*cracked* comptia security plus sy0-701

might be ai generated

Secure Baseline

Approved secure configuration used as the standard for deploying systems and detecting unauthorized configuration changes.

Hardening

Reduces attack opportunities by removing unnecessary software, disabling unused services, and changing insecure defaults.

Mobile Device Management (MDM)

Centrally enforces device policies, including encryption, screen locks, application restrictions, and remote wipe.

Bring Your Own Device (BYOD)

Allows employees to use personal devices for work, requiring controls that protect company data without full organizational ownership.

Corporate-Owned, Personally Enabled (COPE)

Gives employees limited personal use of company-owned devices while retaining organizational control.

Choose Your Own Device (CYOD)

Lets employees select a device from an organization-approved list.

Wi-Fi Protected Access 2 (WPA2)

Protects wireless traffic using AES-CCMP; weak shared passwords can still be guessed offline.

Wi-Fi Protected Access 3 (WPA3)

Improves wireless security with SAE, which resists offline password guessing.

Simultaneous Authentication of Equals (SAE)

Password-based Wi-Fi authentication method used by WPA3 that makes offline password guessing harder.

Pre-Shared Key (PSK)

Secret configured in advance and shared by authorized users; changing it affects everyone who uses it.

Remote Authentication Dial-In User Service (RADIUS)

Centralizes network authentication and accounting, commonly supporting individual credentials through 802.1X.

Input Validation

Checks data against expected types, lengths, and formats before processing to reduce malformed input and injection risks.

Parameterized Queries

Separate database commands from supplied input so user data cannot be interpreted as SQL instructions.

Secure Cookie

Cookie configured with security attributes to reduce exposure of session data.

Secure Cookie Attribute

Restricts cookie transmission to HTTPS connections.

HttpOnly Cookie Attribute

Prevents client-side JavaScript from reading a cookie, reducing session theft through script injection.

SameSite Cookie Attribute

Restricts when browsers send cookies with cross-site requests, helping mitigate CSRF.

Static Application Security Testing (SAST)

Examines source code or compiled code without running the application to find flaws early in development.

Static Code Analysis

Examines code without executing it to identify potential defects and security weaknesses.

Dynamic Application Security Testing (DAST)

Tests a running application from the outside to identify exploitable runtime weaknesses.

Dynamic Analysis

Examines software behavior while it executes to reveal runtime problems.

Fuzzing

Feeds unexpected, random, or malformed inputs to software to uncover crashes and other defects.

Package Monitoring

Tracks third-party software components for known vulnerabilities, suspicious changes, and malicious updates.

Code Signing

Uses a digital signature to verify software origin and integrity, but does not guarantee that the software is safe.

Sandboxing

Runs code in an isolated environment to limit its ability to affect other systems or data.

Application Allow List

Permits only explicitly approved applications to run, blocking unapproved software by default.

Application Deny List

Blocks specified applications while allowing others, including potentially unknown malicious software.

Asset Inventory

Records organizational assets and their ownership, location, and classification to establish what should exist.

Enumeration

Actively discovers network devices, accounts, services, and other resources to identify what actually exists.

Shadow Information Technology (Shadow IT)

Technology used without IT approval or oversight, creating unmanaged security and compliance risks.

Acquisition and Procurement

Obtains hardware, software, and services while evaluating security requirements and vendor risks before purchase.

Sanitization

Makes stored data unrecoverable using methods that may allow the storage medium to be reused.

Destruction

Physically damages storage media so it cannot be reused and its data cannot practically be recovered.

Degaussing

Uses a strong magnetic field to erase magnetic media such as traditional hard drives and tapes; it does not sanitize SSDs.

Certificate of Sanitization or Destruction

Documents that storage media was sanitized or destroyed, providing evidence for audits and disposal records.

Data Remanence

Residual information that remains on storage media after deletion or formatting.

Decommissioning

Retires an asset by removing access, sanitizing or destroying data, and updating asset records.

Data Retention

Defines how long information must be kept and when it must be deleted to meet business and legal requirements.

Vulnerability Scan

Automatically checks systems for known weaknesses without attempting to exploit them.

Credentialed Vulnerability Scan

Uses authorized login credentials to inspect internal system details, such as missing patches and insecure settings.

Non-Credentialed Vulnerability Scan

Examines a system without logging in, showing externally visible weaknesses but providing less internal detail.

Penetration Test

Authorized security test that attempts to exploit weaknesses to demonstrate their actual impact.

False Positive

A finding incorrectly identifies harmless activity or a safe condition as a problem.

False Negative

A detection system fails to identify a real threat or vulnerability.

Common Vulnerabilities and Exposures (CVE)

Standard identifier assigned to a publicly documented cybersecurity vulnerability.

Common Vulnerability Scoring System (CVSS)

Scores a vulnerability's technical severity on a 0.0–10.0 scale; actual business risk depends on additional context.

Threat Feed

Supplies threat intelligence such as malicious IP addresses, domains, file hashes, and attacker techniques.

Open-Source Intelligence (OSINT)

Gathers information from publicly available sources for investigation, reconnaissance, and threat analysis.

Responsible Disclosure Program

Provides a process for researchers to report vulnerabilities privately so they can be addressed before public disclosure.

Bug Bounty Program

Offers rewards for qualifying vulnerability reports submitted under defined testing rules.

Vulnerability Remediation

Fixes or reduces a weakness through patching, reconfiguration, segmentation, or compensating controls.

Risk Exception

Formally approved deviation from a security requirement, usually documented with justification and compensating controls.

Risk Exemption

Explicit authorization to remain outside a specified security requirement under defined conditions.

Remediation Validation

Confirms that a security fix worked through rescanning, testing, or other verification.

Security Information and Event Management (SIEM)

Centralizes and correlates logs to detect suspicious activity and alert analysts.

Event Correlation

Links related events across systems to reveal patterns that individual alerts might not show.

Log Normalization

Converts differently formatted logs into a consistent structure for searching, comparison, and correlation.

Alert Tuning

Adjusts detection rules and thresholds to reduce false alarms without overlooking important threats.

Quarantine

Isolates a suspicious file, device, or message to prevent harm while it is investigated.

Security Content Automation Protocol (SCAP)

Standards for automating security configuration checks, vulnerability assessments, and compliance reporting.

Center for Internet Security (CIS) Benchmarks

Published secure-configuration recommendations for operating systems, applications, and other technologies.

Simple Network Management Protocol (SNMP)

Monitors and manages network devices; SNMPv3 adds authentication and encryption protections.

SNMP Trap

Notification sent by a managed device to report an event or condition to a monitoring system.

NetFlow

Records network traffic metadata, such as communicating addresses and traffic volume, without capturing packet contents.

Packet Capture

Records network packets, potentially including payloads, for detailed troubleshooting and security investigation.

Data Loss Prevention (DLP)

Detects or blocks sensitive information moving through channels such as email, removable media, and cloud uploads.

Firewall

Filters network traffic according to rules involving addresses, ports, protocols, or application characteristics.

Implicit Deny

Blocks traffic or access that has not been explicitly permitted by the applicable rules.

Access Control List (ACL)

Ordered rules defining which traffic or users may access a network path or resource.

Screened Subnet

Separates public-facing services from the internal network to limit the impact of a compromised internet-facing system.

Intrusion Detection System (IDS)

Monitors activity for signs of attacks and generates alerts without automatically blocking the traffic.

Intrusion Prevention System (IPS)

Inspects traffic and actively blocks detected malicious activity, commonly while positioned inline.

Host-Based Intrusion Prevention System (HIPS)

Detects and blocks suspicious activity on an individual endpoint.

Host-Based Firewall

Filters incoming and outgoing traffic on an individual device, including when it uses an untrusted network.

Web Filter

Allows or blocks web access based on URLs, categories, reputation, or organizational policy.

DNS Filtering

Blocks resolution of known malicious or prohibited domains before connections are established.

Group Policy

Centrally applies configuration and security settings to Windows users and domain-joined computers.

Sender Policy Framework (SPF)

Uses a DNS record to identify mail servers authorized to send email for a domain.

DomainKeys Identified Mail (DKIM)

Uses a digital signature to help verify an email's domain association and detect message alteration.

Domain-based Message Authentication, Reporting, and Conformance (DMARC)

Specifies how receivers should handle messages that fail SPF or DKIM checks and provides reporting.

File Integrity Monitoring (FIM)

Detects unexpected changes to important files and configurations that may indicate tampering.

Network Access Control (NAC)

Evaluates identity and device compliance before granting network access and may isolate noncompliant devices.

Endpoint Detection and Response (EDR)

Monitors endpoint behavior to detect threats and support investigation, containment, and response.

Extended Detection and Response (XDR)

Correlates security telemetry across multiple domains, such as endpoints, networks, cloud services, and email.

User and Entity Behavior Analytics (UEBA)

Detects suspicious deviations from typical user or device behavior, potentially revealing compromised accounts or insider threats.

Telnet

Provides remote command-line access over TCP port 23 without encrypting traffic, exposing credentials and commands.

Secure Shell (SSH)

Provides encrypted remote command-line access, commonly over TCP port 22.

Hypertext Transfer Protocol (HTTP)

Transfers web content over TCP port 80 without providing transport encryption by itself.

Hypertext Transfer Protocol Secure (HTTPS)

Protects HTTP traffic with TLS, commonly over TCP port 443.

File Transfer Protocol (FTP)

Transfers files using TCP ports 20 and 21 without encrypting credentials or content by default.

Simple Mail Transfer Protocol (SMTP)

Sends email between mail servers, commonly over TCP port 25; message submission commonly uses ports 587 or 465.

Lightweight Directory Access Protocol (LDAP)

Queries and manages directory information, commonly over TCP port 389 without encryption by default.

Lightweight Directory Access Protocol Secure (LDAPS)

Protects directory communication with TLS, commonly over TCP port 636.

Remote Desktop Protocol (RDP)

Provides remote graphical access to Windows systems, commonly over TCP port 3389.

Domain Name System (DNS)

Resolves domain names to IP addresses, commonly using port 53 over UDP or TCP.

Domain Name System Security Extensions (DNSSEC)

Uses digital signatures to authenticate DNS data and detect tampering, but does not encrypt DNS traffic.

Dynamic Host Configuration Protocol (DHCP)

Automatically supplies devices with IP addresses and network settings such as gateways and DNS servers.

Account Provisioning

Creates accounts and assigns appropriate permissions when access is needed.

Account Deprovisioning

Disables or removes accounts and access when they are no longer required.