Core cybersecurity vocabulary and concepts tested on the Security+ exam.
45 cards · basic cards · AI-written, checked twice. Edit anything.
- What are the three components of the AAA model in network security?
- Authentication (verifying identity), Authorization (granting access rights), and Accounting (logging activity).
- How does RADIUS differ from TACACS+?
- RADIUS uses UDP and combines authentication with accounting, while TACACS+ uses TCP and separates authentication, authorization, and accounting into distinct processes.
- What does role-based access control (RBAC) use to determine permissions?
- User roles or job titles within an organization; permissions are assigned to roles rather than individual users.
- How does attribute-based access control (ABAC) differ from RBAC?
- ABAC uses attributes such as user properties, resource properties, and environmental conditions to make access decisions, offering more granular control than role alone.
- What is the principle of least privilege?
- Granting users only the minimum permissions necessary to perform their job functions.
- What is the difference between symmetric and asymmetric encryption?
- Symmetric encryption uses one shared key for both encryption and decryption; asymmetric encryption uses a public key and private key pair.
- What is AES and what key sizes does it support?
- AES (Advanced Encryption Standard) is a symmetric block cipher; it supports key sizes of 128, 192, and 256 bits.
- What is RSA primarily used for?
- RSA is an asymmetric algorithm used for key exchange, digital signatures, and encrypting small amounts of data.
- What is the purpose of a hash function?
- To convert input data of any size into a fixed-size output (hash) that is unique to that input; hashes are one-way functions.
- What does a digital signature provide?
- Authentication (verifies the sender's identity), non-repudiation (sender cannot deny sending it), and integrity (message has not been altered).
- What is a certificate authority (CA)?
- A trusted third party that issues and signs digital certificates to verify the identity and public key of individuals or entities.
- What is social engineering?
- An attack that exploits human psychology and trust to manipulate people into divulging confidential information or performing actions that compromise security.
- What is phishing?
- A social engineering attack that uses fraudulent emails, messages, or websites to trick users into revealing credentials or sensitive information.
- What is a man-in-the-middle (MITM) attack?
- An attack where an attacker intercepts and potentially modifies communications between two parties without their knowledge.
- What is a brute force attack?
- An attack that systematically tries many password or encryption key combinations until the correct one is found.