CompTIA Security+ $$SY0-701$$ Master Flashcards

Complete vocabulary review for the CompTIA Security+ $$SY0-701$$ exam, covering general concepts, threats, architecture, operations, and management.

CIA

Confidentiality, Integrity, and Availability.

Confidentiality

It prevents unauthorized disclosure of information.

Integrity

It ensures information is accurate, complete, and not improperly altered.

Availability

It ensures authorized users can access systems and data when needed.

AAA

Authentication, Authorization, and Accounting.

Authentication

Verifies who you are.

Authorization

Determines what you are allowed to do.

Accounting

Tracking and recording user activity.

Non-repudiation

Evidence that prevents a party from credibly denying an action or transaction.

Least privilege

Giving users and systems only the access necessary to perform their required tasks.

Zero trust

A security model that assumes no implicit trust and continuously verifies access.

Defense in depth

Using multiple overlapping security controls so $1$ failure does not compromise everything.

Symmetric encryption

Encryption using the same secret key to encrypt and decrypt data.

Asymmetric encryption

Encryption using a public/private key pair.

Hashing

A $1$-way transformation used to verify integrity or protect stored secrets.

AES

A widely used symmetric encryption algorithm.

RSA

Asymmetric cryptography, commonly used for encryption and digital signatures.

Digital signature

A cryptographic mechanism that provides integrity, authentication, and non-repudiation.

PKI

Public Key Infrastructure: the systems, policies, and processes used to manage public-key certificates.

Digital certificate

An electronic credential that binds an identity to a public key.

Security control

A safeguard designed to reduce risk or protect systems, data, and users.

Phishing

A social-engineering attack that uses deceptive messages to trick victims into taking an action.

Spear phishing

Highly targeted phishing aimed at a specific person or organization.

Whaling

Phishing targeting high-value executives or other senior personnel.

Smishing

Phishing conducted through SMS/text messages.

Vishing

Phishing conducted through voice calls or voice communications.

Business email compromise (BEC)

An attack involving impersonation or compromise of business email to induce fraud or unauthorized actions.

Ransomware

Malware that encrypts or otherwise locks access to data/systems and demands payment.

Trojan

Malicious software disguised as legitimate software or files.

Worm

Malware capable of self-propagating, often across networks.

Botnet

A collection of compromised systems controlled by an attacker.

Rootkit

Malware designed to maintain privileged access and hide its presence.

Zero-day vulnerability

A vulnerability unknown to the organization/vendor or lacking an available effective fix at the time of exploitation.

SQL injection

Injecting malicious SQL into application input to manipulate database queries.

XSS

Cross-site scripting: injecting script content into web content viewed by other users.

Buffer overflow

Writing more data to a memory buffer than it can safely hold, potentially causing crashes or code execution.

Credential stuffing

Using stolen username/password combinations against other services.

Password spraying

Trying a small number of common passwords across many accounts to avoid account lockouts.

Brute force

Systematically trying many possible passwords or keys until $1$ works.

Supply-chain attack

Compromising a trusted vendor, dependency, update, or service to reach downstream targets.

Insider threat

A threat originating from someone with legitimate organizational access.

IaaS

Infrastructure as a Service: the provider supplies virtualized infrastructure such as compute, storage, and networking.

PaaS

Platform as a Service: the provider manages the platform while the customer focuses primarily on applications/data.

SaaS

Software as a Service: the provider delivers and manages the application.

Public cloud

Cloud infrastructure offered to multiple customers by a provider.

Private cloud

Cloud infrastructure dedicated to a single organization.

Hybrid cloud

An environment combining private/on-premises resources with public cloud resources.

Cloud shared responsibility model

The provider and customer divide security responsibilities; the exact split depends on the service model.

Virtualization

Using software to abstract physical computing resources into virtual machines or other virtual resources.

Hypervisor

Software/firmware that creates and manages virtual machines.

Container

A lightweight isolated application environment that shares the host operating system kernel.

Network segmentation

Dividing a network into separate security zones to limit access and contain attacks.

VLAN

A logical network segment that separates traffic at $Layer\,2$.

DMZ

A segmented network zone used for systems that must be accessible from less-trusted networks.

Firewall

A control that permits, denies, or filters network traffic according to rules.

IDS

Intrusion Detection System: detects and alerts on malicious traffic.

IPS

Intrusion Prevention System: can detect and actively block malicious traffic.

WAF

Web Application Firewall that protects web applications from attacks such as injection and malicious HTTP requests.

VPN

A secure logical connection that commonly uses encryption to protect traffic over an untrusted network.

NAC

Network Access Control: controlling network access based on identity, device posture, policy, or other conditions.

Load balancer

A device/service that distributes traffic across multiple servers or resources.

Proxy

An intermediary that makes requests on behalf of a client or server and can provide filtering, privacy, or security controls.

Data at rest

Data stored on a device or storage system.

Data in transit

Data moving between systems or networks.

Data in use

Data actively being processed or accessed.

High availability

Designing systems to minimize downtime through redundancy and resilient components.

Fault tolerance

The ability to continue operating despite a component failure.

RTO

Recovery Time Objective: the target maximum time to restore a service after disruption.

RPO

Recovery Point Objective: the target maximum amount of data loss measured in time.

Hot site

A recovery site maintained in a highly ready state for rapid failover.

Cold site

A recovery location with basic facilities but requiring substantial setup before operations resume.

SIEM

Security Information and Event Management: centralized collection, correlation, analysis, and alerting of security logs/events.

SOAR

Security Orchestration, Automation, and Response: technology that automates and coordinates security workflows.

EDR

Endpoint Detection and Response: monitoring endpoints for suspicious behavior and supporting investigation/response.

XDR

Extended Detection and Response: correlates detection and response across multiple security layers and data sources.

Vulnerability management

The ongoing process of identifying, prioritizing, remediating, and validating vulnerabilities.

Hardening

Reducing a system's attack surface by disabling unnecessary services, applying secure settings, and removing weaknesses.

Secure baseline

An approved minimum secure configuration used as a standard for systems.

Patch management

The process of identifying, testing, approving, deploying, and verifying software updates.

IAM

Identity and Access Management: managing identities, authentication, authorization, and access.

MFA

Multi-factor authentication: using $2$ or more different authentication factors.

SSO

Single Sign-On: allowing $1$ authentication event to provide access to multiple services.

Federation

A trust relationship allowing identities authenticated by $1$ organization/domain to access resources in another.

RADIUS

A protocol commonly used for centralized authentication, authorization, and accounting for network access.

LDAP

A protocol used to access and manage directory information.

Kerberos

A ticket-based authentication protocol commonly associated with enterprise directory environments.

PAM

Privileged Access Management: controls and monitors privileged accounts and access.

MDM

Mobile Device Management: centrally managing and enforcing policies on mobile devices.

Incident response

The organized process of detecting, analyzing, containing, eradicating, and recovering from security incidents.

Digital forensics

The collection, preservation, examination, and analysis of digital evidence.

Chain of custody

Documentation showing who collected, handled, transferred, stored, or examined evidence.

Risk

The possibility that a threat will exploit a vulnerability and cause harm or loss.

Risk assessment

Identifying and analyzing risks to determine their likelihood and impact.

Risk avoidance

Eliminating the activity or condition that creates the risk.

Risk mitigation

Reducing the likelihood or impact of a risk through controls.

Risk transfer

Shifting some financial or operational consequences of risk to another party, often through insurance or contracts.

Risk acceptance

Formally acknowledging a risk and choosing to live with it.

Residual risk

The risk remaining after controls are applied.

Inherent risk

The level of risk before controls or mitigations are considered.

Risk register

A documented list of identified risks, their characteristics, owners, treatments, and status.