Security Best Practices and Data Protection. This is the digital version of locking your front door, hiding your valuables, and knowing who has a spare key. For the FC0-U71 exam, and for working in IT, you need to understand how to protect sensitive information from being stolen, lost, or tampered with.
Jump to a section
A simple way to picture Security Best Practices and Data Protection
Have you ever hidden a spare key under the doormat or in a fake rock? That spare key is convenient for you, but it's also the first place a burglar looks. Security best practices and data protection work in a similar way.
Let's say you rent out a flat. You give your front door key to a cleaner, a gardener, and a plumber. That's like giving users access to a computer system. Now, what happens if the plumber loses the key? If you used the same lock for the front door, the back door, and the garden shed, you'd have to change all the locks. That's expensive and time-consuming. But if you gave the plumber a key that only opens the back door, you only need to change that one lock. This is the principle of least privilege: give people only the access they absolutely need to do their job.
Furthermore, think about how you protect important documents. You don't leave your passport, your bank statements, and your birth certificate on the kitchen table for anyone to see. You put them in a locked filing cabinet or a safe. In the digital world, encrypting data is like putting those documents in a safe. Even if someone takes the filing cabinet (your hard drive), they cannot read the documents without the combination (the encryption key). Just like you wouldn't give a maid the combination to your main safe, you shouldn't give a software application access to every file on your computer. You create user accounts and passwords for digital locks, and you use encryption to lock the contents of the filing cabinet itself.
Security Best Practices and Data Protection are the rules and tools you use to keep digital information safe. Think of every file, every email, every login detail as something valuable. Without protection, anyone on the network (or the internet) could steal or alter it. This section covers the core concepts you need to know.
The most fundamental concept is the CIA triad. This stands for Confidentiality, Integrity, and Availability.
Confidentiality means keeping data secret from people who should not see it. This is achieved through encryption, access controls, and authentication.
Integrity means ensuring data has not been altered or corrupted. This is checked with hashing and backups.
Availability means data is accessible when you need it. Redundancy, backups, and disaster recovery plans ensure availability.
Now, let's break down the main tools and practices.
Authentication and Authorisation
Authentication is the process of verifying who you are. The most common method is a username and password. But passwords alone are weak. This is where Multi-Factor Authentication (MFA) comes in. MFA requires two or more factors:
Something you know (a password)
Something you have (a phone, a hardware token)
Something you are (a fingerprint or face scan)
Once you are authenticated, Authorisation determines what you are allowed to do. For example, a standard employee can read their own payslip, but only the HR manager can edit it.
Access Control Models
There are two main ways to control access:
Role-Based Access Control (RBAC). Permissions are assigned to roles (e.g., 'Sales Manager', 'System Administrator'), and people are assigned to those roles. This makes it easy to grant or revoke access for whole groups at once.
Principle of Least Privilege. This rule says a user or application should only have the minimum permissions needed to do their job. Never give someone 'admin' rights just because it is easier.
Data Protection Methods
Data is most vulnerable when it is being sent (in transit) and when it is stored (at rest).
Encryption at rest protects files on a hard drive or in a cloud storage. If someone steals the physical drive, they cannot read the data without the decryption key.
Encryption in transit protects data as it travels across a network. Think of HTTPS (the padlock in your browser). It encrypts the data between your computer and a website, so a hacker on the same Wi-Fi cannot read your credit card number.
Backups
If a hard drive fails or ransomware encrypts your files, a backup is your safety net. The 3-2-1 rule is a best practice:
3 copies of your data (one primary, two backups)
2 different storage media (e.g., external drive and cloud)
1 copy stored off-site
Physical Security
Digital security is useless if someone can walk into a server room. Locked doors, security cameras, and ID badges are physical controls. Similarly, you should lock your computer screen when you walk away (using Windows+L on a PC) to prevent 'shoulder surfing' or unauthorised access.
Patching and Updates
Software manufacturers regularly release updates that fix security holes (vulnerabilities). An unpatched system is like leaving a window open. Always install security patches as soon as possible.
Why does this matter? Without these practices, a business risks data breaches, legal fines, and loss of customer trust. For the exam, you need to recognise which tool or practice applies to each specific scenario.
Identify Assets and Risks
First, you determine what data is valuable (customer records, financial data, intellectual property) and how it could be harmed (theft, corruption, loss). This is the foundation of any security plan.
Implement Authentication Controls
You set up user accounts with strong passwords and enforce Multi-Factor Authentication (MFA) for all users. This verifies that each person is who they claim to be before they can access the system.
Apply Authorisation and Access Controls
Using Role-Based Access Control (RBAC) and the Principle of Least Privilege, you assign permissions. You ensure that an intern cannot delete the database, and an accountant cannot view HR records.
Encrypt Data at Rest and in Transit
You enable disk encryption (like BitLocker) on all devices to protect data at rest. You enforce HTTPS and VPNs to encrypt data in transit. This ensures that even if data is intercepted or stolen, it remains unreadable.
Set Up Backups and Disaster Recovery
You configure automated backups following the 3-2-1 rule. You also create a disaster recovery plan that outlines how to restore operations if primary systems fail. This ensures data availability.
Maintain and Monitor
You install security patches and updates on a regular schedule. You monitor logs for suspicious activity. This is an ongoing process, not a one-time task.
You are an IT support technician at a small marketing agency called 'BrightAd'. The company has 30 employees, many of whom work remotely. Your manager asks you to improve the company's security because a competitor recently suffered a ransomware attack. Here is exactly what you do step-by-step.
Step 1: Set up MFA for all employee accounts
You access the cloud admin panel (Microsoft 365 or Google Workspace). You enforce Multi-Factor Authentication for every single user. You also require MFA for the company's accounting software. This will stop a hacker who guesses a password from logging in.
Step 2: Implement the Principle of Least Privilege
You discover that all employees have local admin rights on their company laptops. A user could accidentally install malware. You create three roles:
'Standard User' (can install standard approved apps, cannot change system settings)
'Power User' (can install software, but cannot change security policies)
'Administrator' (full access, only for the IT team)
You reassign everyone to the 'Standard User' role, except three IT staff who get 'Administrator'.
Step 3: Enable encryption on all laptops
You use BitLocker (on Windows) to encrypt the hard drives of all company laptops. You store the recovery keys in a secure encrypted file, not on a shared drive. If a laptop is stolen, the thief cannot read the files.
Step 4: Set up regular backups
You configure a daily backup of all important files (shared folders, databases, email) to an external cloud provider. You set a retention policy of 30 days. You also make a weekly backup to a local network-attached storage (NAS) device that is disconnected from the internet when not in use.
Step 5: Update and patch all systems
You check for pending Windows updates and install them. You also update all major software (Adobe, Chrome, Microsoft Office). You enable automatic updates so you do not have to do this manually every month.
Step 6: Physical security
You install a lock on the server room door. You remind staff to lock their screens when they step away. You also put up a 'Clean Desk' policy: no passwords written on sticky notes.
Outcome: A month later, a phishing email arrives. A copywriter clicks a link, but because they are a 'Standard User' with MFA, the malware cannot escalate and the backup is intact. You restore the one infected file from the previous day's backup. The company loses almost no data.
The FC0-U71 exam tests 'Security Best Practices and Data Protection' in several specific ways. The questions are scenario-based multiple choice. They will describe a situation and ask you to choose the best solution. Here is exactly what to expect.
Concepts they love to test
CIA triad: You will get a scenario and you must identify which part of CIA is being compromised. Example: 'A user's password is stolen, and their emails are read.' Answer: Confidentiality.
MFA: They will ask you to name the 'best' way to improve login security. The answer is almost always 'Multi-Factor Authentication'.
Least Privilege: They will describe a situation where a user has too many permissions. The correct fix is to implement least privilege.
Encryption: Distinguishing between encryption at rest (hard drive) and encryption in transit (network). Example: 'Protecting data while it is sent from a browser to a server' is encryption in transit (HTTPS).
Backups: They will test the 3-2-1 rule. Memorise the three numbers and what each stands for.
Social Engineering: Questions about 'phishing', 'shoulder surfing', 'dumpster diving', and 'tailgating' appear. Know the definition of each.
Physical Security: Locked doors, badge readers, and camera systems.
Common traps
The exam might offer 'stronger passwords' as an answer. While strong passwords are good, MFA is always the better answer when the question asks for 'best' security.
They might list 'firewall' as an option when the real problem is data access control. A firewall controls network traffic, not who can read a file.
They might say 'use a password manager' when the best answer is 'use MFA'.
They will try to confuse you between authentication (who you are) and authorisation (what you can do).
Key definitions to memorise
Ransomware: Malware that encrypts your files and demands payment for the key.
Phishing: A fake email that tries to trick you into giving up credentials.
Tailgating: Following an authorised person through a secure door without using your own badge.
Authentication: Verifying identity.
Authorisation: Granting permissions.
Biometrics: Fingerprint, facial recognition, iris scan.
Exam tip: Read the scenario carefully. Identify whether the problem is about unauthorised access (Confidentiality), data being changed (Integrity), or data being unavailable (Availability). That will often lead you directly to the correct answer.
The CIA triad consists of Confidentiality (secrecy), Integrity (accuracy), and Availability (access).
Multi-Factor Authentication (MFA) is the single most effective way to prevent unauthorised logins.
The Principle of Least Privilege means granting users only the minimum permissions required to do their job.
Data encryption is required both at rest (on a hard drive) and in transit (over a network).
The 3-2-1 backup rule means 3 copies of data, on 2 different media, with 1 copy stored off-site.
Ransomware is a type of malware that encrypts your files and demands payment for the decryption key.
Social engineering attacks like phishing, shoulder surfing, and tailgating exploit human behaviour, not technology.
Regular software patching closes security vulnerabilities that attackers can exploit.
These come up on the exam all the time. Here's how to tell them apart.
Authentication
Verifies who you are (identity check).
Examples: password, fingerprint, security token.
Happens first, before you can do anything.
Authorisation
Determines what you are allowed to do.
Examples: read a file, run a program, change settings.
Happens after authentication is successful.
Encryption at Rest
Protects data stored on a hard drive, SSD, or database.
Tools: BitLocker, FileVault, LUKS.
Protects against physical theft of the device.
Encryption in Transit
Protects data while it travels across a network (e.g., internet).
Tools: HTTPS, VPN, SSL/TLS.
Protects against eavesdropping on network traffic.
Phishing
An attacker sends a fake email or message to trick you into revealing credentials.
Happens online, often via email or social media.
Prevention: do not click suspicious links, use MFA.
Shoulder Surfing
An attacker looks over your shoulder to see your password or PIN.
Happens in person, often in public places.
Prevention: use a privacy screen, lock your screen.
Firewall
Controls network traffic (blocks or allows connections).
Works at the network level.
Stops external attacks from reaching your computer.
Antivirus
Scans files and programs for known malicious code.
Works on the computer itself.
Removes malware that has already infiltrated the system.
Role-Based Access Control (RBAC)
A method of assigning permissions based on job roles.
Permissions are attached to roles, then users are assigned to roles.
Example: all 'Accountants' get access to the accounting software.
Principle of Least Privilege
A security principle that dictates minimising permissions.
It is the 'why' behind RBAC, not the 'how'.
Example: an accountant does not get access to HR files unless necessary.
Mistake
A strong password is enough to keep my account secure.
Correct
A strong password is important, but it can still be stolen or guessed. Multi-Factor Authentication (MFA) adds a second layer of protection that makes it much harder for an attacker to gain access even if they have your password.
People are used to relying on passwords alone. They do not realise how easy it is for hackers to steal passwords through phishing, data breaches, or brute-force attacks.
Mistake
Encryption protects data only when it is stored on a hard drive.
Correct
Encryption protects data both at rest (on a drive) and in transit (across a network). For example, when you visit a website with HTTPS, your data is encrypted while it travels over the internet.
The term 'encryption' is often used in popular media to mean 'locking a file'. People forget that data on a network cable or Wi-Fi signal is also vulnerable.
Mistake
If I back up my data to an external hard drive and keep it on my desk, I am safe.
Correct
The 3-2-1 rule requires one copy off-site. If your office floods, burns, or is robbed, the backup on your desk is destroyed too. An off-site copy (cloud or a different physical location) is essential.
People think 'I have a backup' is enough. They do not consider physical disasters that affect the entire building.
Mistake
A firewall and antivirus software are the same thing.
Correct
A firewall controls what traffic can enter and leave your network (like a security guard at the door). Antivirus software scans files for malicious code and removes infections (like a doctor checking for diseases). Both are needed, but they do different jobs.
Both are security tools, and beginners often lump all security tools together as 'protection'. The exam will test the difference.
Mistake
If a user has an administrator account, they can do everything safely because they have full control.
Correct
Administrator accounts are the most dangerous because a hacker who takes over that account has full control of the system. The principle of least privilege says you should only give administrator rights to IT staff who absolutely need them, and only for specific tasks.
People equate 'more access' with 'more power and more convenience'. They do not see the increased risk of a compromised admin account.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Authentication is the process of verifying your identity (e.g., entering a password). Authorisation is what you are allowed to do after logging in (e.g., reading a file or changing settings).
No. A strong password can still be stolen through phishing or data breaches. MFA adds a second factor (like a code on your phone) that makes it much harder for an attacker to break in.
It means having 3 copies of your data, stored on 2 different types of media (e.g., external drive and cloud), with 1 copy kept off-site to protect against physical disasters like fire or flood.
Encryption at rest protects stored files on a hard drive or database. Encryption in transit protects data while it travels across a network, like when you visit a secure website using HTTPS.
It is the security practice of giving users only the minimum permissions they need to do their job. For example, a standard employee does not need administrator access to install software.
Ransomware is a type of malicious software that encrypts your files and then demands a ransom payment to unlock them. Regular backups are the best defence against ransomware.
You've finished Security Best Practices and Data Protection. Continue through the FC0-U71 study guide to build a complete picture of the exam.
Done with this chapter?