CompTia Security + Non-Multiple Choice

Confidentiality, Integrity, Availability

Users should have the minimum level of access necessary to perform their job functions.

Virus, Worm, Trojan.

A network security device that monitors and controls incoming and outgoing network traffic based on predetermined security rules.

The manipulation of individuals to gain confidential information by exploiting human psychology rather than technical hacking techniques.

A security system that requires more than one method of verification to gain access to a resource.

Preparation, Detection and Analysis, Containment, Eradication and Recovery, Post-Incident Activity.

Distributed Denial of Service; an attack that attempts to make a machine or network resource unavailable by overwhelming it with traffic.

It converts data into a coded format to prevent unauthorized access.

An electronic document used to prove the ownership of a public key, issued by a Certificate Authority (CA).

A method of trying to gather personal information using deceptive emails and websites.

Virtual Private Network; a service that creates a secure connection over the Internet.

Symmetric uses the same key for encryption and decryption, while asymmetric uses a pair of keys (public and private).

A formal document that outlines an organization's security measures and expectations.

An automated process used to identify vulnerabilities in systems and applications

The process of identifying, assessing, and prioritizing risks followed by coordinated efforts to minimize, monitor, and control the probability or impact of unforeseen events.

An attack method that involves trying all possible combinations of passwords until the correct one is found.

A minimum level of security that must be implemented to protect an organization's information systems.

An attack where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other.

A security process that requires two different forms of identification from the user to access a system.

A device or software application that monitors network or system activities for malicious activities or policy violations.

The process of managing updates for software applications and technologies to fix vulnerabilities and improve security.

To assess the effectiveness of an organization’s security policies and controls against established standards.

A security flaw that is unknown to the vendor and has no patch available at the time it is discovered.

Authentication verifies who you are, while authorization determines what you are allowed to do.

A standard security technology for establishing an encrypted link between a server and a client.

A framework for managing digital certificates and public-key encryption.

A security resource whose value lies in being probed, attacked, or compromised to gather information about threats.

Strategies and tools used to prevent sensitive data from being lost, misused, or accessed by unauthorized users.

Malicious software designed to harm, exploit, or otherwise compromise a computer system or network.

A list of permissions attached to an object that specifies which users or system processes can access that object.

A virus attaches itself to a legitimate program and requires user action to spread, while a worm is a standalone malware that replicates itself to spread to other systems automatically.

A physical or digital device that is used to gain access to a network or system, often as part of a two-factor authentication system.

A plan for how to respond to emergencies or unexpected events to ensure business continuity.

Dividing a computer network into smaller, manageable segments to improve performance and security.

An employee or contractor who uses their access to an organization’s resources to harm or exploit the organization.

A physical or logical subnetwork that contains and exposes an organization's external-facing services to an untrusted network, typically the Internet.

The encryption of data stored on a disk or storage device to protect it from unauthorized access.

A type of malware that enables unauthorized access to a computer while hiding its presence.

A solution that aggregates and analyzes security data from across an organization’s technology infrastructure.

An incident that results in unauthorized access to sensitive data or systems.

The encryption of data as it travels over a network to prevent interception by unauthorized parties.

The method or pathway used by a threat actor to gain access to a target system.

A set of rules governing the creation, use, and management of passwords to enhance security.

A type of malware that encrypts a victim's files and demands a ransom payment to restore access.

A software update designed to fix vulnerabilities, bugs, or security flaws in software applications or operating systems.

A piece of software, a chunk of data, or a sequence of commands that takes advantage of a bug or vulnerability.

A type of surveillance software that records keystrokes made by a user to capture sensitive information like passwords.

A documented strategy outlining the processes to follow when responding to a security breach or incident.

To identify, quantify, and prioritize vulnerabilities in a system.

The process of replacing sensitive data elements with non-sensitive equivalents, called tokens, that retain essential information without compromising security.

The design artifacts that describe how security controls are positioned and how they relate to the overall system architecture.