CompTIA A+ / Network+ / Security+ CompTIA Security+: Threats, Attacks & Cryptography (SY0-701) Flashcards

24 sample cards from the CompTIA Security+: Threats, Attacks & Cryptography (SY0-701) deck

Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.

1. What is the difference between a vulnerability scan and a penetration test?

   A vulnerability scan automatically identifies and reports known weaknesses without exploiting them. A penetration test actively exploits vulnerabilities to demonstrate real-world impact and depth of compromise.

2. Compare credentialed (authenticated) vs non-credentialed vulnerability scans.

   Credentialed scans use valid login credentials for a deeper, insider view of misconfigurations and missing patches. Non-credentialed scans probe from an outsider's perspective without authentication, finding externally visible issues.

3. What do CVE and CVSS stand for in vulnerability management?

   CVE (Common Vulnerabilities and Exposures) is a standardized identifier for a publicly known vulnerability. CVSS (Common Vulnerability Scoring System) is a 0-10 score rating a vulnerability's severity.

4. What is a false positive versus a false negative in scanning?

   A false positive is when a scan reports a vulnerability that does not actually exist. A false negative is when a scan fails to detect a real, existing vulnerability.

5. Define a zero-day vulnerability.

   A vulnerability that is unknown to the vendor and has no available patch, leaving 'zero days' for defenders to prepare before it can be exploited.

6. List common vulnerability remediation/response options.

   Patching/remediation, insurance (transfer), segmentation/isolation, applying compensating controls, exception/exemption (accept risk), and validation of remediation via rescanning and audit.

7. What is the difference between symmetric and asymmetric encryption?

   Symmetric encryption uses a single shared secret key for both encryption and decryption (fast, e.g. AES). Asymmetric encryption uses a mathematically related public/private key pair (slower, e.g. RSA), where one key encrypts and the other decrypts.

8. Name common symmetric encryption algorithms and a typical AES key size.

   AES, 3DES, and (legacy) DES/Blowfish/RC4. AES supports 128-, 192-, and 256-bit keys; AES-256 is a common strong choice.

9. What is a hash function and what property must it have?

   A one-way function that converts arbitrary input into a fixed-length digest. It must be deterministic, irreversible (preimage resistant), and collision resistant (hard to find two inputs with the same hash). Examples: SHA-256, SHA-3.

10. What is the difference between encryption and hashing?

    Encryption is reversible (with a key) and protects confidentiality. Hashing is one-way (irreversible) and verifies integrity; it does not protect confidentiality.

11. What is a salt and why is it used with password hashes?

    A salt is a random value added to a password before hashing so identical passwords produce different hashes. It defeats precomputed rainbow-table attacks and makes brute-forcing harder.

12. What is key stretching?

    Deliberately making a key/password derivation slow and computationally expensive (e.g. PBKDF2, bcrypt, scrypt, Argon2) to resist brute-force and dictionary attacks.

13. What is Public Key Infrastructure (PKI)?

    A framework of hardware, software, policies, and procedures for creating, managing, distributing, and revoking digital certificates and public/private key pairs to enable trusted secure communication.

14. What is the role of a Certificate Authority (CA) and Registration Authority (RA)?

    A CA issues, signs, and vouches for digital certificates, binding a public key to an identity. An RA verifies the requester's identity and forwards approved requests to the CA, but does not issue certificates itself.

15. What is a Certificate Revocation List (CRL) versus OCSP?

    A CRL is a published list of revoked certificates that clients download and check. OCSP (Online Certificate Status Protocol) provides real-time, on-demand certificate status; OCSP stapling lets the server present a signed status to reduce client lookups.

16. What is certificate chaining (chain of trust)?

    The hierarchy linking an end-entity certificate through one or more intermediate CA certificates up to a trusted root CA. Each certificate is signed by the one above it, establishing trust to the root.

17. What is the difference between a wildcard certificate and a SAN certificate?

    A wildcard certificate (e.g. *.example.com) secures unlimited subdomains of a single domain. A SAN (Subject Alternative Name) certificate secures multiple specified distinct domain names in one certificate.

18. What is full-disk encryption (FDE) and what hardware component commonly supports it?

    FDE encrypts an entire storage volume so data is unreadable without authentication. A TPM (Trusted Platform Module) securely stores the encryption keys and supports it; BitLocker is a common implementation.

19. What is the difference between data at rest, data in transit, and data in use, and how is each protected?

    Data at rest is stored data (protect with FDE/file encryption); data in transit moves across networks (protect with TLS/IPsec/VPN); data in use is actively processed in memory (protect with secure enclaves, access controls, and homomorphic encryption).

20. What is a digital signature and what does it provide?

    A digital signature is created by hashing a message and encrypting the hash with the sender's private key. The recipient verifies it with the sender's public key, providing integrity, authentication, and non-repudiation (but not confidentiality).

21. What is the difference between steganography, tokenization, and data masking?

    Steganography hides data within other media (e.g. an image). Tokenization replaces sensitive data with a non-sensitive token mapped in a secure vault. Data masking obscures data (e.g. showing only last 4 digits) so the original is not exposed.

22. What is perfect forward secrecy (PFS)?

    A property where unique ephemeral session keys are generated per session so that compromise of a long-term private key does not allow decryption of past recorded sessions.

23. What is a blockchain and how does it relate to cryptography?

    A blockchain is a distributed, append-only ledger where each block contains a cryptographic hash of the previous block, creating an immutable, tamper-evident chain that provides integrity and a public, verifiable record.

24. What is key escrow?

    A practice where a copy of a cryptographic key is held by a trusted third party so it can be recovered (e.g. for legal access or data recovery) if the original key is lost or required.

What this deck covers

CompTIA Security+: Threats, Attacks & Cryptography (SY0-701) flashcards FAQ