RecruitScenario sim

Cybersecurity Basics and Key Terms

Learn what cybersecurity protects, the words security teams use every day, and how to tell a threat from a vulnerability from a risk.

100 min 500 XPSkills: CIA triad, Threat and vulnerability, Controls, Defence in depth

What you'll be able to do

›Explain confidentiality, integrity and availability with a real example of each
›Tell an asset, a threat, a vulnerability, an exploit and a risk apart
›Group controls by type and by when they act
›Use authentication, authorisation, least privilege and defence in depth correctly
›Test whether a control works for a specific event, rather than trusting its label

Loading the lessons...

Labs

160 bonus XP

Hands-on work. You edit the artefact, the server runs the checks: the expectations and the reference solution never reach your browser.

Lab 1 · YAML lab

Write your first risk record

Briefing 40 XP

Turn a plain description into a structured risk record written in YAML, a simple text format for data.

Use only the facts in the fixture. Do not add facts that are not there.

What the shop owner told you

Our customer database holds names and card payment records. It runs on a web server that has not been patched for eight months. Criminal groups are scanning shops like ours for that exact flaw. If they got in, they could read and copy the customer data. We want to prevent it, so we will patch the server this week.

Checks

Name the asset
Name the threat actor
Name the weakness
Pick the CIA goal at risk
Classify the control

Lab 2 · Review lab

Check a colleague's glossary

Briefing 40 XP

A colleague wrote a short glossary for new staff. Accept each line that is correct. Reject each line that uses a term wrongly.

Verdicts are accept or reject. Every rejection needs one reason code from: wrong-cia-goal | authn-authz-confused | weaker-substitute.

Six glossary lines

G-1 | Integrity means only approved people can read the data.
G-2 | A vulnerability is a weakness that a threat could use.
G-3 | Authentication decides which folders you may open after you log in.
G-4 | Defence in depth means several layers of controls so one failure does not expose everything.
G-5 | A compensating control is any extra control added to look thorough, even if it gives weaker protection.
G-6 | Phishing is a fake message that tricks a person into clicking a link or sharing a password.

Checks

Every line in the fixture carries a verdict
Accept and reject land on the right lines
Each rejection cites a valid reason code

Lab 3 · YAML lab

Record a control test

Briefing 40 XP

Write the decision record in YAML, a simple text format for structured data.

Use the fixture rather than inventing missing evidence.

Decision evidence

Harbour Lane Books tests a price-change control. The alert is technical and detective. The response owner is shop manager. The agreed response target is 15 minutes. The measured response is 45 minutes, so target_met is false. Review date is 2027-07-01.

Checks

Complete control
Complete response
Complete test
Complete review

Lab 4 · Review lab

Review control and actor claims

Briefing 40 XP

Review each claim against the deeper lesson. Accept accurate claims and reject misleading ones.

Verdicts are accept or reject. Every rejection needs one reason code from: operation-unproven | account-not-person | attribution-overreach.

Review notes

D-1 | Recording an event remains detective even when the same tool also blocks downloads.
D-2 | An enabled alert proves someone will respond promptly.
D-3 | A criminal using an employee account must be an employee.
D-4 | Recovery testing should check whether a compromised production account can destroy backups.
D-5 | A shared motive proves two attacks came from the same group.
D-6 | A temporary substitute needs a defined scope and expiry.

Checks

Every line in the fixture carries a verdict
Accept and reject land on the right lines
Each rejection cites a valid reason code

Next on your path · Cybersecurity Fundamentals

Risk Management End to End

Follow risk from business context through analysis, treatment and continuing review.

Recruit 100 min 500 XP

Start next room

Community

Discussion & writeups

Share how you approached the room or ask where you got stuck. Never paste task answers or full lab solutions: write the reasoning, not the key.

Loading discussion…

View the Cybersecurity Fundamentals path