Virtualization and Cloud-Specific Vulnerabilities (Domain 2)
Virtualization and cloud computing introduce powerful efficiencies—but they also open up new categories of vulnerabilities that traditional security models often fail to address.…
Search & Discovery 2.0
Find the exact control, technique, lesson, or book.
Search the complete Bare Metal Cyber knowledge system with identifier-aware ranking, framework filters, topic discovery, and direct paths into books, podcasts, and Academy learning.
11,003searchable records
6,025Academy lessons
6framework families
144published books
Search results
625 results for “Security+ Practice”
Cloud Key-Use Governance
Cloud key-use governance defines who and what may use encryption keys, for which operations, under what conditions, with what logging, and through which approval and recovery processes.
Compliance Exceptions and Risk Waivers
A compliance exception or risk waiver documents an authorized, time-bound decision to deviate from a requirement while the resulting exposure, compensating measures, owner, and remediation plan remain visible.
Continuous Control Monitoring
Continuous control monitoring uses defined data, tests, and review cycles to identify changes in control condition and risk between formal assessments.
Control Baselines and Tailoring
A control baseline is a starting set of safeguards selected for a defined impact or risk context; tailoring adjusts that set to the system, organization, threats, and applicable requirements.
Functional Analysis and Allocation
Functional analysis identifies what a system must do and allocates those functions and security responsibilities to people, processes, hardware, software, data, and external services.
Log Analysis
Log analysis interprets recorded events to answer questions about system behavior, user activity, failures, attacks, and the sequence of an incident.
Malware Defense Validation
Malware defense validation tests whether prevention, detection, isolation, and response controls work against relevant behaviors without exposing production systems to uncontrolled risk.
Secure Interface Design
Secure interface design controls how components exchange data, identity, commands, state, and errors across technical and organizational boundaries.
System Categorization and Impact Level
System categorization determines the potential impact of losing confidentiality, integrity, or availability for the information and services a system supports.
Web Application Penetration Testing
Web application penetration testing evaluates how an application handles identity, authorization, input, sessions, business rules, APIs, dependencies, and trust boundaries under realistic misuse.
03.17.01 — Supply Chain Risk Management Plan
Dependence on the products, systems, and services of external providers and the nature of the relationships with those providers present an increasing level of risk to an organization. Threat actions that may increase security risks include unauthorized production, the insertion or use of counterfeits, tampering, poor manufacturing and development practices in the supply chain, theft, and the insertion of malicious s
SC-7(14) — Protect Against Unauthorized Physical Connections
Systems that operate at different security categories or classification levels may share common physical and environmental controls, since the systems may share space within the same facilities. In practice, it is possible that these separate systems may share common equipment rooms, wiring closets, and cable distribution paths. Protection against unauthoriz
ISC2 CCSP
Combine the existing free, ad-free 100-lesson CCSP audio course with the newly revised CCSP for Busy People Second Edition study guide and a separate, updated Kindle flashcards eBook. Read for understanding, listen for reinforcement, and practice the decisions that matter in cloud security.
SR-2 — Supply Chain Risk Management Plan
The dependence on products, systems, and services from external providers, as well as the nature of the relationships with those providers, present an increasing level of risk to an organization. Threat actions that may increase security or privacy risks include unauthorized production, the insertion or use of counterfeits, tampering, theft, insertion of mal
SR-6 — Supplier Assessments and Reviews
An assessment and review of supplier risk includes security and supply chain risk management processes, foreign ownership, control or influence (FOCI), and the ability of the supplier to effectively assess subordinate second-tier and third-tier suppliers and contractors. The reviews may be conducted by the organization or by an independent third party. The r
Adversarial Machine Learning
A professional reference on attacks against machine-learning systems and the practices used to evaluate and defend them.
SA-11(1) — Static Code Analysis
Static code analysis provides a technology and methodology for security reviews and includes checking for weaknesses in the code as well as for the incorporation of libraries or other included code with known vulnerabilities or that are out-of-date and not supported. Static code analysis can be used to identify vulnerabilities and enforce secure coding pract
SC-3(4) — Module Coupling and Cohesiveness
The reduction of inter-module interactions helps to constrain security functions and manage complexity. The concepts of coupling and cohesion are important with respect to modularity in software design. Coupling refers to the dependencies that one module has on other modules. Cohesion refers to the relationship between functions within a module. Best practic
When Zero Trust Meets Zero Patience
In this episode, we take on the fatigue that often comes with Zero Trust—those endless logins, rigid rules, and culture-draining compliance routines. Listeners will discover how to simplify security without weakening defenses, turn routine practices into engaging challenges, and humanize policies with humor and empathy. Through vivid examples and practical strategies, the episode shows how Zero Trust can shift from…
XDR, EDR, NDR, MDR, WTF-DR?
In this episode, we cut through the alphabet soup of cybersecurity—EDR, NDR, XDR, MDR, and even the tongue-in-cheek WTF-DR. You’ll learn what each of these acronyms really means, how they differ, and where they overlap. More importantly, you’ll gain clarity on how they fit together in practice, why no single tool is enough, and how to build a layered defense without wasting budget on hype. Through clear…
SR-2 — Supply Chain Risk Management Plan | Defense Map
The dependence on products, systems, and services from external providers, as well as the nature of the relationships with those providers, present an increasing level of risk to an organization. Threat actions that may increase security or privacy risks include unauthorized production, the insertion or use of counterfeits, tampering, theft, insertion of malicious software and hardware, and poor manufacturing and…
Domain 2 Audio Quiz: Scenario Walkthroughs
In this episode, we dive into scenario-based questions for Domain 2: Security and Compliance. Scenario-based questions require you to apply your knowledge of security best practices, compliance regulations, and AWS security services to real-world situations.…
Ethics & Professionalism: Codes, Conflicts and Duty of Care
Professionalism in cloud security goes beyond technical competence—it includes ethical conduct and adherence to codes of practice.…