CompTIA Security+ SY0-601: Security Assessments and Penetration Testing

Vocabulary flashcards based on CompTIA Security+ Exam Objectives (SY0-601) covering Security Assessment techniques and Penetration Testing methodologies.

Threat hunting

A proactive security assessment technique used to search for undetected cyber threats within a network.

Intelligence fusion

The process of combining and analyzing multiple sources of data and intelligence to create a comprehensive view of the threat landscape.

Threat feeds

Real-time streams of information that provide data on potential or current security threats.

Advisories and bulletins

Official notifications and publications issued by organizations or software vendors that describe security vulnerabilities and recommended mitigations.

Vulnerability scans

Automated security assessment tools used to identify known weaknesses, misconfigurations, and vulnerabilities in applications, web applications, or networks.

False positives

An error in security testing where a vulnerability is incorrectly reported as present when it does not actually exist.

False negatives

An error in security testing where an actual vulnerability exists but is not detected by the scanning tool.

Credentialed vs. non-credentialed scans

Credentialed scans use valid login credentials to perform a deeper, internal inspection of systems, while non-credentialed scans examine systems from an external perspective without access rights.

Intrusive vs. non-intrusive scans

Intrusive scans attempt to exploit a vulnerability to prove its existence, potentially disrupting services, whereas non-intrusive scans only look for markers of a vulnerability without exploitation.

CVE (Common Vulnerabilities and Exposures)

A list of publicly disclosed computer security flaws, providing standardized identifiers for vulnerabilities.

CVSS (Common Vulnerability Scoring System)

A numerical system used to provide a standardized way to measure the severity of security vulnerabilities.

SIEM (Security information and event management)

A security solution that provides real-time analysis of security alerts generated by applications and network hardware via log aggregation and monitoring.

User behavior analysis

A security process used to identify patterns in user activities to detect anomalies that may indicate a threat or compromise.

Sentiment analysis

A technique used in security monitoring to analyze the mood or attitude of users, often applied in social media or communication monitoring.

SOAR (Security orchestration, automation, and response)

A stack of compatible software programs that enables organizations to collect data about security threats and respond to low-level security events without human assistance.

Penetration testing

A simulated cyberattack performed against a computer system to evaluate its security by seeking exploitable vulnerabilities.

Known environment

A penetration test where the tester has full knowledge of the infrastructure and systems, formerly known as white-box testing.

Unknown environment

A penetration test where the tester has no prior knowledge of the target environment, formerly known as black-box testing.

Partially known environment

A penetration test where the tester has limited information about the target, such as internal IP addresses or network diagrams.

Passive reconnaissance

Gathering information about a target without directly interacting with its systems, often using OSINT.

Active reconnaissance

Gathering information about a target by directly interacting with its systems to find open ports, services, or vulnerabilities.

Rules of engagement

The agreed-upon constraints, scope, and parameters that define how a penetration test is to be conducted.

Lateral movement

A technique used by attackers (or testers) to move through a network after an initial compromise to seek additional targets.

Privilege escalation

The act of gaining higher-level access or permissions (e.g., administrative or root) on a system beyond what was initially granted.

Persistence

Techniques used to maintain access to a system or network over a long period, even after reboots or security updates.

Pivoting

The practice of using a compromised system as a base to attack or scan other systems on the same or different networks.

War driving

The act of searching for Wi-Fi wireless networks by a person in a moving vehicle, often using a laptop or smartphone.

OSINT (Open Source Intelligence)

Information collected from public legal sources, such as search engines, social media, and public records, for reconnaissance.

Red-team

A group of security professionals who act as attackers to test the effectiveness of a security program.

Blue-team

A group of security professionals who act as defenders to protect an organization's assets and respond to red-team attacks.

Purple-team

A collaborative security exercise where red and blue teams work together to share real-time feedback and maximize learning.

Bug Bounty

A program where organizations invite ethical hackers to find and report security vulnerabilities in their systems, rewarding them for their efforts.

Log Aggregation vs Log Collector

Log collectors are lightweight agents that gather and forward raw logs from individual servers, applications, or devices to a central location. Log aggregation is the broader, end-to-end process of collecting, parsing, standardizing, and centralizing these logs so they are searchable, analyzable, and useful for troubleshooting