Luyện CompTIA Security+

Unauthorized modification of data violates integrity, which ensures information is accurate and has not been altered.

Phishing uses deceptive email messages to trick users into revealing credentials or sensitive information.

Vishing is voice phishing: attackers use phone calls and social engineering to obtain sensitive information.

Smishing is phishing carried out through SMS or text messages.

Spear phishing targets specific individuals with customized messages. When senior executives are the targets, it is often called whaling.

Baiting offers something tempting, such as a labeled USB drive, to persuade a victim into an action that compromises security.

Tailgating occurs when an unauthorized person follows an authorized person into a restricted area without credentials.

Shoulder surfing is observing someone enter credentials or other sensitive information, often by looking over their shoulder.

Dumpster diving is collecting information from discarded media and documents that were not securely destroyed.

A watering hole attack infects a trusted site likely to be visited by the target group, then waits for victims to arrive.

Ransomware encrypts data or locks systems and demands payment, usually in cryptocurrency, to restore access.

A Trojan disguises itself as legitimate software while performing malicious actions in the background.

Worms self-replicate and propagate across networks automatically, exploiting vulnerabilities or weak configurations.

A rootkit conceals its presence at the OS or kernel level and provides persistent privileged access to an attacker.

A botnet is a network of compromised devices controlled remotely, often used for DDoS, spam, or credential attacks.

Malware often generates unexpected network activity, creates persistence through scheduled tasks or startup entries, and may encrypt or rename files. Certificate expiration is a normal lifecycle event, not a malware symptom.

Phishing, tailgating, and shoulder surfing manipulate human behavior. SQL injection exploits a database query flaw rather than human trust.

Spear phishing is personalized phishing aimed at a specific individual or small group, often using names and job context to increase credibility.

Phishing uses email, vishing uses voice calls, smishing uses SMS, and whaling targets senior executives with email campaigns.

Ransomware encrypts files, worms self-replicate, Trojans disguise themselves, and rootkits hide privileged access.

A zero-day is a previously unknown vulnerability that is exploited before the vendor has released a fix.

The Common Vulnerability Scoring System (CVSS) provides a numeric severity score. CVE is the vulnerability identifier system.

Vulnerability scanning detects known weaknesses non-destructively, while penetration testing attempts to exploit them to validate real-world impact.

Timely patch management closes known vulnerabilities before attackers can exploit them. It cannot guarantee protection against unknown zero-days.

Parameterized queries separate SQL logic from user input, preventing attackers from changing the query structure.

Output encoding or escaping neutralizes injected script content, which is the core defense against cross-site scripting (XSS).

A buffer overflow occurs when data exceeds the allocated memory region, which can overwrite adjacent memory and enable code execution.

DLL injection inserts malicious code into a trusted process by making it load an attacker-controlled dynamic library.

Symmetric encryption, such as AES, uses one shared secret key for both encryption and decryption.

RSA is an asymmetric algorithm: one key encrypts or signs, and the paired key decrypts or verifies.

Hashing, such as SHA-256, produces a fixed-size digest that changes when the input changes, allowing integrity verification.

A digital signature verifies the sender identity and document integrity, and provides non-repudiation. It does not by itself keep content confidential.

A digital certificate is issued by a certificate authority and binds a public key to an identity such as a domain or person.

Certificate revocation lists (CRLs) and the Online Certificate Status Protocol (OCSP) let clients check whether a certificate has been revoked.

Plaintext delivery exposes the key during transit and storage. Secret keys should be exchanged only through approved secure channels and managed with proper key lifecycle controls.

Hashing, digital signatures, and file integrity monitoring detect unauthorized changes. Port forwarding is a networking function, not an integrity control.

Salted hashes slow offline cracking, lockout stops online guessing, and MFA limits the value of stolen passwords. Plaintext storage greatly increases risk.

Symmetric encryption uses one shared key, asymmetric encryption uses a key pair, hashing produces a fixed-size digest, and a digital certificate binds a public key to an identity.

OCSP, the Online Certificate Status Protocol, returns current certificate revocation status without downloading a full CRL.

AES is symmetric encryption, RSA is asymmetric, SHA-256 is a hash, and digital signatures provide authenticity and non-repudiation.

MFA requires at least two factors from different categories, such as knowledge, possession, and inherence.

A smart card or hardware token is a possession factor. Passwords and PINs are knowledge factors; fingerprints are inherence factors.

RBAC assigns permissions based on organizational roles rather than individual ownership or labels.

Least privilege grants the minimum permissions required for a role, limiting the impact of compromise.

PAM controls privileged accounts with vaulting, session monitoring, rotation, and just-in-time access.

Password managers generate and store unique strong passwords, reducing reuse and improving account hygiene.

SSO authenticates the user once and passes identity assertions to multiple applications, often using SAML or OIDC.

A firewall inspects traffic and enforces allow or deny rules at network boundaries.

An IDS detects and alerts on suspicious activity, while an IPS takes active action such as dropping or blocking the traffic.

Segmentation contains breaches by restricting communication paths, so a compromised system has limited reach.

A demilitarized zone (DMZ) sits between the internet and the internal network and hosts services that must be reachable externally.

A WAF filters HTTP/HTTPS requests and blocks common application-layer attacks before they reach the application.

A VPN protects data in transit by encapsulating and encrypting traffic between endpoints over untrusted networks.

Zero trust verifies every access request continuously and grants the least privilege needed, regardless of network location.

EDR collects endpoint telemetry, detects suspicious behavior, and supports automated investigation and response.

Customers are generally responsible for guest OS, IAM, and data protection, while the provider secures the physical data center and underlying infrastructure.

Microsegmentation, NAC, and host-based firewalls restrict east-west traffic. Open internal traffic would make lateral movement easier.

Zero trust requires verification for every access request and assumes no implicit trust.

A hardware security module (HSM) protects keys and performs cryptographic operations in tamper-resistant hardware.

A firewall protects the network perimeter, EDR protects endpoints, a WAF protects web applications, and an HSM protects cryptographic keys.

Incident response begins with protecting people and the organization, then moves to containment to limit damage.

Isolating infected systems stops ransomware from spreading and preserves the ability to recover and investigate.

Chain of custody records every transfer of evidence, proving that it was not altered and preserving legal admissibility.

Imaging the original media with a write blocker preserves the evidence while analysis is performed on the copy.

A security information and event management (SIEM) system aggregates logs, correlates events, and generates alerts.

Authentication logs record successful and failed login attempts, making them the primary source for access-related detection.

Retention policies specify storage duration, legal obligations, and destruction requirements for data and logs.

The General Data Protection Regulation (GDPR) governs personal data protection and privacy for EU individuals.

The Payment Card Industry Data Security Standard (PCI DSS) applies to organizations that store, process, or transmit cardholder data.

Risk is generally expressed as the likelihood of a threat exploiting a vulnerability multiplied by the resulting impact.

Risk transfer shifts the financial impact to another party, such as an insurance provider.

A BCP maintains essential business operations during disruptions, while a disaster recovery plan restores IT systems and data.

RPO measures how much data loss is acceptable, usually expressed as the maximum age of data that must be recoverable.

RTO is the target time within which systems and operations must be restored after disruption.

A tabletop exercise is a discussion-based simulation that tests plans, roles, and decision-making without production impact.

Chain of custody, write blockers, and hashing preserve evidence integrity. Analyzing the original drive risks altering it.

Least privilege, behavior analytics, and DLP detect and limit risky insider activity. Open shared folders increase the risk.

The recovery point objective (RPO) defines the maximum tolerable data loss, measured by the age of the recovered data.

Chain of custody records every person who handled evidence and every transfer, preserving its integrity and admissibility.

Preparation builds readiness, detection identifies incidents, containment and eradication stop the threat before recovery restores services, and post-incident activity captures lessons learned.