User Mode vs Kernel Mode

Distinguish spyware, adware and ransomware by their behaviour and intended impact.

Distinguish viruses, worms, trojans and rootkits by their infection and concealment methods.

Explain how a social-engineering attack deceives a user into revealing information or performing an unsafe action.

Identify network, organisational, software, operating-system, mobile, physical and user-process vulnerabilities in a scenario.

Explain how SQL injection exploits insecure handling of database input.

Explain why zero-day vulnerabilities create a period of heightened risk.

Analyse the security implications of cloud computing and Internet of Things devices.

Answer an exam-style scenario question that maps Wi-Fi, Bluetooth, internet and internal-network attack vectors to relevant vulnerabilities.

Apply UK GDPR and data-protection requirements to an organisation responsible for personal data.

Apply the Computer Misuse Act 1990 to examples of unauthorised access, unauthorised modification and related offences.

Apply the Telecommunications (Lawful Business Practice) Regulations to workplace monitoring scenarios.

Apply the Fraud Act 2006 to an IT-enabled information-theft scenario.

Identify relevant employer and employee duties under the Health and Safety at Work etc. Act 1974.

Evaluate locks, card entry, biometrics, CCTV, security staff, alarms, protected cabling and secure cabinets for a specified site.

Compare on-site, off-site and cloud backup storage in terms of security and recoverability.

Answer an exam-style recommendation question about scheduled automated backups for a given organisation.

Explain how user mode and kernel mode separate privileges and limit the damage caused by faulty or malicious processes.

Compare signature-based and heuristic malware detection and select an appropriate response to an identified threat.

Explain how packet filtering, packet inspection, application awareness, inbound rules, outbound rules and network address translation are used by firewalls.

Select suitable authentication methods from passwords, biometrics, two-step verification, security tokens and knowledge-based authentication.

Explain how Kerberos and certificate-based authentication establish trust in a networked system.

Apply access rights and least privilege to restrict access to applications, folders, files and physical resources.

Select suitable encryption for password storage, digital rights management, files, folders and disks.

Answer an exam-style comparison question about HTTPS, virtual private networks, Tor, digital certificates and public/private keys.

Compare the applications and security implications of LANs, WLANs, WANs, SANs and PANs.

Compare the security boundaries of an intranet, extranet, the internet and a cloud environment.

Analyse the security implications of star, extended-star, hierarchical, wireless-mesh and ad-hoc topologies.

Compare peer-to-peer, client/server and thin-client architectures from a security perspective.

Analyse security risks introduced by virtualisation, cloud computing and bring your own device arrangements.

Analyse security risks introduced by software-defined networking, storage-defined networking and Internet of Things devices.

Interpret the devices, links, trust boundaries and data flows shown on a network schematic.

Answer a network-design practice question by amending a schematic with segmentation and justified security controls.

Select switches, routers, wireless access points, multifunction devices, USB hubs and modems for a specified network role.

Compare copper cable, fibre, Wi-Fi, Bluetooth, infrared and Li-Fi connection media from a security perspective.

Assess the risks of mobile devices, flash drives and optical media within an organisational network.

Select operating-system, monitoring, event-log, vulnerability-scanning, packet-sniffing and discovery tools for specified tasks.

Explain how TCP/IP, ports and packets enable network communication and expose possible attack surfaces.

Interpret IPv4, IPv6 and RFC 1918 private addresses and explain the security role of network address translation.

Explain how domains, subdomains, directory services and authentication services support controlled network access.

Answer short practice questions on the security relevance of DNS, DHCP, routing, remote access, file, print, web, mail and communication services.

Select a port scanner, registry checker, website scanner or vulnerability-management tool for a specified assessment.

Assess user-related vulnerabilities by examining permissions, password behaviour, training and working practices.

Explain the value of an independent third-party review before a network design is implemented.

Define the scope, authorisation and safety limits of an ethical penetration test.

Map selected OWASP Top 10 weaknesses to plausible attacks and controls in a web-system scenario.

Find current information about a named hardware or software vulnerability using a reputable vulnerability source.

Calculate risk severity from the probability of a threat and the expected impact of loss.

Complete a practice risk-register entry linking an asset, threat, vulnerability, probability, impact and severity rating.

Prioritise medium, high and extreme risks by probability and impact.

Select hardware protection measures for the highest-priority risks in a network scenario.

Select software and physical protection measures for the highest-priority risks in a network scenario.

Choose between risk reduction, transfer, avoidance and acceptance for a specified risk.

Write a supported justification linking a proposed control to a threat, vulnerability and expected risk reduction.

Analyse how technical constraints, financial constraints, legal duties and usability affect a proposed control.

Perform a simple cost–benefit comparison of alternative security controls.

Answer a test-plan practice question using a test description, expected outcome and possible follow-up action.

Explain how the Plan–Do–Check–Act cycle supports continuous security improvement under ISO 27001 principles.

Identify the required content of internet-use, email-use, password, staff-responsibility and security-training policies.

Use a security audit result to judge whether staff and systems comply with an organisational policy.

Design a backup policy specifying selected data, full or incremental methods, frequency and storage location.

Design a data-protection policy that addresses relevant legal and organisational responsibilities.

Evaluate whether a set of general IT policies addresses the risks in a given organisation.

Rewrite an ambiguous security-policy rule so that it is specific, enforceable and testable.

Answer an evaluation question by recommending policy and training improvements supported by scenario evidence.

Assign team-leader, incident-lead and associate-member responsibilities within a Computer Security Incident Response Team.

Design an incident-reporting route that defines reportable events, recipients and required information.

Perform an initial incident assessment to confirm the incident type, severity and affected systems.

Choose containment actions that protect people, sensitive data, hardware and service availability.

Identify an incident's likely nature, intent, origin and compromised systems from initial evidence.

Specify how to preserve evidence, notify appropriate external parties and obtain legal guidance.

Select a clean recovery point and outline how systems and data should be restored.

Answer a disaster-recovery scenario question using recovery time objective, recovery point objective and an ISO-aligned plan structure.

Identify security clauses required in cloud, hardware and software service-provider agreements.

Analyse how legal ownership, jurisdiction, geographical location and cross-border data movement affect an agreement.

Evaluate contractual duties for privacy, encryption, breaches, data loss, liability and disaster recovery.

Recommend provisions for secure data return or deletion when a service-provider agreement ends.

Explain how statutory requirements and multiple jurisdictions affect dispute resolution.

Outline a desktop-forensics process covering device confiscation, imaging, forensic tools, files, settings, logs and user activity.

Explain how live data, active memory, temporary files and corruption complicate live forensics.

Answer a forensic-planning question covering authorisation, non-disruptive network scanning, infrastructure logs and malware alerts.

Create a contemporaneous forensic record containing timestamps, system snapshots, investigator actions and observed alterations.

Assess the reliability and relevance of a forensic finding and test whether it may be a false positive.

Use desktop and network evidence to decide whether a system was internally or externally compromised.

Compare a leading explanation for an incident with at least one plausible alternative cause.

Recommend justified improvements to security documentation, policy adherence and technical controls from forensic findings.

Use the Part A and Part B assessment structure and grade descriptors to allocate time and self-mark a practice response.

Complete a timed secure-network planning question covering risks, controls, constraints, legal duties, usability, costs and testing.

Write a distinction-level conclusion that combines technical evidence, supported judgement, alternative possibilities and realistic recommendations.