SC-730 Part 5: Capstone Final Review and Readiness Guide

This capstone brings together all four exam domains. Before sitting SC-730, you should be able to walk through each scenario below and pick the safest, policy-aligned action without hesitation. The exam tests judgment, not memorization — good answers are usually short, safe, and follow the reporting chain.

Exam Domain Weights (Quick Reference)

Domain	Weight	Key Topics
Cybersecurity Concepts	25–30%	Shared responsibility, MFA, password managers, data policies, CIA triad
Common Risks and Threats	30–35%	Social engineering, phishing, malware, insider threats, AI risks
Basic Security Practices	25–30%	Device security, data classification, data lifecycle, backups, 3-2-1 rule
Incident Response and Reporting	10–15%	Reportable incidents, incident report contents, response steps, escalation

Part 1 Review: Cybersecurity Concepts

Shared Responsibility Model

Stakeholder	Core Responsibilities
Executive/Organization	Fund security, enforce policy, create culture, audit, plan for incidents
IT/Security Team	Patch systems, monitor threats, implement controls, maintain logs and backups
Every Employee	Follow policy, use MFA, report suspicious activity, handle data securely

MFA: Why It Matters

Multifactor authentication combines at least two of these factors:

Something you know — password, PIN
Something you have — phone, hardware token, smart card
Something you are — fingerprint, facial recognition

MFA blocks over 99.9% of automated account attacks. On the exam, MFA is almost always the correct answer when asked how to protect an account against credential theft.

Exam tip: Repeated unsolicited MFA prompts you did not initiate are a sign of MFA fatigue attack. The correct response is to deny all prompts and report to the security team — not to approve one to make it stop.

Data Types That Must Not Go into Unapproved AI Tools

Customer personal data (names, emails, IDs)
Financial records, bank or payment details
Health information
Contracts, trade secrets, proprietary source code
Employee personal information
Legal proceedings or attorney-client communications

Part 2 Review: Risks and Threats

Social Engineering Techniques

Technique	How It Works	Exam Signal
Phishing	Fake email, SMS, or site harvests credentials or installs malware	Urgent link, spoofed sender, mismatched URL
Spear phishing	Targeted phishing using personal details about the victim	Mentions your name, manager, or current project
Vishing	Phone call impersonating IT, bank, or executive	Caller asks for credentials or urgent wire transfer
Pretexting	Attacker builds a false scenario to gain trust before asking for access	Plausible backstory, identity claim that can't be verified immediately
Baiting	Physical or digital lure (free USB, free download) with hidden malware	Found USB, too-good-to-be-true download
Business Email Compromise (BEC)	Impersonates exec or vendor to redirect payments	CEO email requests urgent wire, vendor changes bank details

Malware Indicators

System suddenly slow or overheating without explanation
Unexpected pop-ups or browser redirects
Programs opening or closing without user action
Hard drive activity when system should be idle
Disabled security software
Files modified, encrypted, or deleted unexpectedly
Unknown processes in task manager

Public Wi-Fi Risks

On public Wi-Fi, attackers can use man-in-the-middle attacks to intercept traffic. The correct protection is a corporate VPN. Never access sensitive work resources on public Wi-Fi without a VPN active.

Insider Threat Indicators

Accessing systems or files outside normal role or hours
Copying large amounts of data to external storage or personal email
Expressing grievance, resignation, or disengagement before unusual access
Disabling security software or logging

Part 3 Review: Security Practices

Data Classification Tiers

Tier	Examples	Handling Rule
Public	Marketing materials, published press releases	Can be shared freely; no special handling
Internal	Process documents, internal announcements	Share within organization; not for external distribution
Confidential	Strategy docs, contract terms, HR data	Need-to-know basis; encryption in transit and at rest
Restricted/Highly Confidential	Trade secrets, customer PII, regulated health data	Strictest controls; formal approval to share; DLP enforced

3-2-1 Backup Rule

3 copies of your data
2 different storage media types
1 copy stored offsite (or offline/immutable)

Critical point: Backups are only proven when a restore test succeeds. A backup that has never been restored is an untested assumption, not a recovery plan.

Data Lifecycle Stages

Collection — Collect only what is necessary (data minimization)
Use — Use only for the stated purpose (purpose limitation)
Transfer — Encrypt in transit, use approved channels
Storage — Encrypt at rest, access control, least privilege
Retention — Keep only as long as required by policy or regulation
Destruction — Secure, irreversible disposal (shred physical, cryptographic wipe for digital)

Part 4 Review: Incident Response

Nine Reportable Incident Types

Suspected or confirmed unauthorized access to systems or data
Lost or stolen devices containing work data
Malware infection or ransomware attack
Phishing email that may have compromised credentials
Accidental data exposure (wrong recipient, public share)
Account compromise or credential theft
Unusual system behavior suggesting a breach
Physical security breach (tailgating, unauthorized entry)
Any request to violate policy or bypass security controls

Initial Incident Report: Required Elements

Element	What to Include
Date and time	When did you first notice the issue?
Incident type	Phishing, malware, lost device, unauthorized access, etc.
Affected systems or data	Which device, file, account, or service is involved?
Actions taken so far	Did you disconnect, change a password, or forward the email?
Your contact information	How can the security team reach you for follow-up?

Response Phases

Phase	Timeframe	Key Actions
Immediate	First minutes	Stop the harm: disconnect device, lock account, forward phishing email, don't delete evidence
Follow-up	Hours to days	Work with IT: password resets, device forensics, scan for lateral movement
Long-term	Weeks to months	Root cause analysis, policy update, additional training, regulatory notification if required

Mixed-Domain Scenarios

Scenario 1: Payment Fraud Request

You receive an email that appears to be from your CFO asking you to urgently transfer funds to a new vendor account. The CFO is shown as traveling internationally.

Domain tested: Threat recognition (BEC) + incident response

Best actions:

Do not complete the transfer
Verify by calling the CFO directly using a known phone number (not a number from the email)
Forward the email to security team / report as potential BEC

Why not just reply to the email to confirm? In a BEC attack, the attacker controls the email thread. Any reply goes back to the attacker, who will confirm the request is legitimate.

Scenario 2: Found USB Drive

An employee finds a USB drive in the office lobby labelled "Confidential — Payroll Q4." They plug it in to see who it belongs to.

Domain tested: Baiting attack recognition + device security

Correct action: Do not plug in found USB drives. Hand it to IT security instead.

Why: Found drives are a classic baiting technique. Plugging in an unknown drive can install malware, create a remote access tunnel, or steal credentials — all within seconds of connection.

Scenario 3: Repeated MFA Prompts

An employee gets five MFA approval requests on their phone within 10 minutes. They did not initiate any of them. Approving one would stop the notifications.

Domain tested: MFA fatigue attack recognition + incident reporting

Correct action: Deny all prompts. Do not approve. Report to IT security immediately as a potential credential compromise — someone has your password and is trying to push through MFA.

Scenario 4: Overshared Document

A confidential contract was accidentally shared with "Anyone with the link" in the cloud storage platform instead of specific reviewers. The link was not sent to anyone externally yet.

Domain tested: Data classification + incident response

Correct actions:

Immediately change the sharing permission back to restricted access
Report the accidental exposure to the security team (this is a reportable incident)
Check access logs to confirm no one accessed it during the window

Scenario 5: Colleague Copying Files

A coworker in the same department is copying large batches of customer files to a personal USB drive and personal email account before an announced company restructuring.

Domain tested: Insider threat recognition + incident reporting

Correct action: Report to your manager or security team. Do not confront the colleague directly. Do not wait to see if they actually do something harmful — the behavior itself is a reportable incident.

Exam Readiness Checklist

Topic	Can You Answer Without Notes?
Who is responsible for what in the shared responsibility model?	Yes / Review Part 1
What are the three MFA factor types? Can you name examples?	Yes / Review Part 1
What makes an email suspicious? What are the red flags?	Yes / Review Part 2b
What are the 4 data classification tiers and their handling rules?	Yes / Review Part 3a
What does the 3-2-1 backup rule require?	Yes / Review Part 3b
What are the 9 reportable incident types?	Yes / Review Part 4
What must go in an initial incident report?	Yes / Review Part 4
What is the first action when you suspect a malware infection?	Yes / Review Part 2b + Part 4
What is the risk of pasting work data into unapproved AI tools?	Yes / Review Part 1 + Part 2a

Final note: SC-730 tests whether a non-technical business professional would make the right decision in a real security situation. The exam does not ask you to configure firewalls or write code. It asks whether you would recognize the threat, take the safe first action, and report correctly.