Security Management & Architecture Exam Prep

Management-level security knowledge is commonly organised into eight domains: security and risk management, asset security, security architecture and engineering, communication and network security, identity and access management, security assessment and testing, security operations, and software development security. Governance and risk sit on top and set priorities for the others.

It means choosing the answer a responsible security leader could defend: protect people first, make sure ownership and authority are clear, use the existing process such as the incident response plan, and only then choose a technical control that fits the risk and its cost.

Use a routine such as READ: identify your Role, note the Exact qualifier (FIRST, BEST, MOST), Axe distractors that are out of order, outside your authority, absolute or symptom fixes, then Decide between the last two options by checking people, policy, process and product from the top down.

FIRST asks which step must come before all others, so it is about sequence – often assessing, identifying the owner or protecting people. BEST asks which option fits the situation and role most completely. The same scenario can therefore have different correct answers depending on the qualifier.

It depends on how many domains you already work in. As a guide, an intensive plan takes about 4 weeks at roughly two hours a day, a standard plan about 8 weeks, and a steady plan about 12 weeks. In every plan, practise scenario questions from the start and keep an error log.

Management with the appropriate authority accepts risk, and senior management is ultimately accountable. The security team assesses the risk, advises and recommends treatments, but it does not accept risk on the organisation's behalf. Auditors report findings and must stay independent.