Security+ Final week

Encrypting confidential data for a recipient uses which key?

The recipient’s public key. Only their private key can decrypt it.

What does the recipient use to decrypt data encrypted with their public key?

Their private key.

Digital signature: which key signs and which verifies?

Sender’s private key signs; sender’s public key verifies.

What provides confidentiality: hashing or encryption?

Encryption. It is reversible with the correct key.

What provides one-way integrity checking?

Hashing

Two parties establish a shared secret. What process is this?

Key exchange, commonly Diffie–Hellman.

Symmetric encryption

Same shared key encrypts and decrypts; fast; used for bulk data.

Asymmetric encryption

Public/private key pair; slower; used for key exchange, signatures and limited encryption.

What mathematical property underpins RSA?

A trapdoor function. Easy one way, difficult to reverse without secret information.

Encryption algorithm

Mathematical procedure that transforms plaintext into ciphertext.

Hash function

Produces a fixed-length, one-way digest for integrity.

Full-disk encryption

Encrypts the complete physical drive, including OS and files.

Volume encryption

Encrypts one logical volume, partition or virtual drive.

File-level encryption

Encrypts selected files or folders.

Data in transit: primary protection

Encryption, normally TLS or another secure tunnel.

TPM

Trusted Platform Module

Motherboard-integrated hardware storing keys and platform measurements.

HSM

Hardware Security Module

Dedicated hardware device for securely generating and managing cryptographic keys.

Root of trust

Foundation that is inherently trusted and supports the chain of trust.

Risk appetite

Broad amount and type of risk an organisation is willing to pursue or accept.

Risk tolerance

Specific acceptable variation or exposure before action is required.

Risk threshold

Point at which risk becomes unacceptable or triggers action.

Risk owner

Person or department responsible for managing a specific risk.

Risk register

Central record of identified risks, impacts, owners and responses.

Likelihood

Qualitative assessment of how likely a risk is to occur.

ARO

Annual Rate of Occurrence

Expected incidents per year.

SLE formula

Single Loss Expectancy

Asset value × Exposure factor.

ALE formula

SLE × ARO.

SLE $15,000 and ARO 0.1: ALE?

$1,500.

Due diligence

Investigation performed before selecting or entering an arrangement.

Due care

Ongoing reasonable actions taken to protect assets and meet obligations.

Internal audit

Organisation examines its own controls and processes.

Independent third-party audit

External, objective assessment of controls.

Attestation

Formal affirmation that a statement or report is accurate and complete.

TCO

Total Cost of Ownership

Total lifecycle cost: purchase, operation, maintenance, support and retirement.

CAPEX

Capital Expeniture

Initial capital purchase expenditure.

ROI

Return on Investment

Benefit or return compared with the investment cost.

DAC

Discretionary Access Control

Owner decides who can access the resource.

MAC

Mandatory Access Control

Central authority uses classifications and labels; users cannot alter permissions.

RBAC

Role-Based Access Control

Permissions assigned according to job role.

ABAC

Attribute-Access Control

Access based on attributes such as user, device, location, time and resource.

802.1X

Port-based network access control; authenticates before wired or wireless access.

NAC

Network Access Control

Assesses identity/device posture and allows, restricts or quarantines network access.

BYOD

Bring Your Own Device

Employee owns and uses the device.

COPE

Corperate owned, Personally Enabled

Company owns the device but permits personal use.

COBO

Corporate owned, Business only

Company-owned and restricted to business use.

CYOD

Choose Your Own Device

User chooses from an approved list of company-supported devices.

Default credential management

Replace factory-set usernames and passwords before deployment.

Data controller

Determines why and how personal data is processed.

Data processor

Processes personal data on behalf of the controller.

Data custodian

Handles operational storage, protection and maintenance of data.

Tap/monitor mode

Copies traffic for analysis without altering the traffic flow.

Inline mode

Device sits directly in the traffic path and can block or modify traffic.

IDS

Intrusion Detection System

Detects and alerts; normally does not block.

IPS

Intrusion Prevention System

Detects and actively blocks or rejects traffic.

HIDS/HIPS

Host-based detection/prevention on an endpoint.

What blocks unauthorised endpoint port activity and exfiltration?

HIPS

Signature-based detection weakness

May miss zero-day and unknown attacks.

Signature tuning

Reduces false positives caused by broad or unsuitable signatures.

Load balancer

Distributes traffic across servers for performance and availability.

WAF

Web Application Firewall

Protects web applications against attacks such as SQL injection and XSS.

Port 1433

Microsoft SQL Server.

Port 53

DNS

Port 21

FTP

Port 443

HTTPS

IP addresses plus port numbers correspond mainly to which OSI layer?

Layer 4, because ports are transport-layer identifiers.

Screened subnet/DMZ

Isolated zone separating public-facing services from the internal network.

WPA2-Personal authentication

Passphrase is used to derive the pairwise master key (PMK).

WPA3-Personal authentication

Uses SAE/Dragonfly, providing stronger protection against offline guessing.

TKIP

Temporal Key Integrity Protocol

Older per-packet keying protocol associated with WPA and legacy compatibility.

AES/CCMP

Advanced Encryption Standard

Counter Mode with Cipher Block Chaining Messaging Authentication Code Protocol

Stronger encryption used with WPA2 and later standards.

IaC

Infrastructure as Code

Infrastructure provisioned and managed using code or scripts.

Availability

Service remains accessible and operational.

Resilience

Ability to withstand disruption and recover quickly after failure.

Redundancy

Duplicate components remove single points of failure.

Scalability

Capacity can increase to support additional demand.

Failover

Switching operations to a standby system after failure.

RTOS security concern

Performance priorities may reduce protections such as buffer-overflow defences.

Shadow IT

Unapproved hardware, software or services used for convenience, usually without malicious intent.

Insider threat

Authorised insider intentionally or negligently abuses legitimate access.

Brute-force attack

Systematically tries many or all possible password combinations.

Dictionary attack

Tries words and candidate passwords from a prepared list.

Password spraying

Tries a small number of common passwords across many accounts.

Credential stuffing

Uses stolen username/password pairs against other services.

Credential replay

Reuses captured credentials or authentication material.

Replay attack

Captures and retransmits valid data, tokens or messages.

<script>, alert(), document.cookie

Code/script injection; commonly associated with XSS in web contexts.

CSRF

Cross-Site Request Forgery

Tricks an authenticated user’s browser into submitting an unwanted request.

Command injection

Executes operating-system commands through vulnerable input handling.

Directory traversal

Uses paths such as ../ to access files outside the intended directory.

Supply-chain attack

Compromises a trusted vendor, dependency, installer or service provider.

Watering-hole attack

Compromises a site frequently visited by the intended victims.

Typosquatting

Uses a misspelt or similar-looking domain to deceive users.

Cryptographic downgrade

Forces communication to use a weaker protocol or cipher.

Environmental variables in vulnerability management

Organisation-specific infrastructure, business and operational context affecting vulnerability risk.

Rescanning

Runs the vulnerability scan again to determine whether the finding remains.

Reviewing event logs

Examines system behaviour and evidence related to remediation or exploitation.

Patch management

Identifies, tests, deploys and verifies software or firmware security updates.

Baseline

Approved standard configuration used to identify deviation and configuration drift.

Log aggregation

Centralises logs to simplify correlation, investigation and compliance.

Archiving logs

Preserves historical evidence for later investigations, audits and analysis.