Opleiding: EXIN Cyber and IT Security Foundation - Including Exam [CITSF-EXIN]

OVERVIEW

The Certificate EXIN Cyber & IT Security Foundation is part of the overall qualification scheme for Cyber & IT Security.

Security in IT is not only becoming more important but also more sophisticated. In light of this, organizations are dedicating roles to the safeguarding of their data and systems. The EXIN Cyber & IT Security program is geared towards providing candidates with the required knowledge to understand the technical side of information security. It covers the theoretical background, detailed information about security infrastructure and goes into the vulnerabilities, risks, and required measures.

The subjects of this module are:

- TCP/IP Networking

- Computer Systems

- Applications & Databases

- Cryptography

- Identity & Access Management

- Cloud Computing

- Exploiting Vulnerabilities

Updated June 2026

OBJECTIVES

The following table lists the topics of the module (exam requirements) and the subtopics (exam specifications):

1. Tcp/Ip Networking 10%

• Nodes, Node Connections & TCP/IP Addressing 5%
• OSI Model, TCP/IP Model, Protocols 5%

2. Computer Systems 10%

• Computer Architecture, Operating Systems 5%
• Computer System Vulnerabilities 2.5%
• Computer System Security Measures 2.5%

3. Applications & Databases 15%

• Application Development 5%
• Databases 5%
• Security Issues & Countermeasures 5%

4. Cryptography 20%

• Encryption Methodologies & Standards 5%
• Digital Signatures, Hashing 5%
• Public Key Infrastructure (Pki) 5%
• SSL/TLS, Ipsec 5%

5. Identity & Access Management 15%

• Identification, Authentication, Biometrics, Single Sign-On (SSO), Password Management 10%
• Authorization 5%

6. Cloud Computing 15%

• Characteristics & Deployment Models 10%
• Risks 5%

7. Exploiting Vulnerabilities 15%

• Attack Categories & Threat Types 5%
• Actors & Tools 10%

AUDIENCE

- Network Administrator

- Application Developer

- Security Officer

- Auditor

- Quality Manager

- Operational Manager

CERTIFICATION

Examination details :

Examination type: Multiple-choice questions

Number of questions: 40

Pass mark: 60%

Open book/notes: No

Electronic equipment/aides permitted: No

Time allotted for examination: 60 minutes

NEXT STEP

None

CONTENT

1.  TCP/IP Networking 

• Nodes, Node Connections & TCP/IP Addressing    
• • describe what a node is.   
  • describe how nodes can be connected to each other.  
  • explain the concepts of TCP/IP addressing of both IP v4 and IP v6. 
• OSI Model, TCP/IP Model, Protocols    
• • describe the layers and main functionalities of the OSI and TCP/IP models.  
  • explain the main network protocols, what their functionality is and how they fit into the OSI and TCP/IP reference models.

2.  Computer Systems 

• Computer Architecture, Operating Systems    
• • explain the components of a computer system.  
  • describe how an operating system works.
  • list the main operating systems. 
• Computer System Vulnerabilities  
• • identify the most prevalent types of computer system vulnerabilities. 
• Computer System Security Measures   
• • identify the main security measures related to computer systems.

3.  Applications & Databases 

• Application Development   
• • explain the different methods and phases of the systems development life cycle.  
  • describe the advantages and disadvantages of each of the different methods of the systems development lifecycle.
  • explain how to address security during the systems development life cycle. 
• Databases   
• • describe the different database models.  
  • explain the functionality of the database and the database management systems. 
• Security Issues & Countermeasures 
• • describe the prevalent security issues related to applications development and databases.  
  • explain the countermeasures against security issues related to applications and databases.

4.  Cryptography 

• Encryption Methodologies & Standards  
• • differentiate between symmetric and asymmetric encryption.  
  • identify encryption algorithms and standards.
• Digital Signatures, Hashing   
• • explain how digital signatures provide for authenticity and non-repudiation.  
  • explain how hashing provides for the integrity of digital information.  
  • describe the main hashing standards.
• Public Key Infrastructure (PKI)    
• • describe the components, parties and processes of a public key infrastructure.  
  • explain what digital certificates and their use cases are.
• SSL/TLS, Ipsec   
• • explain the technology and use cases of SSL/TLS.  
  • explain the technology and use cases of IPSec.

5. Identity & Access Management 

• Identification, Authentication, Biometrics, Single Sign-On (SSO), Password Management  
• • differentiate between identification and authentication.  
  • describe the main technologies of authentication and two-factor authentication.  
  • explain biometrics and their use cases.  
  • explain the concepts and different types of Single sign-on (SSO).  
  • explain password management and its use cases.
• Authorization    
• • describe how the principles of Need to know, Least privilege and Separation of Duties (SoD) relate to authorization.  
  • describe authorization models such as role-based access control (RBAC) and attribute-based access control (ABAC).  
  • describe the specifications and functionality of OpenID Connect and OAuth.

6. Cloud Computing 

• Characteristics & Deployment Models    
• • differentiate between the deployment models public cloud, private cloud and hybrid cloud.  
  • explain the service models SaaS, PaaS, IaaS, SECaaS and IDaaS. 
• Risks    
• • identify the risks of cloud computing.

7. Exploiting Vulnerabilities 

• Attack Categories & Threat Types    
• • identify the main attack categories of cybercrime. 
• Actors & Tools The candidate can
• • recognize Black hat hackers, White hat hackers, Grey hat hackers, Script kiddies and Hacktivists.
  • identify which tools cybercriminals use.
  • identify the steps cybercriminals take to exploit vulnerabilities.