Domain 7 · Objective reference 7.7 · Chapter 49 of 62
Maintain prevention, detection and controlled deception
About 5 minutes · Current ISC2 outline effective 15 April 2024; the announced 15 April 2027 replacement requires separate mapping
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Detection needs a known truth set to measure misses.
Explore the anchors
Block selected harmful behavior.
Concept matching activity
Match this task or description to its concept:
Observe and raise useful signals.
Choose a concept before checking the explanation.
Detection laboratory
Positive means the detector raised an alert. True/false compares that decision with known reality.
False negative — An attack exists. No alert was raised.
| Detector | Attack present | No attack |
|---|---|---|
| Alert | True positive | False positive |
| No alert | False negative | True negative |
Change the threshold
Eight fictional events have fixed known truth. An alert fires when the synthetic score is at least the threshold. The score is not a probability of attack.
TP 2 · FP 1 · FN 2 · TN 3. Precision 67%. Recall 50%.
Precision = TP ÷ (TP + FP). Recall = TP ÷ (TP + FN). Lower thresholds can increase detection and false alarms; this tiny dataset does not establish real-world performance.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Concepts and mechanisms
- Design, evidence and tradeoffs
Concepts and mechanisms
Firewalls, application controls, intrusion detection/prevention, anti-malware and sandboxing address different conditions. Allowlisting and blocklisting define different default decisions and maintenance burdens. Honeypots or honeynets can provide controlled observation but need isolation, monitoring and protection against becoming unmanaged infrastructure. Supplier security services still require defined customer responsibilities and usable response handoffs.
Design, evidence and tradeoffs
Assess visibility, configuration, updates, alert handling and failure modes. A prevention control can block a tested case without proving all attacks are covered, while a detection tool can alert without anyone acting. Machine-learning systems also need validation and monitoring for changed populations or degraded performance. Avoid weakening production safeguards to obtain a convenient test result; use approved simulation and explicit limits.
Worked example
A decoy uses synthetic data and constrained connectivity, with an owner who reviews events and maintains the environment.
Check your understanding
Why is installing a defensive tool not sufficient operating evidence?
Show explanation
Configuration, telemetry, maintenance, response capacity and tested behavior determine whether it performs the intended function.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.