Free CompTIA Security+ (SY0-701) practice questions across all five exam domains with detailed explanations and 50 flashcards.
CompTIA Security+ SY0-701 is the most widely recognised entry-level cybersecurity certification and a baseline requirement for many IT security roles in South Africa's banking, insurance, and government sectors. Tour practice set covers all six SY0-701 domains: General Security Concepts (12%), Threats, Vulnerabilities, and Mitigations (22%), Security Architecture (18%), Security Operations (28%), Security Program Management and Oversight (20%). Questions are written at exam difficulty with full explanations covering the why behind every answer.
Security Operations is the largest domain — focus time here on identity and access management, endpoint security, incident response, and vulnerability management. The flashcard set covers the 100 most exam-critical terms and definitions in Security+.
CompTIA Security+ is the most widely adopted entry-level cybersecurity certification globally. Meets DoD 8570 requirements.
Exam: Max 90 questions, 90 minutes, 750/150 to pass. Focus on Threats (22%) and Operations (28%) — together 50% of the exam.
0/150
correct answers
Question 01 of 20
What is a zero-day vulnerability?
Explanation: Zero-day: unknown to software vendor. Zero days of protection.
Question 02 of 20
Which malware type encrypts files for ransom?
Explanation: Ransomware encrypts victim data and demands cryptocurrency ransom for decryption key.
Question 03 of 20
What does the CIA Triad stand for?
Explanation: CIA Triad: Confidentiality (private), Integrity (accurate), Availability (accessible).
Question 04 of 20
What is social engineering?
Explanation: Social engineering exploits human psychology rather than technical vulnerabilities.
Question 05 of 20
Which hashing algorithm is currently recommended?
Explanation: SHA-256 (SHA-2 family) is the current standard. MD5 and SHA-1 are broken.
Question 06 of 20
What is defence in depth?
Explanation: Defence in depth: multiple security layers working together.
Question 07 of 20
Port 443 is used by?
Explanation: HTTPS uses TCP port 443. HTTP=80, SSH=22, RDP=3389, DNS=53.
Question 08 of 20
What is a man-in-the-middle attack?
Explanation: MitM: attacker secretly relays and possibly modifies communication between two parties.
Question 09 of 20
What is a honeypot?
Explanation: Honeypot: decoy system mimicking real target. Attackers reveal techniques when they interact.
Question 10 of 20
SQL injection attacks exploit?
Explanation: SQL injection: malicious SQL via input fields potentially reading or modifying database records.
Question 11 of 20
What is a rootkit?
Explanation: Rootkits operate at kernel level, hiding processes, files, and connections.
Question 12 of 20
What is a DoS attack?
Explanation: DoS: floods target to exhaust resources. DDoS uses many compromised systems.
Question 13 of 20
What does AAA stand for in security?
Explanation: AAA: Authentication (verify identity), Authorisation (what can they access), Accounting (log what they did).
Question 14 of 20
What is symmetric encryption?
Explanation: Symmetric: one shared secret key. Faster than asymmetric.
Question 15 of 20
What is the principle of least privilege?
Explanation: Least privilege minimises access rights to only what's required.
Question 16 of 20
What is a rainbow table attack?
Explanation: Rainbow tables use precomputed hash tables. Salting passwords defeats tour attack.
Question 17 of 20
What is salting passwords?
Explanation: Salt: random data added before hashing. Each user gets unique salt.
Question 18 of 20
What is a VPN?
Explanation: VPN: encrypted tunnel protecting data in transit.
Question 19 of 20
What is multi-factor authentication?
Explanation: MFA requires factors from different categories: know, have, are.
Question 20 of 20
What is penetration testing?
Explanation: Pen testing: ethical hackers simulate attacks to find and report vulnerabilities.
Q21
What is the CIA triad?
Explanation: CIA: Confidentiality (only authorised access), Integrity (data not tampered with), Availability (accessible when needed). Every security control protects one or more of these pillars.
Explanation: MFA factors: Knowledge (password, PIN), Possession (token, phone, smart card), Inherence (fingerprint, face). Combining any two dramatically reduces credential attack risk even if one factor is compromised.
Q24
What is a zero-day vulnerability?
Explanation: Zero-day: vendor has zero days to fix it before exploitation. Extremely valuable on black market. Mitigations: defence-in-depth, behaviour-based detection (not just signature), network segmentation, least privilege.
Q25
What is ransomware?
Explanation: Ransomware: delivery via phishing, RDP brute force, or supply chain. Defence: offline backups (3-2-1 rule), patching, network segmentation, user training. Never guarantee paying restores files.
Explanation: SQLi: attacker inputs ' OR '1'='1 or similar. Can: dump database, bypass auth, delete data. Prevention: parameterised queries/prepared statements, input validation, WAF, least privilege DB accounts.
Q29
What is a DDoS attack?
Explanation: DDoS types: volumetric (bandwidth), protocol (SYN flood), application layer (HTTP flood). Mitigation: CDN, rate limiting, traffic scrubbing services, anycast, overprovisioning. Botnet: network of compromised devices used for DDoS.
Q30
What is public key infrastructure (PKI)?
Explanation: PKI: CA (Certificate Authority) signs certificates. Chain of trust: root CA → intermediate CA → end-entity certificate. Used in: HTTPS, S/MIME, code signing, VPN. CRL and OCSP: revocation checking.
Q31
What is the difference between symmetric and asymmetric encryption?
Explanation: Symmetric: AES-256 (strong, fast). Asymmetric: RSA, ECC (slower, used for key exchange and signatures). TLS uses asymmetric to exchange a symmetric session key. Best of both worlds.
Q32
What is a digital signature?
Explanation: Digital signature: sender hashes data, encrypts hash with private key. Recipient decrypts with sender's public key, re-hashes data, compares. Proves: data integrity, sender identity, non-repudiation (can't deny sending).
Explanation: IDS false positive: alerts on legitimate traffic. False negative: misses real attack. IPS in inline mode can block attacks but risks blocking legitimate traffic. Most NGFWs integrate IPS functionality.
Q35
What is a VPN?
Explanation: VPN protocols: OpenVPN, IPsec/IKEv2, WireGuard, L2TP/IPsec. Site-to-site: connects networks. Remote access: user to corporate network. Split tunnelling: only work traffic through VPN. Zero Trust: moving away from traditional VPN.
Q36
What is SIEM?
Explanation: SIEM: collects logs from firewalls, servers, endpoints, apps. Correlates events to detect attack patterns. Generates alerts. Examples: Splunk, Microsoft Sentinel, IBM QRadar. Requires tuning to reduce false positives.
Q37
What is threat hunting?
Explanation: Threat hunting: assumes adversaries are already inside. Uses: threat intelligence, behavioural analytics, MITRE ATT&CK framework. Hypothesis-driven: 'If APT X is present, what would we see?' More mature than purely reactive security.
Q38
What is a hash function?
Explanation: Hash functions: MD5 (broken), SHA-1 (deprecated), SHA-256, SHA-3 (current standards). Uses: password storage, file integrity verification, digital signatures. Collision: two inputs producing same hash (SHA-256 collision-resistant).
Q39
What is a penetration test?
Explanation: Pentest phases: Reconnaissance, Scanning, Exploitation, Post-exploitation, Reporting. White box (full info), Grey box (partial), Black box (no info). Different from vulnerability scan: pentests actually exploit vulnerabilities.
Explanation: Zero Trust principles: verify explicitly, use least privilege access, assume breach. Replaces castle-and-moat perimeter model. Key components: identity verification (MFA), microsegmentation, continuous monitoring, device compliance checks.
Q44
What is RBAC?
Explanation: RBAC: users assigned roles, roles assigned permissions. Examples: Admin, Developer, Read-only. Benefits: easier auditing, consistent access, principle of least privilege. Compare: ABAC (attribute-based), MAC (mandatory access control).
Q45
What is a vulnerability scanner?
Explanation: Vulnerability scanners: Nessus, OpenVAS, Qualys. Detect: missing patches, misconfigurations, weak passwords, open ports. Authenticated scan (with credentials) finds more than unauthenticated. Schedule regularly. Not a substitute for pentesting.
Q46
What is defence in depth?
Explanation: Defence in depth layers: physical security, network perimeter, network segmentation, endpoint security, application security, data encryption, identity management, monitoring. Attacker must bypass every layer.
Q47
What is data loss prevention (DLP)?
Explanation: DLP: identifies sensitive data (PII, credit cards, IP) using patterns and classification. Can: alert, block, encrypt, or quarantine. Endpoint DLP: monitors device. Network DLP: monitors traffic. Cloud DLP: monitors cloud storage.
Q48
What is a certificate authority (CA)?
Explanation: CA hierarchy: Root CA (offline, highest trust), Intermediate CA (issues end-entity certs). Certificate contains: public key, subject, issuer, validity period, serial number. Browsers have pre-installed trusted root CAs. Wildcard cert: *.domain.com.
Q49
What is Kerberos?
Explanation: Kerberos: KDC (Key Distribution Centre) issues TGT (Ticket Granting Ticket). Client uses TGT to get service tickets. Prevents replay attacks. Pass-the-ticket: stealing Kerberos tickets. Golden ticket: forged TGT with krbtgt hash.
Q50
What is LDAP?
Explanation: LDAP: port 389 (unencrypted), 636 (LDAPS — encrypted). Used for: user authentication, group membership lookup, email address lookup. Active Directory uses LDAP as its query protocol. Enumerate: ldapsearch. Attack: LDAP injection.
ADVERTISEMENT
Q51
What is endpoint detection and response (EDR)?
Explanation: EDR: records all endpoint activity (process creation, network connections, file changes). Can: detect fileless malware, lateral movement, credential theft. Examples: CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne. Replaces traditional AV.
Q52
What is credential stuffing?
Explanation: Credential stuffing: automated, uses breach databases. Effective because ~65% of users reuse passwords. Defence: MFA (primary), unique passwords per site, breach monitoring (HaveIBeenPwned), rate limiting, CAPTCHA.
Explanation: Honeypot: appears legitimate but is actually monitored trap. Low-interaction: emulates services. High-interaction: full OS (riskier but more data). Honeynet: network of honeypots. Legal: check jurisdiction before deploying.
Q58
What is patch management?
Explanation: Patch management cycle: inventory → scan for missing patches → test in staging → deploy → verify → document. Cadence: critical patches ASAP (within 24–72hrs), high within 7 days, medium within 30 days. Unpatched systems = primary attack vector.
Q59
What is an air gap?
Explanation: Air-gapped systems: used for nuclear controls, classified military systems, critical infrastructure. Attacks still possible: Stuxnet (USB), Van Eck phreaking (electromagnetic emissions), acoustic attacks. Air gap != invincible.
Q60
What is the 3-2-1 backup rule?
Explanation: 3-2-1 rule: 3 copies (production + 2 backups), 2 media types (disk + tape or cloud), 1 offsite (different location or cloud). Test restores regularly — untested backups are not backups. Extended: 3-2-1-1-0 (one offline/immutable, zero errors after testing).
Q61
What is the CIA triad?
Explanation: CIA: Confidentiality (only authorised access), Integrity (data not tampered with), Availability (accessible when needed). Every security control protects one or more of these pillars.
Explanation: MFA factors: Knowledge (password, PIN), Possession (token, phone, smart card), Inherence (fingerprint, face). Combining any two dramatically reduces credential attack risk even if one factor is compromised.
Q64
What is a zero-day vulnerability?
Explanation: Zero-day: vendor has zero days to fix it before exploitation. Extremely valuable on black market. Mitigations: defence-in-depth, behaviour-based detection (not just signature), network segmentation, least privilege.
Q65
What is ransomware?
Explanation: Ransomware: delivery via phishing, RDP brute force, or supply chain. Defence: offline backups (3-2-1 rule), patching, network segmentation, user training. Never guarantee paying restores files.
Explanation: SQLi: attacker inputs ' OR '1'='1 or similar. Can: dump database, bypass auth, delete data. Prevention: parameterised queries/prepared statements, input validation, WAF, least privilege DB accounts.
Q69
What is a DDoS attack?
Explanation: DDoS types: volumetric (bandwidth), protocol (SYN flood), application layer (HTTP flood). Mitigation: CDN, rate limiting, traffic scrubbing services, anycast, overprovisioning. Botnet: network of compromised devices used for DDoS.
Q70
What is public key infrastructure (PKI)?
Explanation: PKI: CA (Certificate Authority) signs certificates. Chain of trust: root CA → intermediate CA → end-entity certificate. Used in: HTTPS, S/MIME, code signing, VPN. CRL and OCSP: revocation checking.
Q71
What is the difference between symmetric and asymmetric encryption?
Explanation: Symmetric: AES-256 (strong, fast). Asymmetric: RSA, ECC (slower, used for key exchange and signatures). TLS uses asymmetric to exchange a symmetric session key. Best of both worlds.
Q72
What is a digital signature?
Explanation: Digital signature: sender hashes data, encrypts hash with private key. Recipient decrypts with sender's public key, re-hashes data, compares. Proves: data integrity, sender identity, non-repudiation (can't deny sending).
Explanation: IDS false positive: alerts on legitimate traffic. False negative: misses real attack. IPS in inline mode can block attacks but risks blocking legitimate traffic. Most NGFWs integrate IPS functionality.
Q75
What is a VPN?
Explanation: VPN protocols: OpenVPN, IPsec/IKEv2, WireGuard, L2TP/IPsec. Site-to-site: connects networks. Remote access: user to corporate network. Split tunnelling: only work traffic through VPN. Zero Trust: moving away from traditional VPN.
ADVERTISEMENT
Q76
What is SIEM?
Explanation: SIEM: collects logs from firewalls, servers, endpoints, apps. Correlates events to detect attack patterns. Generates alerts. Examples: Splunk, Microsoft Sentinel, IBM QRadar. Requires tuning to reduce false positives.
Q77
What is threat hunting?
Explanation: Threat hunting: assumes adversaries are already inside. Uses: threat intelligence, behavioural analytics, MITRE ATT&CK framework. Hypothesis-driven: 'If APT X is present, what would we see?' More mature than purely reactive security.
Q78
What is a hash function?
Explanation: Hash functions: MD5 (broken), SHA-1 (deprecated), SHA-256, SHA-3 (current standards). Uses: password storage, file integrity verification, digital signatures. Collision: two inputs producing same hash (SHA-256 collision-resistant).
Q79
What is a penetration test?
Explanation: Pentest phases: Reconnaissance, Scanning, Exploitation, Post-exploitation, Reporting. White box (full info), Grey box (partial), Black box (no info). Different from vulnerability scan: pentests actually exploit vulnerabilities.
Explanation: Zero Trust principles: verify explicitly, use least privilege access, assume breach. Replaces castle-and-moat perimeter model. Key components: identity verification (MFA), microsegmentation, continuous monitoring, device compliance checks.
Q84
What is RBAC?
Explanation: RBAC: users assigned roles, roles assigned permissions. Examples: Admin, Developer, Read-only. Benefits: easier auditing, consistent access, principle of least privilege. Compare: ABAC (attribute-based), MAC (mandatory access control).
Q85
What is a vulnerability scanner?
Explanation: Vulnerability scanners: Nessus, OpenVAS, Qualys. Detect: missing patches, misconfigurations, weak passwords, open ports. Authenticated scan (with credentials) finds more than unauthenticated. Schedule regularly. Not a substitute for pentesting.
Q86
What is defence in depth?
Explanation: Defence in depth layers: physical security, network perimeter, network segmentation, endpoint security, application security, data encryption, identity management, monitoring. Attacker must bypass every layer.
Q87
What is data loss prevention (DLP)?
Explanation: DLP: identifies sensitive data (PII, credit cards, IP) using patterns and classification. Can: alert, block, encrypt, or quarantine. Endpoint DLP: monitors device. Network DLP: monitors traffic. Cloud DLP: monitors cloud storage.
Q88
What is a certificate authority (CA)?
Explanation: CA hierarchy: Root CA (offline, highest trust), Intermediate CA (issues end-entity certs). Certificate contains: public key, subject, issuer, validity period, serial number. Browsers have pre-installed trusted root CAs. Wildcard cert: *.domain.com.
Q89
What is Kerberos?
Explanation: Kerberos: KDC (Key Distribution Centre) issues TGT (Ticket Granting Ticket). Client uses TGT to get service tickets. Prevents replay attacks. Pass-the-ticket: stealing Kerberos tickets. Golden ticket: forged TGT with krbtgt hash.
Q90
What is LDAP?
Explanation: LDAP: port 389 (unencrypted), 636 (LDAPS — encrypted). Used for: user authentication, group membership lookup, email address lookup. Active Directory uses LDAP as its query protocol. Enumerate: ldapsearch. Attack: LDAP injection.
Q91
What is endpoint detection and response (EDR)?
Explanation: EDR: records all endpoint activity (process creation, network connections, file changes). Can: detect fileless malware, lateral movement, credential theft. Examples: CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne. Replaces traditional AV.
Q92
What is credential stuffing?
Explanation: Credential stuffing: automated, uses breach databases. Effective because ~65% of users reuse passwords. Defence: MFA (primary), unique passwords per site, breach monitoring (HaveIBeenPwned), rate limiting, CAPTCHA.
Explanation: Honeypot: appears legitimate but is actually monitored trap. Low-interaction: emulates services. High-interaction: full OS (riskier but more data). Honeynet: network of honeypots. Legal: check jurisdiction before deploying.
Q98
What is patch management?
Explanation: Patch management cycle: inventory → scan for missing patches → test in staging → deploy → verify → document. Cadence: critical patches ASAP (within 24–72hrs), high within 7 days, medium within 30 days. Unpatched systems = primary attack vector.
Q99
What is an air gap?
Explanation: Air-gapped systems: used for nuclear controls, classified military systems, critical infrastructure. Attacks still possible: Stuxnet (USB), Van Eck phreaking (electromagnetic emissions), acoustic attacks. Air gap != invincible.
Q100
What is the 3-2-1 backup rule?
Explanation: 3-2-1 rule: 3 copies (production + 2 backups), 2 media types (disk + tape or cloud), 1 offsite (different location or cloud). Test restores regularly — untested backups are not backups. Extended: 3-2-1-1-0 (one offline/immutable, zero errors after testing).
ADVERTISEMENT
Q101
What is steganography?
Explanation: Steganography hides data inside carriers like images (altering pixel LSBs). Different from cryptography (hides content). Steganalysis detects hidden data. Used for: watermarking, covert communication, malware C2. Detection: statistical anomalies in file.
Q102
What is a honeynet?
Explanation: Honeynet: multiple interconnected honeypots simulating a real network. Captures attacker tools, techniques, lateral movement. High-interaction: realistic (risks vs reward). Legal considerations: entrapment vs observation. Data collected feeds threat intelligence.
Q103
What is the difference between black box and white box testing?
Explanation: Testing types: Black box (external attacker perspective, realistic but may miss internal weaknesses), White box (full access — code review, architecture analysis, most comprehensive), Grey box (some internal knowledge — balanced). All three produce different findings.
Q104
What is threat modelling?
Explanation: Threat modelling frameworks: STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege), PASTA, DREAD. Done at design phase — cheaper to fix architecture than patch production. Output: threat model diagram, risk register, security requirements.
Q105
What is a WAF?
Explanation: WAF: Layer 7 protection. Rules-based (signature) or anomaly-based. Deployed: in-line (proxy), cloud (Cloudflare, AWS WAF), on-premise. Protects: OWASP Top 10 attacks. Limitations: not a substitute for secure development. Can be bypassed by obfuscation.
Q106
What is certificate pinning?
Explanation: Certificate pinning: prevents MitM attacks even with rogue CA. Used in: mobile apps, APIs. Risks: if certificate changes legitimately, app breaks. HPKP (HTTP Public Key Pinning) deprecated — too dangerous. Modern alternative: Certificate Transparency logs.
Q107
What is OSINT?
Explanation: OSINT tools: Maltego, Shodan (internet-connected device search), theHarvester (email, subdomain enumeration), WHOIS, LinkedIn (employee reconnaissance). Attackers use OSINT for pre-attack reconnaissance. Blue teams use it to understand their own exposure.
Q108
What is an insider threat?
Explanation: Insider threats: malicious (intentional sabotage, data theft), negligent (accidental data leak, falling for phishing), compromised (account taken over by external actor). Controls: least privilege, DLP, UEBA (user/entity behaviour analytics), background checks, separation of duties.
Q109
What is SAML?
Explanation: SAML: enables Single Sign-On across different domains. Flow: user authenticates to IdP → IdP issues SAML assertion → SP validates assertion → access granted. Used in enterprise SSO (Salesforce, Google Workspace). Replaced by OAuth2/OIDC for modern API-based applications.
Q110
What is OAuth 2.0?
Explanation: OAuth 2.0: authorisation (not authentication). Flow: user → app → authorisation server → access token → resource server. Used: 'Sign in with Google' grants app access to Google profile without giving password. OpenID Connect (OIDC) adds authentication layer on top of OAuth 2.0.
Explanation: Network segmentation: VLANs, firewalls between zones, microsegmentation (per-workload policies). DMZ: public-facing servers separate from internal network. Zero Trust microsegmentation: deny all by default, allow only specific flows. Reduces blast radius of breaches.
Q113
What is a security audit?
Explanation: Security audit: internal or external, compares controls against standards (ISO 27001, SOC 2, PCI DSS). Types: compliance audit (against standard), operational (process review), technical (system configuration). Output: audit report with findings and recommendations. Different from pentest (exploits vulnerabilities).
Q114
What is GDPR?
Explanation: GDPR (effective 2018): rights: access, rectification, erasure ('right to be forgotten'), portability, objection. Obligations: lawful basis for processing, privacy by design, DPO appointment, breach notification within 72 hours. Fines: up to 4% of global annual revenue or €20 million.
Q115
What is a DMZ?
Explanation: DMZ (demilitarised zone): public servers (web, email, DNS) placed here. Two firewalls: outer (internet to DMZ) and inner (DMZ to internal network). Attacker who compromises DMZ server cannot directly reach internal network. Also: separated guest Wi-Fi network.
Q116
What is typosquatting?
Explanation: Typosquatting examples: googl.com, paypa1.com, arnazon.com. Also: homograph attacks (Unicode lookalike characters). Defences: register common misspellings of your own domain, browser SafeSearch, certificate validation. Cybersquatting: registering brand names as domains.
Q117
What is a rainbow table?
Explanation: Rainbow tables: precompute hashes for millions of passwords. Crack hashed passwords without brute force. Defence: salting (add random value before hashing — makes rainbow tables impractical). Salted hash: even identical passwords produce different hashes. bcrypt, Argon2 include salting automatically.
Q118
What is security through obscurity?
Explanation: Security through obscurity: keeping algorithms, code, or architecture secret as the primary defence. Fails when: source code leaks, reverse engineering occurs. Kerckhoffs's principle: a cryptosystem should be secure even if everything about it except the key is public knowledge. Obscurity can be a supplementary layer only.
Q119
What is a CASB?
Explanation: CASB functions: Shadow IT discovery (what cloud apps employees use), DLP (prevent sensitive data upload), threat protection (malware in cloud storage), compliance (enforce policies). Deployment: API-based, proxy-based. Examples: Microsoft Defender for Cloud Apps, Netskope, Zscaler.
Q120
What is credential harvesting?
Explanation: Credential harvesting methods: fake login pages, man-in-the-browser, keyloggers, data breach dumps, shoulder surfing. Harvested credentials used for: direct access, credential stuffing (other sites), sale on dark web. Defence: MFA (primary), password managers, breach monitoring.
Q121
What is a SIEM alert triage process?
Explanation: Alert triage: L1 SOC analyst reviews alert → checks context (asset criticality, user history, threat intel) → classifies: true positive (real threat), false positive (benign), or noise. True positives escalated to L2/L3. Key metrics: mean time to detect (MTTD), mean time to respond (MTTR).
Q122
What is secure coding?
Explanation: Secure coding practices: input validation, parameterised queries, output encoding, error handling (no sensitive info in errors), least privilege for app accounts, use of vetted libraries, code review (SAST tools: SonarQube, Checkmarx), secrets management (no hardcoded credentials).
Q123
What is the difference between authentication and authorisation?
Explanation: Logic bombs: time bomb (triggers on date/time), conditional (triggers on event). Often used by disgruntled employees — activates after they leave. Detection: code review, monitoring for unusual scheduled tasks. Famous case: UBS PaineWebber (2002) — analyst planted logic bomb before firing.
Explanation: Security posture = people (training, culture) + process (policies, procedures, incident response) + technology (controls, monitoring). Measured by: risk assessments, audits, penetration tests, security ratings. Posture management: continuously monitor and improve. Attack surface: all points attackers can try to access.
Q127
What is data sovereignty?
Explanation: Data sovereignty: EU data in AWS us-east-1 may still be subject to US laws (CLOUD Act). Solutions: EU-region cloud deployments, data residency agreements, on-premises. GDPR: EU data of EU residents must have adequate protections regardless of location. Relevant for: government, healthcare, financial data.
Q128
What is a pass-the-hash attack?
Explanation: Pass-the-hash: attacker dumps NTLM hashes from memory (mimikatz tool), uses hash directly without cracking. Affects: Windows NTLM authentication. Mitigations: Credential Guard, Protected Users group, local admin password solution (LAPS), privileged access workstations, move to Kerberos.
What is the difference between symmetric key and session key?
Explanation: Session keys: generated fresh for each session using asymmetric key exchange (e.g., Diffie-Hellman). Even if long-term key compromised later, past sessions cannot be decrypted. Perfect Forward Secrecy (PFS): each session has unique key. TLS 1.3 mandates PFS.
Q131
What is vulnerability vs risk vs threat?
Explanation: Framework: Asset (what to protect) + Vulnerability (weakness) + Threat (exploits weakness) + Impact = Risk. Risk treatment: Accept, Avoid (eliminate), Mitigate (reduce likelihood/impact), Transfer (insurance). Risk appetite: amount of risk organisation is willing to accept.
Q132
What is the principle of separation of duties?
Explanation: Separation of duties: e.g., person who requests payment cannot also approve it. Person who writes code cannot also deploy it to production. Dual control: two people required simultaneously (nuclear launch). Reduces: fraud, errors, insider attacks. Compensating control when SoD not feasible: increased monitoring.
Q133
What is endpoint hardening?
Explanation: Endpoint hardening: disable unused ports/services, remove unused software, apply CIS benchmarks, enforce full-disk encryption (BitLocker, FileVault), application whitelisting, restrict local admin rights, patch regularly, deploy EDR. Gold image: baseline hardened configuration for all new devices.
Q134
What is a cold, warm, or hot site in disaster recovery?
Explanation: DR sites: Cold site (weeks to bring online), Warm site (hours to days), Hot site (minutes, near real-time replication). RTO (Recovery Time Objective): max acceptable downtime. RPO (Recovery Point Objective): max acceptable data loss. Hot site aligns with low RTO/RPO requirements.
Q135
What is a CVSS score?
Explanation: CVSS v3: Base score (exploitability + impact), Temporal (exploit availability, patches), Environmental (org-specific). Score ranges: Critical (9.0-10.0), High (7.0-8.9), Medium (4.0-6.9), Low (0.1-3.9). Used to prioritise patching. CVE ID: identifier for specific vulnerability.
Q136
What is a digital forensics chain of custody?
Explanation: Chain of custody: who collected evidence, when, where, how stored, who handled it. Breaks in chain: evidence may be inadmissible. Write blockers: hardware that prevents modifying evidence during acquisition. Forensic image: bit-by-bit copy of drive. Hash verification: MD5/SHA-256 confirms image integrity.
Q137
What is BYOD?
Explanation: BYOD risks: malware on personal device, data leakage, lost/stolen device with corporate data, inability to remotely wipe fully. Controls: MDM (Mobile Device Management), containerisation (separate work/personal), MAM (Mobile Application Management), VPN requirement, remote wipe of work partition only.
Q138
What is evil twin attack?
Explanation: Evil twin: attacker sets up AP with same SSID as legitimate network (e.g., 'CoffeShop_WiFi'). Victim device connects automatically. Attacker: SSL strip, capture credentials, inject malware. Defence: VPN always on public Wi-Fi, verify certificate warnings, prefer mobile data. Deauth attack often used to force reconnection to evil twin.
Q139
What is the difference between symmetric encryption algorithms AES and DES?
Explanation: DES (1977): 56-bit key — brute-forceable by 1998. 3DES: three DES operations — slow, deprecated. AES (2001): NIST standard. AES-128 (minimum acceptable), AES-256 (used for classified/highly sensitive data). Block cipher with modes: ECB (don't use), CBC, GCM (authenticated encryption).
Explanation: FDE tools: BitLocker (Windows, TPM-based), FileVault (macOS), VeraCrypt (cross-platform). TPM: Trusted Platform Module stores encryption key, unlocks at boot if hardware unchanged. Pre-boot authentication: password required before OS loads. Protects: stolen laptops, decommissioned hardware.
Q142
What is a botnet?
Explanation: Botnet recruitment: drive-by downloads, phishing, exploitation of unpatched systems. C2 communications: IRC (old), HTTP, P2P, domain generation algorithms (DGA). Uses: DDoS for hire, spam campaigns, click fraud. Takedowns: law enforcement + industry cooperation (e.g., Emotet takedown 2021).
Q143
What is threat intelligence?
Explanation: Threat intelligence types: Strategic (trends, for executives), Tactical (TTPs, for security teams), Operational (specific campaigns), Technical (IOCs: IPs, hashes, domains). Sources: ISACs, vendor reports (Mandiant, CrowdStrike), OSINT, dark web monitoring. Feed into: SIEM, EDR, firewall blocklists.
Q144
What is data exfiltration?
Explanation: Exfiltration methods: email (to personal account), USB drives, cloud storage (Dropbox, Google Drive), DNS tunnelling, HTTPS (encrypted, harder to detect), steganography. Detection: DLP, NetFlow analysis, UEBA (unusual access patterns). Prevention: DLP, data classification, least privilege, network monitoring.
Q145
What is a security operations playbook?
Explanation: Playbooks define: detection criteria, investigation steps, containment actions, eradication procedures, recovery steps, communication requirements, documentation. Examples: phishing playbook, ransomware playbook, data breach playbook. Automated in SOAR platforms. Reviewed and updated after each incident.
Q146
What is the Cyber Kill Chain?
Explanation: Cyber Kill Chain (Lockheed Martin): 1)Recon 2)Weaponise 3)Deliver 4)Exploit 5)Install 6)C2 7)Action. Breaking any stage stops the attack. MITRE ATT&CK provides more granular tactics/techniques. Used for: defensive mapping, threat hunting, red team planning.
Q147
What is shadow IT?
Explanation: Shadow IT: employees use unauthorised cloud apps (Dropbox, WhatsApp, personal Gmail) for work. Risks: data in unmanaged locations, no security controls, compliance violations. Detection: CASB, network traffic analysis, web proxy logs. Response: discover, assess risk, either approve with controls or block.
Q148
What is a vulnerability disclosure policy?
Explanation: Vulnerability disclosure: Responsible (coordinated) disclosure: researcher notifies vendor privately, vendor has 90 days to patch (Google Project Zero standard), then public disclosure. Full disclosure: immediate public release. Bug bounty: financial reward for valid reports. HackerOne, Bugcrowd: platforms hosting bug bounty programmes.
Q149
What is a digital certificate?
Explanation: Certificate contains: subject (owner identity), public key, CA digital signature, validity period, serial number. X.509 standard. Wildcard certificate: *.domain.com (covers all subdomains). SAN certificate: multiple domains. Self-signed: no CA — not trusted by browsers. EV certificate: extended validation (green bar).
The CIA triad is the foundation of information security: Confidentiality (only authorised parties can access information), Integrity (information is accurate and has not been tampered with), and Availability (information and systems are accessible when needed by authorised users). Security controls are evaluated against which pillar they protect.
Authentication verifies identity — proving you are who you claim to be (password, biometric, MFA). Authorisation determines what you are permitted to do after authentication — which resources you can access. A user might authenticate successfully but be authorised to access only certain data (role-based access control — RBAC).
A man-in-the-middle (MitM) attack occurs when an attacker secretly intercepts and potentially alters communications between two parties who believe they are communicating directly. Examples: ARP poisoning, SSL stripping, rogue Wi-Fi hotspots. Mitigations: encryption (HTTPS/TLS), certificate pinning, VPNs, and HSTS.
Symmetric encryption uses the same key for encryption and decryption (AES, 3DES). It is fast but requires secure key exchange. Asymmetric encryption uses a public/private key pair (RSA, ECC). Data encrypted with the public key can only be decrypted with the private key. Used in TLS handshakes and digital signatures. Hybrid systems use asymmetric to exchange symmetric keys.
Phishing is a social engineering attack where attackers send fraudulent messages designed to trick recipients into revealing credentials, clicking malicious links, or downloading malware. Variants include spear phishing (targeted), whaling (targeting executives), vishing (voice), and smishing (SMS). Mitigations: user training, email filtering, MFA, and anti-phishing tools.
An IDS (Intrusion Detection System) monitors network traffic passively and alerts when suspicious activity is detected — it does not block traffic. An IPS (Intrusion Prevention System) is inline and actively blocks suspicious traffic. HIDS monitors a single host; NIDS monitors network traffic. Modern NGFWs combine firewall + IPS functionality.
PKI (Public Key Infrastructure) is the framework for creating, managing, distributing, using, storing, and revoking digital certificates. A Certificate Authority (CA) signs certificates that bind a public key to an identity. The certificate chain verifies authenticity. Used in: HTTPS, S/MIME email, code signing, and VPNs.
MFA (Multi-Factor Authentication) requires users to verify identity using two or more factors from different categories: Something you know (password, PIN), Something you have (security token, smartphone, smart card), Something you are (fingerprint, face scan, iris scan). MFA dramatically reduces the risk of credential-based attacks even if passwords are compromised.