CompTIA Security+ SY0-701

CompTIA Security+ SY0-701 Flashcards: 369 cards

369 free CompTIA Security+ flashcards from the course's cheat sheet and glossary. Tap a card to flip it. Mark the ones you know and they drop out of the deck; the rest keep coming back.

Acronyms 206

3DES: Triple Data Encryption Standard. DES applied three times; legacy and slow, replaced by AES.
802.1X: IEEE 802.1X. Port-based network access control: a device must authenticate before the switch port or Wi-Fi passes traffic.
AAA: Authentication, authorization, and accounting. Prove who you are, decide what you may do, record what you did.
ABAC: Attribute-based access control. Access decisions based on attributes of the user, resource, and context, such as time and location.
ACL: Access control list. An ordered list of permit and deny rules on a router, firewall, or file system.
AES: Advanced Encryption Standard. The standard symmetric cipher, with 128, 192, or 256-bit keys.
AES-128: AES with a 128-bit key. The standard-strength AES, secure and fast.
AES-256: AES with a 256-bit key. The high-strength AES used for data at rest and sensitive sessions.
AES-CCMP: AES in CCMP mode. The AES-based encryption WPA2 uses for Wi-Fi.
AH: Authentication Header. The IPsec protocol that provides integrity and authentication without encryption.
ALE: Annualized loss expectancy. The expected yearly cost of a risk: SLE times ARO.
AP: Access point. The radio that bridges Wi-Fi clients onto the wired network.
API: Application programming interface. The defined way one program talks to another, such as the web endpoints a cloud service exposes.
APT: Advanced persistent threat. A well-funded, skilled, patient attacker, usually a nation-state, that stays hidden for a long time.
ARO: Annualized rate of occurrence. How many times per year an incident is expected to happen.
ARP: Address Resolution Protocol. Finds the MAC address that goes with a known IPv4 address on the local segment.
ASLR: Address space layout randomization. Randomizes where programs load in memory so exploits cannot predict addresses.
AUP: Acceptable use policy. The rules for how staff may use company systems and data.
AV: Asset value. What an asset is worth, the first number in quantitative risk analysis (SLE = AV x EF). Also: Antivirus. Software that detects, quarantines, and removes malware using signatures, heuristics, and behavior.
BEC: Business email compromise. Fraud by email impersonating an executive or vendor to redirect payments.
BIA: Business impact analysis. Identifies critical functions and what an outage of each would cost, setting RTO and RPO.
BPA: Business partnership agreement. How partners share responsibilities, profits, and liabilities.
BYOD: Bring your own device. Staff use personal phones and laptops for work.
CA: Certificate authority. The trusted entity that signs certificates.
CEO: Chief executive officer. The top executive; the person impersonated in whaling and business email compromise.
CFO: Chief financial officer. The executive in charge of money; a common target and impersonation in payment fraud.
CI: Continuous integration. Every code change is automatically built and tested when it is committed.
CIA: Confidentiality, integrity, and availability. The three goals of security: keep data secret, keep it correct, keep it reachable.
CIS: Center for Internet Security. The organization that publishes hardening benchmarks and the CIS Controls.
COPE: Corporate-owned, personally enabled. The company buys the device and lets staff use it personally.
CPU: Central processing unit. The processor that executes instructions.
CRL: Certificate revocation list. A signed list of revoked certificate serial numbers published by a CA.
CSR: Certificate signing request. The file containing a public key and identity that you send to a CA to get a certificate.
CSRF: Cross-site request forgery. Tricks a logged-in user's browser into sending a request the user did not intend.
CVE: Common Vulnerabilities and Exposures. The public identifier for a known vulnerability, such as CVE-2024-12345.
CVSS: Common Vulnerability Scoring System. A 0 to 10 severity score for a vulnerability.
CYOD: Choose your own device. Staff pick from a list of approved devices the company then owns and manages.
DAC: Discretionary access control. The owner of a resource decides who may access it.
DBA: Database administrator. The person who runs the database servers.
DDoS: Distributed denial of service. Many sources, usually a botnet, flood a target at once.
DER: Distinguished Encoding Rules. The binary format for certificates and keys.
DES: Data Encryption Standard. The 1970s 56-bit block cipher; broken by brute force, do not use.
DHCP: Dynamic Host Configuration Protocol. Hands out IP addresses, masks, gateways, and DNS servers automatically (UDP 67 and 68).
DKIM: DomainKeys Identified Mail. Outgoing mail is digitally signed; the public key is published in DNS.
DLP: Data loss prevention. Tools that detect and block sensitive data leaving by email, web, USB, or cloud.
DMARC: Domain-based Message Authentication, Reporting, and Conformance. A DNS policy telling receivers what to do with mail that fails SPF or DKIM, and where to send reports.
DMZ: Demilitarized zone. A screened subnet between the internet and the internal network for public-facing servers.
DNS: Domain Name System. Translates names such as www.example.com into IP addresses (UDP 53, TCP 53 for zone transfers).
DNSSEC: DNS Security Extensions. Digital signatures on DNS records so a resolver can tell an answer was not forged.
DoH: DNS over HTTPS. DNS queries carried inside HTTPS on TCP 443 so they cannot be read or altered in transit.
DoS: Denial of service. One source floods or crashes a target so it cannot serve users.
DoT: DNS over TLS. DNS queries encrypted with TLS on TCP 853.
DSA: Digital Signature Algorithm. A government-standard signature algorithm; used less than RSA and ECDSA today.
EAP: Extensible Authentication Protocol. The framework that carries authentication methods inside 802.1X.
EAP-FAST: EAP Flexible Authentication via Secure Tunneling. Cisco's tunneled EAP method using a protected access credential instead of a certificate.
EAP-TLS: EAP with Transport Layer Security. Certificate-based authentication on both sides; the strongest Wi-Fi and wired 802.1X method.
EAP-TTLS: EAP with Tunneled TLS. A server certificate builds a TLS tunnel, then the client authenticates inside it with a password or other method.
ECC: Elliptic curve cryptography. Public-key cryptography that gives RSA-level strength with much shorter keys, ideal for phones and IoT.
ECDHE: Elliptic Curve Diffie-Hellman Ephemeral. Key exchange with a fresh elliptic curve key per session, giving forward secrecy.
ECDSA: Elliptic Curve Digital Signature Algorithm. Digital signatures using elliptic curve keys.
EDR: Endpoint detection and response. Endpoint agents that record activity, detect attacks, and let responders isolate and clean the machine.
EF: Exposure factor. The fraction of an asset's value lost in one incident.
ESP: Encapsulating Security Payload. The IPsec protocol that encrypts and authenticates the payload.
FIDO2: Fast Identity Online 2. Passwordless or second-factor authentication with a hardware security key or device biometrics.
FIM: File integrity monitoring. Alerts when critical files or configurations change.
FTP: File Transfer Protocol. Plaintext file transfer on TCP 21 (control) and 20 (data); replace with SFTP or FTPS.
FTPS: FTP Secure. FTP wrapped in TLS, ports 990 and 989 (implicit) or 21 with an upgrade (explicit).
GB: Gigabyte. About a billion bytes; the unit for RAM, storage, and data caps.
GCMP: Galois/Counter Mode Protocol. The stronger AES encryption mode used by WPA3.
GPS: Global Positioning System. Satellite positioning, also used as a stratum 0 time reference.
HMAC: Hash-based message authentication code. A keyed hash that proves a message came from someone with the key and was not altered.
HR: Human resources. The department that hires and separates staff; its system should drive account provisioning and removal.
HSM: Hardware security module. A tamper-resistant appliance or card that generates, stores, and uses cryptographic keys.
HTTP: Hypertext Transfer Protocol. Web traffic in the clear on TCP 80.
HTTPS: Hypertext Transfer Protocol Secure. HTTP inside TLS on TCP 443.
IaaS: Infrastructure as a service. The provider supplies virtual machines, storage, and networks; you manage the operating system and up.
IaC: Infrastructure as code. Defining networks and servers in files that tools build automatically and repeatably.
ICS: Industrial control system. The general term for computers that run physical processes; SCADA is one kind.
ID: Identifier or identification. A name or number that uniquely labels a user, device, session, or record.
IDS: Intrusion detection system. Watches a copy of the traffic and alerts on attacks; cannot block them.
IKE: Internet Key Exchange. Negotiates the keys and security associations for IPsec; UDP 500, and 4500 through NAT.
IMAP: Internet Message Access Protocol. Reads mail that stays on the server, synced across devices; TCP 143, secure 993.
IMAPS: IMAP Secure. IMAP over TLS on TCP 993.
iOS: iPhone operating system. Apple's mobile operating system for iPhone.
IoT: Internet of Things. Networked devices such as cameras, sensors, thermostats, and smart TVs.
IP: Internet Protocol. The Layer 3 protocol that addresses and routes packets between networks.
IPS: Intrusion prevention system. Sits inline and blocks attacks as they pass.
IPsec: Internet Protocol Security. The suite that encrypts and authenticates IP packets for VPNs.
ISAC: Information sharing and analysis center. An industry group where members share threat intelligence.
IT: Information technology. Computers, networks, and the people who run them.
KMS: Key management service. A managed, usually cloud-hosted, service that creates, stores, rotates, and controls access to encryption keys.
LACP: Link Aggregation Control Protocol. Negotiates bundling several physical links into one logical link (802.1AX, formerly 802.3ad).
LAN: Local area network. One site's network: a building, floor, or campus that one organization owns and runs.
LDAP: Lightweight Directory Access Protocol. Queries a directory such as Active Directory for users and groups; TCP 389, secure 636.
LDAPS: LDAP Secure. LDAP over TLS on TCP 636.
LTE: Long-Term Evolution. 4G cellular data; the workhorse mobile broadband standard.
MAC: Media access control (address). The 48-bit Layer 2 hardware address of a network interface, which a switch uses to forward frames. Also: Mandatory access control. The access control model where the system assigns classification labels that users cannot change.
MD5: Message Digest 5. A 128-bit hash that is broken: collisions can be manufactured; recognize, never recommend.
MDM: Mobile device management. Software that enrolls phones and tablets and enforces policy: passcodes, encryption, apps, remote wipe.
MFA: Multi-factor authentication. Two or more different kinds of proof: something you know, have, are, or where you are.
MIME: Multipurpose Internet Mail Extensions. The standard that lets email carry attachments and non-text content.
MOA: Memorandum of agreement. A more formal, sometimes binding, statement of what parties agree to do.
MOU: Memorandum of understanding. A non-binding statement of intent and roles between parties.
MPLS: Multiprotocol Label Switching. A provider WAN that forwards by short labels instead of IP lookups, with traffic engineering and QoS.
ms: Millisecond. One thousandth of a second; latency and response times.
MSA: Master service agreement. The umbrella contract covering a whole vendor relationship; individual jobs hang off it.
MTBF: Mean time between failures. The average running time before a component fails; a reliability measure.
MTTR: Mean time to repair. The average time to fix a failure and restore service.
NAC: Network access control. Checks a device's identity and health before letting it onto the network.
NAT-T: NAT traversal. Wraps IPsec in UDP 4500 so it can pass through address translation.
NDA: Non-disclosure agreement. A contract that keeps shared information confidential.
NGFW: Next-generation firewall. A firewall that identifies applications and users, and includes intrusion prevention.
NTP: Network Time Protocol. Synchronizes clocks across the network (UDP 123); wrong time breaks Kerberos, certificates, and logs.
NTS: Network Time Security. Authentication and integrity for NTP so time cannot be spoofed.
OAuth: Open Authorization. Lets a user grant an application limited access to their account on another service without sharing the password.
OCSP: Online Certificate Status Protocol. A real-time query to the CA asking whether one certificate is revoked.
OS: Operating system. The software that manages hardware and runs applications: Windows, macOS, Linux, iOS, Android.
OSINT: Open-source intelligence. Information gathered from public sources: websites, social media, records, DNS.
P7B: PKCS #7 bundle. A file holding a certificate chain with no private key.
PBKDF2: Password-Based Key Derivation Function 2. Stretches a password with many hash rounds so guessing is slow.
PEAP: Protected EAP. A server certificate creates a TLS tunnel and the user's password is checked inside it.
PEM: Privacy Enhanced Mail (format). The Base64 text format for certificates and keys, with BEGIN and END lines.
PFX: Personal Information Exchange. A password-protected bundle holding a certificate and its private key (also .p12).
PIN: Personal identification number. A short numeric secret, a something-you-know factor.
PKI: Public key infrastructure. The system of certificate authorities, certificates, and revocation that makes public keys trustworthy.
POP3: Post Office Protocol version 3. Downloads mail to one device and usually deletes it from the server; TCP 110, secure 995.
POP3S: POP3 Secure. POP3 over TLS on TCP 995.
PSK: Pre-shared key. One shared passphrase for everyone on a Wi-Fi network (Personal mode).
RA: Registration authority. The part of a PKI that verifies identities before the CA signs.
RADIUS: Remote Authentication Dial-In User Service. The AAA server behind Wi-Fi Enterprise, VPNs, and 802.1X; UDP 1812 and 1813.
RAID: Redundant array of independent disks. Combining disks for speed, capacity, or fault tolerance: 0 stripe, 1 mirror, 5 stripe with parity, 6 double parity, 10 mirrored stripes.
RAM: Random-access memory. The working memory that holds running programs and data; lost at power off.
RAT: Remote access trojan. Malware that opens a back door so an attacker can control the machine.
RBAC: Role-based access control. Permissions are assigned to roles, and users get roles.
RC4: Rivest Cipher 4. A fast stream cipher used in WEP and old TLS; broken and deprecated.
RDP: Remote Desktop Protocol. Microsoft's remote graphical desktop on TCP 3389.
RFID: Radio-frequency identification. Tags read by radio for badges, inventory, and asset tracking.
RPO: Recovery point objective. The maximum acceptable data loss, measured in time.
RSA: Rivest, Shamir, Adleman. The classic public-key algorithm for encryption and digital signatures.
RTO: Recovery time objective. The maximum acceptable time to restore a service after failure.
RTOS: Real-time operating system. An operating system that guarantees responses within strict time limits, used in embedded and control devices.
RTP: Real-time Transport Protocol. Carries the actual voice and video packets of a call, over UDP.
SaaS: Software as a service. Complete applications delivered over the web, such as email and office suites.
SAE: Simultaneous authentication of equals. The WPA3 Personal handshake that resists offline password guessing.
SAML: Security Assertion Markup Language. An XML standard for passing authentication between an identity provider and a web application (enterprise SSO).
SAN: Subject alternative name. The certificate field listing every hostname the certificate is valid for.
SASE: Secure access service edge. SD-WAN networking plus cloud-delivered security (firewall, web gateway, ZTNA, CASB) as one service.
SCADA: Supervisory control and data acquisition. Systems that monitor and control industrial processes such as power, water, and manufacturing.
SCAP: Security Content Automation Protocol. Standard formats that let tools check systems against security benchmarks automatically.
SD-WAN: Software-defined wide area network. Steers traffic across several cheap links (broadband, LTE, MPLS) by policy from a central controller.
SDLC: Software development life cycle. The phases of building software: plan, design, code, test, deploy, maintain.
SDN: Software-defined networking. Separates the control plane (decisions) from the data plane (forwarding) and centralizes control.
SFTP: SSH File Transfer Protocol. File transfer inside an SSH session, TCP 22.
SHA: Secure Hash Algorithm. The family of hash functions: SHA-1 (deprecated), SHA-2 (SHA-256, the standard), SHA-3.
SHA-1: Secure Hash Algorithm 1. A 160-bit hash, deprecated because collisions have been found.
SHA-2: Secure Hash Algorithm 2. The current hash family, including SHA-256 and SHA-512.
SHA-256: Secure Hash Algorithm 256-bit. The standard hash today: a 256-bit fingerprint of any input.
SHA-3: Secure Hash Algorithm 3. A newer hash standard with a different internal design from SHA-2.
SIEM: Security information and event management. Collects logs from everything, correlates them, and raises alerts.
SIP: Session Initiation Protocol. Sets up and tears down voice and video calls; port 5060, or 5061 with TLS.
SLA: Service level agreement. The contract stating measurable service commitments, such as 99.9% uptime.
SLE: Single loss expectancy. The cost of one occurrence of a risk: asset value times exposure factor.
SMB: Server Message Block. Windows file and printer sharing on TCP 445.
SMS: Short Message Service. Text messages; used for one-time codes and also a phishing channel (smishing).
SMTP: Simple Mail Transfer Protocol. Sends email between servers on TCP 25; clients submit on 587 with TLS.
SMTPS: SMTP Secure. SMTP with TLS, port 465 (implicit) or 587 with STARTTLS.
SNMP: Simple Network Management Protocol. Polls and receives alerts from network devices (UDP 161 polls, 162 traps).
SOW: Statement of work. Defines one specific piece of work: deliverables, timeline, and price.
SPF: Sender Policy Framework. A DNS TXT record listing which servers may send mail for a domain.
SQL: Structured Query Language. The language used to query databases; also the name of the servers on TCP 1433 (Microsoft) and 3306 (MySQL).
SRTP: Secure Real-time Transport Protocol. Encrypted RTP for voice and video.
SSH: Secure Shell. Encrypted remote command-line access and file transfer on TCP 22; replaces Telnet and FTP.
SSID: Service set identifier. The Wi-Fi network name that access points broadcast and clients join.
SSL: Secure Sockets Layer. The predecessor of TLS; every version is deprecated.
SSO: Single sign-on. Log in once and reach many systems without signing in again.
SSRF: Server-side request forgery. Makes the web server itself fetch a URL the attacker supplies, often reaching internal systems.
SY0-701: CompTIA Security+ exam SY0-701. The current version of the Security+ certification exam.
TACACS+: Terminal Access Controller Access-Control System Plus. Cisco's AAA protocol for device administration on TCP 49; encrypts the whole payload and separates authentication from authorization.
TCP: Transmission Control Protocol. Reliable, ordered, connection-based transport: three-way handshake, acknowledgments, retransmission.
TFTP: Trivial File Transfer Protocol. Bare-bones UDP 69 file transfer with no login, used for firmware and config files.
TKIP: Temporal Key Integrity Protocol. WPA's per-packet keying scheme; deprecated.
TLS: Transport Layer Security. The encryption layer under HTTPS and most secure protocols; use 1.2 or 1.3.
TOC: Time of check. The moment a program verifies a condition; in a race condition, before it acts on it.
TOU: Time of use. The moment a program acts on a condition it checked earlier.
TPM: Trusted Platform Module. A security chip on the motherboard that stores keys and measurements; required for BitLocker and Windows 11.
TV: Television. A display or broadcast receiver; smart TVs are IoT devices.
UBA: User behavior analytics. Baselines what each user normally does and flags deviations.
UEFI: Unified Extensible Firmware Interface. Modern firmware that replaces BIOS: GPT disks, Secure Boot, mouse-driven setup.
UPS: Uninterruptible power supply. A battery unit that keeps equipment running through a power cut and conditions the power.
URL: Uniform resource locator. A web address such as https://www.example.com/page.
USB: Universal Serial Bus. The standard port for peripherals, storage, and charging.
UTM: Unified threat management. One appliance bundling firewall, IDS/IPS, antivirus, content filtering, and VPN.
VLAN: Virtual local area network. A logical LAN on a switch: ports in different VLANs are separate broadcast domains.
VM: Virtual machine. A complete computer running as software on a hypervisor.
VPN: Virtual private network. An encrypted tunnel across an untrusted network such as the internet.
WAF: Web application firewall. A firewall that understands HTTP and blocks attacks on web applications such as SQL injection and XSS.
WAN: Wide area network. Connects LANs across cities or countries, usually over links leased from a provider.
WEP: Wired Equivalent Privacy. The original Wi-Fi encryption, broken in minutes; never use it.
Wi-Fi: Wireless fidelity. The trade name for IEEE 802.11 wireless networking.
WO: Work order. A short authorization for one specific job.
WPA: Wi-Fi Protected Access. The interim fix for WEP that used TKIP; deprecated.
WPA2: Wi-Fi Protected Access 2. Wi-Fi security using AES with CCMP; still common and acceptable.
WPA3: Wi-Fi Protected Access 3. The current Wi-Fi security standard: SAE in Personal mode, stronger encryption, protected management frames.
XDR: Extended detection and response. EDR extended across endpoints, network, cloud, and email into one correlated view.
XML: Extensible Markup Language. A text format for structured data, used by SAML, SOAP, and many configuration files.
XSS: Cross-site scripting. An attacker's script runs in other users' browsers because a site echoes untrusted input.

The exam itself 9

Exam code: SY0-701 (Security+)
Questions: Up to 90, multiple choice plus performance-based
Time: 90 minutes
Passing score: 750 on a scale of 100 to 900 (about 83%)
1.0 General Security Concepts: 12%
2.0 Threats, Vulnerabilities, and Mitigations: 22%
3.0 Security Architecture: 18%
4.0 Security Operations: 28%
5.0 Security Program Management and Oversight: 20%

Cryptography 25

Symmetric: One shared key encrypts and decrypts. Fast, bulk data. AES (128, 192, 256-bit), 3DES (legacy), ChaCha20, Blowfish
Asymmetric: Public key encrypts or verifies, private key decrypts or signs. Slow, used for key exchange and signatures. RSA, ECC (smaller keys, same strength), DSA, ECDSA
Key exchange: Diffie-Hellman and ECDHE agree on a shared key over an open channel. Ephemeral keys give perfect forward secrecy
Hashing: One-way fixed-length fingerprint: MD5 128-bit (broken), SHA-1 160-bit (deprecated), SHA-256, SHA-3. HMAC adds a key for authenticity
Salting: Random data added to a password before hashing so identical passwords hash differently and rainbow tables fail
Key stretching: Make hashing slow on purpose: PBKDF2, bcrypt, scrypt, Argon2
Digital signature: Hash the message, encrypt the hash with the private key. Proves integrity, authenticity, and non-repudiation
Key length: Longer is stronger; AES-256 over AES-128, RSA 2048 minimum, ECC 256 is comparable to RSA 3072
Blockchain: Open public ledger: chained hashed blocks, tamper-evident, distributed
Transport encryption: TLS 1.2 and 1.3 for web and mail, IPsec for VPNs, SSH for shells. Deprecated: SSL, TLS 1.0 and 1.1
Full-disk: The whole drive; protects a lost laptop
Partition or volume: One partition or logical volume
File: Individual files
Database: The whole database
Record: Individual fields or rows, such as card numbers
Certificate authority (CA): Issues and signs certificates; the root of trust
Registration authority: Verifies identity before the CA issues
CSR: Certificate signing request: the public key plus identity sent to the CA
CRL: Certificate revocation list, downloaded periodically; can be stale
OCSP: Real-time revocation check of one certificate; OCSP stapling has the server include a fresh response
Self-signed: Not signed by a trusted CA; browsers warn; internal use only
Third-party: Issued by a public CA; trusted by browsers
Wildcard: *.example.com covers every subdomain at one level
SAN: Subject alternative name: several names on one certificate
Formats: PEM (Base64 text, .crt .pem), DER (binary), PFX or P12 (with private key), P7B (chain, no private key)

Threat actors, vectors, and social engineering 19

Message-based: Email, SMS, instant messaging
Image-based and file-based: Malicious images, macros in documents, executables
Voice call: Vishing
Removable device: USB drops
Vulnerable software: Client-based (agent installed) versus agentless
Unsupported systems: End-of-life operating systems and applications
Unsecure networks: Open wireless, unmanaged wired ports, Bluetooth
Open service ports, default credentials: Exposed services, unchanged admin passwords
Supply chain: Managed service providers, vendors, suppliers
Phishing: Fraudulent email to steal credentials or deliver malware
Vishing, smishing: The same by voice call, by text message
Spear phishing, whaling: Targeted at a person; targeted at an executive
Business email compromise: Attacker uses or imitates a real business account to redirect payments
Pretexting: An invented story that justifies the request
Impersonation, brand impersonation: Pretending to be a person; pretending to be a company
Watering hole: Compromise a site the targets already visit
Typosquatting: Look-alike domain names catching mistyped URLs
Misinformation, disinformation: False content spread unknowingly; spread deliberately
Tailgating, shoulder surfing, dumpster diving: Following through a door; watching a screen; reading the trash

Vulnerabilities 11

Application: Memory injection, buffer overflow, race conditions (time-of-check to time-of-use), malicious update
Operating system: Unpatched services, weak defaults
Web-based: SQL injection (' OR 1=1), cross-site scripting (script in a page other users load)
Hardware: Firmware flaws, end-of-life, legacy devices
Virtualization: VM escape (guest reaches the host), resource reuse (data left in reallocated memory or storage)
Cloud-specific: Misconfigured storage, shared-tenant risks, exposed APIs
Supply chain: Service provider, hardware provider, software provider
Cryptographic: Weak or deprecated algorithms, short keys, bad implementations
Misconfiguration: Open ports, default settings, excessive permissions
Mobile: Side loading (apps from outside the store), jailbreaking or rooting
Zero-day: Known to attackers before a patch exists

Attacks and indicators 8

Ransomware: Files encrypted, payment demanded
Trojan: Hidden inside a wanted program; remote access trojan gives control
Worm: Spreads by itself across the network
Virus: Attaches to files, needs a user action to spread
Spyware, keylogger: Watches activity; records keystrokes
Bloatware: Unwanted preinstalled software, expands attack surface
Logic bomb: Triggers on a date or event
Rootkit: Hides at kernel or firmware level; survives reboots, evades antivirus

Security architecture 12

Security zones: Trusted, untrusted, screened subnet (DMZ) for public-facing servers
Attack surface: Everything reachable; shrink it
Fail-open versus fail-closed: Fail-open keeps traffic flowing when the control fails (availability); fail-closed blocks (security)
Active versus passive: Inline (can block, can bottleneck) versus tap or monitor port (sees a copy, alerts only)
Jump server: Hardened host you go through to reach protected systems
Proxy server: Forward proxy for clients; reverse proxy in front of servers
IPS versus IDS: Inline and blocks versus out of band and alerts
Load balancer: Spreads traffic; active-active or active-passive
Sensors: Collect traffic or logs for monitoring
Port security: 802.1X authentication on switch ports and Wi-Fi, using EAP (EAP-TLS with certificates is strongest; PEAP, EAP-TTLS, EAP-FAST)
Firewall types: WAF (Layer 7, protects web apps), UTM (all-in-one), NGFW (application-aware, user-aware), Layer 4 (ports) versus Layer 7 (content)
Secure communication: VPN and remote access; tunneling with TLS or IPsec; SD-WAN; SASE (network plus cloud security)

Data protection 9

Regulated: Law or regulation governs it: health, payment card, personal data
Trade secret, intellectual property: Formulas, source code, designs
Legal information, financial information: Contracts, litigation; ledgers, filings
Human-readable versus non-human-readable: Documents versus binaries and encrypted blobs
Public: Anyone may see it
Private, sensitive: Internal; harm if leaked
Confidential: Limited to those who need it
Restricted: Tightly controlled, often regulated
Critical: The organization cannot function without it

Resilience and recovery 12

Load balancing versus clustering: Spreads requests across servers; servers act as one system with failover
Hot site: Running mirror, minutes to switch, most expensive
Warm site: Equipment ready, data restored on failover, hours
Cold site: Space and power only, days
Geographic dispersion: Sites far enough apart that one disaster cannot hit both
Platform diversity, multi-cloud: Different vendors so one flaw or outage does not take everything
Continuity of operations: Keep the business running through the incident
Capacity planning: People, technology, infrastructure sized for growth and surge
Testing: Tabletop (talk through), failover (actually switch), simulation (drill), parallel processing (run both and compare)
Backups: Onsite and offsite, frequency, encryption, snapshots, replication, journaling (log every change), tested recovery
Full, incremental, differential: Everything; changes since the last backup of any kind (small, slow restore); changes since the last full (bigger, faster restore)
Power: UPS bridges to the generator; generator for long outages

Securing resources and monitoring 22

Identification: Vulnerability scans (credentialed sees more), application analysis static and dynamic, package monitoring, threat feeds (OSINT, proprietary, ISACs, dark web), penetration testing, responsible disclosure and bug bounty, system and process audits
Analysis: Confirm (false positive, false negative), prioritize with CVSS and CVE, classification, exposure factor, environmental variables, industry and organizational impact, risk tolerance
Response: Patch, cyber insurance, segmentation, compensating controls, documented exceptions and exemptions
Validation: Rescan, audit, verify
Reporting: Trends, open items, time to remediate
None: 0.0
Low: 0.1 to 3.9
Medium: 4.0 to 6.9
High: 7.0 to 8.9
Critical: 9.0 to 10.0
Firewall rules, access lists, ports and protocols, screened subnets: Allow only what is needed between zones
IDS/IPS trends and signatures: Detect known patterns; tune for trends
Web filter: Agent-based or centralized proxy; URL scanning, content categorization, block rules, reputation
Operating system security: Group Policy on Windows, SELinux on Linux
Secure protocols: Pick the encrypted port and transport: SSH not Telnet, HTTPS not HTTP, SFTP not FTP, SNMPv3, LDAPS, DoH or DoT
DNS filtering: Block known-bad domains at resolution
Email security: SPF (allowed senders), DKIM (signed mail), DMARC (policy for failures), email gateway
File integrity monitoring: Alert when critical files change
DLP: Prevent sensitive data from leaving by email, USB, or upload
NAC: Check device health before granting network access
EDR and XDR: Endpoint detection and response; extended across network and cloud
User behavior analytics: Baseline each user, alert on deviation

Identity and access management 12

Provisioning and deprovisioning: Create access on hire, remove it on exit; the classic offboarding failure is a still-active account
Identity proofing: Verify a person is who they claim before issuing credentials
Federation: One organization trusts another's identities
SSO protocols: SAML (XML, enterprise web SSO), OAuth (authorization delegation), OpenID Connect (authentication on OAuth), LDAP (directory), Kerberos (tickets, Windows domains)
Attestation: Confirming that a device or account state is what it claims
Mandatory (MAC): Labels and clearances set by the system; users cannot change them; military
Discretionary (DAC): The owner decides who gets access; file permissions
Role-based (RBAC): Permissions attach to roles, users to roles
Rule-based: Fixed rules such as firewall ACLs or time limits
Attribute-based (ABAC): Decisions from attributes: department, location, device, time
Time-of-day restrictions: Access only during set hours
Least privilege: Only what the job needs

Incident response and forensics 7

Firewall logs: Allowed and blocked connections
Application logs: Errors, logins, transactions
Endpoint logs: Processes, files, EDR alerts
OS-specific logs: Windows Event logs, Linux syslog and auth logs
IPS/IDS logs: Matched signatures
Network logs, metadata: Flows, DNS, headers
Vulnerability scans, automated reports, dashboards, packet captures: State, trends, and raw evidence

Governance, risk, and compliance 17

Asset value (AV): What the asset is worth
Exposure factor (EF): Fraction of value lost in one incident
Single loss expectancy: SLE = AV x EF
Annualized rate of occurrence (ARO): How many times per year
Annualized loss expectancy: ALE = SLE x ARO
Qualitative versus quantitative: High/medium/low ratings versus dollars and probabilities
Assessment cadence: Ad hoc, recurring, one-time, continuous
Risk register: List of risks with key risk indicators, owners, and thresholds
Risk tolerance and appetite: How much variance is acceptable; appetite is expansionary, conservative, or neutral
Strategies: Transfer (insurance), accept (with exemption or exception), avoid (stop the activity), mitigate (add controls)
Business impact analysis: RTO (time to restore), RPO (data loss allowed), MTTR (mean repair time), MTBF (mean time between failures)
SLA: Measurable service levels and penalties
MOA, MOU: Agreement of intent; MOU less formal
MSA: Master agreement covering the relationship; work orders hang off it
WO / SOW: Work order or statement of work for one job
NDA: Confidentiality
BPA: Business partnership agreement: profits, responsibilities

Questions people ask

How many CompTIA Security+ SY0-701 flashcards are there?

369: 206 Acronyms, 9 The exam itself, 25 Cryptography, 19 Threat actors, vectors, and social engineering, 11 Vulnerabilities, 8 Attacks and indicators, 12 Security architecture, 9 Data protection, 12 Resilience and recovery, 22 Securing resources and monitoring, 12 Identity and access management, 7 Incident response and forensics, 17 Governance, risk, and compliance. They come from the course's cheat sheet and glossary, so what you drill is what the lessons teach.

Do I need an account?

No. The cards you mark as known are remembered in this browser only. Sign in to the course for progress that follows you between devices.