1Security Concepts

• 1.1The CIA triad and defense-in-depth

  Covers the three pillars that measure a security objective—confidentiality, integrity, and availability (the CIA triad)—and defense-in-depth, which avoids relying on a single control, framed as the judgment of "which of the CIA properties this incident harmed" and "where an added layer would have stopped it."

• 1.2Comparing security deployments

  Covers network, endpoint, and application security deployments, agent-based vs. agentless, legacy AV vs. NGAV, the division of roles among SIEM, SOAR, and log management, plus visibility differences in container/virtualization and cloud environments, framed as the judgment of "which deployment fills this visibility gap."

• 1.3Core security operations terms

  Covers core operations terms—threat intelligence, threat hunting, malware analysis, threat actor, risk-based analysis (RBA), reverse engineering, sliding window, threat modeling, and DevSecOps—framed as the judgment of "which concept or activity to use in this situation."

• 1.4Comparing risk, threat, vulnerability, and exploit

  Rigorously distinguishes the often-confused terms threat, vulnerability, exploit, and risk and their relationships, framed as the judgment of "which of the four does this control act on?" and "which one remains?" The axis is risk = the likelihood a threat exploits a vulnerability x impact.

• 1.5Access control models

  Covers control models—discretionary (DAC), mandatory (MAC), role-based (RBAC), attribute-based (ABAC), rule-based, and time-based—and the AAA (authentication, authorization, accounting) framework, framed as the judgment of "which model fits this requirement of who may do what, and when."

• 1.6CVSS terms, the 5-tuple, and detection methods

  Covers the CVSS metrics that measure vulnerability severity (attack vector (AV), attack complexity (AC), privileges required (PR), user interaction (UI), scope (S) plus temporal and environmental), the 5-tuple that pinpoints a compromised host from logs, and the difference between rule/signature-based and behavioral/statistical detection, framed as SOC triage judgment.