Professor Messer's CompTIA SY0-701 Security+ Practice Exams - Vocabulary

Comprehensive vocabulary flashcards covering key security controls, threat vectors, cryptography, network architecture, and governance concepts from Professor Messer's CompTIA SY0-701 Security+ material.

Operational Control

A category of security controls implemented and executed by people rather than automated systems, such as security guards and user awareness programs.

Managerial Control

An administrative security control category focused on security design, policy development, and organizational procedures.

Physical Control

A security control category designed to limit physical access to facilities and assets, such as fences, badge readers, bollards, and door locks.

Technical Control

A security control category implemented through technology and computer systems, including operating system controls, firewalls, and automated logging systems.

Deterrent Control

A control type that does not physically stop an action, but is intended to discourage or dissuade an adversary from attempting an unauthorized intrusion, such as a warning login banner.

Compensating Control

A security control that does not stop an incident directly, but restores functionality or provides an alternative defense when an optimal security control is not feasible, such as using a UPS or reimaging systems from backups.

Passive Reconnaissance

The practice of collecting intelligence on a target from open, public sources (such as social media and corporate websites) without directly transmitting packets to the target's internal network.

Active Reconnaissance

Information gathering that interacts directly with target systems by sending network traffic, such as port scans or ping sweeps, which can be viewed and recorded in security logs.

OSINT (Open Source Intelligence)

The collection and analysis of information gathered from publicly available and open repositories, such as social media platforms, online discussion forums, and corporate websites.

SPF (Sender Policy Framework)

A DNS record listing all authorized mail servers permitted to transmit email on behalf of a given domain.

DKIM (DomainKeys Identified Mail)

An email authentication method that publishes a public key in DNS to allow recipient servers to validate the cryptographic digital signatures of incoming messages.

DMARC (Domain-based Message Authentication Reporting and Conformance)

A policy standard that instructs receiving email servers how to handle messages that fail SPF or DKIM checks, specifying dispositions such as accepting, quarantining to spam, or rejecting the email.

Root Cause Analysis

A structured problem-solving process that identifies the underlying, fundamental vulnerability or failure that enabled a security incident to occur.

MTBF (Mean Time Between Failures)

A statistical prediction estimating the average operational time elapsed between hardware breakdowns on a repairable system.

MTTR (Mean Time to Restore / Repair)

The average amount of time required to repair a failed device or component and return the system to normal operations.

RTO (Recovery Time Objective)

The target duration of time within which a service, system, or business process must be restored following an interruption.

RPO (Recovery Point Objective)

The maximum acceptable amount of data loss measured in time, dictating the operational point to which data must be restored from backups.

SLE (Single Loss Expectancy)

The calculated monetary loss incurred each time a single specific threat event takes place.

ARO (Annualized Rate of Occurrence)

The estimated number of times an incident or threat is projected to occur within a 12-month period.

ALE (Annual Loss Expectancy)

The total estimated financial loss an organization faces from a given risk over an entire year, calculated as $\text{ALE} = \text{SLE} \times \text{ARO}$.

Exposure Factor

The proportion or percentage of asset value lost when an incident occurs or a specific vulnerability is exploited.

Risk Appetite

A broad strategic description of how much risk an organization is willing to accept before implementing additional mitigation controls.

SLA (Service Level Agreement)

A legally binding contract between a service provider and customer detailing minimum required service metrics, such as availability, uptime, and response times.

SOW (Statement of Work)

A detailed project document listing the specific tasks, deliverables, timelines, and scope of work to be performed by a service vendor.

MOA (Memorandum of Agreement)

A formal, high-level document wherein participating organizations agree to a broad set of goals and objectives outlining their cooperative partnership.

Race Condition

A software or system vulnerability where two concurrent processes execute simultaneously without coordination, resulting in unpredictable behavior or continuous errors.

Access Control Vestibule

A physical access security feature consisting of a room with two interlocking doors designed to control and evaluate the flow of individuals entering or exiting a secure area.

Journaling

A fault-tolerance technique that writes transactions to a temporary log before committing them to the primary database or file system to minimize corruption during power outages.

MDM (Mobile Device Management)

A centralized software suite used by administrators to monitor, enforce security baselines, and remotely manage mobile devices across an enterprise.

COPE (Corporate-Owned, Personally Enabled)

A mobile device deployment strategy in which the organization purchases, configures, and owns the device while permitting the employee to use it for personal tasks.

BYOD (Bring Your Own Device)

A mobile device model where employees utilize their personal smartphones, tablets, or laptops for corporate work activities.

False Negative

A security scan result that erroneously fails to detect an existing threat, vulnerability, or exploit when one is actually present.

802.1X

An IEEE standard for port-based Network Access Control (NAC) that requires connecting client devices (supplicants) to authenticate against a centralized database via an authenticator switch or access point.

Posture Assessment

A client compliance check executed during network connection or VPN login to ensure host configurations, patches, and security software adhere to established baselines.

Discretionary Access Control (DAC)

An access control architecture where the creator or owner of an object exercises complete discretion over granting rights and permissions to other entities.

Mandatory Access Control (MAC)

An access control framework where operating system administrators assign security clearance levels to users and classification labels to objects, permitting access only when clearances match or exceed the object level.

Role-Based Access Control (RBAC)

An access control model where permissions are assigned to specific job roles or group definitions rather than to individual user accounts.

Smishing

A social engineering attack executed via SMS text messaging that directs victims to fraudulent login pages or requests sensitive personal details.

Vishing

Voice phishing; a telephone-based social engineering scheme where an attacker calls a victim while posing as an authority figure to elicit private credentials or account details.

DNS Poisoning

An exploit where fraudulent address records are written into a DNS server or resolver, improperly redirecting client internet traffic to unauthorized target IP addresses.

Domain Hijacking

An unauthorized modification of domain registration settings or external DNS controls that redirects user traffic intended for a legitimate organization to an attacker-controlled site.

Tabletop Exercise

A discussion-based incident response or disaster recovery simulation where stakeholders verbally review and evaluate operational response procedures around a conference table without altering live infrastructure.

DNS Filtering

A technique that screens domain name lookups against categorized threat feeds to block access to known malicious domains by returning a null or false IP address.

SCADA (Supervisory Control and Data Acquisition)

An industrial automation control system used to monitor and manage large-scale manufacturing facilities, utility networks, and infrastructure equipment.

Password Spraying

A horizontal brute-force technique that attempts a few commonly used passwords across a large collection of user accounts to evade account lockout thresholds.

Brute Force Attack

An attack methodology that systematically iterates through every possible alphanumeric and symbol combination until an authentication secret or password is identified.

Blockchain

A distributed, immutable shared ledger technology used to track, record, and verify transactions, supply chain parts, or digital assets without a centralized intermediary.

Zero Trust

A security paradigm based on the mandate that no entity inside or outside the network is inherently trusted, requiring continuous authentication and policy enforcement for all resource access requests.

Responsibility Matrix

A formal reference model published by cloud service providers establishing the division of security duties between the provider and customer across various deployment tiers (such as IaaS, PaaS, and SaaS).

Buffer Overflow

An application exploit where excess data submitted into an undersized memory buffer spills into adjacent memory spaces, often resulting in crashes or arbitrary code execution.

Key Escrow

A key management arrangement where a copy of cryptographic decryption keys is archived with a trusted third-party repository to ensure organizational recovery capability.

SASE (Secure Access Service Edge)

A cloud-native security framework merging software-defined wide-area networking (SD-WAN) and cloud-delivered security services into a unified remote connectivity solution.

Salting

The addition of a random, unique cryptographic string to a plaintext password prior to computing its hash digest to ensure identical passwords generate unique stored hashes.

Key Stretching

A security process that repeatedly runs a cryptographic key or password through thousands of hashing or transformation loops to slow down offline brute-force attacks.

SCAP (Security Content Automation Protocol)

A standardized protocol framework enabling automated scanning, vulnerability discovery, measurement, and configuration compliance evaluation across heterogeneous security tools.

Data Custodian

The operational role tasked with maintaining daily security controls, configuring user permissions, and ensuring data integrity on technical systems.

Data Owner

A senior stakeholder or executive ultimately accountable for the classification, business use, and overall lifecycle protection of organizational data.

Data Controller

The organization or entity that determines the overarching business objectives, requirements, and methods for processing personal data.

Data Processor

A party or external service provider that handles and processes personal data strictly according to the directives given by the data controller.

Data Subject

The identifiable living human being to whom personal information or personally identifiable data relates.

HSM (Hardware Security Module)

A dedicated, high-assurance physical computing device designed for centralizing, generating, storing, and accelerating cryptographic operations and digital keys.

TPM (Trusted Platform Module)

A dedicated cryptographic hardware chip integrated directly onto a computer motherboard to securely store burned-in keys and support full disk encryption.

Secure Enclave

A physically isolated hardware processor located within modern computing devices dedicated to protecting cryptographic operations, boot processes, and true random number generation.

SQL Injection

An input-handling exploit where malicious database queries are appended into application data fields, enabling the attacker to directly interrogate or alter backend database contents.

Trojan Horse

Malicious software disguised as an ostensibly beneficial or legitimate application that deceives the user into installing it, thereby compromising the host.

Rootkit

Malware that embeds itself into the operating system kernel or modifies system binaries to conceal its active presence and maintain persistent privileged access.

Logic Bomb

Malicious code embedded within a program that remains dormant until triggered by a specific predefined event, such as a designated date, time, or system action.

Keylogger

Hardware or software that records all keystrokes and user input on a computer, intermittently exfiltrating the captured credentials and logs to a remote attacker.

DLP (Data Loss Prevention)

Software or hardware solutions that inspect data in motion, at rest, or in use to recognize and prevent the unauthorized exfiltration of sensitive information.

Honeypot

A decoy server or application intentionally left vulnerable in a screened subnet to attract attackers, deflect them from production assets, and analyze adversary tactics.

CRL (Certificate Revocation List)

A published, periodically updated file maintained by a Certificate Authority containing certificates that have been revoked prior to their defined expiration date.

CSR (Certificate Signing Request)

A structured request sent by an applicant to a Certificate Authority containing identity details and a public key to be cryptographically signed into a digital certificate.

OCSP (Online Certificate Status Protocol)

A real-time network protocol used by browsers and applications to query a Certificate Authority directly to verify whether an SSL/TLS certificate has been revoked.

OCSP Stapling

An optimization mechanism where a web server queries the CA directly and embeds the time-stamped OCSP certificate status response into the initial SSL/TLS handshake with the client.

Data in-Transit

A state of data describing information actively moving across a network medium between communication endpoints.

Data at-Rest

A state of data describing information stored statically on persistent storage media, such as hard drives, databases, and backup tapes.

Data in-Use

A state of data describing information currently residing in volatile memory, CPU registers, or cache, actively being processed by a computing system.

Data Sovereignty

The legal concept dictating that digital data is subject to the privacy and storage laws and jurisdiction of the geographic nation where it physically resides.

Air Gap

A physical network segmentation strategy where a secured computing device or network has no physical or wireless network connection to any other system.

Jump Server

A hardened, highly secured gateway server through which administrative personnel establish encrypted remote terminal connections before bridging into protected network segments.

Tokenization

A data protection technique that substitutes sensitive details (like credit card account numbers) with a non-sensitive, randomly generated surrogate value called a token.

Data Masking

A privacy control that obfuscates sensitive information by substituting parts of the data with non-functional placeholder characters (such as asterisks), preventing exposure while preserving field layout.

Steganography

The cryptographic method of hiding a secret message or file inside an ordinary, non-suspicious carrier medium, such as embedding text within the pixels of an image file.

WAF (Web Application Firewall)

An application-layer firewall that analyzes incoming web traffic and user input to protect browser-based applications from attacks such as SQL injection and cross-site scripting.

Directory Traversal

An application vulnerability where an attacker uses file system navigation syntax (such as ../) to access files and directories outside of the designated web root.

Replay Attack

An attack where an adversary intercepts a valid, unencrypted network transmission or authentication payload and retransmits it later to execute unauthorized requests.

File Integrity Monitoring (FIM)

A security auditing utility that computes and tracks cryptographic hash values of critical system files and alerts administrators if unauthorized modifications occur.

Continuous Integration (CI)

A software development methodology where developers constantly merge new source code into a shared repository multiple times daily, accompanied by automated building and unit testing.

Non-Repudiation

A cryptographic assurance (commonly achieved via digital signatures) that confirms the authenticity of a message or transaction, making it impossible for the originator to deny sending it.

Playbook

A documented, sequential collection of conditional procedures and incident response steps designed to guide administrators through the mitigation of specific security scenarios.