Security+ Fundamental Security Concepts

What is a gap analysis?

A comparison between the current security state and the desired security state to identify missing controls and improvements.

Why is a security gap analysis performed?

To identify cybersecurity risks, vulnerabilities, and areas where security controls need improvement.

What four categories of controls can a gap analysis identify?

Technical, Physical, Managerial, and Operational controls.

What are residual risks?

Risks that remain after security controls have been implemented.

What are common security gaps?

Weak/shared passwords, poor patch management, excessive privileges, missing acceptable use policies, weak physical security, poor auditing, and configuration errors.

What is Zero Trust (ZT)?

A security model that assumes no user or device is trusted by default, regardless of network location.

What does Zero Trust replace?

The traditional "Trust but Verify" security model.

What is the core principle of Zero Trust?

Never trust, always verify.

What does ZTNA stand for?

Zero Trust Network Access.

What security principle is heavily enforced in Zero Trust?

Least Privilege.

What is adaptive authentication?

Authentication that changes based on the user's level of risk.

What is another name for adaptive authentication?

Risk-based authentication.

What are the goals of Zero Trust?

Reduce attack surface, reduce threat scope, improve visibility, and minimize risk.

What is the Policy Decision Point (PDP)?

The Zero Trust component that makes access decisions.

What does the Policy Engine (PE) do?

Determines whether access should be granted, denied, or revoked.

What does the Policy Administrator (PA) do?

Creates or shuts down communication paths after the Policy Engine makes a decision.

What is a Policy Enforcement Point (PEP)?

A device or application that enforces access decisions.

Give examples of Network Policy Enforcement Points (PEPs).

Firewalls, routers, switches, and authentication proxies.

Give examples of Application Policy Enforcement Points (PEPs).

API gateways, VLANs, resource groups, and trusted cloud services.

What is the Zero Trust Control Plane?

The portion of Zero Trust responsible for making policy decisions.

What is the Zero Trust Data Plane?

The portion that carries user traffic after authorization.

What is a honeypot?

A decoy system designed to attract attackers.

What is the primary purpose of a honeypot?

To detect, observe, and slow attackers.

What is a honeynet?

A network made up of multiple honeypots.

What is a honeytoken?

A fake file or credential used to detect attackers or malicious insiders.

What do deception technologies help security teams analyze?

Attacker behavior, attack techniques, and kill chain activities.

What is the purpose of security fences?

To deter and prevent unauthorized physical access.

What are bollards?

Physical barriers that prevent vehicles from entering restricted areas.

What is a mantrap?

A secured entry area with two interlocking doors allowing only one person through at a time.

What attacks do mantraps help prevent?

Tailgating and piggybacking.

What authentication factor is an access badge?

Something you have.

Why are visitor logs maintained?

To record and track guests entering a facility.

What security functions do guards perform?

Preventive, detective, and deterrent controls.

What type of control is CCTV?

A detective physical security control.

Besides detecting incidents, how can cameras improve security?

They also deter attackers.

Why should cameras be combined with lighting?

To improve visibility and reduce blind spots.

What are the four major types of security lighting?

Continuous, standby, movable, and emergency lighting.

What does a photoelectric sensor detect?

A break in a light beam.

What does a passive infrared (PIR) sensor detect?

Infrared energy (body heat).

What does a vibration sensor detect?

Movement or vibration.

What does an acoustic sensor detect?

Changes in sound.

What does a microwave sensor detect?

Movement using high-frequency radio waves.

What does an electro-mechanical sensor detect?

A broken electrical circuit, such as when a door or window opens.

What environmental conditions do sensors commonly monitor?

Temperature and moisture.

What is change management?

A structured process for implementing changes while minimizing risk.

What usually comes before change management?

Configuration management.

What are the phases of the change management lifecycle?

Submit, Approve, Document, Test, Implement, and Review (After-Action Report).

What is a Change Impact Analysis?

An analysis that determines how a proposed change affects systems, users, and processes.

What is another name for Change Impact Analysis?

Gap Analysis.

What is a rollback (backout) plan?

A recovery plan used if a change fails.

What is a maintenance window?

A scheduled period during which changes are made.

What is an SOP?

Standard Operating Procedure.

What does RACI stand for?

Responsible, Accountable, Consulted, Informed.

How many Accountable people should there be in a RACI model?

Exactly one.

What is an allow list?

A list that explicitly permits approved actions or access.

What is a deny list?

A list that explicitly blocks prohibited actions or access.

Why is downtime important in change management?

Changes can affect system availability.

What technical considerations are important during change management?

Service restarts, legacy systems, dependencies, and secure state transitions.

What is a CMDB?

Configuration Management Database.

What is a CMS?

Configuration Management System.

Why is a CMDB important?

It supports asset management, change management, patch management, and incident management.

What does version control track?

Operating systems, applications, firmware, drivers, code, containers, patches, TPMs, and updates.