• Classify Threats and Threat Actor Types

• Utilize Attack Frameworks and Indicator Management

• Utilize Threat Modeling and Hunting Methodologies

• Analyze Network Monitoring Output

• Analyze Appliance Monitoring Output

• Analyze Endpoint Monitoring Output

• Analyze Email Monitoring Output

• Configure Log Review and SIEM Tools

• Analyze and Query Logs and SIEM Data

• Identify Digital Forensics Techniques

• Analyze Network-related IoCs

• Analyze Host-related IoCs

• Analyze Application-related IoCs

• Analyze Lateral Movement and Pivot IoCs

• Explain Incident Response Processes

• Apply Detection and Containment Processes

• Apply Eradication, Recovery, and Post-Incident Processes

• Apply Risk Identification, Calculation, and Prioritization Processes

• Explain Frameworks, Policies, and Procedures

• Analyze Output from Enumeration Tools

• Configure Infrastructure Vulnerability Scanning Parameters

• Analyze Output from Infrastructure Vulnerability Scanners

• Mitigate Vulnerability Issues

• Apply Identity and Access Management Security Solutions

• Apply Network Architecture and Segmentation Security Solutions

• Explain Hardware Assurance Best Practices

• Explain Vulnerabilities Associated with Specialized Technology

• Identify Non-Technical Data and Privacy Controls

• Identify Technical Data and Privacy Controls

• Mitigate Software Vulnerabilities and Attacks

• Mitigate Web Application Vulnerabilities and Attacks

• Analyze Output from Application Assessments

• Identify Cloud Service and Deployment Model Vulnerabilities

• Explain Service-Oriented Architecture

• Analyze Output from Cloud Infrastructure Assessment Tools

• Compare Automation Concepts and Technologies