Free lesson 1: How the Exam Works, the 5-Domain Map and Your Study Plan
Your first security certification exam is not a trivia contest. It tests whether you can read a short workplace scenario, recognise which part of security it belongs to, and pick the answer a careful professional would choose. This lesson shows you how these exams are built, gives you a five-domain map of everything they cover, walks you through a fully solved scenario question, and hands you a study plan for 4, 8 or 12 weeks.
- 12lessons, one per exam topic area plus a final review
- 5domains that organise every topic
- 70practice questions: 30 in the review lesson, 40 in the final test
- ~22 minreading time for this lesson
How entry-level security certification exams work
This course prepares you for the vendor-neutral topics that entry-level exams such as CompTIA Security+ or ISC2 Certified in Cybersecurity (CC) have in common, but it is not tied to any one exam. Whatever badge you aim for, the body of knowledge is remarkably stable: the same principles, attack families, control types and incident process appear again and again in different wording.
What changes between providers is the packaging. The number of questions, the time limit, the passing mark, whether there are hands-on items and whether you can go back to earlier questions are all set by the provider and can change with each exam version. Most entry-level exams give you somewhere between one and two hours for several dozen to around a hundred questions. Many report a scaled score rather than a simple percentage, which means you cannot reliably convert "I got 70 % right" into "I passed". Treat the provider's official exam page as the only source of truth for these numbers.
Independent course, not affiliated with or endorsed by any exam provider. Exam objectives change — always check the official objectives. We do not publish real exam questions. Every question in this course is written by us to teach a concept. And whenever a lesson touches attack techniques: only test what you own or are explicitly authorised to test.
The question formats you will meet
Knowing the shape of a question in advance lets you switch into the right reading mode before you think about content.
| Format | What it looks like | What it really tests | How to approach it |
|---|---|---|---|
| Single-answer multiple choice | A short stem, four options, one correct | Definitions and "which control fits" | Answer in your head before reading the options |
| Multiple response | "Choose two" or "select all that apply" | Whether you know the full set, not just one item | Treat each option as true/false on its own |
| Scenario question | A paragraph about a company, a log line or a symptom, then BEST / FIRST / MOST | Judgement and process order | Read the last sentence first, then hunt for facts |
| Performance-based item (on some exams) | Drag-and-drop matching, ordering steps, filling a firewall rule table, reading a log | Applied skill under time pressure | If navigation is allowed, flag and return after the quick questions |
The five-domain map: everything an entry-level exam covers
Security knowledge looks endless as a list of acronyms and becomes manageable once you hang every term on one of five hooks. Use the map below as a filing system: whenever you learn something new, ask which domain it belongs to.
| Domain | What lives here | Typical question verbs | Lessons |
|---|---|---|---|
| D1 General security concepts | CIA triad, AAA, control categories and types, cryptography, PKI, identity and access models, Zero Trust | define, compare, classify | 1, 3, 4 |
| D2 Threats, vulnerabilities and mitigations | Threat actors and motives, social engineering, malware, network and application attacks, vulnerability types, indicators | identify, recognise, match | 2 |
| D3 Security architecture | Network design, firewalls, VPNs, segmentation, endpoint and mobile protection, cloud models, secure baselines and hardening | design, choose, place | 5, 6, 7 |
| D4 Security operations | Logging, SIEM, monitoring, vulnerability management, incident response, digital forensics basics | analyse, prioritise, respond | 8, 9 |
| D5 Governance, risk and compliance | Risk analysis, policies, frameworks, audits, privacy, third parties, physical security, business continuity and disaster recovery | assess, justify, document | 10, 11 |
The verbs column is the hidden key: D2 questions ask you to recognise something from its symptoms, D3 to choose a design, D4 to order actions, D5 what an organisation should decide or document. When a question feels ambiguous, naming its real verb often settles it.
The three ideas that appear in every domain
The CIA triad. Confidentiality means only authorised parties can read data. Integrity means data and systems are not changed without authorisation, and changes can be detected. Availability means authorised users can reach systems and data when they need them. Ransomware hits availability (and often confidentiality, through theft before encryption), a defaced website hits integrity, a leaked customer list hits confidentiality.
AAA and non-repudiation. Authentication proves who you are, authorisation decides what you may do, and accounting records what you did. Non-repudiation means someone cannot credibly deny an action, which in practice needs a digital signature or equally strong evidence tied to one identity. A user who logs in but receives "403 Forbidden" passed authentication and failed authorisation – a favourite exam trap.
Controls by category and type. Every safeguard can be described twice: by category (how it is implemented) and by type (what it does in time). This double classification is one of the most frequently tested ideas at entry level.
| Control type | Job | Technical example | Managerial / operational example | Physical example |
|---|---|---|---|---|
| Preventive | Stops it happening | Firewall deny rule, MFA | Background checks, change approval | Locked server room |
| Deterrent | Discourages the attempt | Login banner warning of monitoring | Published disciplinary policy | Visible guard, warning signs |
| Detective | Notices it happened | IDS alert, file integrity monitoring | Log review, audits | CCTV, motion sensor |
| Corrective | Limits damage and restores | Restore from backup, auto-quarantine | Incident response plan | Fire suppression |
| Compensating | Alternative when the ideal control is not possible | Isolating a legacy system that cannot be patched | Extra supervision instead of separation of duties | Guard where a lock cannot be installed |
| Directive | Tells people what to do | Pop-up requiring policy acceptance | Acceptable use policy | "Authorised staff only" sign |
The usual categories are technical, managerial (policies and decisions, sometimes called administrative), operational (done by people day to day) and physical. One control can carry several labels: a camera is physical, detective because it records, and deterrent because people see it. Pick the label that matches the job the stem describes.
How scenario questions think: BEST, FIRST, MOST and LEAST
Most points on entry-level exams are lost not on knowledge but on reading. A scenario question has three parts: a stem that sets the scene, a qualifier that defines what "correct" means, and options that usually include one right answer, one tempting near-miss, and two answers that are true in general but wrong here.
- 1 Question lineread the last sentence first
- 2 QualifierBEST, FIRST, MOST, LEAST, NOT
- 3 Factsconstraints, phase, asset
- 4 Domainwhich of the five?
- 5 Eliminateout of scope, wrong phase
- 6 Decidecompare the final two
The qualifier is everything. FIRST is about process order: identify before you contain, contain before you eradicate. BEST is about fit: the option that solves the stated problem within the stated constraints, not the most powerful technology. MOST likely means the common cause, not the exotic one. LEAST and NOT reverse the question, and tired eyes read past them.
Worked example: a scenario question solved step by step
A question in exam style, written by us for this course. Try to answer it before you read the solution.
A user in the finance department reports that she clicked a link in an email that appeared to come from the IT helpdesk, entered her password on the page that opened, and approved the MFA prompt on her phone "because it popped up right then". The identity provider's sign-in log for her account shows the entries below. Which of the following should the security analyst do FIRST?
# Example output: identity provider sign-in log (simplified, lab data)
time (UTC) user result source_ip client mfa
2026-03-12 09:14:03 l.meier success 198.51.100.23 Outlook/Win push approved
2026-03-12 09:26:41 l.meier success 203.0.113.77 Browser/Linux push approved
2026-03-12 09:27:10 l.meier action 203.0.113.77 New-InboxRule forward-to: archive@mail.example.net
2026-03-12 09:31:55 l.meier action 203.0.113.77 Search-Mailbox query: "invoice" OR "IBAN"- Reimage the user's laptop to remove any malware.
- Disable the account or reset its password, and revoke all active sessions and tokens.
- Send an urgent phishing-awareness reminder to all employees.
- Block the sender's domain on the email gateway.
- Read the question line and circle the qualifier. "Which should the analyst do FIRST?" This is a process-order question. All four options might be reasonable at some point; only one belongs at the top of the list.
- Extract the facts from the stem and the log. The 09:14 sign-in comes from the user's usual client. The 09:26 sign-in comes from a different address and a different client, twelve minutes later, and it was approved through MFA – exactly the push the user accepted. One minute after that, the new session creates a rule that forwards mail to an outside address, then searches the mailbox for payment terms. That is an attacker with a live session, setting up persistence and looking for money.
- Place it in the incident process. Detection has already happened: the user reported it and the log confirms it. The next phase is containment. Anything that belongs to eradication, recovery or lessons learned comes later.
- Eliminate by phase and scope. Option A is eradication or recovery, and there is no evidence of malware on the laptop at all – the compromise happened in the browser and at the identity provider. Option C is a lessons-learned or awareness action; useful, but it does nothing about the attacker reading mail right now. Option D is a reasonable containment step for the email vector, but the attacker no longer needs the email: they already hold a valid session.
- Decide between the last candidates. B removes the attacker's access to the mailbox. Resetting the password alone is not enough, because an existing session or refresh token can keep working; that is why the option also revokes sessions. B is correct.
- Know what comes next. A real analyst would then remove the forwarding rule, check what was searched and sent, look for the same email in other inboxes, block the domain and URL, preserve the logs, and finally report and run awareness training. Exams sometimes ask for the SECOND step.
The user had MFA and the attacker still got in. A fake login page that relays your password and your push approval to the real site in real time is called an adversary-in-the-middle phishing attack. Push and SMS codes do not stop it. Phishing-resistant methods such as FIDO2 security keys or passkeys do, because they cryptographically bind the login to the real website's domain. Expect this distinction in Lessons 2 and 4.
A second worked example: a risk calculation
Governance questions sometimes include a small calculation. The classic quantitative risk formulas fit on one line each, and once you have done one example by hand they stop being scary.
- SLE (single loss expectancy) = asset value × exposure factor (the fraction of value lost in one event).
- ARO (annualised rate of occurrence) = how many times per year you expect the event.
- ALE (annualised loss expectancy) = SLE × ARO.
Scenario: a small online shop values its customer database at CHF 200,000. A breach would cost about a quarter of that value in clean-up, notification and lost business, so the exposure factor is 0.25. The team estimates such a breach once every five years, so the ARO is 0.2.
SLE = 200,000 × 0.25 = 50,000 CHF per event
ALE = 50,000 × 0.2 = 10,000 CHF per year
Proposed control: database encryption + monitoring, cost 4,000 CHF per year
New ARO estimate: once every twenty years = 0.05
New ALE = 50,000 × 0.05 = 2,500 CHF per year
Risk reduction = 10,000 − 2,500 = 7,500 CHF per year
Value of control = 7,500 − 4,000 = 3,500 CHF per year → worth doingThe exam logic is simple: a control is financially justified when the reduction in ALE is larger than the yearly cost of the control. If the control cost 9,000 per year, it would cost more than it saves, and accepting or transferring the risk (for example through cyber insurance) could be the better business decision. Lesson 10 covers when each risk response fits.
Memory hooks you can build on
The hooks below are our own; replace them with sillier ones if you like, because silly sticks better. Each list is explained fully in a later lesson.
| What you need to remember | The list | Hook |
|---|---|---|
| Incident response phases (classic model) | Preparation, Detection, Analysis, Containment, Eradication, Recovery, Lessons learned | "Please Don't Ask Cats to Eat Raw Lettuce" |
| Order of volatility for evidence | CPU registers and cache, RAM and running state, temporary files, disk, remote logs, archives | "Hot to cold": collect what dies first, first |
| Risk responses | Avoid, Transfer, Mitigate, Accept | "A TMA": walk away, hand over, reduce, or sign off |
| Access control models | DAC (owner decides), MAC (labels decide), RBAC (job role decides), ABAC (attributes decide) | "Who decides?" – owner, label, role or rule set |
| Symmetric vs asymmetric | Symmetric: one shared key, fast, bulk data. Asymmetric: key pair, slow, key exchange and signatures | "Sym = same" |
| Signing vs encrypting with key pairs | Encrypt with the recipient's public key; sign with your own private key | "Lock for them, sign as me" |
One caution: the classic incident phases come from earlier revisions of NIST SP 800-61; the 2025 revision maps incident response onto the six functions of the NIST Cybersecurity Framework 2.0. Many exam objectives still use the phase names, so learn them, but check your exam's wording.
Your study plan: 4, 8 or 12 weeks
Pick the plan by your starting point, not your ambition. With IT support or networking experience, four focused weeks can be enough; if "subnet" or "hash" are new words, take twelve. All three plans use the same lessons at a different pace.
For people with IT experience, about 10–12 hours per week.
- Week 1: Lessons 1–4 (exam basics, threats, crypto and PKI, identity). End the week by rewriting the control table from memory.
- Week 2: Lessons 5–7 (network, endpoint and cloud, hardening). Draw one network diagram with zones and firewalls from scratch.
- Week 3: Lessons 8–11 (operations, incident response, governance, continuity). Do every "Check yourself" block without notes.
- Week 4: Lesson 12, the 30-question practice block, the final test, and a second pass through every lesson where you scored below 80 %.
The default plan, about 6 hours per week.
- Week 1: Lessons 1–2.
- Week 2: Lessons 3–4.
- Week 3: Lesson 5 and the start of Lesson 6.
- Week 4: Lessons 6–7 plus a short review of attack mitigations from Lesson 2.
- Week 5: Lesson 8.
- Week 6: Lessons 9–10.
- Week 7: Lesson 11 and a mixed review of Lessons 2–4.
- Week 8: Lesson 12, the practice block, the final test, and targeted repair of weak domains.
For complete beginners, about 4 hours per week.
- Weeks 1–2: Lesson 1 twice, then networking fundamentals: what an IP address, a port and a protocol are. Lesson 5 will make far more sense afterwards.
- Weeks 3–4: Lessons 2–3, one per week, with your own flashcards for every term in bold.
- Weeks 5–8: Lessons 4–8, roughly one per week, plus one block of "Check yourself" questions from earlier lessons every Sunday.
- Weeks 9–10: Lessons 9–11.
- Weeks 11–12: Lesson 12, the practice block and the final test, then a full week of repairing the weakest domain before you book the exam.
How to study, not just what
Active recall beats rereading. After each lesson, close it and write down the five things you remember. Then check. The gaps you find are exactly what the exam will find.
Explain the wrong options. For every practice question, write one line on why each wrong option is wrong in this scenario. That trains the elimination skill you need on questions you do not know.
Book the exam when you score consistently well on unseen questions, not when you have "finished the material".
Common thinking errors – and how to avoid them
These are not knowledge gaps but reasoning habits, and they cost points even for people who know the material well.
- "The strongest control must be the best answer."
- "At my company we would just…"
- "I'll fix the root cause first, then contain."
- "This option is true, so it must be correct."
- "The question is obviously about firewalls."
- "Which option solves this problem within these constraints?"
- "What does the documented best practice say?"
- "Which phase am I in, and what comes next in that process?"
- "Is it true and does it answer the question asked?"
- "Let me re-read the last sentence before I decide."
Why "most secure" is often the wrong answer
Exams describe a business. If the stem mentions a tight budget, a legacy system that cannot be changed, or a requirement that users must not be slowed down, the best answer respects those constraints. Air-gapping the entire network is extremely secure and almost never the right answer to "how should the company protect its point-of-sale terminals?" Segmentation plus monitoring usually is.
Why your workplace habits can mislead you
Real organisations take shortcuts, and experienced people sometimes answer from habit. Exams reward the documented process: get approval through change management, preserve evidence before you wipe a system, follow the incident response plan, notify according to policy. When your experience and the textbook disagree, the exam wants the textbook.
Why absolute words are a warning sign
Options containing "always", "never", "completely" or "guarantees" are often wrong, because security rarely offers absolutes. "Encryption guarantees integrity" is false (encryption alone does not); "MFA prevents all account takeovers" is false. This is a tendency, not a rule, so use it to break ties, not to answer blind.
Exam angle: how this lesson's topics are tested
Several ideas from this lesson are exam content themselves. Expect these patterns:
- Control classification. "A company installs cameras in the car park. Which type of control is this primarily?" The trap is answering "preventive". A camera does not stop anyone; it records (detective) and discourages (deterrent). Read whether the stem stresses recording or discouraging.
- Compensating controls. "A medical device cannot be patched. What should the team do?" The trap is "replace it immediately" when the stem says the device is required for operations. The expected answer is a compensating control: isolate it on its own network segment and monitor it.
- CIA mapping. "A DDoS attack takes the web shop offline. Which part of the CIA triad is affected?" Availability. The trap is "integrity", because the attack feels like damage.
- Risk formulas. A short ALE calculation, or a question about when a control is cost-justified. The trap is comparing the control's cost with the SLE instead of with the reduction in ALE.
- Process order. Any question with FIRST. The trap is jumping to eradication (reimage, delete, patch) before containment or before evidence is preserved.
Scenario: exam day, from the night before to the last minute
One possible timeline for a hypothetical exam with 90 questions in 90 minutes; scale the numbers to your exam.
- Day beforeLight review of your own one-page cheat sheet only. No new topics. Check the test centre address or your online-proctoring setup, ID requirements and allowed items.
- Minute 0–2Read the instructions. Note whether you can navigate back and flag questions; that decides your strategy.
- First passAnswer every quick question in about 45 seconds on average and flag anything slow. If navigation is allowed, skip long performance-based items and return to them. At 45 seconds per question, 90 questions take about 67 minutes, leaving around 22 minutes.
- Second passReturn to performance-based items and flagged questions. Use elimination; commit to an answer for each.
- Last 5 minutesMake sure nothing is blank. Unanswered questions score nothing; a guess among two remaining options is right half the time.
Some exams do not let you return to earlier questions. Then "skip and return" does not apply: answer each question when you see it and check the clock every ten questions.
Self-check: try these six questions
1. A company puts up signs saying "This area is monitored by CCTV" but has not yet installed any cameras. Which control type do the signs represent?
- Detective
- Deterrent
- Corrective
- Compensating
Show answer
B – the signs only discourage. Without cameras nothing is recorded, so there is no detective effect, and nothing is restored or substituted.
2. An employee logs in to the HR portal successfully but receives "access denied" when opening salary reports. Which security function is working as intended?
- Authentication failed
- Authorisation restricted the action
- Accounting blocked the login
- Non-repudiation was violated
Show answer
B – the login succeeded, so authentication worked. The denial is an authorisation decision based on the user's permissions.
3. In a scenario question, an attacker has an active session in a user's mailbox. Which action should come FIRST?
- Run a phishing simulation for all staff
- Rebuild the mail server
- Revoke the user's sessions and reset the credentials
- Write the lessons-learned report
Show answer
C – containment comes first while the attacker is active. Training and reports belong to the lessons-learned phase; rebuilding a server is out of scope because the server is not compromised.
4. An asset worth CHF 80,000 has an exposure factor of 0.5 and an ARO of 0.1. What is the ALE?
- CHF 40,000
- CHF 8,000
- CHF 4,000
- CHF 400
Show answer
C – SLE = 80,000 × 0.5 = 40,000; ALE = 40,000 × 0.1 = 4,000 per year. A is the SLE, a common trap.
5. A factory machine runs an old operating system that the vendor no longer patches, and it must stay in production. What is the BEST approach?
- Accept the risk without further action
- Isolate it on a separate network segment and monitor it as a compensating control
- Install the latest desktop antivirus and consider the risk solved
- Shut the machine down immediately
Show answer
B – the stem forbids removal, so the answer is a compensating control. Accepting without action ignores a known risk, antivirus alone does not fix missing patches, and shutting down contradicts the business requirement.
6. A user approved an MFA push that was triggered by an attacker's fake login page. Which change would BEST prevent this specific attack in future?
- Longer passwords
- SMS one-time codes instead of push
- Phishing-resistant MFA such as FIDO2 security keys or passkeys
- More frequent password changes
Show answer
C – FIDO2 and passkeys bind the login to the real site's domain, so a relaying fake page cannot use them. SMS codes can be relayed just like a push, and password length or rotation does not matter when the password is handed over directly.
You can now…
- Explain how entry-level exams are built – formats, scaled scores, and why the official objectives are the source of truth.
- File any topic into one of the five domains and name the lessons that cover it.
- Apply the CIA triad and AAA to a scenario and spot authentication-versus-authorisation traps.
- Classify controls by category and type, including compensating and directive controls.
- Decode qualifiers – BEST, FIRST, MOST, LEAST, NOT – and use them to eliminate options.
- Solve a FIRST question by placing the scenario in the incident process.
- Calculate SLE, ARO and ALE and judge whether a control is cost-justified.
- Choose a 4, 8 or 12-week plan that matches your starting point.
- Plan exam day with a time budget and a strategy for flagged questions.
Glossary
What's next in this course
- Lesson 2 – Threats, Attack Types and Vulnerabilities: recognise social engineering, malware and network and application attacks from their symptoms.
- Lesson 3 – Cryptography and PKI: hashing, symmetric and asymmetric encryption, signatures and certificates without the maths fog.
- Lesson 4 – Identity and Access: IAM, MFA and Zero Trust: access models, federation and why some MFA resists phishing.
- Lesson 5 – Network Security: Firewalls, VPNs and Segmentation: rule order, zones, secure protocols and the ports you must know.
- Lesson 6 – Endpoint, Mobile and Cloud Security Basics: EDR, device management and the shared responsibility model.
- Lesson 7 – Security Architecture and Hardening: baselines, secure design principles and resilience.
- Lesson 8 – Security Operations: Logging, SIEM and Monitoring: reading logs, tuning alerts and running vulnerability management.
- Lesson 9 – Incident Response and Forensics Basics: the full process, chain of custody and order of volatility.
- Lesson 10 – Risk, Governance, Compliance and Privacy: risk analysis, policies, frameworks and data protection duties.
- Lesson 11 – Physical and Operational Security, Business Continuity: site controls, backups, RTO and RPO, and recovery sites.
- Lesson 12 – Final Review and Exam Strategy: cheat-sheet tables, time management and 30 mixed practice questions.
Lessons 2–12 and the 40-question final test unlock with a one-time purchase – no subscription.