Cybersecurity Analyst key topics and quick reference

Updated 16 September 2026 · 2 min read

Analysts depend on facts they can recall instantly during an investigation: which service a port belongs to, what kind of control a measure is, what a term in an alert means. The reference tables on this page gather those facts. The notes below explain how to study them and how they fit together when you analyse real activity.

How this guide was made

Written for this site with AI assistance, then checked automatically before publishing. The topic table, sample questions, worked examples and study plan are generated from this site’s question bank: each worked example is recalculated by separate code, and each sample answer says where it came from.

The guide deliberately states no salaries, grades, pass marks or exam dates. Those change, and they could not be checked here, so take them from the advert itself.

This site is independent and is not affiliated with MIFOTRA or any employer.

Where to spend your study time

The suggested emphasis reflects what this position works with day to day. It is a study guide, not a published exam blueprint.

Area	Suggested emphasis	Questions in the bank	Practise
Cybersecurity	45%	541	Security
Networking fundamentals	18%	2,636	Networking
Ports and protocols	18%	264	Networking
Linux command line	9%	360	In the full bank
Cloud and emerging technology	9%	188	In the full bank

Ports as evidence

In an investigation, a port number is a clue. Connections from the internet to remote desktop or file sharing ports deserve attention, and cleartext protocols such as Telnet or FTP on a network that should use encrypted ones suggest weak configuration. Learn each port alongside the risk it represents.

Quick reference

Ports worth knowing by heart

Service	Port	Transport
FTP data	20	TCP
FTP control	21	TCP
SSH (and SFTP, which runs over it)	22	TCP
Telnet	23	TCP
SMTP	25	TCP
DNS	53	TCP and UDP
DHCP server	67	UDP
DHCP client	68	UDP
TFTP	69	UDP
HTTP	80	TCP
Kerberos	88	TCP and UDP
POP3	110	TCP
NTP	123	UDP
NetBIOS name service	137	UDP
NetBIOS session	139	TCP
IMAP	143	TCP
SNMP	161	UDP
SNMP trap	162	UDP
LDAP	389	TCP
HTTPS	443	TCP
SMB over TCP	445	TCP
SMTPS	465	TCP
Syslog	514	UDP
SMTP submission	587	TCP
LDAPS	636	TCP
IMAPS	993	TCP
POP3S	995	TCP
MSSQL	1433	TCP
Oracle DB	1521	TCP
MySQL	3306	TCP
RDP	3389	TCP
PostgreSQL	5432	TCP
VNC	5900	TCP
HTTP alternate	8080	TCP

Security control types

Type	Purpose	Example
Preventive	Stops an incident happening	Firewall rule, MFA
Detective	Spots an incident in progress or after	Log monitoring, IDS
Corrective	Limits damage and restores service	Restoring from backup, patching
Deterrent	Discourages an attempt	Warning banner, visible cameras
Compensating	Substitutes where the preferred control is not possible	Extra monitoring on a legacy system

The CIA triad - confidentiality, integrity, availability - is the test every control is measured against.

Cybersecurity terms

Term	Meaning
Air gap	Physically isolating a system from untrusted networks
Data at rest	Stored data, as opposed to data moving across a network
DDoS	Overwhelming a service using traffic from many distributed sources
Digital signature	A value proving a message came from a key holder and is unaltered
Man-in-the-middle	An attacker relaying traffic between two parties who believe they are direct
Multi-factor authentication	Proving identity with factors from different categories
Non-repudiation	Assurance that a party cannot deny having taken an action
Penetration test	An authorised simulated attack to find exploitable weaknesses
Phishing	A message impersonating a trusted sender to obtain credentials or data
Privilege escalation	Gaining rights beyond those originally granted
Ransomware	Malware that encrypts data and demands payment for the key
SIEM	A system aggregating and correlating security events for analysis
Social engineering	Manipulating people rather than systems to gain access
Spear phishing	Phishing aimed at one named person using details specific to them
Symmetric encryption	Encryption where the same key both encrypts and decrypts
Trojan	Malware disguised as software the user wants to install
Worm	Malware that copies itself across a network without user action
Zero-day	A vulnerability exploited before a patch exists

Thinking in control types

Classifying controls helps you design layered defence. A strong design combines preventive controls such as multi-factor authentication, detective controls such as log monitoring, and corrective controls such as tested backups. Questions often ask for a control of a particular type, so practise classifying the measures you already know.

Terms that appear in alerts

Security tools use precise vocabulary. Understanding terms such as indicator of compromise, lateral movement, privilege escalation and exfiltration lets you read an alert quickly and decide what to check next.

Be able to explain

The difference between a vulnerability, a threat and a risk.
Why remote desktop exposed to the internet is dangerous.
What makes a control detective rather than preventive.
The difference between hashing and encryption.
What lateral movement looks like in logs.

Common questions

Which ports should I prioritise?

Remote access, file sharing, web, email and name resolution, because those appear most often in attacks and in firewall questions.

How do I learn the security terms efficiently?

Link each term to a real example or incident. Terms learned through examples are easier to recall and to apply.