`) are embedded into trusted web applications and executed in the victim's browser.\n\n- **Stored XSS**: Script permanently stored on target server.\n- **Reflected XSS**: Script reflected off web server in link/response.\n- **DOM-based XSS**: Script manipulates DOM environment."}},{"@type":"Question","eduQuestionType":"Flashcard","name":"What is the key difference between Symmetric and Asymmetric Encryption?","text":"What is the key difference between Symmetric and Asymmetric Encryption?","acceptedAnswer":{"@type":"Answer","text":"- **Symmetric**: Uses a single shared key for both encryption and decryption (e.g., AES, 3DES). Fast and efficient for large data volumes, but key exchange is difficult.\n- **Asymmetric**: Uses a public key for encryption and a distinct private key for decryption (e.g., RSA, ECC). Slower computational speed, but simplifies secure key exchange."}},{"@type":"Question","eduQuestionType":"Flashcard","name":"What is cryptographic Hashing and why is a Salt used?","text":"What is cryptographic Hashing and why is a Salt used?","acceptedAnswer":{"@type":"Answer","text":"- **Hashing**: A one-way mathematical function generating a fixed-length string (digest) from input data (e.g., SHA-256, MD5) to verify data integrity.\n- **Salt**: A unique, randomly generated string appended to input passwords before hashing to defend against precomputed **rainbow table** attacks and hash collision exploits."}},{"@type":"Question","eduQuestionType":"Flashcard","name":"What is Role-Based Access Control (RBAC)?","text":"What is Role-Based Access Control (RBAC)?","acceptedAnswer":{"@type":"Answer","text":"An access control model where permissions are assigned to defined **roles** within an organization, and users are assigned to those roles based on job functions (e.g., HR, Financial Analyst, IT Support), adhering to the principle of least privilege."}},{"@type":"Question","eduQuestionType":"Flashcard","name":"Compare Mandatory Access Control (MAC) and Discretionary Access Control (DAC).","text":"Compare Mandatory Access Control (MAC) and Discretionary Access Control (DAC).","acceptedAnswer":{"@type":"Answer","text":"- **MAC**: Non-discretionary system enforced model; access decisions depend on data classification labels (e.g., Top Secret) and matching user clearance levels.\n- **DAC**: Access is at the discretion of the data **owner**, who sets permissions (e.g., Read, Write, Execute) via Access Control Lists (ACLs)."}},{"@type":"Question","eduQuestionType":"Flashcard","name":"What is Attribute-Based Access Control (ABAC)?","text":"What is Attribute-Based Access Control (ABAC)?","acceptedAnswer":{"@type":"Answer","text":"An advanced access control model that evaluates dynamic policies based on multiple attributes:\n- **Subject**: User department, role, security clearance.\n- **Resource**: Sensitivity label, document type.\n- **Environment**: Access time, IP address, device security status."}},{"@type":"Question","eduQuestionType":"Flashcard","name":"What are the six phases of the Incident Response process?","text":"What are the six phases of the Incident Response process?","acceptedAnswer":{"@type":"Answer","text":"1. **Preparation**: Establishing IR policies, tools, and response teams.\n2. **Identification**: Detecting and verifying security incidents.\n3. **Containment**: Isolating compromised systems to limit damage.\n4. **Eradication**: Neutralizing threats and removing root causes.\n5. **Recovery**: Restoring systems safely back to production.\n6. **Lessons Learned**: Documenting improvements and updated procedures."}},{"@type":"Question","eduQuestionType":"Flashcard","name":"What are the core compliance standards of GDPR?","text":"What are the core compliance standards of GDPR?","acceptedAnswer":{"@type":"Answer","text":"The **General Data Protection Regulation** (EU privacy law) mandates:\n- User consent for collecting Personal Identifiable Information (PII).\n- **Right to be Forgotten** (data erasure requests).\n- Breach notification within 72 hours of discovery.\n- Heavy financial penalties for non-compliance."}},{"@type":"Question","eduQuestionType":"Flashcard","name":"What is HIPAA and what safeguards does it mandate?","text":"What is HIPAA and what safeguards does it mandate?","acceptedAnswer":{"@type":"Answer","text":"The **Health Insurance Portability and Accountability Act** regulates Protected Health Information (**PHI**) in the US healthcare sector. It enforces the **Privacy Rule** and **Security Rule**, requiring technical safeguards (encryption), physical controls, and administrative procedures."}},{"@type":"Question","eduQuestionType":"Flashcard","name":"What are the 5 primary factors of Multi-Factor Authentication (MFA)?","text":"What are the 5 primary factors of Multi-Factor Authentication (MFA)?","acceptedAnswer":{"@type":"Answer","text":"1. **Something you know**: Password, PIN, passphrase.\n2. **Something you have**: Smart card, hardware token, authenticator app.\n3. **Something you are**: Biometric fingerprint, facial recognition.\n4. **Somewhere you are**: GPS location, specific IP network.\n5. **Something you do**: Typing dynamics, physical gesture patterns."}},{"@type":"Question","eduQuestionType":"Flashcard","name":"What are the core components of Public Key Infrastructure (PKI)?","text":"What are the core components of Public Key Infrastructure (PKI)?","acceptedAnswer":{"@type":"Answer","text":"- **Certificate Authority (CA)**: Trusted third party issuing digital certificates.\n- **Registration Authority (RA)**: Verifies user/device identities for the CA.\n- **Certificate Revocation List (CRL)**: List of revoked or invalid certificates.\n- **OCSP (Online Certificate Status Protocol)**: Real-time protocol checking certificate validity."}},{"@type":"Question","eduQuestionType":"Flashcard","name":"What is Defense in Depth?","text":"What is Defense in Depth?","acceptedAnswer":{"@type":"Answer","text":"A cybersecurity strategy deploying multiple layered security controls across physical, technical, and administrative operational domains. If one security layer fails, subsequent security controls continue protecting critical assets."}},{"@type":"Question","eduQuestionType":"Flashcard","name":"What is SIEM and what are its main functions?","text":"What is SIEM and what are its main functions?","acceptedAnswer":{"@type":"Answer","text":"**Security Information and Event Management (SIEM)** aggregates log data from network infrastructure, security appliances, and applications. Main functions include:\n- Real-time log aggregation and correlation.\n- Automated threat alerting and anomaly detection.\n- Historical analysis and compliance reporting."}},{"@type":"Question","eduQuestionType":"Flashcard","name":"What is a Man-in-the-Middle (MitM) attack and how is it prevented?","text":"What is a Man-in-the-Middle (MitM) attack and how is it prevented?","acceptedAnswer":{"@type":"Answer","text":"An attack where an adversary secretly intercepts, relays, or alters communications between two trusting endpoints.\n\n**Prevention**: Strong mutual authentication, modern transport layer encryption (e.g., `TLS 1.3`), HTTPS enforcement via HSTS, and secure cryptographic VPNs."}}]}]}CompTIA Security+ (SY0-601) - Core Concepts Flashcards | Notum Learn
Flashcard Deck · 20 cards · Public

CompTIA Security+ (SY0-601) - Core Concepts

Master essential cybersecurity domains for the CompTIA Security+ (SY0-601) exam with high-yield flashcards covering cryptography, threat architecture, incident response, and compliance frameworks.
Study Now (20 Cards) Browse Community

Cards in this deck

(20 cards)

Preview terms and definitions before starting your study session.

#1
Term
What are the three components of the CIA Triad?
Definition
  • Confidentiality: Ensuring sensitive information is accessible only to authorized users and systems.
  • Integrity: Safeguarding the accuracy and completeness of assets by preventing unauthorized modifications.
  • Availability: Guaranteeing timely and reliable access to systems and data for authorized personnel when needed.
#2
Term
What is Zero Trust Architecture?
Definition
A security paradigm guided by the core philosophy "never trust, always verify." It mandates continuous authentication, authorization, and posture validation for every user, device, and application session, regardless of whether they reside inside or outside the network boundary.
#3
Term
What is the MITRE ATT&CK Framework?
Definition
A globally accessible knowledge base of real-world adversary Tactics, Techniques, and Procedures (TTPs). Security teams use it to model threat actor behavior, map defenses, fill coverage gaps, and structure threat hunting operations.
#4
Term
How do Phishing, Spear Phishing, and Whaling differ?
Definition
  • Phishing: Broad, unsophisticated social engineering emails sent to large groups to steal credentials or deploy malware.
  • Spear Phishing: Targeted email attack customized for a specific individual or organization.
  • Whaling: High-targeted spear phishing aimed specifically at senior executives (e.g., CEO, CFO).
#5
Term
What is a Distributed Denial of Service (DDoS) attack?
Definition
An attack where multiple compromised systems (collectively known as a botnet) flood a target server, network, or application service with redundant traffic, exhausting system resources and causing network outages for legitimate users.
#6
Term
What is SQL Injection (SQLi) and how is it mitigated?
Definition
An attack where malicious SQL statements are injected into application input fields (e.g., ' OR '1'='1) to bypass authentication or extract backend database data.
Mitigation: Use parameterized queries (prepared statements), strict input validation/sanitization, and stored procedures.
#7
Term
What is Cross-Site Scripting (XSS)?
Definition
An injection attack where malicious client-side scripts (typically JavaScript like <script>...</script>) are embedded into trusted web applications and executed in the victim's browser.
  • Stored XSS: Script permanently stored on target server.
  • Reflected XSS: Script reflected off web server in link/response.
  • DOM-based XSS: Script manipulates DOM environment.
#8
Term
What is the key difference between Symmetric and Asymmetric Encryption?
Definition
  • Symmetric: Uses a single shared key for both encryption and decryption (e.g., AES, 3DES). Fast and efficient for large data volumes, but key exchange is difficult.
  • Asymmetric: Uses a public key for encryption and a distinct private key for decryption (e.g., RSA, ECC). Slower computational speed, but simplifies secure key exchange.
Showing 8 of 20 cards in this deck.
Study All Now

Related Flashcard Sets

Explore similar study materials created by the community

Browse community decks
Deck · 20 cards

Neuroscience Fundamentals - Brain Structures & Function

Master the core principles of neuroscience with this high-yield flashcard deck covering neuroanatomy, neuronal communication, action potentials, and functional pathways. Ideal for medical, biology, and cognitive science students.

Study flashcards Study set
Deck · 20 cards

USMLE Step 1 - Physiology & Pathology Essentials

Master essential USMLE Step 1 concepts covering core organ system physiology and foundational pathology. Designed for high-yield board review and rapid active recall.

Study flashcards Study set
Deck · 25 cards

HSK 1 - Essential Chinese Vocabulary & Grammar

Unlock HSK 1 success with this essential flashcard deck! Master foundational Chinese vocabulary, grammar, and practical phrases for confident daily communication and exam readiness.

Study flashcards Study set
Deck · 24 cards

Kubernetes Fundamentals - Container Orchestration & Deployment

Master Kubernetes fundamentals with this high-yield flashcard deck, covering essential concepts like Pods, Deployments, Services, and core architectural components. Accelerate your journey in cloud-native development and operations by understanding how to orchestrate and deploy containerized applications at scale.

Study flashcards Study set