Security+ Flashcards & Memory Notes

Who can read the data. Publishing a lab result breaks confidentiality even if the file is unchanged.

That data was not changed without permission. An edited invoice that still opens is an integrity failure.

That people can use the data when they need it. Ransomware that blocks access is an availability failure.

It stops the action before it succeeds. A firewall drop is preventive. A camera recording is detective.

A substitute when the preferred control cannot be used. A VPN plus a device certificate can stand in for MFA on a legacy app.

The Policy Enforcement Point. The Policy Engine decides. The Policy Administrator carries the decision out.

A TPM is a chip on the motherboard. An HSM is a dedicated key device. Both hold keys in hardware.

A hash is one-way. Encryption can be reversed with the key.

So identical passwords produce different hashes and a precomputed table fails.

Who sent it, and that it did not change. It uses the sender's private key. A shared symmetric key cannot show which party signed.

An insider misuses access they already have. Shadow IT is a system the organization did not approve.

Phishing by text message. Vishing is a voice call.

On its own, without a user opening a host file. A virus needs a host.

Malware that looks useful so someone will install it.

Spraying tries a few passwords on many accounts. Brute force tries many passwords on one account.

SQL injection changes a database query. XSS runs a script in the browser.

A flaw that is exploited before the vendor has a patch.

The resource changes after the permission check and before it is used.

A site the targets already visit, compromised so their browsers are infected.

It hides processes and files. Ransomware demands payment. A logic bomb waits for a condition.

Hot is fastest, then warm, then cold. Cold is space more than equipment.

The maximum acceptable downtime. RPO is how much data you can lose.

When people must be able to leave, such as a door during a fire. Sensitive data should fail closed.

HTTP requests, such as form fields and URLs. A layer 4 filter does not understand the application.

No network path to other systems.

A network segment that faces untrusted traffic, with internal systems behind it.

CVE names the flaw. CVSS scores its severity.

A false negative misses a real flaw. A false positive is an alert on something harmless.

SPF lists senders, DKIM signs the message, and DMARC sets the failure policy.

It collects logs from many systems and correlates them into alerts.

SAML carries a sign-in assertion. OAuth issues an authorization token.

MAC uses system labels, DAC lets the owner decide, and RBAC uses roles.

Something you know, have, or are, and somewhere you are.

Elevated access that expires. It replaces a standing admin right.

Preparation, detection, analysis, then containment. Eradication, recovery, and lessons learned come after.

Asset value times exposure factor.

SLE times the annualized rate of occurrence.

Avoid stops the activity. Transfer shifts the impact, often to insurance.

The controller decides why data is processed. The processor follows those instructions.

The tester is given internal knowledge, such as diagrams or credentials. An unknown environment withholds that knowledge.