service Level Agreement): Defines measurable performance metrics (uptime %, MTTR response times) and financial penalties. MOU / MOA (Memorandum of Understanding/Agreement): Document of mutual intent and cooperation before a formal contract. BPA (Business Partners Agreement): Outlines profit/obligation sharing. ISA (Interconnection Security Agreement): Technical security requirements for linking two organizations' IT networks.

What are Slack Space, Wear Leveling / TRIM challenges on SSDs, and Legal Hold in eDiscovery?

Slack Space is the unused portion of a fixed-size filesystem cluster between the end of a file (`EOF`) and the end of the allocated cluster—which may retain remnants of previously deleted files. Modern SSDs use Wear Leveling and garbage collection (`TRIM`), which automatically zeroes out deleted blocks in the background, making traditional deleted-file recovery nearly impossible compared to magnetic HDDs. A Legal Hold (Litigation Hold) is a mandatory legal directive suspending normal data retention/deletion schedules to preserve all electronically stored information (ESI) relevant to pending litigation.

Compare the four Risk Treatment (Risk Response) strategies: Risk Mitigation, Risk Transfer, Risk Avoidance, and Risk Acceptance.

Mitigation (Reduction): Implementing security controls to reduce the likelihood (ARO) or impact (EF) of a risk. Transfer (Sharing): Shifting the financial impact of a risk to a third party (e.g., purchasing cyber insurance or outsourcing to a cloud provider—note that legal/regulatory accountability can NEVER be transferred). Avoidance: Ceasing the business activity or decommissioning the system that creates the risk. Acceptance (Retention): Formally documenting and accepting the risk when the cost of controls exceeds the potential loss (requires senior management sign-off).

What is the RFC 3227 Order of Volatility for Digital Forensics evidence collection, from most volatile to least volatile?

Evidence must be collected from most volatile to least volatile: 1. CPU Registers and L1/L2/L3 Cache; 2. System RAM (Memory dump via LiME/WinPmem), routing tables, ARP cache, active network connections (`netstat`), and running processes; 3. Temporary file systems / Swap space / Pagefile (`pagefile.sys`, `hiberfil.sys`); 4. Non-volatile Local Disks (SSD/HDD bit-stream image); 5. Remote logging and monitoring data; 6. Physical configuration and network topology; 7. Archival media / Offline Backups.

Compare Cold Site, Warm Site, Hot Site, and Cloud Active-Active Disaster Recovery sites.

Cold Site: Leased physical building with power, HVAC, and racks, but NO servers or data installed (lowest cost, weeks to recover). Warm Site: Pre-installed networking and server hardware (often scaled down), requiring latest backups to be loaded (hours to days to recover). Hot Site: Fully redundant, mirrored infrastructure with near-real-time data replication ready to take over in minutes (highest traditional cost). Cloud Multi-Region Active-Active: Live traffic served simultaneously across geographically dispersed regions with zero-downtime automatic DNS/Anycast failover.

Compare Disaster Recovery Testing methods: Checklist Review, Tabletop Exercise, Walkthrough, Simulation, Parallel Test, and Full Interruption Test.

Checklist Review: Leaders individually review DR plan currency. Tabletop Exercise: Stakeholders talk through a hypothetical disaster scenario around a conference table without touching production systems. Simulation: Technical teams practice recovery steps in a non-production sandbox environment. Parallel Test: DR site is brought up and processes live transactions alongside the primary site to verify output consistency without cutting over primary traffic. Full Interruption (Cutover) Test: Primary production site is actually shut down to verify real failover (highest validation, highest operational risk).

In CISA Auditing, define Audit Risk (`AR = IR * CR * DR`) and explain Statistical vs Non-Statistical (Judgmental) Sampling and Stop-or-Go Sampling.

Audit Risk (`AR`) is the risk an auditor gives an clean opinion when material weaknesses exist: `AR = Inherent Risk (IR) * Control Risk (CR) * Detection Risk (DR)`. Statistical Sampling uses probability theory so results can be mathematically extrapolated to the entire population with a quantified confidence level. Judgmental Sampling relies on auditor expertise to target high-risk items (cannot be statistically extrapolated). Stop-or-Go (Sequential) Sampling tests small increments and stops early when virtually zero errors are expected.

Map these major frameworks and regulations to their primary domains: ISO/IEC 27001 & 27002, NIST CSF 2.0, SOC 2 (Type I vs Type II), PCI DSS, and HIPAA.

ISO/IEC 27001: International standard for specifying and certifying an Information Security Management System (ISMS; 27002 provides control implementation guidance). NIST CSF 2.0: 6 core functions—Govern, Identify, Protect, Detect, Respond, Recover. SOC 2 (AICPA Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, Privacy): Type I audits control design at a single point in time; Type II audits operational effectiveness over 6–12 months. PCI DSS: Mandatory standard for organizations handling branded credit card (PAN) data. HIPAA: US healthcare Protected Health Information (PHI) privacy/security.

Compare Full, Incremental, and Differential Backups across backup speed, storage usage, and restoration speed, and explain the 3-2-1-1-0 Backup Rule.

Full: Copies all selected data and clears the archive bit (slowest backup, fastest single-step restore). Differential: Copies all data changed since the LAST FULL backup without clearing the archive bit (requires 2 sets to restore: Last Full + Latest Differential). Incremental: Copies only data changed since the LAST BACKUP OF ANY TYPE and clears the archive bit (fastest backup/least storage, requires Last Full + EVERY Incremental in sequence to restore). 3-2-1-1-0 Rule: 3 copies of data, on 2 different media types, 1 copy offsite, 1 copy immutable/air-gapped (WORM/Object Lock against ransomware), and 0 unverified backup errors.

Why do Cloud Forensics and Container Forensics differ from traditional on-premises disk forensics?

In public cloud and Kubernetes environments, physical hardware is abstracted and multi-tenant (you cannot seize a physical hard drive in AWS/GCP), and containers are ephemeral. Investigators instead use cloud APIs to take point-in-time EBS/Persistent Disk snapshots, isolate instances via quarantine Security Groups (preserving IAM metadata and memory), inspect immutable CloudTrail/VPC Flow Logs, and pause/checkpoint containers (`docker commit` / CRIU) before termination.

In CISA Information Systems Auditing, what is the difference between Compliance Testing (Tests of Controls) and Substantive Testing?

Compliance Testing evaluates whether internal security controls are operating consistently in accordance with management policies (e.g., verifying that a sample of 30 production change tickets all have documented CAB approval signatures—often using Attribute Sampling). Substantive Testing directly verifies the integrity and accuracy of actual underlying data, transactions, or account balances (e.g., recalculating ledger totals or running a full configuration scan—often using Variable Sampling). Strong compliance test results allow an auditor to reduce the scope of substantive testing.

During Incident Response, what happens in Containment (Short-Term vs Long-Term), Eradication, and Recovery?

Containment stops the bleeding so damage does not spread: Short-Term Containment immediately isolates the affected host (e.g., EDR network quarantine or VLAN ACL change while keeping power on for memory forensics); Long-Term Containment applies temporary workarounds/firewall blocks to keep production running while rebuilding clean systems. Eradication removes the root cause (wiping/reimaging hosts, patching the exploited vulnerability, rotating all compromised credentials/keys). Recovery restores systems from verified clean backups and monitors intensely for reinfection.

Compare CASB (Cloud Access Security Broker), SWG (Secure Web Gateway), ZTNA (Zero Trust Network Access), and SASE (Secure Access Service Edge).

CASB: Sits between users and SaaS apps (via inline forward/reverse proxy or out-of-band SaaS API connectors) to discover Shadow IT, enforce DLP, and block unauthorized SaaS data sharing. SWG: Inspects outbound employee internet traffic for malware and URL filtering. ZTNA: Replaces legacy corporate network VPNs with identity- and context-aware per-application tunnels. SASE (Gartner framework): Converges SD-WAN networking with SSE (Security Service Edge: CASB + SWG + ZTNA + FWaaS) into a unified, cloud-delivered edge service.

Compare Mean Time Between Failures (MTBF), Mean Time To Failure (MTTF), and Mean Time To Repair/Restore (MTTR), and state the Availability formula.

MTBF: Average operational uptime between failures for a REPAIRABLE system. MTTF: Average lifespan before failure for a NON-REPAIRABLE component (e.g., a cooling fan replaced upon failure). MTTR: Average time required to diagnose, repair, and restore a failed system to service. System Availability formula: `Availability = MTBF / (MTBF + MTTR)`. ('Five Nines' `99.999%` availability allows only ~5.26 minutes of downtime per year).

Define Inherent Risk, Residual Risk, Control Risk, Risk Appetite, and Risk Tolerance.

Inherent Risk: The raw level of risk existing before any security controls are applied. Residual Risk: The remaining risk that persists AFTER security controls have been implemented (`Residual Risk = Inherent Risk - Controls`); senior management must formally accept residual risk. Risk Appetite: The broad, high-level amount of risk an organization is willing to pursue to achieve strategic objectives. Risk Tolerance: The specific, measurable acceptable variance around risk appetite metrics.

Incident Response (NIST/PICERL), Digital Forensics, GRC, Risk Management (ALE/SLE/ARO) & Cloud Security

Executive and operational mastery for Security+, CISM, CISA, and CISSP: NIST SP 800-61 vs SANS PICERL incident response, RFC 3227 Order of Volatility, digital forensics and chain of custody, SIEM/SOAR/EDR/XDR, quantitative risk formulas (SLE/ALE/ARO), BIA continuity metrics (RTO/RPO/MTD/MTBF/MTTR), DR sites, CISA auditing, and cloud security (CASB/SASE/CSPM/CWPP).

Level: advanced
Languages: en → en
Cards: 32
Markdown: Incident Response (NIST/PICERL), Digital Forensics, GRC, Risk Management (ALE/SLE/ARO) & Cloud Security (.md)

Flashcards (32)

#	Front (Term / Question)	Back (Definition / Answer)
1	State the Quantitative Risk Analysis formulas for Single Loss Expectancy (SLE), Annualized Rate of Occurrence (ARO), and Annualized Loss Expectancy (ALE).	1. `SLE = AV * EF`, where `AV` is Asset Value ($) and `EF` is Exposure Factor (percentage of asset value lost in a single incident, from `0.0` to `1.0`). 2. `ARO` is the estimated number of times the threat event will occur in one year (e.g., once every 4 years = `0.25`). 3. `ALE = SLE * ARO` (expected annual financial loss).
2	Define the Business Impact Analysis (BIA) continuity metrics: RPO, RTO, WRT, and MTD (MTPD), and state the inequality connecting RTO, WRT, and MTD.	RPO (Recovery Point Objective): Maximum acceptable amount of DATA LOSS measured backward in time (dictates backup/replication frequency, e.g., 15 minutes). RTO (Recovery Time Objective): Maximum target time to restore a system/hardware after an outage. WRT (Work Recovery Time): Time needed after RTO to verify data integrity, sync backlog transactions, and resume normal business operations. MTD / MTPD (Maximum Tolerable Downtime): Total downtime beyond which the business suffers irreparable harm. Inequality: `RTO + WRT <= MTD`.
3	Compare Data Loss Prevention (DLP) across Endpoint DLP, Network DLP, and Storage/Cloud DLP, and explain Exact Data Matching (EDM) vs Regex/Lexicons.	Endpoint DLP: Agent monitors USB drives, clipboard, printing, and local file transfers. Network DLP: Inspects egress email (SMTP) and web uploads at the perimeter/SWG. Storage/Cloud DLP: Scans data at rest in file shares, databases, and SaaS drives via CASB. Regex/Pattern matching looks for structural patterns (e.g., 16-digit Luhn-valid credit cards or SSNs, prone to false positives); Exact Data Matching (EDM) and Document Fingerprinting hash actual rows from production customer databases to detect exfiltration with near-zero false positives.
4	Under GDPR and privacy engineering, what are the differences between Data Controller vs Data Processor, and Anonymization vs Pseudonymization?	Data Controller: The entity that determines the purposes ('why') and means ('how') of processing personal data (holds primary regulatory liability). Data Processor: A third party (e.g., AWS or payroll vendor) that processes personal data strictly on behalf of and under instructions from the Controller. Pseudonymization replaces direct identifiers with a reversible alias/token (data STILL falls under GDPR scope). Anonymization irreversibly strips or aggregates identifiers (e.g., k-anonymity, differential privacy) so individuals can never be re-identified (no longer personal data under GDPR).
5	What are the NIST SP 800-88 R1 three methods of Media Sanitization: Clear, Purge, and Destroy?	Clear: Applies logical techniques (overwriting all user-addressable storage locations with zeros/random patterns) to protect against simple non-invasive keyboard/OS recovery (suitable when reusing media internally). Purge: Applies physical or cryptographic techniques—such as Degaussing (magnetic tapes/HDDs only—useless on SSDs!) or Cryptographic Erase (destroying the SED's internal encryption key in flash)—rendering data unrecoverable even against state-of-the-art laboratory forensics. Destroy: Physical disintegration, incineration, shredding, or smelting (mandatory for failed drives leaving top-secret facilities).
6	Compare CSPM, CWPP, CIEM, and CNAPP in Cloud-Native Security.	CSPM (Cloud Security Posture Management): Continuously audits cloud control-plane APIs (AWS/Azure/GCP) for misconfigurations (e.g., public S3 buckets, open `0.0.0.0/0` security groups, missing MFA) and compliance drift. CWPP (Cloud Workload Protection Platform): Protects the runtime workloads themselves (VMs, containers, Kubernetes pods, serverless functions) via vulnerability scanning and runtime eBPF behavioral monitoring. CIEM (Cloud Infrastructure Entitlement Management): Detects over-privileged IAM roles and enforces least privilege. CNAPP (Cloud-Native Application Protection Platform): Unifies CSPM, CWPP, CIEM, and IaC scanning from code to cloud.
7	Compare Vulnerability Scanning (Credentialed vs Non-Credentialed) and Penetration Testing, and explain SCAP (`OVAL`, `XCCDF`, `CPE`).	Vulnerability Scanning is an automated, continuous breadth search identifying missing patches and misconfigurations; Credentialed (Authenticated) scans log into hosts via SSH/WMI to inspect installed package versions and registry keys with far fewer false positives than Non-Credentialed network banner scans. Penetration Testing is a goal-oriented, active exploitation engagement chaining flaws to prove business impact. SCAP (Security Content Automation Protocol) standardizes automated compliance checking using `XCCDF` (checklists), `OVAL` (vulnerability assessment logic), and `CPE` (product naming).
8	Work through a Quantitative Risk Analysis & Safeguard Cost-Benefit calculation: An asset worth $200,000 faces a threat that destroys 50% of its value once every 5 years. A control costs $12,000/year and reduces ARO to 0.05. Is the safeguard worth buying?	1. `SLE = AV * EF = $200,000 * 0.50 = $100,000`. 2. `ALE_prior = SLE * ARO_prior = $100,000 * (1/5 = 0.20) = $20,000/year`. 3. `ALE_post = $100,000 * 0.05 = $5,000/year`. 4. `Net Value of Safeguard = (ALE_prior - ALE_post) - Annual Cost of Safeguard = ($20,000 - $5,000) - $12,000 = +$3,000/year`. Because the net value is positive (+$3,000/year saved), the safeguard IS financially justified.
9	What are CPTED (Crime Prevention Through Environmental Design), Mantraps (Access Control Vestibules), Faraday Cages, and TEMPEST?	CPTED uses natural architectural design—Natural Surveillance (clear sightlines, lighting), Natural Access Control (bollards, landscaping paths), and Territorial Reinforcement (fencing, signage)—to deter physical crime. A Mantrap (Access Control Vestibule) uses two interlocking doors where the first must close and verify identity/weight before the second opens to prevent tailgating. A Faraday Cage blocks electromagnetic fields/RF signals. TEMPEST is the NSA specification for shielding equipment against eavesdropping via unintentional electromagnetic emanations (Van Eck phreaking).
10	Compare Fire Suppression classes (Class A, B, C, D, K) and Data Center Wet Pipe, Dry Pipe, Pre-Action, and Clean Agent (FM-200 / Novec 1230) systems.	Fire Classes: A (ordinary combustibles: wood/paper -> water); B (flammable liquids -> foam/CO2); C (energized electrical equipment -> non-conductive gas/clean agent); D (combustible metals); K (kitchen oils). Data Center sprinklers: Wet Pipe keeps water in pipes up to the head (risk of water damage if bumped); Pre-Action (ideal for server rooms) holds water back behind a valve until BOTH a smoke/heat detector triggers AND the sprinkler fusible link melts. Clean Agents (FM-200, Novec 1230 / FK-5-1-12, Inergen) extinguish electrical fires via heat absorption/chemical interruption without damaging electronics or depleting oxygen like legacy Halon/CO2.
11	Classify Security Controls by Type (Preventive, Detective, Corrective, Deterrent, Compensating, Directive) and by Implementation (Technical, Managerial, Operational, Physical).	Preventive: Stops an incident from occurring (firewall block, MFA, mantrap). Detective: Identifies and alerts on active/past incidents (IDS, SIEM, CCTV, audit logs). Corrective: Restores systems after an incident (backups, EDR quarantine, patching). Deterrent: Discourages attackers (`Warning` banners, lighting, visible guards). Compensating: Alternative control used when a primary requirement (e.g., PCI DSS on legacy mainframe) cannot be met directly. Directive: Administrative policies and acceptable use guidelines.
12	What are key Container and Kubernetes security hardening controls (Docker & K8s)?	1. Never run containers as `root` (`runAsNonRoot: true`, drop Linux `CAP_SYS_ADMIN` capabilities) or in `--privileged` mode (which exposes the host kernel and devices); 2. Mount the container root filesystem as read-only (`readOnlyRootFilesystem: true`); 3. Scan base images for CVEs and verify cryptographic signatures (Cosign); 4. Restrict pod-to-pod East-West traffic using Kubernetes `NetworkPolicies`; 5. Enforce Pod Security Standards (`Restricted` profile), RBAC least privilege, and encrypt `etcd` Secrets at rest.
13	Compare the 4 phases of the NIST SP 800-61 Incident Response Lifecycle with the 6 phases of the SANS PICERL model.	NIST SP 800-61 combines intermediate steps into 4 phases: 1. Preparation; 2. Detection and Analysis; 3. Containment, Eradication, and Recovery; 4. Post-Incident Activity (Lessons Learned). SANS PICERL explicitly separates them into 6 sequential phases: 1. Preparation; 2. Identification; 3. Containment; 4. Eradication; 5. Recovery; 6. Lessons Learned.
14	What is User and Entity Behavior Analytics (UEBA), and how does it detect Insider Threats and compromised credentials?	Unlike static rule-based SIEM correlation, UEBA applies machine learning and statistical profiling to establish baselines of normal behavior for every human user and machine entity (service accounts, IoT, hosts). When an employee's account suddenly downloads 50 GB of source code from GitHub at 3:00 AM or queries unusual SMB shares laterally, UEBA raises the entity's risk score even though no malware signature was triggered.
15	Compare SIEM, SOAR, EDR, and XDR in modern Security Operations Centers (SOCs).	SIEM (Security Information and Event Management): Aggregates, normalizes, and correlates logs/events from across the enterprise (firewalls, AD, cloud, endpoints) for compliance, alerting, and threat hunting. SOAR (Security Orchestration, Automation, and Response): Executes automated playbooks/runbooks (e.g., enriching phishing indicators via VirusTotal API, opening a Jira ticket, and isolating a host) to reduce MTTR. EDR (Endpoint Detection and Response): Kernel/user telemetry agent on endpoints recording process trees, memory injections, and allowing remote containment. XDR: Unifies telemetry across Endpoint, Network (NDR), Cloud, and Email into a single vendor-integrated detection and response platform.
16	Explain the Cloud Shared Responsibility Model across IaaS, PaaS, and SaaS.	In all cloud models, the Customer is ALWAYS responsible for their own Data, Endpoints, Identities/Access Management (IAM), and Classification. IaaS (EC2, Compute Engine): Provider secures physical data center, hardware, storage, and hypervisor; Customer secures Guest OS patching, host firewall, network configuration, runtime, and application code. PaaS (RDS, App Engine): Provider also manages Guest OS and runtime patching; Customer manages application code/configuration and data. SaaS (Microsoft 365, Salesforce): Provider manages the full application stack; Customer manages data, user permissions, and SaaS security posture.
17	How do you maintain Forensic Integrity and Chain of Custody when acquiring a disk image?	1. Document the Chain of Custody log (who handled the evidence, what item/serial number, when, where stored, and why at every transfer); 2. Connect physical storage through a Hardware Write Blocker so the investigator's OS cannot alter timestamps or metadata; 3. Capture a bit-for-bit forensic image (`dd`, `dcfldd`, FTK Imager, E01 format) including unallocated slack space and deleted sectors; 4. Compute SHA-256 cryptographic hashes of the original drive and the forensic image to prove mathematical identity, and perform all analysis exclusively on a working copy.
18	Differentiate between NDA, SLA, MSA, MOU/MOA, BPA, and ISA in third-party vendor governance.	NDA (Non-Disclosure Agreement): Legally binds parties to protect confidential information. MSA (Master Service Agreement): Umbrella contract establishing overarching legal terms for future work. SLA (Service Level Agreement): Defines measurable performance metrics (uptime %, MTTR response times) and financial penalties. MOU / MOA (Memorandum of Understanding/Agreement): Document of mutual intent and cooperation before a formal contract. BPA (Business Partners Agreement): Outlines profit/obligation sharing. ISA (Interconnection Security Agreement): Technical security requirements for linking two organizations' IT networks.
19	What are Slack Space, Wear Leveling / TRIM challenges on SSDs, and Legal Hold in eDiscovery?	Slack Space is the unused portion of a fixed-size filesystem cluster between the end of a file (`EOF`) and the end of the allocated cluster—which may retain remnants of previously deleted files. Modern SSDs use Wear Leveling and garbage collection (`TRIM`), which automatically zeroes out deleted blocks in the background, making traditional deleted-file recovery nearly impossible compared to magnetic HDDs. A Legal Hold (Litigation Hold) is a mandatory legal directive suspending normal data retention/deletion schedules to preserve all electronically stored information (ESI) relevant to pending litigation.
20	Compare the four Risk Treatment (Risk Response) strategies: Risk Mitigation, Risk Transfer, Risk Avoidance, and Risk Acceptance.	Mitigation (Reduction): Implementing security controls to reduce the likelihood (ARO) or impact (EF) of a risk. Transfer (Sharing): Shifting the financial impact of a risk to a third party (e.g., purchasing cyber insurance or outsourcing to a cloud provider—note that legal/regulatory accountability can NEVER be transferred). Avoidance: Ceasing the business activity or decommissioning the system that creates the risk. Acceptance (Retention): Formally documenting and accepting the risk when the cost of controls exceeds the potential loss (requires senior management sign-off).
21	What is the RFC 3227 Order of Volatility for Digital Forensics evidence collection, from most volatile to least volatile?	Evidence must be collected from most volatile to least volatile: 1. CPU Registers and L1/L2/L3 Cache; 2. System RAM (Memory dump via LiME/WinPmem), routing tables, ARP cache, active network connections (`netstat`), and running processes; 3. Temporary file systems / Swap space / Pagefile (`pagefile.sys`, `hiberfil.sys`); 4. Non-volatile Local Disks (SSD/HDD bit-stream image); 5. Remote logging and monitoring data; 6. Physical configuration and network topology; 7. Archival media / Offline Backups.
22	Compare Cold Site, Warm Site, Hot Site, and Cloud Active-Active Disaster Recovery sites.	Cold Site: Leased physical building with power, HVAC, and racks, but NO servers or data installed (lowest cost, weeks to recover). Warm Site: Pre-installed networking and server hardware (often scaled down), requiring latest backups to be loaded (hours to days to recover). Hot Site: Fully redundant, mirrored infrastructure with near-real-time data replication ready to take over in minutes (highest traditional cost). Cloud Multi-Region Active-Active: Live traffic served simultaneously across geographically dispersed regions with zero-downtime automatic DNS/Anycast failover.
23	Compare Disaster Recovery Testing methods: Checklist Review, Tabletop Exercise, Walkthrough, Simulation, Parallel Test, and Full Interruption Test.	Checklist Review: Leaders individually review DR plan currency. Tabletop Exercise: Stakeholders talk through a hypothetical disaster scenario around a conference table without touching production systems. Simulation: Technical teams practice recovery steps in a non-production sandbox environment. Parallel Test: DR site is brought up and processes live transactions alongside the primary site to verify output consistency without cutting over primary traffic. Full Interruption (Cutover) Test: Primary production site is actually shut down to verify real failover (highest validation, highest operational risk).
24	In CISA Auditing, define Audit Risk (`AR = IR * CR * DR`) and explain Statistical vs Non-Statistical (Judgmental) Sampling and Stop-or-Go Sampling.	Audit Risk (`AR`) is the risk an auditor gives an clean opinion when material weaknesses exist: `AR = Inherent Risk (IR) * Control Risk (CR) * Detection Risk (DR)`. Statistical Sampling uses probability theory so results can be mathematically extrapolated to the entire population with a quantified confidence level. Judgmental Sampling relies on auditor expertise to target high-risk items (cannot be statistically extrapolated). Stop-or-Go (Sequential) Sampling tests small increments and stops early when virtually zero errors are expected.
25	Map these major frameworks and regulations to their primary domains: ISO/IEC 27001 & 27002, NIST CSF 2.0, SOC 2 (Type I vs Type II), PCI DSS, and HIPAA.	ISO/IEC 27001: International standard for specifying and certifying an Information Security Management System (ISMS; 27002 provides control implementation guidance). NIST CSF 2.0: 6 core functions—Govern, Identify, Protect, Detect, Respond, Recover. SOC 2 (AICPA Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, Privacy): Type I audits control design at a single point in time; Type II audits operational effectiveness over 6–12 months. PCI DSS: Mandatory standard for organizations handling branded credit card (PAN) data. HIPAA: US healthcare Protected Health Information (PHI) privacy/security.
26	Compare Full, Incremental, and Differential Backups across backup speed, storage usage, and restoration speed, and explain the 3-2-1-1-0 Backup Rule.	Full: Copies all selected data and clears the archive bit (slowest backup, fastest single-step restore). Differential: Copies all data changed since the LAST FULL backup without clearing the archive bit (requires 2 sets to restore: Last Full + Latest Differential). Incremental: Copies only data changed since the LAST BACKUP OF ANY TYPE and clears the archive bit (fastest backup/least storage, requires Last Full + EVERY Incremental in sequence to restore). 3-2-1-1-0 Rule: 3 copies of data, on 2 different media types, 1 copy offsite, 1 copy immutable/air-gapped (WORM/Object Lock against ransomware), and 0 unverified backup errors.
27	Why do Cloud Forensics and Container Forensics differ from traditional on-premises disk forensics?	In public cloud and Kubernetes environments, physical hardware is abstracted and multi-tenant (you cannot seize a physical hard drive in AWS/GCP), and containers are ephemeral. Investigators instead use cloud APIs to take point-in-time EBS/Persistent Disk snapshots, isolate instances via quarantine Security Groups (preserving IAM metadata and memory), inspect immutable CloudTrail/VPC Flow Logs, and pause/checkpoint containers (`docker commit` / CRIU) before termination.
28	In CISA Information Systems Auditing, what is the difference between Compliance Testing (Tests of Controls) and Substantive Testing?	Compliance Testing evaluates whether internal security controls are operating consistently in accordance with management policies (e.g., verifying that a sample of 30 production change tickets all have documented CAB approval signatures—often using Attribute Sampling). Substantive Testing directly verifies the integrity and accuracy of actual underlying data, transactions, or account balances (e.g., recalculating ledger totals or running a full configuration scan—often using Variable Sampling). Strong compliance test results allow an auditor to reduce the scope of substantive testing.
29	During Incident Response, what happens in Containment (Short-Term vs Long-Term), Eradication, and Recovery?	Containment stops the bleeding so damage does not spread: Short-Term Containment immediately isolates the affected host (e.g., EDR network quarantine or VLAN ACL change while keeping power on for memory forensics); Long-Term Containment applies temporary workarounds/firewall blocks to keep production running while rebuilding clean systems. Eradication removes the root cause (wiping/reimaging hosts, patching the exploited vulnerability, rotating all compromised credentials/keys). Recovery restores systems from verified clean backups and monitors intensely for reinfection.
30	Compare CASB (Cloud Access Security Broker), SWG (Secure Web Gateway), ZTNA (Zero Trust Network Access), and SASE (Secure Access Service Edge).	CASB: Sits between users and SaaS apps (via inline forward/reverse proxy or out-of-band SaaS API connectors) to discover Shadow IT, enforce DLP, and block unauthorized SaaS data sharing. SWG: Inspects outbound employee internet traffic for malware and URL filtering. ZTNA: Replaces legacy corporate network VPNs with identity- and context-aware per-application tunnels. SASE (Gartner framework): Converges SD-WAN networking with SSE (Security Service Edge: CASB + SWG + ZTNA + FWaaS) into a unified, cloud-delivered edge service.
31	Compare Mean Time Between Failures (MTBF), Mean Time To Failure (MTTF), and Mean Time To Repair/Restore (MTTR), and state the Availability formula.	MTBF: Average operational uptime between failures for a REPAIRABLE system. MTTF: Average lifespan before failure for a NON-REPAIRABLE component (e.g., a cooling fan replaced upon failure). MTTR: Average time required to diagnose, repair, and restore a failed system to service. System Availability formula: `Availability = MTBF / (MTBF + MTTR)`. ('Five Nines' `99.999%` availability allows only ~5.26 minutes of downtime per year).
32	Define Inherent Risk, Residual Risk, Control Risk, Risk Appetite, and Risk Tolerance.	Inherent Risk: The raw level of risk existing before any security controls are applied. Residual Risk: The remaining risk that persists AFTER security controls have been implemented (`Residual Risk = Inherent Risk - Controls`); senior management must formally accept residual risk. Risk Appetite: The broad, high-level amount of risk an organization is willing to pursue to achieve strategic objectives. Risk Tolerance: The specific, measurable acceptable variance around risk appetite metrics.