EXAM KNOWLEDGE MAP
Turn security vocabulary back into a decision chain: what is protected, what may happen, where the weakness lies, and who should act. Section B applies that chain to longer cases.
Follows IPA Syllabus v4.1 and the current 120-minute, 60-question Sections A/B format.
Question practice is open. These resources are available without signing in.
FINAL REVIEW BOARD
Sections A and B run in one 120-minute session with 60 questions.
Confirm asset, threat, vulnerability, risk, control, and residual risk in order.
For long cases, organize roles, permissions, data flow, logs, and timeline first.
QUICK REFERENCE
Section A uses a ten-chapter security index; Section B is separated into twelve case-reading and response methods.
SOLVING METHODS
Keep reading, calculation, verification, and review procedures in one place. Choose the format, then check only the steps you need.
SYLLABUS AT A GLANCE
Define protection goals from business value and the CIA triad.
Malware, social engineering, web attacks, and configuration weaknesses.
Symmetric and public-key cryptography, hashes, signatures, certificates, and authentication factors.
Segmentation, permissions, logs, endpoints, and zero trust.
OFFICIAL REFERENCE
Identification, analysis, evaluation, treatment, and residual risk.
Policy, accountability, performance evaluation, and continual improvement.
Personal information, cybercrime, intellectual property, and contractual duties.
Supplier selection, contracts, security responsibility, oversight, and exit.
Detection, containment, eradication, recovery, lessons learned, and BCP.
Log review, metrics, internal audit, and follow-up.
Organize organizations, systems, roles, data, and timeline.
Use prompt evidence to choose a proportionate, executable action assigned to the correct role.
