🌲
Domains 1–5 · CompTIA Security+ SY0-701 · Full Exam Coverage

Gravity Falls Security+ Study Hub

Welcome to Gravity Falls, Oregon — where the Mystery Shack runs on paranoia, Journal 3 is the ultimate threat intelligence feed, and a triangular dream demon named Bill Cipher is your top-tier APT. Learn every Security+ SY0-701 domain through Dipper's investigations, Mabel's chaos, Ford's bunker architecture, and Bill's relentless social engineering.

"Trust no one." — Journal 3  |  "A DEAL'S A DEAL!" — Bill Cipher
📚 Topics 🧠 Study Guide 🧬 Characters 🔍 Analogies 📝 Notes 🚨 IR Lifecycle 🔎 Detection 👥 Roles 📋 Reporting 🔁 Post-Incident 🌀 Adventure 🔗 Links 🃏 Flashcards ✏️ Quiz

📚 Topics Covered — All 5 Domains

Domain 1.0 — General Security Concepts (12%)

Objectives: 1.1 Security Controls · 1.2 Fundamental Concepts · 1.3 Change Management · 1.4 Cryptographic Solutions

CIA TriadZero TrustAAA Non-repudiationHashingPKI Symmetric/AsymmetricMFAPhysical Security HoneypotsChange ManagementCertificates
Domain 2.0 — Threats, Vulnerabilities & Mitigations (22%)

Objectives: 2.1 Threat Actors · 2.2 Attack Vectors · 2.3 Vulnerabilities · 2.4 Indicators of Malicious Activity · 2.5 Mitigations

APT / Nation-StateSocial EngineeringPhishing/Smishing Malware TypesSQL InjectionBuffer Overflow DDoSRansomwareZero-day Insider ThreatHardeningPatching
Domain 3.0 — Security Architecture (18%)

Objectives: 3.1 Architecture Models · 3.2 Enterprise Infrastructure · 3.3 Data Protection · 3.4 Resilience & Recovery

Network SegmentationDMZVPN/SASE/SD-WAN Cloud IaaS/PaaS/SaaSFirewalls/WAFIDS/IPS Data ClassificationBackups/RTO/RPOAir Gap High AvailabilityLoad BalancingVirtualization
Domain 4.0 — Security Operations (28%)

Objectives: 4.1 Security Techniques · 4.2 Asset Management · 4.3 Vulnerability Management · 4.4 Monitoring · 4.5 Enterprise Capabilities · 4.6 Identity & Access · 4.7 Automation · 4.8 Incident Response · 4.9 Investigations

SIEMEDR/XDRIncident Response Phases RBAC/ABAC/MFASSO/SAML/LDAPVulnerability Scanning Log AnalysisThreat HuntingDigital Forensics DLPDMARC/SPF/DKIM802.1X
Domain 5.0 — Security Program Management & Oversight (20%)

Objectives: 5.1 Security Governance · 5.2 Risk Management · 5.3 Third-Party Risk · 5.4 Compliance · 5.5 Audits & Assessments · 5.6 Security Awareness

Policy/Standard/ProcedureRisk RegisterBIA/RTO/RPO SLA/NDA/MOUPen TestingCompliance Frameworks GDPR/PrivacySLE/ALE/AROVendor Assessment Phishing CampaignsSecurity AwarenessGovernance Structures

🧠 Domain Study Guide — Gravity Falls Mnemonics

📌 P.I.N.E.S. — Domain 1: General Security Concepts

P.I.N.E.S.Policies, Integrity, Networks, Encryption, Safeguards

CIA Triad & Fundamental Concepts

  • Confidentiality: Journal 3 secrets stay hidden from Gideon and Bill.
  • Integrity: Entries remain unaltered; Blendin's time-travel can't corrupt them.
  • Availability: Ford's bunker systems stay online during Weirdmageddon.
  • Non-repudiation: Digital signatures prove Ford wrote the journals — he can't deny it.
  • AAA: Authentication (who you are), Authorization (what you can do), Accounting (what you did).
  • Zero Trust: "Trust no one" — even inside the Shack, everyone is verified before accessing Ford's lab.

Security Control Types

  • Preventive: Lock the bunker door — stops Bill before he enters.
  • Detective: Cameras catch Gideon sneaking through the vending machine.
  • Corrective: Restore journals from backup after an alteration.
  • Deterrent: Warning sign: "DO NOT ENTER — Highly Dangerous Anomalies."
  • Compensating: If biometrics fail, use a multi-digit code instead.

Cryptographic Solutions

  • Hashing: One-way fingerprint; SHA-256 the journal page, any change detected immediately.
  • Salting: Add random data before hashing to defeat rainbow table attacks on passwords.
  • PKI: Ford issues certificates; CA signs them; CRL lists revoked certs.
  • Symmetric (AES): One shared key — Dipper and Ford both hold it.
  • Asymmetric (RSA/ECC): Ford publishes a public key; only his private key decrypts.
Mini Quiz: Hiding Journal 3 in a secret compartment primarily protects which CIA pillar?
A. Confidentiality
B. Integrity
C. Availability
⚡ S.T.A.N.F.O.R.D. — Domain 2: Threats, Vulnerabilities & Mitigations

S.T.A.N.F.O.R.D.Social Engineering, Threat Actors, Attack Vectors, Network Attacks, Flaws, Outages, Ransomware, Demons

Threat Actor Classifications

  • Bill Cipher: APT/Nation-state level — reality-bending, high resources, sophisticated. Motivated by chaos and conquest.
  • Gideon Gleeful: Hacktivist/organized-crime hybrid — social engineering, physical threats, persistent adversary.
  • Random anomalies: Unskilled attackers / zero-day threats — unpredictable, zero-day exploits in reality itself.
  • Shack insider: Insider threat — legitimate access abused; most dangerous because already trusted.

Social Engineering Attacks

  • Phishing: Fake email — "New anomaly research discovered, click here."
  • Spear phishing: Targeted at Ford specifically — references his dimensional research.
  • Vishing: Voice call — Gideon impersonating the Mayor to extract info.
  • Pretexting: Bill creates a false identity and backstory to manipulate victims.
  • Watering hole: Compromise a site Ford visits — GravityFallsResearch.net.

Malware & Attack Types

  • Ransomware: Bill encrypts Ford's research — "Sign the deal or lose everything."
  • Rootkit: Hidden deep in the Shack's systems, invisible to normal scans.
  • Logic bomb: Triggers when Blendin sets a specific date in the time machine.
  • DDoS: Anomaly army floods the network — overwhelming capacity.
  • SQLi/XSS: Application-layer attacks on the Shack's tourist website.
Bill Cipher convincing someone to "just sign this deal" is best described as:
A. Social engineering
B. Patch management
C. Network segmentation
🏗️ F.O.R.D. — Domain 3: Security Architecture

F.O.R.D.Frameworks, Organization, Resilience, Design

Network Segmentation & Infrastructure

  • Shack guest Wi-Fi: Low trust, tourist-facing — think DMZ / screened subnet.
  • Ford's bunker network: High security, air-gapped from tourist systems.
  • Town systems: Separate segment, different risk profile entirely.
  • VPN: Ford securely connects from town to his bunker over an encrypted tunnel.
  • Jump server: Dipper must proxy through a secure host before touching bunker systems.

Secure Design Principles

  • Least privilege: Soos has ops access; he cannot read Ford's dimensional research files.
  • Defense in depth: Physical locks + network firewall + application controls + monitoring.
  • Fail-secure: Bunker door defaults CLOSED, not open, on system failure.
  • Separation of duties: One person discovers anomalies, another approves containment.

Resilience & Recovery

  • RTO: Max downtime before research operations collapse — 4 hours.
  • RPO: Max data loss acceptable — no more than 24 hours of journal entries.
  • Hot/Warm/Cold sites: Hot = bunker backup always running; Cold = alternate Shack location, no data yet.
  • Backups: Encrypted, offsite, tested with restore drills (tabletop exercises at Ford's kitchen table).
Keeping Ford's bunker on a separate network from the Shack guest Wi-Fi is:
A. Network segmentation
B. Obfuscation
C. Vishing
🐷 W.A.D.D.L.E.S. — Domain 4: Security Operations

W.A.D.D.L.E.S.Watch, Alerts, Detection, Data, Logs, Events, Stability

Monitoring & SIEM

  • SIEM: One console showing Shack, bunker, and town events — correlates anomaly patterns.
  • Log aggregation: All access logs centralized; firewall, OS, application, IDS/IPS logs combined.
  • Alert fatigue: Soos ignoring the 50th "Bill-like pattern" alert of the day. Tune your rules.
  • EDR/XDR: Endpoint agents watching for malicious behavior on every terminal in the Shack.
  • DLP: Prevents journal entries from leaving via email to Gideon.

Identity & Access Management

  • RBAC: Dipper (analyst), Ford (architect/admin), Soos (IT ops) — each role has defined permissions.
  • MFA: Password + hardware token + Ford's 6-finger handprint scan.
  • SSO / SAML: Log in once, access all Shack systems — credentials not re-entered per service.
  • 802.1X: Port-based NAC — devices authenticate to the network before getting access.
  • Privileged access management (PAM): Just-in-time access for admin tasks, no persistent admin sessions.

Vulnerability Management

  • CVE/CVSS: Bill exploits catalogued vulnerabilities; CVSS scores prioritize which to patch first.
  • Credentialed vs. non-credentialed scans: Credentialed finds more; like Dipper having a key to the room.
  • Bug bounty: Ford pays anomaly hunters who responsibly disclose vulnerabilities in his systems.
Investigating strange access patterns in Journal 3 log files is part of which IR phase?
A. Detection & Analysis
B. Preparation
C. Lessons Learned
👁️ B.I.L.L. — Domain 5: Governance, Risk & Compliance

B.I.L.L.Boundaries, Integrity, Laws, Liability

Security Governance

  • Policy: "No one may access the bunker without Ford's explicit written approval." High-level, management-issued.
  • Standard: "All bunker passwords must be 20+ chars, include symbols, changed every 90 days." Mandatory.
  • Procedure: Exact step-by-step Dipper follows to report and contain an anomaly. Specific, actionable.
  • Guideline: "Trust no one as a general mindset." Recommended, not mandatory.

Risk Management

  • Risk = Likelihood × Impact: Probability Bill appears × damage he causes.
  • SLE: Single loss expectancy — what one Bill attack costs in dollars.
  • ALE = SLE × ARO: Annual expected loss from all Bill-type incidents per year.
  • Avoid: Never open the interdimensional rift. Ever.
  • Mitigate: Add mystical wards + firewalls + monitoring around the Shack.
  • Transfer: Cyber insurance for anomaly-related data breaches.
  • Accept: "Gravity Falls will always be weird." Residual risk acknowledged.

Compliance & Audits

  • Compliance reporting: Internal audits (Ford reviewing his own controls), external (regulators auditing the Shack).
  • Pen testing: Dipper attempts to breach the bunker under a rules-of-engagement agreement with Ford.
  • NDA / SLA: Any vendor working with anomaly data signs an NDA; SLAs define acceptable uptime.
  • GDPR/Privacy: Tourist data from the Shack's website must comply with applicable privacy law.
"No one may access the bunker without Ford's approval" is an example of a:
A. Policy
B. Procedure
C. Guideline

🧬 Character → Security Role Mapping

SOC Analyst / Investigator
Dipper Pines

Reads logs, hunts threats, and documents anomalies in the journal. Dipper is your incident responder — methodical, evidence-driven, and relentless in detection and analysis.

User Awareness / Chaos Tester
Mabel Pines

Embodies end-user behavior — creative, unpredictable, and occasionally the source of unintentional insider risk. Mabel's social energy maps to user-awareness training and phishing susceptibility testing.

Security Architect / CISO
Ford Pines

The paranoid genius who designed the bunker's security architecture. Ford is your CISO — threat modeler, policy author, zero-trust evangelist, and PKI authority for anomaly research systems.

Business Owner / Insider Risk
Grunkle Stan

Stan runs the business with minimal security hygiene — cash-only, fake exhibits, probably violates a compliance regulation per episode. He's your insider-risk-adjacent business owner who prioritizes revenue over security controls.

IT Operations / Help Desk
Soos Ramirez

Soos fixes things — sometimes correctly, sometimes accidentally creating a misconfiguration. He represents IT ops: enthusiastic, well-meaning, and the reason change management procedures exist.

Physical Security / Operator
Wendy Corduroy

Cool under pressure, practical, and handles physical security. Wendy understands the real-world controls — she knows when to escalate, when to hold the line, and when something is genuinely weird vs. normal weird.

APT / Threat Actor
Bill Cipher

The ultimate Advanced Persistent Threat. Bill is nation-state-level: near-unlimited resources, reality-bending capabilities, motivated by chaos. He social engineers, exfiltrates from minds, and attacks at every layer simultaneously.

Persistent Adversary
Gideon Gleeful

Organized crime / hacktivist hybrid. Gideon uses social engineering, physical coercion, and manipulation to gain access. He's the threat actor that never gives up — persistent, resourceful, and personally motivated.

🔍 Deep-Dive Security Analogies

Scenario → Concept
Bill Reading Ford's Mind → Data Exfiltration

When Bill enters Ford's mindscape and extracts research data directly, that's advanced data exfiltration bypassing all technical controls. The countermeasure isn't purely technical — it's compartmentalization (Ford never giving Bill a mental foothold) plus strong MFA on access to sensitive thoughts. Organizations face the same with spear-phishing + credential theft leading to exfil.

Scenario → Concept
Vending Machine Elevator → Access Control Vestibule

The secret vending machine that leads to Ford's bunker is a physical access control vestibule — you must authenticate through the first door before the second opens. It enforces the principle that two separated checkpoints prevent tailgating. On the SY0-701 exam, this maps directly to objective 1.2 physical security controls and mantraps.

Scenario → Concept
Blendin's Time Tampering → Integrity Violations

Blendin Blandin traveling through logs and rolling back events is a perfect integrity attack — data is modified, timestamps are wrong, and the chain of custody for forensic evidence is destroyed. The defense is immutable logging, cryptographic log signing, and WORM storage so that even time-travel can't alter what was written.

Scenario → Concept
Weirdmageddon → Availability Attack (DDoS)

Bill turning Gravity Falls into a nightmare dimension is the ultimate availability attack — every system overwhelmed, no services function, communications cut off. The countermeasure parallels enterprise DDoS mitigation: scrubbing centers, CDN-based absorption, emergency failover to cold sites, and an incident response plan that survives Weirdmageddon-level disruption.

📝 High-Frequency Exam Topics — Study Notes

🔑 Ports You Must Know (from your flashcard CSV)

SSH=22 · HTTP=80 · HTTPS=443 · DNS=53 · NTP=123 · RDP=3389 · LDAP=389 · LDAPS=636 · Syslog=514 · RADIUS=1812/1813 · TACACS+=49

Memory hook: Bill speaks on port 443 (HTTPS), but his real channel is port 22 (SSH — Secure Shell… Bill's deals).

⚖️ Risk Formula & Business Impact

Risk = Likelihood × Impact  |  SLE = Asset Value × Exposure Factor  |  ALE = SLE × ARO

RTO = max downtime tolerated before operations fail. RPO = max data age acceptable at recovery. MTTR = average repair time. MTBF = average time between failures.

🔐 Crypto Quick Reference

AES = symmetric (128/192/256-bit) · RSA/ECC = asymmetric · SHA-256/SHA-3 = hashing · PBKDF2/bcrypt = key stretching/salting · Diffie-Hellman = key exchange · PFS = session keys not derived from long-term keys.

📧 Email Security Trio

SPF = lists authorized sending IPs in DNS · DKIM = cryptographic signature on outbound email · DMARC = policy telling receivers what to do when SPF/DKIM fail (quarantine, reject, or report).

Analogy: SPF = bouncer's guest list · DKIM = wax seal on the envelope · DMARC = instructions to the post office if the seal is broken.

🛡️ Zero Trust Core Principles

Never trust, always verify. Assume breach. Least privilege always. Micro-segmentation. Continuous monitoring and validation of every session — even Ford's own account gets re-verified when entering the bunker.

🚨 Incident Response Lifecycle — Domain 4.8

1
Preparation

Plans, playbooks, tools, training. Ford writes contingency plans; Dipper memorizes the journal.

4.8 Exam Tag
2
Detection & Analysis

Identify and understand the incident. Noticing Bill's symbol in SIEM logs and tracing the pattern.

4.8 Exam Tag
3
Containment

Limit the damage. Isolate compromised portals, restrict access to bunker systems, snapshot state.

4.8 Exam Tag
4
Eradication

Remove the threat. Purge Bill's code, close gateways, rebuild affected systems from known-good images.

4.8 Exam Tag
5
Recovery

Restore operations. Restore journals from encrypted offsite backups; verify integrity with hashes.

4.8 Exam Tag
6
Lessons Learned

Review and improve. Dipper updates Journal 3 with exactly what went wrong and how to prevent it next time.

4.8 Exam Tag

🔎 Detection Deep Dive

Indicators of Compromise (IoC)

Account lockouts, impossible travel (Bill logging in from Dimension 52-B and Oregon simultaneously), out-of-cycle logging, missing logs, resource spikes.

Threat Hunting

Proactively searching for threats not yet detected by automated tools. Dipper reading between the lines of the journal — finding anomalies before SIEM fires.

False Positives vs. Negatives

False positive = alert fires but nothing is wrong (Mabel's glitter gun triggers motion sensors). False negative = real attack missed (Bill slips through undetected). CVSS helps prioritize which to chase.

SIEM vs. SOAR

SIEM collects, correlates, and alerts. SOAR adds automated response — auto-blocks Bill's IP, auto-creates a ticket, auto-notifies Ford without Soos needing to click anything.

A system that only generates alerts but does NOT block traffic is a(n):
A. IPS
B. IDS
C. WAF

👥 Roles & Responsibilities

Data Owner

Ford — the creator and ultimate responsible party for Journal 3 data. Defines classification and access policy.

Data Custodian

Dipper — manages and protects the data on the owner's behalf. Runs backups, enforces access controls.

Data Processor

Soos — processes data per instructions from the owner. Doesn't make policy decisions, just executes them (sometimes incorrectly).

Privacy Officer (DPO)

Responsible for GDPR/privacy compliance. Ensures tourist data from the Shack's gift shop isn't shared without consent.

The person who creates and is ultimately responsible for data classification and policy is the:
A. Data Owner
B. Data Custodian
C. Data Processor

📋 Reporting Requirements

Internal Reporting

Immediate notification up the chain — Dipper tells Ford within 1 hour of detecting anomalous log activity. Internal SLAs typically require rapid escalation.

External Reporting

Regulatory notifications (GDPR: 72 hours to supervisory authority), breach disclosure to affected individuals, law enforcement when criminal activity is involved.

Timelines Matter

Many frameworks set hard deadlines: PCI DSS requires immediate notification to payment brands; HIPAA requires 60-day breach notification; GDPR requires 72 hours to regulator.

Legal Hold & Forensics

Before any eradication — preserve evidence. Chain of custody maintained for every artifact. Dipper documents who touched the journal, when, and under what supervision before it's cleaned up.

Under GDPR, a data breach must be reported to the supervisory authority within:
A. 24 hours
B. 72 hours
C. 30 days

🔁 Post-Incident Activity

Lessons Learned Meeting

Within 2 weeks of incident closure. Entire team present. Cover: what happened, root cause, what worked, what didn't, what to improve. Dipper writes it all into an updated journal entry — this becomes the new playbook.

Key Metrics to Review

MTTD (mean time to detect) · MTTR (mean time to respond/repair) · Number of IoCs detected vs. missed · Cost of incident · Compliance impact. These feed into the next risk assessment cycle.

Training & Awareness Updates

If Bill's social engineering succeeded because Mabel clicked a phishing link, new training is mandatory before the next tabletop exercise. Awareness campaigns are updated to reflect current threat actor TTPs observed in the incident.

🌀 Interactive Adventure: The Journal 3 Data Breach

Journal 3 has been tampered with. Entries are missing, timestamps are wrong, and SIEM is showing Bill's triangular symbol in 14 log files. Blendin Blandin has been spotted near the server room. This is a full IR scenario — walk through every phase correctly to stop Bill and restore the journals.

🔍 Scene 1 — Detection: Something is Wrong

Dipper notices journal entries from yesterday are gone, replaced by outdated versions. SIEM shows 47 failed logins from an unknown IP and a spike in outbound traffic at 3:17 AM. Ford is suspicious. What's your first move?

📊 Compare current journal data against known-good hashed backups and review SIEM correlation rules for the timeline
🎨 Assume Mabel was doodling in the logs again and close the alert

🃏 Leitner Flashcards — All 5 Domains

Spaced repetition: Box 1 = new/weak · Box 5 = "Explain it to Ford while Bill whispers backwards."   Space=flip · 1=Again · 2=Got It · 3=Easy · S=Skip

Loading...

✏️ 10-Question Security+ Quiz — Gravity Falls Edition

1. Hiding Journal 3 in a secret compartment primarily protects which CIA pillar?
A. Integrity
B. Availability
C. Confidentiality
2. Bill Cipher convincing someone to sign a deal using false promises is best described as:
A. Patch management
B. Physical security
C. Social engineering
3. Ford's bunker network isolated from the tourist Shack Wi-Fi is an example of:
A. Network segmentation
B. Obfuscation
C. DDoS mitigation
4. Blendin time-traveling and rolling system state back to older versions primarily threatens:
A. Availability
B. Integrity
C. Confidentiality
5. Soos having IT ops access but NOT access to Ford's research files demonstrates:
A. Full-disk encryption
B. Tailgating
C. Least privilege
6. Investigating strange log patterns in Journal 3 access records is part of which IR phase?
A. Preparation
B. Detection & Analysis
C. Lessons Learned
7. Isolating compromised portals and revoking active sessions after detecting Bill's rootkit is:
A. Preparation
B. Containment
C. Governance
8. Restoring journal files from verified encrypted backups after Bill's attack is:
A. Eradication
B. Detection
C. Recovery
9. "No one may access the bunker without Ford's written approval" is a(n):
A. Policy
B. Guideline
C. Procedure
10. "Never implicitly trust any user or device, even inside the Shack network" describes:
A. Defense in depth
B. Zero Trust
C. Tailgating prevention