Title: Cybersecurity Fundamentals — LearnCoachAssist

Q: What are the three components of the CIA triad in cybersecurity?
A: Confidentiality (ensuring data is accessible only to authorized parties), Integrity (ensuring data is accurate and unaltered), and Availability (ensuring systems and data are accessible when needed). Together they form the foundation of information security.

Q: How does a breach of "integrity" in the CIA triad differ from a breach of "confidentiality"?
A: A confidentiality breach means unauthorized parties accessed the data (e.g., a data leak). An integrity breach means the data was altered or tampered with without authorization, even if it wasn't exposed — for example, an attacker modifying financial records.

Q: Why is "availability" considered equally important as confidentiality and integrity?
A: Even if data remains confidential and unaltered, a system is useless if legitimate users cannot access it when needed. DDoS attacks, ransomware, and hardware failures all target availability, potentially causing significant financial and operational damage.

Q: What is a phishing attack and what makes spear phishing more dangerous?
A: Phishing uses fraudulent emails or messages to trick victims into revealing sensitive information or clicking malicious links. Spear phishing targets a specific individual or organization with personalized content, making it far more convincing and harder to detect than generic phishing.

Q: How does SQL injection work and what type of vulnerability does it exploit?
A: SQL injection works by inserting malicious SQL code into input fields (such as login forms) that are passed directly to a database query without proper sanitization. It exploits improper input validation, allowing attackers to read, modify, or delete database contents.

Q: What is Cross-Site Scripting (XSS) and what is the difference between stored and reflected XSS?
A: XSS injects malicious scripts into web pages viewed by other users. Stored XSS persists on the server (e.g., in a forum post) and affects every visitor, while reflected XSS is embedded in a URL and only executes when a victim clicks the crafted link.

Q: How does a DDoS attack differ from a standard DoS attack?
A: A DoS attack uses a single source to overwhelm a target with traffic, while a DDoS (Distributed Denial of Service) attack uses many compromised systems (a botnet) simultaneously. DDoS attacks are much harder to mitigate because the traffic comes from thousands of different IP addresses.

Q: What is a man-in-the-middle (MITM) attack and how can HTTPS help prevent it?
A: In a MITM attack, an attacker secretly intercepts and potentially alters communication between two parties who believe they are communicating directly. HTTPS encrypts traffic using TLS, making it extremely difficult for an attacker to read or modify the data in transit.

Q: What is the difference between authentication and authorization?
A: Authentication verifies who a user is (proving identity, e.g., via password or biometrics). Authorization determines what an authenticated user is allowed to do (permissions and access levels). Authentication always comes before authorization.

Q: What is multi-factor authentication (MFA) and why is it more secure than passwords alone?
A: MFA requires two or more verification factors from different categories: something you know (password), something you have (phone/token), or something you are (biometrics). Even if one factor is compromised, an attacker still cannot access the account without the others.

Q: What is the difference between symmetric and asymmetric encryption?
A: Symmetric encryption uses a single shared key for both encryption and decryption (fast but requires secure key exchange). Asymmetric encryption uses a public/private key pair where the public key encrypts and the private key decrypts, solving the key distribution problem but being computationally slower.

Q: What is hashing and why is it not considered encryption?
A: Hashing is a one-way function that converts data into a fixed-length digest that cannot be reversed to recover the original data. Unlike encryption, hashing has no decryption key — it is used to verify data integrity and securely store passwords, not to protect data for later retrieval.

Q: Why should passwords be stored as salted hashes rather than plain hashes?
A: A salt is a unique random value added to each password before hashing, ensuring that identical passwords produce different hashes. Without salting, attackers can use precomputed rainbow tables to quickly crack hashed passwords in bulk.

Q: What is the role of TLS/SSL in network security?
A: TLS (Transport Layer Security, successor to SSL) encrypts data transmitted between a client and server, ensuring confidentiality and integrity of the communication. It also authenticates the server using digital certificates, preventing impersonation attacks.

Q: What is a firewall and what is the difference between stateful and stateless firewalls?
A: A firewall monitors and controls network traffic based on predefined security rules. A stateless firewall inspects each packet independently against its rules, while a stateful firewall tracks active connections and makes decisions based on the full context of the traffic session.

Q: How does a VPN protect a user's data and privacy?
A: A VPN (Virtual Private Network) creates an encrypted tunnel between the user's device and a VPN server, protecting data from interception on untrusted networks. It also masks the user's IP address, providing anonymity and bypassing geographic restrictions.

Q: What is the difference between an IDS and an IPS?
A: An IDS (Intrusion Detection System) monitors network traffic and alerts administrators about suspicious activity but does not block it. An IPS (Intrusion Prevention System) actively blocks detected threats in real time, sitting inline with traffic to intercept malicious packets.

Q: What is the NIST Cybersecurity Framework and what are its five core functions?
A: The NIST CSF is a voluntary framework providing guidelines for managing cybersecurity risk. Its five core functions are: Identify (understand risk), Protect (implement safeguards), Detect (discover events), Respond (take action), and Recover (restore capabilities).

Q: What does ISO 27001 certification indicate about an organization?
A: ISO 27001 certification means the organization has implemented a systematic Information Security Management System (ISMS) that meets international standards for managing sensitive information. It requires regular risk assessments, security controls, and continuous improvement processes.

Q: What are the typical phases of an incident response plan?
A: The standard phases are: Preparation (establishing plans and teams), Identification (detecting the incident), Containment (limiting damage), Eradication (removing the threat), Recovery (restoring systems), and Lessons Learned (post-incident review to improve future response).

Q: Why is the "containment" phase critical during incident response?
A: Containment prevents the incident from spreading to other systems and limits further damage while the team investigates. Without rapid containment, an attacker could escalate privileges, exfiltrate more data, or compromise additional assets, significantly increasing the impact.

Q: What makes a strong password and why is length more important than complexity?
A: A strong password is long, unique, and unpredictable. Length matters most because each additional character exponentially increases the number of possible combinations an attacker must try, making brute-force attacks impractical even without special characters.

Q: Why should users avoid reusing passwords across multiple sites?
A: If one site is breached, attackers use credential stuffing to automatically try the stolen username/password combination on thousands of other sites. A single reused password can compromise email, banking, and other critical accounts simultaneously.

Q: What is a password manager and why is it recommended for security?
A: A password manager securely stores and generates unique, complex passwords for every account, encrypted behind one master password. It eliminates password reuse, removes the need to memorize passwords, and makes it easy to use strong credentials everywhere.

Q: What is the principle of least privilege and why is it a security best practice?
A: The principle of least privilege grants users and systems only the minimum access permissions needed to perform their tasks. This limits the potential damage from compromised accounts, insider threats, and malware by reducing the attack surface.

Q: What is social engineering and why is it often the most effective attack vector?
A: Social engineering manipulates people into divulging information or performing actions that compromise security, exploiting trust, fear, or urgency. It is highly effective because it targets human psychology rather than technical defenses, bypassing firewalls and encryption entirely.

Q: What is ransomware and what is the recommended response when infected?
A: Ransomware encrypts a victim's files and demands payment for the decryption key. Security experts recommend not paying the ransom, as payment doesn't guarantee recovery and funds criminal operations. Instead, isolate affected systems, restore from backups, and report the incident to authorities.

Q: What is a zero-day vulnerability and why is it particularly dangerous?
A: A zero-day vulnerability is a software flaw unknown to the vendor, meaning no patch exists when it is discovered or exploited. It is especially dangerous because defenders have zero days to prepare, and traditional signature-based security tools cannot detect attacks exploiting it.

Q: What is the purpose of penetration testing and how does it differ from vulnerability scanning?
A: Penetration testing involves authorized simulated attacks to actively exploit vulnerabilities and assess real-world impact. Vulnerability scanning is automated and only identifies known weaknesses without exploiting them. Pen testing reveals how vulnerabilities can be chained and the actual risk they pose.

Q: What is defense in depth and why do organizations use this strategy?
A: Defense in depth is a layered security approach where multiple independent controls (firewalls, encryption, access controls, monitoring, training) protect assets. If one layer fails, others still provide protection, ensuring no single point of failure can compromise the entire system.

Q: What is cybersecurity?
A: Cybersecurity is the protection of systems, networks, devices, and data from unauthorized access, attack, or disruption.

Q: What is the CIA triad?
A: The CIA triad stands for confidentiality, integrity, and availability, three core goals of information security.

Q: What is phishing?
A: Phishing is a social-engineering attack that tricks people into revealing credentials or taking unsafe actions.

Q: Why do strong passwords matter?
A: Strong unique passwords reduce the chance that attackers can guess or reuse stolen credentials across services.

Q: What is multi-factor authentication?
A: Multi-factor authentication requires more than one proof of identity, making account compromise much harder.

Q: What is malware?
A: Malware is malicious software designed to damage systems, steal data, spy on activity, or disrupt operations.

Q: What is ransomware?
A: Ransomware is malware that encrypts data or systems and demands payment to restore access.

Q: Why are software updates important for security?
A: Updates often patch known vulnerabilities that attackers actively exploit when systems stay unpatched.

Q: What is social engineering?
A: Social engineering is manipulating people into bypassing safeguards or revealing sensitive information.

Q: What is least privilege in cybersecurity?
A: Least privilege means giving people and systems only the minimum access needed to perform their tasks.

Q: What is a security incident?
A: A security incident is an event that threatens confidentiality, integrity, or availability and requires investigation or response.

Q: What is a basic cybersecurity habit?
A: Pause before trusting links, attachments, requests for credentials, or unusual urgency.

Q: What does "confidentiality" mean?
A: Information is accessible only to authorized parties — protected from unauthorized disclosure.

Q: What does "integrity" mean?
A: Data has not been altered or destroyed in an unauthorized manner — accuracy and completeness preserved.

Q: What does "availability" mean?
A: Authorized users can access information and resources when needed.

Q: What is AAA?
A: Authentication, Authorization, Accounting — framework for controlling access to resources.

Q: What is authentication?
A: Verifying a user is who they claim to be — usually with credentials, tokens, or biometrics.

Q: What is authorization?
A: Determining what an authenticated user is allowed to do.

Q: What is accounting (audit logging)?
A: Recording who did what and when — supports investigation and compliance.

Q: What is the difference between identification and authentication?
A: Identification claims an identity ("I am Alice"); authentication proves it ("here's my password/token").

Q: What is MFA?
A: Multi-factor authentication — requires two or more independent factors to verify identity.

Q: What are the three authentication factor types?
A: Something you know (password), something you have (token), something you are (biometric).

Q: What is 2FA?
A: Two-factor authentication — a specific case of MFA using exactly two factors.

Q: What is SSO?
A: Single Sign-On — one authentication grants access to multiple applications.

Q: What is SAML?
A: Security Assertion Markup Language — XML-based standard for SSO between identity provider and service provider.

Q: What is OAuth 2.0?
A: Authorization framework letting apps obtain limited access to user accounts without sharing passwords.

Q: What is OpenID Connect?
A: Identity layer built on OAuth 2.0 — adds authentication and ID tokens.

Q: What is JWT?
A: JSON Web Token — a compact, URL-safe token format with claims signed and optionally encrypted.

Q: What is the JWT structure?
A: Header.Payload.Signature — three base64url-encoded parts separated by dots.

Q: What is RBAC?
A: Role-Based Access Control — permissions assigned to roles, users assigned to roles.

Q: What is ABAC?
A: Attribute-Based Access Control — decisions based on attributes of user, resource, action, and environment.

Q: What is the principle of least privilege?
A: Grant only the minimum permissions necessary to complete the task — limits blast radius of compromise.

Q: What is defense in depth?
A: Layered security controls — if one fails, others still protect.

Q: What is the zero trust model?
A: Never trust, always verify — no implicit trust based on network location; authenticate and authorize every request.

Q: What is BeyondCorp?
A: Google's zero-trust implementation — based on device and user identity rather than network perimeter.

Q: What is symmetric encryption?
A: Same key used to encrypt and decrypt — fast, but key distribution is the challenge.

Q: What is asymmetric encryption?
A: Public/private key pair — public encrypts, private decrypts (or vice versa for signing).

Q: What is AES?
A: Advanced Encryption Standard — symmetric block cipher, NIST standard since 2001. Key sizes 128, 192, 256.

Q: What is RSA?
A: Asymmetric cipher based on the difficulty of factoring large primes. Common key sizes: 2048, 3072, 4096.

Q: What is ECC?
A: Elliptic Curve Cryptography — asymmetric crypto with shorter keys for equivalent security to RSA.

Q: What is hashing?
A: One-way function producing fixed-size output — used for integrity verification and password storage.

Q: What is SHA-256?
A: Cryptographic hash function in the SHA-2 family — 256-bit output, widely used.

Q: What is MD5? Why avoid it?
A: Hash function with collision vulnerabilities; broken for security purposes. Use only for non-security checksums.

Q: What is SHA-1? Why avoid it?
A: Older SHA — collisions demonstrated. Deprecated for cryptographic use.

Q: What is a hash collision?
A: Two different inputs producing the same hash output — undermines integrity guarantees.

Q: What is salting?
A: Adding random data to a password before hashing — prevents rainbow table attacks.

Q: What is bcrypt / scrypt / Argon2?
A: Slow, memory-hard hash functions designed for password storage — resist GPU brute force.

Q: Why is Argon2 currently preferred?
A: Tunable memory and compute cost, side-channel resistant — winner of the 2015 Password Hashing Competition.

Q: What is PBKDF2?
A: Password-Based Key Derivation Function — applies a hash many times to slow brute force. Older but still in standards.

Q: What is a digital signature?
A: Hash signed with private key — proves authenticity and integrity without revealing the key.

Q: What is PKI?
A: Public Key Infrastructure — system of CAs, certificates, and policies enabling trusted public key distribution.

Q: What is a digital certificate?
A: A signed document binding a public key to an identity — verified via the CA chain.

Q: What is X.509?
A: Standard format for digital certificates — used in TLS, S/MIME, code signing.

Q: What is a CA?
A: Certificate Authority — trusted entity that issues digital certificates.

Q: What is the root of trust?
A: A CA whose certificate is pre-installed in OS/browser trust stores.

Q: What is a CSR?
A: Certificate Signing Request — what you submit to a CA to get a certificate.

Q: What is OCSP?
A: Online Certificate Status Protocol — checks if a certificate has been revoked.

Q: What is OCSP stapling?
A: Server includes a recent OCSP response in TLS handshake — reduces client-side OCSP traffic.

Q: What is CRL?
A: Certificate Revocation List — list of revoked certificates published by the CA.

Q: What is HTTPS?
A: HTTP over TLS — encrypts the channel, authenticates the server.

Q: What is TLS?
A: Transport Layer Security — protocol securing communications. TLS 1.3 is current; 1.2 still widely used.

Q: What changed in TLS 1.3?
A: Faster handshake (1-RTT, 0-RTT for resumption); removed legacy ciphers; cleaner protocol.

Q: What is the TLS handshake?
A: Negotiation of cipher suites, key exchange, server (and optionally client) authentication.

Q: What is perfect forward secrecy?
A: Past sessions stay secure even if long-term keys are compromised — achieved via ephemeral key exchange (DHE/ECDHE).

Q: What is HSTS?
A: HTTP Strict Transport Security — server header telling browsers to always use HTTPS for the domain.

Q: What is HSTS preload?
A: Browser-shipped list of domains that always use HTTPS — even on first visit.

Q: What is mTLS?
A: Mutual TLS — both client and server present certificates. Used in zero-trust microservices.

Q: What is a CSP header?
A: Content Security Policy — HTTP header restricting what resources a page can load. Mitigates XSS.

Q: What is XSS?
A: Cross-Site Scripting — attacker injects script into a page viewed by other users.

Q: What are XSS types?
A: Stored (persisted in DB), Reflected (in URL/form), DOM-based (executed in client JS).

Q: How to prevent XSS?
A: Contextual output encoding, CSP, input validation, framework auto-escaping, HttpOnly cookies.

Q: What is CSRF?
A: Cross-Site Request Forgery — attacker tricks a user's browser into making unwanted authenticated requests.

Q: How to prevent CSRF?
A: CSRF tokens, SameSite cookies, double-submit patterns, custom request headers, Origin header checks.

Q: What is the SameSite cookie attribute?
A: Controls whether cookies are sent on cross-site requests. Values: Strict, Lax (default), None.

Q: What is the Secure cookie attribute?
A: Cookie sent only over HTTPS.

Q: What is the HttpOnly cookie attribute?
A: Cookie inaccessible to JavaScript — protects session cookies from XSS theft.

Q: What is SQL injection?
A: Untrusted input concatenated into SQL queries lets attacker execute arbitrary SQL.

Q: How to prevent SQL injection?
A: Parameterized queries / prepared statements; never concatenate user input into SQL.

Q: What is a parameterized query?
A: Query template with placeholders; values bound separately so they can't be interpreted as SQL.

Q: What is the OWASP Top 10?
A: List of most critical web application security risks, updated periodically by OWASP.

Q: OWASP Top 10 (2021) — what's #1?
A: A01: Broken Access Control — most common serious vulnerability category.

Q: OWASP Top 10 (2021) — #2?
A: A02: Cryptographic Failures (formerly "Sensitive Data Exposure").

Q: What is broken access control?
A: Failing to enforce permissions on actions or resources — common cause: trusting client-side checks.

Q: What is IDOR?
A: Insecure Direct Object Reference — exposing internal IDs and not authorizing access.

Q: What is privilege escalation?
A: An attacker gains higher permissions than originally granted.

Q: What is vertical privilege escalation?
A: Standard user becomes admin.

Q: What is horizontal privilege escalation?
A: User A accesses user B's data at the same privilege level.

Q: What is RCE?
A: Remote Code Execution — attacker runs arbitrary code on the server. Critical severity.

Q: What is SSRF?
A: Server-Side Request Forgery — attacker tricks server into making requests to internal resources.

Q: What is CRLF injection?
A: Injecting carriage return / line feed into HTTP headers to manipulate response.

Q: What is XXE?
A: XML External Entity attack — abuses XML parsers fetching external entities.

Q: What is path traversal?
A: Attacker provides "../" in input to access files outside intended directory.

Q: What is open redirect?
A: A URL parameter trusted to send users to another site, used in phishing.

Q: What is the SOP?
A: Same-Origin Policy — browsers restrict scripts from interacting across origins.

Q: What is CORS?
A: Cross-Origin Resource Sharing — server-controlled relaxation of SOP for cross-origin requests.

Q: What is a CORS preflight?
A: OPTIONS request browsers send before non-simple cross-origin requests, asking permission.

Q: What is Access-Control-Allow-Origin?
A: Header indicating which origins may access the response.

Q: What is Access-Control-Allow-Credentials?
A: Allows cookies/credentials to be sent on cross-origin requests — careful with combination of origins.

Q: What is a phishing attack?
A: Tricking users into providing credentials or executing malicious actions, usually via deceptive emails or pages.

Q: What is spear phishing?
A: Targeted phishing against specific individuals — researched and customized.

Q: What is whaling?
A: Phishing aimed at executives or high-value targets.

Q: What is smishing?
A: Phishing via SMS.

Q: What is vishing?
A: Phishing via voice calls.

Q: What is BEC?
A: Business Email Compromise — attacker impersonates executive to authorize wire transfers.

Q: What is DNS spoofing?
A: Returning false DNS responses to redirect traffic — mitigated by DNSSEC.

Q: What is DNSSEC?
A: DNS Security Extensions — cryptographic signatures on DNS records ensuring integrity.

Q: What is a MITM attack?
A: Man-in-the-middle — attacker intercepts communication between two parties.

Q: What prevents MITM?
A: TLS with valid certificate validation; certificate pinning for high-value apps.

Q: What is certificate pinning?
A: Client trusts only specific certificates / public keys, not the CA chain — defeats compromised CAs.

Q: What is HTTP Public Key Pinning?
A: Header form of pinning; deprecated due to brittleness — modern apps use Expect-CT or CAA records.

Q: What is CAA record?
A: DNS record specifying which CAs can issue certificates for a domain.

Q: What is the certificate transparency log?
A: Public append-only log of issued certificates — exposes rogue or misissued certs.

Q: What is a brute-force attack?
A: Systematically trying many passwords or keys until success.

Q: What is a dictionary attack?
A: Brute force using a wordlist of likely passwords.

Q: What is credential stuffing?
A: Reusing leaked credentials from one site to log into another.

Q: What protects against credential stuffing?
A: MFA, rate limiting, breach detection (e.g., Have I Been Pwned), unique passwords per site.

Q: What is a rainbow table?
A: Precomputed table of password hashes for fast lookup — defeated by salting.

Q: What is a password manager?
A: Tool generating and storing unique strong passwords — significantly raises security baseline.

Q: What are passkeys?
A: Public-key replacements for passwords — bound to device, phishing-resistant, no shared secret.

Q: What is WebAuthn?
A: W3C standard for public-key authentication in browsers — underpins passkeys.

Q: What is FIDO2?
A: Alliance standard combining WebAuthn + CTAP for passwordless authentication.

Q: What is TOTP?
A: Time-based One-Time Password — 6-digit codes from Google Authenticator, Authy, etc. RFC 6238.

Q: What is HOTP?
A: HMAC-based One-Time Password — counter-based, less common than TOTP.

Q: What is a session?
A: Server-side state representing a logged-in user — typically referenced by a session ID in a cookie.

Q: What is session fixation?
A: Attacker sets a known session ID before login, then reuses it post-login. Mitigation: rotate session ID on login.

Q: What is session hijacking?
A: Stealing or guessing a session ID to impersonate the user.

Q: What is a CSRF token?
A: Random token tied to user session that must accompany state-changing requests — attacker can't forge it.

Q: What is a security header?
A: HTTP response header that tells browsers to enforce security policies (CSP, HSTS, X-Frame-Options, etc.).

Q: What is X-Frame-Options?
A: Header preventing the page from being embedded in iframes — defeats clickjacking. Now largely superseded by CSP frame-ancestors.

Q: What is clickjacking?
A: Attacker overlays an invisible iframe so user clicks land on attacker-controlled UI.

Q: What is X-Content-Type-Options: nosniff?
A: Prevents browser from MIME-sniffing — stops some content-injection attacks.

Q: What is Referrer-Policy?
A: Controls how much referrer info is sent to other origins — reduces leakage.

Q: What is Permissions-Policy?
A: Controls which browser features (camera, microphone, geolocation) the page may use.

Q: What is incident response?
A: The process of detecting, containing, eradicating, and recovering from security incidents.

Q: What is the incident response lifecycle?
A: Preparation → Identification → Containment → Eradication → Recovery → Lessons Learned (NIST SP 800-61).

Q: What is a SOC?
A: Security Operations Center — team monitoring, detecting, and responding to security events.

Q: What is SIEM?
A: Security Information and Event Management — collects, correlates, and alerts on security logs.

Q: What is SOAR?
A: Security Orchestration, Automation and Response — automates SOC workflows.

Q: What is EDR?
A: Endpoint Detection and Response — agent-based threat detection on endpoints.

Q: What is XDR?
A: Extended Detection and Response — EDR + network/cloud telemetry into one platform.

Q: What is the kill chain?
A: Lockheed Martin's model of attack stages: Recon → Weaponization → Delivery → Exploitation → Installation → C2 → Actions on Objectives.

Q: What is MITRE ATT&CK?
A: Framework cataloging adversary tactics, techniques, and procedures (TTPs) — used for threat modeling and detection.

Q: What is a CVE?
A: Common Vulnerabilities and Exposures — unique identifier for a publicly known vulnerability.

Q: What is CVSS?
A: Common Vulnerability Scoring System — 0–10 severity score based on attack vector, complexity, impact.

Q: What is a CWE?
A: Common Weakness Enumeration — categorization of software weakness types.

Q: What is a zero-day?
A: A vulnerability unknown to the vendor (zero days to patch) — high value to attackers.

Q: What is a patch?
A: Vendor-provided fix for a vulnerability — apply promptly especially for internet-facing systems.

Q: What is patch management?
A: Process of identifying, testing, deploying, and verifying patches across systems.

Q: What is vulnerability scanning?
A: Automated tool finding known vulnerabilities in systems and applications.

Q: What is penetration testing?
A: Manual + automated authorized attack simulation to find exploitable vulnerabilities.

Q: What is a red team exercise?
A: Realistic adversary simulation testing detection and response — broader than pentest.

Q: What is a blue team?
A: Defensive team monitoring and protecting systems.

Q: What is a purple team?
A: Combined red + blue collaboration improving both attack and defense.

Q: What is threat modeling?
A: Structured analysis of what assets need protection, from whom, and how — STRIDE, PASTA, etc.

Q: What is STRIDE?
A: Microsoft's threat categories: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.

Q: What is DREAD?
A: Threat scoring model: Damage, Reproducibility, Exploitability, Affected users, Discoverability.

Q: What is DDoS?
A: Distributed Denial of Service — many sources flooding a target to exhaust resources.

Q: What protects against DDoS?
A: Anti-DDoS services (Cloudflare, AWS Shield), rate limiting, scaling, sinkhole routing.

Q: What is a botnet?
A: Network of compromised devices controlled by an attacker — often used for DDoS or spam.

Q: What is a rootkit?
A: Stealthy malware hiding its presence at the OS or firmware level.

Q: What is a worm?
A: Self-replicating malware spreading without user interaction.

Q: What is a trojan?
A: Malware disguised as legitimate software.

Q: What is a logic bomb?
A: Malware activating on a trigger condition (date, event).

Q: What is a backdoor?
A: Hidden access to a system, bypassing normal authentication.

Q: What is a supply chain attack?
A: Compromising a software dependency or build pipeline to attack downstream users.

Q: What was SolarWinds?
A: 2020 supply chain attack on SolarWinds Orion — infiltrated thousands of government and corporate networks.

Q: What is dependency confusion?
A: Publishing malicious package with the same name as an internal package — typosquatting on naming.

Q: What is typosquatting?
A: Registering package names similar to popular ones (e.g., reqeusts vs requests) to trap users.

Q: What is SBOM?
A: Software Bill of Materials — list of components and dependencies in a piece of software.

Q: What is the secret sprawl problem?
A: API keys, tokens, passwords scattered through code and config — common cause of breaches.

Q: What is secret scanning?
A: Automated detection of secrets in code repositories — GitHub, GitLab, AWS provide built-in scanners.

Q: What is secrets management?
A: Centralized service for storing and accessing secrets (HashiCorp Vault, AWS Secrets Manager).

Q: What is encryption at rest?
A: Data encrypted when stored on disk — protects from physical theft.

Q: What is encryption in transit?
A: Data encrypted while moving between systems — TLS being the most common.

Q: What is encryption in use?
A: Data encrypted during processing — confidential computing, homomorphic encryption.

Q: What is hardware security module (HSM)?
A: Tamper-resistant hardware for cryptographic key storage and operations.

Q: What is FIPS 140?
A: US standard for cryptographic module validation — required in federal use cases.

Q: What is PCI DSS?
A: Payment Card Industry Data Security Standard — rules for handling credit card data.

Q: What is HIPAA?
A: US law protecting health information privacy and security.

Q: What is GDPR?
A: EU General Data Protection Regulation — privacy law with extraterritorial reach.

Q: What is SOC 2?
A: AICPA audit framework assessing controls around security, availability, confidentiality, processing integrity, privacy.

Q: What is ISO 27001?
A: International standard for information security management systems (ISMS).

Q: What is NIST CSF?
A: NIST Cybersecurity Framework — voluntary risk-management framework: Identify, Protect, Detect, Respond, Recover.

Q: What is data classification?
A: Categorizing data by sensitivity to apply appropriate protections (public, internal, confidential, restricted).

Q: What is DLP?
A: Data Loss Prevention — tools and policies preventing sensitive data from leaving the organization.

Q: What is BYOD?
A: Bring Your Own Device — employees use personal devices for work; introduces security complexity.

Q: What is MDM?
A: Mobile Device Management — centralized management of mobile devices and their security policies.

Q: What is a SIEM correlation rule?
A: Logic identifying suspicious patterns across multiple log sources to generate alerts.

Q: What is threat intelligence?
A: Information about emerging threats — indicators of compromise (IOCs), attacker TTPs, vulnerabilities.

Q: What is an IOC?
A: Indicator of Compromise — observable artifact suggesting an intrusion (file hash, IP, domain, registry change).

Q: What is SOAR playbook?
A: Automated workflow responding to a specific alert type — speeds containment.

Q: What is the difference between IDS and IPS?
A: IDS detects and alerts; IPS detects and actively blocks. Often combined.

Q: What is a firewall?
A: Device or software filtering traffic based on rules — allow or deny by source, destination, port, protocol.

Q: What is a stateful firewall?
A: Tracks connection state — knows return traffic is part of an established session.

Q: What is a WAF?
A: Web Application Firewall — protects web apps from common attacks (XSS, SQLi, etc.).

Q: What is a reverse proxy?
A: Sits in front of servers, terminating connections; useful for TLS, caching, WAF integration.

Q: What is a CDN?
A: Content Delivery Network — distributes content across edge servers; provides DDoS protection.

Q: What is network segmentation?
A: Dividing a network into zones to limit lateral movement after a breach.

Q: What is microsegmentation?
A: Fine-grained segmentation (often at the workload or process level) — key to zero trust.

Q: What is VPN?
A: Virtual Private Network — encrypted tunnel typically for remote access or site-to-site.

Q: What is split tunneling?
A: Some VPN traffic goes through tunnel, some directly to internet — performance vs. security trade-off.

Q: What is ZTNA?
A: Zero Trust Network Access — successor to VPN; per-app access based on identity and posture.

Q: What is SAST?
A: Static Application Security Testing — analyzes source code for vulnerabilities.

Q: What is DAST?
A: Dynamic Application Security Testing — tests running application for vulnerabilities.

Q: What is IAST?
A: Interactive AST — combines SAST and DAST by instrumenting the running app.

Q: What is SCA?
A: Software Composition Analysis — scans dependencies for known vulnerabilities.

Q: What is DevSecOps?
A: Integrating security into DevOps — security as code, automated in pipelines.

Q: What is a security control?
A: Safeguards or countermeasures implementing security policies (technical, administrative, physical).

Q: What is preventive vs. detective vs. corrective control?
A: Preventive stops incidents; detective finds them; corrective fixes them.

Q: What is the principle "trust but verify"?
A: Trust establishes initial confidence; verification ensures it's still valid — pairs well with zero trust.

Q: What is a security policy?
A: High-level statement of management intent regarding information security.

Q: What is a security standard?
A: Mandatory rules supporting a policy (e.g., password requirements).

Q: What is a security baseline?
A: Minimum set of controls applied to a category of systems.

Q: What is hardening?
A: Reducing attack surface by removing unnecessary services, applying secure defaults, restricting access.

Q: What is the principle of "secure by default"?
A: Systems ship with security enabled, requiring explicit action to weaken it.

Q: What is the principle of "secure by design"?
A: Building security in from the start, not bolted on later.

Q: What is fail secure vs fail open?
A: Fail-secure: failure denies access (default for security). Fail-open: failure allows access (for safety-critical systems).

Q: What is risk?
A: Likelihood of a threat exploiting a vulnerability × impact if it does.

Q: What is risk management?
A: Process of identifying, assessing, treating, and monitoring risk.

Q: What are the four risk treatment options?
A: Avoid, transfer, mitigate, accept.

Q: What is a residual risk?
A: Risk remaining after controls are applied.

Q: What is a CISO?
A: Chief Information Security Officer — executive responsible for an organization's security.

Q: What is "security through obscurity"?
A: Relying on secrecy of design as the primary defense — generally insufficient on its own.

Q: What is a side-channel attack?
A: Exploiting indirect information leaks (timing, power, EM emissions) — Spectre/Meltdown are famous CPU examples.

Q: What is a timing attack?
A: Inferring secrets from variation in execution time — mitigated by constant-time algorithms.

Q: What is the simplest security principle to remember?
A: Assume breach, minimize blast radius, monitor everything, patch quickly, train people.