Let me give you one quick memory tip. CIA — think of it like the security of a safe. Confidentiality is the lock. Integrity is knowing nothing inside has been tampered with. Availability is knowing you can open it when you need to.

A quick memory device: A-T-M-A — Avoid, Transfer, Mitigate, Accept. Think of an ATM — you use it to manage your money, just like you use these strategies to manage your risk.

In this lecture I walk you through the CIA Triad and Risk Management Quiz before you attempt it. We review the three CIA principles, the DAD Triad mirror image, the four risk treatment strategies, and the Risk Register — then work through the reasoning process for applying each concept to scenario-based questions. By the end of this walkthrough you will know how to identify which CIA principle is under attack in any scenario, how to distinguish between the four risk responses, and how to eliminate wrong answers quickly under exam conditions. Domain 1 carries the highest exam weight at 26 percent — this quiz confirms you are ready to move forward.

Five takeaways before you move on.

One — three factor categories: Know, Have, Are. K-H-A.

Two — MFA requires factors from different categories. Same category twice is not MFA.

Three — 2FA is MFA with exactly two categories.

Four — SSO is an access mechanism, not a factor.

Five — strong authentication always combines categories. Weak authentication relies on only one.

This topic appears throughout the entire CC exam — in Domain 3, in scenario questions, and in access control policy questions. Know it cold.

In the next section we go deeper into access control models — the rules that determine what authenticated users are actually allowed to do once they are inside a system.

Great work. Keep going.

In this lecture I walk you through the PICERL Scenario Worksheet before you attempt it independently. We review the six phases of the NIST Incident Response Lifecycle, establish what correct decision-making looks like at each phase, and work through the opening stage of the ransomware scenario together. By the end of this walkthrough you will know exactly what the worksheet expects, how to structure your written responses, and how to think through incident response decisions the way a real security analyst would. This is the most practical assignment in the course — treat it seriously and it will prepare you for scenario questions throughout the CC exam.

There are three categories of authentication factors, and you need to know all three cold.

Factor 1 — Something You Know.
This is the most common type of authentication. Passwords, PINs, security questions, passphrases — anything that exists in your memory. It is the oldest form of authentication and also the weakest on its own, because knowledge can be stolen, guessed, or shared.

Factor 2 — Something You Have.
This is a physical object in your possession. A smart card, a hardware token, a key fob that generates a one-time code, or your smartphone receiving an authentication app push notification. The assumption is that an attacker cannot authenticate as you unless they physically have your device.

Factor 3 — Something You Are.
This is biometric authentication — your fingerprint, face scan, iris pattern, voice recognition, or even your typing rhythm. These are tied to your physical body and are the hardest to replicate, though not impossible.

In this lecture I walk you through the Authentication Factors Quiz before you attempt it. We review the three factor categories, clarify the most common exam mistakes around MFA, and work through the reasoning process for distinguishing between Single-Factor, 2FA, MFA, Passwordless, and SSO. By the end of this walkthrough you will know not just the correct answers but how to eliminate wrong options quickly under exam conditions. Authentication factors appear throughout the entire CC exam — in Domain 3 questions, in access control scenarios, and in security policy questions. This walkthrough ensures you approach the quiz with confidence and the right mental framework.

When you see an authentication scenario on the CC exam, ask yourself one question: Is this something in the person's memory, something in their hand, or something on their body? Memory = Know. Hand = Have. Body = Are. That single question will get you to the right answer every time.

Complete Quiz
Self-Assessment Quiz 10
Ungraded✓ Complete
CIA Triad & Risk Management Quiz 10 Graded✓ Complete
PICERL Scenario Worksheet 10 Self-graded✓ Complete
Authentication Factors Quiz 10 Graded✓ Complete