CompTIA Security+ (SY0-701) Flashcards

Confidentiality, Integrity, and Availability. Confidentiality restricts data access to authorized parties, integrity ensures data has not been altered improperly, and availability ensures systems and data are accessible when needed.

Authentication, Authorization, and Accounting. Authentication verifies identity, authorization determines what an authenticated identity is permitted to do, and accounting logs what actions were actually taken.

Authentication proves who a user is (identity verification), while authorization determines what an authenticated user is allowed to access or do.

A security property ensuring a party cannot deny having performed an action, typically enforced through digital signatures and audit logs that tie an action to a specific identity.

Symmetric encryption uses a single shared key for both encryption and decryption, making it fast but requiring secure key distribution. Asymmetric encryption uses a mathematically linked public/private key pair, solving key distribution but at a higher computational cost.

A previously unknown software flaw that has no available patch, exploited by attackers before the vendor becomes aware and can issue a fix.

A vulnerability is a weakness that can be exploited, a threat is a potential danger that could exploit that weakness, and risk is the likelihood and impact of a threat successfully exploiting a vulnerability.

The use of psychological manipulation to trick people into divulging confidential information, granting access, or performing actions that compromise security, rather than exploiting technical flaws.

Phishing is social engineering conducted via email, vishing is conducted via voice/phone calls, and smishing is conducted via SMS text messages.

A layered security strategy that uses multiple, overlapping controls (technical, administrative, and physical) so that if one control fails, others still protect the asset.

Users, processes, and systems should be granted only the minimum access rights necessary to perform their required functions, reducing the potential impact of a compromised account.

A distributed denial-of-service attack in which multiple compromised systems (often a botnet) flood a target with traffic or requests, overwhelming it and denying service to legitimate users.

A virus requires a host file and user action to spread, a worm self-propagates across networks without user interaction, and a trojan disguises itself as legitimate software to trick users into installing it.

Malware that encrypts a victim's files or locks them out of a system, then demands payment (typically cryptocurrency) in exchange for restoring access.

An authentication method requiring two or more independent verification factors from different categories: something you know (password), something you have (token), and something you are (biometric).

A network security device or software that monitors and controls incoming and outgoing traffic based on predetermined security rules, forming a barrier between trusted and untrusted networks.

An intrusion detection system (IDS) monitors traffic and alerts on suspicious activity but does not act on it, while an intrusion prevention system (IPS) sits inline and can actively block or stop detected threats.

A virtual private network creates an encrypted tunnel over a public network, providing confidentiality and integrity for data in transit between endpoints.

Dividing a network into smaller isolated zones to limit the lateral movement of attackers, contain breaches, and enforce access controls between segments.

Preventive controls stop an incident before it occurs (e.g., firewalls), detective controls identify an incident as or after it occurs (e.g., IDS, logging), and corrective controls restore systems and reduce impact after an incident (e.g., backups, patching).

Qualitative risk analysis uses subjective ratings (high/medium/low) to prioritize risks, while quantitative risk analysis assigns numeric/monetary values, such as calculating Annualized Loss Expectancy, to measure risk impact.

SLE is the monetary loss expected from a single occurrence of a risk event, calculated as Asset Value multiplied by the Exposure Factor (the percentage of asset value lost).

The expected yearly monetary loss from a risk, calculated as Single Loss Expectancy (SLE) multiplied by the Annualized Rate of Occurrence (ARO).

Accept (take no action and absorb the risk), avoid (eliminate the activity causing the risk), mitigate (reduce likelihood or impact with controls), and transfer (shift risk to a third party, such as through insurance).

Recovery Time Objective (RTO) is the maximum acceptable time to restore a system after a disruption, while Recovery Point Objective (RPO) is the maximum acceptable amount of data loss measured in time since the last backup.

A process that identifies critical business functions and quantifies the operational and financial impact of their disruption, informing recovery priorities and continuity planning.

A documented, unbroken record of who collected, handled, transferred, and stored evidence, ensuring the evidence remains admissible and untampered from collection through legal proceedings.

AES is a symmetric algorithm that uses the same secret key for encryption and decryption and is efficient for bulk data, while RSA is an asymmetric algorithm using a public/private key pair, commonly used for key exchange and digital signatures.

A digital certificate binds a public key to a verified identity, issued and signed by a trusted Certificate Authority (CA), enabling parties to trust that a public key belongs to the claimed owner.

Hashing produces a fixed-length, one-way digest of data used to verify integrity; any change to the original data produces a different hash, but the original data cannot be derived from the hash.