Title: Cybersecurity Fundamentals — LearnCoachAssist

Q: What is cybersecurity?
A: The practice of protecting systems, networks, and data from digital attacks, unauthorized access, and damage.

Q: What is the CIA triad?
A: Confidentiality, Integrity, and Availability — the three core security principles.

Q: What is confidentiality?
A: Ensuring information is accessible only to authorized parties.

Q: What is integrity (security)?
A: Ensuring data is accurate and unaltered except by authorized changes.

Q: What is availability?
A: Ensuring systems and data are accessible when needed.

Q: What is authentication?
A: Verifying the identity of a user, device, or system.

Q: What is authorization?
A: Granting permission to access specific resources or perform specific actions.

Q: What is the difference between authentication and authorization?
A: Authentication confirms who you are; authorization defines what you can do.

Q: What is accounting (AAA)?
A: Tracking and logging user actions for audit and forensic purposes.

Q: What is non-repudiation?
A: The assurance that someone cannot deny the validity of an action.

Q: What is a threat?
A: A potential cause of unwanted incident that may harm a system.

Q: What is a vulnerability?
A: A weakness that can be exploited by a threat to compromise security.

Q: What is risk?
A: The potential for loss when a threat exploits a vulnerability.

Q: What is risk = threat × vulnerability × impact?
A: A simplified equation showing how risk is calculated.

Q: What is an exploit?
A: Code or technique that takes advantage of a vulnerability.

Q: What is malware?
A: Malicious software designed to harm or exploit systems.

Q: What is a virus (malware)?
A: Malware that attaches to programs and spreads when executed.

Q: What is a worm?
A: Self-replicating malware that spreads across networks without user interaction.

Q: What is a Trojan horse?
A: Malware disguised as legitimate software.

Q: What is ransomware?
A: Malware that encrypts data and demands payment for decryption.

Q: What is spyware?
A: Malware that secretly monitors user activity and exfiltrates information.

Q: What is adware?
A: Software that displays unwanted advertisements.

Q: What is a rootkit?
A: Malware that hides itself and provides persistent privileged access.

Q: What is a keylogger?
A: Software or hardware that records keystrokes to capture passwords or sensitive data.

Q: What is fileless malware?
A: Malware that operates in memory without writing files to disk.

Q: What is a botnet?
A: A network of compromised devices controlled by an attacker.

Q: What is a zero-day vulnerability?
A: A vulnerability unknown to the vendor with no patch available.

Q: What is a backdoor?
A: A hidden method of bypassing normal authentication.

Q: What is a logic bomb?
A: Malicious code triggered by a specific condition or event.

Q: What is phishing?
A: Fraudulent attempts to obtain sensitive information by impersonating trusted entities.

Q: What is spear phishing?
A: Targeted phishing aimed at specific individuals or organizations.

Q: What is whaling?
A: Phishing targeting high-profile individuals like executives.

Q: What is smishing?
A: Phishing conducted via SMS text messages.

Q: What is vishing?
A: Phishing conducted via voice calls.

Q: What is pretexting?
A: Creating a fabricated scenario to obtain information.

Q: What is social engineering?
A: Manipulating people into divulging information or performing actions.

Q: What is baiting?
A: Leaving infected media (e.g., USB sticks) to lure victims.

Q: What is tailgating?
A: Following an authorized person into a restricted area.

Q: What is shoulder surfing?
A: Observing someone's screen or keystrokes to capture credentials.

Q: What is a denial-of-service (DoS) attack?
A: An attack that overwhelms a service to make it unavailable.

Q: What is a DDoS attack?
A: A distributed denial-of-service attack from many sources simultaneously.

Q: What is a man-in-the-middle (MITM) attack?
A: Intercepting communications between two parties to eavesdrop or alter data.

Q: What is a replay attack?
A: Capturing valid data transmission and resending it.

Q: What is SQL injection?
A: Inserting malicious SQL into queries to manipulate a database.

Q: What is cross-site scripting (XSS)?
A: Injecting client-side scripts into web pages viewed by other users.

Q: What is cross-site request forgery (CSRF)?
A: Tricking a logged-in user's browser to perform unintended actions.

Q: What is buffer overflow?
A: Writing data beyond a buffer's boundary, potentially overwriting memory.

Q: What is privilege escalation?
A: Gaining higher-level permissions than originally granted.

Q: What is brute force attack?
A: Trying all possible password combinations until success.

Q: What is a dictionary attack?
A: Trying passwords from a curated list of likely candidates.

Q: What is credential stuffing?
A: Using stolen credentials from one breach to access other accounts.

Q: What is password spraying?
A: Trying a common password against many accounts to evade lockouts.

Q: What is rainbow table attack?
A: Using precomputed hash tables to crack passwords.

Q: What is salting (passwords)?
A: Adding random data to passwords before hashing to defeat rainbow tables.

Q: What is hashing?
A: A one-way function that converts data to a fixed-size string.

Q: What is encryption?
A: Converting plaintext to ciphertext to protect confidentiality.

Q: What is decryption?
A: Converting ciphertext back to plaintext using a key.

Q: What is symmetric encryption?
A: Encryption using the same key for both encryption and decryption.

Q: What is asymmetric encryption?
A: Encryption using a public/private key pair.

Q: Name a common symmetric algorithm.
A: AES (Advanced Encryption Standard).

Q: Name a common asymmetric algorithm.
A: RSA, ECC (Elliptic Curve Cryptography).

Q: What is a digital signature?
A: A cryptographic method to verify message authenticity and integrity.

Q: What is a digital certificate?
A: An electronic document binding a public key to an identity, issued by a CA.

Q: What is a Certificate Authority (CA)?
A: A trusted entity that issues digital certificates.

Q: What is PKI?
A: Public Key Infrastructure — the framework for managing digital certificates.

Q: What is TLS?
A: Transport Layer Security — a protocol for encrypted communication, successor to SSL.

Q: What is SSL?
A: Secure Sockets Layer — an older encryption protocol now deprecated in favor of TLS.

Q: What is HTTPS?
A: HTTP over TLS, providing encrypted web traffic.

Q: What is VPN?
A: Virtual Private Network — encrypted tunnel for secure remote network access.

Q: What is end-to-end encryption?
A: Encryption where only the communicating parties can read messages.

Q: What is forward secrecy?
A: A property where session keys can't be compromised even if the long-term key is.

Q: What is a firewall?
A: A device or software that filters network traffic based on rules.

Q: What is a stateful firewall?
A: A firewall that tracks the state of network connections.

Q: What is a stateless firewall?
A: A firewall that examines packets without context.

Q: What is a WAF?
A: Web Application Firewall — filters HTTP traffic to/from web apps.

Q: What is IDS?
A: Intrusion Detection System — monitors for malicious activity.

Q: What is IPS?
A: Intrusion Prevention System — detects AND blocks malicious activity.

Q: What is SIEM?
A: Security Information and Event Management — aggregates logs for threat detection.

Q: What is EDR?
A: Endpoint Detection and Response — monitors and responds to threats on endpoints.

Q: What is XDR?
A: Extended Detection and Response — unified threat detection across endpoints, network, cloud.

Q: What is a honeypot?
A: A decoy system designed to attract and study attackers.

Q: What is network segmentation?
A: Dividing a network into smaller zones to limit attack spread.

Q: What is a DMZ?
A: Demilitarized Zone — a buffer network between the internal network and the internet.

Q: What is zero trust?
A: A security model assuming no implicit trust; verify every request.

Q: What is the principle of least privilege?
A: Granting users only the minimum permissions needed for their tasks.

Q: What is defense in depth?
A: Layering multiple security controls so failure of one doesn't compromise security.

Q: What is multi-factor authentication (MFA)?
A: Authentication using two or more independent factors.

Q: What are the three authentication factors?
A: Something you know (password), have (token), are (biometric).

Q: What is biometric authentication?
A: Using physical traits (fingerprint, face, iris) for identification.

Q: What is OAuth?
A: An open standard for delegated authorization.

Q: What is OpenID Connect?
A: An authentication layer on top of OAuth 2.0.

Q: What is SAML?
A: Security Assertion Markup Language — XML-based standard for SSO.

Q: What is SSO?
A: Single Sign-On — one login grants access to multiple systems.

Q: What is JWT?
A: JSON Web Token — a compact, signed token format for authentication.

Q: What is RBAC?
A: Role-Based Access Control — assigning permissions based on roles.

Q: What is ABAC?
A: Attribute-Based Access Control — using attributes (user, resource, environment) for policy.

Q: What is an ACL?
A: Access Control List — a list specifying permissions for resources.

Q: What is MAC?
A: Mandatory Access Control — system enforces policies regardless of user choice.

Q: What is DAC?
A: Discretionary Access Control — owners decide who has access.

Q: What is patching?
A: Applying updates to fix vulnerabilities.

Q: What is vulnerability management?
A: The systematic process of identifying, evaluating, and remediating vulnerabilities.

Q: What is a CVE?
A: Common Vulnerabilities and Exposures — a public list of known security flaws.

Q: What is CVSS?
A: Common Vulnerability Scoring System — measures severity of vulnerabilities.

Q: What is OWASP Top 10?
A: A list of the most critical web application security risks.

Q: Name three OWASP Top 10 risks.
A: Broken access control, cryptographic failures, injection.

Q: What is a SOC?
A: Security Operations Center — team monitoring an organization's security posture.

Q: What is incident response?
A: The process of detecting, responding to, and recovering from security incidents.

Q: What are the phases of incident response?
A: Preparation, identification, containment, eradication, recovery, lessons learned.

Q: What is a tabletop exercise?
A: A simulated incident discussed in a meeting to test response procedures.

Q: What is digital forensics?
A: Investigation and analysis of digital evidence after a security incident.

Q: What is chain of custody?
A: Documenting evidence handling to ensure integrity in legal proceedings.

Q: What is threat intelligence?
A: Information about threats used to inform defensive actions.

Q: What is OSINT?
A: Open Source Intelligence — gathering information from public sources.

Q: What is a penetration test?
A: Authorized simulated attack to evaluate security.

Q: What is a red team?
A: Offensive security professionals simulating attackers.

Q: What is a blue team?
A: Defensive security professionals protecting systems.

Q: What is a purple team?
A: Collaboration between red and blue teams.

Q: What is bug bounty?
A: A program rewarding security researchers for discovering vulnerabilities.

Q: What is a CVE-7+ score considered?
A: High severity vulnerability.

Q: What is data loss prevention (DLP)?
A: Tools and processes to prevent unauthorized data exfiltration.

Q: What is endpoint security?
A: Securing user devices like laptops, phones, and servers.

Q: What is mobile device management (MDM)?
A: Software to manage and secure mobile devices.

Q: What is BYOD?
A: Bring Your Own Device — employees use personal devices for work.

Q: What is shadow IT?
A: Use of IT systems without organizational approval.

Q: What is GDPR?
A: General Data Protection Regulation — EU privacy law.

Q: What is HIPAA?
A: US law protecting health information.

Q: What is PCI DSS?
A: Payment Card Industry Data Security Standard for cardholder data.

Q: What is SOC 2?
A: Audit framework for service organizations' controls.

Q: What is ISO 27001?
A: An international standard for information security management systems.

Q: What is NIST?
A: National Institute of Standards and Technology — publishes cybersecurity frameworks.

Q: What is the NIST Cybersecurity Framework?
A: A voluntary framework with five functions: Identify, Protect, Detect, Respond, Recover.

Q: What is BCDR?
A: Business Continuity and Disaster Recovery planning.

Q: What is RTO?
A: Recovery Time Objective — maximum acceptable downtime.

Q: What is RPO?
A: Recovery Point Objective — maximum acceptable data loss.

Q: What is a backup?
A: A copy of data stored separately for recovery purposes.

Q: What is the 3-2-1 backup rule?
A: 3 copies, 2 different media, 1 offsite.

Q: What is immutable backup?
A: Backups that cannot be altered or deleted, protecting against ransomware.

Q: What is air-gapped backup?
A: Backups disconnected from networks to prevent online attacks.

Q: What is cloud security?
A: Protecting cloud-based systems, data, and infrastructure.

Q: What is the shared responsibility model?
A: Cloud provider secures the cloud; customer secures their data in the cloud.

Q: What is SaaS?
A: Software as a Service — applications delivered over the web.

Q: What is IaaS?
A: Infrastructure as a Service — virtualized compute, storage, network.

Q: What is PaaS?
A: Platform as a Service — managed runtime for application deployment.

Q: What is CSPM?
A: Cloud Security Posture Management — finds misconfigurations in cloud environments.

Q: What is CWPP?
A: Cloud Workload Protection Platform — secures workloads in cloud.

Q: What is container security?
A: Securing applications packaged in containers like Docker.

Q: What is Kubernetes security?
A: Securing container orchestration including pods, secrets, network policies.

Q: What is DevSecOps?
A: Integrating security into DevOps practices throughout the development lifecycle.

Q: What is shift-left security?
A: Addressing security earlier in the development process.

Q: What is SAST?
A: Static Application Security Testing — analyzes source code for vulnerabilities.

Q: What is DAST?
A: Dynamic Application Security Testing — tests running applications.

Q: What is IAST?
A: Interactive Application Security Testing — combines static and dynamic analysis.

Q: What is SCA?
A: Software Composition Analysis — checks dependencies for known vulnerabilities.

Q: What is supply chain attack?
A: Compromising a trusted vendor to attack their customers.

Q: What is SBOM?
A: Software Bill of Materials — inventory of components in software.

Q: What is OWASP?
A: Open Web Application Security Project — community-led security resources.

Q: What is secure coding?
A: Writing code with security in mind to prevent vulnerabilities.

Q: What is input validation?
A: Checking that user input conforms to expectations before processing.

Q: What is output encoding?
A: Encoding data before output to prevent injection attacks.

Q: What is parameterized query?
A: Database query with placeholders, preventing SQL injection.

Q: What is content security policy (CSP)?
A: HTTP header restricting which resources a page can load.

Q: What is HSTS?
A: HTTP Strict Transport Security — forces HTTPS connections.

Q: What is X-Frame-Options?
A: Header preventing clickjacking by controlling iframe embedding.

Q: What is clickjacking?
A: Tricking users into clicking hidden interface elements.

Q: What is session hijacking?
A: Stealing a user's session token to impersonate them.

Q: What is session fixation?
A: Forcing a user to use an attacker-known session ID.

Q: What is cookie security?
A: Practices to protect cookies: HttpOnly, Secure, SameSite flags.

Q: What is HttpOnly cookie?
A: Cookie inaccessible to JavaScript, preventing XSS theft.

Q: What is Secure cookie flag?
A: Cookie sent only over HTTPS.

Q: What is SameSite cookie?
A: Cookie attribute controlling cross-site requests, mitigating CSRF.

Q: What is a kill chain?
A: A model describing stages of a cyberattack (e.g., reconnaissance to actions).

Q: What is MITRE ATT&CK?
A: A framework cataloging adversary tactics, techniques, and procedures.

Q: What is reconnaissance?
A: Gathering information about a target before an attack.

Q: What is OSINT in recon?
A: Using public information for reconnaissance.

Q: What is port scanning?
A: Identifying open ports on a target system.

Q: What is Nmap?
A: Popular open-source network scanning tool.

Q: What is Wireshark?
A: A network protocol analyzer used for traffic inspection.

Q: What is Metasploit?
A: Penetration testing framework with many exploits.

Q: What is Kali Linux?
A: A Linux distribution loaded with security and penetration testing tools.

Q: What is Burp Suite?
A: A web application security testing platform.

Q: What is APT?
A: Advanced Persistent Threat — sophisticated, sustained attacker, often nation-state.

Q: What is lateral movement?
A: Attacker moving within a network after initial compromise.

Q: What is data exfiltration?
A: Unauthorized transfer of data out of an organization.

Q: What is exfiltration over C2?
A: Stealing data through command-and-control channels.

Q: What is a watering hole attack?
A: Compromising sites a target frequents.

Q: What is typosquatting?
A: Registering domains similar to legitimate ones to fool users.

Q: What is DNS spoofing?
A: Tampering with DNS to redirect users to malicious sites.

Q: What is ARP spoofing?
A: Sending fake ARP messages to associate attacker's MAC with target's IP.

Q: What is BGP hijacking?
A: Maliciously rerouting Internet traffic via BGP manipulation.

Q: What is a dropper?
A: Malware whose purpose is to install other malware.

Q: What is a payload?
A: The malicious code delivered by an attack.

Q: What is a watering hole?
A: Targeting users by compromising a site they frequent.

Q: What is dwell time?
A: The duration an attacker remains undetected in a network.

Q: What is MTTD?
A: Mean Time To Detect a security incident.

Q: What is MTTR?
A: Mean Time To Respond/Recover from a security incident.

Q: What is the difference between vulnerability assessment and pen test?
A: Assessment identifies vulnerabilities; pen test exploits them to demonstrate impact.

Q: What is responsible disclosure?
A: Reporting vulnerabilities to vendors before public disclosure.

Q: What is the dark web?
A: Encrypted networks accessible via Tor where illegal activity often occurs.

Q: What is Tor?
A: The Onion Router — anonymous communication network.

Q: What is cryptocurrency in cybercrime?
A: Often used for ransom payments due to perceived anonymity.

Q: What is steganography?
A: Hiding data within other data (e.g., text in images).

Q: What is a passkey?
A: A passwordless authentication standard using public-key cryptography.

Q: What is FIDO2?
A: An open authentication standard for passwordless login.

Q: What is U2F?
A: Universal 2nd Factor — hardware-based second factor authentication.

Q: What is a security key?
A: Physical USB/NFC device used for authentication.

Q: What is YubiKey?
A: A popular hardware security key.

Q: What is a TPM?
A: Trusted Platform Module — hardware chip for cryptographic operations.

Q: What is secure boot?
A: Verifying firmware/OS integrity before loading.

Q: What is BIOS/UEFI security?
A: Protecting firmware from tampering.

Q: What is air-gapping?
A: Physically isolating a system from networks for high security.

Q: What is data classification?
A: Categorizing data by sensitivity (e.g., public, internal, confidential, secret).

Q: What is data at rest?
A: Data stored on a device or medium.

Q: What is data in transit?
A: Data being transmitted over a network.

Q: What is data in use?
A: Data being actively processed in memory.

Q: What is full disk encryption?
A: Encrypting an entire storage device.

Q: What is BitLocker?
A: Microsoft's full disk encryption feature.

Q: What is FileVault?
A: Apple's full disk encryption feature for macOS.

Q: What is LUKS?
A: Linux Unified Key Setup — standard for Linux disk encryption.

Q: What is a CISO?
A: Chief Information Security Officer — senior executive responsible for security.

Q: What is GRC?
A: Governance, Risk, and Compliance — frameworks aligning security with business.

Q: What is a security audit?
A: Independent review of security controls and practices.

Q: What is the principle of separation of duties?
A: Splitting critical functions across multiple people to prevent fraud.

Q: What is job rotation (security)?
A: Moving employees through roles to prevent fraud and identify issues.

Q: What is the human firewall?
A: Trained employees acting as the first line of defense.

Q: What is security awareness training?
A: Educating employees about security threats and best practices.

Q: What is a phishing simulation?
A: Testing employees with fake phishing emails to gauge resilience.

Q: What is a security policy?
A: A document defining security requirements and acceptable behavior.

Q: What is an AUP?
A: Acceptable Use Policy — rules for using organizational resources.

Q: What is a privileged account?
A: Account with elevated permissions, requiring stronger controls.

Q: What is PAM?
A: Privileged Access Management — securing high-permission accounts.

Q: What is just-in-time access?
A: Granting elevated access only when needed and for limited time.

Q: What is credential vaulting?
A: Storing passwords securely and rotating them automatically.

Q: What is secrets management?
A: Protecting API keys, credentials, and other sensitive configuration.

Q: What is HashiCorp Vault?
A: A popular tool for secrets management.

Q: What is AWS KMS?
A: Amazon's Key Management Service for cryptographic keys.

Q: What is HSM?
A: Hardware Security Module — dedicated cryptographic hardware.

Q: What is FIPS 140-2/3?
A: US standard for cryptographic module security.

Q: What is hardening?
A: Reducing a system's attack surface through configuration.

Q: What is CIS Benchmarks?
A: Configuration baselines for hardening systems.

Q: What is logging?
A: Recording events for monitoring and forensics.

Q: What is log retention?
A: Keeping logs for a defined period to support investigations.

Q: What is SOAR?
A: Security Orchestration, Automation, and Response — automating security workflows.

Q: What is threat hunting?
A: Proactively searching for threats not detected by automated systems.

Q: What is anomaly detection?
A: Identifying deviations from normal behavior that may indicate threats.

Q: What is UEBA?
A: User and Entity Behavior Analytics — detecting anomalies in behavior.

Q: What is a sandbox?
A: An isolated environment to safely run suspicious code.

Q: What is detonation?
A: Running suspicious files in a sandbox to observe behavior.

Q: What is YARA?
A: A tool for identifying malware via pattern matching.

Q: What is a signature-based detection?
A: Matching known patterns of malicious code.

Q: What is heuristic detection?
A: Detecting threats based on suspicious characteristics.

Q: What is behavior-based detection?
A: Detecting threats based on actions they perform.

Q: What is AI/ML in cybersecurity?
A: Using artificial intelligence to detect threats and automate response.

Q: What is a cyber insurance?
A: Insurance covering losses from cyber incidents.

Q: What is the cost of a data breach?
A: Often millions of dollars in remediation, fines, and reputation damage.

Q: What is GDPR's maximum fine?
A: €20 million or 4% of global annual revenue, whichever is higher.

Q: What is the cybersecurity skills gap?
A: The shortage of qualified cybersecurity professionals globally.

Q: What are common cybersecurity certifications?
A: Security+, CISSP, CEH, OSCP, CISM, CISA.

Q: What is CISSP?
A: Certified Information Systems Security Professional — senior security certification.

Q: What is OSCP?
A: Offensive Security Certified Professional — hands-on pen testing certification.

Q: What is the cyber kill chain?
A: Lockheed Martin's model describing the stages of a cyber attack.

Q: What are the stages of the cyber kill chain?
A: Reconnaissance, weaponization, delivery, exploitation, installation, C2, actions.

Q: What is the principle of "trust but verify"?
A: A traditional security stance, largely supplanted by zero trust.

Q: What is "verify and never trust"?
A: The zero-trust principle replacing the legacy "trust but verify."

Q: What is microsegmentation?
A: Granular network segmentation, often at workload level.

Q: What is east-west traffic?
A: Traffic between systems inside a network.

Q: What is north-south traffic?
A: Traffic between internal systems and external networks.

Q: What is SASE?
A: Secure Access Service Edge — combines network and security in cloud.

Q: What is ZTNA?
A: Zero Trust Network Access — secure remote access based on identity.

Q: What is CASB?
A: Cloud Access Security Broker — security policy enforcement for cloud apps.

Q: What is browser isolation?
A: Running web sessions in remote sandboxes to protect endpoints.