| Section | Objectives |
| Topic 1: Databases | - Database Injection and Exploitation
- Database Misconfiguration and Vulnerability Assessment
- Database Technologies and Services
- Database Authentication and Access Control
|
| Topic 2: Windows Desktop Lockdown | - Desktop Lockdown Bypass Assessment
- Windows Desktop Security Controls
- Application Restrictions and Security Policies
|
| Topic 3: Soft Skills and Assessment Management | - Law and Compliance
- 1. Legal requirements and regional legislation
- 2. Client confidentiality and authorisation
- Reporting and Quality Assurance
- 1. Technical findings and remediation recommendations
- 2. Risk classification and impact assessment
- 3. Report review and quality assurance
- Scoping and Risk Management
- 1. Assessment scope and constraints
- 2. Operational risks and service availability
- Engagement Lifecycle
- 1. Evidence collection and record keeping
- 2. Penetration testing methodologies and engagement phases
- 3. Client communication and professional conduct
|
| Topic 4: Microsoft Windows Security Assessment | - Windows Services and Misconfigurations
- Active Directory and Domain Security
- Windows Operating System Security
- Windows Authentication and Privilege Escalation
|
| Topic 5: Virtualisation | - Virtual Machine Security
- Virtualisation Platforms and Architecture
- Virtualisation Misconfigurations
|
| Topic 6: Core Technical Skills | - Cryptography
- 1. Cryptographic protocols and hash functions
- 2. Symmetric and asymmetric encryption
- Security Testing Tools and Output Interpretation
- 1. Port scanning and vulnerability scanning
- 2. Enumeration and exploitation tools
- 3. Network traffic analysis
- Pivoting and Lateral Movement
- 1. Accessing targets across multiple networks
- 2. Pivoting through compromised systems
|
| Topic 7: Social Engineering | - Social Engineering Risk Assessment
- Human Factors and Security Awareness
- Social Engineering Techniques
|
| Topic 8: Cloud Security | - Cloud Identity and Access Management
- Cloud Misconfigurations and Vulnerability Assessment
- Cloud Architecture and Services
- Cloud Infrastructure Security
|
| Topic 9: Networks | - IP Addressing and Subnetting
- Network Device Security
- Routing and Network Segmentation
- Wireless Network Security
- Network Traffic Analysis
- Network Protocols and Architecture
|
| Topic 10: Network Services | - Service Misconfiguration and Vulnerability Assessment
- Service Discovery and Enumeration
- Authentication and Access Control
- Common Network Service Security
|
| Topic 11: macOS Security Assessment | - macOS System Security
- macOS Configuration Weaknesses
- macOS Authentication and Access Controls
|
| Topic 12: Web Technologies | - Web Architecture and Protocols
- Common Web Vulnerabilities
- Web Application Security Testing
- Web Service Enumeration and Exploitation
|
| Topic 13: Physical Security | - Physical Security Weaknesses
- Physical Access Controls
|
| Topic 14: Secure Development Operations | - Configuration and Secret Management
- Development Pipeline Security
- Secure Development and Deployment Practices
|
| Topic 15: Internet Information Gathering and Reconnaissance | - Public Information Sources
- Target Identification and Enumeration
- Domain and Infrastructure Reconnaissance
|
| Topic 16: Containerisation | - Container Security and Isolation
- Container Misconfigurations and Vulnerabilities
- Container Architecture and Technologies
|
| Topic 17: Linux and UNIX Security Assessment | - Privilege Escalation
- Authentication and Access Control
- System Services and Exploitation
- Linux and UNIX System Enumeration
|