Security+ Glossary

Plain-English answers to the most-searched CompTIA Security+ SY0-701 questions. Every term mapped to its exam domain.

50+ terms defined
5 exam domains covered
SY0-701 aligned
๐Ÿ”
โ€” # โ€”

What is 802.1X authentication?

D3 ยท Architecture โ–ผ
802.1X is an IEEE standard for port-based Network Access Control (NAC) that requires devices to authenticate before being granted access to a wired or wireless network port.

Three components: Supplicant (client device), Authenticator (switch or AP), Authentication Server (RADIUS/LDAP).
802.1X prevents unauthorized devices from connecting. Combined with EAP for the actual authentication method. EAP-TLS (certificate-based) is the most secure EAP type.
View Full Definition โ†’ Practice Questions โ†’
โ€” A โ€”

What is Attribute-Based Access Control (ABAC)?

D1 ยท General โ–ผ
ABAC makes access decisions based on policies evaluating multiple attributes: subject attributes (role, department), object attributes (classification), and environmental attributes (time, location, device).
ABAC is the most granular access control model and the foundation of zero trust. RBAC = who you are. ABAC = who you are + what + how/when/where.
View Full Definition โ†’ Practice Questions โ†’

What is an Acceptable Use Policy (AUP)?

D1 ยท General โ–ผ
An AUP defines rules for using organization IT systems. All employees should sign during onboarding.
AUPs must inform users their activity may be monitored. Signed AUPs provide legal protection. AUP is the answer when asked about communicating security expectations to users.
View Full Definition โ†’ Practice Questions โ†’

What is AES encryption?

D5 ยท Crypto โ–ผ
AES is a symmetric block cipher. Key sizes: AES-128, AES-192, AES-256. Block size: 128 bits. Modes: ECB (avoid), CBC, GCM (preferred โ€” provides authentication too).
AES-256 in GCM mode is the gold standard. GCM provides both confidentiality AND integrity (AEAD). For disk encryption: AES-256 with XTS mode.
View Full Definition โ†’ Practice Questions โ†’

What is an air gap in cybersecurity?

D3 ยท Architecture โ–ผ
An air gap completely isolates a system from the internet and all unsecured networks. Stuxnet bridged an air gap via infected USB drives.
Air gaps provide the strongest isolation but aren't foolproof. USB drops, acoustic attacks, and electromagnetic emanations can bridge air gaps.
View Full Definition โ†’ Practice Questions โ†’

What is API security?

D3 ยท Architecture โ–ผ
API security protects APIs from attacks. Top vulnerabilities include BOLA/IDOR (accessing other users' data by manipulating IDs), broken authentication, and excessive data exposure.
APIs are the new perimeter. Common protections: OAuth/API keys, rate limiting, input validation, TLS, API gateway. BOLA (Insecure Direct Object Reference) is the most common API vulnerability.
View Full Definition โ†’ Practice Questions โ†’

What is an APT (Advanced Persistent Threat)?

D2 ยท Threats โ–ผ
An APT is a prolonged, stealthy attack by a motivated adversary โ€” typically nation-state โ€” who stays undetected for months or years. Lifecycle: spear phishing โ†’ C2 โ†’ lateral movement โ†’ exfiltration.
APTs are targeted, not opportunistic. Average dwell time is 200+ days. Defenses: segmentation, least privilege, threat hunting, DLP, robust logging.
View Full Definition โ†’ Practice Questions โ†’

What is ARP poisoning?

D2 ยท Threats โ–ผ
ARP poisoning sends fake ARP replies to link the attacker's MAC to a legitimate IP, redirecting LAN traffic for MITM attacks. Prevention: Dynamic ARP Inspection (DAI).
ARP poisoning only works on local segments (Layer 2). DAI on switches is the primary defense.
View Full Definition โ†’ Practice Questions โ†’

What is a birthday attack in cryptography?

D5 ยท Crypto โ–ผ
A birthday attack exploits the birthday paradox to find two inputs producing the same hash (collision). Why MD5 and SHA-1 are broken: collision attacks have been demonstrated against both.
Birthday attacks target hash functions. Defense: use longer outputs (SHA-256+). A 128-bit hash has only 64 bits of collision resistance due to the birthday bound.
View Full Definition โ†’ Practice Questions โ†’

What is a botnet?

D2 ยท Threats โ–ผ
A botnet is a network of malware-infected devices controlled via C2. Used for DDoS, spam, credential stuffing, and ransomware distribution.
Botnets power DDoS attacks. Mirai botnet used IoT devices with default credentials. Sinkholing disrupts botnets by redirecting C2 traffic.
View Full Definition โ†’ Practice Questions โ†’

What is a buffer overflow attack?

D2 ยท Threats โ–ผ
A buffer overflow writes more data to a buffer than it holds, overwriting adjacent memory. Attackers can redirect execution to malicious code.
Mitigations: ASLR, DEP/NX (non-executable memory), stack canaries, safe languages. Common in C/C++ programs.
View Full Definition โ†’ Practice Questions โ†’

What is a business continuity plan (BCP)?

D4 ยท Operations โ–ผ
A BCP outlines how an organization maintains critical functions during a disaster. Includes BIA (Business Impact Analysis), recovery strategies, and communication plan.
BCP = keeping the business running. DRP = recovering IT systems. BIA is done first to identify which systems have the lowest RTO/RPO.
View Full Definition โ†’ Practice Questions โ†’

What is a CASB (Cloud Access Security Broker)?

D3 ยท Architecture โ–ผ
A CASB sits between cloud users and apps to monitor activity, enforce security policies, and discover shadow IT. Capabilities: cloud DLP, threat protection, compliance enforcement.
CASB solves shadow IT. Provides DLP for cloud data. Think of it as a firewall/DLP for cloud services. Key for GDPR/HIPAA cloud compliance.
View Full Definition โ†’ Practice Questions โ†’

What is a disaster recovery plan (DRP)?

D4 ยท Operations โ–ผ
DRP restores IT systems after a disaster. ๐Ÿ”ด Hot site โ€” fully operational, minutes. ๐ŸŸก Warm site โ€” partially equipped, hours/days. ๐Ÿ”ต Cold site โ€” empty facility, days/weeks.
Hot = fastest recovery, highest cost. Cold = slowest, lowest cost. DRP testing: tabletop, walkthrough, simulation, parallel, full cutover. Testing validates the plan.
View Full Definition โ†’ Practice Questions โ†’

What is a DMZ in network security?

D3 ยท Architecture โ–ผ
A DMZ hosts public-facing services between two firewalls: Internet โ†’ Firewall 1 โ†’ DMZ โ†’ Firewall 2 โ†’ Internal network.
If a DMZ server is compromised, the attacker still faces the inner firewall. Bastion host = hardened server in the DMZ. Dual-firewall DMZ is more secure than single-firewall tri-homed.
View Full Definition โ†’ Practice Questions โ†’

What is a Faraday cage in security?

D3 ยท Architecture โ–ผ
A Faraday cage blocks electromagnetic fields โ€” preventing wireless signals from entering or leaving. Uses: SCIFs, forensic evidence bags (prevents remote wipe), RFID-blocking wallets.
In forensics, a Faraday bag prevents the owner from remotely wiping a seized phone. SCIFs use Faraday shielding for TEMPEST protection.
View Full Definition โ†’ Practice Questions โ†’

What is an HSM (Hardware Security Module)?

D5 ยท Crypto โ–ผ
An HSM is a dedicated tamper-resistant device that securely generates and stores cryptographic keys. FIPS 140-2/3 certified. Keys never leave in plaintext.
HSM is the most secure key storage. Used for CA root keys, TLS keys, code signing, PCI-DSS. TPM is similar but on-board. If asked about most secure key storage โ€” HSM.
View Full Definition โ†’ Practice Questions โ†’

What is an incident response plan?

D4 ยท Operations โ–ผ
NIST IR lifecycle: 1๏ธโƒฃ Preparation 2๏ธโƒฃ Detection & Analysis 3๏ธโƒฃ Containment, Eradication & Recovery 4๏ธโƒฃ Post-Incident Activity (lessons learned).
NIST uses 4 phases. SANS uses 6: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned. "Lessons learned" is always the last phase.
View Full Definition โ†’ Practice Questions โ†’

What is an insider threat?

D2 ยท Threats โ–ผ
An insider threat comes from people with authorized access โ€” employees, contractors. Types: malicious (intentional), negligent (accidental), compromised (stolen credentials).
Defenses: least privilege, separation of duties, job rotation, mandatory vacation, UEBA, DLP, monitoring privileged users, immediate offboarding.
View Full Definition โ†’ Practice Questions โ†’

What is a load balancer in Security+?

D3 ยท Architecture โ–ผ
A load balancer distributes traffic across servers for availability and performance. Security benefits: hides server topology, SSL/TLS termination, DDoS mitigation, failover.
Active-active = multiple servers handle traffic simultaneously. Active-passive = primary handles traffic; secondary activates on failure. Reduces single points of failure.
View Full Definition โ†’ Practice Questions โ†’

What is a logic bomb?

D2 ยท Threats โ–ผ
A logic bomb remains dormant until specific conditions are met (date, user action), then executes a destructive payload. Often planted by disgruntled employees.
Logic bombs are an insider threat tool. Defenses: code review, separation of duties, least privilege, monitoring for unusual scheduled tasks.
View Full Definition โ†’ Practice Questions โ†’

What is a man-in-the-middle (MITM) attack?

D2 ยท Threats โ–ผ
A MITM attack secretly intercepts communication between two parties. Techniques: ARP poisoning, DNS spoofing, SSL stripping, evil twin Wi-Fi.
TLS/HTTPS prevents MITM by authenticating the server. On public Wi-Fi, use a VPN. Certificate pinning prevents SSL stripping attacks.
View Full Definition โ†’ Practice Questions โ†’

What is a pass-the-hash attack?

D2 ยท Threats โ–ผ
Pass-the-hash (PtH) uses a captured NTLM hash to authenticate without knowing the plaintext password. Tools: Mimikatz.
PtH is a lateral movement technique. Defenses: Credential Guard, disable NTLM, use Kerberos, least privilege. Admin account hashes give access everywhere.
View Full Definition โ†’ Practice Questions โ†’

What is a proxy server in Security+?

D3 ยท Architecture โ–ผ
๐Ÿ”ต Forward proxy โ€” filters client outbound traffic.
๐ŸŸข Reverse proxy โ€” protects servers (WAF, load balancing).
๐Ÿ”’ Transparent proxy โ€” intercepts without client config.
Forward proxy = protects/monitors clients. Reverse proxy = protects servers. SSL inspection proxies decrypt HTTPS traffic โ€” requires deploying a trusted CA cert to clients.
View Full Definition โ†’ Practice Questions โ†’

What is a rainbow table attack?

D2 ยท Threats โ–ผ
A rainbow table is a precomputed lookup table mapping plaintexts to hashes, dramatically speeding up password cracking without real-time hashing.
Rainbow tables are defeated by salting โ€” adding a unique random value per password makes precomputed tables useless. Unsalted MD5/SHA-1 hashes are trivially crackable.
View Full Definition โ†’ Practice Questions โ†’

What is a replay attack?

D2 ยท Threats โ–ผ
A replay attack captures valid authentication data and retransmits it to gain unauthorized access without knowing the actual password. Prevention: nonces, timestamps, session token expiry.
Kerberos uses timestamps (within 5 minutes) to prevent replay attacks. TLS prevents replay via sequence numbers. "Nonce" or "timestamp" in an answer about replay = usually correct.
View Full Definition โ†’ Practice Questions โ†’

What is a rootkit?

D2 ยท Threats โ–ผ
A rootkit hides itself and other malware by modifying the OS kernel, firmware, or hypervisor. Types: user-mode, kernel-mode, bootkit/firmware (survives reinstalls).
Rootkits are designed to evade detection. Best defense: prevention (Secure Boot, TPM). If suspected, reimage the system โ€” you can't trust AV results on a rootkitted machine.
View Full Definition โ†’ Practice Questions โ†’

What is a Software-Defined Perimeter (SDP)?

D3 ยท Architecture โ–ผ
An SDP creates an invisible network perimeter โ€” resources are hidden until users are authenticated and authorized. Similar to ZTNA โ€” makes infrastructure "dark."
SDP reduces attack surface by making servers invisible. Key benefit: you can't attack what you can't find. Implements "deny all, allow specific" at the network discovery level.
View Full Definition โ†’ Practice Questions โ†’

What is a security policy?

D1 ยท General โ–ผ
Policy hierarchy: Policy (why) โ†’ Standard (what) โ†’ Guideline (optional recommendations) โ†’ Procedure (step-by-step how).
Policies are mandatory; guidelines are optional. Examples: AUP, Password Policy, Data Classification Policy, BYOD Policy. Policies must be reviewed and updated regularly.
View Full Definition โ†’ Practice Questions โ†’

What is a SOC (Security Operations Center)?

D4 ยท Operations โ–ผ
A SOC is a centralized team monitoring IT environments 24/7. Tiers: Tier 1 (alert triage), Tier 2 (deeper investigation), Tier 3 (threat hunting, forensics).
SIEM is the SOC's primary tool. SOAR automates repetitive tasks. MDR (Managed Detection and Response) is an outsourced SOC service.
View Full Definition โ†’ Practice Questions โ†’

What is a supply chain attack?

D2 ยท Threats โ–ผ
A supply chain attack compromises a trusted vendor to attack end customers. SolarWinds 2020: malicious code inserted into Orion updates, compromising 18,000+ organizations.
Devastating because victims trust the compromised vendor. Defenses: SBOM (Software Bill of Materials), code signing verification, vendor risk management, integrity monitoring of software updates.
View Full Definition โ†’ Practice Questions โ†’

What is a TPM (Trusted Platform Module)?

D5 ยท Crypto โ–ผ
A TPM is a motherboard microcontroller providing hardware-based security: secure key storage, random number generation, and platform integrity measurement via measured boot.
TPM enables FDE keys tied to hardware. Detects bootkit/rootkit tampering via measured boot. TPM โ‰  HSM: TPM is on-board, HSM is standalone. Required for Windows 11.
View Full Definition โ†’ Practice Questions โ†’

What is a Trojan horse in cybersecurity?

D2 ยท Threats โ–ผ
A Trojan disguises itself as legitimate software. Types: RAT (Remote Access Trojan), banking Trojan, downloader, backdoor. Unlike viruses, Trojans don't self-replicate.
Trojans need user action to install. RATs provide full interactive access. Defenses: email filtering, application allowlisting, user education. Verify software signatures before installing.
View Full Definition โ†’ Practice Questions โ†’

What is a watering hole attack?

D2 ยท Threats โ–ผ
A watering hole attack compromises a legitimate website frequently visited by the target group, infecting visitors with malware.
Harder to defend against than phishing โ€” targets visit trusted sites. Defenses: web filtering, browser isolation, EDR, keeping browsers/plugins patched, threat intelligence.
View Full Definition โ†’ Practice Questions โ†’

What is a worm in cybersecurity?

D2 ยท Threats โ–ผ
A worm self-replicates and spreads automatically by exploiting vulnerabilities โ€” without user interaction. Examples: WannaCry (EternalBlue + ransomware), Stuxnet.
Worms spread automatically; viruses require execution. WannaCry is the go-to exam example โ€” worm spreading + ransomware. Patch SMB vulnerabilities (MS17-010) to prevent worm propagation.
View Full Definition โ†’ Practice Questions โ†’

What is a zero-day vulnerability?

D2 ยท Threats โ–ผ
A zero-day is a flaw unknown to the vendor with no available patch. Zero-day exploits attack it before a patch exists. Nation-state actors pay millions for zero-days.
No patch exists โ€” defenses rely on: behavioral detection (EDR), network segmentation, least privilege, and compensating controls.
View Full Definition โ†’ Practice Questions โ†’
โ€” B โ€”

What are Bluetooth security threats in Security+?

D2 ยท Threats โ–ผ
๐Ÿ“ฉ Bluejacking โ€” unsolicited messages (harmless)
๐Ÿ“‚ Bluesnarfing โ€” unauthorized data access
๐ŸŽฎ Bluebugging โ€” full device control
Know the three Bluetooth attack names. Bluesnarfing and bluebugging are most serious. Non-discoverable mode reduces but doesn't eliminate risk.
View Full Definition โ†’ Practice Questions โ†’
โ€” C โ€”

What is certificate pinning?

D5 ยท Crypto โ–ผ
Certificate pinning hardcodes a known-good certificate or public key into an app, rejecting any other certificate โ€” even validly signed ones โ€” preventing MITM attacks.
Used in mobile banking apps. Downside: if the pinned cert expires, the app breaks. Pin the public key for more flexibility.
View Full Definition โ†’ Practice Questions โ†’

What is chain of custody in digital forensics?

D4 ยท Operations โ–ผ
Chain of custody documents everyone who collected, handled, and stored digital evidence โ€” ensuring integrity and legal admissibility.
If the chain is broken, evidence may be inadmissible. Use write blockers. Always work on a forensic copy. Hash evidence before and after โ€” identical hashes prove integrity.
View Full Definition โ†’ Practice Questions โ†’

What is change management in security?

D4 ยท Operations โ–ผ
Change management controls how IT changes are requested, approved, tested, and implemented to minimize security risk. Process: request โ†’ review โ†’ CAB approval โ†’ test โ†’ implement โ†’ document.
Many breaches are caused by unauthorized changes. The CAB approves significant changes. Emergency changes still require post-hoc documentation.
View Full Definition โ†’ Practice Questions โ†’

What is code signing?

D5 ยท Crypto โ–ผ
Code signing applies a digital signature to software so users can verify it's authentic and unmodified since signing.
Prevents supply chain attacks and malware masquerading as legitimate software. Windows requires driver signing. macOS requires notarization.
View Full Definition โ†’ Practice Questions โ†’

What is Command and Control (C2) in cybersecurity?

D2 ยท Threats โ–ผ
C2 is the infrastructure attackers use to remotely control compromised systems. Channels use HTTPS, DNS tunneling, or social media to blend with normal traffic.
Detection: behavioral analysis, DNS monitoring, SSL inspection, unusual beaconing patterns.
View Full Definition โ†’ Practice Questions โ†’

What is configuration management?

D4 ยท Operations โ–ผ
Configuration management maintains known, secure system configurations. Key concepts: baseline, CMDB (Configuration Management Database), configuration drift.
Configuration drift creates vulnerabilities. Automated tools (Ansible/Puppet) enforce baselines continuously. CIS Benchmarks provide hardening guidelines.
View Full Definition โ†’ Practice Questions โ†’

What is cross-site request forgery (CSRF)?

D2 ยท Threats โ–ผ
CSRF tricks an authenticated user's browser into submitting unwanted requests to a web app using their valid session cookie.
Prevention: CSRF tokens, SameSite cookie attribute, re-authentication for sensitive actions. Different from XSS โ€” XSS exploits user trust in the site.
View Full Definition โ†’ Practice Questions โ†’

What is cross-site scripting (XSS)?

D2 ยท Threats โ–ผ
XSS injects malicious scripts into web pages viewed by other users. Types: Stored (saved to server), Reflected (in URL), DOM-based (manipulates DOM).
XSS steals cookies and hijacks sessions. Prevention: output encoding, Content Security Policy (CSP), input validation.
View Full Definition โ†’ Practice Questions โ†’
โ€” D โ€”

What is data classification in Security+?

D1 ยท General โ–ผ
Data classification organizes data by sensitivity. Government: Top Secret โ†’ Secret โ†’ Confidential โ†’ Unclassified. Commercial: Confidential โ†’ Private โ†’ Sensitive โ†’ Public.
Data owners (business managers) decide classification. Data custodians (IT) implement controls. Classification drives DLP rules, encryption requirements, and access controls.
View Full Definition โ†’ Practice Questions โ†’

What is Data Loss Prevention (DLP)?

D3 ยท Architecture โ–ผ
DLP monitors, detects, and prevents sensitive data from being transmitted or accessed in unauthorized ways. Types: Network DLP, Endpoint DLP, Cloud DLP.
DLP prevents both malicious exfiltration and accidental leaks. The answer when you need to prevent sensitive data from leaving the organization.
View Full Definition โ†’ Practice Questions โ†’

What is deception technology in cybersecurity?

D4 ยท Operations โ–ผ
Deception technology deploys decoys โ€” honeypots, honey credentials, honeytokens โ€” to detect attackers with minimal false positives. Any interaction = high-confidence IoC.
Legitimate users have no reason to access decoys. Detects lateral movement, credential stuffing, and insider threats. Very low false positive rate.
View Full Definition โ†’ Practice Questions โ†’

What is Diffie-Hellman key exchange?

D5 ยท Crypto โ–ผ
Diffie-Hellman allows two parties to establish a shared secret key over an insecure channel without sending the key itself. DHE/ECDHE provide Perfect Forward Secrecy (PFS).
DH solves the key distribution problem. ECDHE is used in TLS 1.3 for forward secrecy โ€” past sessions can't be decrypted even if the server key is later compromised.
View Full Definition โ†’ Practice Questions โ†’

What is digital forensics?

D4 ยท Operations โ–ผ
Digital forensics identifies, collects, preserves, analyzes, and reports digital evidence for legal investigations. Process: identification โ†’ collection โ†’ examination โ†’ analysis โ†’ reporting.
Order of volatility: CPU/RAM โ†’ swap โ†’ network connections โ†’ disk. RAM contains passwords, encryption keys, and running malware โ€” capture it first!
View Full Definition โ†’ Practice Questions โ†’

What is DNS poisoning and spoofing?

D2 ยท Threats โ–ผ
DNS poisoning corrupts a DNS cache with fraudulent records, redirecting users to attacker-controlled IPs even when typing the correct domain.
DNSSEC is the primary countermeasure. Short TTL values limit the damage window. DNS poisoning is a MITM setup technique.
View Full Definition โ†’ Practice Questions โ†’

What is DNSSEC?

D3 ยท Architecture โ–ผ
DNSSEC adds cryptographic signatures to DNS records to verify authenticity and prevent cache poisoning. It does NOT encrypt queries โ€” only provides authentication/integrity.
DNS over HTTPS (DoH, port 443) and DNS over TLS (DoT, port 853) add encryption. DNSSEC is the exam answer for preventing DNS spoofing/cache poisoning.
View Full Definition โ†’ Practice Questions โ†’

What is dumpster diving in security?

D2 ยท Threats โ–ผ
Dumpster diving searches discarded waste for sensitive information โ€” documents, hardware, passwords on sticky notes, network diagrams.
Low-tech but effective. Once in public trash, material is generally not legally protected. Always shred documents with a cross-cut shredder.
View Full Definition โ†’ Practice Questions โ†’

What is data exfiltration?

D2 ยท Threats โ–ผ
Data exfiltration is the unauthorized transfer of data to attacker-controlled locations via HTTPS, DNS tunneling, email, USB, or cloud storage.
DLP is specifically designed to detect and block exfiltration. CASB monitors cloud exfiltration. DNS monitoring detects DNS tunneling. Double extortion ransomware exfiltrates before encrypting.
View Full Definition โ†’ Practice Questions โ†’
โ€” E โ€”

What is EDR (Endpoint Detection and Response)?

D4 ยท Operations โ–ผ
EDR continuously monitors endpoints for suspicious behavior with real-time detection and automated response. Unlike AV (signatures), EDR uses behavioral analysis to detect fileless/unknown threats.
XDR extends EDR across network, email, cloud. MDR = outsourced EDR. Key advantage: detects fileless malware and living-off-the-land attacks that bypass signature AV.
View Full Definition โ†’ Practice Questions โ†’

What is Elliptic Curve Cryptography (ECC)?

D5 ยท Crypto โ–ผ
ECC provides equivalent security to RSA with much smaller key sizes. 256-bit ECC โ‰ˆ 3072-bit RSA. Advantages: smaller keys, faster, less battery/bandwidth.
ECDSA = ECC for signatures. ECDH = ECC for key exchange. TLS 1.3 uses ECDHE for forward secrecy. ECC is preferred over RSA for new implementations.
View Full Definition โ†’ Practice Questions โ†’
โ€” F โ€”

What is fileless malware?

D2 ยท Threats โ–ผ
Fileless malware operates entirely in RAM without writing to disk, hijacking legitimate tools (PowerShell, WMI) โ€” nearly invisible to file-based AV.
Fileless malware evades signature-based AV. Behavioral detection (EDR) is essential. Look for unusual PowerShell activity from Office apps. Memory forensics (Volatility) detects active fileless threats.
View Full Definition โ†’ Practice Questions โ†’

What is full disk encryption (FDE)?

D5 ยท Crypto โ–ผ
FDE encrypts all data on a storage device โ€” OS, apps, and user data โ€” making it unreadable without the correct key. Solutions: BitLocker (Windows + TPM), FileVault (macOS), LUKS (Linux).
FDE is the answer when asked how to protect data on a lost/stolen laptop. Protects data at rest. TPM + FDE ties the key to hardware, preventing boot on another machine.
View Full Definition โ†’ Practice Questions โ†’

What is fuzz testing (fuzzing)?

D4 ยท Operations โ–ผ
Fuzzing feeds unexpected, random, or malformed data into a program to discover bugs and vulnerabilities โ€” especially buffer overflows and input validation errors.
Fuzzing finds vulnerabilities manual code review misses. Coverage-guided fuzzing (AFL, libFuzzer) maximizes code path coverage. Combine with SAST/DAST for comprehensive testing.
View Full Definition โ†’ Practice Questions โ†’
โ€” G โ€”

What is GDPR in Security+?

D1 ยท General โ–ผ
GDPR governs personal data of EU residents. Key requirements: lawful basis, data minimization, right to erasure, 72-hour breach notification. Penalties: up to โ‚ฌ20M or 4% of global revenue.
GDPR applies to any organization handling EU residents' data regardless of location. Key exam concepts: data subject rights, 72-hour breach notification, DPO role.
View Full Definition โ†’ Practice Questions โ†’
โ€” H โ€”

What is HIPAA in Security+?

D1 ยท General โ–ผ
HIPAA protects PHI (Protected Health Information). Rules: Privacy Rule, Security Rule (technical/physical/admin safeguards), Breach Notification Rule (60-day reporting).
Covered entities: healthcare providers, health plans, business associates. ePHI = electronic PHI. Breaches affecting 500+ require HHS and media notification.
View Full Definition โ†’ Practice Questions โ†’
โ€” I โ€”

What is identity federation?

D1 ยท General โ–ผ
Identity federation allows users from one organization (IdP) to access resources at another (SP) using existing credentials โ€” no separate account needed.
Federation extends SSO across organizational boundaries. ADFS is Microsoft's federation solution. "Login with Google" uses federation via OIDC.
View Full Definition โ†’ Practice Questions โ†’

What are IoT security concerns in Security+?

D3 ยท Architecture โ–ผ
IoT security problems: default credentials, no patch mechanism, insecure communications. Mirai botnet used IoT devices with default credentials for massive DDoS attacks.
Best practices: change default credentials immediately, isolate IoT on a separate VLAN, apply firmware updates, disable unnecessary services.
View Full Definition โ†’ Practice Questions โ†’
โ€” J โ€”

What is job rotation in security?

D1 ยท General โ–ผ
Job rotation periodically moves employees between roles, helping detect fraud and preventing long-term fraudulent schemes.
Pairs with mandatory vacation โ€” forced leave that forces someone else to cover your role, making it harder to hide ongoing fraud.
View Full Definition โ†’ Practice Questions โ†’
โ€” K โ€”

What is Kerberos in Security+?

D1 ยท General โ–ผ
Kerberos uses encrypted tickets to authenticate users without transmitting passwords. Components: KDC, TGT (Ticket Granting Ticket), Service Ticket. Requires clock sync within 5 minutes.
Default AD authentication protocol. Port 88. "Golden ticket" attacks forge TGTs. "Silver ticket" attacks forge service tickets. Clock sync is critical โ€” prevents replay attacks.
View Full Definition โ†’ Practice Questions โ†’
โ€” L โ€”

What is lateral movement in cybersecurity?

D2 ยท Threats โ–ผ
Lateral movement describes attacker techniques to move from one system to others after initial compromise โ€” targeting high-value systems like domain controllers.
Network segmentation is the primary defense. Zero trust and micro-segmentation limit blast radius. Monitor for unusual auth events, SMB/RDP connections between workstations.
View Full Definition โ†’ Practice Questions โ†’

What is LDAP in Security+?

D1 ยท General โ–ผ
LDAP accesses directory services โ€” databases of users, groups, and computers. Most used with Active Directory. Port 389 (LDAP), 636 (LDAPS โ€” encrypted).
Always use LDAPS (port 636) to encrypt directory traffic. LDAP injection targets directory services. LDAP = directory lookups; Kerberos = authentication tickets โ€” they work together in AD.
View Full Definition โ†’ Practice Questions โ†’

What is log management and SIEM correlation?

D4 ยท Operations โ–ผ
Log management collects and retains logs. SIEM correlation applies rules to identify threat patterns across multiple log sources simultaneously.
Logs must be protected from tampering โ€” centralized write-once system. PCI DSS requires 1-year log retention. NTP synchronization is critical โ€” mismatched timestamps break correlation.
View Full Definition โ†’ Practice Questions โ†’
โ€” M โ€”

What is Mandatory Access Control (MAC)?

D1 ยท General โ–ผ
MAC is the most restrictive access model โ€” the OS enforces access based on security labels and clearance levels. Users cannot change permissions even on their own files.
Access control models: MAC (OS enforces, most restrictive), DAC (owner controls), RBAC (role-based), ABAC (attribute-based). Bell-LaPadula: no read up, no write down.
View Full Definition โ†’ Practice Questions โ†’

What is microsegmentation?

D3 ยท Architecture โ–ผ
Microsegmentation divides the network into very granular zones โ€” down to individual workloads โ€” controlling exactly which can communicate with which others.
Microsegmentation is zero trust at the network level. Used heavily in cloud/data center. Limits east-west (internal) traffic. An attacker who compromises one workload is completely isolated.
View Full Definition โ†’ Practice Questions โ†’
โ€” N โ€”

What is network segmentation?

D3 ยท Architecture โ–ผ
Network segmentation divides a network into isolated zones to limit breach blast radius. Implementation: VLANs, firewalls/ACLs, DMZ, micro-segmentation.
Primary defense against lateral movement. Air gap = complete physical isolation. Micro-segmentation is zero trust applied at the network level.
View Full Definition โ†’ Practice Questions โ†’

What is NTP and why is it important for security?

D4 ยท Operations โ–ผ
NTP synchronizes clocks. Critical for: log correlation, Kerberos (requires clocks within 5 minutes), certificate validity, and replay attack prevention. Port: UDP 123.
If Kerberos suddenly fails across an organization, suspect a time sync issue. Accurate time is foundational โ€” often overlooked but critical for security operations and forensics.
View Full Definition โ†’ Practice Questions โ†’
โ€” O โ€”

What is OAuth and OpenID Connect?

D1 ยท General โ–ผ
OAuth 2.0 authorizes third-party apps to access user resources. OIDC adds authentication on top โ€” tells apps who the user is via JWT ID tokens.
OAuth = authorization. OIDC = authentication. SAML is older XML-based. OAuth/OIDC are modern JSON-based. "Sign in with Google" uses OIDC for auth and OAuth for authorization.
View Full Definition โ†’ Practice Questions โ†’
โ€” P โ€”

What is patch management?

D4 ยท Operations โ–ผ
Patch management identifies, tests, and deploys software updates to fix vulnerabilities. Lifecycle: discover โ†’ identify โ†’ test โ†’ deploy โ†’ verify โ†’ document.
Unpatched systems are the #1 cause of successful attacks. Vulnerability scanning finds missing patches; patch management deploys them. Emergency patches may skip normal testing.
View Full Definition โ†’ Practice Questions โ†’

What is PCI DSS?

D1 ยท General โ–ผ
PCI DSS sets security requirements for organizations that store, process, or transmit cardholder data. 12 core requirements covering network security, data protection, access control, and monitoring.
PCI DSS is an industry standard (not law) with contractual enforcement. Non-compliance = fines and loss of card processing. Key: encrypt cardholder data, segment the CDE.
View Full Definition โ†’ Practice Questions โ†’

What is penetration testing?

D4 ยท Operations โ–ผ
Pen testing is an authorized simulated attack to find and demonstrate exploitable vulnerabilities. โฌ› Black box (no knowledge), โฌœ White box (full knowledge), ๐Ÿ”ฒ Gray box (partial).
Always requires written authorization (Rules of Engagement). Without authorization it's illegal. Bug bounty programs are a form of authorized pen testing.
View Full Definition โ†’ Practice Questions โ†’

What is Perfect Forward Secrecy (PFS)?

D5 ยท Crypto โ–ผ
PFS ensures each session uses a unique ephemeral key โ€” if the server's long-term private key is later compromised, past sessions can't be decrypted. Achieved with DHE or ECDHE.
TLS 1.3 mandates PFS โ€” only supports ECDHE cipher suites. PFS protects against "record now, decrypt later" attacks.
View Full Definition โ†’ Practice Questions โ†’

What is physical security in Security+?

D3 ยท Architecture โ–ผ
Physical security layers: Perimeter (fencing, bollards, CCTV) โ†’ Entry (badge readers, mantraps) โ†’ Internal (cable locks, server room) โ†’ Monitoring (motion sensors).
Physical access bypasses most logical controls. Key: mantrap (two-door entry), tailgating (following through door), clean desk policy, Faraday cage (blocks EM signals).
View Full Definition โ†’ Practice Questions โ†’

What is pretexting in social engineering?

D2 ยท Threats โ–ผ
Pretexting creates a fabricated scenario to manipulate targets โ€” posing as IT support, auditors, or new employees to gain access or information.
Pretexting is the foundation of most social engineering attacks. Defense: verification procedures, employee training. Never provide access without verifying identity through established channels.
View Full Definition โ†’ Practice Questions โ†’

What is privilege escalation?

D2 ยท Threats โ–ผ
๐Ÿ”ผ Vertical โ€” gaining higher privileges (user โ†’ admin). ๐Ÿ”ต Horizontal โ€” accessing another user's data at the same level.
Attackers almost always attempt privilege escalation after initial access. Defenses: least privilege, patch management, privileged access workstations, monitoring unusual admin activity.
View Full Definition โ†’ Practice Questions โ†’

What is Privileged Access Management (PAM)?

D1 ยท General โ–ผ
PAM secures, controls, monitors, and audits all privileged access โ€” admin accounts, root access, service accounts, and API keys. Capabilities: password vaulting, session recording, JIT access.
Privileged accounts are the #1 target. JIT access grants temporary admin rights only when needed and auto-revokes them. Critical for zero trust architecture.
View Full Definition โ†’ Practice Questions โ†’

What is provisioning and deprovisioning in IAM?

D1 ยท General โ–ผ
Provisioning creates accounts and grants access. Deprovisioning revokes access โ€” must happen immediately upon termination.
Orphaned accounts (active accounts of former employees) are regularly exploited. Automated provisioning (SCIM) reduces errors. Access reviews periodically verify all access is still needed.
View Full Definition โ†’ Practice Questions โ†’

What is Public Key Infrastructure (PKI)?

D5 ยท Crypto โ–ผ
PKI is the complete framework for creating, managing, and revoking digital certificates. Components: CA, RA, CRL, OCSP, certificate repository.
PKI underpins HTTPS, email signing, code signing, VPNs, and smart card auth. CRL = periodic revocation list. OCSP = real-time check. OCSP stapling improves performance.
View Full Definition โ†’ Practice Questions โ†’
โ€” Q โ€”

What is quantitative vs qualitative risk assessment?

D1 ยท General โ–ผ
Quantitative: SLE = Asset Value ร— Exposure Factor. ALE = SLE ร— ARO. Assigns monetary values.
Qualitative: Uses ratings (High/Medium/Low) based on expert judgment. Faster.
Know the formulas: SLE = AV ร— EF. ALE = SLE ร— ARO. If a control costs less than the ALE reduction, it's worth implementing.
View Full Definition โ†’ Practice Questions โ†’
โ€” R โ€”

What is RADIUS in Security+?

D1 ยท General โ–ผ
RADIUS provides centralized AAA for network access control โ€” VPN, Wi-Fi, and network device access. Ports: 1812 (auth), 1813 (accounting).
Standard for 802.1X network authentication. Enterprise Wi-Fi uses WPA2/3-Enterprise + RADIUS. TACACS+ encrypts the entire payload vs. RADIUS which only encrypts the password.
View Full Definition โ†’ Practice Questions โ†’

What are RFID and NFC security risks?

D2 ยท Threats โ–ผ
Security risks: eavesdropping, cloning/skimming (copying card data), relay attacks (extending NFC range for contactless payment fraud), jamming.
Shielded (Faraday) wallets block unauthorized RFID reads. Relay attacks bypass contactless payment limits. Relevant for access badges and contactless credit cards.
View Full Definition โ†’ Practice Questions โ†’

What is risk management in Security+?

D1 ยท General โ–ผ
Risk responses: ๐Ÿ›ก๏ธ Mitigate โ€” add controls. ๐Ÿ”„ Transfer โ€” insurance. โŒ Avoid โ€” eliminate activity. โœ… Accept โ€” acknowledge residual risk.
Know the four strategies: Avoid, Transfer, Mitigate, Accept. Residual = remaining risk after controls. Inherent = risk before controls. Risk appetite = how much the org will accept.
View Full Definition โ†’ Practice Questions โ†’

What is Role-Based Access Control (RBAC)?

D1 ยท General โ–ผ
RBAC assigns permissions to roles; users are assigned to roles based on job function, inheriting all permissions. Most common enterprise access control model.
Change the role's permissions once โ€” affects all users in that role. RBAC = job-based roles. ABAC = attribute-based policies (more granular).
View Full Definition โ†’ Practice Questions โ†’

What is RSA encryption?

D5 ยท Crypto โ–ผ
RSA is the most widely used asymmetric algorithm based on factoring large prime numbers. Minimum key: 2048-bit. 1024-bit is broken.
RSA is slow โ€” used for key exchange and signatures, NOT bulk data. TLS uses RSA/ECDH to exchange a symmetric key, then AES for data. Quantum computers threaten RSA.
View Full Definition โ†’ Practice Questions โ†’

What is RTO and RPO in Security+?

D4 ยท Operations โ–ผ
RTO โ€” maximum acceptable downtime. RPO โ€” maximum acceptable data loss measured in time (defines backup frequency).
Lower RTO/RPO = more expensive (hot sites, real-time replication). Higher = cheaper (cold sites, daily backups). Critical systems have the lowest RTO/RPO values.
View Full Definition โ†’ Practice Questions โ†’
โ€” S โ€”

What is SPF, DKIM, and DMARC in email security?

D3 ยท Architecture โ–ผ
๐Ÿ“ฌ SPF โ€” lists authorized mail servers in DNS.
๐Ÿ” DKIM โ€” cryptographic signature on outgoing emails verified via DNS.
๐Ÿ›ก๏ธ DMARC โ€” enforces SPF/DKIM policy (none/quarantine/reject) and reports.
SPF = right server, DKIM = right signature, DMARC = enforces policy. DMARC with p=reject is the strongest policy. Prevents domain spoofing in phishing attacks.
View Full Definition โ†’ Practice Questions โ†’

What is system hardening in Security+?

D4 ยท Operations โ–ผ
System hardening reduces attack surface by removing unnecessary software, applying patches, and enabling security features. Steps: remove defaults, disable unused services/ports, apply patches, enable logging.
Default configurations are often insecure. Key hardening: disable telnet (use SSH), disable HTTP (use HTTPS), change default credentials. CIS Benchmarks and DISA STIGs provide guides.
View Full Definition โ†’ Practice Questions โ†’

What is salting in password security?

D5 ยท Crypto โ–ผ
Salting adds a unique random value to each password before hashing, making identical passwords produce different hashes and defeating rainbow table attacks.
bcrypt/scrypt/Argon2 incorporate salting and are computationally expensive โ€” correct modern password hashing. MD5 and SHA-1 are NOT suitable for passwords.
View Full Definition โ†’ Practice Questions โ†’

What is SAML in Security+?

D1 ยท General โ–ผ
SAML is an XML-based standard for exchanging auth data between an Identity Provider (IdP) and Service Provider (SP). Used for federated identity and SSO in enterprise cloud apps.
SAML uses XML assertions. OAuth/OIDC use JSON tokens. SAML is the enterprise SSO standard for cloud apps like Salesforce, AWS, Office 365.
View Full Definition โ†’ Practice Questions โ†’

What is SASE in Security+?

D3 ยท Architecture โ–ผ
SASE combines WAN and security services (CASB, SWG, ZTNA, FWaaS) into a single cloud-delivered service for remote workers and cloud-first organizations.
SASE is the modern replacement for traditional hub-and-spoke VPN. Security is applied at the cloud edge. SSE (Security Service Edge) is the security portion without SD-WAN networking.
View Full Definition โ†’ Practice Questions โ†’

What is SCADA and ICS security?

D3 ยท Architecture โ–ผ
ICS/SCADA manage industrial processes โ€” power grids, water, manufacturing. Availability is paramount. Systems often run legacy OS with no patch support.
In ICS/SCADA, CIA priority flips: Availability > Integrity > Confidentiality. Air gapping, segmentation, and data diodes are key controls. Stuxnet targeted SCADA systems via USB.
View Full Definition โ†’ Practice Questions โ†’

What is Secure Boot?

D3 ยท Architecture โ–ผ
Secure Boot ensures only signed, trusted bootloaders and OS kernels run at startup. UEFI firmware verifies signatures before executing each component.
Secure Boot + TPM (measured boot) = full chain of trust from firmware to OS. Secure Boot prevents unauthorized boot code; measured boot detects changes. Required for Windows 11.
View Full Definition โ†’ Practice Questions โ†’

What are secure coding practices?

D2 ยท Threats โ–ผ
Key practices: input validation, parameterized queries (prevent SQLi), output encoding (prevent XSS), proper error handling, no hardcoded credentials, dependency scanning.
OWASP Top 10 is the standard web application security risk list. SAST analyzes source code. DAST tests running apps. DevSecOps integrates security into the development pipeline.
View Full Definition โ†’ Practice Questions โ†’

What is security awareness training?

D1 ยท General โ–ผ
Security awareness training educates employees about threats to reduce human error โ€” the leading cause of breaches. Effective programs include phishing simulations and role-based content.
The most cost-effective security control. Phishing simulations measure and improve resistance. Security awareness training is often the correct answer for reducing social engineering risk.
View Full Definition โ†’ Practice Questions โ†’

What is separation of duties?

D1 ยท General โ–ผ
Separation of duties divides critical tasks among multiple people so no single individual has complete control โ€” reducing fraud and error risk.
Required by SOX and PCI DSS. Dual control requires simultaneous action by two people โ€” stronger than SoD. Prevents a single insider from committing fraud undetected.
View Full Definition โ†’ Practice Questions โ†’

What is shoulder surfing?

D2 ยท Threats โ–ผ
Shoulder surfing observes a victim's screen or keyboard to steal PINs, passwords, or sensitive information โ€” in person or with cameras at a distance.
Privacy screen filters reduce viewing angles. ATM PIN pads have physical shields. Positioning awareness (back to wall) helps reduce risk in public spaces.
View Full Definition โ†’ Practice Questions โ†’

What is Single Sign-On (SSO)?

D1 ยท General โ–ผ
SSO lets users authenticate once and access multiple apps without re-logging in. Protocols: SAML (enterprise), OAuth/OIDC (modern APIs), Kerberos (Active Directory).
SSO improves UX and security (fewer passwords = less reuse). Risk: compromised SSO credentials expose all connected apps. Always pair SSO with MFA.
View Full Definition โ†’ Practice Questions โ†’

What is S/MIME for email security?

D5 ยท Crypto โ–ผ
S/MIME provides end-to-end email encryption and digital signing using X.509 certificates. Encryption uses recipient's public key; signing uses sender's private key.
S/MIME = end-to-end encryption (server can't read it). TLS = in-transit encryption (server can read it). PGP is an alternative using web-of-trust instead of PKI CA trust.
View Full Definition โ†’ Practice Questions โ†’

What is SOAR in Security+?

D4 ยท Operations โ–ผ
SOAR integrates security tools and automates repetitive tasks through playbooks โ€” automatically responding to common security events without human intervention.
SIEM = detect and alert. SOAR = automate the response. SOAR reduces MTTR (Mean Time to Respond). When asked about automating incident response or reducing analyst workload โ€” SOAR.
View Full Definition โ†’ Practice Questions โ†’

What is spyware and adware?

D2 ยท Threats โ–ผ
Spyware secretly collects user information โ€” keystrokes, browsing, credentials. Adware displays unwanted advertising, often bundled with free software (PUPs).
Keyloggers are a subset of spyware. PUPs often come with freeware installers. Defenses: EDR, application allowlisting, user education, reviewing app permissions.
View Full Definition โ†’ Practice Questions โ†’

What is SQL injection?

D2 ยท Threats โ–ผ
SQLi inserts malicious SQL into input fields to manipulate a backend database โ€” bypassing authentication, dumping data, or deleting records.
SQLi is the #1 web application attack. Prevention: parameterized queries (prepared statements), input validation, and a WAF. Never concatenate user input directly into SQL strings.
View Full Definition โ†’ Practice Questions โ†’

What is SAST vs DAST in application security?

D4 ยท Operations โ–ผ
FeatureSASTDAST
WhenEarly (code review)Later (staging)
AccessSource codeRunning app
ViewWhite boxBlack box
IAST combines both. RASP monitors and blocks attacks at runtime. Use all for comprehensive coverage. SAST finds code-level flaws; DAST finds runtime and config issues.
View Full Definition โ†’ Practice Questions โ†’

What is steganography?

D5 ยท Crypto โ–ผ
Steganography conceals secret data within ordinary files (image LSBs, audio) so the hidden data's existence isn't apparent. Unlike encryption, it hides that communication is occurring.
Steganography hides the existence of data; encryption hides the meaning. They can be combined. Steganalysis is the detection of steganographic content.
View Full Definition โ†’ Practice Questions โ†’

What is STRIDE in threat modeling?

D4 ยท Operations โ–ผ
LetterThreatViolated Property
SSpoofingAuthentication
TTamperingIntegrity
RRepudiationNon-repudiation
IInfo DisclosureConfidentiality
DDenial of ServiceAvailability
EElevation of PrivilegeAuthorization
Memorize STRIDE and its corresponding security properties โ€” high-yield exam content. Each STRIDE threat maps to a violated security property.
View Full Definition โ†’ Practice Questions โ†’

What is symmetric encryption?

D5 ยท Crypto โ–ผ
Symmetric encryption uses a single shared key for both encryption and decryption. Fast, used for bulk data. Algorithms: AES (current), 3DES (deprecated), ChaCha20 (TLS 1.3).
AES-256 is the exam-safe answer for strongest symmetric algorithm. Key management is the main weakness. Hybrid encryption uses asymmetric to exchange the symmetric key.
View Full Definition โ†’ Practice Questions โ†’
โ€” T โ€”

What are the different types of backups?

D4 ยท Operations โ–ผ
TypeBacks upBackup speedRestore speed
FullEverythingSlowestFastest
IncrementalChanges since last backupFastestSlowest
DifferentialChanges since last fullMediumMedium
Incremental = fastest backup, slowest restore. Differential = medium both. Full = slowest backup, fastest restore. 3-2-1 rule: 3 copies, 2 different media, 1 offsite.
View Full Definition โ†’ Practice Questions โ†’

What is the cloud shared responsibility model?

D3 ยท Architecture โ–ผ
ModelCSP ManagesCustomer Manages
IaaSPhysical, network, hypervisorOS, apps, data
PaaS+ OS, middlewareApps, data
SaaSEverything except data/accessData, user access
Customers are ALWAYS responsible for their data and access management. "Security OF the cloud" (CSP) vs. "Security IN the cloud" (customer).
View Full Definition โ†’ Practice Questions โ†’

What is the MITRE ATT&CK framework?

D4 ยท Operations โ–ผ
MITRE ATT&CK documents adversary TTPs based on real-world observations. Tactics = the why; Techniques = the how.
Industry-standard adversary behavior framework. Used for threat hunting, detection engineering, and incident response. Companion: MITRE D3FEND (defensive).
View Full Definition โ†’ Practice Questions โ†’

What is the NIST Cybersecurity Framework?

D1 ยท General โ–ผ
NIST CSF provides a common language for managing cybersecurity risk. Core functions: Identify โ†’ Protect โ†’ Detect โ†’ Respond โ†’ Recover (+ Govern in CSF 2.0).
Know the 5 (or 6) NIST CSF functions in order. Voluntary but widely adopted. NIST SP 800-53 provides detailed security controls aligning with the CSF.
View Full Definition โ†’ Practice Questions โ†’

What is the order of volatility in forensics?

D4 ยท Operations โ–ผ
Order (most โ†’ least volatile): CPU/cache โ†’ RAM โ†’ swap โ†’ network connections โ†’ running processes โ†’ disk โ†’ remote logs โ†’ archival media.
RAM is the most important volatile source โ€” contains active encryption keys, malware, and passwords. Always capture memory before shutting down a compromised system.
View Full Definition โ†’ Practice Questions โ†’

What is the SDLC and security?

D4 ยท Operations โ–ผ
Secure SDLC integrates security at each phase: Requirements โ†’ Design (threat modeling) โ†’ Development (SAST) โ†’ Testing (DAST) โ†’ Deployment (hardening) โ†’ Maintenance (patching).
Fixing security issues early in the SDLC is 30ร— cheaper than in production. DevSecOps integrates security into CI/CD pipelines. Threat modeling during design is the most cost-effective security activity.
View Full Definition โ†’ Practice Questions โ†’

What is tailgating and piggybacking?

D2 ยท Threats โ–ผ
Tailgating: following an authorized person through a secured door. Piggybacking: authorized person knowingly holds the door for an unauthorized person.
Countermeasures: mantraps/airlocks (only one door opens at a time), anti-passback systems, security awareness training. One badge = one person through.
View Full Definition โ†’ Practice Questions โ†’

What is threat hunting?

D4 ยท Operations โ–ผ
Threat hunting is the proactive, human-led search for threats that have evaded automated tools โ€” assuming compromise and actively looking for IoCs and TTPs.
Threat hunting is proactive (you go looking), not reactive (waiting for alerts). Requires skilled analysts and rich data. MITRE ATT&CK framework guides threat hunting hypotheses.
View Full Definition โ†’ Practice Questions โ†’

What is threat intelligence?

D4 ยท Operations โ–ผ
Types: Strategic (executive), Tactical (TTPs for security teams), Operational (specific attack details), Technical (IoCs โ€” IPs, hashes, domains).
Threat intelligence shifts security from reactive to proactive. STIX/TAXII are standards for sharing TI. ISACs are industry sharing groups. Know the 4 types for the exam.
View Full Definition โ†’ Practice Questions โ†’

What is threat modeling?

D4 ยท Operations โ–ผ
Threat modeling proactively identifies threats during the design phase before code is written. Frameworks: STRIDE, PASTA, DREAD, Attack trees.
Threat modeling answers "What can go wrong?" STRIDE is the most exam-tested framework. Done during design โ€” cheapest time to fix issues. Most cost-effective security activity in the SDLC.
View Full Definition โ†’ Practice Questions โ†’

What is typosquatting?

D2 ยท Threats โ–ผ
Typosquatting registers slight misspellings of popular domains to capture misdirected traffic for phishing, credential harvesting, or malware distribution.
Organizations can defensively register common misspellings. Related: combosquatting (amazon-deals.com), homograph attacks (lookalike Unicode characters in domain names).
View Full Definition โ†’ Practice Questions โ†’
โ€” V โ€”

What is vishing and smishing?

D2 ยท Threats โ–ผ
Vishing: phone call social engineering โ€” impersonating banks, tech support, IRS. Smishing: SMS phishing with malicious links or urgent requests.
Know all phishing variants: Phishing (email), Spear phishing (targeted), Whaling (executives), Vishing (voice), Smishing (SMS). AI voice cloning has made vishing significantly more dangerous.
View Full Definition โ†’ Practice Questions โ†’

What is vulnerability scanning?

D4 ยท Operations โ–ผ
Vulnerability scanning automatically identifies security weaknesses โ€” missing patches, misconfigurations, open ports. Credentialed (deeper) vs. non-credentialed (external view).
Scanning is automated and non-exploitative; pen testing is manual and exploits vulnerabilities. Always get written authorization before scanning. Scanning finds vulnerabilities; pen testing proves they're exploitable.
View Full Definition โ†’ Practice Questions โ†’
โ€” W โ€”

What is WPA3 and how is it better than WPA2?

D3 ยท Architecture โ–ผ
WPA3 improvements: โœ… SAE (resistant to offline dictionary attacks) โœ… Forward secrecy โœ… OWE (encrypts open Wi-Fi) โœ… 192-bit enterprise security.
WPA2-PSK is vulnerable to offline brute-force. WPA3-SAE (Dragonfly) eliminates this. WPA3-Personal = SAE. WPA3-Enterprise = 192-bit security suite.
View Full Definition โ†’ Practice Questions โ†’
โ€” Z โ€”

What is ZTNA (Zero Trust Network Access)?

D3 ยท Architecture โ–ผ
ZTNA grants access to specific apps based on verified identity and device posture โ€” replacing broad VPN network access with least-privilege app access.
VPN = network-level access (too broad). ZTNA = application-level access (least privilege). Even if credentials are compromised, attacker can only access authorized apps, not the whole network.
View Full Definition โ†’ Practice Questions โ†’
๐Ÿ”
No terms found matching ""

Try practicing with our 750+ question bank โ†’

Ready to Test Your Knowledge?

750+ practice questions, mock exam, flashcards, and Boss Battle mode. All free.

Start Studying Free โ†’
What is 2FA? D1 ยท General +
2FA requires two authentication factors from different categories: knowledge (password), possession (phone/hardware key), or inherence (biometric). Any two from different categories.
Password + PIN = NOT 2FA (both are knowledge factors). Password + authenticator app = 2FA (knowledge + possession). MFA = two or more factors. Strong 2FA: FIDO2/WebAuthn hardware key (possession) + biometric (inherence). SMS is weak 2FA (SIM swapping). Better than nothing, but upgrade when possible.
Full Definition โ†’
What is 802.1X? D3 ยท Architecture โ–ธ
802.1X is the port-based network access control framework โ€” requiring authentication before granting network access. Components: Supplicant (client), Authenticator (switch/AP), Authentication Server (RADIUS).
802.1X is the mechanism; RADIUS is the protocol; EAP is the authentication method. Enterprise Wi-Fi uses WPA2/3-Enterprise + 802.1X + RADIUS for per-user authentication. Without 802.1X, any device can plug into a network port or connect to Wi-Fi with the PSK.
Full Definition โ†’
Full Definition โ†’
What are 802.11 Wi-Fi standards? D6 ยท Network+ +
StandardFrequencyMax Speed
802.11a5GHz54 Mbps
802.11g2.4GHz54 Mbps
802.11n (Wi-Fi 4)2.4/5GHz600 Mbps
802.11ac (Wi-Fi 5)5GHz3.5 Gbps
802.11ax (Wi-Fi 6)2.4/5/6GHz9.6 Gbps
Wi-Fi 6 (ax) and Wi-Fi 6E (adds 6GHz band) are current standards. Backward compatible within band. 5GHz = faster but shorter range. 6GHz (Wi-Fi 6E) = least interference, newest.
Full Definition โ†’
What is an access token in security? D1 ยท General โ–ธ
An access token is a credential that grants access to specific resources. OAuth 2.0 uses bearer tokens โ€” whoever holds the token can use it. JWTs are a common token format.
Access tokens are short-lived. Refresh tokens are long-lived and used to obtain new access tokens. Never log access tokens โ€” treat them like passwords.
Full Definition โ†’
Full Definition โ†’
What is an account lockout policy? D1 ยท General โ–ธ
An account lockout policy disables accounts after a defined number of failed login attempts โ€” preventing brute-force and password-spraying attacks.
Balance security vs. usability. Too aggressive = DoS via intentional lockouts. Typical settings: 5 attempts, 30-min lockout. Audit lockout events โ€” high frequency may indicate an attack.
Full Definition โ†’
Full Definition โ†’
What is Active Directory (AD)? D1 ยท General โ–ธ
Active Directory is Microsoft's directory service for Windows environments. Provides authentication (Kerberos), authorization (groups/GPOs), and centralized management of users, computers, and policies.
Domain Controller (DC) hosts AD. Group Policy Objects (GPOs) enforce settings. AD is the #1 target in enterprise attacks โ€” gaining Domain Admin = game over. Protect with tiered admin model.
Full Definition โ†’
Full Definition โ†’
What is Active Directory Certificate Services (AD CS)? D1 ยท General โ–ธ
AD CS is Microsoft's PKI implementation โ€” issues internal certificates for users, computers, and services within an AD environment.
AD CS misconfigurations are a major attack vector (ESC1โ€“ESC8 vulnerabilities). Certificate templates with excessive permissions can lead to domain compromise. Audit AD CS regularly.
Full Definition โ†’
Full Definition โ†’
What is Advanced Malware Protection (AMP)? D4 ยท Operations โ–ธ
AMP uses behavioral analysis, sandboxing, and machine learning to detect and block advanced malware that evades traditional signature-based tools.
AMP is Cisco's brand name โ€” the concept is next-gen AV/EDR. Sandboxing executes suspicious files in an isolated environment to observe behavior. Key for detecting zero-day malware.
Full Definition โ†’
Full Definition โ†’
What is adversarial AI in cybersecurity? D2 ยท Threats โ–ธ
Adversarial AI attacks target machine learning models โ€” data poisoning (corrupting training data), evasion attacks (crafting inputs to fool models), model inversion (extracting training data).
AI-powered attacks include deepfakes for social engineering and adversarial images that fool facial recognition. AI security is an emerging Security+ domain topic.
Full Definition โ†’
Full Definition โ†’
What is an aggregation attack? D2 ยท Threats โ–ธ
An aggregation attack combines multiple pieces of individually innocuous data to derive sensitive information โ€” individually harmless, collectively dangerous.
Example: combining name + employer + neighborhood + car = precise location profile. Data minimization and access controls on queries help prevent aggregation attacks.
Full Definition โ†’
Full Definition โ†’
What is agent-based vs agentless monitoring? D4 ยท Operations โ–ธ
๐Ÿ”ต Agent-based โ€” software installed on endpoint, continuous monitoring, detailed visibility.
โšช Agentless โ€” network-based scanning, no software to install, lower overhead.
Agent-based provides richer data (running processes, file changes). Agentless is easier to deploy at scale. Many EDR and SIEM solutions support both modes.
Full Definition โ†’
Full Definition โ†’
What is application allowlisting? D4 ยท Operations โ–ธ
Application allowlisting only permits pre-approved software to run โ€” blocking everything else including unknown malware and unauthorized tools.
Most effective malware prevention control. Difficult to maintain at scale. AppLocker (Windows) and similar tools implement it. Ideal for kiosks, POS systems, and high-security environments.
Full Definition โ†’
Full Definition โ†’
What is anomaly detection in security? D4 ยท Operations โ–ธ
Anomaly detection identifies deviations from established baselines โ€” a user logging in at 3am from a new country, a server sending unusual amounts of data outbound.
Requires a baseline first. High false positive rate initially. UEBA (User and Entity Behavior Analytics) applies ML to detect subtle anomalies. Complements signature-based detection.
Full Definition โ†’
Full Definition โ†’
What is anti-forensics? D2 ยท Threats โ–ธ
Anti-forensics techniques destroy or hide evidence of malicious activity โ€” log deletion, timestomping (altering file timestamps), overwriting disk sectors, steganography.
Centralized logging (SIEM) defeats local log deletion. Immutable logs (write-once storage) are critical. Detecting anti-forensics activity is itself an indicator of compromise.
Full Definition โ†’
Full Definition โ†’
What is a Web Application Firewall (WAF)? D3 ยท Architecture โ–ธ
A WAF inspects HTTP/HTTPS traffic to block web attacks โ€” SQLi, XSS, CSRF, path traversal. Deployed in front of web applications.
WAF is layer 7 (application layer). Regular firewall is layer 3/4. WAF doesn't replace secure coding โ€” it's a compensating control. OWASP ModSecurity Core Rule Set is widely used.
Full Definition โ†’
Full Definition โ†’
What is application sandboxing? D4 ยท Operations โ–ธ
Application sandboxing runs apps in isolated environments where they can't access system resources or other apps โ€” containing the damage if the app is malicious.
iOS and Android sandbox all apps by default. Browsers sandbox tabs. Sandboxing is the reason mobile malware is less impactful than desktop malware. Cuckoo sandbox is a popular malware analysis tool.
Full Definition โ†’
Full Definition โ†’
What is asset management in cybersecurity? D4 ยท Operations โ–ธ
Asset management maintains an accurate inventory of all hardware and software โ€” you can't protect what you don't know you have.
"You can't secure what you don't know exists." Unknown assets (shadow IT, rogue devices) are major risk factors. CIS Control #1 is asset inventory. CMDB tracks relationships between assets.
Full Definition โ†’
Full Definition โ†’
What is an attack surface? D2 ยท Threats โ–ธ
The attack surface is the total set of entry points an attacker can use โ€” open ports, services, user accounts, APIs, physical access points, and human targets.
Reducing attack surface is a fundamental security principle. Every unnecessary service, port, or account is potential attack surface. Hardening reduces attack surface. Defense in depth protects what remains.
Full Definition โ†’
Full Definition โ†’
What is an attack vector? D2 ยท Threats โ–ธ
An attack vector is the specific path or method an attacker uses to gain access โ€” email phishing, unpatched web app, physical USB drop, network exploitation.
Different from attack surface (the total). Attack vector is the specific route chosen. Common vectors: phishing (most common), web app vulnerabilities, stolen credentials, insider threats, supply chain.
Full Definition โ†’
Full Definition โ†’
What is an audit log and why is it important? D4 ยท Operations โ–ธ
An audit log records who did what and when โ€” providing accountability, non-repudiation, and a forensic record for incident investigations and compliance.
Audit logs must be tamper-evident (stored centrally, signed). Key events to log: authentication attempts, privilege use, data access, config changes. Logs are useless without review.
Full Definition โ†’
Full Definition โ†’
What is automated patching and its risks? D4 ยท Operations โ–ธ
Automated patching deploys updates without manual intervention โ€” faster remediation but risk of breaking production systems if patches aren't tested first.
Best practice: test patches in staging first, then roll out in waves. Critical patches may justify immediate deployment despite risk. WSUS and SCCM manage patches in enterprise Windows environments.
Full Definition โ†’
Full Definition โ†’
What is a baseline configuration in security? D4 ยท Operations โ–ธ
A baseline configuration is the documented, approved, hardened configuration for a system type โ€” the secure starting point all instances should match.
Deviation from baseline = configuration drift = security risk. Automated tools (Ansible, Puppet) enforce baselines. SCAP (Security Content Automation Protocol) automates baseline compliance checking.
Full Definition โ†’
Full Definition โ†’
What is a block cipher? D5 ยท Crypto โ–ธ
A block cipher encrypts fixed-size blocks of data at a time. AES uses 128-bit blocks. Different modes of operation (ECB, CBC, GCM) determine how blocks are chained.
ECB mode is insecure (identical plaintext = identical ciphertext). CBC needs an IV and is vulnerable to padding oracle attacks. GCM is the modern choice โ€” provides authentication too.
Full Definition โ†’
Full Definition โ†’
What is a blue team in cybersecurity? D4 ยท Operations โ–ธ
A blue team is the defensive security team โ€” responsible for detection, response, and hardening. They defend against attacks (real and simulated by red teams).
Blue = defense, Red = offense, Purple = both working together sharing knowledge. Blue team tools: SIEM, IDS/IPS, EDR, threat intel feeds. Purple teaming improves both red and blue capabilities.
Full Definition โ†’
Full Definition โ†’
What is a broadcast storm in networking? D6 ยท Network+ โ–ธ
A broadcast storm occurs when network switches loop broadcast frames endlessly, consuming all bandwidth. Caused by switching loops.
Spanning Tree Protocol (STP) prevents broadcast storms by disabling redundant paths. RSTP is the faster modern version. Broadcast storms can take down an entire network segment.
Full Definition โ†’
Full Definition โ†’
What is a brute force attack? D2 ยท Threats โ–ธ
A brute force attack tries every possible password combination until finding the correct one. Speed depends on password length, complexity, and computational power.
Defense: long complex passwords make brute force impractical. Account lockout policies limit online attacks. Key stretching (bcrypt) slows offline attacks. MFA defeats brute force even if password is found.
Full Definition โ†’
Full Definition โ†’
What is a captive portal? D3 ยท Architecture โ–ธ
A captive portal redirects unauthenticated users to a web page requiring login or acceptance of terms before granting internet access โ€” common in hotels, airports, coffee shops.
Captive portals provide minimal security โ€” they authenticate users but don't encrypt traffic. Always use a VPN on captive portal networks. Evil twin APs can mimic captive portals.
Full Definition โ†’
Full Definition โ†’
What is a cipher suite in TLS? D5 ยท Crypto โ–ธ
A cipher suite is a named combination of algorithms used in TLS: key exchange + authentication + encryption + MAC. Example: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384.
TLS 1.3 reduced cipher suites to only strong options. Weak cipher suites (RC4, DES, MD5) must be disabled. Always configure TLS to offer only strong cipher suites.
Full Definition โ†’
Full Definition โ†’
What is a cold boot attack? D2 ยท Threats โ–ธ
A cold boot attack physically freezes RAM chips to preserve contents after power off, then reads the memory โ€” potentially extracting full disk encryption keys.
Demonstrates that RAM persists briefly after power off. Countermeasures: pre-boot authentication, memory encryption (AMD SME/SEV), clearing RAM on shutdown. BitLocker's startup PIN prevents this.
Full Definition โ†’
Full Definition โ†’
What is a compensating control? D1 ยท General โ–ธ
A compensating control provides equivalent protection when the standard control cannot be implemented โ€” e.g., network segmentation when legacy systems can't be patched.
Common in PCI DSS compliance โ€” if you can't meet a requirement directly, document a compensating control that provides equivalent security. Must be equally effective, not just easier.
Full Definition โ†’
Full Definition โ†’
How is a DDoS attack mitigated? D3 ยท Architecture โ–ธ
DDoS mitigation: upstream filtering (ISP or scrubbing centers), anycast routing (distributes attack traffic), CDN (absorbs volumetric attacks), rate limiting, Cloudflare/AWS Shield.
Reactive mitigation: blackhole routing (drops all traffic โ€” causes DoS but protects infrastructure). Proactive: traffic scrubbing centers clean traffic before delivery. Content delivery networks distribute load.
Full Definition โ†’
Full Definition โ†’
What is a demilitarized zone (DMZ)? D3 ยท Architecture โ–ธ
A DMZ isolates public-facing servers between two firewalls. Compromised DMZ servers can't reach internal networks directly due to the second firewall.
DMZ servers should have no direct access to internal servers. Database servers should be on the internal network, not the DMZ. The DMZ is a sacrificial zone โ€” hardened but expected to be attacked.
Full Definition โ†’
Full Definition โ†’
What is a detective control? D1 ยท General โ–ธ
A detective control identifies security events after they occur โ€” IDS, security cameras, audit logs, integrity monitoring. Detects but doesn't prevent.
Control categories: Preventive (stops attacks), Detective (identifies attacks), Corrective (fixes damage), Deterrent (discourages attacks). A camera is deterrent AND detective. IPS is preventive AND detective.
Full Definition โ†’
Full Definition โ†’
What is a digital certificate? D5 ยท Crypto โ–ธ
A digital certificate binds a public key to an identity, signed by a trusted CA. X.509 is the standard format. Contains: subject, issuer, public key, validity period, signature.
When you visit HTTPS sites, your browser verifies the server's certificate was signed by a trusted CA. Self-signed certificates trigger browser warnings โ€” no CA has vouched for them.
Full Definition โ†’
Full Definition โ†’
What is a dormant account security risk? D1 ยท General โ–ธ
Dormant accounts are active accounts no longer used by their owner โ€” former employees, old service accounts, test accounts. Prime targets for attackers.
Regular access reviews identify dormant accounts. Automated deprovisioning reduces risk. Lock or delete accounts inactive for 90+ days. Service accounts with no recent logins may be orphaned.
Full Definition โ†’
Full Definition โ†’
What is a drive-by download attack? D2 ยท Threats โ–ธ
A drive-by download automatically downloads and executes malware when a user simply visits a compromised or malicious website โ€” no user action (like clicking) required.
Exploits unpatched browsers and plugins (Flash, Java, PDF readers). Defense: keep browsers/plugins updated, web filtering, browser isolation, NoScript extension. Users don't need to click anything.
Full Definition โ†’
Full Definition โ†’
What is an eavesdropping attack? D2 ยท Threats โ–ธ
Eavesdropping passively captures network traffic to intercept sensitive data โ€” passwords, tokens, session cookies from unencrypted communications.
Passive attack โ€” doesn't modify traffic. Protection: encrypt everything (TLS, VPN). On shared networks (Wi-Fi), eavesdropping is trivial with Wireshark. Modern switched networks reduce eavesdropping vs. old hub networks.
Full Definition โ†’
Full Definition โ†’
What is an ephemeral key? D5 ยท Crypto โ–ธ
An ephemeral key is a temporary cryptographic key used for a single session and then discarded. Provides Perfect Forward Secrecy โ€” compromising the long-term key doesn't expose past sessions.
"Ephemeral" in a cipher suite name (DHE, ECDHE) = new key per session = forward secrecy. TLS 1.3 requires ephemeral keys. Long-term keys are only used for authentication, not encryption.
Full Definition โ†’
Full Definition โ†’
What is an evil maid attack? D2 ยท Threats โ–ธ
An evil maid attack involves physical access to an unattended device โ€” installing a keylogger, replacing firmware, or compromising the bootloader to steal encryption keys.
BitLocker with a startup PIN requires the PIN at boot โ€” defeating evil maid attacks that try to extract the key from TPM alone. TPM + PIN + Secure Boot = strong protection against physical attacks.
Full Definition โ†’
Full Definition โ†’
What is an exploit? D2 ยท Threats โ–ธ
An exploit is code or technique that takes advantage of a vulnerability to execute malicious actions โ€” gaining access, escalating privileges, or causing damage.
Vulnerability โ‰  exploit. A vulnerability is the flaw; an exploit is the code that uses it. PoC (Proof of Concept) exploits demonstrate exploitability. Metasploit contains hundreds of ready-to-use exploits.
Full Definition โ†’
Full Definition โ†’
What is a false positive and false negative in security? D4 ยท Operations โ–ธ
๐Ÿ”ด False positive: legitimate activity flagged as malicious. Causes alert fatigue.
๐Ÿ”ต False negative: malicious activity not detected. More dangerous โ€” missed attack.
Tuning IDS/IPS reduces false positives. Too sensitive = false positives. Too lenient = false negatives. Both are bad โ€” balance is key. False negatives are more dangerous (undetected attacks).
Full Definition โ†’
Full Definition โ†’
What is a flood attack? D2 ยท Threats โ–ธ
Flood attacks overwhelm targets with traffic. Types: SYN flood (exhausts TCP state), ICMP flood (ping flood), UDP flood (stateless), HTTP flood (Layer 7 โ€” hardest to mitigate).
SYN flood defense: SYN cookies (validates TCP handshake without state allocation). HTTP flood requires Layer 7 analysis โ€” CAPTCHA, rate limiting, behavioral analysis. CDN absorbs volumetric floods.
Full Definition โ†’
Full Definition โ†’
What is a forensic copy (image)? D4 ยท Operations โ–ธ
A forensic copy is a bit-for-bit duplicate of storage media โ€” including deleted files and unallocated space. Hash values verify the copy matches the original exactly.
Always work on forensic copies โ€” never on original evidence. Tool: dd (Linux), FTK Imager. Hash before and after copying (MD5 + SHA-256). The original must remain untouched for legal admissibility.
Full Definition โ†’
Full Definition โ†’
What is a forward proxy? D3 ยท Architecture โ–ธ
A forward proxy intercepts client requests to the internet โ€” filtering content, logging activity, blocking malicious sites, and optionally performing SSL inspection.
Forward proxy = protects users. Reverse proxy = protects servers. Transparent proxy = clients don't know it exists. SSL inspection (SSL bump) requires deploying a CA cert to client browsers.
Full Definition โ†’
Full Definition โ†’
What is a gap analysis in security? D4 ยท Operations โ–ธ
A gap analysis compares the current security posture against a desired state (compliance framework, best practice) โ€” identifying what's missing and what needs improvement.
Starting point for security programs. Maps current controls to NIST CSF, ISO 27001, or CIS Controls. Output: prioritized remediation roadmap. Often the first step before implementing a new framework.
Full Definition โ†’
Full Definition โ†’
What is a golden ticket attack? D2 ยท Threats โ–ธ
A golden ticket attack forges Kerberos TGTs using the KRBTGT account hash โ€” giving attackers persistent, unlimited access to all domain resources. Very hard to detect.
Requires Domain Admin to get KRBTGT hash (via DCSync or DC compromise). Mitigation: reset KRBTGT password twice (twice invalidates all existing tickets). Detect with unusual Kerberos ticket lifetimes or account usage patterns.
Full Definition โ†’
Full Definition โ†’
What is a Group Policy Object (GPO)? D1 ยท General โ–ธ
GPOs are collections of Windows configuration settings applied to users and computers in AD โ€” enforcing password policies, disabling USB drives, configuring screen lock, deploying software.
GPOs are a primary enterprise hardening tool. Processed in order: Local โ†’ Site โ†’ Domain โ†’ OU (LSDOU). Later GPOs override earlier. Loopback processing applies computer policies to logged-in users.
Full Definition โ†’
Full Definition โ†’
What is a guest network and why it matters? D3 ยท Architecture โ–ธ
A guest network is a separate VLAN for untrusted devices โ€” visitors, personal devices, IoT โ€” isolated from the corporate network. Provides internet access without internal access.
Guest networks prevent BYOD and visitor devices from reaching internal systems. IoT devices should be on a similar isolated VLAN. Network segmentation via VLANs is the implementation mechanism.
Full Definition โ†’
Full Definition โ†’
What is a hardware root of trust? D5 ยท Crypto โ–ธ
A hardware root of trust is an inherently trusted hardware component (TPM, secure enclave) whose integrity is guaranteed by the manufacturer โ€” forming the foundation of a chain of trust.
Chain of trust: hardware root of trust โ†’ bootloader โ†’ OS โ†’ applications. Each layer verifies the next. If the root of trust is compromised, the entire chain is untrustworthy. TPM is the most common hardware root of trust.
Full Definition โ†’
Full Definition โ†’
What is a hash collision? D5 ยท Crypto โ–ธ
A hash collision occurs when two different inputs produce the same hash output โ€” undermining the hash function's integrity guarantees. MD5 and SHA-1 have known practical collision attacks.
Collision attacks break digital signatures and file integrity checks. SHA-256 and SHA-3 are collision-resistant. The birthday attack is used to find collisions probabilistically. Hash functions with collisions should not be used for security purposes.
Full Definition โ†’
Full Definition โ†’
What is a honeynet? D4 ยท Operations โ–ธ
A honeynet is a network of honeypots designed to attract and study attackers in a realistic but isolated environment โ€” gathering threat intelligence on tools and techniques.
Honeynets are more realistic than single honeypots โ€” attackers can move laterally within them. All traffic to a honeynet is suspicious. Used by research teams to study real attacker behavior and collect malware samples.
Full Definition โ†’
Full Definition โ†’
What is a host-based firewall? D4 ยท Operations โ–ธ
A host-based firewall runs on individual endpoints, controlling inbound and outbound traffic at the host level โ€” providing protection even on trusted network segments.
Defense in depth: network firewall at the perimeter + host-based firewall on each system. Windows Firewall/Defender, iptables (Linux). Provides protection against internal threats and lateral movement.
Full Definition โ†’
Full Definition โ†’
What is a threat hunting hypothesis? D8 ยท CySA+ โ–ธ
A threat hunting hypothesis is an educated assumption about attacker behavior that guides a threat hunt โ€” based on intelligence, TTP analysis, or MITRE ATT&CK techniques.
Good hypotheses are testable and specific: "Attackers using PowerShell for lateral movement will have unusual parent-child process relationships." Intelligence-driven hypotheses are more targeted than purely exploratory hunts.
Full Definition โ†’
Full Definition โ†’
What is an injection attack? D2 ยท Threats โ–ธ
Injection attacks insert malicious code into interpreters โ€” SQL injection, LDAP injection, OS command injection, XPATH injection, NoSQL injection.
Injection is consistently #1 or #2 in OWASP Top 10. Root cause: user input concatenated directly into commands/queries. Fix: parameterized queries/prepared statements, input validation, principle of least privilege for application accounts.
Full Definition โ†’
Full Definition โ†’
What is a JSON Web Token (JWT)? D5 ยท Crypto โ–ธ
A JWT is a compact, self-contained token encoding user claims (identity, roles) and signed by the server. Three parts: header.payload.signature (Base64 encoded).
JWT signature verifies integrity โ€” a tampered JWT won't validate. Stored in localStorage (XSS risk) or HttpOnly cookies (CSRF risk). Algorithm confusion attack: changing "RS256" to "none" โ€” always validate the algorithm.
Full Definition โ†’
Full Definition โ†’
What is a Key Derivation Function (KDF)? D5 ยท Crypto โ–ธ
A KDF derives one or more cryptographic keys from a secret value (password). Password-based KDFs (PBKDF2, bcrypt, scrypt, Argon2) add computational cost to slow brute-force attacks.
Regular hash functions (SHA-256) are too fast for password storage. bcrypt/Argon2 are intentionally slow. Argon2 won the Password Hashing Competition โ€” current best practice. Iteration count should be tuned to take ~100ms per hash.
Full Definition โ†’
Full Definition โ†’
What is a keylogger? D2 ยท Threats โ–ธ
A keylogger records keystrokes to steal credentials, PINs, and sensitive data. Types: software keyloggers (malware) and hardware keyloggers (physical USB/keyboard devices).
Software keyloggers are detected by EDR. Hardware keyloggers require physical access to install and remove. Physical inspection of keyboard connections detects hardware keyloggers. Multi-factor auth limits keylogger damage.
Full Definition โ†’
Full Definition โ†’
What is a Man-in-the-Browser (MitB) attack? D2 ยท Threats โ–ธ
A MitB attack uses a browser trojan to intercept and modify web transactions in real-time โ€” capturing banking credentials, modifying transfer amounts after authentication.
MitB defeats standard MFA โ€” authentication succeeds, then the trojan modifies the transaction. Out-of-band transaction verification (SMS confirmation of exact transfer details) is an effective defense.
Full Definition โ†’
Full Definition โ†’
What is a network TAP? D4 ยท Operations โ–ธ
A network TAP (Test Access Point) passively copies all network traffic to a monitoring port without interrupting the connection โ€” for IDS, forensic capture, or traffic analysis.
TAP is passive โ€” it can't fail and break the link. SPAN/mirror port is an alternative using switch software but may drop packets under load. TAPs are preferred for high-speed forensic capture.
Full Definition โ†’
Full Definition โ†’
What is a Network Intrusion Detection System (NIDS)? D4 ยท Operations โ–ธ
A NIDS monitors network traffic for attack signatures and anomalies, generating alerts. Deployed out-of-band (via TAP or SPAN port) โ€” passive, can't block traffic.
NIDS: passive monitoring, generates alerts. NIPS: inline, blocks traffic. Snort and Suricata are popular open-source NIDS tools. Signature-based NIDS misses zero-days; anomaly-based NIDS has high false positives.
Full Definition โ†’
Full Definition โ†’
What is a null session attack? D2 ยท Threats โ–ธ
A null session establishes an unauthenticated SMB connection to enumerate Windows users, groups, shares, and policies โ€” a legacy Windows vulnerability.
Null sessions were common in Windows NT/2000. Modern Windows disables anonymous SMB by default. SMB signing prevents MITM on SMB connections. Enum4linux can still exploit misconfigurations. Disable SMB v1 entirely.
Full Definition โ†’
Full Definition โ†’
What is an on-path attack? D2 ยท Threats โ–ธ
An on-path attack (formerly called man-in-the-middle) positions the attacker in the communication path to intercept, read, and modify traffic between two parties.
CompTIA now uses "on-path" instead of MITM. Same concept โ€” attacker positioned between two communicating parties. Prevention: TLS/HTTPS, VPNs, certificate pinning, HSTS.
Full Definition โ†’
Full Definition โ†’
What is a password manager? D1 ยท General โ–ธ
A password manager securely stores unique, complex passwords for all accounts โ€” enabling strong, unique passwords per site without memorization.
Password managers are the most effective defense against credential reuse attacks. Organizations should use enterprise password managers (1Password Teams, Bitwarden Business) with MFA protection. If the password manager is compromised โ€” all passwords are at risk.
Full Definition โ†’
Full Definition โ†’
What is a password policy? D1 ยท General โ–ธ
A password policy defines requirements: minimum length, complexity, expiration, history, and lockout. NIST SP 800-63B now recommends: long passphrases, no mandatory rotation (unless compromised), check against breach lists.
New NIST guidance: minimum 8 chars (12+ recommended), no forced rotation, no complexity rules โ€” they cause weak patterns (Password1!). Check passwords against HaveIBeenPwned. Length beats complexity.
Full Definition โ†’
Full Definition โ†’
What is a payload in cybersecurity? D2 ยท Threats โ–ธ
A payload is the malicious code that executes after exploitation โ€” a reverse shell, Meterpreter session, ransomware encryptor, or command execution capability.
In pen testing: exploit (gets in) + payload (what happens after). Metasploit framework separates exploits from payloads โ€” mix and match. Staged payloads download additional code; stageless payloads are self-contained.
Full Definition โ†’
Full Definition โ†’
What is a persistence mechanism? D2 ยท Threats โ–ธ
Persistence mechanisms ensure malware survives system reboots โ€” registry run keys, scheduled tasks, Windows services, DLL hijacking, WMI subscriptions, startup folders.
After initial compromise, attackers establish persistence before moving. Detection: monitor registry run keys, scheduled tasks, new services, startup folders for unauthorized changes. Autoruns (Sysinternals) shows all persistence points.
Full Definition โ†’
Full Definition โ†’
What is a phishing kit? D2 ยท Threats โ–ธ
A phishing kit is a ready-made package containing fake login pages, deployment scripts, and credential harvesting code โ€” enabling non-technical attackers to launch convincing phishing campaigns.
Phishing kits are sold/rented on dark web marketplaces. Many kits even steal credentials from the kit buyer (double theft). Sophisticated kits bypass MFA via real-time proxying. Detection: certificate transparency logs, brand monitoring.
Full Definition โ†’
Full Definition โ†’
What is a security playbook? D4 ยท Operations โ–ธ
A security playbook is a documented set of procedures for responding to specific security incidents โ€” phishing, ransomware, data breach, insider threat. SOAR platforms automate playbook execution.
Playbooks reduce response time and ensure consistency. Written when calm; executed when under pressure. Test regularly (tabletop exercises). Include decision trees: IF this indicator THEN take this action. Critical for SOC operations.
Full Definition โ†’
Full Definition โ†’
What is a preventive security control? D1 ยท General โ–ธ
A preventive control stops security incidents before they occur โ€” firewalls, MFA, locks, encryption, access controls, security awareness training.
Control types: Preventive (stops), Detective (identifies), Corrective (fixes), Deterrent (discourages), Recovery (restores), Compensating (alternative). Preventive = most valuable. Detective = most common. Know all types.
Full Definition โ†’
Full Definition โ†’
What is a protocol analyzer? D7 ยท Tools โ–ธ
A protocol analyzer (packet sniffer) captures and decodes network traffic for troubleshooting and forensics. Wireshark is the most widely used tool.
Wireshark decodes hundreds of protocols. Can decrypt TLS traffic if you have the session keys. Filter syntax: 'tcp.port==443', 'ip.addr==192.168.1.1'. Promiscuous mode captures all traffic on a segment.
Full Definition โ†’
Full Definition โ†’
What is a race condition vulnerability? D2 ยท Threats โ–ธ
A race condition (TOCTOU โ€” Time of Check/Time of Use) exploits a timing gap between checking permissions and using a resource โ€” allowing unauthorized actions during that window.
TOCTOU: check file permissions (OK), attacker swaps file, use file (unauthorized file used). Common in Unix setuid programs. Fix: atomic operations, use file handles not names after permission checks.
Full Definition โ†’
Full Definition โ†’
What is active reconnaissance? D9 ยท PenTest+ โ–ธ
Active reconnaissance directly interacts with target systems โ€” port scans, ping sweeps, web crawling, banner grabbing. Creates logs on target systems but provides more detailed information.
Active recon generates evidence of your activities. May be detected and blocked. Always have authorization. Contrast with passive recon (OSINT) which generates no target-side logs.
Full Definition โ†’
Full Definition โ†’
What is a red team? D4 ยท Operations โ–ธ
A red team simulates a real-world adversary โ€” using the same TTPs as actual threat actors โ€” to test an organization's detection and response capabilities realistically.
Red team โ‰  pen test. Pen test = find all vulnerabilities. Red team = achieve specific objectives while evading detection, mirroring a real APT. Red teams test the blue team, not just technical controls.
Full Definition โ†’
Full Definition โ†’
What is a risk register? D1 ยท General โ–ธ
A risk register is a documented inventory of identified risks โ€” including description, likelihood, impact, risk owner, current controls, and treatment plan.
Risk registers operationalize risk management. Each risk has an owner. Risks must be reviewed regularly. Link to security roadmap โ€” high-priority risks drive near-term remediation projects. Required by ISO 27001, NIST, and most frameworks.
Full Definition โ†’
Full Definition โ†’
What is a rogue access point? D2 ยท Threats โ–ธ
A rogue AP is an unauthorized wireless access point โ€” either an internal employee creating a backdoor or an attacker's evil twin AP to intercept traffic.
Wireless IDS (WIDS) detects rogue APs by monitoring for unauthorized SSIDs/BSSIDs. Regular wireless surveys detect rogue APs. 802.1X authentication prevents internal rogue APs from accessing the network.
Full Definition โ†’
Full Definition โ†’
What is a screened subnet? D3 ยท Architecture โ–ธ
A screened subnet places a firewall between the internet and public-facing servers, with another between those servers and the internal network โ€” equivalent to a DMZ with two firewalls.
Screened subnet = DMZ = demilitarized zone. All describe the same architecture. The inner firewall screens the internal network from the screened subnet. More secure than single-firewall tri-homed design.
Full Definition โ†’
Full Definition โ†’
What is a security rating service? D4 ยท Operations โ–ธ
Security rating services (BitSight, SecurityScorecard) provide outside-in assessments of an organization's security posture โ€” analyzing external attack surface, breach history, and leaked credentials.
Used for vendor risk management and cyber insurance underwriting. Don't replace internal assessments but provide continuous external visibility. Ratings are based on observable data โ€” not your internal controls.
Full Definition โ†’
Full Definition โ†’
What is a silver ticket attack? D2 ยท Threats โ–ธ
A silver ticket attack forges Kerberos service tickets for specific services using the service account's NTLM hash โ€” more targeted than golden tickets but harder to detect.
Silver tickets target specific services (SQL Server, file shares) using that service's account hash. Unlike golden tickets, they don't require DC communication (harder to detect). Mitigation: managed service accounts with complex auto-rotated passwords.
Full Definition โ†’
Full Definition โ†’
What is a Security SLA? D1 ยท General โ–ธ
A security SLA defines contracted security obligations โ€” availability guarantees, incident notification timeframes, data handling requirements, audit rights, breach response times.
SLAs are contractual โ€” breach = legal liability. Key metrics: uptime (99.99% = ~52 min downtime/year), incident notification time (within 72 hours under GDPR), recovery time objectives.
Full Definition โ†’
Full Definition โ†’
What is a Software Bill of Materials (SBOM)? D4 ยท Operations โ–ธ
An SBOM is a comprehensive inventory of all software components in a product โ€” libraries, frameworks, dependencies โ€” enabling rapid impact assessment when new vulnerabilities are disclosed.
Log4Shell impact: organizations without SBOMs didn't know if they used Log4j. Biden's 2021 cybersecurity EO requires SBOMs for federal software procurement. SBOMs enable software supply chain risk management.
Full Definition โ†’
Full Definition โ†’
What is a stream cipher? D5 ยท Crypto โ–ธ
A stream cipher encrypts one bit or byte at a time, XORing with a pseudorandom keystream. Fast and memory-efficient. Examples: RC4 (broken), ChaCha20 (modern, used in TLS 1.3).
RC4 is broken โ€” never use it. ChaCha20-Poly1305 is the modern stream cipher โ€” used in TLS 1.3 and WireGuard VPN. Reusing the same key+nonce = catastrophic (keystreams cancel out, revealing plaintext XOR plaintext).
Full Definition โ†’
Full Definition โ†’
What is a subnet and why does it matter for security? D6 ยท Network+ โ–ธ
A subnet divides a network into smaller segments โ€” controlling which hosts can communicate directly. Security use: segment sensitive systems, create security zones, implement least-privilege networking.
Subnets are the foundation of network segmentation. Different subnets route through firewalls/routers โ€” enabling ACL enforcement between zones. /24 = 254 hosts, /25 = 126 hosts, /30 = 2 hosts (point-to-point links).
Full Definition โ†’
Full Definition โ†’
What is a tabletop exercise? D4 ยท Operations โ–ธ
A tabletop exercise is a discussion-based simulation where participants walk through a scenario โ€” identifying gaps in IR plans, roles, communication, and decision-making without actual system changes.
Cheapest and most accessible IR testing method. Run tabletops regularly. Scenarios: ransomware, data breach, insider threat. Compare results to documented procedures. Fix gaps before a real incident.
Full Definition โ†’
Full Definition โ†’
What is a Remote Access Trojan (RAT)? D2 ยท Threats โ–ธ
A RAT provides attackers with full remote access to a compromised system โ€” controlling the desktop, activating camera/microphone, keylogging, file access, and spreading to other systems.
RATs are the tool of APT groups for long-term access. Famous RATs: AsyncRAT, QuasarRAT, Cobalt Strike. Detection: unusual outbound connections, EDR behavioral alerts. Cover cameras on laptops โ€” RATs can activate them silently.
Full Definition โ†’
Full Definition โ†’
What is a use-after-free vulnerability? D2 ยท Threats โ–ธ
A use-after-free vulnerability occurs when a program continues using a memory pointer after the memory has been freed โ€” potentially executing attacker-controlled code placed in that memory location.
UAF vulnerabilities are common browser and kernel exploits. Browser-based UAFs are often zero-days. Mitigations: ASLR (randomizes memory placement), heap isolation, memory-safe languages (Rust, Go). Regularly patch browsers.
Full Definition โ†’
Full Definition โ†’
What is a Virtual Private Cloud (VPC)? D3 ยท Architecture โ–ธ
A VPC is an isolated virtual network in the cloud โ€” with its own subnets, routing, security groups (stateful firewalls), and NACLs (stateless ACLs). Foundation of cloud network security.
Security groups = stateful (track connections), applied to instances. NACLs = stateless (apply rules in order), applied to subnets. Default security group allows all outbound โ€” restrict egress to principle of least privilege.
Full Definition โ†’
Full Definition โ†’
What is a computer virus? D2 ยท Threats โ–ธ
A virus attaches itself to legitimate programs and replicates when that program is executed โ€” requiring user action (running infected software) to spread. Infects files, boot sectors, or macros.
Virus = requires execution of infected file to spread. Worm = spreads automatically via network. Trojan = disguised as legitimate software. Ransomware = encrypts files for ransom. Know these distinctions for the exam.
Full Definition โ†’
Full Definition โ†’
What is a web shell? D2 ยท Threats โ–ธ
A web shell is a malicious script uploaded to a web server (via file upload vulnerability or RCE) that provides browser-accessible command execution โ€” persistent backdoor.
Web shells are notoriously hard to detect (small, often obfuscated files). FIM (File Integrity Monitoring) detects new/modified web files. Common in compromised WordPress and Drupal sites. Look for unusual .php files in upload directories.
Full Definition โ†’
Full Definition โ†’
What is a whaling attack? D2 ยท Threats โ–ธ
Whaling is spear phishing targeting senior executives โ€” leveraging their authority to request wire transfers, W2 data, or system access. High-value targets with high-value outcomes.
Whaling emails often appear to be from boards, law firms, or regulators. Defense: executive security awareness training, out-of-band verification of financial requests, anti-spoofing controls (DMARC), DKIM.
Full Definition โ†’
Full Definition โ†’
What is a zero-knowledge proof? D5 ยท Crypto โ–ธ
A zero-knowledge proof (ZKP) allows one party to prove they know a secret without revealing the secret itself โ€” the verifier gains confidence without learning the actual value.
ZKPs enable privacy-preserving authentication. Applications: proving you're over 18 without revealing your birthdate, blockchain privacy (Zcash), passwordless authentication concepts. Emerging technology becoming more relevant in security.
Full Definition โ†’
Full Definition โ†’
What is a zombie computer? D2 ยท Threats โ–ธ
A zombie is a malware-infected computer secretly controlled by attackers via C2 โ€” often unaware to the owner. Zombies form botnets used for DDoS, spam, credential stuffing.
Signs of a zombie: unexpected outbound traffic, high CPU usage, slow performance, unusual network connections. Defense: EDR, behavioral monitoring, network egress filtering to detect C2 beaconing.
Full Definition โ†’
Full Definition โ†’
What is active scanning in vulnerability assessment? D9 ยท PenTest+ โ–ธ
Active scanning directly probes hosts to identify services, versions, and vulnerabilities โ€” using tools like Nessus or Qualys to authenticate and thoroughly test systems.
Credentialed (authenticated) scans find more vulnerabilities than non-credentialed. Scanning can cause system instability โ€” schedule maintenance windows for production systems. Document scope and get authorization before scanning.
Full Definition โ†’
Full Definition โ†’
What is an air-gapped network? D3 ยท Architecture โ–ธ
An air-gapped network is completely isolated from public networks. Data transfer requires physical media (USB, optical) or one-way data diodes. Used for classified systems and critical ICS/SCADA.
Air gaps are not perfect โ€” Stuxnet crossed an air gap via USB. Physical security is critical (USB drops). Data diodes enforce one-way data flow at the hardware level. Consider also electromagnetic isolation (Faraday cage) for classified work.
Full Definition โ†’
Full Definition โ†’
What is an application layer attack? D2 ยท Threats โ–ธ
Application layer (Layer 7) attacks target web application logic โ€” Slowloris (holds connections open with partial HTTP requests), HTTP floods, Slow POST. Hard to distinguish from legitimate traffic.
Layer 7 attacks require fewer packets than volumetric attacks. Harder to mitigate because traffic looks legitimate. Defenses: connection rate limiting, CAPTCHA, behavioral analysis, WAF, CDN with bot mitigation.
Full Definition โ†’
Full Definition โ†’
What is a Bayesian filter in email security? D4 ยท Operations โ–ธ
A Bayesian filter classifies emails as spam or legitimate using statistical probability โ€” learning from word frequency patterns in known spam vs. ham (legitimate email).
Bayesian filters improve with training โ€” more data = better classification. Spammers use tricks to fool them: misspellings, image-based text, random word padding. Modern spam filters combine Bayesian with reputation, sender policy, and ML.
Full Definition โ†’
Full Definition โ†’
What is an open-source SIEM? D7 ยท Tools โ–ธ
Open-source SIEM options: Elastic Security (Elasticsearch + Kibana), Wazuh (OSSEC-based), Graylog, OpenSearch Security โ€” provide SIEM capabilities without commercial licensing costs.
Elastic Stack (ELK) is widely deployed. Wazuh adds EDR/vulnerability management to OSSEC. OpenSearch is AWS's Elasticsearch fork. Cost: storage and infrastructure, not licensing. Require more expertise to operate than commercial SIEMs.
Full Definition โ†’
Full Definition โ†’
What is an exploit chain? D2 ยท Threats โ–ธ
An exploit chain combines multiple vulnerabilities to achieve a goal that no single exploit could โ€” e.g., remote code execution โ†’ sandbox escape โ†’ privilege escalation โ†’ persistence.
Browser exploits often use 3-part chains: browser RCE + sandbox escape + privilege escalation. Patching any one vulnerability in the chain breaks the entire attack. Defense in depth is critical โ€” stop chains at any link.
Full Definition โ†’
Full Definition โ†’
What is a honey credential? D4 ยท Operations โ–ธ
A honey credential is a fake username/password pair deliberately placed where attackers would find it (code repos, config files, AD) โ€” any use triggers an immediate alert.
Honey credentials have zero false positives โ€” no legitimate process ever uses them. Great for detecting password spraying (if attacker tries the honey password) and insider threats (if someone uses credentials from a secured location).
Full Definition โ†’
Full Definition โ†’
What is a key ceremony? D5 ยท Crypto โ–ธ
A key ceremony is a formal, audited procedure for generating and backing up a CA's root private key โ€” conducted with multiple witnesses, physical security, and documented procedure.
Root CA key ceremonies require multiple trusted participants (no single person has full key knowledge), HSM use, physical security, and formal documentation. Often required by compliance (WebTrust, ETSI) for public CAs.
Full Definition โ†’
Full Definition โ†’
What is a Man-in-the-Disk attack? D2 ยท Threats โ–ธ
A Man-in-the-Disk attack manipulates data apps store on Android external storage โ€” since multiple apps can access external storage, malicious apps can tamper with other apps' stored data.
Android security model restricts internal storage access (per-app sandbox) but external storage is shared. Apps should never store sensitive data on external storage. Validate integrity of data read from external storage.
Full Definition โ†’
Full Definition โ†’
What is a network baseline? D4 ยท Operations โ–ธ
A network baseline documents normal network behavior โ€” traffic volumes, protocols, communication patterns, bandwidth utilization โ€” enabling anomaly detection when deviations occur.
Baselines must be established before deploying anomaly detection. Baselines change over time (business growth, new apps) โ€” update them. Unusual deviations from baseline often indicate malware, data exfiltration, or misconfigurations.
Full Definition โ†’
Full Definition โ†’
What is an offline attack? D2 ยท Threats โ–ธ
An offline attack performs password cracking on stolen hash databases โ€” no lockout policies, no rate limiting, full GPU power. Can test billions of combinations per second.
Stolen password databases enable offline cracking. Defense: strong key derivation functions (bcrypt/Argon2) make even offline attacks impractical. MD5/SHA-1 hashes are cracked in seconds offline. This is why algorithm choice matters enormously.
Full Definition โ†’
Full Definition โ†’
What is AlienVault OTX? D7 ยท Tools โ–ธ
AlienVault OTX (Open Threat Exchange) is a free, community-driven threat intelligence sharing platform โ€” organizations contribute and consume IoCs, malware samples, and threat data via "pulses."
OTX integrates with most SIEMs and security tools. Free tier provides high-value threat intelligence. Contributing back strengthens the community. AT&T Cybersecurity (MSSP) uses OTX as the backend for their SIEM platform.
Full Definition โ†’
Full Definition โ†’
What is a padding oracle attack? D5 ยท Crypto โ–ธ
A padding oracle attack exploits error messages or timing differences when a server processes improperly padded ciphertext โ€” allowing decryption of CBC-mode ciphertext without the key.
POODLE exploited SSL 3.0's CBC padding oracle. Mitigation: use AES-GCM (authenticated encryption โ€” doesn't need padding). Return generic errors regardless of failure reason. BEAST, POODLE, LUCKY13 are all padding oracle variants.
Full Definition โ†’
Full Definition โ†’
What is a passive attack? D2 ยท Threats โ–ธ
A passive attack observes or intercepts data without modifying it โ€” eavesdropping, traffic analysis, shoulder surfing, photographing sensitive information.
Passive attacks are hard to detect โ€” no interaction with target systems. Active attacks (modify data, inject packets) leave traces. Encryption defeats passive eavesdropping. Traffic analysis counters: onion routing, traffic shaping, dummy traffic.
Full Definition โ†’
Full Definition โ†’
What is a PKI certificate chain? D5 ยท Crypto โ–ธ
A certificate chain goes Root CA โ†’ Intermediate CA(s) โ†’ End-entity certificate. Browsers verify the chain to the trusted root to establish trust.
Root CAs sign Intermediate CAs; Intermediate CAs sign end-entity (server) certs. Root CAs are offline and extremely protected. Intermediate CAs do the day-to-day signing. If any CA in the chain is compromised, all downstream certs are untrusted.
Full Definition โ†’
Full Definition โ†’
What is a Proof of Concept (PoC) exploit? D2 ยท Threats โ–ธ
A PoC exploit demonstrates that a vulnerability is technically exploitable โ€” providing working code that proves the vulnerability's impact without necessarily being weaponized.
PoC publication is controversial โ€” helps defenders prioritize but also accelerates attacker capability. CVSS exploitability score considers PoC availability. When a PoC is published publicly, patch immediately โ€” exploitation attempts spike within 24-72 hours.
Full Definition โ†’
Full Definition โ†’
What is a Policy Enforcement Point (PEP)? D1 ยท General โ–ธ
A PEP enforces access control decisions made by a Policy Decision Point (PDP) โ€” validating requests and permitting or denying access based on policy.
Zero trust architecture separates the decision (PDP/Policy Engine) from the enforcement (PEP). PEP = firewall, proxy, API gateway. PDP = identity provider, policy engine. Separating them enables dynamic, context-aware access decisions.
Full Definition โ†’
Full Definition โ†’
What is a Privacy Impact Assessment (PIA)? D1 ยท General โ–ธ
A PIA (Privacy Impact Assessment) evaluates how new systems or processes collect, use, and store personal data โ€” identifying and mitigating privacy risks before deployment.
GDPR requires DPIA (Data Protection Impact Assessment) for high-risk processing. PIAs are best practice for any new system handling personal data. Completed before deployment (not after) to influence design decisions.
Full Definition โ†’
Full Definition โ†’
What is a Privileged Access Workstation (PAW)? D1 ยท General โ–ธ
A PAW is a dedicated, hardened workstation used exclusively for administrative tasks โ€” no email, web browsing, or standard user apps โ€” reducing the risk of malware compromising admin credentials.
PAWs prevent credential theft via malware on admin workstations. Separate from day-to-day workstations. Admin-only: no browsing, email, or office apps. Physical or VM-based. Essential for Tier 0 (Domain Admin) and Tier 1 (server admin) access.
Full Definition โ†’
Full Definition โ†’
What is a recovery control? D1 ยท General โ–ธ
A recovery control restores systems and operations to normal after a security incident โ€” backups, DRP, hot/warm/cold sites, system reimaging, clean restore procedures.
Recovery controls are reactive โ€” they restore after damage. Preventive controls stop damage. Detective controls identify damage. All three are needed. RTO and RPO define the requirements for recovery controls.
Full Definition โ†’
Full Definition โ†’
What is a sandbox escape? D2 ยท Threats โ–ธ
A sandbox escape breaks out of an isolated execution environment to access the host system or other sandboxes โ€” exploiting the hypervisor, container runtime, or browser sandbox.
Sandbox escapes are rare and high-value (often zero-days). Browser-to-OS escape chains are extremely valuable. Container escape exploits are more common (misconfigured --privileged containers). Defense: keep hypervisors and container runtimes patched.
Full Definition โ†’
Full Definition โ†’
What is a secure enclave? D5 ยท Crypto โ–ธ
A secure enclave is a hardware-isolated coprocessor for handling sensitive operations โ€” Apple's Secure Enclave (TouchID/FaceID), Intel SGX, ARM TrustZone โ€” processing sensitive data without exposing it to the main OS.
Secure enclaves protect cryptographic keys and biometric data even from OS-level malware. iOS encryption keys never leave the Secure Enclave. Hardware-bound credentials prevent key extraction even with root access.
Full Definition โ†’
Full Definition โ†’
What is a signing certificate? D5 ยท Crypto โ–ธ
A signing certificate contains a private key used for digital signatures โ€” code signing (software authenticity), email signing (S/MIME), and document signing. Key usage extensions specify permitted uses.
Code signing certificates are high-value targets โ€” compromised signing certificates were used in SolarWinds and Stuxnet attacks. Extended Validation (EV) code signing certificates require organizational vetting and provide more trust.
Full Definition โ†’
Full Definition โ†’
What is a software vulnerability? D2 ยท Threats โ–ธ
A software vulnerability is a weakness in code, design, or configuration that can be exploited to violate security properties โ€” gaining unauthorized access, executing code, or causing DoS.
Vulnerability lifecycle: discovery โ†’ CVE assignment โ†’ vendor patch โ†’ public disclosure โ†’ exploitation attempts spike. Patch before public disclosure if possible. Post-disclosure, treat as emergency โ€” attackers reverse-engineer patches quickly.
Full Definition โ†’
Full Definition โ†’
What is a threat actor? D2 ยท Threats โ–ธ
Threat actors: Nation-states (sophisticated, patient, espionage/sabotage), Cybercriminals (financially motivated, ransomware/fraud), Hacktivists (ideologically motivated), Insiders, Script kiddies (low skill).
Match controls to threat actor capability. Script kiddies stopped by basic patching/MFA. Nation-states require comprehensive defense-in-depth, threat hunting, and incident response capability. Know your threat actors to prioritize defenses.
Full Definition โ†’
Full Definition โ†’
What is a threat feed? D4 ยท Operations โ–ธ
A threat feed provides real-time IoCs (malicious IPs, domains, hashes) for automatic blocking and detection โ€” integrated into firewalls, proxies, SIEM, and DNS sinkholes.
Free feeds: AlienVault OTX, abuse.ch, CISA KEV, Cisco Talos. Commercial: Mandiant, CrowdStrike, Recorded Future. Quality > quantity โ€” a bad feed = false positives that block legitimate traffic. Automate IoC ingestion for timeliness.
Full Definition โ†’
Full Definition โ†’
What is a timing attack? D2 ยท Threats โ–ธ
A timing attack measures response times to infer secret information โ€” string comparison functions that return faster for longer matching prefixes reveal password lengths and values.
Constant-time comparison functions prevent timing attacks. Relevant for: password comparison, cryptographic operations, database queries (different response times for existing vs. nonexistent users โ€” username enumeration). Use timing-safe equals functions.
Full Definition โ†’
Full Definition โ†’
What is availability in the CIA triad? D1 ยท General โ–ธ
Availability ensures systems and data are accessible when needed. Threatened by: DoS/DDoS, hardware failure, natural disasters, ransomware, misconfigurations. Improved by: redundancy, DRP, clustering, backups.
CIA triad: Confidentiality (prevent unauthorized access), Integrity (prevent unauthorized modification), Availability (ensure access when needed). ICS/SCADA prioritizes availability. DDoS attacks target availability specifically.
Full Definition โ†’
Full Definition โ†’
What is a web honeypot? D4 ยท Operations โ–ธ
A web honeypot places decoy files, directories, or form fields in web applications โ€” detecting automated scanners, crawlers, and attackers via requests to non-existent resources that no legitimate user would visit.
Honeytokens in web apps: hidden form fields, comments with fake credentials, robots.txt honeypot entries. Any access = suspicious. Low false positive rate โ€” legitimate users never touch honeypots by definition.
Full Definition โ†’
Full Definition โ†’
What is a YARA rule? D7 ยท Tools โ–ธ
YARA is a malware identification and classification tool using pattern-matching rules. Rules contain strings (ASCII, hex, regex) and conditions that match against files or memory.
YARA rules are shareable threat intelligence. Used in EDR, sandbox, email gateways, and SIEM for malware detection. VirusTotal supports YARA hunting. Writing good YARA rules: focus on malware-unique strings, avoid common library code to reduce false positives.
Full Definition โ†’
Full Definition โ†’
What is an account lockout policy? D1 ยท General โ–ธ
An account lockout policy disables accounts after N failed login attempts โ€” preventing brute-force and password-spraying.
Balance security vs. availability. Too aggressive = intentional lockout DoS. Typical: 5 attempts, 30-min lockout, reset counter after 30 min. Audit lockouts โ€” high frequency indicates attack.
Full Definition โ†’
Full Definition โ†’
What is alert fatigue? D4 ยท Operations โ–ธ
Alert fatigue occurs when excessive false-positive alerts cause analysts to ignore or dismiss them โ€” including real attacks.
Target breach (2013): FireEye alerts were dismissed as noise. Fix: tune detection rules aggressively, use SOAR for automation, risk-score alerts, prioritize quality over quantity of detections.
Full Definition โ†’
Full Definition โ†’
What is application allowlisting? D4 ยท Operations โ–ธ
Application allowlisting permits only pre-approved software to run โ€” blocking all else including unknown malware and unauthorized tools.
Most effective malware prevention control. AppLocker (Windows) implements it via GPO. Best for: kiosks, POS systems, high-security environments. Difficult to maintain at scale โ€” significant operational overhead.
Full Definition โ†’
Full Definition โ†’
What is a security baseline? D4 ยท Operations โ–ธ
A security baseline is the documented, approved, hardened configuration for a system type โ€” the secure starting point all instances should match.
Deviation from baseline = configuration drift = security risk. CIS Benchmarks and DISA STIGs provide pre-built baselines. Automated tools (Ansible, Puppet, Chef) enforce baselines continuously.
Full Definition โ†’
Full Definition โ†’
What is a brute force attack? D2 ยท Threats โ–ธ
A brute force attack systematically tries every possible password. Online brute force = against live login (slow, lockout risk). Offline brute force = against stolen hashes (fast, GPU-accelerated).
Long passwords make brute force computationally infeasible. Account lockout stops online attacks. Key stretching (bcrypt) slows offline attacks. MFA defeats brute force even if password is found.
Full Definition โ†’
Full Definition โ†’
What is an eavesdropping attack? D2 ยท Threats โ–ธ
Eavesdropping passively captures network traffic to intercept sensitive data โ€” passwords, session cookies from unencrypted connections. Passive โ€” doesn't modify traffic.
Protection: encrypt everything (TLS, VPN). On shared networks (Wi-Fi), eavesdropping is trivial with Wireshark. Modern switched networks reduced eavesdropping vs. hub networks, but VLANs and physical layer attacks still enable it.
Full Definition โ†’
Full Definition โ†’
What is an Endpoint Protection Platform (EPP)? D4 ยท Operations โ–ธ
An EPP is a prevention-focused endpoint security platform โ€” combining next-gen AV (NGAV), application control, device control, and behavioral prevention.
EPP = prevention focused. EDR = detection and response focused. Modern platforms combine both. EPP stops known and common threats; EDR investigates sophisticated ones that get through. XDR extends visibility beyond the endpoint.
Full Definition โ†’
Full Definition โ†’
What is an evil maid attack? D2 ยท Threats โ–ธ
An evil maid attack uses physical access to an unattended device โ€” installing a keylogger, replacing firmware, or compromising the bootloader to steal encryption keys.
BitLocker + startup PIN defeats this โ€” the PIN must be entered before the TPM releases the encryption key. TPM alone (without PIN) is vulnerable โ€” the TPM auto-releases the key on boot. Physical security + pre-boot PIN = defense.
Full Definition โ†’
Full Definition โ†’
What is a golden ticket attack? D2 ยท Threats โ–ธ
A golden ticket attack forges Kerberos TGTs using the KRBTGT account hash โ€” giving unlimited, persistent access to all domain resources. Very hard to detect.
Requires Domain Admin first (to extract KRBTGT hash). Mitigation: reset KRBTGT password TWICE (twice invalidates all existing tickets). Detect via unusual ticket lifetimes. Microsoft's Defender Identity catches golden ticket attacks.
Full Definition โ†’
Full Definition โ†’
What is a host-based firewall? D4 ยท Operations โ–ธ
A host-based firewall runs on individual endpoints, controlling inbound and outbound traffic at the host โ€” providing protection even on trusted internal segments.
Defense in depth: perimeter firewall + host firewall on each system. Windows Firewall/Defender, iptables/nftables (Linux). Critical for stopping lateral movement โ€” internal attackers can't reach a hardened host even on the same VLAN.
Full Definition โ†’
Full Definition โ†’
What is an on-path attack? D2 ยท Threats โ–ธ
An on-path attack (CompTIA's current term for MITM) positions the attacker between communicating parties to intercept and optionally modify traffic.
CompTIA Security+ now uses "on-path" instead of "man-in-the-middle." Same concept โ€” same defenses: TLS/HTTPS (authenticates server), VPN (encrypts tunnel), certificate pinning (prevents rogue CA attacks), HSTS (prevents SSL stripping).
Full Definition โ†’
Full Definition โ†’
What is a rogue access point? D2 ยท Threats โ–ธ
A rogue AP is unauthorized wireless โ€” either an employee creating a backdoor or an attacker's evil twin AP to intercept traffic.
Wireless IDS (WIDS) detects rogue APs by monitoring for unauthorized SSIDs/BSSIDs. 802.1X prevents internal rogue APs from accessing the wired network (unauthenticated ports blocked). Regular wireless surveys map your RF environment.
Full Definition โ†’
Full Definition โ†’
What is a VLAN? D6 ยท Network+ โ–ธ
A VLAN logically segments a physical network into isolated broadcast domains โ€” separating traffic without physical separation. 802.1Q tagging carries VLAN information on trunk ports.
VLANs enable network segmentation with minimal hardware. Access ports: single VLAN, no tag (endpoint devices). Trunk ports: multiple VLANs with 802.1Q tags (between switches/routers). VLAN hopping attacks can bypass segmentation โ€” add firewall controls.
Full Definition โ†’
Full Definition โ†’
What is a WAF? D3 ยท Architecture โ–ธ
A WAF inspects HTTP/HTTPS traffic to block web attacks โ€” SQLi, XSS, CSRF, path traversal. Deployed in front of web applications at Layer 7.
WAF โ‰  replace secure coding. WAF is a compensating control. OWASP ModSecurity Core Rule Set provides baseline protection. WAF in detection mode first, then blocking mode after tuning. A WAF blocking legitimate requests hurts the business โ€” tune carefully.
Full Definition โ†’
Full Definition โ†’
What is ARP (Address Resolution Protocol)? D6 ยท Network+ โ–ธ
ARP resolves IPv4 addresses to MAC addresses within a local subnet. ARP request (broadcast): "Who has 192.168.1.1?" ARP reply (unicast): "I do โ€” here's my MAC."
ARP operates at Layer 2. ARP table caches IP-MAC mappings. ARP poisoning inserts false mappings to redirect traffic (MITM). Dynamic ARP Inspection (DAI) validates ARP packets against the DHCP snooping binding table. 'arp -a' displays the local ARP table.
Full Definition โ†’
Full Definition โ†’
What is a routing protocol? D6 ยท Network+ โ–ธ
Routing protocols: Distance vector (RIP โ€” hop count, slow convergence), Link state (OSPF, IS-IS โ€” full topology, fast convergence), Path vector (BGP โ€” policy-based, internet scale).
Static routes: manually configured, no overhead. Dynamic routing: automatic path discovery, redundancy. OSPF is the dominant enterprise interior protocol. BGP is the internet routing protocol. RIP is legacy (max 15 hops, slow convergence) โ€” deprecated.
Full Definition โ†’
Full Definition โ†’
What is ATT&CK mapping in detection? D8 ยท CySA+ โ–ธ
ATT&CK mapping documents which techniques you can detect vs. which are gaps โ€” creating a "coverage heat map" to prioritize detection engineering investments.
ATT&CK Navigator visualizes detection coverage. Map existing detections to techniques โ†’ identify gaps โ†’ write new detection rules to fill gaps. Purple team exercises validate coverage in practice, not just on paper.
Full Definition โ†’
Full Definition โ†’
What is a behavioral IoC? D8 ยท CySA+ โ–ธ
A behavioral IoC describes attacker actions rather than specific artifacts โ€” "PowerShell making outbound connections" vs. specific IP address or hash. More durable than artifact-based IoCs.
IP addresses and hashes change in minutes. Behavioral patterns persist across campaigns. The Pyramid of Pain: TTPs at top (hardest for attacker to change), hash values at bottom (easiest to change). Focus detection on behavioral indicators for lasting coverage.
Full Definition โ†’
Full Definition โ†’
What is a lessons learned review? D8 ยท CySA+ โ–ธ
A lessons learned review (post-mortem) analyzes what happened, why, how it was detected, and how to prevent recurrence โ€” the last IR phase.
Must occur for every significant incident. Outputs: root cause, detection gap analysis, control improvements, policy updates, training needs. Blameless post-mortems produce better results โ€” focus on systems and processes, not individuals. Track improvement actions to completion.
Full Definition โ†’
Full Definition โ†’
What is a penetration test report? D8 ยท CySA+ โ–ธ
A pen test report contains: Executive summary (business risk), Methodology, Findings (vulnerability + evidence + CVSS + recommendation), Risk rating, and Remediation roadmap.
Two audiences: executives (want business risk context) and technical teams (need exact reproduction steps and remediation guidance). Each finding must include: evidence (screenshot/log), impact explanation, and specific remediation steps. Track findings to closure.
Full Definition โ†’
Full Definition โ†’
What are Active Directory attacks? D9 ยท PenTest+ โ–ธ
Key AD attacks: Kerberoasting (request service tickets, crack offline), AS-REP Roasting (request hash for pre-auth disabled accounts), DCSync (replicate all hashes from DC), Golden/Silver tickets.
Kerberoasting targets service accounts with SPNs โ€” request TGS ticket, crack the service account's password offline. Defense: service accounts should have complex 25+ char passwords (managed service accounts). DCSync requires Domain Admin โ€” the ultimate goal of AD attacks.
Full Definition โ†’
Full Definition โ†’
What is Active Directory enumeration? D9 ยท PenTest+ โ–ธ
AD enumeration maps users, groups, GPOs, trusts, and attack paths. BloodHound/SharpHound collects AD data and graphs attack paths to Domain Admin.
BloodHound is the most powerful AD attack path analysis tool. Run SharpHound to collect data, import into BloodHound Neo4j, query for shortest path to Domain Admin. Defenders can run BloodHound on their own environment to find and close attack paths.
Full Definition โ†’
Full Definition โ†’
What are AV/EDR evasion techniques? D9 ยท PenTest+ โ–ธ
Evasion techniques: obfuscation (encode/encrypt payload), living-off-the-land (use built-in tools: PowerShell, certutil, mshta), process injection (hide in legitimate processes), API unhooking (bypass EDR hooks).
Modern EDR uses behavioral analysis โ€” pure obfuscation doesn't defeat it. LOLBAS (Living Off the Land Binaries and Scripts) uses trusted Windows tools for attack steps. EDR detects the behavior, not just the binary. Red teams constantly develop new evasion; blue teams must detect behavior not just signatures.
Full Definition โ†’
Full Definition โ†’
What is a reverse shell? D9 ยท PenTest+ โ–ธ
A reverse shell connects from the target back to the attacker's listener โ€” bypassing firewalls and NAT that block inbound connections.
Target โ†’ attacker (reverse). Attacker โ†’ target (bind shell โ€” requires inbound port open). Reverse shells bypass outbound filtering only if the port is allowed (443/80 best). Listeners: nc -lvnp 4444. Metasploit handler: use multi/handler. Encrypted shells (socat, meterpreter) evade cleartext inspection.
Full Definition โ†’
Full Definition โ†’
What is AES (Advanced Encryption Standard)? D5 ยท Crypto โ–ธ
AES is the current symmetric encryption standard โ€” 128, 192, or 256-bit key sizes, 128-bit block size. Replaced DES/3DES. Used everywhere: TLS, disk encryption, VPNs, Wi-Fi (WPA2/3).
AES-256 is the gold standard for symmetric encryption. AES is computationally infeasible to brute-force. Security comes from key confidentiality โ€” algorithm is public. Use AES-GCM for authenticated encryption. AES-XTS for disk encryption (BitLocker, FileVault).
Full Definition โ†’
Full Definition โ†’
What is an Advanced Persistent Threat (APT)? D2 ยท Threats โ–ธ
An APT is a sophisticated, prolonged attack โ€” typically nation-state or state-sponsored โ€” focused on long-term access for espionage, sabotage, or intellectual property theft. Average dwell time: 200+ days.
APT characteristics: sophisticated TTPs, patient (months/years), persistent (survive detection attempts), targeted (specific victim), well-resourced. APT1, APT28, APT29 (Cozy Bear) are named groups. Detection requires threat hunting โ€” they evade automated tools.
Full Definition โ†’
Full Definition โ†’
What is ARP spoofing/poisoning? D2 ยท Threats โ–ธ
ARP spoofing sends false ARP replies to poison victim caches โ€” associating the attacker's MAC with a legitimate IP (gateway, server) to intercept traffic.
ARP operates at Layer 2 with no authentication. Dynamic ARP Inspection (DAI) validates ARP packets against the DHCP snooping binding table. Static ARP entries for critical hosts prevent poisoning. Detection: 'arp -a' shows duplicate MACs for different IPs.
Full Definition โ†’
Full Definition โ†’
What is asset inventory? D4 ยท Operations โ–ธ
Asset inventory maintains a complete, accurate list of all hardware and software โ€” you can't protect what you don't know exists. CIS Control #1 and #2.
"You can't secure what you don't know exists." Unknown assets (shadow IT, rogue devices) are high-risk. Network scanning (Nmap, Nessus) discovers unmanaged devices. CMDB tracks assets and their relationships. Automated discovery keeps inventory current.
Full Definition โ†’
Full Definition โ†’
What are authentication protocols? D1 ยท General โ–ธ
Key auth protocols: Kerberos (Windows AD, ticket-based), RADIUS (network access โ€” Wi-Fi, VPN), TACACS+ (Cisco device admin), LDAP/SAML (enterprise SSO), EAP (extensible framework for 802.1X).
RADIUS encrypts only password. TACACS+ encrypts entire payload (more secure for device admin). Kerberos uses tickets, not passwords over the network. SAML for web SSO. RADIUS for 802.1X wireless/VPN authentication. Know when to use each protocol.
Full Definition โ†’
Full Definition โ†’
What is a Certificate Authority (CA)? D5 ยท Crypto โ–ธ
A CA issues and signs digital certificates, vouching for the identity of certificate holders. Trust hierarchy: Root CA โ†’ Intermediate CA(s) โ†’ End-entity certificate.
Root CAs are offline for security (minimal attack surface). Intermediate CAs do daily signing operations. Browsers ship with ~150 trusted root CAs. If any CA is compromised, all its issued certs are untrusted. Internal/private CAs are used for enterprise internal certificates.
Full Definition โ†’
Full Definition โ†’
What is a container escape? D2 ยท Threats โ–ธ
Container escape breaks out of a container to access the host OS or other containers โ€” exploiting misconfigurations (--privileged flag, host volume mounts) or container runtime vulnerabilities.
Privileged containers have full host access โ€” essentially root on the host. Never run privileged containers in production. Host path mounts (especially /) give container access to host filesystem. Check for excessive capabilities. Security-context in K8s enforces restrictions.
Full Definition โ†’
Full Definition โ†’
What is an insider threat? D2 ยท Threats โ–ธ
Insider threats: Malicious (intentional theft/sabotage), Negligent (accidental data loss/misconfiguration), Compromised (external attacker using insider's credentials).
Negligent insiders cause more incidents than malicious ones. Controls: least privilege (limit access), DLP (detect exfiltration), UEBA (detect behavior anomalies), PAM session recording (audit admin actions), separation of duties, background checks. Offboarding procedures critical for malicious insiders.
Full Definition โ†’
Full Definition โ†’
What is an IPS (Intrusion Prevention System)? D4 ยท Operations โ–ธ
An IPS is deployed inline โ€” actively blocking detected attacks by dropping malicious packets. Contrast with IDS (passive, only alerts). Both can be signature-based or anomaly-based.
IPS: inline, active blocking (like a firewall with deep inspection). IDS: out-of-band, passive alerting (no blocking, no performance impact). IPS must fail-closed (block all) or fail-open (pass all) if it fails โ€” choose based on environment. False positives in IPS block legitimate traffic.
Full Definition โ†’
Full Definition โ†’
What is a security incident? D4 ยท Operations โ–ธ
A security incident is an event that actually or potentially violates security policy. A security event is any observable occurrence (all incidents are events, not all events are incidents).
Every alert = event. Confirmed breach = incident. Classification guides response priority and resources. Incident threshold definition is critical โ€” too low = alert fatigue, too high = missed incidents. Define in policy: what always triggers an incident? What requires investigation before classification?
Full Definition โ†’
Full Definition โ†’
What is a TPM? D5 ยท Crypto โ–ธ
A TPM (Trusted Platform Module) is a dedicated security chip providing: secure key storage, random number generation, platform integrity measurement (PCRs), and remote attestation.
TPM enables BitLocker (seals encryption key to TPM PCR measurements โ€” changes to boot process lock the drive), remote attestation (prove device integrity to a server), and hardware-based credential storage. TPM 2.0 required for Windows 11. Discrete TPM chips are more secure than firmware TPMs (fTPM).
Full Definition โ†’
Full Definition โ†’
What is a watering hole attack? D2 ยท Threats โ–ธ
A watering hole attack compromises websites frequently visited by targets โ€” waiting for victims to visit the legitimate-but-compromised site and delivering malware via drive-by download.
Difficult to defend against because the site is legitimate (known, trusted). Detection: web proxy categorization changes, SSL certificate changes on trusted sites, behavioral analysis detecting drive-by download. Patch browsers/plugins to defeat the exploit. Web isolation technology is the best defense.
Full Definition โ†’
Full Definition โ†’
What is anycast routing? D6 ยท Network+ โ–ธ
Anycast routes traffic to the nearest (topologically closest) server sharing an IP address โ€” used by DNS root servers, CDNs, and for DDoS mitigation.
Anycast is why Google DNS (8.8.8.8) responds from a server near you, not a single server. CDNs use anycast to deliver content from the nearest edge. DDoS mitigation: attack traffic is distributed across global nodes, not concentrated at one. One IP, many physical servers worldwide.
Full Definition โ†’
Full Definition โ†’
What is application delivery networking? D6 ยท Network+ โ–ธ
An ADC (Application Delivery Controller) extends load balancing with SSL offloading (terminates TLS centrally), content caching, compression, and advanced health checking.
SSL offloading moves TLS processing from app servers to dedicated hardware โ€” reducing app server CPU load. The internal network between ADC and app servers may be unencrypted (tradeoff: internal network trust). Re-encryption maintains E2E encryption at cost of ADC CPU.
Full Definition โ†’
Full Definition โ†’
What is a ping sweep? D9 ยท PenTest+ โ–ธ
A ping sweep sends ICMP Echo requests to every IP in a range โ€” identifying live hosts without port scanning. 'nmap -sn 192.168.1.0/24'.
Many hosts block ICMP โ€” Nmap -sn also uses ARP (on local subnet) and TCP SYN/ACK probes to detect hosts blocking ping. Nmap -PR (ARP scan) is the most reliable on local subnets. Ping sweeps are active reconnaissance โ€” they appear in firewall logs. Use for internal recon during authorized pen tests.
Full Definition โ†’
Full Definition โ†’
What is a Private VLAN (PVLAN)? D6 ยท Network+ โ–ธ
Private VLANs isolate hosts within the same VLAN/subnet โ€” isolated ports can't communicate with each other, only with promiscuous ports (the gateway/router).
PVLANs are commonly used in hosting environments โ€” each customer's servers are isolated from others even on the same subnet. Isolated port: talks only to promiscuous. Community port: talks to same community + promiscuous. Promiscuous: talks to all. Prevents lateral movement between same-VLAN hosts without IP routing.
Full Definition โ†’
Full Definition โ†’
What are attack patterns? D8 ยท CySA+ โ–ธ
Attack patterns document recurring attacker behaviors โ€” MITRE ATT&CK catalogues 14 tactic categories and 500+ techniques. CAPEC (Common Attack Pattern Enumeration) catalogs application attack patterns.
ATT&CK is the most widely used framework for attack pattern knowledge. Use ATT&CK to: map detections to techniques, identify coverage gaps, structure threat intelligence, guide purple team exercises. Techniques are more durable than IoCs for long-term detection.
Full Definition โ†’
Full Definition โ†’
What is a GRC platform? D8 ยท CySA+ โ–ธ
A GRC platform (Archer, ServiceNow GRC, MetricStream) centralizes governance, risk management, and compliance tracking โ€” policy management, risk registers, audit management, and control testing in one system.
GRC platforms prevent risks from being tracked in spreadsheets (which get stale and lost). Link risks to controls, controls to audit evidence. Demonstrate compliance to auditors with documented evidence in the platform. Automate control testing where possible for continuous compliance assurance.
Full Definition โ†’
Full Definition โ†’
What is a post-mortem? D8 ยท CySA+ โ–ธ
A post-mortem (post-incident review) analyzes an incident after resolution โ€” what happened, why, how it was detected, and how to prevent recurrence. Blameless culture produces better results.
Blameless post-mortem: focus on systems and processes, not individuals. Outputs: root cause analysis, detection gap findings, control recommendations, policy updates, training needs. Track improvement actions to completion. Share key findings across the security team โ€” institutional learning prevents repeat incidents.
Full Definition โ†’
Full Definition โ†’
What is a purple team exercise? D8 ยท CySA+ โ–ธ
A purple team exercise runs red team attacks while blue team monitors โ€” red shares exact TTP details immediately so blue can tune detections and verify they work in real time.
Exercise structure: red executes specific ATT&CK technique โ†’ blue checks if detection fired โ†’ if not, tune together โ†’ document coverage. More cost-effective than pure red team (faster learning loop). ATT&CK-mapped exercises systematically improve detection coverage across the entire matrix.
Full Definition โ†’
Full Definition โ†’
What is active exploitation? D9 ยท PenTest+ โ–ธ
Active exploitation is the process of executing exploit code against a live target system โ€” moving from identifying a vulnerability to actually gaining access or demonstrating impact.
Always verify the exact OS/version before running exploits โ€” wrong exploit can crash services (especially for critical infrastructure pen tests). Have a rollback plan. Document every exploit attempt (success or failure) with timestamps and evidence. Never exceed authorized scope.
Full Definition โ†’
Full Definition โ†’
What is API security testing? D9 ยท PenTest+ โ–ธ
API security testing checks: BOLA/IDOR (access other users' data), authentication bypass, mass assignment (extra parameters accepted), rate limiting, sensitive data exposure in responses.
OWASP API Security Top 10: BOLA (#1), Broken Auth (#2), Broken Object Property Level Auth (#3), Unrestricted Resource Consumption (#4), BFLA (#5). Tools: Postman, Burp Suite, OWASP ZAP, mitmproxy. Change userId in API requests โ€” BOLA is extremely common in API implementations.
Full Definition โ†’
Full Definition โ†’
What is automated vulnerability scanning? D9 ยท PenTest+ +
Automated scanning uses tools like Nessus, Qualys, OpenVAS to identify known vulnerabilities across systems โ€” fast and comprehensive for known issues but misses logic flaws and chained vulnerabilities.
Automated scanners are starting points, not substitutes for manual testing. They produce false positives โ€” verify findings manually before reporting. Authenticated scans find 3-5x more vulnerabilities than unauthenticated. Web app scanners (Nikto, OWASP ZAP) supplement network scanners for web targets.
Full Definition โ†’
What is banner grabbing? D9 ยท PenTest+ โ–ธ
Banner grabbing reads service banners to identify software versions โ€” helping attackers find vulnerable software. Tools: Nmap, Netcat, Telnet.
Banner grabbing is passive reconnaissance. Defense: suppress or falsify banners. Knowing a server runs Apache 2.2.3 lets an attacker target known CVEs for that exact version.
Full Definition โ†’
Full Definition โ†’
What is baiting in social engineering? D2 ยท Threats โ–ธ
Baiting leaves infected USB drives or other media in public places โ€” relying on human curiosity to plug them in and execute malware.
USB drops are highly effective. The Pentagon was once breached via infected USB found in a parking lot. Defense: disable USB autorun, restrict USB ports, security awareness training.
Full Definition โ†’
Full Definition โ†’
What is behavioral analysis in security? D4 ยท Operations โ–ธ
Behavioral analysis monitors actions rather than signatures โ€” detecting threats based on what they do (encrypting files, making unusual network connections) rather than what they look like.
Behavioral analysis is key for detecting zero-days and fileless malware. EDR uses behavioral analysis. UEBA applies it to user activities. Requires baseline establishment first.
Full Definition โ†’
Full Definition โ†’
What is BeyondCorp and zero trust? D3 ยท Architecture โ–ธ
BeyondCorp is Google's zero trust implementation โ€” employees work without VPN from any location; access is based on device health + identity, not network location.
BeyondCorp proved zero trust works at scale. The key insight: "network location is not a reliable indicator of trustworthiness." Identity and device posture replace the network perimeter.
Full Definition โ†’
Full Definition โ†’
What is biometric authentication? D1 ยท General โ–ธ
Biometrics authenticate based on physical characteristics. Types: fingerprint, facial recognition, iris scan, retina scan, voice recognition, behavioral (gait, typing patterns).
FAR (False Acceptance Rate) = accepting unauthorized users. FRR (False Rejection Rate) = rejecting authorized users. Crossover Error Rate (CER/EER) = where FAR = FRR โ€” lower CER = more accurate. Biometrics can't be changed if compromised.
Full Definition โ†’
Full Definition โ†’
What is BYOD and its security risks? D3 ยท Architecture โ–ธ
BYOD allows employees to use personal devices for work. Risks: corporate data on unmanaged devices, no control over OS patches, mixing personal/corporate data, device loss.
Controls: MDM (Mobile Device Management) for full device management, MAM (Mobile Application Management) for just corporate apps. Remote wipe, certificate-based auth, containerization separate personal/work data.
Full Definition โ†’
Full Definition โ†’
What is Business Email Compromise (BEC)? D2 ยท Threats โ–ธ
BEC is a targeted attack where criminals impersonate executives or vendors via email to trick employees into transferring funds or divulging sensitive information. Average loss: $120,000 per incident.
BEC doesn't require malware โ€” it's pure social engineering. Defenses: out-of-band verification for wire transfers, DMARC/DKIM, training employees to verify requests through phone calls.
Full Definition โ†’
Full Definition โ†’
What is black box testing in security? D9 ยท PenTest+ โ–ธ
Black box testing evaluates security with no prior knowledge of the target โ€” simulating an external attacker who has no inside information. Tests what an outsider could discover and exploit.
Most realistic attack simulation. Time-consuming (must discover everything). Contrast: white box (full knowledge, efficient, finds more vulnerabilities) and gray box (partial knowledge, balanced). Black box tests your real external exposure.
Full Definition โ†’
Full Definition โ†’
What is biometric authentication? D1 ยท General โ–ธ
Biometrics authenticate using physical characteristics. FAR (False Acceptance Rate) = accepting imposters. FRR (False Rejection Rate) = rejecting legitimate users. CER = where FAR=FRR (lower = more accurate).
Biometrics can't be changed if compromised. Best combined with another factor. Face ID uses 3D infrared to defeat photo spoofing. Behavioral biometrics (typing rhythm, gait) are passive and continuous.
Full Definition โ†’
Full Definition โ†’
What are block cipher modes? D5 ยท Crypto โ–ธ
AES modes: ECB (identical blocks = identical ciphertext โ€” insecure), CBC (chains blocks with IV โ€” needs padding, vulnerable to padding oracle), GCM (authenticated encryption, no padding โ€” preferred), XTS (disk encryption).
Never use ECB. GCM is the modern choice โ€” provides confidentiality + integrity in one pass (AEAD). CBC is acceptable but requires HMAC for integrity. XTS is specifically designed for disk sector encryption.
Full Definition โ†’
Full Definition โ†’
What is bandwidth vs throughput vs latency? D6 ยท Network+ โ–ธ
Bandwidth = maximum theoretical capacity. Throughput = actual data rate achieved. Latency = one-way delay. Jitter = variation in latency (critical for VoIP/video).
1Gbps bandwidth โ‰  1Gbps throughput. Overhead, errors, and congestion reduce throughput. Latency affects real-time applications more than throughput. Jitter buffers smooth VoIP quality. QoS prioritizes latency-sensitive traffic.
Full Definition โ†’
Full Definition โ†’
What is BGP? D6 ยท Network+ โ–ธ
BGP (Border Gateway Protocol) is the internet's routing protocol โ€” routing between autonomous systems (AS). Uses path vector routing with AS-path attribute to prevent loops.
BGP is the protocol that makes the internet work. BGP hijacking = advertising routes you don't own โ†’ traffic misdirection. RPKI (Resource Public Key Infrastructure) adds cryptographic validation to BGP route origins. Default route: 0.0.0.0/0 in BGP.
Full Definition โ†’
Full Definition โ†’
What is Burp Suite? D7 ยท Tools โ–ธ
Burp Suite is the premier web application security testing platform โ€” HTTP proxy (intercept/modify requests), Scanner (automated vulnerability detection), Repeater (manual testing), Intruder (fuzzing/brute force).
Burp Proxy: configure browser to proxy through Burp (127.0.0.1:8080). Intercept requests, modify parameters, replay to test for SQLi/XSS/IDOR. Community edition is free but no Scanner. Essential tool for any web app pen tester.
Full Definition โ†’
Full Definition โ†’
What is Business Continuity Planning (BCP)? D4 ยท Operations โ–ธ
BCP ensures critical business functions continue during and after disasters โ€” encompassing DRP (IT recovery), crisis management, and continuity of operations planning.
BCP is broader than DRP. DRP = how to restore IT systems. BCP = how the business survives when systems are unavailable. Both require: BIA (to identify priorities), testing (tabletop + full DR exercises), and regular updates. Executive sponsorship is critical โ€” BCP without budget is wishful thinking.
Full Definition โ†’
Full Definition โ†’
What is breach notification? D8 ยท CySA+ +
Breach notification timelines: GDPR (72 hours to supervisory authority), HIPAA (60 days to HHS, individuals), PCI DSS (immediately to card brands), State laws (30-60 days to individuals, varies by state).
Notify legal counsel first โ€” they guide the notification process. GDPR 72-hour clock starts when you become aware. HIPAA notification to individuals if PHI was accessed. Some states (California CCPA) have strict notification requirements. Document the decision-making process for all notifications made (and not made).
Full Definition โ†’
What is CBC mode encryption? D5 ยท Crypto โ–ธ
CBC (Cipher Block Chaining) XORs each plaintext block with the previous ciphertext block before encrypting, using an IV for the first block. More secure than ECB.
CBC requires an IV โ€” it should be random and unpredictable. CBC is vulnerable to padding oracle attacks (POODLE). Modern preference is AES-GCM which provides both encryption and authentication.
Full Definition โ†’
Full Definition โ†’
What is certificate transparency? D5 ยท Crypto โ–ธ
Certificate Transparency (CT) requires CAs to log all issued certificates to public append-only logs, allowing domain owners to detect rogue certificates issued for their domains.
CT helps detect unauthorized certificate issuance. Browsers require CT logs for trusted certificates. Domain owners can monitor CT logs to detect MITM attacks using fraudulent certificates.
Full Definition โ†’
Full Definition โ†’
What is clickjacking? D2 ยท Threats โ–ธ
Clickjacking overlays invisible UI elements over legitimate web content โ€” tricking users into clicking hidden buttons that perform unintended actions.
Prevention: X-Frame-Options HTTP header (deny/sameorigin), Content-Security-Policy frame-ancestors directive. Forces browsers to refuse to render the page inside iframes.
Full Definition โ†’
Full Definition โ†’
What is cloud access logging and monitoring? D4 ยท Operations โ–ธ
Cloud access logging records all API calls, resource access, and configuration changes in cloud environments. AWS CloudTrail, Azure Monitor, GCP Cloud Audit Logs.
Cloud logs are critical for forensics. Enable logging from day one โ€” you can't go back and capture missed events. Alert on unusual API calls, especially those disabling logging itself.
Full Definition โ†’
Full Definition โ†’
What is cloud-native security? D3 ยท Architecture โ–ธ
Cloud-native security integrates security into cloud-native architectures โ€” securing containers, Kubernetes, serverless functions, and CI/CD pipelines.
Key principles: immutable infrastructure (rebuild, don't patch), shift left (security in CI/CD), least privilege for service accounts, network policies for pod-to-pod communication in K8s.
Full Definition โ†’
Full Definition โ†’
What is cloud storage security? D3 ยท Architecture โ–ธ
Cloud storage security protects data in cloud object storage (S3, Azure Blob, GCS). Common misconfiguration: public buckets exposing sensitive data to the internet.
S3 bucket misconfiguration is the #1 cloud security failure. Always: block public access, enable server-side encryption, enable versioning, use bucket policies for least privilege.
Full Definition โ†’
Full Definition โ†’
What is CVE (Common Vulnerabilities and Exposures)? D4 ยท Operations โ–ธ
CVE is a standardized identifier for publicly known security vulnerabilities. Each CVE has a unique ID (CVE-YEAR-NUMBER) and is scored by CVSS (Common Vulnerability Scoring System).
CVSS scores: 0-3.9 Low, 4-6.9 Medium, 7-8.9 High, 9-10 Critical. Use CVSS to prioritize patching. NVD (National Vulnerability Database) hosts CVE details.
Full Definition โ†’
Full Definition โ†’
What is confidential computing? D5 ยท Crypto โ–ธ
Confidential computing protects data in use (while being processed) through hardware-based Trusted Execution Environments (TEEs). Intel SGX, AMD SEV are examples.
Completes the encryption trilogy: at rest + in transit + in use. Critical for cloud environments where the CSP could theoretically access running workloads. Emerging tech but appearing on exams.
Full Definition โ†’
Full Definition โ†’
What is containment in incident response? D4 ยท Operations โ–ธ
Containment stops an incident from spreading โ€” isolating affected systems while preserving evidence for forensics. Short-term (immediate isolation) vs. long-term (rebuild).
Don't immediately reimage โ€” preserve forensic evidence first (memory dump, logs). Balance containment vs. business continuity. Isolate, don't power off (unless necessary โ€” RAM evidence lost).
Full Definition โ†’
Full Definition โ†’
What is continuous monitoring in security? D4 ยท Operations โ–ธ
Continuous monitoring provides real-time visibility into the security posture โ€” continuously checking for vulnerabilities, misconfigurations, and unauthorized changes rather than point-in-time assessments.
FISMA requires continuous monitoring for federal systems. CDM (Continuous Diagnostics and Mitigation) is DHS's program. Contrast with annual pen tests โ€” continuous gives ongoing visibility.
Full Definition โ†’
Full Definition โ†’
What is credential stuffing? D2 ยท Threats โ–ธ
Credential stuffing automates login attempts using username/password pairs from data breaches โ€” effective because ~60% of people reuse passwords across sites.
Defense: MFA (makes stolen passwords useless), breached password detection (check against HaveIBeenPwned database), rate limiting, CAPTCHA, anomaly detection. Password reuse is the enabler.
Full Definition โ†’
Full Definition โ†’
What is Cross-Site Tracing (XST)? D2 ยท Threats โ–ธ
XST uses the HTTP TRACE method combined with XSS to steal cookies, bypassing HttpOnly restrictions.
Defense: disable HTTP TRACE method on web servers. HttpOnly flag alone doesn't protect against XST. An often-overlooked web vulnerability โ€” disable TRACE in Apache/Nginx config.
Full Definition โ†’
Full Definition โ†’
What is cryptographic agility? D5 ยท Crypto โ–ธ
Cryptographic agility is designing systems to easily swap out cryptographic algorithms โ€” essential for transitioning away from algorithms broken by quantum computers or cryptanalysis.
Post-quantum cryptography (NIST standardizing CRYSTALS-Kyber, CRYSTALS-Dilithium) will eventually replace RSA/ECC. Crypto-agile systems can upgrade without full redesign. Plan for this now.
Full Definition โ†’
Full Definition โ†’
What is cyberwarfare? D2 ยท Threats โ–ธ
Cyberwarfare is state-sponsored attacks on another nation's systems โ€” targeting critical infrastructure, military systems, financial networks, and government agencies.
Stuxnet (2010) โ€” destroyed Iranian centrifuges. NotPetya (2017) โ€” most destructive cyberattack in history. Critical infrastructure (power, water, finance) is the primary target.
Full Definition โ†’
Full Definition โ†’
What is credential exposure? D2 ยท Threats โ–ธ
Credential exposure occurs when credentials appear in source code, public repositories, config files, or breach dumps โ€” giving attackers valid credentials without brute force.
Check GitHub for accidentally committed credentials (truffleHog, git-secrets). HaveIBeenPwned monitors breach exposure. Rotate any exposed credentials immediately. Use secrets management vaults (HashiCorp Vault) not env files.
Full Definition โ†’
Full Definition โ†’
What is certificate auto-enrollment? D5 ยท Crypto โ–ธ
Certificate auto-enrollment automatically requests, deploys, and renews certificates for users and computers via Group Policy โ€” ensuring all systems have valid certificates without manual intervention.
Auto-enrollment dramatically reduces certificate management overhead and prevents expiration outages. Requires an Enterprise CA (not Standalone CA). Critical for large organizations deploying 802.1X, smart card auth, or code signing.
Full Definition โ†’
Full Definition โ†’
What is Cloud Workload Protection (CWPP)? D3 ยท Architecture โ–ธ
CWPP secures cloud workloads at runtime โ€” containers, VMs, serverless functions โ€” with vulnerability scanning, runtime protection, and least-privilege enforcement.
CWPP, CASB, and CSPM together form comprehensive cloud security. CSPM = configuration; CASB = access/DLP; CWPP = runtime workload protection. CNAPP converges all three into a single platform.
Full Definition โ†’
Full Definition โ†’
What is CNAPP? D3 ยท Architecture โ–ธ
CNAPP (Cloud-Native Application Protection Platform) combines CSPM (Cloud Security Posture Management), CWPP, and supply chain security into a unified platform covering code-to-cloud.
CNAPP represents the convergence of cloud security tools. Gartner coined the term. Key: shifts security left (code) while maintaining runtime visibility. Avoids security tool sprawl in cloud environments.
Full Definition โ†’
Full Definition โ†’
What is Cloud Security Posture Management (CSPM)? D3 ยท Architecture โ–ธ
CSPM continuously audits cloud configurations against security policies โ€” detecting misconfigurations, compliance violations, and policy drift before attackers exploit them.
CSPM automatically detects "public S3 bucket" type misconfigurations. Most cloud breaches involve misconfiguration, not zero-days. AWS Security Hub, Azure Defender for Cloud, and third-party tools provide CSPM capabilities.
Full Definition โ†’
Full Definition โ†’
What is containment in incident response? D4 ยท Operations โ–ธ
Containment stops an incident from spreading while preserving forensic evidence. Short-term: immediately isolate. Long-term: rebuild or remediate.
Don't immediately reimage โ€” capture memory first. Balance containment vs. business continuity. Isolate (network disconnect) rather than power off when possible โ€” RAM evidence preserved. Document all actions with timestamps.
Full Definition โ†’
Full Definition โ†’
What is CIDR notation? D6 ยท Network+ โ–ธ
CIDR notation expresses IP ranges as address/prefix: 192.168.1.0/24 = 256 addresses (254 usable). /24 = 255.255.255.0 mask. /25 = 128 addresses, /26 = 64, /30 = 4 (2 usable).
Memorize common prefixes: /8=16M hosts, /16=65K hosts, /24=254 hosts, /25=126, /26=62, /27=30, /28=14, /29=6, /30=2. Calculate: hosts = 2^(32-prefix) - 2. /30 is ideal for point-to-point links.
Full Definition โ†’
Full Definition โ†’
What are common network protocols and ports? D6 ยท Network+ โ–ธ
Key ports: HTTP 80, HTTPS 443, SSH 22, SMTP 25, DNS 53, DHCP 67/68, RDP 3389, SMB 445, LDAP 389, LDAPS 636, SNMP 161/162, FTP 20/21, Telnet 23, IMAP 143, POP3 110.
Memorize the key ports โ€” they appear frequently on Security+ AND Network+ exams. Encrypted alternatives: SSH (22) replaces Telnet (23), SFTP replaces FTP (21), LDAPS (636) replaces LDAP (389), HTTPS (443) replaces HTTP (80).
Full Definition โ†’
Full Definition โ†’
What is cloud security monitoring? D8 ยท CySA+ โ–ธ
Cloud security monitoring: enable all logging (AWS CloudTrail, Azure Activity Logs, GCP Audit Logs), use cloud-native threat detection (AWS GuardDuty, Azure Defender), integrate into SIEM.
Alert on: new IAM roles/permissions, disabling logging (attacker evasion), unusual geographic access, resource creation in non-standard regions, API calls from Tor exit nodes. Cloud misconfiguration is best detected by continuous configuration scanning (CSPM).
Full Definition โ†’
Full Definition โ†’
What are containment strategies in IR? D8 ยท CySA+ โ–ธ
Containment strategies: network isolation (block all external communication), network segmentation (isolate from rest of network but maintain some access), endpoint isolation (EDR kill switch), honeytoken monitoring (detect without alerting attacker).
Containment decision factors: evidence preservation needs, business impact of isolation, risk of attacker escalating or destroying evidence, confidence in scope of compromise. Document every containment action with timestamp and rationale.
Full Definition โ†’
Full Definition โ†’
What is crowdsourced threat intelligence? D8 ยท CySA+ โ–ธ
Crowdsourced TI aggregates intelligence from many contributors โ€” VirusTotal (file/URL reputation), AlienVault OTX (IoC sharing), ISACs (sector-specific), MISP (open-source sharing platform).
ISACs (Information Sharing and Analysis Centers) provide sector-specific TI โ€” FS-ISAC (financial), H-ISAC (healthcare), E-ISAC (electricity). Sharing TI benefits all participants. Automated STIX/TAXII ingestion makes TI actionable in SIEM/SOAR.
Full Definition โ†’
Full Definition โ†’
What is Cobalt Strike? D9 ยท PenTest+ โ–ธ
Cobalt Strike is a commercial penetration testing framework featuring the Beacon C2 agent โ€” widely used by red teams and unfortunately also by APT groups. Provides lateral movement, persistence, and data exfiltration capabilities.
Cobalt Strike is legitimate red team software but frequently cracked and used by real attackers. Blue teams hunt for Cobalt Strike beacons via network signatures (default watermark, malleable C2 profiles). Detecting Cobalt Strike is a key blue team skill.
Full Definition โ†’
Full Definition โ†’
What are common web exploitation techniques? D9 ยท PenTest+ โ–ธ
Common web exploits: SQL injection (auth bypass, data extraction), XSS (session hijacking, credential theft), IDOR (access other users' data), File upload (web shell), Path traversal (read system files), SSRF (internal network access).
IDOR (Insecure Direct Object Reference) = change userId=123 to userId=124 in API request to see another user's data. BOLA in APIs. These are all found in Burp Suite intercept and modify. OWASP Top 10 covers these systematically.
Full Definition โ†’
Full Definition โ†’
What is credential dumping? D9 ยท PenTest+ โ–ธ
Credential dumping extracts credentials from memory or disk โ€” Mimikatz (LSASS memory), Impacket secretsdump (DCSync or local NTDS.dit), reg save SAM (local accounts).
Requires admin/SYSTEM privileges. Defense: Credential Guard (isolates LSASS in hypervisor), EDR behavioral detection of LSASS access, LSASS Protection (PPL mode), restrict NTDS.dit access. Log Event 4661 (NTDS access) and Mimikatz signatures.
Full Definition โ†’
Full Definition โ†’
What controls improve availability? D1 ยท General โ–ธ
Availability controls: hardware redundancy (RAID, dual PSU), clustering (HA pairs), load balancing, geographic redundancy (multi-region), backups (offline/offsite), UPS/generators, automatic failover.
RAID improves storage availability but is NOT a backup. 3-2-1 backup rule: 3 copies, 2 media types, 1 offsite. RTO/RPO drive availability investment decisions. Chaos engineering proactively tests resilience by intentionally causing failures.
Full Definition โ†’
Full Definition โ†’
What is chain of custody? D4 ยท Operations โ–ธ
Chain of custody documents who collected, handled, and transferred evidence โ€” maintaining integrity for legal admissibility. Any gap = evidence may be inadmissible or challenged.
Document: what was collected, when, by whom, where stored, every transfer. Hash evidence immediately upon collection. Use tamper-evident storage. Handle original media with write blockers. In court: chain of custody proves evidence was not tampered with.
Full Definition โ†’
Full Definition โ†’
What are cloud service models? D3 ยท Architecture โ–ธ
IaaS (manage OS/apps, vendor manages hardware): EC2, Azure VMs. PaaS (manage apps/data, vendor manages platform): Azure App Service. SaaS (vendor manages everything, you manage users/data): Office 365, Salesforce.
Shared responsibility: more abstraction = vendor manages more security. IaaS = most control, most responsibility. SaaS = least control, least responsibility (but still responsible for data, access, user management). The customer ALWAYS owns their data regardless of service model.
Full Definition โ†’
Full Definition โ†’
What is code injection? D2 ยท Threats โ–ธ
Code injection tricks an application into executing attacker-supplied code โ€” SQL injection, OS command injection, LDAP injection, template injection, eval() injection in dynamic languages.
Root cause: user input passed to an interpreter without sanitization. Universal mitigations: parameterized queries (SQL), input validation + escaping (others), least privilege app accounts (limit blast radius). WAF provides defense-in-depth but is not a substitute for secure coding.
Full Definition โ†’
Full Definition โ†’
What controls protect confidentiality? D1 ยท General โ–ธ
Confidentiality controls: encryption (at rest, in transit), access controls (authentication + authorization + least privilege), data classification, need-to-know principle, DLP, MFA, physical security.
Confidentiality = prevent unauthorized disclosure. Threatened by: eavesdropping, insider theft, data breach, social engineering. CIA triad: Confidentiality + Integrity + Availability. Each has specific threats and controls. Balance all three โ€” over-securing one often harms another.
Full Definition โ†’
Full Definition โ†’
What is CSRF? D2 ยท Threats โ–ธ
CSRF tricks an authenticated user into unknowingly submitting a malicious request โ€” exploiting the trust a web application has in the user's browser.
CSRF attack: victim is logged into bank.com โ†’ attacker tricks them into clicking a link โ†’ browser sends authenticated request to bank.com with their session cookie โ†’ unauthorized action performed. Prevention: CSRF tokens (unique per session), SameSite cookie attribute (Strict or Lax), re-authentication for sensitive actions.
Full Definition โ†’
Full Definition โ†’
What are cryptographic failures? D5 ยท Crypto โ–ธ
Cryptographic failures (OWASP #2): transmitting sensitive data without encryption, using weak algorithms (MD5, SHA-1, DES, RC4), improper key management, using cryptographic functions incorrectly.
Examples: sending PII over HTTP, storing passwords as unsalted MD5, using hardcoded encryption keys, not validating TLS certificates. Fix: use TLS everywhere, bcrypt for passwords, AES-256/ChaCha20 for encryption, properly manage keys (never hardcode them).
Full Definition โ†’
Full Definition โ†’
What are common hash functions? D5 ยท Crypto โ–ธ
FunctionOutputStatus
MD5128-bitBroken (collisions)
SHA-1160-bitDeprecated (collisions)
SHA-256256-bitSecure (current)
SHA-3VariableSecure (newest)
Never use MD5 or SHA-1 for security purposes. SHA-256 is the current standard. SHA-3 uses a completely different construction (Keccak) โ€” provides diversity if SHA-2 is weakened. bcrypt/Argon2 for password hashing (not general-purpose hashes).
Full Definition โ†’
Full Definition โ†’
What controls protect data integrity? D1 ยท General โ–ธ
Integrity controls: hashing (detect changes), digital signatures (verify authenticity + integrity), FIM (File Integrity Monitoring), version control, database constraints, input validation, WORM storage.
Integrity = prevent unauthorized modification. CIA triad. Threatened by: malware (modifying files), man-in-the-middle (modifying data in transit), insider sabotage, software bugs. TLS provides integrity in transit. FIM provides integrity at rest. Digital signatures provide non-repudiation.
Full Definition โ†’
Full Definition โ†’
What is Cross-Site Scripting (XSS)? D2 ยท Threats โ–ธ
XSS injects malicious JavaScript into web pages โ€” stealing session cookies, redirecting users, capturing keystrokes, or defacing pages. Types: Reflected, Stored (persistent), DOM-based.
XSS bypasses Same-Origin Policy by executing in the victim's browser in the context of the legitimate site. Prevention: output encoding (HTML encode all user input before displaying), Content Security Policy (CSP), HttpOnly cookie flag (prevents JS from reading cookies). OWASP Top 10 consistently listed.
Full Definition โ†’
Full Definition โ†’
What is cloud incident response? D8 ยท CySA+ โ–ธ
Cloud IR differences: no physical access, evidence is in logs (CloudTrail, activity logs), snapshots for disk forensics, API calls as primary evidence source, evidence preservation via log export to immutable storage.
Cloud forensics: enable all logging before you need it. Export logs to S3 with object lock (WORM) immediately. Take EBS snapshots for disk analysis. API call logs show exactly what an attacker did. Cloud providers have shared responsibility for preservation โ€” request CSP assistance for serious incidents.
Full Definition โ†’
Full Definition โ†’
What is continuous security validation? D8 ยท CySA+ โ–ธ
Continuous security validation (Breach and Attack Simulation โ€” BAS) automatically tests security controls 24/7 โ€” simulating attack TTPs and validating that detections fire and blocks work.
BAS platforms (SafeBreach, Cymulate, AttackIQ) continuously run simulated attacks against production controls. Unlike pen tests (annual), BAS is continuous. Answers: "Do my security controls actually work right now?" Detects when new product deployment breaks a detection or when a signature update covers a new technique.
Full Definition โ†’
Full Definition โ†’
What is cyber deception? D8 ยท CySA+ โ–ธ
Cyber deception deploys decoys throughout the environment โ€” honeypots (fake systems), honey tokens (fake credentials/files), canary tokens (tracking URLs/documents) that alert immediately when accessed.
Deception shifts the advantage: attackers must avoid ALL decoys, but defenders only need one decoy touched to detect them. Zero false positive rate from decoys (no legitimate process ever touches them). Canary tokens in documents alert when opened โ€” detecting document exfiltration even after the file leaves your control.
Full Definition โ†’
Full Definition โ†’
What are common compliance frameworks? D8 ยท CySA+ โ–ธ
Key frameworks: GDPR (EU personal data), HIPAA (US healthcare PHI), PCI DSS (payment cards global), SOX (US public companies financial), FISMA (US federal systems), CMMC (US defense contractors).
Multiple frameworks may apply simultaneously. Map controls to all applicable frameworks once and demonstrate compliance for all. Common control framework approach: implement strong controls once, map to all requirements. CIS Controls โ†’ ISO 27001 โ†’ NIST CSF โ†’ PCI DSS โ†’ HIPAA: all map to similar underlying security practices.
Full Definition โ†’
Full Definition โ†’
What is cloud penetration testing? D9 ยท PenTest+ โ–ธ
Cloud pen testing focuses on cloud-specific misconfigurations: IAM privilege escalation, public S3 buckets, SSRF to metadata service, Lambda function exploitation, exposed APIs, storage misconfigurations.
AWS pen test rules: most testing permitted, some services require AWS approval (DDoS testing, Route53 infrastructure). ScoutSuite and Prowler assess cloud security posture. Pacu is the AWS exploitation framework. Cloud environments often have IAM misconfigurations that don't exist in traditional networks โ€” know cloud-specific attack paths.
Full Definition โ†’
Full Definition โ†’
What are common pen test tools? D7 ยท Tools โ–ธ
Essential pen test toolkit: Nmap (scanning), Metasploit (exploitation), Burp Suite (web app), Wireshark (traffic analysis), Hashcat (password cracking), Mimikatz (credential dumping), BloodHound (AD attack paths), Impacket (Windows protocols).
Kali Linux bundles most tools. All tools are legal to use on authorized targets โ€” illegal on unauthorized systems. PenTest+ tests knowledge of which tool to use for which task. Know tool categories: reconnaissance, scanning, exploitation, post-exploitation, cracking, web app, wireless.
Full Definition โ†’
Full Definition โ†’
What is credential spraying in pen testing? D9 ยท PenTest+ +
Credential spraying tests a few common passwords (Password1!, Summer2024!) against many accounts โ€” avoiding lockout by staying under the per-account threshold.
Tools: Spray (dedicated spray tool), MSOLSpray (O365), SprayingToolkit. Effective against: O365, Citrix, VPN portals. Defense bypass: spray at 1 attempt per account per hour. Detection: multiple accounts with failed logins from same source. Modern Entra ID (Azure AD) Smart Lockout detects and blocks spray attacks.
Full Definition โ†’
What is data at rest and how is it protected? D5 ยท Crypto โ–ธ
Data at rest is stored data โ€” on disk, in databases, backups, USB drives. Protected by: full disk encryption, file-level encryption, database encryption, encrypted backups.
The three data states: at rest, in transit, in use. FDE protects laptops. TDE (Transparent Data Encryption) protects databases. Don't forget backups โ€” useless if encrypted storage is bypassed via unencrypted backup.
Full Definition โ†’
Full Definition โ†’
What is data in transit and how is it protected? D5 ยท Crypto โ–ธ
Data in transit is data moving between systems โ€” over networks. Protected by: TLS/HTTPS, VPNs, IPSec, SSH, SFTP, S/MIME.
TLS is the primary protection for web traffic. VPNs encrypt all traffic at the network layer. Never send sensitive data via unencrypted email or HTTP. Even internal traffic should be encrypted (zero trust).
Full Definition โ†’
Full Definition โ†’
What is data masking? D1 ยท General โ–ธ
Data masking replaces sensitive data with realistic but fictitious values โ€” for testing, development, and analytics where real data isn't needed.
Static masking: permanently replaces data. Dynamic masking: masks data on the fly when accessed. Tokenization: replaces data with a token that maps back to the real value. Used heavily in PCI DSS for cardholder data.
Full Definition โ†’
Full Definition โ†’
What is data sovereignty? D1 ยท General โ–ธ
Data sovereignty is the principle that data is subject to the laws of the country where it is collected or stored. Critical for cloud deployments across borders.
GDPR restricts transferring EU data outside the EU. Data residency requirements may force cloud storage in specific regions. This affects cloud provider selection and architecture decisions.
Full Definition โ†’
Full Definition โ†’
What is defense in depth? D3 ยท Architecture โ–ธ
Defense in depth uses multiple independent layers of security โ€” if one fails, others remain. Physical โ†’ Perimeter โ†’ Network โ†’ Host โ†’ Application โ†’ Data.
No single control is sufficient. Layering means an attacker must defeat multiple controls to succeed. On exam questions, when asked about a comprehensive security approach โ€” defense in depth.
Full Definition โ†’
Full Definition โ†’
What is DHCP snooping? D6 ยท Network+ โ–ธ
DHCP snooping is a Layer 2 switch security feature that blocks rogue DHCP servers โ€” only allowing DHCP responses from trusted (uplink) ports.
Rogue DHCP server attack: attacker's DHCP server assigns their IP as the gateway โ€” MITM attack. DHCP snooping prevents this by filtering unauthorized DHCP responses.
Full Definition โ†’
Full Definition โ†’
What is directory traversal? D2 ยท Threats โ–ธ
Directory traversal uses ../ sequences to navigate outside intended directories and read unauthorized files โ€” potentially exposing /etc/passwd, config files, or source code.
Prevention: input validation, canonicalize paths before validation, chroot jails. A WAF can block ../ patterns. Affects any web app that constructs file paths from user input.
Full Definition โ†’
Full Definition โ†’
What is Discretionary Access Control (DAC)? D1 ยท General โ–ธ
DAC lets resource owners control who can access their resources. Users can grant others access to files they own. Most flexible but least secure model โ€” used in Windows/Linux filesystems.
DAC: owner decides. MAC: OS decides. RBAC: role decides. ABAC: attributes decide. DAC is vulnerable to Trojan horses โ€” malware running as you inherits all your permissions.
Full Definition โ†’
Full Definition โ†’
What is DNS over HTTPS (DoH)? D3 ยท Architecture โ–ธ
DoH encrypts DNS queries inside HTTPS on port 443 โ€” preventing ISP surveillance and DNS manipulation. Used by browsers (Firefox, Chrome) and OS-level resolvers.
DoH provides DNS query privacy. DoT (DNS over TLS, port 853) is an alternative. Both prevent ISP-level DNS snooping. Corporate environments may block DoH to maintain DNS visibility.
Full Definition โ†’
Full Definition โ†’
What is domain hijacking? D2 ยท Threats โ–ธ
Domain hijacking transfers domain registration to an attacker's control โ€” enabling them to redirect all traffic for that domain, including email and website.
Prevention: registrar lock, strong authentication on registrar accounts, MFA for domain registrar login, registry lock for critical domains. Domain hijacking is often via social engineering the registrar.
Full Definition โ†’
Full Definition โ†’
What is DNS sinkholing? D4 ยท Operations โ–ธ
DNS sinkholing redirects DNS queries for malicious domains to a controlled IP โ€” cutting off malware C2 communications and identifying infected hosts that query the sinkholed domain.
ISPs and security companies sinkhole known-bad domains. Infected hosts that query sinkholed domains are identified and can be remediated. Widely used to disrupt botnet C2 infrastructure.
Full Definition โ†’
Full Definition โ†’
What is detection engineering? D8 ยท CySA+ โ–ธ
Detection engineering creates and maintains detection rules and queries that identify attacker TTPs in SIEM, EDR, and NIDS systems โ€” translating threat intelligence into working detections.
Detection engineers write Sigma rules (generic), Suricata/Snort rules (network), YARA rules (malware signatures), and SIEM queries (Splunk SPL, EQL). MITRE ATT&CK maps techniques to detection opportunities.
Full Definition โ†’
Full Definition โ†’
What is DHCP starvation? D2 ยท Threats โ–ธ
DHCP starvation floods a DHCP server with fake MAC addresses to exhaust all available IP addresses โ€” legitimate clients get no IPs (DoS). Often precedes a rogue DHCP server attack.
DHCP snooping limits DHCP requests per port, preventing starvation. Port security (limiting MACs per port) also mitigates this. Often the first step in a rogue DHCP MITM attack sequence.
Full Definition โ†’
Full Definition โ†’
What is DPAPI in Windows security? D2 ยท Threats โ–ธ
DPAPI (Data Protection API) is a Windows cryptographic API that encrypts credentials and secrets tied to a user account. Browsers, Outlook, and Wi-Fi passwords use DPAPI.
Mimikatz can extract DPAPI-protected data from memory or disk when running as the user. DPAPI blobs are decryptable with domain controller backup keys. A key target in credential harvesting attacks.
Full Definition โ†’
Full Definition โ†’
What is dynamic DNS (DDNS) in security? D2 ยท Threats โ–ธ
Dynamic DNS (DDNS) is abused by malware for C2 โ€” using free DDNS services to host C2 infrastructure that changes IPs frequently, evading IP-based blocking.
Block known DDNS providers (no-ip.com, dyndns.org) at the firewall if not needed for business. Fast-flux DNS rapidly changes IPs to make takedowns hard. DGAs (Domain Generation Algorithms) generate random C2 domains algorithmically.
Full Definition โ†’
Full Definition โ†’
What are dormant accounts? D1 ยท General โ–ธ
Dormant accounts are active accounts no longer used โ€” former employees, old service accounts, test accounts. Prime targets for attackers since owners won't notice unusual activity.
Regular access reviews identify dormant accounts. Automated deprovisioning reduces risk. Policy: disable accounts inactive 90+ days. Service accounts with no recent logins may be orphaned. Disable before delete (confirm nothing breaks first).
Full Definition โ†’
Full Definition โ†’
What is DHCP? D6 ยท Network+ โ–ธ
DHCP automatically assigns IP configuration to clients. DORA process: Discover (broadcast) โ†’ Offer โ†’ Request โ†’ Acknowledge. Server: UDP 67. Client: UDP 68.
DHCP starvation floods the server with fake MAC addresses exhausting the IP pool. Rogue DHCP server attack assigns attacker's IP as the default gateway (MITM). DHCP snooping on switches prevents both attacks by only allowing DHCP from trusted ports.
Full Definition โ†’
Full Definition โ†’
What are DNS record types? D6 ยท Network+ โ–ธ
Key DNS records: A (IPv4), AAAA (IPv6), MX (mail server), TXT (SPF/DKIM/DMARC/verification), CNAME (alias), NS (nameserver), PTR (reverse lookup), SOA (zone authority).
TXT records are used for SPF/DKIM/DMARC email security. PTR records verify reverse DNS (email deliverability). CNAME chains should be minimal. dig [domain] [type] queries specific record types. Misconfigured MX records cause email delivery failures.
Full Definition โ†’
Full Definition โ†’
What is dynamic risk assessment? D8 ยท CySA+ โ–ธ
Dynamic risk assessment continuously evaluates risk in real time based on current context โ€” user location, device health, behavior patterns โ€” adjusting access decisions accordingly.
Zero trust implements dynamic risk assessment: initial login may be allowed, but unusual subsequent behavior triggers step-up authentication or session termination. Microsoft Continuous Access Evaluation (CAE) re-evaluates token validity in near real-time.
Full Definition โ†’
Full Definition โ†’
How do defenders use OSINT? D8 ยท CySA+ โ–ธ
Defenders use OSINT for: attack surface discovery (Shodan scans), exposed credential monitoring (HaveIBeenPwned), subdomain enumeration, GitHub secret scanning, dark web monitoring, brand impersonation detection.
Run Shodan searches on your own IP ranges regularly. Monitor for exposed credentials with HaveIBeenPwned Enterprise API. GitHub Dorks find accidentally committed secrets. See yourself as attackers see you โ€” external attack surface management (EASM).
Full Definition โ†’
Full Definition โ†’
What is data classification? D1 ยท General โ–ธ
Data classification assigns sensitivity levels to data based on impact if disclosed โ€” enabling appropriate protection proportionate to sensitivity.
Common levels: Public, Internal, Confidential, Restricted/Secret. Government: Unclassified, CUI, Confidential, Secret, Top Secret/SCI. Classification drives: encryption requirements, access controls, handling procedures, retention policies. Without classification, you treat all data the same (either over-protecting cheap data or under-protecting sensitive data).
Full Definition โ†’
Full Definition โ†’
What is deception technology? D4 ยท Operations โ–ธ
Deception technology deploys honeypots, honey tokens, and fake credentials throughout the network โ€” any interaction with decoys is immediately suspicious since no legitimate process uses them.
Deception has near-zero false positives โ€” only attackers (or very confused legitimate users) access decoys. Honeytokens: fake AWS keys in code repos, fake AD accounts, fake files in file shares. Detection is immediate upon first decoy access. Shifts attacker time wasted in decoy environment.
Full Definition โ†’
Full Definition โ†’
What is DES and why is it deprecated? D5 ยท Crypto โ–ธ
DES (Data Encryption Standard) uses a 56-bit key โ€” too short for modern security. Triple DES (3DES) applies DES three times (112-bit effective security) โ€” still deprecated (slow, vulnerable to Sweet32).
DES: cracked in 22 hours in 1999 (EFF DES Cracker). Modern GPUs crack it instantly. 3DES: still in some legacy systems but deprecated by NIST in 2017. Replace with AES-256 everywhere. Both are exam topics โ€” know why they're deprecated.
Full Definition โ†’
Full Definition โ†’
Detective vs preventive controls: which is better? D1 ยท General โ–ธ
Neither is universally better โ€” you need both. Preventive controls (firewalls, MFA) stop attacks. Detective controls (IDS, audit logs, SIEM) identify when prevention fails. No prevention is perfect.
Defense in depth requires all control types working together. Preventive controls that block all attacks are ideal but impossible. Detective controls that catch everything prevention misses are equally important. Plan for prevention to fail โ€” have detection and response ready.
Full Definition โ†’
Full Definition โ†’
What is DHCP snooping? D6 ยท Network+ โ–ธ
DHCP snooping allows DHCP responses only from trusted (uplink) ports โ€” blocking rogue DHCP servers on access ports. Creates a binding table (MAC+IP+port) used by Dynamic ARP Inspection.
Enable on all access switches. Trust only uplink ports connected to legitimate DHCP servers. Rate-limit DHCP requests per port to prevent DHCP starvation. The binding table created by DHCP snooping is used by DAI (Dynamic ARP Inspection) to validate ARP packets.
Full Definition โ†’
Full Definition โ†’
What is digital forensics? D4 ยท Operations โ–ธ
Digital forensics identifies, preserves, analyzes, and presents digital evidence โ€” for incident investigations, legal proceedings, or internal disciplinary matters.
Four phases: Collection (with write blockers, hashing), Examination (extract relevant data), Analysis (draw conclusions), Reporting (document findings). ACPO principles: don't modify original, document all actions, follow lawful process. Evidence must be legally obtained and properly handled.
Full Definition โ†’
Full Definition โ†’
What is DKIM? D3 ยท Architecture โ–ธ
DKIM adds a digital signature to outgoing emails using the domain's private key. Recipients verify using the public key in DNS TXT records โ€” proving the email wasn't modified in transit.
DKIM verifies the email wasn't modified. SPF verifies the sending server is authorized. DMARC uses both to enforce policy. Without DKIM, email bodies can be modified in transit without detection. Rotate DKIM keys annually or when compromised.
Full Definition โ†’
Full Definition โ†’
What is DMARC? D3 ยท Architecture โ–ธ
DMARC uses SPF and DKIM alignment to enforce email authentication policy โ€” p=none (monitor), p=quarantine (spam folder), p=reject (block). Sends aggregate and forensic reports.
Start with p=none to understand your email ecosystem before enforcing. Progress to p=quarantine โ†’ p=reject over weeks/months. DMARC p=reject is the only setting that actually prevents spoofing of your domain. Required by CISA, major email providers increasingly require it.
Full Definition โ†’
Full Definition โ†’
What is DNS security (DNSSEC)? D3 ยท Architecture โ–ธ
DNSSEC adds cryptographic signatures to DNS records โ€” allowing resolvers to verify records haven't been tampered with. Prevents DNS cache poisoning and MITM attacks on DNS.
DNSSEC provides integrity, not confidentiality (records are still visible). DNS over HTTPS/TLS provides privacy. Cache poisoning (Kaminsky attack) exploits unsigned DNS โ€” DNSSEC prevents this. Many high-value domains still haven't deployed DNSSEC โ€” significant security gap.
Full Definition โ†’
Full Definition โ†’
What is double extortion ransomware? D2 ยท Threats โ–ธ
Double extortion ransomware both encrypts files AND exfiltrates data โ€” threatening to publish stolen data if ransom isn't paid, making backups insufficient as the sole defense.
Backups alone don't address double extortion โ€” you can restore files but stolen data is still threatened for publication. DLP and egress monitoring detect the exfiltration phase. Incident response must address both the encryption and the exfiltration simultaneously.
Full Definition โ†’
Full Definition โ†’
What is dumpster diving? D2 ยท Threats โ–ธ
Dumpster diving retrieves sensitive information from discarded materials โ€” documents, hardware, printed credentials, network diagrams found in trash.
Defense: cross-cut shredder for all documents with sensitive information, secure document destruction services, physical security around dumpsters, electronic media destruction (not just deletion) before disposal. Many breaches start with information gathered from trash.
Full Definition โ†’
Full Definition โ†’
What is data exfiltration? D2 ยท Threats โ–ธ
Data exfiltration transfers stolen data from victim to attacker โ€” via web (HTTPS uploads), DNS tunneling, email, cloud storage, or physical media. The final stage of most attacks.
Exfiltration detection: DLP (pattern matching on sensitive data), egress monitoring (unusual outbound volumes), DNS monitoring (DNS tunneling), CASB (unauthorized cloud uploads), UEBA (unusual data access patterns). Preventing initial access is better than detecting exfiltration.
Full Definition โ†’
Full Definition โ†’
What is Dynamic ARP Inspection (DAI)? D6 ยท Network+ โ–ธ
DAI validates ARP packets against the DHCP snooping binding table โ€” blocking ARP replies that don't match known IP-MAC-port bindings, preventing ARP poisoning attacks.
DAI requires DHCP snooping to be configured first (creates the binding table DAI validates against). Trust uplink ports (same as DHCP snooping). DAI + DHCP snooping + port security = comprehensive Layer 2 security. Must be explicitly configured โ€” not enabled by default.
Full Definition โ†’
Full Definition โ†’
What is DNS enumeration? D9 ยท PenTest+ โ–ธ
DNS enumeration extracts DNS information โ€” querying all record types, attempting zone transfers (AXFR), brute-forcing subdomains, analyzing certificate transparency logs.
Zone transfer: 'dig axfr @[nameserver] [domain]' โ€” reveals ALL DNS records if misconfigured. Should be restricted to authorized secondary nameservers. Tools: dnsenum, dnsrecon, amass. Certificate transparency (crt.sh) reveals subdomains without any DNS queries.
Full Definition โ†’
Full Definition โ†’
What is DLP? D8 ยท CySA+ โ–ธ
DLP detects and prevents unauthorized transmission of sensitive data โ€” classifying data, monitoring channels (email, web, USB, cloud), and blocking policy violations.
DLP placement: endpoint (monitor file operations, USB), network (inspect outbound traffic), cloud (CASB monitors SaaS apps). False positive challenge: legitimate sensitive data sharing must work. Start in monitor mode before enforcing. DLP is not a substitute for access control โ€” it's a last line of defense.
Full Definition โ†’
Full Definition โ†’
What is detection coverage? D8 ยท CySA+ โ–ธ
Detection coverage maps your existing detections against ATT&CK techniques โ€” identifying which techniques you can detect (green), which are gaps (red), and prioritizing new detection development.
ATT&CK Navigator (free MITRE tool) visualizes coverage. Start by mapping existing SIEM rules and EDR detections. Prioritize coverage based on your threat intelligence โ€” focus on techniques used by groups targeting your industry. Use purple team exercises to validate coverage is actually working.
Full Definition โ†’
Full Definition โ†’
What is digital evidence? D8 ยท CySA+ โ–ธ
Evidence types: Volatile (RAM, running processes, network connections โ€” lost on power off), Non-volatile (disk, logs, artifacts). Collect in volatility order: RAM first, then disk.
Order of volatility (most to least volatile): CPU registers/cache โ†’ RAM โ†’ swap/page file โ†’ disk โ†’ remote logging โ†’ backup media. Courts require proper chain of custody for admissibility. Hash evidence immediately. Document every action. Legal hold: don't delete evidence relevant to ongoing investigation.
Full Definition โ†’
Full Definition โ†’
What is defense evasion? D9 ยท PenTest+ โ–ธ
Defense evasion techniques: disabling security tools, clearing event logs, modifying timestamps (timestomping), using signed binaries (LOLBAS), API unhooking (bypass EDR), code obfuscation, process injection (hide in trusted process).
MITRE ATT&CK TA0005 โ€” Defense Evasion is the largest tactic category (50+ techniques). Blue team: monitor for these evasion behaviors themselves (process tampering, log clearing, security tool termination). Detection of evasion attempts is a high-confidence indicator of active attack.
Full Definition โ†’
Full Definition โ†’
What is DoS testing in pen testing? D9 ยท PenTest+ +
DoS testing verifies application availability under attack conditions โ€” testing rate limiting effectiveness, service degradation, and recovery. Requires explicit, specific authorization.
DoS testing authorization must be very specific: exact systems, attack types, timing, impact acceptance. Never DoS test without written approval including acceptable impact thresholds. Application-layer DoS (slowloris, HTTP flood) is often more revealing than volumetric โ€” tests application resilience specifically.
Full Definition โ†’
How does asymmetric key exchange work in TLS? D5 ยท Crypto โ–ธ
In TLS, asymmetric cryptography (RSA or ECDH) establishes a shared symmetric key during the handshake, then that symmetric key encrypts the actual session data โ€” combining security with speed.
Pure asymmetric encryption is too slow for bulk data. Hybrid encryption solves this: asymmetric for key exchange, symmetric for data. TLS 1.3 only supports ECDHE for key exchange.
Full Definition โ†’
Full Definition โ†’
What is encryption in the cloud? D5 ยท Crypto โ–ธ
Cloud encryption types: at rest (data stored on disk), in transit (data moving between services), in use (confidential computing). Key management: CSP-managed or Customer-Managed Keys (CMK).
CMKs give you control โ€” if you delete the CMK, data becomes unreadable. KMS (Key Management Service) handles key storage. Envelope encryption: data key encrypts data, master key encrypts data key.
Full Definition โ†’
Full Definition โ†’
What is egress filtering? D3 ยท Architecture โ–ธ
Egress filtering monitors and restricts outbound network traffic โ€” blocking data exfiltration, C2 communications, and unauthorized external connections from internal systems.
Most organizations focus on ingress (inbound). Egress filtering catches compromised internal systems calling home. Block unnecessary outbound ports; DNS and HTTPS egress filtering detect C2 tunneling.
Full Definition โ†’
Full Definition โ†’
What is ECDH and ECDHE key exchange? D5 ยท Crypto โ–ธ
ECDH uses elliptic curve math for key exchange. ECDHE is the ephemeral version โ€” generates new keys per session for Perfect Forward Secrecy.
TLS 1.3 exclusively uses ECDHE for key exchange. "E" in ECDHE = ephemeral = new key each session = forward secrecy. If you see "ephemeral" in a cipher suite, forward secrecy is provided.
Full Definition โ†’
Full Definition โ†’
What is email spoofing? D2 ยท Threats โ–ธ
Email spoofing forges the From: header to make email appear from a trusted sender. Used in BEC, phishing, and malware distribution.
DMARC/SPF/DKIM together prevent spoofing of your own domain. But they don't prevent spoofing of domains you don't control. User education: verify unexpected requests out-of-band, especially financial.
Full Definition โ†’
Full Definition โ†’
What is embedded systems security? D3 ยท Architecture โ–ธ
Embedded systems run firmware on limited-resource devices (medical devices, industrial equipment, vehicles). Security challenges: no user interface, hard to patch, long lifecycles.
Medical devices and industrial controllers often can't be patched โ€” compensating controls (network segmentation, monitoring) are essential. Firmware analysis can reveal hard-coded credentials and vulnerabilities.
Full Definition โ†’
Full Definition โ†’
What is encryption key management? D5 ยท Crypto โ–ธ
Key management covers the entire lifecycle: generation โ†’ distribution โ†’ storage โ†’ rotation โ†’ revocation โ†’ destruction. Weakest link in encryption implementations.
Encrypting data is useless if keys are stored next to the data. Key rotation limits damage from key compromise. Key escrow allows recovery. Hardware (HSM/TPM) provides secure key storage.
Full Definition โ†’
Full Definition โ†’
What is endpoint protection? D4 ยท Operations โ–ธ
Endpoint protection secures end-user devices through multiple layers: AV/NGAV (malware detection), EDR (behavioral detection), host firewall, DLP, patch management, application control.
EPP (Endpoint Protection Platform) = prevention-focused. EDR = detection and response focused. XDR extends visibility beyond endpoints. Modern solutions combine all capabilities in one agent.
Full Definition โ†’
Full Definition โ†’
What is Enterprise Mobility Management (EMM)? D3 ยท Architecture โ–ธ
EMM encompasses MDM (device management), MAM (app management), and MCM (content management) for mobile devices โ€” enabling secure corporate mobile access.
MDM = most control (can wipe entire device). MAM = corporate apps only (respects personal data). MCM = controls corporate content/documents. Choose based on BYOD vs. corporate-owned devices.
Full Definition โ†’
Full Definition โ†’
What is enumeration in cybersecurity? D9 ยท PenTest+ โ–ธ
Enumeration actively queries systems to gather detailed information โ€” usernames, shares, services, open ports, OS versions โ€” going beyond simple port scanning.
Enumeration follows scanning in the pen test methodology. Tools: Enum4linux (Samba), NBTScan (NetBIOS), SNMPwalk (SNMP), Ldapdomaindump (AD). Each service type has specific enumeration techniques.
Full Definition โ†’
Full Definition โ†’
How does TLS work in detail? D5 ยท Crypto โ–ธ
TLS handshake: Client Hello โ†’ Server Hello + Certificate โ†’ Key Exchange (ECDHE) โ†’ Server Finished โ†’ Client Finished โ†’ Encrypted Application Data. TLS 1.3 requires fewer round trips than TLS 1.2.
TLS 1.3 is faster (0-RTT for resumed sessions) and more secure (no weak cipher suites, mandatory forward secrecy). TLS 1.0/1.1 are deprecated. Disable them on all servers. TLS 1.2 is still widely used; TLS 1.3 is preferred.
Full Definition โ†’
Full Definition โ†’
How does DKIM work in detail? D3 ยท Architecture โ–ธ
DKIM signing: Mail server hashes specific headers + body โ†’ encrypts hash with domain's private key โ†’ adds signature to email header. Receiver verifies using public key from DNS TXT record.
DKIM's private key must be protected โ€” compromise = spoof all email from that domain. Rotate DKIM keys regularly. DKIM survives email forwarding better than SPF (SPF fails when a forwarder changes the sending IP).
Full Definition โ†’
Full Definition โ†’
What is endpoint isolation in incident response? D4 ยท Operations โ–ธ
Endpoint isolation cuts a compromised endpoint's network connections while maintaining management plane access โ€” stopping lateral movement and C2 while preserving the ability to investigate and remediate.
Modern EDR solutions (CrowdStrike, Defender for Endpoint) support one-click network isolation. Maintain management access while blocking all other traffic. Isolate as soon as ransomware or active attack is confirmed.
Full Definition โ†’
Full Definition โ†’
What is event correlation in SIEM? D4 ยท Operations โ–ธ
Event correlation aggregates and links related events from multiple sources โ€” a failed login (AD log) + successful login from new IP (VPN log) + file download (DLP log) = likely compromised account.
Single events are often ambiguous. Correlation across sources provides context. Example: 3 failed logins + 1 success + geographically impossible source = brute force attack with credential use. Correlation rules drive SIEM alert quality.
Full Definition โ†’
Full Definition โ†’
What is exception handling security? D2 ยท Threats โ–ธ
Secure exception handling catches errors gracefully, logs details internally, and presents generic messages to users โ€” preventing information disclosure through verbose error messages.
Never expose stack traces, SQL errors, or internal paths to users. These give attackers roadmaps. Log all exceptions with context (server-side). Return HTTP 500 to users with a reference ID so admins can look up details.
Full Definition โ†’
Full Definition โ†’
What is exploit development? D9 ยท PenTest+ โ–ธ
Exploit development creates working code to exploit vulnerabilities โ€” analyzing crashes, controlling execution flow, writing shellcode, and bypassing mitigations (ASLR, DEP).
PenTest+ knowledge level: understand concepts and use existing frameworks (Metasploit). CySA+ level: recognize exploitation attempts. Deep exploit development = specialized offensive security skill beyond most certifications.
Full Definition โ†’
Full Definition โ†’
What is Ethernet? D6 ยท Network+ โ–ธ
Ethernet (IEEE 802.3) is the dominant wired LAN technology. Uses MAC addresses for addressing, CSMA/CD for collision management (legacy half-duplex). Modern = full-duplex, no collisions.
Modern switched Ethernet is full-duplex โ€” each port is its own collision domain. CSMA/CD is irrelevant in full-duplex. Ethernet frame: Preamble + Destination MAC + Source MAC + EtherType + Data + FCS. Maximum frame size: 1518 bytes (standard), 9000 bytes (jumbo frames).
Full Definition โ†’
Full Definition โ†’
What is eradication in incident response? D8 ยท CySA+ โ–ธ
Eradication removes all traces of the threat โ€” malware, backdoors, unauthorized accounts, persistence mechanisms, and the root cause vulnerability that enabled initial access.
Eradication must be thorough โ€” missed persistence = reinfection. Check all known persistence points. Patch the root cause vulnerability. NIST phase 3: Containment + Eradication + Recovery are combined. Document all removed artifacts for lessons learned.
Full Definition โ†’
Full Definition โ†’
What are exploit frameworks? D9 ยท PenTest+ โ–ธ
Exploit frameworks provide structured platforms for exploitation: Metasploit (most widely used, open source, 2000+ modules), Core Impact (commercial), Canvas (commercial).
Metasploit workflow: search (find exploit) โ†’ use (select module) โ†’ show options โ†’ set RHOSTS/LHOST/LPORT โ†’ run. Meterpreter = feature-rich in-memory payload. Always verify scope before running exploits โ€” mistakes can crash production systems.
Full Definition โ†’
Full Definition โ†’
How do encryption algorithms compare? D5 ยท Crypto โ–ธ
TypeAlgorithmKey SizeUse For
SymmetricAES-256256-bitBulk data
AsymmetricRSA2048+ bitKey exchange
AsymmetricECC256-bit โ‰ˆ RSA-3072Key exchange (efficient)
HashSHA-256256-bit outputIntegrity
ECC provides equivalent security to RSA with much smaller keys โ€” important for IoT and mobile. AES-256 is unbreakable by brute force. RSA 2048 is current minimum; 4096 for long-term sensitive keys.
Full Definition โ†’
Full Definition โ†’
What is EDR? D4 ยท Operations โ–ธ
EDR (Endpoint Detection and Response) provides behavioral monitoring, threat detection, forensic investigation, and response capabilities on endpoints โ€” far beyond traditional AV.
EDR records all endpoint activity (process creation, network connections, file changes, registry modifications) for investigation. Behavioral analysis detects unknown threats. Remote isolation capability for IR. Leading EDR: CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne. Essential for modern enterprise.
Full Definition โ†’
Full Definition โ†’
What is endpoint hardening? D8 ยท CySA+ โ–ธ
Endpoint hardening: CIS Benchmark compliance, disable unnecessary services/accounts, enable FDE, host firewall rules, EDR deployment, application control, automatic updates, UAC, Credential Guard.
CIS Benchmark Level 1 = practical security baseline. Level 2 = higher security, more impact on usability. DISA STIGs are government requirements. Automated compliance checking (SCAP) validates hardening. Hardening reduces attack surface before attackers arrive โ€” proactive defense.
Full Definition โ†’
Full Definition โ†’
What is Exploit-DB? D7 ยท Tools +
Exploit-DB (exploit-db.com) is a public archive of exploits and vulnerable software โ€” searchable by CVE, software, type. searchsploit is the command-line interface.
searchsploit [software name] searches the offline exploit database. Common workflow: Nmap version scan โ†’ searchsploit [identified service version] โ†’ find matching exploits. Always verify exploits match exact version โ€” wrong version = service crash risk. Verify PoC code before executing (may contain malicious code itself).
Full Definition โ†’
What is fail-open vs fail-closed in security? D3 ยท Architecture โ–ธ
Fail-closed: device blocks all traffic if it fails โ€” maximizes security, risks availability. Fail-open: device passes all traffic if it fails โ€” maintains availability, risks security.
Security-critical devices (IPS, firewalls) should fail-closed. Availability-critical devices may need to fail-open. IDS should fail-open (it's passive). IPS decision depends on environment risk tolerance.
Full Definition โ†’
Full Definition โ†’
What is Federated Identity Management (FIM)? D1 ยท General โ–ธ
FIM extends identity across organizational boundaries using trust relationships โ€” a user's identity at Company A is trusted by Company B without separate credentials.
FIM enables cloud SSO across enterprises. Trust is established via metadata exchange and certificate sharing. SAML 2.0 is the dominant FIM protocol. Key use case: M&A integration โ€” two companies can share identity before full IT integration.
Full Definition โ†’
Full Definition โ†’
What is File Integrity Monitoring (FIM)? D4 ยท Operations โ–ธ
FIM uses cryptographic hashes to detect unauthorized changes to critical files โ€” OS binaries, config files, web pages. Alerts when hashes don't match baseline.
FIM detects rootkits, webshells, and configuration tampering. Tools: Tripwire, OSSEC, Windows File Resource Manager. PCI DSS requires FIM on cardholder data environment systems.
Full Definition โ†’
Full Definition โ†’
What is firmware security? D3 ยท Architecture โ–ธ
Firmware security protects low-level software in hardware components. Attacks: supply chain compromise, malicious updates, direct access via JTAG.
Firmware attacks persist through OS reinstalls. Secure Boot verifies firmware signatures. UEFI Secure Boot > legacy BIOS. Firmware updates should be digitally signed and verified before applying.
Full Definition โ†’
Full Definition โ†’
What is FPGA security? D3 ยท Architecture โ–ธ
FPGAs (Field-Programmable Gate Arrays) are reprogrammable chips used for custom hardware acceleration. Security risks: bitstream attacks (malicious logic injection), side-channel attacks.
FPGAs appear in network accelerators, cryptographic hardware, and data centers. Bitstream encryption protects against reverse engineering and tampering. Relevant for hardware security and supply chain questions.
Full Definition โ†’
Full Definition โ†’
What is full tunnel vs split tunnel VPN? D3 ยท Architecture โ–ธ
๐Ÿ”ต Full tunnel: all traffic routed through VPN โ€” corporate can inspect everything, slow, secure.
โšช Split tunnel: only corporate traffic goes through VPN โ€” faster, direct internet access.
Full tunnel = better security visibility. Split tunnel = better performance. Security concern with split tunnel: user can be on VPN and simultaneously on an infected home network. Corporate policy dictates which to use.
Full Definition โ†’
Full Definition โ†’
What is fingerprinting in reconnaissance? D9 ยท PenTest+ โ–ธ
Fingerprinting identifies OS types, service versions, and application software โ€” active (probing responses) or passive (analyzing traffic patterns). Enables targeted exploits.
OS fingerprinting (Nmap -O) uses TCP/IP stack behavior differences. Service version fingerprinting (Nmap -sV) reads banners. Passive fingerprinting (p0f) analyzes existing traffic. Defense: suppress banners, customize TCP/IP stack behavior.
Full Definition โ†’
Full Definition โ†’
What is forensic imaging? D4 ยท Operations โ–ธ
Forensic imaging creates a verified bit-for-bit copy of storage media. Process: write-block original โ†’ image to new media โ†’ hash original โ†’ hash copy โ†’ verify hashes match.
FTK Imager, dd, dcfldd (dd with built-in hashing) are common tools. Always verify with MD5 and SHA-256. Write blockers prevent accidental modification of originals. Working on forensic copies protects evidence integrity.
Full Definition โ†’
Full Definition โ†’
What is fail-open vs fail-closed? D3 ยท Architecture โ–ธ
Fail-closed: blocks all traffic on failure โ€” maximizes security, risks availability. Fail-open: passes all traffic on failure โ€” maintains availability, risks security.
Security-critical inline devices (IPS, firewalls) should fail-closed. Passive monitoring devices (IDS, network TAP) should fail-open. Choose based on environment: data center IPS fail-closed; hospital patient monitoring fail-open (availability critical).
Full Definition โ†’
Full Definition โ†’
What are flood attacks? D2 ยท Threats โ–ธ
Flood attacks: SYN flood (TCP state exhaustion), ICMP flood (ping flood, bandwidth), UDP flood (stateless bandwidth), HTTP flood (Layer 7, hardest to mitigate).
SYN cookies prevent SYN floods without state. HTTP floods require Layer 7 analysis โ€” behavioral patterns, rate limiting, CAPTCHA. CDN/scrubbing centers absorb volumetric floods. Layer 7 attacks need fewer packets but are harder to distinguish from legitimate traffic.
Full Definition โ†’
Full Definition โ†’
What is forensic analysis? D8 ยท CySA+ โ–ธ
Forensic analysis reconstructs events from evidence โ€” building a timeline, identifying attacker actions, determining scope of compromise, and attributing activity.
Tools: Autopsy (disk forensics), Volatility (memory), Wireshark/Zeek (network), SIEM (log correlation). Artifact types: prefetch files (Windows execution evidence), browser history, registry (persistence), event logs. Timeline analysis is the core forensic methodology.
Full Definition โ†’
Full Definition โ†’
What is fuzzing in pen testing? D9 ยท PenTest+ โ–ธ
Fuzzing sends unexpected/random inputs to find crashes and vulnerabilities โ€” discovering buffer overflows, format string bugs, and input validation failures.
Coverage-guided fuzzing (AFL, libFuzzer) maximizes code path exploration. API fuzzing (Burp Intruder, ffuf) finds parameter handling flaws. Fuzzing finds vulnerabilities that manual review misses โ€” especially memory corruption bugs. Combine with SAST for comprehensive vulnerability discovery.
Full Definition โ†’
Full Definition โ†’
How do firewall rules work? D3 ยท Architecture โ–ธ
Firewall rules are processed in order โ€” first matching rule wins. Structure: (direction) (protocol) (source) โ†’ (destination) : (port) = (action). Last rule: implicit deny-all.
Order matters critically โ€” more specific rules must come before general ones. Rule placement errors can accidentally permit or deny unintended traffic. Document the purpose of every rule. Annually review and remove unused rules (firewall rule bloat increases attack surface).
Full Definition โ†’
Full Definition โ†’
What is fiber optic security? D3 ยท Architecture โ–ธ
Fiber optic security advantages: harder to tap without physical disruption, no electromagnetic emissions (can't be inductively sniffed like copper), supports longer distances and higher speeds.
Fiber is not impossible to tap โ€” fiber optic taps exist (bend the fiber slightly to detect leaked light). Fiber tap attempts typically cause detectable optical signal loss. For highest-security communications, fiber is preferred over copper for physical security. Not immune but significantly harder to compromise.
Full Definition โ†’
Full Definition โ†’
What is forensic timeline analysis? D8 ยท CySA+ +
Forensic timeline analysis creates a chronological sequence of events across multiple sources โ€” correlating file timestamps, log entries, registry modifications, and network captures to reconstruct the attack.
Timelines reveal: initial access time, dwell time, when persistence was established, when lateral movement occurred, when exfiltration happened. Tools: Plaso (log2timeline) automates timeline creation from multiple sources. Critical: all timestamps must be in UTC for correlation. Attackers use timestomping to manipulate file timestamps โ€” cross-verify with other log sources.
Full Definition โ†’
What is geofencing in security? D1 ยท General โ–ธ
Geofencing uses geographic location to enforce access policies โ€” blocking logins from unexpected countries, restricting app functionality by location, triggering alerts on travel patterns.
Impossible travel detection: user logs in from New York, then 30 minutes later from London โ€” impossible. UEBA and CASB solutions implement this. MDM can use geofencing to enforce policies on mobile devices.
Full Definition โ†’
Full Definition โ†’
What is GRC (Governance, Risk, and Compliance)? D1 ยท General โ–ธ
GRC integrates organizational governance (policies/procedures), risk management (identifying and managing risks), and compliance (meeting legal/regulatory requirements).
GRC programs align security with business objectives. Tools: Archer, ServiceNow GRC. Security governance = leadership direction. Risk management = systematic risk treatment. Compliance = meeting external requirements (GDPR, HIPAA, PCI DSS).
Full Definition โ†’
Full Definition โ†’
What is geolocation in security controls? D1 ยท General โ–ธ
Geolocation maps IP addresses to geographic locations for access policies โ€” blocking logins from sanctioned countries, detecting impossible travel, restricting content by region.
IP geolocation is imprecise and easily bypassed with VPNs. Use as one signal among many โ€” not the sole control. Impossible travel detection (login from US then UK 30 min later) is more reliable than simple country blocking.
Full Definition โ†’
Full Definition โ†’
What is GPG (GNU Privacy Guard)? D5 ยท Crypto โ–ธ
GPG is the open-source implementation of PGP โ€” providing email encryption, file encryption, and digital signatures using a web-of-trust model instead of PKI CAs.
GPG uses web-of-trust: users vouch for each other's keys. PGP and GPG are interoperable. Used for secure email, signing Git commits, and verifying software downloads. Less common in enterprise (SMIME preferred) but standard in open source communities.
Full Definition โ†’
Full Definition โ†’
What is Group Policy in Windows? D1 ยท General +
Group Policy Objects (GPOs) enforce configuration settings on AD-joined Windows systems โ€” password policies, screen lock, USB restrictions, firewall rules, software deployment.
GPO processing order: Local โ†’ Site โ†’ Domain โ†’ OU (LSDOU). Last applied wins. Essential enterprise hardening tool. Auditing GPO changes is critical โ€” a malicious GPO can deploy malware to all domain computers.
Full Definition โ†’
What is HIDS and HIPS? D4 ยท Operations โ–ธ
HIDS (Host-based IDS) monitors a single host for suspicious activity โ€” log analysis, file integrity, system call monitoring. HIPS actively blocks detected threats.
HIDS/HIPS complement NIDS/NIPS. HIDS sees encrypted traffic (because it's on the endpoint). NIDS sees network patterns. Modern EDR solutions incorporate HIDS/HIPS functionality with much richer detection.
Full Definition โ†’
Full Definition โ†’
What are HTTP security headers? D3 ยท Architecture โ–ธ
Key security headers: HSTS (force HTTPS), CSP (prevent XSS), X-Frame-Options (prevent clickjacking), X-Content-Type-Options (prevent MIME sniffing), Referrer-Policy, Permissions-Policy.
Security headers are free and easy to implement โ€” no excuses for not having them. HSTS with preloading is the strongest HTTPS enforcement. CSP is the most powerful XSS mitigation control.
Full Definition โ†’
Full Definition โ†’
What is hypervisor security? D3 ยท Architecture โ–ธ
Hypervisor security protects the virtualization layer. VM escape = attacking hypervisor from a guest VM to access the host or other VMs. Type 1 (bare-metal) is more secure than Type 2 (hosted).
Type 1 hypervisors (VMware ESXi, Hyper-V, Xen) run directly on hardware. Type 2 (VirtualBox, VMware Workstation) run on an OS. VM escape is rare but catastrophic โ€” patch hypervisors quickly.
Full Definition โ†’
Full Definition โ†’
What is HMAC? D5 ยท Crypto โ–ธ
HMAC (Hash-based Message Authentication Code) uses a shared secret key combined with a hash function to provide both message integrity AND authentication. If the key is known only to sender and receiver, it proves authenticity.
HMAC = integrity + authentication. Hash alone = integrity only. Digital signature = integrity + authentication + non-repudiation. TLS uses HMAC for record integrity. JWT uses HMAC (HS256) or RSA (RS256) for signature.
Full Definition โ†’
Full Definition โ†’
What are HTTP security headers? D3 ยท Architecture โ–ธ
Key security headers: HSTS (force HTTPS), CSP (prevent XSS), X-Frame-Options (prevent clickjacking), X-Content-Type-Options (prevent MIME sniffing).
Security headers are free and easy to implement. HSTS with preloading is strongest HTTPS enforcement. CSP is the most powerful XSS mitigation โ€” define exactly which sources scripts can load from. Check with securityheaders.com.
Full Definition โ†’
Full Definition โ†’
What is hypervisor security? D3 ยท Architecture โ–ธ
Type 1 (bare-metal, more secure): VMware ESXi, Hyper-V, Xen. Type 2 (hosted, less secure): VirtualBox, VMware Workstation. VM escape = guest breaks out to host.
Type 1 hypervisors run directly on hardware โ€” smaller attack surface. VM escape exploits are rare but catastrophic. Patch hypervisors immediately when vulnerabilities are published. Multi-tenant cloud relies on hypervisor isolation between customers.
Full Definition โ†’
Full Definition โ†’
What is hybrid encryption? D5 ยท Crypto +
Hybrid encryption combines both: asymmetric (RSA/ECDH) for key exchange, symmetric (AES) for bulk data โ€” getting the security of asymmetric with the speed of symmetric.
TLS uses hybrid: ECDHE establishes a shared symmetric key, then AES-GCM encrypts the session data. Pure asymmetric is too slow for bulk data. Symmetric alone has the key distribution problem. Hybrid solves both.
Full Definition โ†’
What is ICMP and its security implications? D6 ยท Network+ โ–ธ
ICMP is used for network diagnostics (ping, traceroute) and error reporting. Security risks: ICMP flood (DDoS), ICMP tunneling (covert data channel), ping sweep (reconnaissance).
Many organizations block outbound ICMP. ICMP tunneling encodes data in ping packets for C2 โ€” IDS can detect by inspecting payload. Disable ICMP redirect messages on routers (allows MITM routing).
Full Definition โ†’
Full Definition โ†’
What is identity proofing? D1 ยท General โ–ธ
Identity proofing verifies a person's real-world identity during account enrollment โ€” validating government ID, biometrics, or knowledge-based authentication (KBA) before issuing credentials.
Strong identity proofing prevents fraudulent account creation. NIST SP 800-63A defines three Identity Assurance Levels (IAL1-3). IAL3 requires in-person or supervised remote proofing.
Full Definition โ†’
Full Definition โ†’
What is immutable infrastructure? D3 ยท Architecture โ–ธ
Immutable infrastructure means systems are never modified after deployment โ€” instead, they're rebuilt from scratch for updates. Eliminates configuration drift and reduces attack surface.
"Cattle, not pets" philosophy. Containers and Kubernetes excel at immutable infrastructure. No SSH access to production. Any change triggers a new image build and deployment. Reduces patch debt.
Full Definition โ†’
Full Definition โ†’
What are Indicators of Attack (IoA)? D8 ยท CySA+ โ–ธ
IoAs are behavioral patterns indicating an attack in progress โ€” unusual admin tool usage, new scheduled tasks, lateral movement patterns. More proactive than IoCs (IoCs are post-compromise).
IoC (Indicator of Compromise) = evidence something happened (malware hash, C2 IP). IoA = evidence something is happening (attacker behavior pattern). IoAs enable detection during the attack, not after.
Full Definition โ†’
Full Definition โ†’
What are Indicators of Compromise (IoC)? D4 ยท Operations โ–ธ
IoCs are forensic artifacts indicating a system has been compromised โ€” file hashes, IP addresses, domain names, registry keys, user agents, malware signatures.
IoCs are reactive (discovered after compromise). Shared via STIX/TAXII, threat intel feeds, ISACs. TTPs are more durable than IoCs โ€” attackers can easily change IPs/hashes but not their fundamental techniques.
Full Definition โ†’
Full Definition โ†’
What is ingress filtering? D3 ยท Architecture โ–ธ
Ingress filtering blocks inbound traffic with spoofed source IP addresses โ€” preventing IP spoofing attacks. BCP38 is the best practice for ISPs to implement it.
Ingress filtering + uRPF (Unicast Reverse Path Forwarding) at ISP level would eliminate most DDoS amplification attacks. Most organizations also need egress filtering to detect compromised internal hosts.
Full Definition โ†’
Full Definition โ†’
What is integrity checking in security? D5 ยท Crypto โ–ธ
Integrity checking verifies data hasn't been modified โ€” using hashes, HMACs, or digital signatures. Ensures information accuracy and detects tampering.
Hash (SHA-256) = integrity only. HMAC = integrity + authentication. Digital signature = integrity + authentication + non-repudiation. Use the right tool: public file verification = hash; secure messages = digital signature.
Full Definition โ†’
Full Definition โ†’
What is IP spoofing? D2 ยท Threats โ–ธ
IP spoofing forges the source IP address โ€” used in DDoS amplification attacks, bypassing IP-based access controls, or hiding the attacker's true origin.
TCP connections can't use spoofed IPs (handshake proves real IP). UDP attacks (DNS amplification, NTP amplification) use spoofing extensively. ingress filtering/BCP38 prevents spoofed traffic from entering the internet.
Full Definition โ†’
Full Definition โ†’
What is IPSec? D3 ยท Architecture โ–ธ
IPSec is a suite of protocols securing IP communications. Modes: Transport (encrypts payload only) and Tunnel (encrypts entire packet โ€” VPN). Protocols: AH (integrity only), ESP (encryption + integrity).
IPSec provides network-layer encryption. IKE/IKEv2 negotiates security associations. AH provides integrity but no encryption. ESP provides both โ€” always prefer ESP. Site-to-site VPNs commonly use IPSec in tunnel mode.
Full Definition โ†’
Full Definition โ†’
What is ISO 27001? D1 ยท General โ–ธ
ISO 27001 is the international standard for Information Security Management Systems (ISMS). Organizations can certify compliance via third-party audit. Annex A contains 93 security controls.
ISO 27001 = process-oriented (management system). ISO 27002 = controls guidance. Certification demonstrates security commitment to customers and partners. PDCA (Plan-Do-Check-Act) model drives continuous improvement.
Full Definition โ†’
Full Definition โ†’
What is Infrastructure as Code (IaC) security? D3 ยท Architecture โ–ธ
IaC security scans infrastructure code (Terraform, CloudFormation, Ansible) for misconfigurations before deployment โ€” finding open S3 buckets, overly permissive security groups, and disabled encryption in code.
Shift security left to the IaC stage. Tools: Checkov, tfsec, KICS. Git pre-commit hooks can block misconfigured IaC. Immutable infrastructure means IaC IS your infrastructure โ€” secure the code, secure the deployment.
Full Definition โ†’
Full Definition โ†’
What is implicit deny in access control? D3 ยท Architecture โ–ธ
Implicit deny means any traffic/access not explicitly permitted is automatically denied โ€” the safest firewall default rule: "deny all" at the end of every ACL.
Implicit deny is fundamental to security design. Firewalls, ACLs, and access control systems should all deny by default. Adding explicit permits is then a conscious decision. Prevents access to services that weren't explicitly considered.
Full Definition โ†’
Full Definition โ†’
What is IPv6 security? D6 ยท Network+ โ–ธ
IPv6 security introduces new attack vectors: neighbor discovery spoofing (like ARP poisoning), rogue router advertisements, IPv6 tunneling bypassing IPv4 controls, and SLAAC abuse.
Many organizations have IPv6 enabled but unmonitored โ€” attackers exploit this blind spot. RA Guard prevents rogue router advertisements. Disable IPv6 if not needed, or properly secure and monitor it. Dual-stack networks need dual security.
Full Definition โ†’
Full Definition โ†’
What is ICMP and its security risks? D6 ยท Network+ โ–ธ
ICMP provides network diagnostics (ping, traceroute). Security risks: ICMP flood (DDoS), ICMP tunneling (covert C2 channel), ping sweep (reconnaissance), ICMP redirect (routing manipulation).
Many orgs block outbound ICMP. ICMP tunneling is detectable by inspecting payload โ€” non-empty ICMP replies are suspicious. Disable ICMP redirects on routers. Ping sweep (-sn in Nmap) maps live hosts without port scanning.
Full Definition โ†’
Full Definition โ†’
What are injection attacks? D2 ยท Threats โ–ธ
Injection attacks insert malicious code into interpreters โ€” SQL (database), LDAP (directory), OS command (shell), XML/XPath (XML parsers), NoSQL.
Injection = consistently top 1-3 in OWASP Top 10. Root cause: user input concatenated directly into commands/queries. Universal fix: parameterized queries/prepared statements for SQL; input validation + escaping for others.
Full Definition โ†’
Full Definition โ†’
What is IPSec? D3 ยท Architecture โ–ธ
IPSec secures IP communications. Modes: Transport (encrypts payload only) and Tunnel (encrypts entire packet โ€” VPN). Protocols: AH (integrity only), ESP (encryption + integrity โ€” preferred).
Always use ESP over AH โ€” ESP provides encryption. IKEv2 is the modern key exchange protocol. Site-to-site VPNs use IPSec tunnel mode. IPSec operates at Layer 3 โ€” encrypts all traffic regardless of application protocol.
Full Definition โ†’
Full Definition โ†’
What is IPv4 addressing? D6 ยท Network+ โ–ธ
IPv4 private ranges (RFC 1918): 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. Loopback: 127.0.0.0/8. APIPA: 169.254.0.0/16 (no DHCP server found).
Know private ranges for the exam. APIPA (169.254.x.x) = DHCP failed โ€” check DHCP server. Loopback (127.0.0.1) = local machine self-reference. Class A: 0-127, Class B: 128-191, Class C: 192-223. Classes are legacy โ€” CIDR is the modern standard.
Full Definition โ†’
Full Definition โ†’
What is IPv6 addressing? D6 ยท Network+ โ–ธ
IPv6 is 128-bit addresses in hexadecimal. Key types: Link-local (FE80::/10 โ€” auto-configured, non-routable), Global unicast (public internet), Loopback (::1), Multicast (FF00::/8).
IPv6 has no broadcast โ€” uses multicast instead. Link-local addresses are automatically configured on every IPv6 interface. IPv6 SLAAC (Stateless Address AutoConfiguration) enables auto-configuration without DHCP. Dual-stack = IPv4 and IPv6 simultaneously.
Full Definition โ†’
Full Definition โ†’
What is IoC sharing? D8 ยท CySA+ โ–ธ
IoC sharing distributes threat indicators to defensive tools for blocking and detection. STIX (format) + TAXII (transport protocol) enable machine-readable automated sharing.
MISP (Malware Information Sharing Platform) is the leading open-source IoC sharing platform. ISACs use TAXII servers. Automate ingestion: new IoCs โ†’ SIEM detection rules + firewall/proxy blocks + EDR detections. Manual IoC management doesn't scale.
Full Definition โ†’
Full Definition โ†’
What is incident classification? D8 ยท CySA+ โ–ธ
Incident classification categorizes incidents by type (malware, phishing, data breach, DoS) and severity (P1-P4 based on business impact) to determine response priority and resources.
P1 (Critical): active data breach, ransomware spreading, critical system down. P2 (High): limited breach, significant system impact. P3 (Medium): contained malware, policy violation. P4 (Low): suspicious email, minor policy violation. Classification drives IR playbook selection.
Full Definition โ†’
Full Definition โ†’
What is incident response communication? D8 ยท CySA+ โ–ธ
IR communication plan covers: internal (executive, IT, legal), regulatory notification (GDPR 72hrs, HIPAA 60 days), customer notification, media response, and law enforcement (if criminal).
IR communication is often the most legally complex aspect. Legal counsel should approve all external communications. Avoid speculating about breach scope in early communications โ€” update as investigation progresses. Document all communication with timestamps.
Full Definition โ†’
Full Definition โ†’
What is identity federation? D1 ยท General โ–ธ
Identity federation extends identity trust across organizational boundaries โ€” a user authenticated at Company A is trusted by Company B without separate credentials. SAML 2.0 and OIDC are the protocols.
Federation enables cloud SSO across enterprises. Trust is established via metadata exchange and certificate sharing. SAML: enterprise web SSO. OIDC: modern apps and APIs (built on OAuth 2.0). Key use case: employee accessing partner systems or SaaS apps with corporate credentials.
Full Definition โ†’
Full Definition โ†’
What is Infrastructure as Code (IaC)? D3 ยท Architecture โ–ธ
IaC defines infrastructure (networks, servers, databases) in code โ€” enabling version control, automated deployment, consistency, and security scanning before deployment.
IaC security scanning (Checkov, tfsec, KICS) finds misconfigurations before deployment โ€” when fixing is cheapest. Git-based workflows provide version history and change approval (PR review). IaC + immutable infrastructure = consistent, auditable, reproducible environments.
Full Definition โ†’
Full Definition โ†’
What is IP reputation filtering? D4 ยท Operations โ–ธ
IP reputation filtering blocks or alerts on connections to/from known-malicious IP addresses โ€” Tor exit nodes, botnet C2 infrastructure, scanner IPs, malware distribution servers.
IP reputation feeds (commercial and free: Spamhaus, Talos, Emerging Threats) integrate with firewalls, proxies, and SIEM. Automated blocking of low-reputation IPs reduces attack surface. False positive risk: legitimate services sharing IPs with malicious actors โ€” review before auto-block.
Full Definition โ†’
Full Definition โ†’
What is internal discovery? D9 ยท PenTest+ โ–ธ
Internal discovery after initial access: enumerate domain users/computers/groups, find network shares, identify additional services/hosts, map network topology, find credentials in files/memory.
Tools: BloodHound (AD mapping), PowerView (AD enumeration), Invoke-ShareFinder (find shares), Nmap (internal scanning), ADExplorer (AD browser). Initial discovery tells you where to go next. Look for: highly privileged accounts, service accounts, admin shares, password files, configuration files with credentials.
Full Definition โ†’
Full Definition โ†’
What is Impacket? D7 ยท Tools +
Impacket is a Python library and collection of tools for Windows protocol interaction โ€” secretsdump.py (credential dumping), psexec.py/wmiexec.py (remote execution), GetNPUsers.py (AS-REP roasting), GetUserSPNs.py (Kerberoasting).
Impacket is essential for Windows/AD pen testing. GetUserSPNs.py -request: Kerberoasting. GetNPUsers.py: AS-REP roasting. secretsdump.py via DCSync or local NTDS: credential extraction. smbclient.py: enumerate SMB shares. All run from Linux against Windows targets.
Full Definition โ†’
What is jailbreaking in mobile security? D2 ยท Threats โ–ธ
Jailbreaking (iOS) or rooting (Android) removes OS restrictions, gaining root access. Consequences: bypasses security sandbox, allows sideloading, disables security updates.
MDM solutions detect jailbroken/rooted devices and can block corporate access. Jailbroken devices are untrustworthy โ€” they may have compromised security controls. Zero-click exploits can jailbreak devices without user action.
Full Definition โ†’
Full Definition โ†’
What is Just-in-Time (JIT) access? D1 ยท General โ–ธ
JIT access grants elevated privileges only when needed, for a limited time, with full audit logging โ€” eliminating standing privileged access that's a constant attack target.
Zero Standing Privilege (ZSP) = never have permanent admin access. JIT is the implementation: request โ†’ approve โ†’ grant โ†’ auto-revoke. Dramatically reduces the blast radius of compromised privileged accounts.
Full Definition โ†’
Full Definition โ†’
What is Just-in-Time (JIT) access? D1 ยท General โ–ธ
JIT access grants elevated privileges only when needed, for a limited time, with full audit logging โ€” eliminating permanently privileged accounts that are constant targets.
Zero Standing Privilege (ZSP) = never have permanent admin access. JIT: request โ†’ approve โ†’ grant โ†’ auto-revoke. Dramatically reduces blast radius of compromised admin accounts. PAM platforms (CyberArk, BeyondTrust) implement JIT.
Full Definition โ†’
Full Definition โ†’
What is job rotation in security? D1 ยท General โ–ธ
Job rotation periodically moves employees between roles โ€” preventing one person from accumulating too much knowledge, detecting fraud through cross-examination, and building resilience.
Job rotation is an administrative control that reduces insider threat risk. Combined with separation of duties and mandatory vacation (where others must cover), it makes sustained fraud much harder. Cross-training also improves operational resilience and knowledge sharing.
Full Definition โ†’
Full Definition โ†’
What are jumbo frames? D6 ยท Network+ +
Jumbo frames extend the maximum transmission unit (MTU) from the standard 1,518 bytes to up to 9,000 bytes โ€” reducing overhead for high-throughput applications (storage networks, virtual machine migration).
Standard MTU 1,518 bytes. Jumbo frame MTU typically 9,000 bytes. Reduces per-packet overhead for large transfers. Must be configured consistently end-to-end โ€” mismatched MTU causes fragmentation or packet drops. Common in data center storage (iSCSI, NFS) and virtualization environments.
Full Definition โ†’
What is kernel security? D3 ยท Architecture โ–ธ
The kernel is the OS core (Ring 0) with full hardware access. Kernel exploits are the most severe โ€” granting complete system control. Protections: ASLR, SMEP, SMAP, kernel integrity checks.
Kernel vulnerabilities are the most dangerous (highest privilege level). Windows Credential Guard isolates LSASS using kernel virtualization. Linux: grsecurity/KSPP patches harden the kernel. Signed kernel modules prevent malicious modules.
Full Definition โ†’
Full Definition โ†’
What is key escrow? D5 ยท Crypto โ–ธ
Key escrow places a copy of the encryption key with a trusted third party for emergency recovery โ€” law enforcement access, disaster recovery, or employee departure.
Key escrow is controversial โ€” law enforcement wants it; privacy advocates oppose it. Enterprise key escrow is common for data recovery. Recovery agents in Windows can decrypt EFS files. Balance: recovery capability vs. escrow compromise risk.
Full Definition โ†’
Full Definition โ†’
What are kernel exploits? D3 ยท Architecture โ–ธ
Kernel exploits target the OS core (Ring 0 โ€” highest privilege), granting complete system control. Most severe vulnerability category. Protections: ASLR, SMEP, SMAP, kernel integrity.
Kernel exploits = full system compromise. Even a non-privileged user can gain root via kernel exploit. Patch OS kernels promptly โ€” kernel CVEs must be treated as emergencies. Container escapes often exploit kernel vulnerabilities.
Full Definition โ†’
Full Definition โ†’
What is key stretching? D5 ยท Crypto โ–ธ
Key stretching applies hash functions iteratively to make password hashing computationally expensive โ€” slowing offline brute-force attacks dramatically.
Regular SHA-256: GPUs can compute billions/second. bcrypt/Argon2: deliberately slow (100ms+). Attacker's speed = 10,000 attempts/second vs. billions. Tune iteration count to maintain ~100ms hash time as hardware improves.
Full Definition โ†’
Full Definition โ†’
What are key Windows Security Event IDs? D4 ยท Operations โ–ธ
Key IDs: 4624 (logon success), 4625 (logon failure), 4648 (explicit credential logon), 4672 (admin privilege assigned), 4688 (process creation), 4698 (scheduled task created), 4719 (audit policy changed).
4625 spike = brute force. 4648 = lateral movement indicator. 4688 with command line logging = malicious command detection. 4698 = new scheduled task (persistence). Forward Security log to SIEM. Enable command line logging in audit policy for 4688 to be useful.
Full Definition โ†’
Full Definition โ†’
What is Kerberos authentication? D1 ยท General โ–ธ
Kerberos provides SSO authentication in Windows AD. Key components: KDC (Key Distribution Center), TGT (Ticket-Granting Ticket), TGS (Ticket-Granting Service). No passwords sent over network.
Kerberos flow: authenticate to KDC โ†’ receive TGT โ†’ use TGT to request service tickets (TGS) โ†’ present service ticket to target service. Attacks: Golden/Silver tickets, Kerberoasting, AS-REP Roasting, Pass-the-Ticket. KRBTGT is the most sensitive AD account.
Full Definition โ†’
Full Definition โ†’
What is key exchange? D5 ยท Crypto +
Key exchange allows two parties to establish a shared secret over an insecure channel โ€” without ever transmitting the secret. Diffie-Hellman (DH) and ECDH are the mechanisms.
DH solves the symmetric key distribution problem. Ephemeral DH (DHE/ECDHE) generates new keys per session for Perfect Forward Secrecy. Used in TLS handshake. Quantum computers threaten DH/ECDH โ€” post-quantum alternatives (CRYSTALS-Kyber) are being standardized.
Full Definition โ†’
What is LAPS (Local Administrator Password Solution)? D1 ยท General โ–ธ
LAPS automatically manages and rotates unique local administrator passwords for each Windows workstation โ€” stored in AD and accessible only to authorized admins.
Without LAPS, most organizations have the same local admin password on every workstation โ€” perfect for lateral movement via pass-the-hash. LAPS gives every machine a unique local admin password. Free Microsoft tool.
Full Definition โ†’
Full Definition โ†’
What is log aggregation? D4 ยท Operations โ–ธ
Log aggregation collects logs from multiple sources (servers, network devices, applications) into a central repository for correlation, analysis, and long-term retention.
Syslog (UDP/TCP 514, TLS 6514) is the standard log transport. Without aggregation, logs stay on individual systems โ€” deleted by attackers, siloed, uncorrelated. Centralized logs are tamper-evident and searchable.
Full Definition โ†’
Full Definition โ†’
What is log retention policy? D4 ยท Operations โ–ธ
Log retention defines how long logs must be kept. Compliance drivers: PCI DSS (1 year), HIPAA (6 years), SOX (7 years), GDPR (as long as necessary).
Incident investigations often require logs from 30-90 days ago. A 1-year minimum is a safe default. Hot storage (recent, fast) โ†’ warm storage (months, slower) โ†’ cold storage (archival, slowest/cheapest) tiers manage costs.
Full Definition โ†’
Full Definition โ†’
What is layered security (defense in depth)? D3 ยท Architecture โ–ธ
Layered security deploys multiple, independent security controls โ€” if one fails, others remain. Each layer addresses different attack vectors.
No single control is sufficient. Example: email filtering catches most phishing; user awareness training catches more; EDR catches malware that gets through; network segmentation limits damage even if endpoint is compromised.
Full Definition โ†’
Full Definition โ†’
What is Local/Remote File Inclusion (LFI/RFI)? D2 ยท Threats โ–ธ
LFI includes local server files via unsanitized input. RFI includes remote files โ€” executing attacker-controlled code. Common in PHP applications using dynamic file includes.
LFI can read /etc/passwd, config files, log files (log poisoning). RFI enables direct code execution by hosting malicious PHP on attacker's server. Prevention: whitelist allowed include files, disable allow_url_include in PHP config.
Full Definition โ†’
Full Definition โ†’
What is Linux hardening? D4 ยท Operations โ–ธ
Linux hardening: minimal installation, strong SSH config (key-only, no root), SELinux/AppArmor (mandatory access control), regular patching, host firewall (iptables/nftables), audit daemon, CIS benchmark compliance.
SELinux = NSA-developed, label-based MAC for Linux. AppArmor = profile-based MAC, simpler to configure. Both confine processes even if exploited. Enable SELinux in enforcing mode โ€” most Linux systems have it in permissive mode by default.
Full Definition โ†’
Full Definition โ†’
What is live forensics? D4 ยท Operations โ–ธ
Live forensics investigates a running system to capture volatile data before shutdown โ€” RAM, running processes, network connections, logged-in users, encryption keys.
Memory forensics is only possible on a live system. Balance: live forensics preserves volatile evidence; but powered system = attacker may have a tripwire. Capture RAM first, then decide whether to power off. IR playbook should prescribe the approach.
Full Definition โ†’
Full Definition โ†’
What is log poisoning? D2 ยท Threats โ–ธ
Log poisoning combines LFI with code injection โ€” injecting malicious code into server logs (via User-Agent, etc.), then using LFI to include the log file, executing the injected code.
Log poisoning turns an LFI vulnerability into RCE. Defense: input sanitization (prevent code injection into logs), disable dynamic file includes (prevent LFI), separate log file permissions from web content.
Full Definition โ†’
Full Definition โ†’
What is LAPS (Local Administrator Password Solution)? D1 ยท General โ–ธ
LAPS automatically manages unique local administrator passwords per Windows workstation โ€” stored in AD, accessible only to authorized admins, rotated automatically.
Without LAPS: same local admin password on every workstation = perfect pass-the-hash lateral movement. LAPS gives each machine a unique, rotated local admin password. Free Microsoft tool. Microsoft LAPS (2023) is the cloud-integrated successor.
Full Definition โ†’
Full Definition โ†’
How is lateral movement detected? D8 ยท CySA+ โ–ธ
Detection signals: Event ID 4648 (logon with explicit credentials), unusual SMB/RDP connections between workstations, authentication from unexpected source hosts, new admin tool usage on non-admin systems.
Lateral movement is the gap between initial access and domain compromise. Detect it here to limit damage. Network segmentation limits movement; monitoring detects it. Honey credentials in password vaults alert when tried on other systems.
Full Definition โ†’
Full Definition โ†’
What is LDAP injection? D2 ยท Threats โ–ธ
LDAP injection manipulates LDAP queries through unsanitized user input โ€” bypassing authentication or extracting directory information. Similar to SQL injection but targeting directory services.
Example: username = '*)(uid=*))(|(uid=*' can return all users. Prevention: input validation, use LDAP-safe libraries, parameterized queries. Less common than SQL injection but devastating in AD-integrated applications.
Full Definition โ†’
Full Definition โ†’
What is log rotation and retention? D4 ยท Operations โ–ธ
Log rotation manages log file size. Log retention defines how long logs are kept: PCI DSS (1 year), HIPAA (6 years), SOX (7 years).
Hot (recent, fast, expensive) โ†’ warm (months, slower) โ†’ cold (archival, cheapest) storage tiers manage retention costs. Incident investigations often need logs from 30-90 days ago. Minimum 1-year retention is a safe default for most organizations.
Full Definition โ†’
Full Definition โ†’
What is load balancing? D3 ยท Architecture โ–ธ
Load balancing algorithms: Round-robin (equal distribution), Least connections (sends to least-loaded), Source IP hash (same client โ†’ same server โ€” session persistence), Weighted round-robin.
Active-active = multiple servers handle traffic simultaneously (better utilization). Active-passive = standby activates only on failure (simpler, less efficient). Health checks remove failed servers automatically. Load balancers also provide DDoS mitigation and SSL termination.
Full Definition โ†’
Full Definition โ†’
What are lateral movement techniques? D9 ยท PenTest+ โ–ธ
Lateral movement: Pass-the-Hash (use NTLM hash to authenticate), Pass-the-Ticket (use Kerberos ticket), WMI/WinRM exec, PsExec (SMB-based remote exec), RDP, SSH, Impacket toolkit.
Impacket (Python) provides: psexec.py, wmiexec.py, smbexec.py, secretsdump.py โ€” essential pen test toolkit for Windows lateral movement. Defense: Credential Guard, disable WMI/WinRM where not needed, SMB signing, EDR behavioral detection, network segmentation.
Full Definition โ†’
Full Definition โ†’
What is Linux privilege escalation? D9 ยท PenTest+ โ–ธ
Linux privesc: SUID binaries (run as file owner), sudo misconfigurations (sudo -l to list allowed commands), writable cron jobs (write to script run as root), PATH hijacking, kernel exploits.
LinPEAS automates Linux privilege escalation enumeration. GTFObins documents how to exploit SUID/sudo binaries for escalation. Misconfigured sudo is the most common Linux privesc path in CTFs and real environments. Check /etc/crontab and /etc/passwd for weak permissions.
Full Definition โ†’
Full Definition โ†’
What is log management? D4 ยท Operations โ–ธ
Log management covers collection, normalization, aggregation, storage, and analysis of logs from all systems. Centralized logging (SIEM) is critical โ€” local logs are deleted by attackers and siloed.
Log management requirements: syslog for transport, SIEM for analysis, hot/warm/cold storage tiers for retention, tamper-evident storage. Without centralized logging, incident investigations fail. More security budget on SIEM than almost any other control is typically justified.
Full Definition โ†’
Full Definition โ†’
What makes a good cryptographic hash function? D5 ยท Crypto โ–ธ
Properties: one-way (preimage resistance), collision resistant (no two inputs โ†’ same output), avalanche effect (small change = completely different output), deterministic.
SHA-256 has these properties; MD5 does not (collisions found). A good hash function makes password cracking computationally infeasible even with GPUs when properly salted.
Full Definition โ†’
Full Definition โ†’
What is MAC address spoofing? D2 ยท Threats โ–ธ
MAC address spoofing changes a device's hardware MAC address to impersonate another device โ€” bypassing MAC-based access controls and network monitoring.
MAC filtering alone is not sufficient security โ€” MAC addresses are trivially spoofed. 802.1X authentication is far more robust. MAC spoofing used to bypass captive portals and MAC-based firewall rules.
Full Definition โ†’
Full Definition โ†’
What is malware analysis? D4 ยท Operations โ–ธ
Malware analysis: Static analysis (examining code without running) โ€” strings, imports, disassembly. Dynamic analysis (running in a sandbox) โ€” behaviors, network calls, file changes.
Tools: Cuckoo sandbox (dynamic), IDA Pro/Ghidra (static/reverse engineering), VirusTotal (reputation). Obfuscated malware resists static analysis โ€” dynamic analysis reveals actual behavior. Sandboxes may be VM-aware.
Full Definition โ†’
Full Definition โ†’
What is memory forensics? D4 ยท Operations โ–ธ
Memory forensics analyzes RAM dumps to find running processes, injected code, encryption keys, network connections, and credentials โ€” especially valuable for fileless malware.
Tools: Volatility, Rekall. Key artifacts in memory: process list, network connections, command history, encryption keys, injected DLLs, malware hiding from process lists. Capture memory before shutdown.
Full Definition โ†’
Full Definition โ†’
What is metadata in security? D2 ยท Threats โ–ธ
Metadata is data describing other data โ€” EXIF data in photos (GPS location, device info), document metadata (author, edit history), email headers.
Photos uploaded online may include GPS coordinates (stalking risk). Word documents may contain author names, revision history, tracked changes, comments. Tools: exiftool, metadata stripping before publishing.
Full Definition โ†’
Full Definition โ†’
What is Mobile Device Management (MDM)? D3 ยท Architecture โ–ธ
MDM manages and secures mobile devices โ€” enforcing encryption, PIN requirements, remote wipe, app distribution, jailbreak detection, and VPN configuration.
MDM gives full device control including personal data visibility. Employees may resist on personal devices. MAM (app-only) is less invasive for BYOD. Remote wipe is critical if a device is lost/stolen.
Full Definition โ†’
Full Definition โ†’
What is multi-tenancy security in cloud? D3 ยท Architecture โ–ธ
Multi-tenancy shares physical infrastructure among multiple customers in cloud environments. Security concern: tenant isolation โ€” preventing one tenant's data/workload from accessing another's.
CSPs use hypervisors, namespaces, and network isolation for tenant separation. Side-channel attacks (Spectre/Meltdown) demonstrated theoretical cross-tenant data leakage. Government workloads often use dedicated/isolated cloud deployments.
Full Definition โ†’
Full Definition โ†’
What makes spear phishing so effective? D2 ยท Threats โ–ธ
Spear phishing effectiveness comes from personalization โ€” using researched details (recipient's name, manager's name, recent project, specific technology) to make emails convincing and contextually relevant.
Generic phishing has ~3% click rate. Personalized spear phishing can reach 30-40%. AI-generated spear phishing is dramatically more scalable now. Defense: security awareness with targeted phishing simulations, email authentication (DMARC).
Full Definition โ†’
Full Definition โ†’
What is macro malware? D2 ยท Threats โ–ธ
Macro malware embeds malicious VBA code in Office documents โ€” when enabled by the victim, the macro downloads and executes additional malware. Common phishing payload.
"Enable Content" prompt is the macro execution gate. Disable macros by default (Group Policy). AMSI (Antimalware Scan Interface) scans macro code at runtime. Most Office phishing attachments use macros or exploits targeting unpatched Office.
Full Definition โ†’
Full Definition โ†’
What is memory protection in OS security? D3 ยท Architecture โ–ธ
Memory protections: ASLR (randomizes memory layout), DEP/NX (non-executable stack/heap), stack canaries (detect overflow), SMEP (prevents kernel executing user code), safe unlinking.
These protections make exploitation harder but not impossible (ROP gadgets bypass DEP+ASLR together). Modern exploitation requires bypassing multiple mitigations. Regularly patching is still the most effective defense.
Full Definition โ†’
Full Definition โ†’
What is MITRE D3FEND? D8 ยท CySA+ โ–ธ
MITRE D3FEND is a complementary framework to ATT&CK mapping defensive techniques to the ATT&CK offensive techniques โ€” helping defenders understand what controls address which attacks.
If ATT&CK describes "T1059.001 PowerShell" then D3FEND shows defensive techniques (Script Execution Analysis, Process Spawn Analysis). Helps defenders achieve ATT&CK coverage through specific control investments.
Full Definition โ†’
Full Definition โ†’
What mitigates buffer overflow attacks? D3 ยท Architecture โ–ธ
Buffer overflow mitigations: ASLR (randomizes memory layout), DEP/NX (non-executable stack/heap), Stack canaries (detect overflows before return), Safe languages (Rust, Go prevent by design).
Multiple mitigations together raise the bar significantly. ROP (Return-Oriented Programming) can bypass DEP alone. ASLR + DEP together require info leak to bypass. Modern exploitation requires chaining multiple techniques.
Full Definition โ†’
Full Definition โ†’
What is MAC address filtering? D3 ยท Architecture โ–ธ
MAC filtering restricts network access to approved MAC addresses. Limitation: MACs are trivially spoofed โ€” an attacker can capture a legitimate MAC from passive wireless monitoring and spoof it.
MAC filtering is security theater for wireless โ€” provides no real protection. 802.1X (RADIUS authentication) is the correct enterprise wireless control. MAC filtering is administratively burdensome with minimal security benefit.
Full Definition โ†’
Full Definition โ†’
What is metadata and its security risks? D2 ยท Threats โ–ธ
Metadata describes other data โ€” EXIF in photos (GPS location, device model), document metadata (author, revision history), email headers (mail server paths).
Photos uploaded online may expose GPS coordinates (physical location/stalking risk). Word docs contain author names and edit history. Tool: exiftool strips metadata. Remove metadata before publishing documents or photos externally.
Full Definition โ†’
Full Definition โ†’
What is mobile device security? D3 ยท Architecture โ–ธ
Mobile security layers: MDM enforcement (PIN/encryption/wipe), app vetting (corporate app store), network (VPN for corporate access), jailbreak/root detection, container (separate corporate/personal data).
MDM remote wipe is critical for lost/stolen devices. Jailbroken/rooted devices bypass OS security sandbox. Zero-click exploits (no user interaction needed) are the most dangerous mobile threat โ€” patch promptly.
Full Definition โ†’
Full Definition โ†’
What makes strong MFA? D1 ยท General โ–ธ
MFA strength: SMS (weakest โ€” SIM swapping), TOTP authenticator apps (medium), Push notifications (medium โ€” MFA fatigue attack), Hardware keys/FIDO2 (strongest โ€” phishing-resistant).
FIDO2/WebAuthn hardware keys are the only phishing-resistant MFA โ€” they verify the site's origin before responding. SMS is better than nothing but weak. MFA fatigue: attacker triggers repeated push notifications hoping victim approves by accident. Require number matching in push MFA.
Full Definition โ†’
Full Definition โ†’
What are malware behavioral indicators? D8 ยท CySA+ โ–ธ
Malware behavioral indicators: unusual parent-child process relationships (Word spawning PowerShell), outbound beaconing at regular intervals, new registry run keys, credential dumping API calls, file encryption (ransomware).
EDR platforms detect these behavioral patterns even without signatures. MITRE ATT&CK maps these behaviors to specific techniques. Baseline normal PowerShell usage to detect malicious PowerShell โ€” it's the same binary, only behavior differs.
Full Definition โ†’
Full Definition โ†’
What makes an effective security policy? D1 ยท General โ–ธ
Effective policies: Clear and unambiguous, enforceable (with consequences), appropriate to audience, exception process defined, regular review schedule, management support, communicated and acknowledged by all staff.
Policies that employees don't know about or can't comply with don't improve security. Write policies in plain language. Annual acknowledgment creates accountability. Policies must be enforced consistently โ€” selective enforcement breeds resentment and non-compliance.
Full Definition โ†’
Full Definition โ†’
What is Mandatory Access Control (MAC)? D1 ยท General โ–ธ
MAC enforces access based on labels assigned to subjects (users/processes) and objects (files/data) โ€” the OS/security policy controls access, not the owner. Used in government/military.
MAC vs DAC vs RBAC: MAC = system decides (most secure), DAC = owner decides (most flexible), RBAC = role decides (most practical). SELinux and AppArmor implement MAC on Linux. MAC prevents Trojan horse attacks โ€” even malware running as you can't violate MAC policies.
Full Definition โ†’
Full Definition โ†’
What is Microsoft 365 security? D3 ยท Architecture โ–ธ
Key M365 security controls: Azure AD MFA, Conditional Access policies, Defender for Office 365 (email), Defender for Endpoint, Microsoft Purview (DLP/compliance), Privileged Identity Management (PIM).
M365 is a rich security platform if licensed and configured properly. Enable MFA for all users (non-negotiable). Conditional Access = zero trust policy engine for M365. Defender for Office 365 P2 adds attack simulation training. Secure Score benchmarks your configuration.
Full Definition โ†’
Full Definition โ†’
What is MDF and IDF? D6 ยท Network+ โ–ธ
MDF (Main Distribution Frame): central wiring hub, core/distribution switches, main internet connection. IDF (Intermediate Distribution Frame): branch wiring closets, access layer switches serving floor or wing.
MDF-to-IDF connections typically use fiber (higher speed, longer distances). IDF-to-desktop uses UTP copper. Physical security of MDF/IDF is critical โ€” unrestricted physical access to switches = full network access. Lock wiring closets, install cameras, control who has keys.
Full Definition โ†’
Full Definition โ†’
What is multicast networking? D6 ยท Network+ โ–ธ
Multicast sends one packet to multiple receivers simultaneously โ€” more efficient than unicast (separate copy per receiver) for one-to-many applications: video streaming, financial data distribution.
Multicast addresses: 224.0.0.0/4. IGMP: hosts join/leave multicast groups. PIM: multicast routing protocol. Multicast is more complex to configure and troubleshoot than unicast. Security: unauthenticated multicast group joins โ€” filter with IGMP snooping on switches.
Full Definition โ†’
Full Definition โ†’
What is mobile application security testing? D9 ยท PenTest+ +
Mobile app testing: SSL/certificate pinning bypass (Frida), binary analysis (jadx for APK, Hopper for IPA), sensitive data storage (cleartext in SharedPrefs/Keychain), insecure network comms, API analysis via proxy.
Android: decompile APK with jadx. iOS: jailbreak for filesystem access. Frida hooks app functions at runtime โ€” bypasses certificate pinning to intercept HTTPS. OWASP MSTG (Mobile Security Testing Guide) is the comprehensive reference. Check: hardcoded credentials, insecure data storage, excessive permissions.
Full Definition โ†’
What is NAT and its security implications? D6 ยท Network+ โ–ธ
NAT maps private IP addresses to a public IP โ€” conserving IPv4 addresses and obscuring internal network topology from external observers.
NAT provides "security through obscurity" โ€” it hides internal IPs but is not a real security control. Attackers can still reach services via port forwarding. Do not rely on NAT as a security boundary.
Full Definition โ†’
Full Definition โ†’
What is network forensics? D4 ยท Operations โ–ธ
Network forensics captures and analyzes network traffic for incident investigation and evidence collection. Tools: Wireshark, tcpdump, Zeek/Bro, full packet capture (FPC) solutions.
PCAP files are the gold standard for network forensics. NetFlow provides summary data (less storage). Full packet capture requires massive storage but provides complete reconstruction. NSM (Network Security Monitoring) = continuous capture.
Full Definition โ†’
Full Definition โ†’
What is Nmap? D7 ยท Tools โ–ธ
Nmap is the most widely used port scanner and network discovery tool. Capabilities: host discovery, port scanning, service version detection, OS fingerprinting, script scanning (NSE).
Common Nmap scan types: -sS (SYN/stealth), -sV (version detection), -O (OS detection), -A (aggressive: version+OS+scripts). -p- scans all 65535 ports. Always get authorization before scanning.
Full Definition โ†’
Full Definition โ†’
What is non-repudiation? D5 ยท Crypto โ–ธ
Non-repudiation prevents a party from denying they performed an action โ€” digital signatures and audit logs provide evidence that can't be reasonably denied.
Digital signatures provide non-repudiation because only the signer has the private key. Audit logs with integrity protection support non-repudiation. HMAC provides authentication but NOT non-repudiation (shared key).
Full Definition โ†’
Full Definition โ†’
What is NAT64? D6 ยท Network+ โ–ธ
NAT64 translates IPv6 packets to IPv4 โ€” allowing IPv6-only clients to communicate with IPv4-only servers. A transition mechanism for organizations moving to IPv6.
IPv6 transition mechanisms (NAT64, 6to4, Teredo) can create security blind spots โ€” traffic may bypass IPv4-only security controls. Ensure security tools monitor both IPv4 and IPv6 traffic.
Full Definition โ†’
Full Definition โ†’
What is NFC payment security? D1 ยท General โ–ธ
NFC payment security: EMV tokenization generates a unique dynamic code per transaction โ€” stolen card data is useless without the dynamic code. Relay attacks extend the NFC range.
EMV chip+NFC is significantly more secure than magnetic stripe (static data). Apple Pay/Google Pay use device tokens โ€” your actual card number is never transmitted. Relay attacks remain a theoretical concern but difficult in practice.
Full Definition โ†’
Full Definition โ†’
What is NAT and security? D6 ยท Network+ โ–ธ
NAT maps private IPs to a public IP, obscuring internal topology. Important: NAT is NOT a security control โ€” it provides obscurity but doesn't prevent attacks through forwarded ports or from internal compromised hosts.
"NAT provides security" is a common misconception. Attackers can still reach services via port forwarding. Internal compromised hosts call out through NAT freely. Don't rely on NAT as a security boundary โ€” use firewalls and ACLs.
Full Definition โ†’
Full Definition โ†’
What is Network Access Control (NAC)? D3 ยท Architecture โ–ธ
NAC enforces policy compliance before granting network access โ€” checking OS patch level, antivirus status, firewall state, disk encryption, and certificate-based device authentication.
Non-compliant devices are quarantined to a remediation VLAN. NAC is about device posture, not just user credentials. 802.1X is the protocol framework NAC builds on. Prevent infected or unmanaged devices from accessing corporate network.
Full Definition โ†’
Full Definition โ†’
What is NIST SP 800-53? D1 ยท General โ–ธ
NIST SP 800-53 provides a catalog of security and privacy controls for federal information systems. Organized into control families: AC (Access Control), IA (Identification and Authentication), SI (System Integrity).
Required for US federal agencies (FISMA). Widely adopted by non-federal organizations. Control baselines: Low, Moderate, High impact levels. Maps to NIST CSF functions. 800-53B provides control baselines. 800-171 covers CUI in non-federal systems.
Full Definition โ†’
Full Definition โ†’
What is Nmap? D7 ยท Tools โ–ธ
Nmap is the premier port scanner. Key options: -sS (SYN scan/stealth), -sV (version), -O (OS detection), -A (aggressive: everything), -p- (all 65535 ports), --script (NSE scripts).
Common Nmap workflow: -sn (host discovery) โ†’ -sS (port scan) โ†’ -sV (version) โ†’ targeted NSE scripts. Always get written authorization before scanning. Nmap scanning unauthorized systems is illegal in many jurisdictions.
Full Definition โ†’
Full Definition โ†’
What is network penetration testing? D9 ยท PenTest+ โ–ธ
Network pen testing assesses network security โ€” external (internet-facing attack surface) and internal (assuming breach inside perimeter) assessments.
External: Nmap scan exposed services โ†’ banner grab โ†’ CVE lookup โ†’ exploit unpatched services. Internal: enumerate AD, find misconfigs, escalate privileges. Segmentation testing: verify VLANs actually isolate traffic. Wireless assessment: test AP security, rogue AP detection.
Full Definition โ†’
Full Definition โ†’
What is network segmentation? D3 ยท Architecture โ–ธ
Network segmentation divides a network into isolated zones โ€” controlling traffic between zones with firewalls. Limits lateral movement and contains breaches to their originating segment.
Segmentation is the most impactful network security control. Flat networks = attacker can reach everything from any compromised host. Recommended segments: DMZ, Production, Dev/Test, Management, IoT, Guest. Each segment crosses a firewall/ACL to reach others.
Full Definition โ†’
Full Definition โ†’
What are network cable types? D6 ยท Network+ โ–ธ
Cat5e (1G/100m), Cat6 (10G/55m), Cat6a (10G/100m), Cat7 (shielded, 10G+). Fiber: Single-mode (long distance, yellow cable), Multi-mode (shorter distance, orange/aqua cable).
Cat6a is the current standard for new installations (supports 10G at full 100m). Single-mode fiber for inter-building/campus. Multi-mode for within building. Know the speed/distance limits for certification exams. Plenum-rated cable required in air-handling spaces (fire safety).
Full Definition โ†’
Full Definition โ†’
What is NetFlow? D7 ยท Tools โ–ธ
NetFlow (Cisco) / IPFIX (standard) provides network traffic metadata โ€” source/destination IP, ports, bytes, packets, and timing โ€” without capturing actual packet contents.
NetFlow storage: ~1% of full packet capture size. Enables: traffic analysis, anomaly detection, network forensics (who talked to what), bandwidth accounting. Security use: detect C2 beaconing, data exfiltration volumes, network scanning. Complement full PCAP with NetFlow for long-term traffic retention.
Full Definition โ†’
Full Definition โ†’
What is network monitoring? D4 ยท Operations โ–ธ
Network monitoring provides visibility into network health and security โ€” SNMP (device status), NetFlow (traffic analysis), Syslog (device logs), packet capture (deep analysis).
NOC (Network Operations Center) focuses on availability. SOC (Security Operations Center) focuses on security threats. Tools overlap: a good SIEM ingests both network performance and security events. Unified visibility across both operational and security dimensions improves detection of security-impacting events.
Full Definition โ†’
Full Definition โ†’
What are network topologies? D6 ยท Network+ โ–ธ
Common topologies: Star (all connect to central switch โ€” modern standard), Bus (legacy coax), Ring (legacy token ring), Mesh (redundant paths โ€” data centers, WAN), Hybrid (combination).
Modern LANs use hierarchical star topology (access โ†’ distribution โ†’ core). Data centers use spine-leaf (highly redundant mesh). WAN uses partial mesh (cost-effective redundancy). Physical vs. logical topology: logical can differ from physical (ring protocol over physical star).
Full Definition โ†’
Full Definition โ†’
What is NDR? D8 ยท CySA+ โ–ธ
NDR (Network Detection and Response) analyzes network traffic for threats โ€” using ML, behavioral analysis, and protocol inspection. Complements EDR (endpoint visibility) with network visibility.
NDR sees: lateral movement (east-west traffic), C2 beaconing, data exfiltration, network scanning. Captures: full PCAP, NetFlow, or Zeek logs. Tools: Darktrace, Vectra, open-source (Zeek + Suricata + Arkime/Moloch). NDR covers devices without EDR agents (network printers, IoT, legacy systems).
Full Definition โ†’
Full Definition โ†’
What is network enumeration? D9 ยท PenTest+ +
Network enumeration maps the target environment after initial access: live hosts, network topology, OS types, services, domain structure, DNS, routing. Builds the target model for attack path planning.
Internal enumeration workflow: Nmap live host scan โ†’ service version scan โ†’ AD enumeration (BloodHound) โ†’ share enumeration โ†’ identify high-value targets (DC, SQL servers, admin workstations). Document every finding โ€” topology maps are crucial for reporting and explaining attack paths to clients.
Full Definition โ†’
What is object storage security? D3 ยท Architecture โ–ธ
Object storage security (AWS S3, Azure Blob, GCS) requires: blocking public access, bucket policies for least-privilege, server-side encryption, versioning, access logging, and MFA delete.
Misconfigured S3 buckets have exposed billions of records. AWS S3 Block Public Access setting should be enabled by default at the organization level. Monitor for public bucket creation with AWS Config/GuardDuty.
Full Definition โ†’
Full Definition โ†’
What is OSINT (Open Source Intelligence)? D9 ยท PenTest+ โ–ธ
OSINT collects publicly available information โ€” social media, job postings, DNS records, WHOIS, Shodan (internet-connected devices), LinkedIn, public code repositories.
OSINT is passive reconnaissance โ€” no interaction with target systems. Tools: Maltego, theHarvester, Shodan, Recon-ng. Job postings reveal technology stack. LinkedIn shows employee names and org structure. DNS reveals infrastructure.
Full Definition โ†’
Full Definition โ†’
What is OSSEC? D7 ยท Tools โ–ธ
OSSEC (and its fork Wazuh) is an open-source HIDS providing log analysis, FIM, rootkit detection, active response, and compliance reporting. Widely used in SOC environments.
Wazuh extends OSSEC with vulnerability management, cloud security monitoring, and Elastic Stack integration. Both are free. Wazuh has become more actively maintained. Use for endpoints that commercial EDR can't cover (old Linux servers, network devices).
Full Definition โ†’
Full Definition โ†’
What is output encoding? D2 ยท Threats โ–ธ
Output encoding converts special characters to safe representations before displaying user input in HTML โ€” preventing browsers from interpreting content as executable code (XSS prevention).
HTML encode: < becomes &lt; > becomes &gt; preventing XSS. Context matters: HTML encoding โ‰  JavaScript encoding โ‰  URL encoding. Use context-aware encoding libraries (OWASP Java HTML Sanitizer, ESAPI). Never write your own encoder.
Full Definition โ†’
Full Definition โ†’
What is OTA (Over-the-Air) update security? D3 ยท Architecture โ–ธ
OTA updates deliver firmware/software wirelessly to devices. Security requirements: code signing (verify authenticity), TLS (protect in transit), version verification (prevent rollback), failure handling.
Unsigned OTA updates are a critical vulnerability โ€” attackers intercept and replace with malicious firmware. Secure OTA requires: digital signature verification, TLS delivery, rollback prevention, update authenticity check before installation.
Full Definition โ†’
Full Definition โ†’
What is OAuth 2.0? D1 ยท General โ–ธ
OAuth 2.0 authorizes third-party apps to access user resources without sharing credentials. Flow: user grants permission โ†’ authorization server issues access token โ†’ app uses token to access resources.
OAuth = authorization (what can this app do?). OpenID Connect adds authentication on top (who is this user?). Common attack: authorization code interception, token theft, open redirect. Validate redirect_uri strictly.
Full Definition โ†’
Full Definition โ†’
What is OSINT? D9 ยท PenTest+ โ–ธ
OSINT collects publicly available information โ€” social media, job postings, DNS records, WHOIS, Shodan (internet-connected devices), public code repositories, breach databases.
OSINT is passive reconnaissance โ€” no interaction with target systems. Tools: Maltego, theHarvester, Shodan, Recon-ng, Google Dorking. Job postings reveal tech stack. LinkedIn reveals employees and org structure. OSINT before active scanning is standard pen test methodology.
Full Definition โ†’
Full Definition โ†’
What is OWASP? D2 ยท Threats โ–ธ
OWASP is a non-profit producing free web security resources. The OWASP Top 10 lists most critical web application security risks. 2021: Broken Access Control (#1), Cryptographic Failures (#2), Injection (#3).
Every developer and security professional should know OWASP Top 10. Used as baseline security requirement in many organizations and contracts. OWASP also produces ASVS (Application Security Verification Standard) for detailed requirements.
Full Definition โ†’
Full Definition โ†’
What is OSPF? D6 ยท Network+ โ–ธ
OSPF (Open Shortest Path First) is a link-state interior gateway protocol using Dijkstra's algorithm to compute shortest paths. Supports areas (Area 0 = backbone) for scalability.
OSPF = interior routing (within an AS). BGP = exterior routing (between ASes). OSPF converges faster than RIP. MD5/SHA authentication prevents rogue routers from injecting false routes. Area 0 (backbone) must connect all other areas.
Full Definition โ†’
Full Definition โ†’
What are OSINT tools? D9 ยท PenTest+ +
Key OSINT tools: Maltego (relationship mapping), theHarvester (email/domain/host enumeration), Shodan (internet-exposed device search), Recon-ng (modular framework), SpiderFoot (automated OSINT), Google Dorks.
Google Dorks: site:company.com filetype:pdf (find company PDFs), site:company.com inurl:admin (find admin pages), "company.com" ext:sql (find exposed databases). Shodan: org:"Target Corp" port:3389 (find exposed RDP). LinkedIn: company filter + connections + tech stack from job postings.
Full Definition โ†’
What is packet filtering? D3 ยท Architecture โ–ธ
Packet filtering examines individual packets against ACL rules (source/destination IP, port, protocol) โ€” fast and simple but doesn't track connection state.
Stateless packet filtering is the oldest firewall type. Can't detect many attacks because it doesn't track connections. Stateful firewalls replaced most uses. Still used in routers for basic ACLs.
Full Definition โ†’
Full Definition โ†’
What is passive reconnaissance? D9 ยท PenTest+ โ–ธ
Passive reconnaissance gathers information without directly interacting with the target โ€” OSINT, WHOIS lookups, DNS enumeration, social media, job listings, Shodan.
Passive recon generates no logs on the target. Active recon (scanning) may be detected. OPSEC-conscious attackers start with extensive passive recon before any active interaction with targets.
Full Definition โ†’
Full Definition โ†’
What is PEAP in wireless security? D3 ยท Architecture โ–ธ
PEAP (Protected EAP) wraps EAP in a TLS tunnel, protecting credentials in transit. Common in enterprise Wi-Fi โ€” EAP-MSCHAPv2 for user authentication inside PEAP tunnel.
PEAP requires a server certificate but NOT client certificates (easier to deploy than EAP-TLS). EAP-TLS requires both server and client certificates (most secure). PEAP is the most common enterprise Wi-Fi authentication method.
Full Definition โ†’
Full Definition โ†’
What is pen test scoping? D9 ยท PenTest+ โ–ธ
Pen test scoping defines exactly what systems are in scope, what attacks are permitted, timing restrictions, and rules of engagement โ€” protecting both tester and client legally.
Always get a written Statement of Work (SoW) and Rules of Engagement (RoE) before starting. "I had permission" without documentation is not a legal defense. Scope creep = immediately stop and get authorization updated.
Full Definition โ†’
Full Definition โ†’
What is physical penetration testing? D9 ยท PenTest+ โ–ธ
Physical pen testing tests physical security controls โ€” tailgating, lock picking, social engineering security guards, cloning access badges, dumpster diving, USB drops.
Physical security is often the weakest link in technically-strong organizations. Requires explicit written authorization including specific locations and time windows. Often combined with social engineering.
Full Definition โ†’
Full Definition โ†’
What is pivoting in pen testing? D9 ยท PenTest+ โ–ธ
Pivoting uses a compromised host as a relay to attack other systems not directly reachable from the attacker's machine โ€” tunneling through the network.
Meterpreter's route command and SOCKS proxies enable pivoting. VPN-like tunnels through compromised hosts reach internal systems. Network segmentation limits pivot potential. Detect via unusual cross-segment connections.
Full Definition โ†’
Full Definition โ†’
What is port scanning? D9 ยท PenTest+ โ–ธ
Port scanning probes a target for open ports โ€” revealing running services that could be attacked. Open = service running. Closed = port accessible, no service. Filtered = firewall blocking.
SYN scan (-sS) is stealthy (doesn't complete handshake). Full connect scan (-sT) is noisy but works without raw socket access. UDP scanning is slow. Always get authorization โ€” port scanning unauthorized systems is illegal in many jurisdictions.
Full Definition โ†’
Full Definition โ†’
What is post-quantum cryptography? D5 ยท Crypto โ–ธ
Post-quantum cryptography (PQC) develops algorithms resistant to quantum computer attacks. NIST standardized CRYSTALS-Kyber (key encapsulation) and CRYSTALS-Dilithium (signatures) in 2024.
Quantum computers will break RSA and ECC via Shor's algorithm. "Harvest now, decrypt later" attacks store encrypted traffic to decrypt once quantum computers exist. Begin crypto-agile migration planning now.
Full Definition โ†’
Full Definition โ†’
What is privilege abuse? D2 ยท Threats โ–ธ
Privilege abuse is an insider using their authorized access for malicious purposes โ€” admins snooping on executive emails, copying databases, or sabotaging systems.
Privileged access monitoring (PAM) with session recording detects abuse. Separation of duties limits any single person's power. UEBA detects anomalous behavior from privileged users. Regular access reviews prevent excessive privilege accumulation.
Full Definition โ†’
Full Definition โ†’
What is process injection? D2 ยท Threats โ–ธ
Process injection inserts malicious code into a legitimate running process โ€” evading security tools by hiding under trusted processes (explorer.exe, svchost.exe).
Types: DLL injection, reflective DLL injection, process hollowing, thread hijacking. EDR detects process injection via behavioral monitoring (API calls, memory anomalies). A common fileless malware technique.
Full Definition โ†’
Full Definition โ†’
What is purple teaming? D4 ยท Operations โ–ธ
Purple teaming combines red team (attackers) and blue team (defenders) working collaboratively โ€” red shares attack details immediately so blue can improve detection and response.
Traditional red team: full adversarial simulation, blue team unaware. Purple team: collaborative, real-time knowledge sharing. Purple teaming is more cost-effective at improving defenses quickly. ATT&CK-based purple team exercises are popular.
Full Definition โ†’
Full Definition โ†’
What is password spraying? D2 ยท Threats โ–ธ
Password spraying tries a few common passwords (Password1, Summer2024!) against many accounts โ€” avoiding account lockout by staying under the threshold per account.
Defense: MFA (makes sprayed passwords useless), breached password detection, behavioral monitoring (multiple accounts with failed logins from same source), mandatory complex passwords. Spray attacks often succeed because users pick predictable passwords.
Full Definition โ†’
Full Definition โ†’
What is port forwarding and tunneling? D9 ยท PenTest+ โ–ธ
Port forwarding tunnels traffic through an SSH connection โ€” local forwarding (local port โ†’ remote), remote forwarding (remote port โ†’ local), dynamic forwarding (SOCKS proxy).
SSH -L (local), -R (remote), -D (dynamic/SOCKS). Dynamic forwarding creates a full SOCKS5 proxy through SSH. Used in pen testing to pivot through SSH-accessible hosts to reach internal systems. Also bypasses firewalls.
Full Definition โ†’
Full Definition โ†’
What is post-exploitation? D9 ยท PenTest+ โ–ธ
Post-exploitation is everything after initial access: privilege escalation, persistence establishment, lateral movement, internal reconnaissance, data exfiltration, and covering tracks.
In pen testing, document every action with timestamps. Post-exploitation demonstrates real impact beyond entry point. Tools: Metasploit, Cobalt Strike, Impacket (for Windows/AD). Blue team goal: detect and respond during post-exploitation.
Full Definition โ†’
Full Definition โ†’
What is protocol tunneling for C2? D2 ยท Threats โ–ธ
Protocol tunneling encodes malicious traffic inside permitted protocols โ€” DNS tunneling (data in DNS queries), HTTPS tunneling (C2 in normal HTTPS), ICMP tunneling (data in ping packets).
DNS tunneling is popular because DNS is almost always allowed outbound. DNS monitoring and filtering prevents DNS tunneling. HTTPS tunneling requires SSL inspection to detect. High query frequency or unusual DNS response sizes indicate DNS tunneling.
Full Definition โ†’
Full Definition โ†’
What is persistence in post-exploitation? D2 ยท Threats โ–ธ
Persistence techniques survive reboots โ€” scheduled tasks, registry run keys, Windows services, DLL hijacking, cron jobs, SSH authorized_keys, WMI subscriptions, startup folder items.
Autoruns (Sysinternals) shows all persistence points in Windows. Monitor: registry run keys (HKLM/HKCU Run), scheduled tasks, new services, startup directories. EDR alerts on new/modified persistence mechanisms.
Full Definition โ†’
Full Definition โ†’
What is persistence in attacks? D2 ยท Threats โ–ธ
Persistence survives system reboots โ€” registry run keys, scheduled tasks, Windows services, DLL hijacking, WMI subscriptions, SSH authorized_keys, cron jobs.
After initial compromise, establishing persistence is the attacker's first priority. Detection: Autoruns (Sysinternals) shows all Windows persistence points. Monitor for new/modified scheduled tasks, services, and registry run keys. EDR behavioral alerts fire on suspicious persistence establishment.
Full Definition โ†’
Full Definition โ†’
What is port security on switches? D6 ยท Network+ โ–ธ
Port security limits the number of MAC addresses per switch port โ€” preventing MAC flooding and unauthorized devices from connecting.
Sticky learning: port remembers and locks in the first MAC address(es) seen. Violation actions: shutdown (most secure), restrict (drop + log), protect (drop silently). Doesn't replace 802.1X โ€” MAC addresses are spoofable. Use both.
Full Definition โ†’
Full Definition โ†’
What is post-quantum cryptography? D5 ยท Crypto โ–ธ
Post-quantum cryptography (PQC) algorithms resist quantum computer attacks. NIST standardized CRYSTALS-Kyber (key encapsulation) and CRYSTALS-Dilithium (signatures) in 2024.
Quantum computers (Shor's algorithm) will break RSA and ECC when they mature. "Harvest now, decrypt later" attacks are storing today's encrypted traffic for future decryption. Begin migration planning โ€” crypto-agile systems can swap algorithms without full redesign.
Full Definition โ†’
Full Definition โ†’
What is packet analysis for detection? D8 ยท CySA+ โ–ธ
Packet analysis extracts indicators and reconstructs events from network captures โ€” identifying C2 beaconing, data exfiltration, lateral movement, and protocol anomalies.
Zeek (formerly Bro) automatically generates structured logs from packet captures. Suricata/Snort write alerts from PCAP. Zeek connection logs show communication metadata without storing full packets. Full packet capture enables complete forensic reconstruction but requires massive storage.
Full Definition โ†’
Full Definition โ†’
What is proactive defense? D8 ยท CySA+ โ–ธ
Proactive defense assumes attackers are already inside and actively searches for them โ€” through threat hunting, purple teaming, red team exercises, and intelligence-driven detection.
Reactive defense: wait for alerts. Proactive defense: assume breach, go looking. Mean dwell time for APTs is 200+ days โ€” proactive hunting finds them sooner. Intelligence-driven: use TI about specific threat actors targeting your industry to guide hunts.
Full Definition โ†’
Full Definition โ†’
What is pen test methodology? D9 ยท PenTest+ โ–ธ
Standard pen test phases: Planning โ†’ Reconnaissance โ†’ Scanning/Enumeration โ†’ Exploitation โ†’ Post-Exploitation โ†’ Reporting.
PTES (Penetration Testing Execution Standard) and OSSTMM are formal methodologies. Always start with written authorization. Document everything โ€” reports must be reproducible. Post-exploitation demonstrates real business impact (not just technical access). Reporting is the deliverable clients pay for.
Full Definition โ†’
Full Definition โ†’
What is pass-the-ticket? D9 ยท PenTest+ โ–ธ
Pass-the-Ticket (PtT) injects a stolen Kerberos ticket into memory to impersonate the victim user โ€” unlike PtH, uses the actual ticket rather than the password hash.
Mimikatz: sekurlsa::tickets /export + kerberos::ptt [ticket.kirbi]. Requires admin to extract tickets from other sessions. Defense: short ticket lifetimes, Protected Users security group (no cached credentials), Credential Guard. Different from PtH โ€” PtT uses tickets, PtH uses NTLM hashes.
Full Definition โ†’
Full Definition โ†’
What is payload delivery? D9 ยท PenTest+ โ–ธ
Payload delivery methods: phishing (email attachment or link), physical USB drop, watering hole (compromised website), supply chain (compromised update), exploitation (direct RCE).
Email phishing is by far the most common initial access vector in real attacks. Payload delivery is Kill Chain stage 3 (Delivery). msfvenom generates custom payloads for specific architectures and formats (PE, macro, HTA, shellcode). AV evasion is critical at this stage.
Full Definition โ†’
Full Definition โ†’
What is pivoting in pen testing? D9 ยท PenTest+ โ–ธ
Pivoting uses a compromised host as a relay to reach otherwise inaccessible network segments. Metasploit route command, SOCKS proxies, SSH -L/-R/-D forwarding.
Meterpreter: run post/multi/manage/autoroute โ†’ route add [target subnet] 1 โ†’ use auxiliary/scanner/... to scan through the compromised host. Proxychains routes tools through SOCKS proxy. Essential technique for reaching internal-only systems from an initial external foothold.
Full Definition โ†’
Full Definition โ†’
What is pen test reporting? D9 ยท PenTest+ โ–ธ
A pen test report has two audiences: Executive (business risk context, risk ratings, strategic recommendations) and Technical (exact steps to reproduce, evidence, specific remediation guidance).
Each finding needs: description, risk rating (CVSS or custom), evidence (screenshot/PoC), business impact, and specific remediation steps. Never leave findings without remediation guidance. Executive summary: lead with business impact, not technical details. Clients pay for the report โ€” make it excellent.
Full Definition โ†’
Full Definition โ†’
What is PAP vs CHAP vs EAP? D3 ยท Architecture โ–ธ
PAP: sends passwords in cleartext โ€” insecure. CHAP: uses MD5 challenge-response โ€” never sends password. MS-CHAP: Microsoft version (legacy). EAP: extensible framework supporting many methods (TLS, PEAP, etc.).
Never use PAP โ€” cleartext passwords. CHAP is better but MD5 is weak. EAP-TLS (certificate-based) is the gold standard for wireless auth. PEAP (EAP inside TLS tunnel) is the most common enterprise Wi-Fi auth. EAP methods are used inside 802.1X.
Full Definition โ†’
Full Definition โ†’
What is PCI DSS? D1 ยท General โ–ธ
PCI DSS is the payment card industry security standard protecting cardholder data. Key requirements: FW, no default credentials, protect stored data, encrypt transmission, AV, secure systems, access control, monitor, test, security policy.
PCI DSS has 12 requirements. Applies to any organization storing, processing, or transmitting cardholder data. Non-compliance = losing ability to accept card payments + fines. Tokenization removes data from PCI scope. Annual assessment by QSA (Qualified Security Assessor) for large merchants.
Full Definition โ†’
Full Definition โ†’
What is penetration testing? D9 ยท PenTest+ โ–ธ
A penetration test is an authorized simulation of attacks against systems โ€” actively exploiting vulnerabilities to demonstrate real-world impact, unlike a vulnerability scan which only identifies issues.
Pen test โ‰  vulnerability scan. Scanning finds issues; pen testing proves they're exploitable and demonstrates impact. Always requires written authorization (scope, rules of engagement). Types: black box, white box, gray box. Deliverable: detailed report with evidence and remediation guidance.
Full Definition โ†’
Full Definition โ†’
What is phishing? D2 ยท Threats โ–ธ
Phishing uses deceptive emails to steal credentials, install malware, or trick users into performing actions โ€” the #1 initial access vector in breach reports year after year.
Generic phishing: mass-sent, low personalization. Spear phishing: targeted, researched, highly convincing. Whaling: targeting executives. Vishing: phone-based. Defense: email filtering (DMARC, sandboxing), user training with simulations, MFA (makes stolen credentials less valuable). Report suspicious emails, don't just delete them.
Full Definition โ†’
Full Definition โ†’
What is physical security? D1 ยท General โ–ธ
Physical security protects physical access to systems and facilities โ€” perimeter (fences, cameras), building entry (badges, guards, mantraps), and device security (cable locks, locked server rooms).
Physical security is the foundation โ€” all technical controls fail if an attacker has physical access (cold boot, evil maid, hardware keylogger). Tailgating/piggybacking defeats badge controls. Mantraps prevent tailgating. Data center physical security: cage, locked cabinet, biometric access.
Full Definition โ†’
Full Definition โ†’
What is PKI? D5 ยท Crypto โ–ธ
PKI (Public Key Infrastructure) is the system of CAs, certificates, policies, and procedures enabling trust in public keys. Provides: authentication, encryption key distribution, digital signatures.
PKI underpins HTTPS, S/MIME, code signing, smart card auth, and VPN auth. Enterprise PKI: internal root CA (offline) โ†’ intermediate CA (online) โ†’ end-entity certificates. Certificate management is operationally complex โ€” automate with ACME/SCEP where possible.
Full Definition โ†’
Full Definition โ†’
What is packet switching? D6 ยท Network+ โ–ธ
Packet switching breaks data into packets that may take different paths to the destination โ€” each router makes independent forwarding decisions. The basis of the internet (IP/TCP).
Packet switching vs. circuit switching (dedicated path, like traditional PSTN phone). Packet switching: efficient, resilient (route around failures), variable delay. Circuit switching: guaranteed bandwidth and latency, wastes resources when idle. Internet = packet switching. MPLS provides some circuit-switching qualities in packet networks.
Full Definition โ†’
Full Definition โ†’
What is Proxy ARP? D6 ยท Network+ โ–ธ
Proxy ARP allows a router to respond to ARP requests on behalf of hosts in another network โ€” enabling hosts to communicate without knowing the destination is on a different subnet.
Proxy ARP is a security concern โ€” a malicious device can proxy ARP for any IP, redirecting traffic (ARP spoofing via Proxy ARP). Disable Proxy ARP on router interfaces where it's not needed. Modern networks with proper subnet routing don't require Proxy ARP.
Full Definition โ†’
Full Definition โ†’
What is password cracking? D9 ยท PenTest+ โ–ธ
Password cracking recovers plaintext from stolen hashes using: dictionary attacks (wordlists โ€” rockyou.txt), rule-based (mutate words), brute force (all combinations), hybrid (dictionary + brute force).
Hashcat is fastest (GPU-accelerated). John the Ripper is slower but more versatile. Common hash types: NTLM (-m 1000), bcrypt (-m 3200, slow), SHA-256 (-m 1400). Rule-based cracking (best64 rules) cracks far more hashes than wordlists alone. rockyou.txt is the standard wordlist.
Full Definition โ†’
Full Definition โ†’
What is payload obfuscation? D9 ยท PenTest+ โ–ธ
Payload obfuscation modifies payloads to evade AV/EDR signature detection โ€” base64 encoding, XOR encryption, string concatenation, variable substitution, compression.
Obfuscation defeats signature-based detection but not behavioral detection. EDR watching for PowerShell making outbound connections will still fire even if the PowerShell script is heavily obfuscated. Focus obfuscation on static file analysis evasion; assume behavioral detection still catches execution.
Full Definition โ†’
Full Definition โ†’
What are persistence techniques? D9 ยท PenTest+ โ–ธ
Windows persistence: Registry Run keys (HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run), Scheduled Tasks, New Services, DLL hijacking, WMI subscriptions, COM hijacking, Browser extension, Startup folder.
Linux persistence: crontab entries, /etc/profile.d/ scripts, systemd services, ~/.bashrc, SSH authorized_keys, setuid binaries. Document ALL persistence mechanisms found during a pen test โ€” clients need to remove them all. Detection: Autoruns (Windows), systemd unit analysis (Linux), crontab review.
Full Definition โ†’
Full Definition โ†’
What are physical attack techniques? D9 ยท PenTest+ โ–ธ
Physical attack techniques: lock picking/bypass (credit card shimming, bump key), tailgating (following authorized person), RFID cloning (Proxmark3 copies badge), USB drop, hardware implant (network tap, keylogger), social engineering security guards.
Physical pen testing requires very specific written authorization including: target locations, date/time windows, permitted techniques, emergency contact for challenged testers. Always carry authorization letter. Many physical pen testers are detained by security or police โ€” authorization protects you legally.
Full Definition โ†’
Full Definition โ†’
What are post-exploitation objectives? D9 ยท PenTest+ +
Post-exploitation objectives (in authorized pen test): gain admin/domain admin, establish persistence, demonstrate lateral movement capability, access sensitive data (PII, IP, financial), demonstrate exfiltration capability, document entire attack chain.
Post-exploitation should demonstrate business impact, not just technical capability. "We got domain admin" is less impactful than "We got domain admin and demonstrated access to 500,000 customer records and your complete intellectual property." Impact drives remediation prioritization.
Full Definition โ†’
What is quantitative risk assessment? D1 ยท General โ–ธ
Quantitative risk expresses risk in financial terms. Formulas: AV (Asset Value) ร— EF (Exposure Factor) = SLE (Single Loss Expectancy). SLE ร— ARO (Annual Rate of Occurrence) = ALE (Annualized Loss Expectancy).
ALE is used to justify security investments: control cost < ALE reduction = economically justified. Qualitative risk uses categories (High/Medium/Low). Quantitative is more precise but requires data. Most organizations use a combination. Exam: know ALE = SLE ร— ARO.
Full Definition โ†’
Full Definition โ†’
What is QoS (Quality of Service)? D6 ยท Network+ +
QoS prioritizes network traffic โ€” guaranteeing bandwidth and low latency for real-time applications (VoIP, video) over less-sensitive traffic (bulk transfers, backups).
DSCP (Differentiated Services Code Point) marks packets with priority level in IP header. EF (Expedited Forwarding) = highest priority for VoIP. AF (Assured Forwarding) = medium priority. BE (Best Effort) = default. Queue management drops lower-priority packets first during congestion. Security: mark traffic at ingress, enforce at each hop.
Full Definition โ†’
What is regulatory compliance in security? D1 ยท General โ–ธ
Regulatory compliance meets legal and industry security requirements โ€” GDPR (EU data privacy), HIPAA (healthcare), PCI DSS (payment cards), SOX (financial), FISMA (US federal).
Compliance โ‰  security. You can be compliant but insecure, or secure but non-compliant. Compliance sets a floor, not a ceiling. Most frameworks drive meaningful security improvements, but shouldn't replace risk-based thinking.
Full Definition โ†’
Full Definition โ†’
What is Remote Code Execution (RCE)? D2 ยท Threats โ–ธ
RCE allows an attacker to run arbitrary code on a remote system without physical access โ€” the most dangerous vulnerability category. Often results from injection flaws, deserialization, or memory corruption.
RCE = CVSS 10.0 in most cases. Log4Shell, EternalBlue, ProxyLogon โ€” famous RCE vulnerabilities. Patch RCE vulnerabilities immediately. Defense: input validation, WAF, network segmentation to limit blast radius.
Full Definition โ†’
Full Definition โ†’
What is residual risk? D1 ยท General โ–ธ
Residual risk is the risk remaining after security controls have been applied. No system is 100% secure โ€” some risk always remains and must be accepted or addressed further.
Risk treatment options reduce risk to a residual level. Management must formally accept residual risk in writing. Zero residual risk is impossible and not the goal. Document accepted risks in a risk register.
Full Definition โ†’
Full Definition โ†’
What is reverse engineering in security? D9 ยท PenTest+ โ–ธ
Reverse engineering analyzes compiled code to understand its functionality โ€” identifying malware capabilities, vulnerabilities in closed-source software, or protocol specifications.
Tools: Ghidra (free, NSA-developed), IDA Pro (commercial), Radare2 (open source). Malware analysts reverse engineer malware to understand C2 protocols. Fuzzing and RE are complementary vulnerability research techniques.
Full Definition โ†’
Full Definition โ†’
What is risk acceptance? D1 ยท General โ–ธ
Risk acceptance is a formal management decision to acknowledge a risk without further mitigation โ€” when the cost of control exceeds the risk impact, or for temporary situations.
Risk acceptance should be documented, reviewed periodically, and made by appropriate authority level. "We know about it but accept it" without documentation is negligence. Include accepted risks in a risk register.
Full Definition โ†’
Full Definition โ†’
What is Runtime Application Self-Protection (RASP)? D3 ยท Architecture โ–ธ
RASP integrates security directly into application runtime โ€” detecting and blocking attacks in real-time from inside the application, with full context of what's happening.
RASP sees attacks from inside the app (full context) unlike WAF (external). Can terminate malicious function calls. Complements WAF rather than replacing it. Useful for protecting apps you can't rewrite with secure code.
Full Definition โ†’
Full Definition โ†’
What is rapid threat modeling? D4 ยท Operations โ–ธ
Rapid threat modeling applies quick threat analysis in agile development โ€” answering 4 questions: What are we building? What can go wrong? What are we going to do about it? Did we do a good enough job?
Full threat modeling is sometimes impractical for every sprint. OWASP Cornucopia and Elevation of Privilege are card games that make threat modeling accessible to developers. Any threat modeling is better than none.
Full Definition โ†’
Full Definition โ†’
What is root cause analysis in incident response? D4 ยท Operations โ–ธ
Root cause analysis (RCA) identifies the fundamental reason for a security incident โ€” going beyond symptoms to fix the underlying vulnerability or process failure.
"5 Whys" technique: ask why five times to reach root cause. RCA prevents recurrence. Incident = patch one system. RCA = fix the class of vulnerabilities. Post-incident review should always include RCA.
Full Definition โ†’
Full Definition โ†’
What is responsible vulnerability disclosure? D4 ยท Operations โ–ธ
Responsible disclosure reports vulnerabilities to the vendor privately, giving them time to patch before public disclosure โ€” typically 90 days (Google Project Zero standard).
Full immediate disclosure creates immediate risk for unpatched users. No disclosure lets vendors ignore vulnerabilities indefinitely. 90-day coordinated disclosure balances vendor time with public risk. Bug bounty programs formalize this relationship.
Full Definition โ†’
Full Definition โ†’
What is Remote Code Execution (RCE)? D2 ยท Threats โ–ธ
RCE allows attackers to run arbitrary code on a remote system without physical access โ€” the most dangerous vulnerability category. Often results from injection, deserialization, or memory corruption.
RCE = near-universal CVSS 9.8-10.0. Log4Shell, EternalBlue, ProxyLogon โ€” famous RCE CVEs. Patch RCE vulnerabilities immediately. Defense in depth limits impact even after RCE (network segmentation, least privilege app accounts).
Full Definition โ†’
Full Definition โ†’
What is recovery in incident response? D8 ยท CySA+ โ–ธ
Recovery restores affected systems to normal operation โ€” safely, verifying clean status, and monitoring for signs of reinfection before considering the incident closed.
Don't rush recovery โ€” verify eradication is complete first. Reimage from known-good images when possible (don't trust cleaned systems for critical assets). Monitor closely for 30 days post-recovery. Validate controls that should have prevented the incident are now in place.
Full Definition โ†’
Full Definition โ†’
What is risk scoring in vulnerability management? D8 ยท CySA+ โ–ธ
Risk scoring combines CVSS with context: asset criticality (business importance), exposure (internet-facing?), exploit availability (CISA KEV?), and compensating controls โ€” producing a business-contextualized priority.
CVSS measures technical severity. Risk score measures business risk. A CVSS 10 on an isolated dev server < CVSS 7 on the public payment portal. VPR (Vulnerability Priority Rating) from Tenable incorporates threat intelligence into scoring.
Full Definition โ†’
Full Definition โ†’
What is reconnaissance in pen testing? D9 ยท PenTest+ โ–ธ
Reconnaissance is the intelligence gathering phase โ€” passive (OSINT, no target interaction) and active (scanning, direct probing). Foundation of all subsequent attack phases.
Passive: WHOIS, DNS, Shodan, social media, LinkedIn, job postings, GitHub, certificate transparency. Active: Nmap, web crawling, banner grabbing. Invest heavily in recon โ€” understanding the target well leads to more efficient and successful exploitation. "Know your enemy."
Full Definition โ†’
Full Definition โ†’
What is RAID? D4 ยท Operations โ–ธ
RAID levels: 0 (striping, performance, no fault tolerance), 1 (mirroring, fault tolerant), 5 (striping + parity, 1 disk failure tolerant), 6 (2 parity disks, 2 failures tolerant), 10 (mirrored stripes).
RAID is NOT a backup โ€” it protects against hardware failure, not accidental deletion, malware, or site disaster. RAID 1 or 10 for databases (performance + redundancy). RAID 5/6 for storage (capacity efficient). Always combine RAID with offsite backups.
Full Definition โ†’
Full Definition โ†’
What is ransomware? D2 ยท Threats โ–ธ
Ransomware encrypts victim files and demands payment for the decryption key. Modern variants: double extortion (encrypt + steal data), RaaS (Ransomware-as-a-Service), targeting backups.
Defense: offline/immutable backups (attackers target online backups), email/web filtering (infection vectors), EDR (behavioral detection of encryption), network segmentation (limit spread), MFA (prevent credential-based initial access). Recovery without paying: backup restoration + forensics. Never guarantee paying recovers data.
Full Definition โ†’
Full Definition โ†’
What is Role-Based Access Control (RBAC)? D1 ยท General โ–ธ
RBAC assigns permissions to roles, and users are assigned to roles โ€” enabling consistent permission management at scale. Adding a user to a role grants all associated permissions.
RBAC is the most practical access control model for enterprise. Well-designed roles reflect job functions. Principle: users should hold minimum necessary roles. Role explosion (hundreds of tiny roles) defeats the purpose โ€” balance granularity with manageability. Active Directory groups implement RBAC in Windows environments.
Full Definition โ†’
Full Definition โ†’
What is risk management? D1 ยท General โ–ธ
Risk management: Identify risks โ†’ Analyze (likelihood ร— impact) โ†’ Treat (accept/transfer/avoid/mitigate) โ†’ Monitor and Review. Document in risk register.
Treatment options: Avoid (eliminate the risky activity), Mitigate (reduce likelihood/impact with controls), Transfer (insurance, contracts), Accept (document and acknowledge). No treatment = negligence. Risk management is an ongoing process โ€” risks change as the environment changes.
Full Definition โ†’
Full Definition โ†’
What is risk transfer? D1 ยท General โ–ธ
Risk transfer shifts financial consequences to a third party โ€” cyber insurance (covers breach costs), contracts with SLA and liability clauses, outsourcing to managed service providers with security SLAs.
Insurance covers financial consequences but NOT the reputation damage, regulatory fines (mostly), or technical remediation. Cyber insurance requires minimum security controls for coverage. Review exclusions โ€” many policies exclude nation-state attacks or unpatched known vulnerabilities.
Full Definition โ†’
Full Definition โ†’
What is role-based security training? D1 ยท General โ–ธ
Role-based training tailors security content to specific roles โ€” developers get secure coding training, admins get privileged access management training, executives get social engineering/BEC training.
Generic annual awareness training has low effectiveness. Role-based training with relevant scenarios achieves better behavior change. Developers who understand injection attacks write code that prevents them. Executives who understand BEC recognize and reject fraudulent wire transfer requests.
Full Definition โ†’
Full Definition โ†’
What are RPO and RTO? D4 ยท Operations โ–ธ
RPO (Recovery Point Objective): maximum acceptable data loss (how old can the backup be?). RTO (Recovery Time Objective): maximum acceptable downtime (how fast must systems restore?).
RPO drives backup frequency: RPO = 1 hour โ†’ backup every hour. RTO drives recovery architecture: RTO = 15 min โ†’ hot standby needed. Lower RPO/RTO = higher cost. BIA identifies business-critical systems needing the lowest RPO/RTO. Document both for every critical system.
Full Definition โ†’
Full Definition โ†’
What is RDP security? D6 ยท Network+ โ–ธ
RDP security: use NLA (Network Level Authentication) for pre-authentication, restrict to VPN access only (don't expose port 3389 to internet), strong passwords + MFA, just-in-time access.
Internet-exposed RDP is the #1 ransomware entry point. Millions of RDP servers brute-forced daily. Immediate action: move RDP behind VPN. NLA requires Windows authentication before establishing RDP session. Bluekeeper (CVE-2019-0708) โ€” critical unauthenticated RDP RCE. Patch and restrict access.
Full Definition โ†’
Full Definition โ†’
What is ransomware incident response? D8 ยท CySA+ +
Ransomware IR steps: Isolate affected systems โ†’ Assess scope (how many systems?) โ†’ Identify variant (ransom note, extension) โ†’ Locate clean backups โ†’ Notify legal/insurance/law enforcement โ†’ Restore from backup โ†’ Root cause analysis โ†’ Remediate entry point.
Never pay ransom without involving legal counsel. Paying doesn't guarantee decryption. Double extortion: even after paying, stolen data threat remains. Backup viability is the #1 factor in ransomware response success. Test backups regularly โ€” discovering they're corrupted during a ransomware incident is catastrophic.
Full Definition โ†’
What is secure error handling? D2 ยท Threats โ–ธ
Secure error handling shows users generic error messages while logging detailed errors internally โ€” preventing information disclosure through verbose error messages that reveal software internals.
Detailed error messages (stack traces, SQL errors, server versions) help attackers. Never expose technical details to end users. Log detailed errors server-side; show users friendly generic messages.
Full Definition โ†’
Full Definition โ†’
What is sandbox evasion? D2 ยท Threats โ–ธ
Sandbox evasion techniques allow malware to detect and avoid execution in analysis sandboxes โ€” sleeping for extended periods, checking for VMs, requiring mouse movement, detecting sandbox artifacts.
Sophisticated malware detects sandbox environments and remains dormant. Defenses: use stealthier sandboxes, extend analysis time, emulate human interaction. Some malware only detonates in specific environments (domain-joined, specific locale).
Full Definition โ†’
Full Definition โ†’
What is security by design? D3 ยท Architecture โ–ธ
Security by design integrates security from the beginning of development โ€” secure defaults, minimal attack surface, threat modeling, input validation built-in rather than bolted on.
"Bolt-on" security (added after development) is expensive and less effective. Security by design = security built into architecture, code, and deployment from day one. "Secure by default" means the safe configuration requires no effort from users.
Full Definition โ†’
Full Definition โ†’
What is SSH (Secure Shell)? D3 ยท Architecture โ–ธ
SSH provides encrypted remote command-line access, file transfer (SFTP/SCP), and port forwarding. Replaces insecure Telnet, rsh, and rlogin. Port 22.
Always use key-based SSH authentication โ€” disable password authentication. Restrict SSH to specific source IPs. Use a jump host (bastion server) for SSH to production systems. Port 22 attacks are constant โ€” consider changing the port (security through obscurity but reduces automated attacks).
Full Definition โ†’
Full Definition โ†’
What are SIEM use cases? D4 ยท Operations โ–ธ
Key SIEM use cases: brute force detection (multiple failed logins), lateral movement (unusual authentication between internal hosts), privilege escalation (unexpected admin activities), data exfiltration (unusual outbound transfers).
SIEM is only as good as its tuning. Start with high-fidelity use cases (low false positives). Use MITRE ATT&CK to map detection coverage. Review alerts regularly โ€” alert fatigue from unchecked SIEM destroys its value.
Full Definition โ†’
Full Definition โ†’
What is security orchestration? D4 ยท Operations โ–ธ
Security orchestration connects security tools via APIs to automate workflows โ€” SIEM detects โ†’ SOAR queries threat intel โ†’ isolates endpoint โ†’ creates ticket โ†’ notifies analyst.
Orchestration reduces MTTR (Mean Time to Respond). Automate repetitive Tier 1 tasks (IOC lookups, sandboxing samples, blocking known-bad IPs). Free analysts for higher-value work that requires judgment.
Full Definition โ†’
Full Definition โ†’
What is Server-Side Request Forgery (SSRF)? D2 ยท Threats โ–ธ
SSRF tricks a server into making requests to internal resources โ€” accessing cloud metadata APIs (AWS IMDS), internal services, or reading local files via the server's perspective.
SSRF in cloud environments can expose IAM credentials via the metadata service (169.254.169.254). AWS IMDSv2 (token-based) mitigates SSRF against the metadata service. SSRF was used in the Capital One breach (2019).
Full Definition โ†’
Full Definition โ†’
What is session fixation? D2 ยท Threats โ–ธ
Session fixation sets a known session ID before the victim authenticates โ€” after login, the attacker uses the pre-set ID to hijack the session.
Prevention: generate a new session ID after successful authentication. This invalidates any pre-authentication session ID. Session fixation is different from session hijacking (stealing an existing session).
Full Definition โ†’
Full Definition โ†’
What is session hijacking? D2 ยท Threats โ–ธ
Session hijacking steals a valid session token โ€” via XSS, network sniffing, or MITM โ€” to impersonate an authenticated user without knowing their password.
Prevention: HTTPS everywhere (prevents sniffing), HttpOnly+Secure cookie flags, short session timeouts, re-authentication for sensitive actions, IP binding (partial โ€” breaks legitimate roaming).
Full Definition โ†’
Full Definition โ†’
What is Shodan? D7 ยท Tools โ–ธ
Shodan searches internet-connected devices โ€” exposed databases, industrial control systems, webcams, routers, VPNs with default credentials. "Google for hackers."
Your organization is discoverable on Shodan. Search your IP ranges to see what attackers see. Exposed industrial systems on Shodan are a major finding. Run Shodan queries on your assets as part of external attack surface management.
Full Definition โ†’
Full Definition โ†’
What is SMB and its security risks? D6 ยท Network+ โ–ธ
SMB (Server Message Block) provides file and printer sharing in Windows. Security risks: EternalBlue exploit (WannaCry), null sessions, relay attacks (NTLM relay).
Disable SMB v1 (still present by default on some systems โ€” enabled EternalBlue/WannaCry). Enable SMB signing to prevent relay attacks. Restrict SMB (port 445) at the firewall โ€” block external access.
Full Definition โ†’
Full Definition โ†’
What is social media OSINT? D9 ยท PenTest+ โ–ธ
Social media OSINT harvests information for reconnaissance โ€” LinkedIn reveals org structure, job titles, tech stack; Instagram/Facebook reveals personal details for spear phishing pretexts.
Attackers research targets before engaging. Job postings reveal technologies used ("We use AWS, Kubernetes, and Splunk"). LinkedIn provides names for pretexting and email format guessing. Security training should address social media oversharing.
Full Definition โ†’
Full Definition โ†’
What is Software Composition Analysis (SCA)? D4 ยท Operations โ–ธ
SCA automatically identifies open-source libraries and third-party components in code, mapping them against CVE databases to detect vulnerable dependencies.
Most code is open-source dependencies โ€” SCA is essential. Tools: Snyk, WhiteSource, Black Duck, GitHub Dependabot. 78% of codebases contain at least one known vulnerability in a dependency. SCA is the automated SBOM creator.
Full Definition โ†’
Full Definition โ†’
What is split DNS? D6 ยท Network+ โ–ธ
Split DNS maintains separate DNS zones for internal and external views โ€” internal users get private IP addresses; external users get public IPs for the same domain names.
Prevents external users from seeing internal IP addresses and hostnames. Commonly implemented with separate internal DNS servers. Split-brain DNS is another name for the same concept.
Full Definition โ†’
Full Definition โ†’
What is SQL Server security hardening? D4 ยท Operations โ–ธ
SQL Server hardening: disable SA account, use Windows authentication (not SQL auth), enable TDE, enable audit logs, least privilege for application accounts, disable xp_cmdshell, patch regularly.
xp_cmdshell provides OS command execution from SQL โ€” disable unless explicitly needed. Application accounts should only have SELECT/INSERT/UPDATE on needed tables โ€” not db_owner. TDE encrypts database files at rest.
Full Definition โ†’
Full Definition โ†’
What is SSL stripping? D2 ยท Threats โ–ธ
SSL stripping downgrades HTTPS connections to HTTP โ€” the MITM intercepts the HTTPS connection to the server and serves HTTP to the victim, who never gets the secure connection.
HSTS (HTTP Strict Transport Security) prevents SSL stripping by telling browsers to ALWAYS use HTTPS for a domain. HSTS preloading bakes domains into browsers. Without HSTS, the first HTTP request is vulnerable.
Full Definition โ†’
Full Definition โ†’
What is static code analysis? D4 ยท Operations โ–ธ
Static code analysis (SAST) scans source code without executing it โ€” finding hardcoded credentials, injection flaws, buffer overflows, and insecure function calls automatically.
SAST integrates into IDEs and CI/CD pipelines. Finds bugs early (cheapest fix). High false positive rate needs tuning. Doesn't find runtime/config issues (DAST's strength). Defense: make SAST a quality gate in the CI pipeline.
Full Definition โ†’
Full Definition โ†’
What is supply chain risk management? D1 ยท General โ–ธ
Supply chain risk covers threats from vendors, contractors, software components, and hardware โ€” any trusted third party that could be compromised to attack you.
SolarWinds and Log4Shell demonstrated supply chain risk scale. Controls: vendor security assessments, SBOM, code signing verification, minimum necessary access for vendors, monitoring vendor connections.
Full Definition โ†’
Full Definition โ†’
What is security offboarding? D1 ยท General โ–ธ
Security offboarding immediately revokes all access upon employee termination โ€” disabling accounts, revoking certificates, returning equipment, and preserving evidence if termination is involuntary.
Immediate revocation is critical โ€” angry ex-employees can cause significant damage. Disable AD account โ†’ revoke SSO/VPN โ†’ change shared credentials โ†’ collect equipment โ†’ preserve email/files. Do it on their last day, not days later.
Full Definition โ†’
Full Definition โ†’
What is SaaS security? D3 ยท Architecture โ–ธ
SaaS security responsibilities: user access management, data classification, MFA enforcement, SSO integration, CASB for shadow IT/DLP, monitoring API access, and data export controls.
In SaaS, the vendor secures the application and infrastructure. You secure your data and user access. Enable SSO (easier MFA enforcement), CASB (DLP and shadow IT), and audit logs. Review third-party app OAuth permissions regularly.
Full Definition โ†’
Full Definition โ†’
What is SCAP? D4 ยท Operations โ–ธ
SCAP (Security Content Automation Protocol) is a NIST standard for automated vulnerability/compliance checking using standardized formats (XCCDF for checklists, OVAL for vulnerability definitions).
SCAP enables automated compliance scanning against CIS Benchmarks and DISA STIGs. Tools: OpenSCAP, Nessus, RHEL Compliance. STIG (Security Technical Implementation Guide) = DoD-specific hardening checklists in SCAP format.
Full Definition โ†’
Full Definition โ†’
What is secrets management? D4 ยท Operations โ–ธ
Secrets management centralizes storage and access to API keys, passwords, certificates, and tokens โ€” providing access control, audit logs, rotation, and dynamic short-lived credentials.
HashiCorp Vault is the dominant open-source secrets manager. AWS Secrets Manager, Azure Key Vault are cloud-native options. Dynamic secrets (generated on demand, short-lived) are more secure than static credentials. Never store secrets in code or environment variables.
Full Definition โ†’
Full Definition โ†’
What is security by obscurity? D1 ยท General โ–ธ
Security by obscurity relies on keeping implementation details secret โ€” hiding services, changing default ports, using proprietary algorithms. Insufficient as a primary security control.
Kerckhoffs's principle: a system should be secure even if everything about it (except the key) is public knowledge. Obscurity can be a defense-in-depth layer but must never be the primary control. Open standards (AES, TLS) withstand public scrutiny โ€” proprietary schemes don't.
Full Definition โ†’
Full Definition โ†’
What is security theater? D1 ยท General โ–ธ
Security theater implements visible security measures that provide the appearance of security without meaningful risk reduction โ€” purely for compliance or public reassurance.
Examples: removing shoes at airports, password complexity rules that create predictable patterns (Password1!), annual security training with zero behavior change. Security theater wastes resources and creates false confidence. Measure security outcomes, not activity.
Full Definition โ†’
Full Definition โ†’
What is sensitive data exposure? D2 ยท Threats โ–ธ
Sensitive data exposure occurs when sensitive information (PII, PHI, financial data) is inadequately protected โ€” transmitted in cleartext, stored without encryption, or exposed through weak access controls.
OWASP Top 10 #2 (2021: Cryptographic Failures). Prevention: encrypt at rest and in transit, use strong algorithms, implement proper key management, minimize data collection, classify data and apply appropriate controls.
Full Definition โ†’
Full Definition โ†’
What is shadow IT? D1 ยท General โ–ธ
Shadow IT is technology used within organizations without IT/security knowledge or approval โ€” employees using personal Dropbox, free Slack teams, unapproved cloud services for work.
CASB solutions discover shadow IT by analyzing traffic and DNS queries. Shadow IT creates data loss, compliance, and security risks (data in unmanaged services). Address via approved app catalogs and user-friendly alternatives to the services employees want to use.
Full Definition โ†’
Full Definition โ†’
What is shimming in malware? D2 ยท Threats โ–ธ
Shimming uses Windows Application Compatibility framework to inject DLLs into processes โ€” legitimate for compatibility but abused for malware persistence and API hooking.
Malicious shims survive reboots and OS updates (installed via legitimate mechanisms). Detection: monitor for unusual shim database modifications. Sdbinst.exe installs shims โ€” alert on its unexpected execution. Used by nation-state malware for persistence.
Full Definition โ†’
Full Definition โ†’
What is SIEM architecture? D4 ยท Operations โ–ธ
SIEM architecture: Data collection โ†’ Normalization (common schema) โ†’ Aggregation โ†’ Correlation engine โ†’ Alerting โ†’ Storage โ†’ Analytics dashboard. Scalability: distributed vs. centralized.
SIEM performance scales with data volume โ€” plan storage and compute accordingly. EPS (Events Per Second) is the primary sizing metric. Normalization (parsing different log formats) is critical โ€” poor parsing = missed detections.
Full Definition โ†’
Full Definition โ†’
What is SNMP and its security risks? D6 ยท Network+ โ–ธ
SNMP monitors and manages network devices. v1/v2c use cleartext community strings (default 'public'). SNMPv3 adds authentication and encryption โ€” the only secure version.
SNMPv1/v2c community strings are transmitted in cleartext โ€” trivially sniffed. Default 'public' community string exposes device configuration. Always use SNMPv3 with auth+privacy mode. Block SNMP (UDP 161/162) from external access.
Full Definition โ†’
Full Definition โ†’
What is Software-Defined Networking (SDN) security? D3 ยท Architecture โ–ธ
SDN separates the control plane (software) from the data plane (hardware) โ€” enabling programmable, centralized network management. Enables micro-segmentation and dynamic policy enforcement.
SDN controller is a high-value target โ€” compromise = control entire network. SDN enables zero trust networking through fine-grained policy control. NSX (VMware), Cisco ACI are common enterprise SDN platforms.
Full Definition โ†’
Full Definition โ†’
What is Same-Origin Policy (SOP)? D2 ยท Threats โ–ธ
Same-Origin Policy (SOP) prevents JavaScript from making requests to a different origin (scheme + domain + port) โ€” a fundamental browser security control preventing XSS cross-site data theft.
CORS (Cross-Origin Resource Sharing) is the controlled mechanism to relax SOP. A wildcard CORS policy (Access-Control-Allow-Origin: *) on sensitive APIs is a critical vulnerability. SOP is why XSS is dangerous โ€” it bypasses SOP.
Full Definition โ†’
Full Definition โ†’
What is STIX and TAXII? D4 ยท Operations โ–ธ
STIX (Structured Threat Information eXpression) is a JSON format for threat intelligence. TAXII (Trusted Automated eXchange of Indicator Information) is the transport protocol for sharing STIX data.
STIX + TAXII = the standard for machine-readable TI sharing. ISACs use TAXII servers to distribute sector-specific TI. SIEM integrations consume STIX bundles to automatically create detection rules. More durable than manual IoC sharing.
Full Definition โ†’
Full Definition โ†’
What is subdomain enumeration? D9 ยท PenTest+ โ–ธ
Subdomain enumeration discovers all subdomains of a target domain โ€” revealing forgotten servers, dev environments, internal tools, and attack surface. Tools: Amass, dnsx, sublist3r, certificate transparency logs.
Certificate transparency logs reveal subdomains without scanning. Forgotten subdomains (old.company.com, dev.company.com) often have weaker security. Regular attack surface management should include subdomain enumeration of your own domains.
Full Definition โ†’
Full Definition โ†’
What is security telemetry? D4 ยท Operations โ–ธ
Security telemetry is the data collected from endpoints, networks, and applications for security monitoring โ€” process execution, network connections, file changes, authentication events.
More telemetry = better detection, but also more storage and analysis cost. Prioritize: authentication logs, network traffic metadata, process execution, and DNS queries โ€” highest signal-to-noise. Less valuable: routine system calls, disk I/O.
Full Definition โ†’
Full Definition โ†’
What is stored XSS vs reflected XSS? D2 ยท Threats โ–ธ
๐Ÿ”ด Stored XSS: malicious script saved to server database โ€” executes for every user who loads the page. Most dangerous.
๐ŸŸก Reflected XSS: script in URL โ€” requires victim to click malicious link.
๐Ÿ”ต DOM XSS: no server involvement โ€” client-side JavaScript vulnerability.
Stored XSS = persistent, affects all visitors. Reflected XSS = victim must click link. DOM XSS = hardest to detect (no server-side indicators). Prevention: output encoding for all user input displayed back to users.
Full Definition โ†’
Full Definition โ†’
What is secure coding? D2 ยท Threats โ–ธ
Key practices: input validation (whitelist), parameterized queries (prevent SQLi), output encoding (prevent XSS), proper error handling (no stack traces to users), no hardcoded credentials, least privilege for application accounts.
OWASP Cheat Sheet Series covers each practice in detail. SAST finds secure coding violations in code. Code reviews catch issues SAST misses. Security training for developers prevents more vulnerabilities than any scanner.
Full Definition โ†’
Full Definition โ†’
What is SSH? D3 ยท Architecture โ–ธ
SSH provides encrypted remote access, file transfer (SFTP/SCP), and tunneling. Replaces insecure Telnet. Key-based authentication is more secure than passwords.
Disable SSH password authentication (key-based only). Restrict SSH to jump/bastion hosts โ€” no direct SSH to production. Rate limit and monitor SSH logins. Fail2ban blocks brute-force SSH attempts automatically. Change default port reduces automated attacks.
Full Definition โ†’
Full Definition โ†’
What is security awareness training? D1 ยท General โ–ธ
Security awareness training changes employee behavior to reduce human error โ€” the leading cause of breaches. Effective programs use phishing simulations, role-based content, and measured outcomes.
Most cost-effective security investment. Phishing simulations with immediate training on failure produce measurable improvement. On the exam: reducing social engineering risk = security awareness training. Annual training isn't enough โ€” make it continuous.
Full Definition โ†’
Full Definition โ†’
What are security control types? D1 ยท General โ–ธ
Control categories by nature: Technical (firewall, AV, encryption), Administrative (policies, training, procedures), Physical (locks, guards, cameras). By function: Preventive, Detective, Corrective, Deterrent, Recovery, Compensating.
Both categorization systems appear on exams. A camera is Physical + Detective + Deterrent simultaneously. MFA is Technical + Preventive. Security awareness training is Administrative + Preventive. Understand overlaps.
Full Definition โ†’
Full Definition โ†’
What is source code review? D4 ยท Operations โ–ธ
Source code review examines code for security vulnerabilities โ€” manual (expert review) and automated (SAST tools). Finds issues before deployment at the lowest remediation cost.
Manual review finds logic flaws that SAST misses. SAST finds common patterns at scale. Both are needed. Security-focused code review checklists ensure consistent coverage. Developer training is the most scalable fix โ€” teach developers to write secure code.
Full Definition โ†’
Full Definition โ†’
What is Spanning Tree Protocol security? D6 ยท Network+ โ–ธ
STP security features: PortFast (skip STP for end devices โ€” fast connection), BPDUGuard (disable port if BPDU received โ€” prevents rogue switches), RootGuard (prevents root bridge election manipulation).
Attackers can inject superior BPDUs to become root bridge, enabling traffic interception. BPDUGuard prevents this on access ports. Enable PortFast + BPDUGuard on all access switch ports (not trunk ports). Enable RootGuard on uplink ports.
Full Definition โ†’
Full Definition โ†’
What is supply chain security? D1 ยท General โ–ธ
Supply chain security addresses threats from vendors, software components, and hardware โ€” any trusted third party that could be compromised to attack you.
SolarWinds: malicious code in Orion software update โ†’ 18,000+ organizations compromised. Log4Shell: one library used everywhere โ†’ global impact. Controls: SBOM, code signing verification, vendor risk assessments, SCA tools in CI/CD.
Full Definition โ†’
Full Definition โ†’
What is Spanning Tree Protocol (STP)? D6 ยท Network+ โ–ธ
STP prevents switching loops by disabling redundant paths โ€” electing a root bridge and blocking non-optimal paths. RSTP (Rapid STP) converges much faster than legacy STP.
Without STP, switching loops cause broadcast storms that take down networks. Root bridge election: lowest bridge ID (priority + MAC). BPDUGuard shuts down ports that receive BPDUs (prevents rogue switch attacks). Enable PortFast on edge ports for faster client connections.
Full Definition โ†’
Full Definition โ†’
What is security log analysis? D8 ยท CySA+ โ–ธ
Security log analysis parses, normalizes, and correlates log data from multiple sources to identify threats, investigate incidents, and meet compliance requirements.
Key log sources: Windows Security events, Syslog, firewall/IDS logs, web server logs, DNS logs, authentication logs (AD/RADIUS). Normalize timestamps (UTC). SIEM aggregates and correlates. Analysts write SPL/KQL queries for investigation.
Full Definition โ†’
Full Definition โ†’
What are security metrics? D8 ยท CySA+ โ–ธ
Key metrics: MTTD (Mean Time to Detect), MTTR (Mean Time to Respond/Remediate), patch SLA compliance %, % critical vulns remediated, phishing click rate, alert volume trend.
Metrics drive improvement. MTTD: how fast you detect breaches. MTTR: how fast you respond. Track trends โ€” improving over time matters more than absolute values. Executive reporting: translate technical metrics into business risk language (cost of data breach, regulatory exposure).
Full Definition โ†’
Full Definition โ†’
What is Sigma? D8 ยท CySA+ โ–ธ
Sigma is a generic, vendor-neutral detection rule format for log-based detections โ€” write once, convert to any SIEM (Splunk SPL, Microsoft KQL, Elastic EQL, etc.).
Sigma enables sharing detection rules across the community. GitHub has thousands of community-contributed Sigma rules. pySigma and sigmac convert to platform-specific queries. Combine with ATT&CK mapping for comprehensive detection coverage.
Full Definition โ†’
Full Definition โ†’
What are SOC tiers? D8 ยท CySA+ โ–ธ
Tier 1: alert triage, basic analysis, escalation. Tier 2: deeper investigation, incident handling, malware analysis. Tier 3: threat hunting, advanced forensics, detection engineering, threat intelligence.
Most SIEM alerts go to Tier 1. SOAR automation handles the most repetitive Tier 1 tasks. Tier 2/3 analysts write the detection rules that feed Tier 1. Career path: Tier 1 โ†’ Tier 2 โ†’ Tier 3 โ†’ Specialty (forensics, threat intel, red team).
Full Definition โ†’
Full Definition โ†’
What is service exploitation? D9 ยท PenTest+ โ–ธ
Service exploitation identifies running services, fingerprints versions, looks up CVEs, and exploits vulnerabilities โ€” the core of network pen testing.
Workflow: Nmap -sV โ†’ identify service versions โ†’ searchsploit [service version] โ†’ Metasploit search โ†’ set options โ†’ exploit. Always try default credentials first (faster, less noisy than exploitation). Document every service tested even if no vulnerability found.
Full Definition โ†’
Full Definition โ†’
What is social engineering testing? D9 ยท PenTest+ โ–ธ
Social engineering testing simulates phishing campaigns, vishing calls, and physical access attempts โ€” measuring human security awareness and testing technical controls (email filters, MFA).
Phishing simulation: craft targeted spear phishing emails โ†’ send to approved target list โ†’ track opens/clicks/credential submissions โ†’ report results with training. Always have explicit written authorization including specific target lists. Never include non-authorized targets even accidentally.
Full Definition โ†’
Full Definition โ†’
What is SQL injection exploitation? D9 ยท PenTest+ โ–ธ
SQLi exploitation types: Error-based (extract via error messages), Union-based (join additional SELECT), Boolean-based (infer data from true/false responses), Time-based blind (SLEEP() delays confirm injection).
sqlmap automates SQLi detection and exploitation. Manual: ' or 1=1-- in login fields. Union injection: ' UNION SELECT username,password FROM users-- . Always test with sqlmap --level=5 --risk=3 for comprehensive testing. SQLi can dump entire databases, bypass auth, and in some configs, achieve RCE via INTO OUTFILE or xp_cmdshell.
Full Definition โ†’
Full Definition โ†’
What is Secure Boot? D3 ยท Architecture โ–ธ
Secure Boot verifies cryptographic signatures of bootloaders and OS kernels before execution โ€” preventing unsigned/malicious boot software from running even with physical access.
Secure Boot is part of UEFI specification. Root of trust: UEFI firmware (signed by manufacturer) โ†’ Secure Boot verifies bootloader โ†’ bootloader verifies OS. Required for Windows 11. BitLocker + Secure Boot + TPM provides strong protection against boot-level attacks.
Full Definition โ†’
Full Definition โ†’
What are security control frameworks? D1 ยท General โ–ธ
Key frameworks: NIST CSF (5 functions: Identify/Protect/Detect/Respond/Recover โ€” voluntary, widely adopted), ISO 27001 (certifiable ISMS), CIS Controls (prescriptive 18 controls), COBIT (IT governance).
NIST CSF = principles-based, widely used in US. ISO 27001 = certifiable, international recognition. CIS Controls = prescriptive and actionable (tells you exactly what to do). Start with NIST CSF for program structure, CIS Controls for specific implementation guidance.
Full Definition โ†’
Full Definition โ†’
What is SSL/TLS inspection? D3 ยท Architecture โ–ธ
SSL/TLS inspection decrypts HTTPS at a proxy, inspects for threats (malware, DLP), and re-encrypts before forwarding. Requires a trusted CA cert deployed to all clients.
Privacy implications: employer sees all decrypted HTTPS traffic. Legal considerations in some jurisdictions. Breaking certificate pinning causes app failures. Typically exclude: banking, healthcare, HR systems. GDPR: inform employees and document the processing. Balance security visibility vs. privacy.
Full Definition โ†’
Full Definition โ†’
What is security governance? D1 ยท General โ–ธ
Security governance provides leadership direction for security โ€” defining strategy, accountability, policy, and risk appetite. Board/executive responsibility, not just IT.
Governance sets the tone from the top. Without executive commitment, security programs fail. CISO reports to CEO or Board for independence. Governance outputs: security strategy, risk appetite statement, policy framework, security metrics for executive reporting.
Full Definition โ†’
Full Definition โ†’
What is secure UX design? D1 ยท General โ–ธ
Secure UX design makes secure choices the easy choices โ€” default settings are secure, warnings are meaningful (not cry-wolf), and required actions align with user intuition.
"Security theater" wastes user attention on low-value security theater (CAPTCHAs on low-risk actions) while missing high-risk moments. Users click through warnings when they see too many. Reserve security friction for genuinely risky actions. Secure defaults eliminate opt-in security problems.
Full Definition โ†’
Full Definition โ†’
What is SAML? D1 ยท General โ–ธ
SAML 2.0 is the dominant enterprise web SSO standard โ€” enabling federated authentication between an Identity Provider (IdP) and Service Provider (SP). XML-based assertions contain user identity and attributes.
SAML flow: user accesses SP โ†’ redirect to IdP โ†’ authenticate โ†’ IdP sends signed SAML assertion โ†’ SP validates assertion โ†’ access granted. IdP = where authentication happens (AD FS, Okta, Azure AD). SP = the application (Salesforce, AWS, ServiceNow).
Full Definition โ†’
Full Definition โ†’
What is SAST vs DAST? D4 ยท Operations โ–ธ
SAST (Static): analyzes source code without running โ€” finds injection flaws, hardcoded credentials early in SDLC. DAST (Dynamic): tests running application โ€” finds runtime issues, server-side auth flaws, configuration problems.
SAST + DAST are complementary. SAST: earlier, cheaper to fix, high false positive rate, needs source code. DAST: more realistic, finds runtime issues, no source code needed, misses logic inside functions. Both should be in CI/CD pipeline. IAST (Interactive) combines both approaches.
Full Definition โ†’
Full Definition โ†’
What are security zones? D3 ยท Architecture โ–ธ
Security zones classify network segments by trust level: Untrusted (internet), DMZ (semi-trusted, public-facing), Trusted (internal), Restricted (highest security โ€” PCI, HR, executive).
Traffic rules between zones enforce least privilege networking. DMZ โ†’ Internal requires explicit permit. Traffic moves from lower-trust to higher-trust = stricter inspection. Micro-segmentation extends zones to individual workloads. East-west traffic (intra-zone) should also be inspected in zero trust architectures.
Full Definition โ†’
Full Definition โ†’
What is separation of duties? D1 ยท General โ–ธ
Separation of duties (SoD) requires multiple people to complete sensitive transactions โ€” no single person can both initiate and approve a wire transfer, deploy code and approve it, or both create and audit accounts.
SoD prevents insider fraud that requires both authorization steps. Finance: different people authorize and execute payments. IT: different people write and approve code deployments. Combined with dual control (two people must act together): absolute strongest control against insider threats.
Full Definition โ†’
Full Definition โ†’
What is social media security awareness? D1 ยท General โ–ธ
Social media security awareness addresses: oversharing personal information (social engineering material), organizational information disclosure (technology stack, security measures), and account security (strong passwords, MFA).
Employees posting about work projects, tools used, or business travel provide attackers with spear phishing material. LinkedIn reveals org chart, job roles, and technologies. Policy: what's acceptable to share about work online? Training should include specific social media examples.
Full Definition โ†’
Full Definition โ†’
What is SOAR? D4 ยท Operations โ–ธ
SOAR (Security Orchestration, Automation and Response) integrates security tools via APIs to automate incident response workflows โ€” SIEM alert โ†’ automatic IOC enrichment โ†’ endpoint isolation โ†’ ticket creation โ†’ analyst notification.
SOAR reduces MTTR by automating repetitive Tier 1 tasks. ROI: automating 100 tickets/day at 15 min each = 25 hours of analyst time saved daily. Platforms: Splunk SOAR, Palo Alto XSOAR, Microsoft Sentinel SOAR. Playbooks encode IR procedures into automated workflows.
Full Definition โ†’
Full Definition โ†’
What is software security testing? D4 ยท Operations โ–ธ
Security testing methods: SAST (source code), DAST (running app), IAST (runtime instrumentation), fuzzing (random input), manual pen test (logic/complex issues), dependency scanning (SCA), secret scanning (credentials in code).
"Shift left" = find security issues early in SDLC when they're cheapest to fix. CI/CD pipeline integration: SAST + SCA + secret scanning on every commit. DAST on every deployment to staging. Manual pen test quarterly or for major releases. Automate what you can; manual testing for what automation misses.
Full Definition โ†’
Full Definition โ†’
What is SPF? D3 ยท Architecture โ–ธ
SPF (Sender Policy Framework) defines which IP addresses are authorized to send email for a domain โ€” published in DNS TXT records. Receiving servers validate the sending IP against the SPF record.
SPF alone isn't enough โ€” it can be bypassed using forwarding (forwarded email changes the sending IP). SPF + DKIM + DMARC together provide comprehensive email authentication. SPF soft fail (~all) vs. hard fail (-all): hard fail is more secure but risk of legitimate mail being rejected if your SPF is incomplete.
Full Definition โ†’
Full Definition โ†’
What is SQL injection? D2 ยท Threats โ–ธ
SQL injection inserts malicious SQL code into queries through unsanitized user input โ€” enabling authentication bypass, data extraction, data modification, and in some cases command execution.
Classic: ' OR '1'='1 in login bypasses authentication. UNION SELECT extracts data from other tables. Blind SQLi: infer data from true/false application responses. Prevention: parameterized queries/prepared statements (the ONLY reliable fix). Input validation is defense-in-depth, not the primary fix.
Full Definition โ†’
Full Definition โ†’
What is steganography? D2 ยท Threats โ–ธ
Steganography conceals data within other data โ€” hiding messages in image pixels, audio files, video frames, or document metadata. Used for covert communication and data exfiltration.
Unlike encryption (content is protected), steganography hides the existence of the message. DLP tools can detect steganography statistically. Exam context: often appears with anti-forensics questions. Real use: malware hiding C2 instructions in social media images.
Full Definition โ†’
Full Definition โ†’
What is SD-WAN? D6 ยท Network+ โ–ธ
SD-WAN uses software-defined networking to manage WAN connections โ€” dynamically routing traffic across multiple links (MPLS, broadband, LTE) based on application policy.
SD-WAN security: built-in encryption between sites, centralized policy management, application-aware routing. Security risk: if the controller is compromised, all branches are affected. Ensure SD-WAN controller access is tightly secured with MFA and restricted access.
Full Definition โ†’
Full Definition โ†’
What is SSH tunneling? D9 ยท PenTest+ โ–ธ
SSH tunneling:
-L (local forward): local port โ†’ remote server.
-R (remote forward): remote port โ†’ local machine.
-D (dynamic): creates SOCKS proxy for routing any traffic.
SSH -D 1080 creates a SOCKS5 proxy โ€” combine with proxychains to tunnel any tool through SSH. Used in pen testing to pivot through SSH-accessible hosts. Blue teams: detect via SSH session duration, unusual data volumes, or multiple port forwards on single SSH connection.
Full Definition โ†’
Full Definition โ†’
What is security architecture? D8 ยท CySA+ โ–ธ
Security architecture applies security principles to system and network design โ€” zero trust, defense in depth, least privilege, fail-secure, separation of concerns, and layered controls.
Security architecture decisions are expensive to reverse โ€” invest in design upfront. Security architects translate business risk requirements into technical controls. Key documents: security architecture principles, reference architectures, design patterns. SABSA, TOGAF are enterprise architecture frameworks with security components.
Full Definition โ†’
Full Definition โ†’
What are Snort/Suricata rules? D8 ยท CySA+ โ–ธ
Snort/Suricata rule structure: action protocol src_ip src_port direction dst_ip dst_port (options). Example: alert tcp any any โ†’ $HOME_NET 22 (msg:"SSH brute force"; threshold:type both,track by_src,count 5,seconds 60;)
Suricata is the modern successor to Snort โ€” supports multi-threading and more protocol support. Rule options: content (byte pattern), pcre (regex), http.uri (HTTP-specific), threshold (frequency-based). Emerging Threats Pro and ET Open provide high-quality community rules. Always test new rules in detect mode before blocking.
Full Definition โ†’
Full Definition โ†’
What is scope creep in pen testing? D9 ยท PenTest+ +
Scope creep occurs when pen testers encounter systems or opportunities outside the authorized scope โ€” they MUST stop immediately and get written authorization updated before proceeding.
"But it was an open door" is not a defense. Unauthorized testing, even accidental, is illegal. If you discover an adjacent system while testing authorized targets: document the finding (you may have found additional attack surface), stop testing the out-of-scope system, notify the client and request scope expansion if appropriate.
Full Definition โ†’
What are the authentication factors? D1 ยท General โ–ธ
Five authentication factors: ๐Ÿ”‘ Something you know, ๐Ÿ“ฑ Something you have, ๐Ÿ‘† Something you are, ๐Ÿ“ Somewhere you are (location), ๐ŸŽฏ Something you do (behavior/gait).
MFA requires factors from at least TWO different categories. SMS codes = something you have (weakest). FIDO2/WebAuthn hardware keys = strongest something-you-have.
Full Definition โ†’
Full Definition โ†’
What is the difference between authentication and authorization? D1 ยท General โ–ธ
Authentication (authn) = proving identity ("who are you?"). Authorization (authz) = determining permissions ("what can you do?"). Authentication always happens first.
A classic exam trick: authentication and authorization are separate steps. You can be authenticated but not authorized (valid credentials, no permission). AAA adds accounting to track actions.
Full Definition โ†’
Full Definition โ†’
What is the certificate lifecycle? D5 ยท Crypto โ–ธ
Certificate lifecycle: Key generation โ†’ CSR (Certificate Signing Request) โ†’ CA verification โ†’ Issuance โ†’ Installation โ†’ Renewal โ†’ Revocation (if compromised).
Expired or improperly revoked certificates break services. CRL and OCSP handle revocation. Automate certificate renewal (Let's Encrypt / ACME protocol) to prevent expiry-related outages.
Full Definition โ†’
Full Definition โ†’
What are the CIS Controls? D4 ยท Operations โ–ธ
The CIS Controls are 18 prioritized security practices developed by the Center for Internet Security. Control 1: asset inventory. Control 2: software inventory. Control 5: account management.
CIS Controls are prescriptive (tell you exactly what to do) vs. NIST CSF (framework). First 6 controls address the most critical risks. CIS Benchmarks provide OS-specific hardening guidelines.
Full Definition โ†’
Full Definition โ†’
What is the difference between cleartext and plaintext? D5 ยท Crypto โ–ธ
Plaintext = data before encryption (intended to be encrypted). Cleartext = data that was never encrypted and is transmitted openly (HTTP, FTP, Telnet).
Transmitting sensitive data in cleartext is a critical vulnerability. Replace HTTP with HTTPS, FTP with SFTP, Telnet with SSH. Packet sniffers trivially capture cleartext credentials.
Full Definition โ†’
Full Definition โ†’
What is the Cyber Kill Chain? D2 ยท Threats โ–ธ
Lockheed Martin's Cyber Kill Chain: 1.Reconnaissance โ†’ 2.Weaponization โ†’ 3.Delivery โ†’ 4.Exploitation โ†’ 5.Installation โ†’ 6.C2 โ†’ 7.Actions on Objectives.
Breaking any stage stops the attack. Defenders should aim to detect as early as possible (recon/delivery). MITRE ATT&CK is more granular and modern, but Kill Chain is still exam-relevant.
Full Definition โ†’
Full Definition โ†’
What is the dark web and its security implications? D2 ยท Threats โ–ธ
The dark web uses Tor to anonymize communications. Used for: selling stolen data/credentials, ransomware-as-a-service marketplaces, hacker forums, C2 infrastructure.
Threat intelligence teams monitor dark web for mentions of your organization or leaked credentials. Dark web monitoring services alert when employee credentials appear in breach dumps.
Full Definition โ†’
Full Definition โ†’
What is the Internet of Things (IoT) security? D3 ยท Architecture โ–ธ
IoT security challenges: massive scale, diverse devices, long lifecycles, limited compute, default credentials, infrequent patching, insecure communications.
Network segmentation (IoT VLAN) is the most practical IoT security control. Mirai botnet demonstrated IoT's DDoS potential. NIST SP 800-213 provides IoT security guidance. Inventory ALL IoT devices.
Full Definition โ†’
Full Definition โ†’
What is the principle of least functionality? D4 ยท Operations โ–ธ
The principle of least functionality states systems should only run the minimum services, features, and capabilities required for their purpose โ€” nothing more.
Closely related to least privilege (for users) and attack surface reduction. Every unnecessary service = additional attack surface. Disable unused protocols, services, accounts, and features on every system.
Full Definition โ†’
Full Definition โ†’
What is the OWASP Top 10? D2 ยท Threats โ–ธ
The OWASP Top 10 is the most referenced web application security risk list. 2021 edition top risks: Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration.
OWASP Top 10 is not a checklist โ€” it's a risk awareness document. Every developer should know it. "Broken Access Control" moved to #1 in 2021 (was #5). Used as a security requirement baseline globally.
Full Definition โ†’
Full Definition โ†’
What is the shared responsibility model for security? D3 ยท Architecture โ–ธ
In cloud security, the shared responsibility model defines what the CSP secures vs. the customer. The split depends on service model (IaaS/PaaS/SaaS) โ€” but customers always own their data and identities.
"Not my responsibility" = data breaches. Even in SaaS, the customer is responsible for: data, access management, user behavior, client-side security. Misunderstanding shared responsibility is the #1 cause of cloud security failures.
Full Definition โ†’
Full Definition โ†’
What is the symmetric key distribution problem? D5 ยท Crypto โ–ธ
The key distribution problem: how do two parties securely share a symmetric key without meeting in person or using an already-secure channel? Asymmetric cryptography solves this.
This is why TLS uses asymmetric cryptography (RSA or ECDH) to establish a shared symmetric key, then AES for the session. Before asymmetric cryptography, key distribution was a fundamental security problem.
Full Definition โ†’
Full Definition โ†’
What is tcpdump? D7 ยท Tools โ–ธ
tcpdump is a command-line packet capture tool for Linux/Unix โ€” capturing and displaying network packets matching filter expressions. Outputs to PCAP files for Wireshark analysis.
tcpdump is pre-installed on most Linux/Unix systems. '-n' disables DNS resolution (faster). '-w file.pcap' saves to file. Basic filter: 'tcpdump -i eth0 port 443'. Complement to Wireshark for remote/headless capture.
Full Definition โ†’
Full Definition โ†’
What is third-party risk management? D1 ยท General โ–ธ
Third-party risk management (TPRM) assesses and monitors the security of vendors, contractors, and business partners who access your systems or data.
Target breach started with HVAC vendor credentials. Controls: security questionnaires, contractual security requirements, least-privilege vendor access, monitoring vendor connections, right-to-audit clauses in contracts.
Full Definition โ†’
Full Definition โ†’
What is TOTP (Time-Based OTP)? D1 ยท General โ–ธ
TOTP generates 6-8 digit codes that change every 30 seconds based on shared secret + current time. Used in authenticator apps (Google Authenticator, Authy, Microsoft Authenticator).
TOTP is much more secure than SMS codes โ€” not vulnerable to SIM swapping. HOTP is counter-based instead of time-based. FIDO2/WebAuthn (hardware keys) is more secure than TOTP. Both are far better than SMS.
Full Definition โ†’
Full Definition โ†’
What is TLS/SSL inspection? D3 ยท Architecture โ–ธ
TLS inspection decrypts HTTPS traffic at a proxy, inspects for threats, and re-encrypts before forwarding โ€” allowing security tools to see encrypted traffic content.
Requires deploying a trusted CA certificate to client browsers. Privacy concern: employer can see all HTTPS traffic. Breaks certificate pinning. GDPR considerations for personal traffic. Used by firewalls, proxies, and CASB solutions.
Full Definition โ†’
Full Definition โ†’
What is token-based authentication? D1 ยท General โ–ธ
Token-based authentication uses physical or software tokens generating one-time passwords โ€” hardware tokens (RSA SecurID), soft tokens (smartphone apps), smart cards, FIDO2 keys.
Hardware tokens are the gold standard for remote admin access โ€” they can't be SIM-swapped or phished (FIDO2 keys are phishing-resistant). Smart cards provide both authentication and digital signing capabilities.
Full Definition โ†’
Full Definition โ†’
What is traffic analysis? D2 ยท Threats โ–ธ
Traffic analysis derives intelligence from communication patterns โ€” even from encrypted traffic. Timing, volume, frequency, and communication partners reveal information regardless of encryption.
Encryption protects content but not metadata. Intelligence agencies exploit traffic analysis at scale. Tor attempts to defeat traffic analysis via onion routing. Even encrypted VPN traffic reveals when you're active.
Full Definition โ†’
Full Definition โ†’
What is TPM 2.0 vs TPM 1.2? D5 ยท Crypto โ–ธ
TPM 2.0 adds modern cryptographic algorithms (SHA-256, ECC, AES) vs. TPM 1.2 (SHA-1, RSA only). More flexible key hierarchy and better platform integrity verification.
Windows 11 requires TPM 2.0. TPM 2.0 supports multiple hash algorithms (important since SHA-1 is deprecated). Firmware TPM (fTPM) is a software implementation โ€” less secure than discrete hardware TPM chips.
Full Definition โ†’
Full Definition โ†’
What is the role of a Data Protection Officer (DPO)? D1 ยท General โ–ธ
A DPO advises on data protection obligations, monitors GDPR compliance, and serves as the contact point for supervisory authorities. Mandatory for large-scale data processors and public authorities.
DPO must have data protection expertise and operate independently. Can be internal or outsourced. Conflict of interest prohibited (DPO can't also make data processing decisions they oversee). Reports directly to highest management level.
Full Definition โ†’
Full Definition โ†’
What is the difference between IoC and IoA? D8 ยท CySA+ โ–ธ
IoC (Indicator of Compromise) = evidence after compromise (malware hash, C2 IP, registry key). IoA (Indicator of Attack) = behavioral indicators during an attack (unusual process behavior, new scheduled task).
IoAs enable real-time detection during the attack. IoCs are useful for hunting and retrospective analysis. IoAs focus on behaviors (harder to change) while IoCs focus on artifacts (easy to change). Both are needed.
Full Definition โ†’
Full Definition โ†’
What are the OSI model security implications? D6 ยท Network+ โ–ธ
Security controls by OSI layer: L1 (physical locks), L2 (VLANs, 802.1X, port security), L3 (firewalls, IPSec, routing ACLs), L4 (stateful firewalls, TCP inspection), L7 (WAF, DLP, application controls).
Attackers target all layers โ€” defense in depth addresses each layer. A WAF at L7 doesn't protect against L2 ARP poisoning. Network segmentation (L2/L3) doesn't stop application-layer attacks. Each layer needs appropriate controls.
Full Definition โ†’
Full Definition โ†’
What are the top public cloud security risks? D3 ยท Architecture โ–ธ
Top cloud security risks: misconfiguration (#1), insecure interfaces/APIs, account compromise, insufficient logging, insecure data storage. AWS is responsible for security OF the cloud; customers for security IN the cloud.
ENISA, CSA, and Gartner consistently rank misconfiguration as the #1 cloud risk. Enable cloud-native security services (GuardDuty, Security Hub, Microsoft Defender for Cloud) immediately on new accounts.
Full Definition โ†’
Full Definition โ†’
What are the security risks of SSO? D1 ยท General โ–ธ
SSO risks: single credential compromise = access to all connected apps ("blast radius"), IdP availability = availability for all services, weak IdP authentication undermines all services.
SSO with weak MFA is dangerous. SSO with phishing-resistant MFA (FIDO2) is excellent. Plan for IdP unavailability. Monitor for unusual SSO patterns (accessing many apps quickly). Break-glass accounts bypass SSO for emergency access.
Full Definition โ†’
Full Definition โ†’
What are TCP/IP security vulnerabilities? D6 ยท Network+ โ–ธ
TCP/IP vulnerabilities: SYN flooding (exhausts connection state), TCP session hijacking (sequence number prediction), IP spoofing (fake source addresses), ACK injection.
TCP sequence numbers are now randomized (prevents easy hijacking). SYN cookies prevent SYN flooding without maintaining state. IPSec at the network layer protects against IP spoofing. TLS at the application layer protects against TCP session hijacking.
Full Definition โ†’
Full Definition โ†’
What is TLP (Traffic Light Protocol)? D4 ยท Operations โ–ธ
TLP is a framework for sharing sensitive information: TLP:RED (personal, not for sharing), TLP:AMBER (limited distribution), TLP:GREEN (community), TLP:WHITE (unlimited sharing).
TLP is standard in threat intelligence communities. ISAC members respect TLP classifications. TLP:RED = in meeting only. TLP:AMBER = organization only. TLP:GREEN = community. TLP:WHITE = public. TLP:AMBER+STRICT = your organization only (no forwarding).
Full Definition โ†’
Full Definition โ†’
What is tokenization vs encryption? D5 ยท Crypto โ–ธ
Tokenization replaces sensitive data with a non-sensitive token that maps back to the original in a secure vault โ€” unlike encryption, tokens are format-preserving and algorithmically irreversible.
PCI DSS: tokenize primary account numbers (PANs) to reduce PCI scope. Encryption is reversible (with key). Tokenization requires the vault for reversal. Either can reduce PCI DSS scope if properly implemented.
Full Definition โ†’
Full Definition โ†’
What is Tor and its security implications? D2 ยท Threats โ–ธ
Tor routes traffic through multiple relays with layered encryption โ€” providing anonymity. Misused by malware for C2, dark web marketplaces, and exfiltration via hidden services.
Block Tor exit nodes at the perimeter firewall using threat intelligence feeds. Tor hidden services (onion addresses) host C2 infrastructure that's hard to take down. DNS monitoring can detect Tor bootstrap connections.
Full Definition โ†’
Full Definition โ†’
What is trusted computing? D5 ยท Crypto โ–ธ
Trusted computing uses hardware (TPM) to verify system integrity โ€” measuring each boot component, storing measurements in TPM PCRs, enabling remote attestation of platform state.
TCG (Trusted Computing Group) defines the TPM standard. Remote attestation: system proves its software state to a remote verifier (used in zero trust device compliance checks). If any measured component changes, attestation fails.
Full Definition โ†’
Full Definition โ†’
What is the two-man rule in security? D1 ยท General โ–ธ
The two-man rule (dual control) requires two authorized people to jointly perform a critical action โ€” neither person can act alone. Stronger than separation of duties.
Used for: nuclear weapon arming, safe opening, cash handling, critical infrastructure operations, root CA key ceremonies. Prevents a single compromised or malicious insider from taking catastrophic action alone.
Full Definition โ†’
Full Definition โ†’
What is the zero-day market? D2 ยท Threats โ–ธ
Zero-day markets are channels (legal and gray/black) where discovered vulnerabilities are bought and sold โ€” nation-state intelligence agencies, defense contractors, and cybercriminals pay millions for reliable exploits.
Zero-day prices: iOS full-chain remote jailbreak = $2-5 million. Chrome renderer RCE = $500K. Organizations can reduce zero-day risk through defense in depth, behavioral detection, and attack surface reduction โ€” no patch = focus on detection.
Full Definition โ†’
Full Definition โ†’
What is the CVE system? D4 ยท Operations โ–ธ
CVE is a standardized identifier for known vulnerabilities. Each has a unique ID (CVE-YEAR-NUMBER) and CVSS score. CVSS ranges: 0-3.9 Low, 4-6.9 Medium, 7-8.9 High, 9-10 Critical.
CVSS alone is insufficient for prioritization โ€” a Critical on an internal dev server is lower priority than a High on an internet-facing payment server. CISA KEV catalog = actively exploited = patch immediately regardless of CVSS score.
Full Definition โ†’
Full Definition โ†’
What are the types of threat actors? D2 ยท Threats โ–ธ
Nation-states (sophisticated, patient, espionage), Cybercriminals (financial โ€” ransomware/fraud), Hacktivists (ideological), Insiders (authorized access), Script kiddies (low skill, tools-based).
Match controls to threat actor. Script kiddies stopped by basic patching. Nation-states require comprehensive detection and response. Insider threats require behavioral monitoring and least privilege. Know each actor's motivation, capability, and typical TTPs.
Full Definition โ†’
Full Definition โ†’
What is threat hunting? D4 ยท Operations โ–ธ
Threat hunting proactively searches for threats that evaded automated detection โ€” assuming compromise and actively hunting for IoCs and TTPs.
Threat hunting is proactive (you go looking), not reactive (waiting for alerts). Requires skilled analysts + rich telemetry + MITRE ATT&CK framework for hypothesis generation. Assumption: automated tools missed something โ€” find it before damage worsens.
Full Definition โ†’
Full Definition โ†’
What is threat modeling? D4 ยท Operations โ–ธ
Threat modeling proactively identifies threats during design โ€” before code is written. Frameworks: STRIDE (Microsoft), PASTA, DREAD, Attack Trees.
Best time to threat model: design phase (cheapest fix). STRIDE is the most exam-tested framework. Even a simple 2-hour threat modeling session prevents costly vulnerabilities. Threat modeling + secure code review = most effective SDLC security combination.
Full Definition โ†’
Full Definition โ†’
What is token theft? D2 ยท Threats โ–ธ
Token theft steals authentication tokens (session cookies, JWTs, Kerberos tickets) to replay and impersonate users without knowing passwords โ€” bypassing MFA.
AiTM (Adversary-in-the-Middle) phishing proxies steal session cookies after MFA completion โ€” the user authenticates, the proxy captures the session. FIDO2 is phishing-resistant even against AiTM. Conditional Access policies with continuous evaluation re-check sessions.
Full Definition โ†’
Full Definition โ†’
What are TLS versions? D5 ยท Crypto โ–ธ
TLS version history: SSL 3.0 (broken), TLS 1.0/1.1 (deprecated 2020), TLS 1.2 (widely used, acceptable), TLS 1.3 (current standard โ€” mandatory forward secrecy, fewer cipher suites, faster).
Disable TLS 1.0 and 1.1 on all servers โ€” both are deprecated by RFC 8996 (2021). PCI DSS 4.0 requires TLS 1.2+ minimum. TLS 1.3 is strictly better: only strong cipher suites, always forward secrecy, faster handshake. Configure servers to prefer TLS 1.3.
Full Definition โ†’
Full Definition โ†’
What are the types of firewalls? D3 ยท Architecture โ–ธ
TypeInspectsState
Packet filterHeadersNo
StatefulConnection stateYes
Application (L7)Deep contentYes
NGFWApp+User+IPSYes
WAF = web app specific. NGFW = network perimeter with app awareness. Stateful is the minimum for enterprise. Packet filter is too basic. The more layers inspected, the more processing overhead.
Full Definition โ†’
Full Definition โ†’
What are the types of proxy servers? D3 ยท Architecture โ–ธ
Forward proxy: sits in front of clients, filters outbound traffic. Reverse proxy: sits in front of servers (WAF, load balancer). Transparent proxy: intercepts without client config. SOCKS proxy: generic application-layer proxy.
Forward proxy = protects clients/monitors egress. Reverse proxy = protects servers. SSL inspection proxy decrypts/re-encrypts HTTPS โ€” requires installing a CA cert on clients. Split tunneling proxies route some traffic through proxy, rest directly.
Full Definition โ†’
Full Definition โ†’
What is trunking in networking? D6 ยท Network+ โ–ธ
A trunk port carries multiple VLANs between switches using 802.1Q tagging. Native VLAN frames are untagged. Access ports carry only one VLAN and connect to end devices.
Trunk ports connect switches to switches (and switches to routers for inter-VLAN routing). VLAN double-tagging attack targets the native VLAN โ€” change native VLAN from default (VLAN 1) to an unused VLAN. Only trunk ports you explicitly configure should be trunking โ€” disable DTP on access ports.
Full Definition โ†’
Full Definition โ†’
What is the difference between TCP and UDP? D6 ยท Network+ โ–ธ
TCP: connection-oriented, reliable (acknowledgments, retransmission), ordered delivery, 3-way handshake (SYN/SYN-ACK/ACK). UDP: connectionless, unreliable, fast, low overhead.
TCP = guaranteed delivery (file transfer, email, HTTP). UDP = fast, accept occasional loss (DNS, VoIP, video streaming, games). Security: SYN flood exhausts TCP state table. DNS uses UDP (small queries) but TCP for zone transfers and large responses.
Full Definition โ†’
Full Definition โ†’
What is the Diamond Model of intrusion analysis? D8 ยท CySA+ โ–ธ
The Diamond Model connects four intrusion elements: Adversary โ†” Capability โ†” Infrastructure โ†” Victim. Each intrusion event links these elements, enabling analyst pivoting.
Diamond Model enables pivoting: know the adversary's infrastructure โ†’ find other victims. Know the capability (malware) โ†’ find other intrusions using same tool. Complements Kill Chain and ATT&CK. Used for intelligence-driven incident analysis.
Full Definition โ†’
Full Definition โ†’
What is the threat intelligence cycle? D8 ยท CySA+ โ–ธ
TI cycle: Direction (define requirements) โ†’ Collection (gather raw data) โ†’ Processing (normalize/enrich) โ†’ Analysis (produce intelligence) โ†’ Dissemination (share with consumers) โ†’ Feedback.
Raw data is not intelligence โ€” it requires analysis. Intelligence is actionable. The cycle is continuous โ€” feedback improves future collection. Different consumers need different formats: executives = strategic, SOC = technical IoCs, IR teams = tactical TTPs.
Full Definition โ†’
Full Definition โ†’
What is the vulnerability lifecycle? D8 ยท CySA+ โ–ธ
Vulnerability lifecycle: Discovery (found by researcher/attacker) โ†’ Reporting (to vendor) โ†’ Patch development โ†’ Coordinated disclosure โ†’ CVE published โ†’ Exploitation spikes โ†’ Patch deployment.
The window between CVE publication and patch deployment is the critical risk period. Exploitation attempts spike within 24-72 hours of CVE publication. CISA KEV = being actively exploited = emergency patch. Risk-based patching focuses effort on this window.
Full Definition โ†’
Full Definition โ†’
What are the types of biometrics? D1 ยท General โ–ธ
Physiological biometrics: fingerprint, iris scan, retina scan, facial recognition, palm vein. Behavioral biometrics: voice recognition, keystroke dynamics (typing rhythm), gait analysis, mouse movement patterns.
Physiological = physical characteristics (stable). Behavioral = patterns over time (continuous authentication possible). Behavioral biometrics are passive โ€” authentication happens continuously without user interaction. Combined with MFA they provide strong continuous identity assurance.
Full Definition โ†’
Full Definition โ†’
What is the incident response lifecycle? D4 ยท Operations โ–ธ
NIST IR phases: 1. Preparation โ†’ 2. Detection & Analysis โ†’ 3. Containment, Eradication & Recovery โ†’ 4. Post-Incident Activity. SANS: PICERL (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned).
Preparation is most important โ€” an IR plan you've never tested fails under pressure. Practice via tabletop exercises and fire drills. NIST SP 800-61 is the authoritative incident handling guide. Detection is often the hardest phase โ€” average dwell time 200+ days for sophisticated attacks.
Full Definition โ†’
Full Definition โ†’
What is the principle of least privilege? D1 ยท General โ–ธ
The principle of least privilege grants only the minimum access rights necessary to perform legitimate functions โ€” reducing blast radius if credentials are compromised.
Least privilege applies to: user accounts, service accounts, applications, network access, file permissions. Most violations accumulate over time (access granted, never removed). Regular access reviews enforce it. "Access creep" is the enemy of least privilege.
Full Definition โ†’
Full Definition โ†’
What are the types of malware? D2 ยท Threats โ–ธ
Key malware types: Virus (requires user to run infected file), Worm (self-propagating via network), Trojan (disguised as legitimate), Ransomware (encrypts files for payment), Rootkit (hides malware, OS-level), Fileless (lives in memory, no disk files).
Know each type and how they spread/persist. Fileless malware is hardest to detect (no files for AV to scan). Rootkits are hardest to remediate (compromise OS integrity). Ransomware is the most financially damaging. Worms spread the fastest (no user interaction needed).
Full Definition โ†’
Full Definition โ†’
What is the NIST Cybersecurity Framework (CSF)? D1 ยท General โ–ธ
NIST CSF organizes security around 5 functions: Identify (assets, risks), Protect (safeguards), Detect (events), Respond (incidents), Recover (restore).
CSF 2.0 (2024) adds a 6th function: Govern. Voluntary for non-federal but widely adopted. Provides common language for cybersecurity. Maps to other frameworks (ISO 27001, CIS Controls). Use to structure security programs and board-level reporting.
Full Definition โ†’
Full Definition โ†’
What is the race to patch? D4 ยท Operations โ–ธ
The race to patch: once a CVE is published, attackers begin developing exploits โ€” organizations must patch before exploitation occurs, often within 24-72 hours for critical vulnerabilities.
CISA KEV catalog = already being exploited = emergency. Immediately after CVE publication, exploitation attempts surge. High CVSS score + internet-facing = highest urgency. Risk-based patching: not all patches are equal urgency โ€” focus emergency effort on exploitable, internet-facing, critical systems.
Full Definition โ†’
Full Definition โ†’
What is threat intelligence? D4 ยท Operations โ–ธ
Threat intelligence provides evidence-based knowledge about threats โ€” enabling informed decisions. Levels: Strategic (executive, risk decisions), Tactical (TTPs for detection), Operational (specific campaign info), Technical (IoCs for blocking).
Raw IoCs without context = low-value. Intelligence = IoCs + TTPs + actor profile + attribution + predictions. Intelligence cycle: requirements โ†’ collection โ†’ processing โ†’ analysis โ†’ dissemination โ†’ feedback. MISP, AlienVault OTX, ISACs are key platforms. Actionable intelligence improves defenses.
Full Definition โ†’
Full Definition โ†’
What is Type I vs Type II error in security? D4 ยท Operations โ–ธ
Type I error = False Positive (raising alarm when there's no threat). Type II error = False Negative (missing a real threat โ€” the more dangerous one).
Security parallels statistics: Type I (false positive) = over-alert. Type II (false negative) = under-alert. In biometrics: Type I = FAR (false acceptance, unauthorized user accepted). Type II = FRR (false rejection, authorized user rejected). Adjusting sensitivity trades one for the other.
Full Definition โ†’
Full Definition โ†’
What is the network access layer? D6 ยท Network+ โ–ธ
The three-tier network model: Core (high-speed backbone, minimal filtering), Distribution (routing, ACLs, inter-VLAN routing, policy enforcement), Access (end devices connect, port security, VLANs, PoE).
Core = speed (no complex processing). Distribution = policy (ACLs, routing between VLANs, QoS). Access = connectivity (user/device facing, port security, 802.1X). Security controls belong at the distribution layer primarily. Collapsed core/distribution is common in smaller environments.
Full Definition โ†’
Full Definition โ†’
What are the OSI model layers? D6 ยท Network+ โ–ธ
OSI layers: 1.Physical (bits, cables), 2.Data Link (frames, MAC, switches), 3.Network (packets, IP, routers), 4.Transport (segments, TCP/UDP), 5.Session, 6.Presentation (encryption, encoding), 7.Application (HTTP, DNS, SMTP).
Mnemonic: "Please Do Not Throw Sausage Pizza Away" (bottom-up) or "All People Seem To Need Data Processing" (top-down). Troubleshoot bottom-up. Firewalls at L3/L4. WAF at L7. Switch at L2. Router at L3. Know which protocol/device operates at which layer.
Full Definition โ†’
Full Definition โ†’
What is the TCP 3-way handshake? D6 ยท Network+ โ–ธ
TCP connection: Client โ†’ SYN โ†’ Server โ†’ SYN-ACK โ†’ Client โ†’ ACK โ†’ Connection Established. Each packet has a sequence number for ordering and acknowledgment.
SYN flood exploits the half-open connection state (SYN received, SYN-ACK sent, no ACK yet) โ€” consuming server connection table. SYN cookies defend against this: server doesn't maintain state until ACK received. TCP FIN (graceful close) vs RST (immediate reset).
Full Definition โ†’
Full Definition โ†’
What is TTL (Time to Live)? D6 ยท Network+ โ–ธ
TTL in IP packets prevents routing loops โ€” decremented by 1 at each router hop. When TTL=0, the packet is dropped and an ICMP Time Exceeded message is sent to the sender.
Traceroute exploits TTL: send packet with TTL=1 (first router drops it, sends ICMP back), TTL=2 (second router), etc. โ€” revealing each hop. TTL values also reveal OS type (Windows=128, Linux=64). Low TTL = possible routing loop or misconfiguration.
Full Definition โ†’
Full Definition โ†’
What are threat hunting tools? D8 ยท CySA+ โ–ธ
Threat hunting tools: SIEM (log-based hunting), EDR (endpoint telemetry), Velociraptor (open-source DFIR/hunt), OSQuery (SQL-based endpoint querying), YARA (file/memory pattern matching).
OSQuery transforms endpoint state into SQL tables โ€” 'SELECT * FROM processes WHERE name LIKE "%mimikatz%"'. Velociraptor collects artifacts from endpoints at scale. ELK + OSQuery = powerful open-source hunting platform. Hypothesis-driven hunts use these tools to test specific attacker behavior assumptions.
Full Definition โ†’
Full Definition โ†’
What is threat actor profiling? D8 ยท CySA+ โ–ธ
Threat actor profiling documents known threat groups โ€” their TTPs, tools, infrastructure patterns, targeting preferences, and historical campaigns โ€” enabling intelligence-driven defense.
Named groups: APT28/Fancy Bear (Russia, election interference), APT41 (China, espionage+cybercrime), Lazarus Group (North Korea, financial crime). Use MITRE ATT&CK Group pages for TTP details. Prioritize defenses against groups known to target your industry and geography.
Full Definition โ†’
Full Definition โ†’
What is threat modeling in SDLC? D8 ยท CySA+ โ–ธ
STRIDE threat modeling: Spoofing (identity), Tampering (data integrity), Repudiation (non-repudiation), Information disclosure (confidentiality), Denial of service (availability), Elevation of privilege.
STRIDE is Microsoft's threat modeling framework โ€” map each component in your data flow diagram to potential STRIDE threats. Each STRIDE category maps to a security property: Spoofing โ†’ Authentication, Tampering โ†’ Integrity, Repudiation โ†’ Non-repudiation, Info disclosure โ†’ Confidentiality, DoS โ†’ Availability, EoP โ†’ Authorization.
Full Definition โ†’
Full Definition โ†’
What are the types of penetration tests? D9 ยท PenTest+ +
Test types by knowledge: Black box (no prior knowledge โ€” simulates external attacker), White box (full access โ€” most thorough), Gray box (partial knowledge โ€” balanced). By scope: network, web app, social engineering, physical, mobile, cloud, red team.
Black box: most realistic, time-consuming, may miss internal vulnerabilities. White box: most efficient, highest coverage, requires trust. Gray box: best balance for most engagements. Red team: goals-based, long duration, tests people/process/technology together. Match test type to client's security maturity and objectives.
Full Definition โ†’
What is UEBA (User and Entity Behavior Analytics)? D8 ยท CySA+ โ–ธ
UEBA applies machine learning to baseline normal user/device behavior โ€” detecting anomalies like impossible travel, unusual data access patterns, and insider threats that signature-based tools miss.
UEBA excels at detecting insider threats and compromised accounts (normal credentials, abnormal behavior). Requires significant data history to establish baselines. Often integrated into SIEM platforms (Splunk UBA, Microsoft Sentinel).
Full Definition โ†’
Full Definition โ†’
What is unauthorized access? D2 ยท Threats โ–ธ
Unauthorized access is accessing a system, network, or data without permission โ€” a federal crime in the US (Computer Fraud and Abuse Act), even if the system is not properly secured.
CFAA criminalizes unauthorized access regardless of system security posture. "Authorized user exceeding authorization" is also covered. Good faith security researchers need careful authorization documentation to avoid prosecution.
Full Definition โ†’
Full Definition โ†’
What is Unified Endpoint Management (UEM)? D3 ยท Architecture โ–ธ
UEM manages all endpoint types โ€” Windows, Mac, iOS, Android, IoT โ€” from a single platform. Converges MDM and traditional endpoint management (SCCM/WSUS).
UEM extends MDM to include traditional PC management. Key for remote work environments. Solutions: Microsoft Intune, VMware Workspace ONE, Jamf Pro. Provides unified policy enforcement regardless of OS or form factor.
Full Definition โ†’
Full Definition โ†’
What is UAC (User Account Control)? D1 ยท General โ–ธ
UAC (User Account Control) prompts for confirmation when actions require elevated privileges โ€” even admin users run with standard rights by default, requiring explicit elevation for administrative actions.
UAC is a least-privilege implementation in Windows. Reduces malware impact by requiring elevation. UAC bypass is a common malware technique (using COM object hijacking, dll hijacking, etc.). Never disable UAC on admin workstations.
Full Definition โ†’
Full Definition โ†’
What is Unicode security? D2 ยท Threats โ–ธ
Unicode security issues include homograph attacks (visually identical Unicode characters in domain names), bidirectional text injection (RTL override to reverse text display), and normalization attacks.
Homograph attack: ะฐpple.com uses Cyrillic 'ะฐ' instead of Latin 'a' โ€” visually identical. Browsers show punycode for known-homograph domains. Bidirectional override (BIDI) characters can make malicious filenames appear benign.
Full Definition โ†’
Full Definition โ†’
What is URL encoding and security implications? D2 ยท Threats โ–ธ
URL encoding represents characters as percent-encoded sequences (%20 = space). Attackers use double-encoding and Unicode encoding to bypass WAF filters and input validation.
WAF evasion via encoding: if a WAF blocks 'script', encoding it as '%73%63%72%69%70%74' may bypass naive pattern matching. Defenses: normalize/decode ALL input before validation. Input validation must happen after decoding.
Full Definition โ†’
Full Definition โ†’
What is user enumeration? D2 ยท Threats +
User enumeration identifies valid usernames through different application responses โ€” different error messages, timing, or HTTP status codes for valid vs. invalid usernames reveal existing accounts.
Prevention: return identical responses for valid/invalid usernames, use timing-safe operations, rate limit login attempts. User enumeration enables targeted password attacks and phishing campaigns with valid email addresses.
Full Definition โ†’
What is VLAN hopping? D2 ยท Threats โ–ธ
VLAN hopping bypasses VLAN segmentation using switch spoofing (attacker becomes a trunk port) or double tagging (crafting frames with two 802.1Q tags).
Prevention: disable DTP (Dynamic Trunking Protocol) on access ports, use dedicated native VLANs, never put user devices on the native VLAN. VLAN hopping is why VLANs alone aren't sufficient โ€” add firewall controls.
Full Definition โ†’
Full Definition โ†’
What is VM sprawl? D3 ยท Architecture โ–ธ
VM sprawl is the uncontrolled proliferation of virtual machines โ€” forgotten test VMs, unpatched images, unauthorized deployments โ€” creating an unmanaged attack surface.
Unpatched, forgotten VMs are actively exploited. Solve with: VM lifecycle management, automated decommissioning, regular audits, tagging/naming conventions, policy requiring approval for new VMs. Same principle applies to cloud resources (cloud sprawl).
Full Definition โ†’
Full Definition โ†’
What is voice phishing (vishing)? D2 ยท Threats โ–ธ
Vishing attacks use phone calls โ€” impersonating banks, IRS, tech support, or executives. AI-generated voice cloning makes impersonation nearly perfect even with voice samples.
Verify caller identity through official phone numbers (not numbers they give you). Banks never ask for full PINs or passwords over the phone. Out-of-band verification (call back via known good number) defeats vishing.
Full Definition โ†’
Full Definition โ†’
What is vulnerability management? D4 ยท Operations โ–ธ
Vulnerability management is the continuous process of identifying, classifying, prioritizing, remediating, and verifying security vulnerabilities across the environment.
Vulnerability management = scan (find) โ†’ prioritize (CVSS + context) โ†’ remediate (patch/mitigate) โ†’ verify (rescan). Never-ending cycle. Track metrics: mean time to remediate (MTTR), % critical vulns remediated within SLA.
Full Definition โ†’
Full Definition โ†’
What is VM escape? D2 ยท Threats โ–ธ
VM escape exploits a hypervisor vulnerability to break out of a virtual machine and access the host or other VMs. Rare but catastrophic โ€” undermines entire virtualization security model.
VM escape vulnerabilities (VENOM, VMware vulnerabilities) require immediate patching. Hypervisor attack surface: shared devices, clipboard, drag-and-drop, display rendering. Cloud providers take VM escape vulnerabilities extremely seriously.
Full Definition โ†’
Full Definition โ†’
What is VLAN security? D6 ยท Network+ โ–ธ
VLAN security: segment sensitive systems (finance, PCI, management), isolate guest/IoT on separate VLANs, place inter-VLAN routing behind firewalls, use private VLANs for isolation within same subnet.
VLANs alone don't provide security โ€” traffic between VLANs passes through a router/firewall where ACLs apply. Private VLANs (PVLAN) isolate hosts within the same subnet (useful for hosting environments). Management VLAN should be separate and tightly access-controlled.
Full Definition โ†’
Full Definition โ†’
What are VPN types? D3 ยท Architecture โ–ธ
VPN types: Site-to-site (connects offices, always-on, IPSec), Remote access (individual users, VPN client, SSL or IPSec), Clientless SSL VPN (browser-based, no client required, portal access).
SSL VPN = modern, works through firewalls (port 443). IPSec VPN = network layer, requires client and UDP 500/4500. Always-on VPN ensures corporate policy applies even off-network. ZTNA is replacing traditional VPN โ€” application-level access instead of network-level.
Full Definition โ†’
Full Definition โ†’
What is vulnerability exploitation? D9 ยท PenTest+ โ–ธ
Vulnerability exploitation is the act of taking advantage of a confirmed vulnerability to gain unauthorized access or escalate privileges.
Exploitation should only begin after thorough reconnaissance and scanning โ€” you need to know what to target. Verify exploits are appropriate for the target OS/version (wrong exploit can crash services). Always document every exploitation attempt. Test in lab first when possible.
Full Definition โ†’
Full Definition โ†’
What is vulnerability scanning? D4 ยท Operations โ–ธ
Vulnerability scanning automatically identifies known vulnerabilities โ€” comparing system configurations and software versions against CVE databases.
Credentialed (authenticated) scans find significantly more vulnerabilities than unauthenticated scans. Schedule regular scans: weekly for internet-facing, monthly for internal. Scanning โ‰  pen testing (scanning identifies; pen testing exploits and proves impact). Integrate scan results into vulnerability management program.
Full Definition โ†’
Full Definition โ†’
What is VLAN management? D6 ยท Network+ โ–ธ
VLAN best practices: Change native VLAN from 1 to unused VLAN, disable DTP (Dynamic Trunking Protocol) on access ports, manually configure trunks, prune unused VLANs from trunks, document VLAN purpose.
VLAN 1 is the default native VLAN โ€” change it to prevent double-tagging attacks. DTP auto-negotiates trunking โ€” disable on all access ports to prevent unauthorized trunk establishment. Native VLAN must match on both ends of a trunk (mismatched = VLAN mismatch, connectivity issues).
Full Definition โ†’
Full Definition โ†’
What is vulnerability chaining? D8 ยท CySA+ +
Vulnerability chaining combines multiple lower-severity vulnerabilities to achieve a high-impact outcome that none could accomplish alone โ€” e.g., SSRF + IDOR + misconfigured IAM = account takeover.
CVSS scores are individual. Chained attacks compound severity. Defenders should think about attack paths, not individual vulnerabilities. BloodHound finds AD attack chains. Manual pen testing excels at finding chains automated scanners miss. Patch chained vulns even if each individually seems low-severity.
Full Definition โ†’
What is war driving? D9 ยท PenTest+ โ–ธ
War driving drives around to discover and map wireless networks โ€” logging SSIDs, signal strength, security settings, and GPS coordinates.
Tools: Kismet, Airodump-ng, WiFi Analyzer. War driving maps open/weak Wi-Fi networks. Organizations should monitor for unauthorized APs and ensure WPA3/WPA2-Enterprise for all networks.
Full Definition โ†’
Full Definition โ†’
What is web scraping and security risks? D2 ยท Threats โ–ธ
Web scraping automates data collection from websites โ€” used legitimately for research and maliciously for harvesting email addresses (spam), pricing data (competitive intelligence), or personal info (OSINT).
Credential stuffing uses scraped email lists. Email harvesting feeds phishing campaigns. Defenses: CAPTCHA, rate limiting, bot detection, robots.txt (suggestion only โ€” not enforced). Terms of service may prohibit scraping.
Full Definition โ†’
Full Definition โ†’
What is Windows Hello? D1 ยท General โ–ธ
Windows Hello provides passwordless authentication via biometrics (face, fingerprint) or PIN tied to a specific device. Backed by TPM and FIDO2 standards.
Windows Hello credentials are device-bound โ€” can't be stolen like passwords. Face recognition uses IR cameras to prevent photo spoofing. Hello for Business extends to enterprise with AD/AAD integration. Replaces password for local authentication.
Full Definition โ†’
Full Definition โ†’
What are wireless security modes (WEP, WPA, WPA2, WPA3)? D3 ยท Architecture โ–ธ
ModeStatusWeakness
WEPBrokenRC4 reuse, trivially cracked
WPADeprecatedTKIP vulnerable
WPA2-PersonalAcceptableOffline dictionary attack on PSK
WPA3-PersonalCurrentSAE โ€” much stronger
Never use WEP or WPA. WPA2-Enterprise (802.1X+RADIUS) is preferred for organizations. WPA3 is the current standard.
Full Definition โ†’
Full Definition โ†’
What is Wireshark? D7 ยท Tools โ–ธ
Wireshark is the most widely used GUI network protocol analyzer โ€” capturing live traffic or opening PCAP files, dissecting hundreds of protocols, and filtering with display filters.
Key Wireshark filters: 'tcp.flags.syn==1' (SYN packets), 'http.request.method==GET', 'dns', 'tls.handshake'. Follow TCP/TLS streams to reconstruct conversations. Can decrypt TLS with session keys or pre-master secret logging.
Full Definition โ†’
Full Definition โ†’
What is WMI and its security risks? D2 ยท Threats โ–ธ
WMI (Windows Management Instrumentation) is abused by attackers for lateral movement, persistence (WMI subscriptions), reconnaissance, and fileless code execution โ€” all appearing legitimate.
WMI provides deep system control โ€” defenders and attackers both use it. Malicious WMI subscriptions trigger on specific events (logon, disk insert) providing persistent fileless execution. Monitor WMI activity (MOF files, unusual subscriptions).
Full Definition โ†’
Full Definition โ†’
What is web application security? D2 ยท Threats โ–ธ
Web application security protects web apps from attacks. Layers: secure development (SAST, secure coding), testing (DAST, pen testing), runtime protection (WAF, RASP), and monitoring (logging, anomaly detection).
Web app vulns cause more breaches than network vulns. OWASP Top 10 is the baseline. Defense in depth: secure code + WAF + DLP + monitoring. No single layer is sufficient. Start security in the SDLC, not just at deployment.
Full Definition โ†’
Full Definition โ†’
What are Windows Event Logs? D4 ยท Operations โ–ธ
Key Windows Security Event IDs: 4624 (successful logon), 4625 (failed logon), 4648 (logon with explicit credentials), 4672 (special privileges assigned), 4688 (process creation), 4698 (scheduled task created).
Event ID 4625 + multiple accounts = password spray. 4648 = lateral movement indicator. 4688 with full command line logging reveals malicious commands. Forward Security event log to SIEM. Enable command line logging in audit policy for process creation.
Full Definition โ†’
Full Definition โ†’
What is wireless eavesdropping? D2 ยท Threats โ–ธ
Wireless eavesdropping captures Wi-Fi traffic passively โ€” on open networks, all traffic is readable. WEP is trivially decrypted. WPA2-PSK traffic can be decrypted if the handshake is captured and the PSK cracked.
WPA2-Enterprise (802.1X) protects against passive eavesdropping โ€” even if other clients' traffic is captured, it can't be decrypted without their unique key. Always use WPA2/3-Enterprise for corporate Wi-Fi. Use VPN even on corporate Wi-Fi for sensitive work.
Full Definition โ†’
Full Definition โ†’
What is WPA3? D3 ยท Architecture โ–ธ
WPA3 improvements: SAE (Simultaneous Authentication of Equals โ€” resists offline dictionary attacks), forward secrecy (captured traffic can't be decrypted later), OWE (encrypts open Wi-Fi).
WPA2-PSK: offline brute-force against captured handshake. WPA3-SAE (Dragonfly): each authentication uses unique parameters โ€” offline cracking impossible. WPA3-Enterprise: 192-bit security suite. Upgrade access points and clients to WPA3 when possible.
Full Definition โ†’
Full Definition โ†’
What are wireless channels and interference? D6 ยท Network+ โ–ธ
2.4GHz: only 3 non-overlapping channels (1, 6, 11). 5GHz: many non-overlapping channels, shorter range. 6GHz (Wi-Fi 6E): even more channels, best for dense environments.
2.4GHz has longer range but more interference (microwaves, Bluetooth, neighboring APs all share 3 channels). 5GHz has shorter range but 24+ non-overlapping channels โ€” better for dense deployments. Use 5GHz for corporate, 2.4GHz for range extension.
Full Definition โ†’
Full Definition โ†’
What is Windows privilege escalation? D9 ยท PenTest+ โ–ธ
Windows privesc: unquoted service paths, weak service binary permissions, token impersonation (PrintSpoofer, Potato attacks), AlwaysInstallElevated, UAC bypass, DLL hijacking, kernel exploits.
WinPEAS automates Windows privilege escalation enumeration. Unquoted service path: C:\Program Files\Vulnerable App\service.exe โ†’ try C:\Program.exe (runs as SYSTEM). PrintSpoofer/Potato attacks escalate from SeImpersonatePrivilege (IIS service accounts) to SYSTEM.
Full Definition โ†’
Full Definition โ†’
What is web application penetration testing? D9 ยท PenTest+ โ–ธ
Web app pen testing methodology: map application (crawl, spider) โ†’ analyze architecture โ†’ test each endpoint for OWASP Top 10 vulnerabilities โ†’ document findings โ†’ report.
OWASP Testing Guide (WSTG) provides comprehensive test cases for every web vulnerability type. Burp Suite is the primary tool. Focus on: authentication, authorization (IDOR), injection, session management, business logic flaws. Business logic flaws require manual testing โ€” scanners miss them.
Full Definition โ†’
Full Definition โ†’
What is wireless pen testing? D9 ยท PenTest+ โ–ธ
Wireless pen testing: capture WPA2 handshake (aircrack-ng) โ†’ crack with hashcat, test WPS (pixie dust attack), deploy evil twin AP, check for rogue APs, test 802.1X configuration.
WPA2-PSK: airdump-ng โ†’ airodump to capture handshake โ†’ hashcat -m 22000 for cracking. WPS PIN attack: reaver or bully (many APs now disable WPS). Evil twin: create same SSID, force deauth, capture credentials. Always verify scope includes wireless testing explicitly.
Full Definition โ†’
Full Definition โ†’
What is wireless eavesdropping? D2 ยท Threats โ–ธ
Wireless eavesdropping captures Wi-Fi frames โ€” trivial on open networks, possible on WPA2-PSK if handshake is captured and PSK cracked, prevented by WPA2/3-Enterprise (unique per-user keys).
WPA2-Personal: if PSK is cracked after capturing 4-way handshake, ALL past traffic can be decrypted. WPA2/3-Enterprise: unique per-session keys โ€” even with user credentials, other users' traffic can't be decrypted. Always use VPN even on corporate Wi-Fi for truly sensitive communications.
Full Definition โ†’
Full Definition โ†’
What is web security? D2 ยท Threats โ–ธ
Web security encompasses: input validation (prevent injection), output encoding (prevent XSS), CSRF protection, authentication (strong, MFA), session management (secure cookies), TLS (transport security), security headers (CSP, HSTS).
Web apps are the most attacked application type. OWASP Top 10 is the baseline checklist. Defense in depth: secure code + WAF + DLP + monitoring. HTTPS everywhere is the minimum. Security headers are free โ€” no excuse for not implementing them.
Full Definition โ†’
Full Definition โ†’
What are wireless security protocols? D3 ยท Architecture +
Wireless evolution: WEP (broken, 1997) โ†’ WPA-TKIP (2003, deprecated) โ†’ WPA2-CCMP/AES (2004, current minimum) โ†’ WPA3-SAE (2018, current best). Enterprise adds 802.1X+RADIUS for per-user authentication.
Never use WEP or WPA (TKIP). WPA2-Enterprise (802.1X) is the enterprise minimum. WPA3-SAE prevents offline dictionary attacks against the PSK. WPA3-OWE (Opportunistic Wireless Encryption) encrypts open networks without a password. Upgrade to WPA3 when hardware supports it.
Full Definition โ†’
What is XML injection? D2 ยท Threats โ–ธ
XML injection includes XXE (XML External Entity) attacks โ€” referencing external entities in XML to read local files, SSRF, or DoS via entity expansion (billion laughs attack).
XXE is in OWASP Top 10. Prevention: disable external entity processing in XML parsers. Most XML parsers enable XXE by default โ€” explicitly disable it. XXE can read /etc/passwd, cloud metadata, internal files.
Full Definition โ†’
Full Definition โ†’
What is XDR (Extended Detection and Response)? D8 ยท CySA+ โ–ธ
XDR extends EDR by correlating telemetry across endpoints, network, email, and cloud into a unified platform โ€” providing broader detection coverage and automated response.
EDR = endpoint only. NDR = network only. XDR = everything correlated. Better signal-to-noise ratio than individual tools. Native XDR (single vendor) vs. Open XDR (multi-vendor). Reduces tool sprawl and improves detection of multi-stage attacks.
Full Definition โ†’
Full Definition โ†’
What is XML External Entity (XXE) injection? D2 ยท Threats โ–ธ
XXE exploits poorly configured XML parsers that process external entity references โ€” reading local files (/etc/passwd), SSRF to internal services, or DoS via recursive entities.
Most critical finding when identified: XXE in cloud environments often leads to SSRF โ†’ cloud metadata โ†’ IAM credentials โ†’ full account compromise. Prevention: disable external entity processing in all XML parsers. JSONify APIs where possible.
Full Definition โ†’
Full Definition โ†’
What is XXE (XML External Entity) injection? D2 ยท Threats +
XXE exploits XML parsers that process external entities โ€” reading local files (/etc/passwd), SSRF to internal services, or DoS via recursive entity expansion.
XXE in cloud โ†’ SSRF โ†’ AWS IMDS โ†’ IAM credentials โ†’ full account compromise. Prevention: disable external entity processing in ALL XML parsers (most enable it by default). OWASP Top 10 โ€” critical and often overlooked. Move to JSON APIs where possible.
Full Definition โ†’
How do you prioritize patches? D4 ยท Operations โ–ธ
Patch prioritization factors: CVSS score, exploitation in the wild (CISA KEV catalog), asset criticality, exposure (internet-facing), compensating controls availability.
CISA's Known Exploited Vulnerabilities (KEV) catalog = must-patch immediately. CVSS alone is insufficient โ€” a 9.8 CVSS on an internal dev server is lower priority than a 7.0 on an internet-facing payment server.
Full Definition โ†’
Full Definition โ†’
How do you defend against social engineering? D1 ยท General โ–ธ
Defense layers: security awareness training, phishing simulations, clear verification procedures, culture of healthy skepticism, technical controls (email filtering, DMARC), MFA (defeats credential theft).
Security culture is the most powerful defense โ€” employees who feel comfortable reporting suspicious activity are more valuable than any technical control. "Verify before you trust" should be a default mindset. Make it easy to report and never punish reporters.
Full Definition โ†’
Full Definition โ†’
How do you prioritize patches? D4 ยท Operations โ–ธ
Prioritization factors: CVSS score, actively exploited in the wild (CISA KEV = immediate), asset criticality, internet-facing exposure, compensating controls available.
CISA's Known Exploited Vulnerabilities (KEV) catalog = patch within days. CVSS 9+ on internet-facing = patch within 7 days. CVSS 9+ internal = patch within 30 days. Lower scores = per-standard SLA (90-180 days). Context always matters.
Full Definition โ†’
Full Definition โ†’
How do you detect rootkits? D4 ยท Operations โ–ธ
Rootkit detection: offline scanning from trusted media (can't hide from external scanner), memory analysis (Volatility), integrity verification of system binaries (Tripwire), behavioral indicators (unusual system calls).
You can't trust the results of AV running on a rootkitted system โ€” the rootkit hides from it. Boot from trusted read-only media for analysis. Secure Boot + TPM measured boot prevents most rootkits from surviving a reboot. Safest response: assume system is untrustworthy, reimage.
Full Definition โ†’
Full Definition โ†’
How do you defend against social engineering? D1 ยท General โ–ธ
Defense layers: security awareness training, phishing simulations, clear verification procedures, culture of healthy skepticism, technical controls (email filtering, DMARC), MFA (defeats credential theft even if stolen).
Culture is the most powerful defense โ€” employees who verify unexpected requests through separate channels stop most social engineering. Never punish employees for reporting suspected social engineering โ€” even if it turns out to be legitimate.
Full Definition โ†’
Full Definition โ†’
What is YARA? D7 ยท Tools +
YARA is the malware identification/classification tool using pattern-matching rules. Rules contain strings (ASCII, hex, regex) and conditions that match files or memory.
YARA rules are shareable community intelligence. Used in EDR, sandbox analysis, email gateways, and SIEM. Writing good YARA: focus on malware-unique strings, avoid common library code. VirusTotal hunting uses YARA against their malware corpus.
Full Definition โ†’
What is Zero Trust Architecture (ZTA)? D3 ยท Architecture โ–ธ
ZTA is the NIST-defined framework for implementing zero trust. NIST SP 800-207 defines seven pillars: Identity, Devices, Networks, Applications, Data, Visibility/Analytics, Automation.
ZTA is the architecture; zero trust is the principle. NIST SP 800-207 is the authoritative reference. Key requirements: verify explicitly, use least privilege, assume breach, end-to-end encryption, continuous monitoring.
Full Definition โ†’
Full Definition โ†’
What is zero trust? D3 ยท Architecture โ–ธ
Zero trust: "Never trust, always verify." No user, device, or network segment is inherently trusted โ€” even inside the perimeter. Verify every request explicitly.
Zero trust replaces castle-and-moat perimeter security. Pillars: verify identity (MFA), verify device (posture), verify network (micro-segmentation), verify applications (ZTNA), assume breach (minimal blast radius). NIST SP 800-207 is the authoritative reference.
Full Definition โ†’
Full Definition โ†’