Your FREE SecurityX (CASP+) Flashcards 2026 – 100+ Cards

Encryption using one shared secret key for both encrypting and decrypting — fast, ideal for bulk data (e.g., AES); the challenge is securely distributing the key.

Encryption using a public/private key pair (e.g., RSA, ECC) — solves key exchange and enables digital signatures, but is slower than symmetric.

The modern, widely trusted symmetric block cipher used for bulk data encryption; supports 128-, 192-, and 256-bit keys.

A widely used asymmetric algorithm based on the difficulty of factoring large numbers; used for key exchange and digital signatures.

Asymmetric cryptography that delivers equivalent strength to RSA with much shorter keys — efficient for mobile and constrained devices.

A key-exchange algorithm that lets two parties derive a shared secret over an insecure channel; the ephemeral variant (DHE/ECDHE) provides forward secrecy.

A one-way function mapping input of any size to a fixed-length, irreversible digest (e.g., SHA-256) — provides integrity, not confidentiality.

A secure 256-bit cryptographic hash from the SHA-2 family, used for integrity verification and digital signatures.

Hash-based Message Authentication Code — a hash combined with a secret key to provide both integrity and authenticity of a message.

A value created with a sender's private key that proves authenticity, integrity, and non-repudiation; verified with the sender's public key.

Assurance that a party cannot deny having performed an action — provided cryptographically by digital signatures.

Random data added to a password before hashing so identical passwords produce different hashes, defeating precomputed (rainbow-table) attacks.

Deliberately slow password hashing (bcrypt, PBKDF2, Argon2) that increases the cost of brute-force attacks.

The framework of CAs, RAs, and policies that creates, distributes, validates, and revokes digital certificates binding identities to public keys.

The trusted entity in a PKI that signs and issues digital certificates and can revoke them.

The PKI entity that verifies a requester's identity before the CA issues a certificate.

A document binding a verified identity to a public key, signed by a CA so relying parties can trust the key.

A published list of certificates a CA has revoked before their natural expiry.

Online Certificate Status Protocol — a real-time query to check whether a single certificate has been revoked, instead of downloading a full CRL.

A trusted anchor (e.g., a root CA or hardware module) from which a chain of trust is built.

A tamper-resistant device that generates, stores, and uses cryptographic keys inside a hardened boundary; keys never leave in plaintext.

A chip embedded in a host for secure boot integrity measurement and hardware-backed key storage.

Storing a recoverable copy of cryptographic keys with a trusted third party for business continuity or legal access.

Use of ephemeral session keys so that compromise of a long-term private key cannot decrypt previously recorded sessions.

The protocol that secures data in transit (e.g., HTTPS) using a hybrid of asymmetric key exchange and symmetric encryption.

A protocol providing an encrypted channel for remote login and command execution.

SSH File Transfer Protocol — secure file transfer running over an SSH-encrypted channel.

A protocol suite that authenticates and encrypts IP traffic, commonly used to build VPN tunnels.

Algorithms designed to resist attacks by large quantum computers, which could break today's RSA and elliptic-curve cryptography.

Designing systems so cryptographic algorithms can be swapped out without re-architecting — essential for the post-quantum transition.

The threat of an adversary recording encrypted traffic today to decrypt it once quantum computers mature.

Encryption that allows computation on ciphertext without decrypting it, so data stays protected during processing.

An attack that tries every possible key or password until the correct one is found; defeated by large key spaces and key stretching.

When two different inputs produce the same hash output; resistance to collisions is why MD5 and SHA-1 are deprecated.

Hard-coding the expected certificate or public key in a client so it rejects any other, even from a valid CA.

A trusted execution environment that isolates sensitive code and keys from the main operating system.

A security model that removes implicit trust based on network location and verifies every request on identity, device, and context — “never trust, always verify.”

The zero-trust tenet of authenticating and authorizing every request on identity, device health, and context — no implicit trust from location.

The zero-trust mindset of designing as if an attacker is already inside — segmenting, encrypting, and monitoring to contain damage.

Layering multiple, overlapping controls (data, app, host, network, perimeter, people) so that if one fails, others still protect the asset.

Dividing a network into isolated zones (VLANs, subnets) so traffic between them passes through controls, limiting lateral movement.

Segmentation pushed down to individual workloads or hosts, enforcing zero-trust policy at a fine granularity.

A network segment placed between the internal network and untrusted external networks to host public-facing services.

A physical control that isolates a system or network with no connection to other networks, used for the most sensitive environments.

A virtual LAN that logically separates devices into broadcast domains regardless of physical location, supporting segmentation.

Secure Access Service Edge — converges networking (SD-WAN) and security (SWG, CASB, ZTNA, FWaaS) into one cloud-delivered service.

Zero Trust Network Access — grants application access per session based on identity and policy, instead of broad network access like a VPN.

Cloud Access Security Broker — a policy enforcement point between users and cloud services for visibility, DLP, and access control.

The cloud security split where the provider secures the cloud infrastructure and the customer secures their data, identities, and configurations.

Infrastructure as a Service — the customer secures the most (OS, apps, data); the provider secures the underlying physical and virtualization layers.

Software as a Service — the provider secures almost everything; the customer mainly secures its data and user access.

Monitoring and blocking unauthorized movement of sensitive data across network, endpoint, and storage based on classification.

Labeling data by sensitivity (e.g., public, internal, confidential, restricted) so the right protections can be applied.

A control that filters, monitors, and blocks malicious HTTP traffic to and from a web application (layer 7).

Inline monitoring that actively detects and blocks identified threats, unlike an IDS, which only alerts.

Monitoring that detects and alerts on suspicious activity but does not block it inline.

A control that admits devices to the network only if they meet security policy (patch level, posture, identity).

An encrypted tunnel that secures data transmission over an unsecured network such as the internet.

Running isolated virtual machines on shared hardware via a hypervisor — used to contain and segregate sensitive workloads.

Building security into a system from the start rather than bolting it on later.

The total set of points where an attacker could attempt to enter or extract data; reducing it is a core architectural goal.

Configuring systems to provide only the services and capabilities required, disabling everything else to shrink the attack surface.

Architecture that minimizes downtime through redundancy, failover, and load balancing.

Packaging an application with its dependencies into an isolated container; secured via image scanning, least privilege, and runtime controls.

Software-defined WAN — centrally managed, policy-driven wide-area networking, often paired with security in a SASE architecture.

A hardened, exposed host that brokers access into a private network, reducing direct exposure of internal systems.

The discipline and tools for managing digital identities and controlling their access to resources.

Controls that secure, monitor, and limit the use of privileged/administrator accounts.

Security Information and Event Management — aggregates and correlates logs across the enterprise to detect threats, alert, and support investigations.

Security Orchestration, Automation, and Response — automates and coordinates incident response via playbooks and tool integrations.

The team and facility that monitors, detects, and responds to security events around the clock.

Desensitization caused by too many alerts (often false positives) from an untuned SIEM, leading analysts to miss real threats.

A knowledge base of real-world adversary tactics (goals) and techniques (methods) used to map detections and drive threat hunting.

Lockheed Martin's linear 7-stage intrusion model: reconnaissance, weaponization, delivery, exploitation, installation, command & control, actions on objectives.

A forensic artifact (malicious IP/domain, file hash, registry key, beaconing) that signals a system may have been breached.

The proactive, hypothesis-driven search for adversaries that have evaded existing detections, before any alert fires.

Evidence-based knowledge about threats — actors, their TTPs, and indicators — used to inform defense.

A decoy system designed to lure, detect, and analyze attackers, diverting them from real assets and revealing their techniques.

An offensive security team that emulates real adversaries to find exploitable gaps before attackers do.

A defensive security team that detects, responds to, and hardens against attacks through the SOC.

A function that integrates Red and Blue teams so attack findings immediately improve detections.

The group that sets the rules of engagement, referees a security exercise, and scores it impartially.

An authorized simulated attack that exploits vulnerabilities to assess real-world risk and validate defenses.

NIST's four phases: preparation; detection & analysis; containment, eradication & recovery; post-incident activity.

Limiting the spread and impact of an incident (e.g., isolating a host) — usually the first action in a live incident.

Removing the threat — malware, attacker footholds, compromised accounts — from the environment.

The documented, unbroken record of who handled evidence and when — what keeps it admissible in legal proceedings.

Collecting evidence most-volatile-first (memory, network state) before less-volatile data (disk) so nothing is lost.

A bit-for-bit, hash-verified copy of storage made for analysis so the original evidence is never altered.

A directive to preserve relevant data once litigation or an investigation is anticipated.

Determining the underlying reason an incident occurred so the same issue can be prevented from recurring.

Detection that matches known patterns (hashes, rules, byte sequences) — precise on known threats but blind to novel ones.

Detecting threats by flagging deviations from a baseline of normal user, host, or network behavior.

A control that detects unauthorized changes to critical files by comparing them against a known-good baseline.

Endpoint tooling that records and analyzes activity to detect, investigate, and respond to threats on hosts.

A tool (e.g., Nessus) that probes systems for known vulnerabilities and misconfigurations.

The period an attacker remains undetected in an environment; threat hunting and detection aim to reduce it.

A predefined, repeatable set of response steps for a given incident type, often automated through SOAR.

Centralizing logs from many sources so they can be correlated and analyzed together (a core SIEM function).

The average time to contain and resolve an incident; lower MTTR signals a more mature operations program.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, set by leadership.

The acceptable variation around the risk appetite for a specific objective or activity.

The risk that remains after a chosen treatment (mitigate, transfer, accept, avoid) has been applied.

Reducing a risk's likelihood or impact by applying controls.

Shifting the financial impact of a risk to a third party, such as through insurance or contractual indemnity.

Choosing to tolerate a risk because it falls within the organization's risk appetite.

Eliminating a risk by stopping the activity that creates it.

The monetary loss expected from one occurrence of a risk — asset value × exposure factor.

How many times per year a given loss event is expected to occur.

SLE × ARO — the expected yearly loss a control's cost is justified against.

Assessing risk with relative ratings (high/medium/low) rather than precise monetary values.

Assessing risk with monetary values and probabilities (SLE, ARO, ALE) to justify control spending.

The investigation and ongoing evaluation of risk involved in a decision, such as a vendor or acquisition.

The reasonable actions and controls a prudent organization implements based on its due-diligence findings.

Splitting a sensitive task across multiple people so no single person can complete it alone, preventing fraud.

Granting each user or process only the minimum access needed to perform its function.

Periodically moving staff between roles to surface fraud and reduce dependence on any one person.

Requiring staff to take time off so that fraudulent activity dependent on their presence is exposed.

Comparing the current security state against a desired or required state to identify what's missing.

A plan to keep critical business functions running during and after a disruption.

A plan focused on restoring IT systems and data after a disruptive event — a key component of a BCP.

The maximum acceptable time to restore a system or process after a disruption.

The maximum acceptable amount of data loss, measured as time, after a disruption.

Information Security Management System — the policies and processes (e.g., per ISO 27001) that manage information-security risk.

An international standard specifying requirements for establishing and operating an ISMS.

A voluntary framework organizing cybersecurity activities into core functions (Identify, Protect, Detect, Respond, Recover, Govern).

General Data Protection Regulation — the EU law protecting the privacy and personal data of EU residents.

Payment Card Industry Data Security Standard — requirements for protecting cardholder data.

U.S. regulation protecting the privacy and security of health information.

Capability Maturity Model Integration — a model for assessing and improving the maturity of organizational processes.

A framework of best practices for delivering IT services effectively and efficiently.

A role responsible for overseeing an organization's compliance with data-protection laws such as GDPR.

Evaluating a vendor's security posture and compliance before and during a business relationship.

A machine-readable inventory of every component and dependency in software, key to managing supply-chain risk.

A documented record of identified risks, their assessment, owners, and treatment status.

An alternative safeguard used when the primary control cannot be applied, to reduce residual risk.