ISC2
CISSP Security Architecture: Engineering for Failure
An organization moves sensitive workloads into a new cloud platform and announces that the project meets its security objectives. The…
EXAMTOPICS EDITORIAL
All the stories.
Read further, find a new perspective, or follow a question worth exploring.
ISC2
CISSP Security and Risk Management: Decisions Before Controls
An organization can purchase a powerful security product without knowing which business risk it is meant to reduce. It can…
AMAZON
AWS SCS-C03: Threat Detection, Logging and Response
At 02:17, a workload role begins calling an API it never used before. One monitoring tool reports unusual behavior. A…
AMAZON
AWS SCS-C03: Encryption and Data Protection by Design
A team encrypted its S3 bucket and closed a security ticket. Months later, a compromised workload role copied confidential objects…
AMAZON
AWS SCS-C03: Network Security Across VPC Boundaries
The architecture diagram says the application is private. Its instances run in private subnets, the database has no internet-facing endpoint,…
AMAZON
AWS SCS-C03: Identity and Access Without Excess Privilege
A production incident begins with an oddly narrow report: a monitoring function is allowed to read metrics but can also…
AMAZON
AWS SCS-C03: Cloud Security Decisions That Matter
A security design can pass a checklist and still fail the business. Imagine an AWS application with encrypted databases, strict…
MICROSOFT
SC-401: Investigate Alerts Without Losing the Evidence
A data loss prevention policy reports that a protected file was shared outside the organization. A manager says the recipient…
MICROSOFT
SC-401: Insider Risk Without Unfair Assumptions
A project manager downloads a large set of documents late on Friday. A monitoring system marks the event as unusual.…
MICROSOFT
SC-401: DLP and Retention Solve Different Problems
An employee accidentally attaches a payroll spreadsheet to a message addressed to a supplier. A DLP rule may warn or…
MICROSOFT
SC-401: Make Sensitivity Labels Enforceable
Two employees open the same document. One sees a Confidential banner and can forward an unrestricted copy; the other receives…
MICROSOFT
SC-401: What Information Security Administrators Protect
A legal team sends a confidential acquisition document through Microsoft 365. A manager then shares a summary in Teams, a…