EXIN Cyber and IT Security Foundation - Including Exam

- Network Administrator

- Application Developer

- Security Officer

- Auditor

- Quality Manager

- Operational Manager

The following table lists the topics of the module (exam requirements) and the subtopics (exam specifications):

1. Tcp/Ip Networking 10%

• Nodes, Node Connections & TCP/IP Addressing 5%
• OSI Model, TCP/IP Model, Protocols 5%

2. Computer Systems 10%

• Computer Architecture, Operating Systems 5%
• Computer System Vulnerabilities 2.5%
• Computer System Security Measures 2.5%

3. Applications & Databases 15%

• Application Development 5%
• Databases 5%
• Security Issues & Countermeasures 5%

4. Cryptography 20%

• Encryption Methodologies & Standards 5%
• Digital Signatures, Hashing 5%
• Public Key Infrastructure (Pki) 5%
• SSL/TLS, Ipsec 5%

5. Identity & Access Management 15%

• Identification, Authentication, Biometrics, Single Sign-On (SSO), Password Management 10%
• Authorization 5%

6. Cloud Computing 15%

• Characteristics & Deployment Models 10%
• Risks 5%

7. Exploiting Vulnerabilities 15%

• Attack Categories & Threat Types 5%
• Actors & Tools 10%

1.  TCP/IP Networking 

• Nodes, Node Connections & TCP/IP Addressing    
• describe what a node is.   
• describe how nodes can be connected to each other.  
• explain the concepts of TCP/IP addressing of both IP v4 and IP v6. 
• OSI Model, TCP/IP Model, Protocols    
• describe the layers and main functionalities of the OSI and TCP/IP models.  
• explain the main network protocols, what their functionality is and how they fit into the OSI and TCP/IP reference models.

2.  Computer Systems 

• Computer Architecture, Operating Systems    
• explain the components of a computer system.  
• describe how an operating system works.
• list the main operating systems. 
• Computer System Vulnerabilities  
• identify the most prevalent types of computer system vulnerabilities. 
• Computer System Security Measures   
• identify the main security measures related to computer systems.

3.  Applications & Databases 

• Application Development   
• explain the different methods and phases of the systems development life cycle.  
• describe the advantages and disadvantages of each of the different methods of the systems development lifecycle.
• explain how to address security during the systems development life cycle. 
• Databases   
• describe the different database models.  
• explain the functionality of the database and the database management systems. 
• Security Issues & Countermeasures 
• describe the prevalent security issues related to applications development and databases.  
• explain the countermeasures against security issues related to applications and databases.

4.  Cryptography 

• Encryption Methodologies & Standards  
• differentiate between symmetric and asymmetric encryption.  
• identify encryption algorithms and standards.
• Digital Signatures, Hashing   
• explain how digital signatures provide for authenticity and non-repudiation.  
• explain how hashing provides for the integrity of digital information.  
• describe the main hashing standards.
• Public Key Infrastructure (PKI)    
• describe the components, parties and processes of a public key infrastructure.  
• explain what digital certificates and their use cases are.
• SSL/TLS, Ipsec   
• explain the technology and use cases of SSL/TLS.  
• explain the technology and use cases of IPSec.

5. Identity & Access Management 

• Identification, Authentication, Biometrics, Single Sign-On (SSO), Password Management  
• differentiate between identification and authentication.  
• describe the main technologies of authentication and two-factor authentication.  
• explain biometrics and their use cases.  
• explain the concepts and different types of Single sign-on (SSO).  
• explain password management and its use cases.
• Authorization    
• describe how the principles of Need to know, Least privilege and Separation of Duties (SoD) relate to authorization.  
• describe authorization models such as role-based access control (RBAC) and attribute-based access control (ABAC).  
• describe the specifications and functionality of OpenID Connect and OAuth.

6. Cloud Computing 

• Characteristics & Deployment Models    
• differentiate between the deployment models public cloud, private cloud and hybrid cloud.  
• explain the service models SaaS, PaaS, IaaS, SECaaS and IDaaS. 
• Risks    
• identify the risks of cloud computing.

7. Exploiting Vulnerabilities 

• Attack Categories & Threat Types    
• identify the main attack categories of cybercrime. 
• Actors & Tools The candidate can
• recognize Black hat hackers, White hat hackers, Grey hat hackers, Script kiddies and Hacktivists.
• identify which tools cybercriminals use.
• identify the steps cybercriminals take to exploit vulnerabilities.

Successful completion of the EXIN Cyber & IT Security Foundation exam.

Examination details :

Examination type: Multiple-choice questions

Number of questions: 40

Pass mark: 60%

Open book/notes: No

Electronic equipment/aides permitted: No

Time allotted for examination: 60 minutes

None

Bloom level :

The EXIN Cyber & IT Security Foundation certification tests candidates at Bloom Level 1 and Level 2 according to Bloom’s Revised Taxonomy:

- Bloom Level 1: Remembering – relies on recall of information. Candidates will need to absorb, remember, recognize and recall. This is the building block of learning before candidates can move on to higher levels.

- Bloom Level 2: Understanding – a step beyond remembering. Understanding shows that candidates comprehend what is presented and can evaluate how the learning material may be applied in their own environment. This type of questions aims to demonstrate that the candidate is able to organize, compare, interpret and choose the correct description of facts and ideas.

Training :

- Contact hours:

The recommended number of contact hours for this training course is 16. This includes group assignments, exam preparation and short breaks. This number of hours does not include homework, the exam session and lunch breaks.

- Indication study effort

60 hours, depending on existing knowledge.