ALISON Cheat Sheet 2026

The 30 highest-yield ALISON facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. Which best describes the scope of Operating Systems & Platforms in professional practice? → A comprehensive area covering both theoretical foundations and practical applications
2. What common challenge do professionals face when applying Operating Systems & Platforms principles? → Balancing theoretical best practices with practical constraints and real-world conditions
3. What type of file system artifact allows forensic investigators to recover deleted files on NTFS volumes? → Master File Table ($MFT)
4. Starting with Android 6.0 (Marshmallow), how were app permissions changed to improve security? → Dangerous permissions must be requested and granted individually at runtime
5. What distinguishes inherent risk from residual risk? → Inherent risk exists before controls; residual risk remains after controls are applied
6. What is the recommended approach to staying current in Cloud Computing & Virtualization? → Regular professional development, industry publications, and peer collaboration
7. Which concept in cybercrime investigation refers to determining what happened, when, who did it, and how during an incident? → Forensic timeline reconstruction
8. What is the primary purpose of industry regulations in this field? → To protect the public and ensure consistent professional standards
9. What common challenge do professionals face when applying Cryptography & Data Protection principles? → Balancing theoretical best practices with practical constraints and real-world conditions
10. What is network segmentation and why is it important? → Dividing a network into smaller segments to contain breaches and control access
11. Which term describes a highly targeted phishing attack aimed at a specific individual or organization? → Spear phishing
12. What is the most important competency assessed in Access Control & Identity Management for professionals in this field? → Applied knowledge and practical problem-solving ability
13. What is the security purpose of certificate pinning in mobile applications? → To ensure the app only trusts specific certificates, preventing MITM attacks via rogue CAs
14. What is the purpose of intrusion detection systems (IDS)? → To monitor network traffic for suspicious activity and known threats
15. Which best describes the scope of Application Security & Development in professional practice? → A comprehensive area covering both theoretical foundations and practical applications
16. What is a DMZ (Demilitarized Zone) in network architecture? → A network segment between internal and external networks that hosts public-facing services
17. What is the role of a 'write blocker' in digital forensics? → To prevent any writes to the evidence drive during imaging, preserving its original state
18. What is the recommended approach to staying current in Database Management & Security? → Regular professional development, industry publications, and peer collaboration
19. Which log file in Linux systems is most useful for tracking user authentication events during a forensic investigation? → /var/log/auth.log
20. What is the first step in the risk management process? → Risk identification — recognizing potential threats and vulnerabilities
21. Which attack technique involves following an authorized person through a secured door without using credentials? → Tailgating
22. What is the most important competency assessed in Cloud Computing & Virtualization for professionals in this field? → Applied knowledge and practical problem-solving ability
23. What is the most important competency assessed in Cryptography & Data Protection for professionals in this field? → Applied knowledge and practical problem-solving ability
24. Which best describes the scope of Access Control & Identity Management in professional practice? → A comprehensive area covering both theoretical foundations and practical applications
25. What is a rogue access point in network security? → An unauthorized wireless access point installed on a network without admin approval
26. What is the consequence of non-compliance with mandatory regulations? → Penalties including fines, license revocation, and potential legal action
27. What does a VPN provide in terms of network security? → Encrypted communication tunnels over public networks
28. What is 'network forensics' focused on? → Capturing and analyzing network traffic to reconstruct events and identify attackers
29. What is the recommended approach to staying current in Threat Detection & Incident Response? → Regular professional development, industry publications, and peer collaboration
30. What primary security risk does a BYOD (Bring Your Own Device) policy introduce in an enterprise environment? → Loss of organizational control over device security posture and data handling