What Is Separation of Duties?

An immutable backup is a protected copy of data that cannot be modified or deleted during a defined retention period, even by accounts that normally possess administrative privileges. Certification exams may connect immutability with ransomware recovery, insider threats, retention controls, and protection against compromised backup administrators. Attackers frequently attempt to erase or encrypt recovery data before disrupting production systems, so an immutable copy can preserve a trusted restoration point. Organizations should separate backup credentials, restrict management access, maintain offline or logically isolated copies, monitor deletion attempts, and define retention periods that meet operational and regulatory needs. Immutability does not guarantee successful recovery, so backups must still be verified, scanned when appropriate, and tested through regular restoration exercises that confirm systems and data can be recovered. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with. And dont forget Cyberauthor.me for the companion study guide and flash cards!

Chain of custody is the documented record of how evidence was collected, identified, transferred, stored, examined, and protected from the moment it was acquired. Certification exams may ask why investigators record who handled an item, when possession changed, where it was stored, and what actions were performed. This documentation helps demonstrate that evidence presented during legal, disciplinary, or administrative proceedings is the same evidence originally collected and was not improperly altered. Investigators should assign unique identifiers, record dates and times, use tamper-evident packaging when appropriate, restrict access, calculate hashes for digital evidence, and document every transfer. Missing signatures, unexplained gaps, or improper storage can weaken confidence in the evidence even when the technical findings appear accurate. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with. And dont forget Cyberauthor.me for the companion study guide and flash cards!

Alert fatigue develops when analysts or users receive so many repetitive, low-quality, or poorly prioritized notifications that important warnings become difficult to recognize and investigate. Certification exams may describe a security operations team ignoring alerts after repeated false positives and ask candidates to identify the operational problem. Common causes include overly broad detection rules, duplicate notifications, missing context, weak severity assignments, and alerts that provide no clear action. Organizations should tune rules, suppress known duplicates, enrich alerts with asset and identity information, automate routine analysis, and define escalation procedures based on risk. Metrics should examine alert volume, response time, closure reasons, and confirmed incidents. Reducing noise must be balanced carefully so that tuning does not create false negatives or hide meaningful changes in attacker behavior. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with. And dont forget Cyberauthor.me for the companion study guide and flash cards!

A false positive occurs when a security control reports malicious activity that is not actually present, while a false negative occurs when genuine malicious activity is missed. Certification exams may ask candidates to identify these outcomes or explain the tradeoff created when detection thresholds are adjusted. A rule that alerts on every administrative script may create excessive false positives, while a rule that requires several severe conditions may overlook a real attack. Defenders should tune controls using validated data, asset criticality, threat context, and acceptable risk rather than attempting to eliminate one error type completely. Testing, analyst feedback, rule reviews, and comparison with confirmed incidents help improve accuracy. False negatives may leave threats undetected, while excessive false positives can consume resources and contribute to alert fatigue. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with. And dont forget Cyberauthor.me for the companion study guide and flash cards!

An indicator of compromise is an observable clue suggesting that malicious activity may have occurred within a system or environment. Certification exams may present a suspicious file hash, unfamiliar domain, unexpected account, altered configuration, unusual process, or unauthorized network connection and ask candidates to classify it as an indicator requiring investigation. An indicator is not automatic proof of an incident because legitimate activity may produce similar evidence, and attackers may change their tools or infrastructure. Analysts should combine multiple indicators with context, timelines, asset information, user behavior, and threat intelligence before reaching a conclusion. Effective handling includes validating the evidence, searching for related activity, preserving relevant logs, containing confirmed threats, and updating detection rules without creating unnecessary false positives. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with. And dont forget Cyberauthor.me for the companion study guide and flash cards!