🪵

Codename: Kids Next Door

Domains 1–5 · CompTIA Security+ SY0-701 · Full Exam Coverage

Sector V's Treehouse isn't just a clubhouse — it's a zero-trust security operations center run by five elite child operatives defending the world against adult tyranny. Every gadget, every mission, every access code maps perfectly to CompTIA Security+ SY0-701 concepts across all five domains.

📚 Topics Covered 🧠 Domain Mnemonics 🕵️ Character Mapping 🔍 Deep-Dive Analogies 📝 Study Notes 🚨 Incident Response 🔎 Detection Deep Dive 👥 Roles & Responsibilities 📋 Reporting Requirements 🎓 Post-Incident Activity 🎮 Interactive Adventure 🔗 Study Links 🃏 Leitner Flashcards ✅ 10-Question Quiz

📚 Topics Covered — All 5 Domains

🔵 Domain 1 · General Security Concepts (12%)

1.1 Security controls (technical, managerial, operational, physical; preventive, deterrent, detective, corrective, compensating, directive)

1.2 CIA Triad · Non-repudiation · AAA · Gap analysis · Zero Trust (Control Plane, Data Plane, Adaptive Identity, Policy Engine, Policy Administrator, Policy Enforcement Point) · Physical security · Deception tech

1.3 Change management (approval, impact analysis, backout plan, version control)

1.4 Cryptography (PKI, symmetric/asymmetric, hashing, salting, digital signatures, blockchain, certificates, key management)

CIA TriadZero TrustAuthenticationCryptographyPKIPhysical SecurityChange ManagementNon-repudiation
🔴 Domain 2 · Threats, Vulnerabilities & Mitigations (22%)

2.1 Threat actors (nation-state, hacktivist, insider, organized crime) & motivations

2.2 Attack vectors (phishing, vishing, smishing, BEC, watering hole, typosquatting, removable device, supply chain)

2.3 Vulnerabilities (buffer overflow, SQL injection, XSS, zero-day, misconfigurations, VM escape, hardware/firmware)

2.4 Indicators of malicious activity (ransomware, DDoS, on-path, credential replay, injection)

2.5 Mitigation (segmentation, least privilege, patching, encryption, application allow lists, hardening)

PhishingRansomwareDDoSSocial EngineeringZero-DaySQL InjectionThreat ActorsHardening
🟢 Domain 3 · Security Architecture (18%)

3.1 Architecture models (cloud, IaC, microservices, containerization, SDN, ICS/SCADA, on-prem vs cloud)

3.2 Secure enterprise infrastructure (DMZ, VPN, SASE, SD-WAN, firewalls, IDS/IPS, jump servers, proxy, load balancer)

3.3 Data protection (classification, encryption, masking, tokenization, data states)

3.4 Resilience & recovery (HA, backups, RTO/RPO, hot/warm/cold sites, tabletop exercises)

DMZVPN / ZTNAFirewall TypesSegmentationCloud SecurityData ClassificationRTO / RPOBackups
🟣 Domain 4 · Security Operations (28%)

4.1 Security techniques (hardening, MDM, wireless security, WPA3, application security, sandboxing)

4.2 Asset management (procurement, classification, inventory, sanitization, decommissioning)

4.3 Vulnerability management (CVSS, CVE, threat feeds, pen testing, bug bounty)

4.4 Monitoring & alerting (SIEM, DLP, SNMP, NetFlow, EDR/XDR, log aggregation)

4.5 Enhanced security (firewall rules, IDS/IPS, DNS filtering, email security DMARC/DKIM/SPF)

4.6 IAM (SSO, LDAP, SAML, OAuth, MFA, PAM, least privilege, RBAC)

4.7 Automation & orchestration (SOAR, scripting, API integrations)

4.8 Incident response (Preparation → Detection → Containment → Eradication → Recovery → Lessons Learned)

4.9 Forensics (chain of custody, legal hold, e-discovery, log data, packet captures)

SIEMMFARBACIncident ResponseChain of CustodyVulnerability MgmtSOAREDR/XDR
🟠 Domain 5 · Security Program Management & Oversight (20%)

5.1 Security governance (policies, standards, procedures, guidelines, governance structures, roles)

5.2 Risk management (risk identification, analysis — qualitative/quantitative, SLE/ALE/ARO, risk register, risk appetite)

5.3 Third-party risk (vendor assessment, SLAs, MOUs, NDAs, supply chain analysis)

5.4 Compliance (reporting, monitoring, privacy — GDPR, data retention, right to be forgotten)

5.5 Audits & assessments (pen testing types, internal/external audits, attestation)

5.6 Security awareness (phishing campaigns, anomalous behavior, insider threat training)

Risk ManagementSLA / NDAGDPRAUPPen TestingSecurity AwarenessGovernanceBIA

🧠 Domain Study Guide — KND Mnemonics

🔵 D1 — "NUMBUH" · General Security Concepts

Non-repudiation · User authentication (AAA) · Manage controls · Blockchain & crypto · Update via change management · Harden with Zero Trust

Control Types

  • Preventive – Treehouse access locks (stop threats before entry)
  • Detective – Numbuh 5's surveillance feeds (identify incidents)
  • Corrective – Emergency repairs after Father's attacks
  • Compensating – Backup ladders when elevators fail

Zero Trust in Sector V

  • Control Plane: Global KND Computer = Policy Engine + Policy Administrator making access decisions
  • Data Plane: Laser grids & trap doors = Policy Enforcement Points blocking unauthorized movement
  • Adaptive Identity: Numbuh 1 re-authenticates every room — no implicit trust inside the Treehouse
  • Threat Scope Reduction: Breach of one room can't spread — operative isolation by design

Cryptography Quick Notes

  • Asymmetric: Numbuh 2's lock-and-key gadget (public lock, private key)
  • Hashing: Fingerprint of mission files — any change = different hash
  • PKI: KND Certificate Authority vouches for operative identities
Mini Quiz: What Zero Trust component decides if access is granted?
A. Policy Engine
B. Policy Enforcement Point
C. Data Plane
🔴 D2 — "FATHER" · Threats, Vulnerabilities & Mitigations

Fishing (phishing) attacks · Adversarial threat actors · Trojan & malware · Hardening defenses · Exploit zero-days · Recon & social engineering

Threat Actor Types

  • Father = Nation-state actor (high resources, persistent, motivated by control)
  • Delightful Children = Organized crime (coordinated, well-funded, patient)
  • Adult street gangs = Hacktivist (ideological, disruptive)
  • Rogue operative = Insider threat (legitimate access, malicious intent)

Attack Vectors

  • Phishing: Fake Moon Base messages requesting operative credentials
  • Social Engineering: Adults posing as candy inspectors to gain Treehouse entry
  • Supply Chain: Compromised 2x4 tech from untrusted vendors
  • Removable Device: USB drives left near the Treehouse by Father's agents

Mitigation Techniques

  • Segmentation: Separate rooms = blast radius reduction
  • Patch management: Regular upgrades to 2x4 technology firmware
  • Application allow list: Only approved gadgets may run on Treehouse systems
  • Least privilege: Rookies can't access command center files
Mini Quiz: Father sending fake KND emails to steal operative passwords is called?
A. Watering hole attack
B. Phishing
C. Vishing
🟢 D3 — "TREEHOUSE" · Security Architecture

Transport security (VPN/TLS) · Redundancy & HA · Encryption of data · Environments (cloud/on-prem) · High availability sites · Orchestration (IaC/SDN) · User segmentation zones · Secure DMZ · Eradication design (fail-closed)

Site Recovery Types

  • Hot site: Second Treehouse fully operational, mirror of primary (can switch in minutes)
  • Warm site: Partially equipped backup base (needs hours to activate)
  • Cold site: Empty treehouse shell — just the location (days to set up)

Network Security Zones

  • Screened subnet (DMZ): Neutral zone where KND meets other factions safely
  • Trusted zone: Command center — only verified operatives with proper clearance
  • Untrusted zone: The outside world — Father's domain

Data States

  • Data at rest: Mission files in the Treehouse vault — encrypt them
  • Data in transit: Radio transmissions — use TLS/IPSec tunneling
  • Data in use: When Numbuh 5 reads mission files — RAM protection needed
Mini Quiz: A secondary Treehouse fully ready to take over operations immediately is a what?
A. Cold site
B. Warm site
C. Hot site
🟣 D4 — "SECTOR" · Security Operations

SIEM & log aggregation · EDR/XDR endpoint defense · Chain of custody (forensics) · Threat hunting & vuln scans · Orchestration (SOAR/automation) · Response lifecycle (IR phases)

Identity & Access Management

  • MFA: Something you know (code) + something you have (KND badge) + something you are (retinal scan)
  • RBAC: Numbuh 1 = CISO role, Numbuh 4 = physical security role — different permissions
  • SSO: One Moon Base login unlocks all sector resources (via SAML)
  • PAM: Just-in-time access to decommission files — no standing privilege

Monitoring Tools

  • SIEM: Numbuh 5's central intel board correlating all Treehouse event logs
  • NetFlow: Tracking all network conversations in and out of the Treehouse
  • DLP: Preventing mission blueprints from being emailed to Father
  • EDR: Real-time monitoring of every operative's terminal for anomalies

Automation & Orchestration

  • SOAR: Automated response — alert fires → system locks → ticket created, all without human click
  • Guard rails: Preventing operatives from misconfiguring the Treehouse network
  • API integrations: 2x4 tech talking to Moon Base systems via secure API
Mini Quiz: Numbuh 5 uses a system that correlates logs from all Treehouse sensors. This is a?
A. DLP system
B. SIEM
C. NetFlow collector
🟠 D5 — "KND GOV" · Security Program Management

Key risk indicators & register · NDAs & vendor agreements · Due diligence (third-party) · Governance & policies · Oversight & compliance · Vulnerability reporting & audits

Risk Management

  • SLE: Single candy store raid = $500 loss in candy reserves
  • ARO: Father attacks twice a year on average
  • ALE = SLE × ARO = $500 × 2 = $1,000 annual expected loss
  • Risk appetite: KND tolerates minor prank attacks but not decommissioning threats

Vendor & Third-Party Risk

  • SLA: Other sectors must respond to distress calls within 15 minutes
  • MOU: Mutual understanding with other kid factions on territory
  • NDA: Operatives can't reveal Treehouse location after decommissioning
  • Right-to-audit: KND can inspect allied sectors' security posture

Security Awareness

  • Phishing simulation: Send fake "free candy" emails to test operative vigilance
  • Insider threat training: Even best friends can be turned by the Delightful Children
  • Acceptable Use Policy: No personal gadgets on the Treehouse network
Mini Quiz: The document that defines acceptable behavior on KND computer systems is called?
A. Acceptable Use Policy (AUP)
B. Service Level Agreement (SLA)
C. Risk Register

🕵️ Character Security Mapping

👦
Numbuh 1 (Nigel Uno)
CISO / Mission Commander

Numbuh 1 sets Sector V's security policies, defines acceptable use rules, and enforces Zero Trust across all operations. He represents governance, risk appetite, and overall security program leadership — always demanding "verify before you trust."

✈️
Numbuh 2 (Hoagie Gilligan)
Security Architect / Engineer

The gadget engineer who designs secure 2x4 technology from the ground up. Numbuh 2 represents secure design principles, vulnerability management, and cryptographic implementation — building defense in depth into every piece of equipment.

🌸
Numbuh 3 (Kuki Sanban)
Availability & Continuity Manager

Numbuh 3 ensures systems stay up and morale stays high — mapping to business continuity, disaster recovery, and high availability planning. She maintains backup systems, ensures RTO/RPO objectives are met, and keeps operations running after incidents.

🥊
Numbuh 4 (Wally Beetles)
Physical Security Officer

The first line of physical defense — Numbuh 4 represents access control vestibules, bollards, security guards, fencing, and brute-force detection. His aggressive response style maps to active physical security controls and corrective actions against intruders.

🕵🏽‍♀️
Numbuh 5 (Abby Lincoln)
Threat Intel / SOC Analyst / IR Lead

Numbuh 5 handles threat intelligence, incident detection, containment, and forensic analysis. She represents SIEM monitoring, chain of custody, threat hunting, and the cool-headed analysis needed during active incidents — the calm in every Sector V storm.

🔥
Father
Nation-State Threat Actor / APT

Father is the ultimate Advanced Persistent Threat — highly resourced, motivated, and relentless. He represents external threat actors, sophisticated attack campaigns, and the need for robust threat scope reduction and continuous monitoring to detect his activities.

😈
Delightful Children From Down The Lane
Organized Threat Group / Insider Threat Proxy

The Delightful Children represent coordinated, organized attackers who exploit trust relationships. They map to organized crime, supply chain attacks, and social engineering campaigns — always working through trusted channels to maximize damage.

🌙
Moon Base / Global KND Command
Enterprise Security Operations Center / Policy Authority

Moon Base is the centralized Policy Engine and Policy Administrator in the Zero Trust architecture. It represents the cloud-based governance layer — handling decommissioning authority, sector authorization, and global policy enforcement across all KND sectors.

🔍 Deep-Dive Analogies

🏠 Treehouse Access Control → Zero Trust Architecture

Even inside the Treehouse, Numbuh 1 must re-authenticate to enter new rooms and access specific gadgets. This perfectly illustrates Zero Trust: location inside the network grants no implicit privilege. The Control Plane (Global KND Computer) evaluates every access request, while the Data Plane (laser grids, locked hatches) enforces the decision at the Policy Enforcement Point. No "castle and moat" — just continuous verification.

Domain 1.2Zero Trust
🍬 Candy Supply Chain → Third-Party Risk Management

KND operatives receiving candy from unknown suppliers represent third-party risk. Father could compromise the candy vendor (supply chain attack), injecting malicious ingredients before delivery. This maps directly to vendor assessment, right-to-audit clauses, and supply chain analysis in Domain 5 — you must assess every vendor's security posture before trusting their products in your environment.

Domain 5.3Supply Chain
📡 Numbuh 5's Intel Board → SIEM & Threat Hunting

Numbuh 5 aggregates reports from all sectors, correlates patterns, and proactively hunts for Father's agents before attacks occur. This mirrors SIEM log aggregation and correlation, threat hunting using behavioral analytics, and OSINT-driven intelligence gathering. Her practice of reviewing historical data to spot anomalies reflects Domain 4.4's security alerting and monitoring concepts.

Domain 4.4SIEMThreat Hunting
🪵 Treehouse Rebuild After Attack → Incident Response Lifecycle

After Father destroys a Treehouse wing, Sector V follows the full IR lifecycle: Preparation (backup plans existed), Detection (Numbuh 5 spotted the breach), Containment (sealed off compromised rooms), Eradication (removed all enemy devices), Recovery (rebuilt from blueprints), and Lessons Learned (updated patrol procedures). This real-world IR flow maps precisely to Domain 4.8's process steps.

Domain 4.8Incident Response
🛡️ 2x4 Tech Blueprint → Change Management & Version Control

Every gadget upgrade Numbuh 2 makes must go through Numbuh 1's approval process, with a backout plan in case the new tech fails in the field. This maps directly to Domain 1.3 change management: approval process, impact analysis, maintenance windows, backout plans, and version control for all technical changes to the Treehouse systems.

Domain 1.3Change Management
🔐 Decommissioning Ceremonies → Data Sanitization & Off-boarding

KND decommissioning — where operatives lose their memories of KND upon turning 13 — represents secure off-boarding and data sanitization. Former operatives can't retain classified KND knowledge (data), mirroring Domain 4.2's disposal/decommissioning requirements: sanitization, destruction, and certification that sensitive data is unrecoverable after an operative leaves the organization.

Domain 4.2Decommissioning

📝 High-Frequency Exam Study Notes

🎯 Zero Trust — Must Know

Control Plane = Policy Engine + Policy Administrator (the decision makers). Data Plane = Policy Enforcement Points (the enforcers). Adaptive identity means authenticating based on context, not just credentials. Implicit trust zones are eliminated — being "on the network" grants nothing.

⚡ IR Phase Order — Memorize This

P-D-A-C-E-R-L: Preparation → Detection → Analysis → Containment → Eradication → Recovery → Lessons Learned. The exam loves testing which phase comes where. Lessons Learned is always LAST. Containment comes BEFORE eradication.

🔐 MFA Factor Types

Something you know (password, PIN) + something you have (token, smart card) + something you are (biometric) + somewhere you are (geolocation). Two different factor TYPES = MFA. Two passwords = NOT MFA.

📊 Risk Math — ALE Formula

SLE = Asset Value × Exposure Factor. ALE = SLE × ARO (Annual Rate of Occurrence). MTTR = how long to recover. MTBF = how long between failures. RTO = how quickly you must recover. RPO = how much data loss is acceptable.

🌐 Firewall Types — Quick Reference

Packet filter: Layer 3/4, IP/port rules. Stateful: Tracks connection state. NGFW: Layer 7, application-aware, IPS built in. WAF: HTTP/HTTPS application attacks (XSS, SQLi). UTM: All-in-one security appliance.

🚨 Incident Response Lifecycle — Domain 4.8

When Father launches an attack on the Treehouse, Sector V follows the full NIST IR lifecycle. Every phase is a Domain 4.8 exam objective.

📋
1. Preparation

Numbuh 1 creates IR plans, trains operatives, maintains gadget inventories, and runs tabletop exercises before any attack occurs.

Domain 4.8
🔍
2. Detection & Analysis

Numbuh 5 identifies suspicious activity via SIEM alerts, anomalous log entries, and threat intelligence feeds indicating Father's movement.

Domain 4.8
🛑
3. Containment

Sector V seals compromised rooms, isolates affected systems, and prevents lateral movement — stopping the spread without full eradication yet.

Domain 4.8
🧹
4. Eradication & Recovery

All enemy devices removed, backdoors eliminated, systems restored from clean backups, and operations returned to normal verified state.

Domain 4.8
📖
5. Lessons Learned

Sector V debriefs, documents what happened, updates procedures, and improves defenses so the same attack cannot succeed again.

Domain 4.8

🔎 Detection Deep Dive — Domain 4.4

Effective detection means knowing what to look for, where to look, and how to respond when alerts fire. Numbuh 5 is Sector V's detection specialist.

Detection Mini Quiz: An operative suddenly accesses mission files at 3 AM from an unknown location. Which IoC category does this represent?
A. Resource consumption
B. Impossible travel / anomalous behavior
C. Out-of-cycle logging

👥 Roles & Responsibilities — Domain 5.1

📌 Data Owner

Numbuh 1 — responsible for classifying mission data and deciding who can access it. Accountable for data assets at the mission level.

🔧 Data Custodian/Steward

Numbuh 2 — implements technical controls to protect data per Numbuh 1's classification. Manages backups and technical safeguards.

⚙️ Data Processor

The Treehouse computer systems that process mission data on behalf of Sector V — processes data but doesn't determine its purpose or use.

🌐 Data Controller

Global KND Moon Base — determines the purposes and means of processing all operative personal data across sectors worldwide.

🔒 Privacy Officer (DPO)

Numbuh 5 — ensures KND operations comply with privacy regulations (GDPR equivalent), manages data subject rights, and oversees data retention policies.

🛡️ Security Operations

All five Sector V members collectively — executing daily security monitoring, responding to incidents, and maintaining Treehouse defenses per established procedures.

Roles Mini Quiz: Who is accountable for classifying and authorizing access to KND mission data?
A. Data Owner (Numbuh 1)
B. Data Custodian (Numbuh 2)
C. Data Processor (Treehouse Computer)

📋 Reporting Requirements — Domains 4.8 & 5.4

🏠 Internal Reporting

Incidents reported upward within Sector V chain of command immediately upon detection. Numbuh 1 notifies Moon Base within defined SLA timeframes. Internal reports include root cause analysis, containment status, and preliminary impact assessment.

🌍 External Reporting

Breaches affecting other sectors or partner factions require external notification. Regulatory equivalents (like GDPR breach notification within 72 hours) must be met. External reports go to regulatory authorities, affected parties, and law enforcement if criminal activity is involved.

⏱️ Reporting Timelines

GDPR: 72 hours to notify supervisory authority. HIPAA: 60 days for breach notification. Many regulations require immediate notification for critical infrastructure. Sector V must define these timelines in their IR plan before incidents occur — not during.

📁 Compliance Reporting

Regular attestation reports to Moon Base confirming Sector V's security controls are effective. Includes internal audit results, vulnerability scan reports, and evidence of training completion — demonstrating ongoing compliance rather than point-in-time snapshots.

Reporting Mini Quiz: Under GDPR, how long do organizations have to report a personal data breach to the supervisory authority?
A. 24 hours
B. 72 hours
C. 7 days

🎓 Post-Incident Activity — Lessons Learned

After every Father attack, Sector V conducts a formal post-incident review — the most important and most exam-tested phase of IR.

🎮 Interactive Adventure — Operation: SECURE TREEHOUSE

Sector V is under attack! Walk through the full Incident Response lifecycle with your operatives. Every choice matters. Wrong answers can be re-tried — "Try the other option!"

🔍 Scene 1: Detection — "Something's Wrong in the Treehouse"

Numbuh 5 notices unusual login attempts to the mission briefing room at 3 AM. The SIEM shows 47 failed attempts from an unknown IP. This is an indicator of:

A. Brute force attack — escalate to Numbuh 1 immediately and log everything ✅
B. Normal maintenance traffic — ignore it and go back to sleep
C. Delete the logs to keep things clean

🃏 Leitner Flashcard System — Sector V Training Deck

Keyboard: Space=Flip   1=Again   2=Got It   3=Easy   S=Skip

0Box 1
Hard
0Box 2
Medium
0Box 3
Easy
0Box 4
Mastered
0Box 5
Done ✅
Loading Sector V training deck...

✅ 10-Question Security+ Quiz — All Domains

Test your knowledge across all five domains. Auto-reset available after completion. Wrong answers show personalized topic feedback.

1. In Zero Trust, which component makes the access decision?
A. Policy Engine
B. Policy Enforcement Point
C. Data Plane
2. Father sends emails pretending to be from Moon Base to steal operative credentials. This is?
A. Vishing
B. Phishing
C. Watering hole
3. Sector V has a fully operational secondary Treehouse that can take over in minutes. This is a?
A. Cold site
B. Warm site
C. Hot site
4. Numbuh 5 aggregates logs from all Treehouse systems and correlates alerts. She is using a?
A. DLP system
B. SIEM
C. Vulnerability scanner
5. Sector V computes ALE for Father's attacks: SLE=$5,000, ARO=2. What is the ALE?
A. $5,000
B. $10,000
C. $2,500
6. Which IR phase comes immediately AFTER eradication?
A. Containment
B. Recovery
C. Lessons Learned
7. Numbuh 4 uses password + badge + fingerprint to access the armory. This is?
A. Single sign-on
B. Multi-factor authentication
C. Role-based access control
8. A firewall that inspects HTTP application traffic and blocks SQL injection is a?
A. Packet-filtering firewall
B. Web Application Firewall (WAF)
C. Stateful firewall
9. "Operatives must not share access codes" is best described as a?
A. Guideline
B. Policy
C. Procedure
10. GDPR requires breach notification to the supervisory authority within how many hours?
A. 24 hours
B. 48 hours
C. 72 hours