Your FREE Security+ Flashcards 2026 – 300+ Cards

Confidentiality, Integrity, Availability — the three core goals of information security.

Ensuring only authorized people can read data; enforced by encryption and access control.

Ensuring data is accurate and unaltered; enforced by hashing and digital signatures.

Ensuring authorized users can access data when needed; enforced by redundancy and backups.

Assurance that someone cannot deny an action they performed; provided by digital signatures and logging.

Authentication (prove identity), Authorization (grant rights), and Accounting (log activity).

Verifying that a subject is who it claims to be (e.g., with a password, token, or biometric).

Granting an authenticated subject the rights to access specific resources.

Recording what authenticated subjects do, for tracking and forensics.

Authentication proves WHO you are; authorization decides WHAT you may access.

A safeguard implemented by technology — firewall, encryption, MFA, antivirus.

An administrative safeguard — policies, risk assessments, security planning.

A safeguard carried out by people — awareness training, guard duty, config management.

A tangible safeguard — locks, fences, badges, cameras, bollards.

A control that stops an incident before it happens (e.g., a firewall rule or a lock).

A control that discourages an attacker (e.g., a warning sign or lighting).

A control that identifies an incident during or after it (e.g., an IDS or log review).

A control that fixes or limits damage after an event (e.g., restoring a backup).

An alternative control used when the primary control isn't feasible.

A control that directs behavior, such as a policy or procedure.

A model that removes implicit trust and verifies every request — 'never trust, always verify.'

The 'brain' that makes access decisions: the Policy Engine and Policy Administrator.

The part that enforces decisions on each request via the Policy Enforcement Point (PEP).

The Zero Trust component that decides to grant or deny access based on policy and context.

The Zero Trust component that allows or blocks each actual request to a resource.

Adjusting authentication requirements based on context and risk (a Zero Trust concept).

An area where access is trusted by default — what Zero Trust seeks to eliminate.

A decoy system that lures attackers away from real assets and records their behavior.

A network of honeypots that mimics a real environment to study attackers.

A bait file (e.g., 'passwords.xlsx') that triggers an alert when accessed.

Fake data (a credential, record, or API key) that signals compromise when used.

Encryption using one shared secret key to both encrypt and decrypt; fast (e.g., AES).

Encryption using a public/private key pair; one key encrypts, the other decrypts (e.g., RSA, ECC).

Advanced Encryption Standard — the dominant symmetric block cipher (128/192/256-bit keys).

A widely used asymmetric algorithm for key exchange and digital signatures.

Elliptic Curve Cryptography — asymmetric crypto giving strong security with smaller keys.

A key-exchange method that lets two parties derive a shared secret over an insecure channel.

A one-way function producing a fixed-length digest; used for integrity, not reversible.

A secure hashing algorithm producing a 256-bit digest, used for integrity verification.

An obsolete hash function, broken by collisions — should not be used for security.

Adding unique random data to a password before hashing so identical passwords differ.

Repeatedly hashing a password (e.g., bcrypt, PBKDF2, Argon2) to slow brute-force attacks.

A message hash encrypted with the signer's private key; proves integrity and authenticity.

Encrypt FOR someone with their public key; verify a signature with the signer's public key.

Decrypt what was sent to you; SIGN messages with your own private key.

Use asymmetric crypto to exchange a fast symmetric session key, then symmetric for the data (TLS).

Public Key Infrastructure — the CAs, policies, and keys that issue and manage digital certificates.

A trusted entity that issues and signs digital certificates.

The top, self-signed CA in a trust chain; usually kept offline for protection.

A CA signed by the root that issues end-entity certificates to protect the root key.

A file binding a public key to a verified identity, signed by a CA.

Certificate Signing Request — a request sent to a CA to issue a certificate for a public key.

Certificate Revocation List — a published list of certificates the CA has revoked.

Online Certificate Status Protocol — a real-time query to check if a certificate is revoked.

Associating a host with its expected certificate/key to resist fraudulent certs.

A certificate that secures a domain and all its subdomains (e.g., *.example.com).

Trusted Platform Module — a hardware chip that securely stores keys and supports disk encryption.

Hardware Security Module — a tamper-resistant device for generating and storing keys.

An isolated hardware region that protects data and keys even from the host OS.

Storing a copy of keys with a trusted third party so data can be recovered if a key is lost.

Hiding data inside other data (e.g., within an image) so its existence is concealed.

Making data or code hard to understand to slow analysis (not true encryption).

A distributed, append-only ledger secured by hashing and consensus.

Replacing sensitive data with a non-sensitive token mapped to the real value stored securely.

The set of algorithms (key exchange, encryption, hashing) negotiated for a TLS session.

Using ephemeral keys so a compromised long-term key can't decrypt past sessions.

A structured process to approve, document, test, and roll back changes safely.

Comparing the current security posture to a desired state to find what's missing.

A fraudulent message (usually email) that tricks the victim into revealing credentials or running malware.

Voice phishing — a social-engineering attack carried out over a phone call.

SMS phishing — a social-engineering attack delivered by text message.

A phishing attack targeted at a specific individual using personalized details.

A phishing attack that specifically targets high-value executives.

Impersonating a trusted executive or vendor to authorize fraudulent payments.

Inventing a believable scenario or pretext to manipulate a victim into cooperating.

Redirecting users from a legitimate site to a fake one, often via poisoned DNS.

Compromising a website the target group is known to visit, to infect them.

Registering misspelled domains to catch users who mistype a URL.

Pretending to be someone trusted to gain access or information.

Following an authorized person through a secure door without credentials.

Searching discarded materials for sensitive information.

Observing someone's screen or keypad to steal credentials or data.

Spreading false content to manipulate beliefs or actions.

An individual or group that carries out an attack.

A government-sponsored, highly resourced threat actor; usually motivated by espionage.

A skilled, well-resourced adversary that maintains long-term stealthy access.

A profit-driven, well-funded threat actor group.

An attacker motivated by a political or social cause.

A current/former employee or partner who misuses authorized access.

A 'script kiddie' who uses others' tools without deep expertise.

Hardware, software, or services used without IT/security approval.

The path or means an attacker uses to gain access (email, USB, supply chain).

The total set of points where an attacker could try to enter or extract data.

Compromising a trusted vendor, MSP, or software update to reach the target.

Malicious software — ransomware, trojans, worms, viruses, spyware, rootkits, keyloggers.

Malware that encrypts data and demands payment for the decryption key.

Ransomware that also steals data and threatens to leak it if unpaid.

Malware disguised as legitimate software that hides a malicious payload.

Self-replicating malware that spreads across networks without user action.

Malware that attaches to a host file and spreads when that file is executed.

Malware that secretly gathers information about a user or system.

Malware or hardware that records keystrokes to steal credentials.

Malware that hides at a privileged level (often the kernel) to maintain stealthy access.

Malicious code that executes when a specific condition or time is met.

Unwanted pre-installed software that expands the attack surface.

Malware that runs in memory using legitimate tools, leaving little on disk.

A network of compromised devices controlled by an attacker (often for DDoS).

Writing more data than a buffer holds, overwriting adjacent memory to run code.

A timing flaw between time-of-check and time-of-use that can be exploited.

Inserting malicious code into a running process's memory space.

Inserting malicious SQL into input so the database runs unintended commands.

Use parameterized queries (prepared statements) plus input validation.

Injecting script into a trusted site that runs in another user's browser.

Output encoding, input validation, and a Content Security Policy (CSP).

Tricking a logged-in user's browser into sending an unwanted authenticated request.

A vulnerability unknown to the vendor with no patch available yet.

An insecure default or setting; a leading cause of breaches.

Factory usernames/passwords left unchanged — an easy attacker entry point.

Breaking out of a virtual machine to access the hypervisor or host.

An attacker secretly relays or alters traffic between two parties (formerly MITM).

Capturing and re-sending valid data (e.g., a session token) to impersonate a user.

Corrupting DNS records to redirect users to malicious sites.

Sending forged ARP messages to associate the attacker's MAC with another IP.

Overwhelming a target with traffic from many sources to deny service.

Using a service to multiply traffic volume toward a victim (a DDoS technique).

Gaining higher rights than granted — vertical (to admin) or horizontal (to a peer).

Trying a few common passwords against many accounts to avoid lockouts.

Systematically trying many passwords or keys until one works.

Trying passwords from a list of likely words.

A precomputed table of hashes used to crack unsalted password hashes.

An artifact (IP, hash, behavior) suggesting a system was breached.

Dividing a network into zones to limit how far an attacker can move.

Granting only the minimum access needed to limit the blast radius.

Applying updates to fix known vulnerabilities.

Removing unneeded services/accounts and applying secure baselines.

Permitting only approved software to run (stronger than block-listing).

Running untrusted code in an isolated environment to contain harm.

Layering multiple independent controls so one failure isn't a breach.

Cloud split: provider secures the infrastructure; customer secures data, identity, and config.

Provider = security OF the cloud (infrastructure); customer = security IN the cloud (data/config).

Infrastructure as a Service — customer manages OS, apps, and data (most responsibility).

Platform as a Service — provider manages the platform; customer manages apps and data.

Software as a Service — provider manages almost everything; customer manages data and access.

Running multiple guest operating systems on one physical host via a hypervisor.

Software that creates and runs virtual machines (Type 1 bare-metal or Type 2 hosted).

Packaging an app with its dependencies in an isolated container sharing the host kernel.

Running code as functions without managing servers; the provider scales it.

Building an app as small, independently deployable services.

Provisioning infrastructure from version-controlled machine-readable files.

Centrally programming network behavior via software, separate from hardware.

Internet of Things — networked everyday devices, often with weak built-in security.

Industrial control systems that run physical processes; hard to patch, need segmentation.

A purpose-built computer inside a device, often with limited update ability.

A network segment grouped by trust level to control traffic between areas.

A perimeter network segment that hosts public-facing services, isolated from the internal LAN.

A device that filters network traffic based on rules to enforce a security boundary.

A firewall adding application awareness, deep inspection, and threat intel.

Web Application Firewall — protects web apps from layer-7 attacks like injection and XSS.

Unified Threat Management — one appliance combining firewall, IPS, AV, filtering, and more.

Intrusion Detection System — detects and alerts on suspicious traffic (passive).

Intrusion Prevention System — detects and blocks suspicious traffic inline (active).

IDS only detects/alerts (passive); IPS sits inline and can block (active).

An intermediary that mediates and can filter client requests to other servers.

A hardened pivot host used to administer systems in a secure zone.

Distributes traffic across multiple servers for availability and scale.

Fail-open allows traffic on failure (availability); fail-closed blocks it (security).

Active devices sit inline and can act; passive devices observe via a tap or span port.

A port-based network access control standard that authenticates devices before granting access.

Limiting which devices (by MAC) can connect to a switch port.

Data stored on disk, database, or backup; protected with encryption and access control.

Data moving across a network; protected with TLS or VPN encryption.

Data actively processed in memory; protected by techniques like secure enclaves.

Labeling data by sensitivity (public, sensitive, confidential, critical) to set controls.

Hiding part of a data value (e.g., showing only the last four digits).

Replacing sensitive data with a non-sensitive token; the real value is stored securely.

Data Loss Prevention — detects and blocks unauthorized movement of sensitive data.

The principle that data is subject to the laws of the country where it resides.

Designing systems to stay operational with minimal downtime via redundancy.

Linking servers so they act as one resilient unit, with failover.

Load balancing spreads traffic; clustering provides coordinated failover/redundancy.

A fully equipped alternate site ready for near-instant failover (most expensive).

A partially equipped recovery site needing some setup before use.

A recovery site with space and power only; longest to bring online (cheapest).

Placing redundant systems in different locations to survive regional disasters.

Redundant Array of Independent Disks — combines drives for redundancy and/or performance.

Uninterruptible Power Supply — battery backup that keeps systems up during short outages.

Keep 3 copies of data, on 2 media types, with 1 copy offsite.

Recovery Time Objective — the maximum acceptable time to restore a system.

Recovery Point Objective — the maximum acceptable data loss, measured back to the last backup.

RTO = how fast you recover (downtime); RPO = how much data you can lose.

Mean Time Between Failures — average time a system runs before failing.

Mean Time To Repair — average time to restore a failed system.

A point-in-time copy of a system or volume for quick recovery.

Logging changes so a system can be restored to a consistent state after a crash.

Reducing attack surface by removing unneeded services/accounts and applying secure baselines.

A standard, approved secure configuration applied to systems.

Mobile Device Management — centrally enforces policies and security on mobile devices.

Bring Your Own Device — employees use personal devices for work (higher risk).

Corporate-Owned, Personally Enabled — company device usable for personal tasks.

The current secure Wi-Fi protocol; uses SAE to resist offline password cracking.

Simultaneous Authentication of Equals — WPA3's secure key-exchange handshake.

Securely erasing or destroying media so data can't be recovered before disposal.

A maintained list of hardware/software assets, essential to securing them.

An automated check that identifies known weaknesses in systems.

An authorized simulated attack that actually exploits weaknesses to prove risk.

A scan only identifies weaknesses; a pen test exploits them.

Common Vulnerabilities and Exposures — a public catalog of unique vulnerability IDs.

Common Vulnerability Scoring System — a 0–10 severity score for a vulnerability.

A reported vulnerability/alert that isn't actually a real issue.

A real vulnerability or attack that the tool failed to detect (dangerous).

Reporting a vulnerability privately to the vendor before public release.

A program that pays outside researchers for responsibly reported vulnerabilities.

Fixing a vulnerability by patching, reconfiguring, or applying a compensating control.

Re-scanning after remediation to confirm the fix actually worked.

Security Information and Event Management — aggregates and correlates logs to detect threats.

Centralizing logs from many sources for correlation and analysis.

Adjusting detection rules to cut false positives and reduce alert fatigue.

Simple Network Management Protocol — monitors and manages network devices.

A protocol that records IP traffic flow data for monitoring and analysis.

Security Orchestration, Automation, and Response — automates response via playbooks.

Endpoint Detection and Response — monitors endpoints to detect and respond to threats.

Extended Detection and Response — correlates detection across endpoints, network, and cloud.

File Integrity Monitoring — alerts when critical files change unexpectedly.

Software that detects and removes malicious code on endpoints.

Blocking access to malicious or disallowed websites.

Blocking resolution of known-malicious domains.

Sender Policy Framework — lists which mail servers may send for a domain.

DomainKeys Identified Mail — cryptographically signs email to prove it wasn't altered.

Ties SPF and DKIM together and tells receivers how to handle failures (anti-spoofing).

The email-authentication trio that fights spoofing and phishing.

Policies and tools that manage identities and control access.

Creating accounts on hire and promptly removing them on departure.

Verifying a person's real-world identity before issuing credentials.

Single Sign-On — one authentication grants access to multiple systems.

Trusting identities from another domain to access resources (e.g., SAML, OIDC).

Security Assertion Markup Language — an XML standard for federated SSO.

An authorization framework that lets apps access resources without sharing passwords.

An authentication layer built on OAuth 2.0 for verifying identity.

Lightweight Directory Access Protocol — queries and manages directory information.

A ticket-based network authentication protocol using a trusted Key Distribution Center.

Multi-factor authentication — two or more factors from different categories.

An MFA knowledge factor — a password or PIN.

An MFA possession factor — a token, phone, or smart card.

An MFA inherence factor — a biometric like a fingerprint or face.

Both are the same category (knowledge); MFA needs DIFFERENT factor types.

Time-based One-Time Password — a short-lived code from an authenticator app.

Role-Based Access Control — permissions follow the user's role.

Mandatory Access Control — the system enforces labels/clearances (high security).

Discretionary Access Control — the resource owner decides who gets access.

Attribute-Based Access Control — access decided by attributes and context.

Granting only the minimum access needed to do a job.

Splitting a sensitive task so no single person controls the whole process.

Privileged Access Management — controls, vaults, and audits admin accounts.

Granting elevated rights only for the moment they're needed, then revoking.

Preparation; detection & analysis; containment, eradication & recovery; post-incident.

Containment — isolate affected systems to stop the spread before eradicating.

Removing the threat and any persistence from affected systems.

Restoring systems from known-good, tested backups and monitoring for reinfection.

Lessons learned and root cause analysis that feed back into preparation.

A discussion-based walkthrough of an incident scenario to test the plan.

Proactively searching for hidden threats that evaded automated detection.

Collecting and analyzing evidence in a sound, documented way.

Documentation of who handled evidence, when, and how — to keep it admissible.

A directive to preserve relevant data when litigation/investigation is anticipated.

Collecting the most volatile evidence (RAM) before the least (disk, archives).

Identifying and producing electronic evidence for legal proceedings.

The policies, standards, procedures, and oversight that direct a security program.

A high-level statement of management's security intent and rules.

A specific mandatory requirement that supports a policy (e.g., password length).

A step-by-step instruction for performing a task securely.

A recommended, non-mandatory best practice.

Defines acceptable use of organizational systems and data.

Requires approval, testing, documentation, and rollback for changes.

Software Development Life Cycle — the structured process for building software securely.

The person accountable for a data set and for setting its classification.

The party that determines why and how personal data is processed.

The party that processes personal data on the controller's behalf.

The role that implements controls and maintains data quality day-to-day.

Identifying, assessing, and treating risk to keep it within appetite.

Rating risk by likelihood and impact (low/medium/high), no dollar values.

Assigning dollar values to risk using SLE, ARO, and ALE.

The percentage of an asset's value lost in a single event.

Single Loss Expectancy = asset value × exposure factor.

Annualized Rate of Occurrence — expected number of events per year.

Annualized Loss Expectancy = SLE × ARO.

A $20,000 SLE happening twice a year (ARO 2) gives an ALE of $40,000.

A documented list of risks with owner, likelihood, impact, and treatment.

The amount and type of risk an organization is willing to accept.

The acceptable variation around the risk appetite for a specific objective.

A metric that signals rising risk exposure.

Reducing a risk's likelihood or impact with controls.

Shifting risk to another party, e.g., buying cyber insurance.

Eliminating a risk by stopping the risky activity entirely.

Acknowledging a risk and taking no action because it's within appetite.

Mitigate, transfer, avoid, accept.

Inherent = risk before controls; residual = risk remaining after controls.

Identifies critical functions and sets recovery objectives (RTO/RPO).

Service Level Agreement — defines guaranteed service levels and metrics with a provider.

Memorandum of Understanding/Agreement — outlines intentions between parties.

Master Service Agreement — overarching terms governing ongoing work.

Statement of Work / Work Order — the specific deliverables and tasks.

Non-Disclosure Agreement — a confidentiality obligation between parties.

Business Partners Agreement — terms governing a partnership.

Investigating risks before entering an agreement or activity.

Taking reasonable, ongoing steps to protect assets (the 'prudent person' standard).

A contract term allowing a customer to audit a vendor's security.

Risk introduced by suppliers, MSPs, and partners with access.

Assessing the security of vendors and the components they provide.

Meeting legal, regulatory, and contractual security requirements.

Fines, sanctions, reputational damage, and possible loss of license.

A formal statement confirming the state of controls (often by an auditor).

An individual's right to request deletion of their personal data.

Policy defining how long data is kept and when it's securely destroyed.

Internal audits are run by the organization; external by independent third parties.

An assessment required by a law or regulator (e.g., PCI DSS, HIPAA).

A pen test where the tester has full knowledge of the target.

A pen test where the tester has limited information.

A pen test with no prior information — simulates an outsider.

Gathering info without directly touching the target (e.g., OSINT).

Directly probing the target (e.g., scanning), which can be detected.

Ongoing education that teaches users to recognize and report threats.

A simulated phishing test used to measure and improve user awareness.

Training users to spot and report unusual activity.

Procedures for granting access on hire and revoking it on departure.

A documented set of steps for responding to a specific type of incident.