Covers security controls including technical, preventive, detective, corrective, compensating, and directive types. Reviews CIA, non‑repudiation, AAA, zero trust, and deception technologies. Addresses change‑management processes, business impacts, and version control. Also examines cryptographic solutions such as PKI, encryption, hashing, obfuscation, digital signatures, and blockchain.

Covers threat actors and motivations, major attack vectors, and common vulnerabilities across software, hardware, cloud, mobile, and supply chains. Includes malware, password, network, physical, and cryptographic attacks. Also focuses on mitigation techniques such as segmentation, access control, hardening, configuration enforcement, isolation, and patching to reduce risk

Covers secure architecture models across on‑premises, cloud, virtualization, IoT, ICS, and IaC. Applies security principles to enterprise infrastructure, communication, and access. Reviews data types, protection methods, and classification. Also addresses resilience and recovery through high availability, site planning, testing, backups, power considerations, and continuity of operations.

Covers securing computing resources through baselines, hardening, mobile and application security, and continuous monitoring. Includes asset management, vulnerability identification and remediation, and enterprise controls like firewalls, IDS/IPS, DLP, NAC, and EDR/XDR. Reviews IAM, automation, and orchestration, along with full incident response, threat hunting, forensics, and log‑based investigations.

Covers security governance through policies, standards, procedures, roles, and monitoring. Addresses risk identification, assessment, reporting, and BIA. Includes third‑party risk management, compliance requirements, and privacy obligations. Reviews audits, assessments, and penetration testing. Also emphasizes security awareness training, phishing recognition, user reporting, and behavioral monitoring.