Comptia Sec+ (1.0 General Security Concepts)

What is the purpose of security controls?

To prevent security events, minimize their impact, and limit the damage caused to assets.

What are the four categories of security controls?

Technical, managerial, operational, and physical.

What is a technical security control?

A control implemented using systems, such as operating system controls, firewalls, or anti-virus.

What is a managerial security control?

An administrative control associated with security design and implementation, such as security policies or standard operating procedures.

What is an operational security control?

A control implemented by people instead of systems, such as security guards or awareness programs.

What is a physical security control?

A control that limits physical access, such as guard shacks, fences, locks, or badge readers.

What are the six security control types?

Preventive, deterrent, detective, corrective, compensating, and directive.

A firewall rule blocks access to a resource. What type of control is this?

Preventive.

A warning sign is posted to make an attacker think twice. What type of control is this?

Deterrent.

Reviewing system logs to identify an intrusion attempt is what type of control?

Detective.

Restoring from backups after ransomware is what type of control?

Corrective.

Blocking a vulnerable application with a firewall instead of patching it is what type of control?

Compensating.

Training users to follow security policy is what type of control?

Directive.

Can a single security control fit more than one category or type?

Yes. Some controls can exist in multiple categories or types, and organizations may classify them differently.

What three principles make up the CIA Triad?

Confidentiality, Integrity, and Availability.

What is confidentiality?

Preventing disclosure of information to unauthorized individuals or systems.

What is integrity?

Ensuring data is stored and transferred as intended and that modifications can be detected.

What is availability?

Ensuring information is accessible to authorized users when needed; redundancy, fault tolerance, and patching can support it.

What is non-repudiation?

Proof that an action or message is genuine so the originator cannot credibly deny it.

How is a digital signature created?

Create a hash of the plaintext, encrypt the hash with the sender's private key, and include the encrypted hash with the plaintext.

What three properties can a digital signature provide?

Integrity, authentication, and non-repudiation.

What is identification in the AAA framework?

Claiming who you are, usually with a username.

What is authentication?

Proving you are who you claim to be using a password or other authentication factors.

What is authorization?

Determining what resources an authenticated user or device is allowed to access.

What is accounting?

Tracking resource usage such as login time, data sent and received, and logout time.

Why are authorization models useful?

They reduce complexity by placing roles, organizations, attributes, or similar abstractions between users and resources.

What is gap analysis?

Comparing the current security state with the desired state or baseline.

What should a gap analysis report provide?

A formal description of the current state and recommendations for meeting the desired baseline.

What is the core idea of Zero Trust?

Nothing is inherently trusted; every device, process, person, and access request must be verified.

What is the data plane?

The plane that processes frames, packets, and network data, including forwarding, trunking, encryption, and NAT.

What is the control plane?

The plane that manages data-plane actions using policies, rules, routing tables, session tables, and NAT tables.

What is the Policy Enforcement Point (PEP)?

The gatekeeper that can allow, monitor, or terminate connections.

What does the Policy Engine do in Zero Trust?

It evaluates each access decision using policy and other information sources and can grant, deny, or revoke access.

How can security zones affect access decisions?

Traffic may be allowed or denied based on source and destination zones, such as trusted, untrusted, internal, external, or departmental zones.

How does an access control vestibule improve physical security?

It controls passage through multiple doors so one door being open or unlocked prevents unrestricted opening of the others.

What is two-person integrity or two-person control?

A physical security practice that prevents any one person from having sole access to a protected asset.

What is the difference between a honeypot and a honeynet?

A honeypot is a deceptive system designed to attract attackers; a honeynet is a larger deception network containing one or more honeypots.

What is the difference between a honeyfile and a honeytoken?

A honeyfile is a fake bait file that can trigger an alert when accessed; a honeytoken is traceable fake data, such as credentials or email addresses, used to identify malicious activity.

What is change management?

A formal process for safely making changes such as software upgrades, patches, firewall changes, or switch-port modifications.

What information is typically included in a change approval process?

The purpose, scope, schedule, affected systems, impact, risk, approval, and end-user acceptance.

Why is a sandbox useful before a production change?

It provides an isolated environment to test upgrades or patches and confirm the backout plan without affecting production.

What is the purpose of a backout plan?

To provide a way to revert changes if the implementation fails or causes problems.

What is a maintenance window?

A scheduled period for making changes while minimizing disruption to production.

What is the difference between an allow list and a deny list?

An allow list permits only approved applications; a deny list blocks applications specifically identified as prohibited.

Why are dependencies important in technical change management?

Changing one component may require other services, libraries, systems, restarts, or upgrades to be changed in a specific order.

What is version control used for?

Tracking changes to files or configuration data over time so previous settings can be restored.

What is Public Key Infrastructure (PKI)?

The policies, procedures, hardware, software, and people used to create, distribute, manage, store, and revoke digital certificates and bind public keys to identities.

What is symmetric encryption?

Encryption that uses one shared secret key for both encryption and decryption.

What are the main advantages and disadvantages of symmetric encryption?

It is fast and has low overhead, but secure key distribution can be difficult and it does not scale well.

What is asymmetric encryption?

Public-key cryptography that uses mathematically related public and private keys; the public key can be shared while the private key must remain private.

What is key escrow?

An arrangement in which a trusted third party holds decryption or private keys under controlled conditions.

What is data at rest, and how can it be protected?

Data stored on devices such as SSDs, hard drives, USB drives, or cloud storage; it can be protected with full-disk, volume, file, or database encryption.

What is transport encryption?

Protecting data while it travels across a network, such as with HTTPS or VPN technologies.

Why are cryptographic keys critical to encryption security?

The algorithm is generally known; the secrecy and strength of the key are what protect the encrypted data.

What is key stretching?

Repeatedly processing or hashing a weak key or password to make brute-force attacks take more time.

What is an out-of-band key exchange?

Sharing a key using a different method than the network, such as telephone, courier, or in person.

How can asymmetric cryptography be used to establish a symmetric session key?

A client encrypts a random symmetric key with the server's public key; the server decrypts it with its private key and both use it as the session key.

What is a Trusted Platform Module (TPM)?

A hardware-based cryptographic component that can generate keys, store cryptographic information, and securely store items such as BitLocker keys.

What is a Hardware Security Module (HSM)?

High-end cryptographic hardware used to securely store many cryptographic keys and offload cryptographic processing.

What is a key management system?

A centralized system for creating, associating, rotating, monitoring, and managing encryption keys.

What is a secure enclave?

An isolated protected area, often hardware-based, that can provide boot monitoring, random-number generation, memory encryption, root keys, and hardware cryptographic functions.

What is obfuscation?

Making information harder to understand without necessarily making it impossible to recover.

What is steganography?

Hiding a message inside another medium such as an image, audio file, video, or network traffic.

What is tokenization?

Replacing sensitive data with a non-sensitive placeholder that is not mathematically related to the original data.

What is data masking?

Hiding part of the original sensitive data from view while the underlying data may remain intact.

What is a cryptographic hash?

A one-way function that represents data as a fixed-length message digest or fingerprint.

What is a hash collision?

When two different inputs produce the same hash value.

Why is a salt added to a password before hashing?

To add random data so the same password can produce different hashes and make rainbow tables ineffective.

What is a blockchain?

A distributed ledger in which participants maintain and replicate records of transactions.

What is a digital certificate, and what standard format is commonly used?

A public-key certificate that binds a public key and information about its holder with a digital signature; the common format is X.509.

What is a root of trust?

An inherently trusted hardware, software, firmware, or other component that provides a foundation for additional trust.

What is a Certificate Authority (CA)?

A trusted authority that digitally signs certificates so others can validate and trust the certificate holder.

What is a Certificate Signing Request (CSR)?

A request containing a public key and identifying information sent to a CA so the applicant can be validated and a certificate signed.

What are Subject Alternative Name (SAN) and wildcard certificates used for?

SAN allows a certificate to contain additional identification information and support multiple names; a wildcard certificate applies to multiple server names within a domain.

How do CRL, OCSP, and OCSP stapling provide certificate revocation information?

A CRL is a CA-maintained list of revoked certificates; OCSP lets clients query certificate status; OCSP stapling lets the certificate holder include CA-signed status information in the SSL/TLS handshake.