CompTIA A+ / Network+ / Security+ CompTIA Security+: Threats, Attacks & Cryptography (SY0-701) Syllabus

Differentiate a DoS attack from a DDoS attack.

A DoS (Denial of Service) attack overwhelms a target from a single source. A DDoS (Distributed DoS) uses many compromised systems (a botnet) simultaneously, making it harder to block and far more powerful.

What is an on-path (man-in-the-middle) attack?

An attacker secretly positions themselves between two communicating parties to intercept, read, or modify traffic without either party's knowledge.

Explain a replay attack.

An attacker captures valid data transmission (e.g. an authentication token or session) and retransmits it later to impersonate a user or repeat a transaction. Defenses include nonces, timestamps, and session tokens.

What is the difference between SQL injection and cross-site scripting (XSS)?

SQL injection inserts malicious SQL into input fields to manipulate a backend database. XSS injects malicious scripts into web pages that execute in other users' browsers, targeting clients rather than the database.

What is a buffer overflow attack?

An attack that writes more data to a memory buffer than it can hold, overwriting adjacent memory to crash the system or execute injected malicious code.

Compare a race condition / TOCTOU vulnerability.

A race condition occurs when the outcome depends on the timing of events. TOCTOU (Time-of-Check to Time-of-Use) exploits the gap between when a resource is checked and when it is used to alter it in between.

What is privilege escalation, and what are its two types?

Gaining higher access rights than authorized. Vertical (privilege) escalation gains higher-level rights (user to admin); horizontal escalation accesses another user's resources at the same privilege level.

Define social engineering.

Manipulating people into divulging confidential information or performing actions that compromise security, exploiting human psychology rather than technical vulnerabilities.

Distinguish phishing, spear phishing, and whaling.

Phishing is mass fraudulent messaging to many targets. Spear phishing is targeted at a specific individual or group. Whaling targets high-value executives (e.g. CEOs, CFOs).

Differentiate vishing, smishing, and pharming.

Vishing is phishing by voice/phone call. Smishing is phishing via SMS text. Pharming redirects users from a legitimate site to a fraudulent one (often via DNS poisoning) to harvest credentials.

List the key principles (motivational triggers) social engineers exploit.

Authority, Intimidation, Consensus/social proof, Scarcity, Urgency, Familiarity/liking, and Trust.

What is pretexting and a business email compromise (BEC)?

Pretexting is inventing a fabricated scenario/identity to gain trust and extract information. BEC is a targeted attack where an attacker impersonates an executive or trusted party (often via spoofed email) to authorize fraudulent transfers or data release.

What is the difference between a vulnerability scan and a penetration test?

A vulnerability scan automatically identifies and reports known weaknesses without exploiting them. A penetration test actively exploits vulnerabilities to demonstrate real-world impact and depth of compromise.

Compare credentialed (authenticated) vs non-credentialed vulnerability scans.

Credentialed scans use valid login credentials for a deeper, insider view of misconfigurations and missing patches. Non-credentialed scans probe from an outsider's perspective without authentication, finding externally visible issues.

What do CVE and CVSS stand for in vulnerability management?

CVE (Common Vulnerabilities and Exposures) is a standardized identifier for a publicly known vulnerability. CVSS (Common Vulnerability Scoring System) is a 0-10 score rating a vulnerability's severity.

What is a false positive versus a false negative in scanning?

A false positive is when a scan reports a vulnerability that does not actually exist. A false negative is when a scan fails to detect a real, existing vulnerability.

Define a zero-day vulnerability.

A vulnerability that is unknown to the vendor and has no available patch, leaving 'zero days' for defenders to prepare before it can be exploited.

List common vulnerability remediation/response options.

Patching/remediation, insurance (transfer), segmentation/isolation, applying compensating controls, exception/exemption (accept risk), and validation of remediation via rescanning and audit.

What is the difference between symmetric and asymmetric encryption?

Symmetric encryption uses a single shared secret key for both encryption and decryption (fast, e.g. AES). Asymmetric encryption uses a mathematically related public/private key pair (slower, e.g. RSA), where one key encrypts and the other decrypts.

Name common symmetric encryption algorithms and a typical AES key size.

AES, 3DES, and (legacy) DES/Blowfish/RC4. AES supports 128-, 192-, and 256-bit keys; AES-256 is a common strong choice.

What is a hash function and what property must it have?

A one-way function that converts arbitrary input into a fixed-length digest. It must be deterministic, irreversible (preimage resistant), and collision resistant (hard to find two inputs with the same hash). Examples: SHA-256, SHA-3.

What is the difference between encryption and hashing?

Encryption is reversible (with a key) and protects confidentiality. Hashing is one-way (irreversible) and verifies integrity; it does not protect confidentiality.

What is a salt and why is it used with password hashes?

A salt is a random value added to a password before hashing so identical passwords produce different hashes. It defeats precomputed rainbow-table attacks and makes brute-forcing harder.

What is key stretching?

Deliberately making a key/password derivation slow and computationally expensive (e.g. PBKDF2, bcrypt, scrypt, Argon2) to resist brute-force and dictionary attacks.

What is Public Key Infrastructure (PKI)?

A framework of hardware, software, policies, and procedures for creating, managing, distributing, and revoking digital certificates and public/private key pairs to enable trusted secure communication.

What is the role of a Certificate Authority (CA) and Registration Authority (RA)?

A CA issues, signs, and vouches for digital certificates, binding a public key to an identity. An RA verifies the requester's identity and forwards approved requests to the CA, but does not issue certificates itself.

What is a Certificate Revocation List (CRL) versus OCSP?

A CRL is a published list of revoked certificates that clients download and check. OCSP (Online Certificate Status Protocol) provides real-time, on-demand certificate status; OCSP stapling lets the server present a signed status to reduce client lookups.

What is certificate chaining (chain of trust)?

The hierarchy linking an end-entity certificate through one or more intermediate CA certificates up to a trusted root CA. Each certificate is signed by the one above it, establishing trust to the root.

What is the difference between a wildcard certificate and a SAN certificate?

A wildcard certificate (e.g. *.example.com) secures unlimited subdomains of a single domain. A SAN (Subject Alternative Name) certificate secures multiple specified distinct domain names in one certificate.

What is full-disk encryption (FDE) and what hardware component commonly supports it?

FDE encrypts an entire storage volume so data is unreadable without authentication. A TPM (Trusted Platform Module) securely stores the encryption keys and supports it; BitLocker is a common implementation.

What is the difference between data at rest, data in transit, and data in use, and how is each protected?

Data at rest is stored data (protect with FDE/file encryption); data in transit moves across networks (protect with TLS/IPsec/VPN); data in use is actively processed in memory (protect with secure enclaves, access controls, and homomorphic encryption).

What is a digital signature and what does it provide?

A digital signature is created by hashing a message and encrypting the hash with the sender's private key. The recipient verifies it with the sender's public key, providing integrity, authentication, and non-repudiation (but not confidentiality).

What is the difference between steganography, tokenization, and data masking?

Steganography hides data within other media (e.g. an image). Tokenization replaces sensitive data with a non-sensitive token mapped in a secure vault. Data masking obscures data (e.g. showing only last 4 digits) so the original is not exposed.

What is perfect forward secrecy (PFS)?

A property where unique ephemeral session keys are generated per session so that compromise of a long-term private key does not allow decryption of past recorded sessions.

What is a blockchain and how does it relate to cryptography?

A blockchain is a distributed, append-only ledger where each block contains a cryptographic hash of the previous block, creating an immutable, tamper-evident chain that provides integrity and a public, verifiable record.

What is key escrow?

A practice where a copy of a cryptographic key is held by a trusted third party so it can be recovered (e.g. for legal access or data recovery) if the original key is lost or required.