SecurityX (CASP+) · Domain 3
Security Engineering
About 31% of the exam
Troubleshooting identity
- Assertion rejected
- metadata or certificate has expired
- Clock skew
- timestamps outside the allowed window
- Attribute mismatch
- claim names differ between parties
- Group not applied
- nesting or replication delay
- Wrong audience
- token issued for another service
- Conditional access
- policy blocks the device state
- Kerberos failure
- duplicate service principal name
- Federation loop
- redirects bounce between providers
Hardening endpoints and servers
- Baseline from a recognized benchmark
- Remove roles, features and shells
- Application allow list on servers
- SELinux or AppArmor in enforcing mode
- Group policy across the Windows estate
- Local firewall default deny inbound
- EDR with tamper protection enabled
- Patch rings from pilot to production
Network troubleshooting
- Asymmetric routing
- stateful firewall drops the return
- MTU mismatch
- large packets silently disappear
- NAT confusion
- logs show translated addresses only
- Split horizon DNS
- internal and external answers differ
- Rule shadowing
- an earlier rule already matched
- IPS false positive
- legitimate traffic blocked inline
- TLS inspection
- pinned applications refuse the proxy
- Loop or storm
- spanning tree misconfiguration
Certificate problems
- Incomplete chain
- host never serves the intermediate
- Name mismatch
- subject alternative name missing
- Expired
- renewal automation never ran
- Revoked
- OCSP or CRL says untrusted
- Weak signature
- old algorithm rejected by clients
- Key exposure
- revoke, reissue and rotate
- Pinning failure
- the key changed under the client
- Trust store
- the root is simply missing
Hardware roots of trust
Boot chain
- Secure boot verifies each stage
- Measured boot records what loaded
- Firmware keys control what may run
- Attestation reports the measurements remotely
Key storage
- TPM binds keys to the platform
- HSM operates on keys that never leave
- Self-encrypting drive holds the media key
- Cloud and virtual HSM options exist
- The root of trust anchors everything above
Tamper and supply
- Anti-tamper seals and switches
- Zeroize keys on intrusion detection
- Verify firmware signatures before flashing
- Anti-rollback counters stop downgrade
Cryptographic implementation
Key management
- Separate duties for key custody
- Rotate on schedule and on compromise
- Envelope encryption limits master key use
- Escrow only what must be recoverable
- Log every key operation
Protocol choices
- TLS 1.3 with forward secrecy
- Authenticated modes such as GCM
- Never ECB, never a static IV
- Certificate based mutual authentication
- HSTS to stop protocol downgrade
Post-quantum
- Harvest now, decrypt later is real
- Inventory algorithms and where they run
- Plan hybrid key exchange first
- Double the symmetric key length
- Agility beats a single migration
A static initialization vector turns a strong cipher into a pattern generator, so review modes and randomness as carefully as key length
Secrets management
- Request
- Issue a short lease
- Use
- Rotate
- Revoke
- Audit
- No credentials in source control
- Vault issues short lived leases
- Dynamic secrets per workload
- Rotate automatically after every use
- Scan repositories and build logs
- Bind machine identity to the workload
Automation and pipelines
- Infrastructure as code
- reviewable, repeatable environment builds
- Policy as code
- guard rails evaluated before deployment
- Pipeline scanning
- secrets, dependencies and configuration
- Signed artifacts
- provenance verified before running
- Orchestration
- workflow spanning many tools
- Idempotence
- safe to run the action twice
- API integration
- authenticate and rate limit calls
- Drift detection
- reality compared with the code
API and application flaws
- Object authorization
- identifier changed, access still granted
- Function authorization
- admin endpoint left unprotected
- Token replay
- bind the token to the client
- Confused deputy
- one service trusted too broadly
- Server-side request forgery
- server fetches an internal address
- No rate limiting
- abuse scales without friction
- Injection
- input reaching an interpreter unchecked
- Deserialization
- hostile objects rebuilt server side
Emerging technology
- IoT
- weak defaults, long service life
- 5G standalone
- cloud native, service based core
- Edge computing
- processing outside your building
- AI and ML
- model integrity and data provenance
- Quantum
- threat to current asymmetric algorithms
- Digital twin
- sensitive process data mirrored
- Smart devices
- consumer firmware inside the enterprise
Operational technology
- Safety and availability outrank confidentiality
- Purdue levels guide the segmentation
- Passive monitoring, never aggressive scanning
- Patch windows measured in months
- Unidirectional gateways for data out
- Vendor access brokered and recorded
Email and DNS engineering
- SPF
- authorized sending hosts listed
- DKIM
- signature bound to the domain
- DMARC
- alignment plus enforcement policy
- MTA-STS
- requires TLS to your domain
- DNSSEC
- record integrity through signatures
- DNS filtering
- blocks known malicious resolution
- Split horizon
- different answers by source
- Sinkhole
- redirect malicious lookups internally
Token hygiene
- Short lifetimes limit a stolen token
- Bind tokens to a client key
- Validate audience, issuer and expiry
- Never accept an unverified signature
- Revoke refresh tokens on compromise
- Log issuance and unusual reuse
Rapid recall
- Root of trust
- the anchor you cannot verify further
- Attestation
- proof of measured platform state
- Envelope encryption
- a master key wraps data keys
- Idempotent
- the same result if repeated
- Drift
- reality diverging from code
- Pinning
- the expected key fixed in advance
- Zeroize
- destroy keys on tamper
Reference strip: harden, encrypt, automate, specialize
Harden
- Benchmarks, baselines, allow lists
- SELinux, AppArmor, group policy
- EDR, host firewall, patch rings
- Configuration drift detection
Hardware
- Secure boot and measured boot
- TPM, HSM, self-encrypting drives
- Remote attestation and roots of trust
- Anti-tamper and anti-rollback
Crypto
- TLS 1.3, forward secrecy, GCM
- Envelope encryption and key rotation
- Certificate lifecycle and pinning
- Post-quantum planning and agility
Automate
- Infrastructure and policy as code
- Pipeline scanning and artifact signing
- Secrets vaulting and dynamic credentials
- APIs, webhooks and orchestration
Specialized
- ICS, SCADA and Purdue levels
- IoT, embedded and edge devices
- 5G core and network slicing
- AI model integrity and provenance
Quick exam traps
- Trap: A longer key repairs a broken cipher mode
- Trap: TLS inspection is transparent to every application
- Trap: A TPM and an HSM are interchangeable
- Trap: Secrets in a private repository are safe enough
- Trap: Signed firmware cannot be downgraded by an attacker
- Trap: Patching operational technology follows the IT schedule
- Trap: An expired certificate only affects the browser warning
- Trap: Rate limiting is a performance feature, not a control
cybercertprep.com · original revision sheet written from the public body of knowledge