Title: Comptia Security Plus Sy0 — LearnCoachAssist

Q: What does the CIA triad stand for in information security?
A: Confidentiality, Integrity, and Availability

Q: Which security principle extends CIA by adding authentication, authorization, and accounting (non-repudiation)?
A: AAA (Authentication, Authorization, Accounting)

Q: What is the difference between authentication and authorization?
A: Authentication verifies identity ("who you are"); authorization determines permitted actions ("what you can do")

Q: Define non-repudiation.
A: Assurance that a party cannot deny having performed an action, typically via digital signatures or audit logs

Q: What is the Parkerian hexad?
A: An extension of the CIA triad adding Possession, Authenticity, and Utility

Q: What is defense in depth?
A: A layered security strategy using multiple overlapping controls so no single failure causes compromise

Q: What is the principle of least privilege?
A: Granting users only the minimum access rights necessary to perform their job functions

Q: What is need-to-know?
A: Access is granted only to information required for a specific task, even if broader clearance exists

Q: What is separation of duties?
A: Splitting critical tasks among multiple people to prevent any single person from committing fraud undetected

Q: What is the difference between a threat, a vulnerability, and a risk?
A: Threat = potential cause of harm; Vulnerability = weakness that can be exploited; Risk = likelihood x impact of a threat exploiting a vulnerability

Q: Define a zero-day vulnerability.
A: A software flaw unknown to the vendor with no patch available, actively exploited by attackers

Q: What is a CVE?
A: Common Vulnerabilities and Exposures - a unique identifier assigned to a publicly known security vulnerability

Q: What does CVSS measure?
A: Common Vulnerability Scoring System - a 0.0-10.0 score representing base severity of a vulnerability

Q: What is a risk register?
A: A documented inventory of identified risks, their likelihood, impact, owner, and mitigation status

Q: What is risk transference?
A: Shifting risk to a third party, e.g., via cyber insurance or outsourcing

Q: What is risk acceptance?
A: Management formally acknowledges a risk and chooses not to mitigate it, typically when cost of control exceeds potential loss

Q: Define threat modeling.
A: A structured process to identify, classify, and prioritize threats to a system (e.g., STRIDE, PASTA, DREAD)

Q: What does STRIDE stand for?
A: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege

Q: What is an attack surface?
A: The sum of all points where an unauthorized user can attempt to enter or extract data from a system

Q: What is attack vector vs. attack surface?
A: Attack vector = the path or method used to gain access; attack surface = the total set of all possible entry points

Q: What is social engineering?
A: Manipulating people into performing actions or divulging confidential information, exploiting human psychology

Q: What is phishing?
A: Social engineering using fraudulent email or messages to trick users into revealing credentials or installing malware

Q: What is spear phishing vs. whaling?
A: Spear phishing targets a specific individual or group; whaling targets senior executives ("big fish")

Q: What is vishing?
A: Voice phishing - social engineering conducted via telephone or VoIP

Q: What is smishing?
A: SMS phishing - social engineering conducted via text messages

Q: What is pretexting?
A: Social engineering where the attacker fabricates a believable scenario to steal information or access

Q: What is tailgating (piggybacking)?
A: Physical security breach where an unauthorized person follows an authorized person through a controlled door

Q: What is a dumpster diving attack?
A: Searching through discarded trash for sensitive information like printed documents or credentials

Q: What is a brute-force attack?
A: Attempting all possible password combinations until the correct one is found

Q: What is a dictionary attack?
A: Trying words from a predefined list of common passwords against an account

Q: What is credential stuffing?
A: Using username/password pairs leaked from one breach to attempt logins on other unrelated services

Q: What is password spraying?
A: Trying a small set of common passwords against many accounts to avoid account lockouts

Q: Define hashing.
A: A one-way cryptographic function that maps data of any size to a fixed-size output (digest)

Q: What is the difference between hashing and encryption?
A: Hashing is one-way and not reversible; encryption is two-way and reversible with a key

Q: What is a rainbow table attack?
A: Precomputed table of hashes used to reverse common passwords by lookup rather than recomputation

Q: How does salting defeat rainbow tables?
A: A unique random value is added to each password before hashing, making precomputed tables ineffective

Q: What is the difference between symmetric and asymmetric encryption?
A: Symmetric uses one shared key for encrypt/decrypt; asymmetric uses a mathematically paired public/private key pair

Q: Name three symmetric encryption algorithms.
A: AES, 3DES, ChaCha20 (Blowfish and RC4 are legacy)

Q: Name two asymmetric encryption algorithms.
A: RSA, ECC (Elliptic Curve Cryptography), and DSA for signatures

Q: What is RSA used for?
A: Asymmetric encryption, digital signatures, and key exchange; security based on the difficulty of factoring large primes

Q: What is ECC?
A: Elliptic Curve Cryptography - asymmetric crypto offering equivalent security to RSA with smaller key sizes

Q: What is a digital signature?
A: Cryptographic proof that a message was created by a known sender and was not altered, produced by signing a hash with a private key

Q: What does a certificate authority (CA) do?
A: Issues, signs, and manages digital certificates that bind public keys to identities

Q: What is X.509?
A: The standard format for public key certificates used in PKI and TLS

Q: What is a self-signed certificate?
A: A certificate signed by the same entity it certifies, not trusted by default in browsers unless manually added

Q: What is a wildcard certificate?
A: A single TLS certificate that secures a domain and all of its first-level subdomains (*.example.com)

Q: What is certificate pinning?
A: Hardcoding a specific certificate or public key in an application to detect fraudulent certificates

Q: What is a CRL?
A: Certificate Revocation List - a CA-published list of certificates that have been revoked before expiration

Q: What is OCSP?
A: Online Certificate Status Protocol - real-time check to determine if a certificate is revoked

Q: What is a PKI?
A: Public Key Infrastructure - the framework of policies, hardware, software, and people used to manage digital certificates and keys

Q: What is key escrow?
A: A copy of a cryptographic key is held by a trusted third party so it can be recovered if the original is lost

Q: What is a hardware security module (HSM)?
A: A tamper-resistant physical device that generates, stores, and manages cryptographic keys

Q: What is a TPM?
A: Trusted Platform Module - a chip on the motherboard that stores cryptographic keys and supports platform integrity measurements

Q: What is full-disk encryption (FDE)?
A: Encrypting an entire storage device so all data is unreadable without the proper key (e.g., BitLocker, FileVault)

Q: Define a block cipher mode of operation.
A: A method of using a block cipher to securely encrypt data longer than a single block (e.g., CBC, GCM, CTR)

Q: What is AES-GCM?
A: Authenticated encryption mode providing both confidentiality and integrity/authenticity in one operation

Q: What is a MAC?
A: Message Authentication Code - a tag using a shared secret key to verify both integrity and authenticity of a message

Q: What is HMAC?
A: Hash-based Message Authentication Code - a MAC constructed using a cryptographic hash (e.g., HMAC-SHA256)

Q: What is a key exchange protocol?
A: A method for two parties to establish a shared secret over an insecure channel (e.g., Diffie-Hellman)

Q: What is the difference between Diffie-Hellman and RSA?
A: Diffie-Hellman is a key exchange protocol; RSA is an encryption/signature algorithm. ECDH is the elliptic-curve variant.

Q: What is perfect forward secrecy (PFS)?
A: A property where session keys are ephemeral, so compromising one long-term key does not reveal past sessions

Q: What is a VPN?
A: Virtual Private Network - an encrypted tunnel across a public network providing confidentiality and integrity for traffic

Q: What is the difference between SSL and TLS?
A: TLS is the successor to SSL; modern systems use TLS 1.2 or 1.3. SSL 3.0 is deprecated and insecure.

Q: What does HTTPS add to HTTP?
A: TLS encryption, server (and optionally client) authentication, and integrity for HTTP traffic

Q: What port does HTTPS use by default?
A: TCP 443

Q: What port does HTTP use by default?
A: TCP 80

Q: What port does SSH use by default?
A: TCP 22

Q: What is SSH used for?
A: Secure remote command-line access and file transfer, replacing unencrypted Telnet

Q: What is the difference between SFTP and FTPS?
A: SFTP is file transfer over SSH (port 22); FTPS is FTP with TLS (ports 989/990)

Q: What is a stateful vs. stateless firewall?
A: Stateful tracks active connections and context; stateless inspects each packet independently against rules

Q: What is a WAF?
A: Web Application Firewall - a firewall that filters and monitors HTTP traffic to/from a web application

Q: What is a next-generation firewall (NGFW)?
A: A firewall combining traditional filtering with deep packet inspection, IDS/IPS, application awareness, and threat intelligence

Q: What is network segmentation?
A: Dividing a network into smaller zones (VLANs, subnets) to limit the blast radius of a compromise

Q: What is a DMZ?
A: Demilitarized zone - a buffer network between an untrusted network (Internet) and a trusted internal network, hosting public-facing services

Q: What is a jump server (bastion host)?
A: A hardened host used to access and manage devices in a separate security zone

Q: What is east-west traffic?
A: Network traffic flowing between servers within a data center or cloud environment, as opposed to north-south (client-to-server)

Q: What is a SIEM?
A: Security Information and Event Management - collects, correlates, and analyzes log data from multiple sources for security monitoring

Q: What is SOAR?
A: Security Orchestration, Automation, and Response - platforms that automate security operations workflows and incident response

Q: What is the difference between IDS and IPS?
A: IDS (Intrusion Detection System) monitors and alerts; IPS (Intrusion Prevention System) blocks traffic in real time

Q: What are false positives and false negatives in IDS?
A: False positive = legitimate traffic flagged as malicious; false negative = malicious traffic not detected (more dangerous)

Q: What is signature-based detection?
A: Matching observed activity against known patterns of attack (e.g., Snort rules)

Q: What is anomaly-based detection?
A: Flagging activity that deviates from a learned baseline of normal behavior

Q: What is a honeypot?
A: A decoy system designed to attract attackers, study their behavior, and divert them from real assets

Q: What is a canary token?
A: A trap element (file, URL, credential) that triggers an alert when accessed, used to detect intruders

Q: What is DLP?
A: Data Loss Prevention - tools and policies that detect and prevent sensitive data from leaving the organization

Q: What is the principle of least functionality?
A: Systems should run only the applications, services, and protocols absolutely required for their function

Q: What is port security?
A: A switch feature limiting which MAC addresses can communicate on a given port

Q: What is ARP poisoning?
A: Sending forged ARP messages to associate the attacker's MAC address with a legitimate IP, enabling MITM

Q: What is a DNS poisoning attack?
A: Corrupting a DNS resolver's cache to redirect users to malicious sites

Q: What is a MAC flooding attack?
A: Overloading a switch's MAC address table to force it into hub mode and capture traffic

Q: What is a rogue DHCP server?
A: An unauthorized DHCP server handing out incorrect network configuration, including a malicious default gateway

Q: What is VLAN hopping?
A: Gaining access to a VLAN not normally reachable, typically via switch spoofing or double-tagging 802.1Q frames

Q: What is a man-in-the-middle (MITM) attack?
A: An attacker secretly intercepts and possibly alters communication between two parties who believe they are talking directly

Q: What is TLS stripping?
A: Downgrading a user's HTTPS connection to unencrypted HTTP via a MITM, exposing session data

Q: What is ARP?
A: Address Resolution Protocol - maps IPv4 addresses to MAC addresses on a local network

Q: What is a replay attack?
A: An attacker captures and maliciously re-sends a valid data transmission to trick the receiver

Q: How does TLS protect against replay attacks?
A: By using nonces, sequence numbers, and session tickets that expire or are unique per session

Q: What is the Kerberos authentication protocol?
A: A ticket-based authentication system using a Key Distribution Center (KDC) to authenticate users in a Windows/AD environment

Q: What are the three parts of Kerberos?
A: Client, Application Server, and Key Distribution Center (KDC) consisting of Authentication Server and Ticket Granting Server

Q: What is a Kerberos ticket?
A: A time-limited token issued by the KDC proving a client's identity, used to access services without re-sending credentials

Q: What is RADIUS?
A: Remote Authentication Dial-In User Service - a AAA protocol for centralized authentication, authorization, and accounting, often for network access

Q: What is TACACS+?
A: A Cisco AAA protocol that separates authentication, authorization, and accounting and encrypts the entire payload (unlike RADIUS)

Q: What is the difference between RADIUS and TACACS+?
A: RADIUS combines authentication/authorization, encrypts only the password (UDP); TACACS+ separates all three A's and encrypts the full body (TCP)

Q: What is LDAP used for?
A: Lightweight Directory Access Protocol - querying and modifying directory services such as Active Directory

Q: What is SAML?
A: Security Assertion Markup Language - an XML-based standard for federated single sign-on (SSO) exchanging authentication/authorization data

Q: What is OAuth 2.0?
A: An authorization framework that allows third-party apps to obtain limited access to user resources without exposing credentials

Q: What is OpenID Connect?
A: An identity layer on top of OAuth 2.0 providing authentication (verifying who the user is) using JSON Web Tokens

Q: What is federation?
A: Trust established between two organizations' identity providers so users from one can access resources in the other

Q: What is single sign-on (SSO)?
A: A user authenticates once and gains access to multiple independent systems without re-entering credentials

Q: What is MFA?
A: Multi-Factor Authentication - requires two or more of: something you know, have, are, do, or somewhere you are

Q: What are the five MFA factors?
A: Something you know (password), have (token), are (biometric), do (behavior), somewhere you are (location)

Q: What is a TOTP?
A: Time-based One-Time Password - a 6-8 digit code generated from a shared secret and current time (e.g., Google Authenticator, RFC 6238)

Q: What is an HMAC-based OTP (HOTP)?
A: An OTP generated from a counter value and shared secret, used in hardware tokens (RFC 4226)

Q: What is an evil twin attack?
A: A rogue Wi-Fi access point mimicking a legitimate one to capture credentials of users connecting to it

Q: What is a deauthentication attack?
A: Sending forged Wi-Fi deauth frames to disconnect clients, often to capture WPA handshakes

Q: What encryption does WPA3 use?
A: Simultaneous Authentication of Equals (SAE), providing forward secrecy and resistance to offline dictionary attacks

Q: What is the difference between WEP, WPA, WPA2, and WPA3?
A: WEP = broken RC4; WPA = TKIP transitional; WPA2 = AES-CCMP; WPA3 = SAE, strongest, forward secrecy

Q: What is a captive portal?
A: A web page users must interact with (accept terms, log in) before gaining network access, common on guest Wi-Fi

Q: What is a DDoS attack?
A: Distributed Denial of Service - overwhelming a target with traffic from many distributed sources (botnet)

Q: What is the difference between DoS and DDoS?
A: DoS uses a single source; DDoS uses many distributed sources, making mitigation harder