Security+ Exam Prep 1: Strategy and Objective Review

Glossary

485 terms from Security+ Exam Prep 1: Strategy and Objective Review, in plain words, each with the chapter that teaches it.

Search the glossary

#

802.1X: A port-based access control standard. A device must authenticate before the network port opens to it, unlike a captive portal, which only shows a page to accept.

A

Acceptable use policy (AUP): A policy that says what staff may and may not do with company systems.
Access review: A regular check that each person still needs each access they hold. Anything they no longer need is removed, which fixes privilege creep.
Access vestibule: A pair of doors that never open at the same time, so only one person can pass at a time. It stops tailgating.
Accidental (unintentional) threat: A trusted person who causes harm by mistake, with no bad intent. If a question describes a mistake, pick this over 'insider' when it is offered.
Account lockout: An account is locked after too many failed sign-ins. Many lockouts at the same moment suggest an attack such as brute force.
Acknowledgement: A person's signed statement that they read and understood a policy. An attestation is different: there the organization states that it complies.
Address Resolution Protocol (ARP): A local network protocol that matches IP addresses to the hardware addresses of devices. Its cache can be poisoned so that traffic goes to the attacker instead.
Advanced Encryption Standard (AES): The current, tested symmetric algorithm. One shared key quickly encrypts bulk data.
Advanced persistent threat (APT): A skilled, well-funded attacker that gets in and stays hidden for a long time to reach a goal. The term describes behavior, while 'state-sponsored' names who pays.
Adware: Malware that floods the user with ads and redirects. It is often bundled with free software.
Agentic AI: AI that works toward a goal in steps and uses tools on its own. Because it acts by itself, it needs guardrails.
Agents/agentless: Two ways to collect data or filter traffic: install software (an agent) on each device, or collect over the network without installing anything.
Air-gapped network: A network with no connection at all to other networks. Data crosses only on removable media, and that media is the remaining risk.
Alert tuning: Adjusting monitoring rules to cut false alarms without missing real attacks.
Allow list: A list of approved items, such as programs. Anything not on the list is blocked, which makes it the strongest choice for application control.
Annualized loss expectancy (ALE): The dollars a risk is expected to cost per year: SLE × ARO. For Kettle & Crane's delivery van, $6,000 × 0.25 = $1,500 a year.
Annualized rate of occurrence (ARO): How many times a year an event is expected to happen. One van theft every four years gives an ARO of 0.25.
Anomaly detection: Automatically comparing activity with a normal baseline and flagging whatever doesn't fit.
Anti-money laundering/counter-terrorism financing (AML/CTF): Compliance training on spotting and reporting suspicious movements of money.
Antivirus: Software that scans files for known malware by signature and behavior, and reports detections to a central console.
Application restart: Stopping and starting a program people use so that it loads new settings or certificates.
Artificial intelligence (AI): Software that learns from data to produce text, decisions or predictions. The exam covers both its threats (such as poisoning and prompt injection) and its uses in security operations.
Assertion: A formal claim, usually from management, that a control is in place, which an auditor then tests. SAML also uses signed assertions to say who a user is.
Asset management life cycle: The stages of handling hardware, software and data assets: plan, acquire, assign, monitor and dispose. Disposal ends with a certificate of destruction.
Asymmetric encryption: Encryption that uses a key pair, one public and one private. It is slower than symmetric encryption but solves key sharing and makes signatures possible. RSA and ECC are examples.
Attack surface: Every point an attacker could try. You shrink it by closing ports and removing what isn't needed.
Attestation: A formal statement that an organization or vendor meets a standard. It differs from a right to audit, where you do the checking yourself.
Audit charter: The formal document that creates the internal audit function and gives it authority.
Audit committee: Board members who oversee both internal and external audit.
Authentication, authorization, and accounting (AAA): Authentication proves who you are, authorization decides what you may do, and accounting records what you did.
Autoscaling: Adding or removing servers automatically as demand changes, for example when Kettle & Crane's shop gets busy.
Availability: A system being up when it is needed, measured as a share of time such as 99.9%. Resilience is what produces it.

B

Backout planning: Written steps to undo a change and return to the last known good state.
Backup code: Single-use recovery codes for when your usual multifactor factor is lost. Store them safely.
Baseline: As a standard, a baseline is the minimum required configuration for every system of one type. In monitoring, it is the normal behavior that activity is compared against.
Basic Input/Output System (BIOS): Start-up firmware, now replaced by UEFI. Protect it with a firmware password and updates.
Behavioral testing: Testing whether people act securely, for example with a phishing simulation.
Benchmarks: Published, recommended secure settings for one product, such as the CIS (Center for Internet Security) Benchmarks.
Bias: AI output that is consistently unfair to some groups, usually because of the training data.
Biometrics: Body traits used to sign in, such as a fingerprint, face, iris or voice ('something you are'). Unlike a password, a stolen biometric can't be changed.
Bit-level copy: An exact copy of every bit on a disk, including deleted space, verified with a hash. It is taken after the memory dump.
Block list: A list of items, such as programs, that are blocked. Everything not on the list is allowed, so it is weaker than an allow list.
Bluetooth: Short-range radio with a range of about 10 m (33 ft). Its risks include unwanted pairing and data theft.
Bounty program: A program that pays outside finders for valid new vulnerabilities reported within a set scope.
Brand Indicators for Message Identification (BIMI): Shows a brand's logo in the inbox, but only for mail that passes enforced DMARC.
Bring your own device (BYOD): A policy covering personal devices that staff use for work. It asks that they be kept updated and locked.
Brute force: Trying many passwords against one account (online) or against a stolen hash (offline). Password spraying works the other way: one password against many accounts.
Buffer overflow: Writing more data than a memory buffer can hold, which overwrites nearby memory. It can crash the program or run the attacker's code.
Business continuity: Keeping essential work going during a disruption by any means, IT or not. Disaster recovery restores the IT itself.
Business email compromise (BEC): Fraud through a real or faked business email account, often to change payment details so money goes to the attacker.
Business impact analysis: Works out which activities matter most and how the harm grows with downtime.

C

Cache poisoning: Planting a false entry in a DNS or ARP cache so that later lookups go to the attacker.
California Consumer Privacy Act (CCPA): A US state privacy law that protects personal information.
Canary account: A fake account that nobody should ever use, so any sign-in to it raises an alert.
Capacity planning: Making sure there are enough people, technology and infrastructure for demand, including during a failure.
Captive portal: A web page a new device must accept before it gets network access, like guest Wi-Fi terms. Unlike 802.1X, it doesn't authenticate the device.
Certificate authority (CA): A trusted organization that checks an identity and signs a certificate binding that identity to a public key, such as the certificate for shop.kettleandcrane.com.
Certificate revocation list (CRL): A signed list, published by the CA, of certificates cancelled before they expired. It is downloaded whole, unlike OCSP, which checks one certificate in real time.
Certificate signing request (CSR): A signed request holding your public key and names, sent to a CA to get a certificate. Only the CSR leaves; the private key stays with you.
Chain of custody: A record of everyone who handled each piece of evidence, and when.
Change advisory board (CAB): The group that reviews and approves change requests. The change owner is accountable for the change, and stakeholders are the people it affects.
Chatbot: AI you ask questions in plain language. It answers but doesn't act on its own.
Children's Online Privacy Protection Act (COPPA): A US law protecting the data of children under 13 online.
Clean desk: A policy requiring staff to put away or lock up sensitive papers, devices and notes whenever they step away from their desk. It stops passers-by, visitors or cleaners from seeing or taking confidential information.
Cloud access security broker (CASB): A cloud security service, part of Security Service Edge, that controls how users reach cloud applications.
Cloud security posture management (CSPM): A tool that checks cloud settings for problems such as public buckets, open ports and missing encryption.
Clustering: Several servers (nodes) acting as one system, so one takes over when another fails.
Code signing: The publisher digitally signs its software, proving where it came from and that it wasn't changed.
Cold site: A recovery site with only space, power and network. It takes days or weeks to set up and costs the least.
Command-and-control server: A server attackers use to direct malware. Its known-bad IP address in logs is an indicator of compromise.
Common Vulnerabilities and Exposures (CVE): A public list that gives each known vulnerability an ID, such as CVE-2026-12345. CVSS gives that vulnerability its severity score.
Common Vulnerability Scoring System (CVSS): Rates a vulnerability's severity from 0.0 to 10.0, where 9.0 and above is critical.
Common Weakness Enumeration (CWE): A list of types of weakness, as opposed to specific vulnerabilities.
Compensating control: An alternative put in place when the normal control can't be used, such as isolating a machine that can't be patched.
Competitor: A rival business that attacks for advantage, such as stealing prices, customers or secrets, or damaging service.
Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA): A test that tells humans from bots. Fake CAPTCHAs trick people into running commands.
Compromised credential monitoring: Checking passwords against lists from known breaches and forcing a change when one matches.
Concurrent sessions: One account signed in more than once at the same time, often from different places.
Conditional access: A technical access policy that systems enforce, allowing or denying sign-ins based on conditions.
Confidentiality, integrity, and availability (CIA): The three goals of security: keep data secret, unchanged, and reachable when it is needed.
Conflict of interest: When a decision maker's personal interest could bias a choice, such as picking a vendor. The person should declare it and step aside.
Containment: Cutting off the affected system or file so an incident can't spread, such as Alex isolating the ransomware-infected warehouse computer. It comes before eradication.
Continuous integration and continuous deployment (CI/CD): Code is built, tested and released automatically. Security gates are added to that pipeline.
Control categories: Who or what carries out a control: technical (software and hardware), managerial (policies, risk decisions), operational (people doing tasks) or physical (locks, fences). Every control also has a type.
Cookies: Small text values a website stores in your browser to remember you.
Corrective control: A control that repairs damage and returns things to normal after an incident, such as restoring a backup or reimaging a computer.
Corrective training: Training given after a mistake or violation to fix that behavior, such as for Kettle & Crane staff who clicked a test phish. Targeted training is for a risky group instead.
Credential stuffing: Trying username and password pairs leaked from other breaches, each pair once.
Credentialed scan: A vulnerability scan that signs in to systems, so it sees more than an outside scan.
Crime syndicate (organized crime): A criminal gang run like a business: skilled, well funded and after money.
Cross-site request forgery (CSRF): A forgery attack that makes the user's browser send the attacker's request to a site that trusts the user. Server-side request forgery (SSRF) makes the server send it instead.
Cross-site scripting: An injection attack in which input such as <script> runs as code in other users' browsers. A WAF can block it.
Cryptomining: Secretly using a victim's computers to mine cryptocurrency. It shows up as unexplained high resource use.
Cyber Kill Chain: A model of seven attack stages, in order, from reconnaissance to actions on objectives.

D

Dashboards: Screens that show key numbers at a glance and where to look first. Zero events can mean no data is arriving.
Data at rest: Data stored on a disk, database or backup. It is protected with encryption and permissions.
Data classification: Labeling data by how much harm its exposure would cause. Business classes run from public through sensitive and confidential to restricted, and government classes from confidential through secret to top secret.
Data controller: The organization that decides why and how personal data is processed. The processor acts on its instructions.
Data custodian: The person who looks after data technically day to day: backups, permissions and encryption.
Data Encryption Standard (DES): An old, broken encryption algorithm that should never be used.
Data in transit: Data moving across a network. It is protected with TLS, IPSec or a VPN.
Data in use: Data loaded in memory and being processed. It is the hardest state to protect.
Data loss prevention (DLP): A tool that finds sensitive data, such as card numbers, and stops it leaving where it shouldn't.
Data management life cycle: The stages data goes through: creation, management, distribution, retention, and disposal by clearing, purging or physical destruction.
Data owner: The senior person accountable for the data. They decide its class and who gets access.
Data processor: An organization that processes personal data on the controller's instructions.
Data sovereignty: Data is subject to the laws of the country where it is stored.
Data steward: The person responsible for data quality and proper use: accurate, labeled and used as allowed.
Data subprocessor: An organization that a processor hires to do part of the processing.
Data transpose: Protecting data by moving values around, changing their order or position, rather than changing the values themselves.
Deepfake: AI-made fake audio, video or images of a real person, such as a cloned voice of the boss approving a payment.
Defense in depth: Layers of independent controls of different kinds, so one failure doesn't expose the asset.
Deidentification: Removing or changing whatever identifies people, so the data can be used without revealing who they are.
Dependencies: What one system needs in order to work. If you change something that others depend on, they can fail.
Deployment models: Public cloud is shared by anyone, private serves one organization, community serves several with common needs, and hybrid mixes them.
Desired state management: You declare how systems should be configured, and a tool detects and fixes any drift from that state.
Detective control: A control that finds and records an incident during or after it, such as logs, alarms or an intrusion detection system.
Deterring control: A control that discourages attackers from trying, such as a warning sign or a visible camera. Unlike a preventive control, it can be ignored.
Diamond Model of Intrusion Analysis: A model in which every intrusion links four features: adversary, capability, infrastructure and victim.
Diffie-Hellman: A key exchange method that lets two sides agree a session key over an open network without revealing it.
Digital forensics: Collecting and analyzing evidence in a way that would hold up in court.
Digital signature: You hash the data and sign the hash with your private key, and anyone can check it with your public key. It gives integrity, authentication and non-repudiation.
Directive control: A control that tells people what they should do, such as a policy or a 'badge in' sign.
Directory traversal: Using ../ in a file path to climb out of the folder a program allows.
Disaster recovery: Restoring IT systems and data after a major disruption. Business continuity keeps the wider business working.
Discretionary access control (DAC): An access model in which the owner of a file decides who may use it.
Distributed denial of service (DDoS): Many machines flood a target until it can't serve real users. A denial of service (DoS) does the same from a single source.
DNS tunneling: Hiding data or commands inside DNS lookups. It is one of the DNS attacks, alongside hijacked domains and amplification.
Domain Name System (DNS): The internet's name lookup service, which turns names like shop.kettleandcrane.com into addresses. It also holds email records such as SPF.
Domain-based Message Authentication, Reporting, and Conformance (DMARC): Mail passes DMARC if SPF or DKIM passes for a domain that matches the From address. Otherwise the domain owner's policy (none, quarantine or reject) applies, and receivers send reports back.
DomainKeys Identified Mail (DKIM): A digital signature on each email message, checked with a public key published in DNS.
Domains (exam): The five main subject areas of SY0-801. Each has a weight, its share of the exam; Security Operations (27%) and Threats (24%) together make up about half.
Downtime: Time when a system is unavailable. Planned downtime goes in a maintenance window, and users are told in advance.
Due diligence: Careful checks of a vendor's security, finances and history before committing to it.
Dynamic Host Configuration Protocol (DHCP): A protocol that hands out network addresses to devices automatically.

E

E-discovery: The legal process of finding and handing over electronic information.
Elliptic curve cryptography (ECC): An asymmetric method that gets the same strength from much shorter keys: a 256-bit ECC key is about as strong as a 3072-bit RSA key.
Emergency access account: A 'break glass' account for when normal sign-in fails. It is locked away, and any use raises an alert.
Encryption: Scrambling data with a key so that only whoever holds the key can reverse it. Hashing, by contrast, is one-way.
End-to-end encrypted messaging: Messaging that only the sender and receiver can read, not even the provider.
Endpoint detection and response (EDR): A tool that records endpoint behavior, detects attacks and can isolate the device. It goes beyond antivirus, which scans files.
Endpoint posture: A health check of a device (patches, protection, encryption) before it is allowed on the network.
Eradication: Removing the cause of an incident, after containment, then restoring systems and watching for a return.
Espionage: An attacker's motive of spying quietly over a long time.
Evasion: An input crafted to make an AI model decide wrongly while it is in use, such as malware shaped to look harmless. Poisoning, by contrast, corrupts the model's learning beforehand.
Evil twin: A rogue access point that copies a real Wi-Fi network's name to lure devices onto it.
Explainability: How well people can see why an AI model gave an output. A 'black box' model can't be checked.
Exposure factor: The percentage of an asset's value lost in a single event, written as a decimal and multiplied by the asset value to get the single loss expectancy (SLE). For example, if thieves take a delivery van holding $8,000 of stock and 75% of it is lost, the exposure factor is 0.75 and the SLE is $6,000.
Expression of interest (EOI): The earliest step in choosing a vendor: finding out who is interested in an upcoming project.
Extended detection and response (XDR): EDR widened beyond endpoints to email, network, cloud and identity.
Extortion: A motive summed up as 'pay us, or we will hurt you': threats to leak data, lock systems or attack.

F

Fail forward: Keeping a change and fixing its problem with a further change, used when going back is impossible or would be worse.
Fail open/fail closed: When a device such as a firewall fails, fail open lets traffic through (favoring availability) and fail closed blocks it (favoring security).
Failover testing: Really switching to the backup site or systems at a planned time.
Federation: A trust between organizations, so one organization's sign-in is accepted by another.
File encryption: Encrypting chosen files or folders. They stay protected while the computer runs and when the files travel.
File system artifacts: Files and folders an attacker leaves behind, such as tools, scripts, and renamed or hidden files.
File Transfer Protocol (FTP): An old, unencrypted file transfer protocol. Use SFTP or FTPS instead.
File Transfer Protocol over TLS (FTPS): FTP protected with TLS encryption.
Fileless malware: Malware that runs in memory using built-in tools such as PowerShell, leaving no program file to scan.
Firewall: A device or software that allows or denies traffic by rules, placed at the borders between zones.
Flagging: Marking an exam question so you can come back to it before you finish. Always answer before you flag, and flag only real doubts.
Full disk encryption: Encrypts a whole drive, protecting a lost or stolen device while it is turned off. The key is often held in a TPM.
Full tunnel vs split tunnel: With a full tunnel, all of a user's traffic goes through the VPN. With a split tunnel, only traffic for the office does.
Functional testing: Testing that a control does what it should.

G

Gap analysis: Comparing where the organization is now with where it needs to be.
General Data Protection Regulation (GDPR): Europe's personal data law. Among other things, it gives organizations 72 hours from becoming aware of a breach to give notice.
Geofencing: A rule based on whether a device is inside or outside a virtual boundary on the map.
Gigabit Interface Converter / Small Form-factor Pluggable (GBIC / SFP): Plug-in network modules for switches and other devices.
Gramm-Leach-Bliley Act (GLBA): A US law protecting financial records.
grep: A command-line tool for searching text, used with regular expressions to pull the lines that matter out of logs.
Group Managed Service Accounts (gMSAs): Windows service accounts shared by a group of servers. The domain changes their passwords automatically.
Group Policy: Central Windows settings pushed to every computer and user in the domain.
Guardrails: Limits that stop automation or AI from doing harm, such as approval gates, dry runs, and caps on how much it changes.
Guideline: Advice about what people should do, as opposed to the 'must' of a policy or standard.

H

Hacktivist: A hacker who is also an activist: they deface sites or leak data for a cause and want attention.
Hallucinations: Confident but false AI output, such as an invented policy or package name. No attacker is involved.
Hard token: A physical device, such as a key fob or security key, used as a sign-in factor.
Hardcoded secrets: Passwords or keys written into code, where anyone who has the code can find them.
Hardening: Making a system harder to attack: remove unneeded software, close ports, change defaults and patch.
Hardware security module (HSM): A dedicated device that guards high-value keys for many systems. A TPM, by contrast, is a chip inside one computer.
Hashing: Turning data into a fixed-size, one-way fingerprint that can't be reversed. It proves integrity and is used to store passwords; a known-bad file hash is also an indicator of compromise.
Health Insurance Portability and Accountability Act (HIPAA): The US law that protects health and care records.
High availability: The design goal of having no single point of failure, so a system is up for a very high share of the time.
HMAC-based one-time password (HOTP): A one-time password generated from a counter using an HMAC (hash-based message authentication code).
Honeyfile: A fake file with a tempting name. Opening it raises an alert.
Honeynet: A network of honeypots that forms a whole fake environment.
Honeypot: A single fake system set up as bait. Any contact with it is suspicious.
Honeytoken: Fake data, such as a record or a key, planted among real data. If it is ever used, data has leaked.
Host-based intrusion detection/prevention system (HIDS/HIPS): Intrusion detection or prevention that runs on one computer, watching its files, processes and logs.
Hypertext Transfer Protocol (HTTP): The plain, unencrypted web protocol. Use HTTPS instead.
Hypertext Transfer Protocol Secure (HTTPS): Web traffic carried over TLS, as on shop.kettleandcrane.com. It uses port 443.

I

Identity proofing: Confirming that a person is who they claim to be before giving them an account.
Identity provider: One service that signs users in to many applications. If it is compromised, every application behind it is open.
Immutability: Backups that can't be changed or deleted until their retention period ends. This makes them the answer to ransomware.
Impact: How much harm a threat would do if it happened. Risk weighs impact together with likelihood.
Impact analysis: Working out on paper what a change affects and what could go wrong, before anyone approves it. Test results then show what actually happens in a test environment.
Impersonation: Pretending to be a specific trusted person or role, such as the help desk, a supplier or a boss.
Implicit deny: The unwritten 'deny' at the end of a firewall rule list that blocks anything no rule allowed. A written 'deny everything else' rule at the bottom makes it explicit.
Impossible travel: Sign-ins from places too far apart for the time between them.
Incident response: The process for handling incidents: preparation, identification, investigation, containment, eradication and recovery, and lessons learned last. Notification isn't a strict step in that order; it often runs alongside containment because legal deadlines count from awareness.
Indicators of compromise: Evidence that a system was attacked, such as a known-bad hash, IP address or domain, or an odd running process.
Infrastructure as Code (IaC): Servers and networks defined in files. Builds are repeatable, but one bad file repeats its mistake everywhere.
Injection: Input that a program treats as a command, as in SQL injection or cross-site scripting. Input validation stops it.
Inline: Placed directly in the path of traffic, so the device can block it, as an IPS is. A device that watches only a copy of the traffic can only alert.
Input validation: Checking input on the server against what is allowed. It stops injection.
Insider: Someone who is or was trusted with access and causes harm, usually on purpose. If the harm was a mistake, the better answer is 'accidental'.
Intelligence cycle: The steps for producing threat intelligence: planning and direction, collection, processing, analysis, dissemination and feedback. Sources include open-source intelligence (OSINT).
Internet of Things (IoT): Networked everyday devices such as cameras, sensors and printers. They often have default passwords and are rarely patched.
Internet Protocol (IP) address: A device's network address, such as Kettle & Crane's web server at 198.51.100.20. A known-bad IP address in logs is an indicator of compromise.
Internet Protocol Address Management (IPAM): The record of which network addresses are in use, so that nothing is left unscanned.
Internet Protocol Flow Information Export (IPFIX): The standard format for flow records showing who talked to whom and how much.
Internet Protocol Security (IPSec): A protocol suite that encrypts network traffic, often used for VPN tunnels.
Intrusion detection system (IDS): Watches a copy of the traffic and raises alerts. Because it isn't inline, it can't block anything.
Intrusion prevention system (IPS): Sits inline in the traffic path and can block attack traffic.
ISO/IEC 27001: An international standard for security management, from ISO and IEC. Organizations can be certified against it by independent audits.

J

Jailbreaking (AI): Tricking an AI model into breaking its own safety rules. Prompt injection is different: it overrides the developer's instructions.
Jailbreaking or rooting (mobile): Removing a phone's built-in restrictions, which weakens its security.
JavaScript: Code that websites run in your browser. A hacked site can run harmful script.
Just-in-time access: A permission granted only when needed, for a short time, then removed.

K

Key escrow: A trusted party holds a copy of a key so that encrypted data can be recovered if the key is lost.
Key exchange: Agreeing a session key over an open network without revealing it, for example with Diffie-Hellman.
Key length: The size of a key in bits; longer is stronger. Compare lengths only within one kind of algorithm.
Key management system (KMS): A service that manages the life cycles of many keys.
Keylogger: Malware that records keystrokes to capture passwords and card numbers.
Known, partially known, and unknown environments: Penetration test types named by how much testers are told before they start: full details, some details such as user-level access, or nothing at all.

L

Large language model (LLM): AI that reads and writes text. It can be attacked through prompts, through its data, and through the tools connected to it.
Layer 4/Layer 7: A layer 4 firewall decides on addresses and ports. A layer 7 firewall reads the application's content.
Learning management system (LMS): Software that assigns training courses and tracks who has completed them.
Least privilege: Each person or program gets only the access its job needs, and no more.
Legacy applications: Old programs the business still needs. They are hard to change or patch, so changes around them need extra careful testing.
Legal hold: An order to keep everything related to a lawsuit or investigation, overriding normal deletion schedules.
Lessons learned: A meeting soon after an incident to decide what to change. It is the last step of incident response.
Lightweight Directory Access Protocol (LDAP): A protocol for querying a directory of users and groups. LDAPS adds TLS.
Likelihood: How probable it is that a threat happens within a period, usually a year.
Living-off-the-land tools: Attackers using tools already built into the operating system, such as PowerShell or certutil, instead of bringing malware, so nothing looks new.
Load balancing: Spreading requests across several servers. A failed server is skipped.
Local Area Network (LAN): The network within one site, such as Kettle & Crane's office.
Log aggregation: Collecting logs from every source into one place.
Log manipulation: Logs that have been deleted, edited or stopped. Gaps in time are the clue.
Logic bomb: Malware that waits for a trigger, such as a date or a name removed from payroll, then does harm.
Logical segmentation: Dividing one network in software, using VLANs, subnets and firewall rules.

M

Macros: Small programs inside Office files. A prompt to 'Enable Content' is the clue that a document may be malicious.
Maintenance window: An agreed, scheduled time when changes may be made, chosen to disturb the fewest people.
Malicious update: Harmful code delivered through a trusted update channel.
Managed service providers: Companies that run IT for many customers. One breach of the provider can reach all of them.
Mandatory access control (MAC): An access model in which the system decides by labels and clearances, and users can't change it.
Masking: Hiding part of a value when it is displayed, such as showing a card number as ****1234. Tokenization replaces the stored value instead.
Master services agreement (MSA): The general terms for all future work between two companies. Each specific job then gets its own statement of work.
Mean time between failures (MTBF): The average working time between failures. Higher is more reliable.
Mean time to repair (MTTR): The average time it takes to fix a failed system.
Memorandum of agreement (MOA): A more detailed, formal agreement setting out each side's duties.
Memorandum of understanding (MOU): A statement of shared intent between parties, usually not legally binding.
Memory dump: A copy of a computer's memory, including processes, keys and fileless malware. Capture it first, because it vanishes at power-off.
Message Digest 5 (MD5): An old hashing algorithm that is broken for security use.
Metadata: Data about data, such as email headers, file owners and times, and photo locations.
Microservices: An application built from small services that talk over the network. Failures stay small, but the connections multiply.
Misconfiguration: A wrong setting rather than a bug in the code, such as a default password, an open port or public sharing.
MITRE ATT&CK: A public knowledge base cataloging attacker tactics and techniques.
Mobile device management (MDM): Central control of phones and tablets: locking, encryption, app rules and remote wipe.
Model manipulation: Changing an AI model itself, or its settings, directly.
Multicloud: Using two or more public cloud providers at once, so one provider's outage isn't fatal. The cost is more settings to secure.
Multifactor authentication (MFA): Signing in with two or more kinds of factor, such as a password plus a token or a biometric.
Multifactor authentication (MFA) bypass: Getting past the second factor, for example by push fatigue, stolen session tokens or real-time phishing.

N

National Institute of Standards and Technology (NIST): A US standards body. Its password guidance says to favor length, not to require complexity rules, and to force changes only when there is evidence of compromise.
National Vulnerability Database (NVD): A database of CVE entries with their severity scores.
Near miss: A wrong exam option that is real and close to the answer, such as a control that meets a different goal or a rule with source and destination swapped.
Near-field communication (NFC): Radio with a range of about 4 cm (1.5 in), used to tap to pay or badge in. Cloning a card needs the attacker to get very close.
NetFlow: Flow records showing who talked to whom, when and how much, without the content. A packet capture holds the content too.
Network Interface Card (NIC): The hardware that connects a device to a network.
Network-based intrusion detection/prevention system (NIDS/NIPS): Intrusion detection or prevention that watches network traffic. NIDS alerts from a copy of the traffic; NIPS sits inline and blocks.
Non-disclosure agreement (NDA): A promise to keep shared information secret.
Non-repudiation: Proof strong enough that someone can't deny an action, such as a digital signature on a café's order.

O

Obfuscation: The umbrella term for making data or code hard to understand without using a key, for example by masking, tokenization or code obfuscation. On its own it is weak, and it is not encryption.
Objectives (exam): The 27 numbered topics of SY0-801, from 1.1 to 5.6. The opening verb of each sets the depth expected; 'Given a scenario' means you must apply it.
Obsolete systems: Old technology that better designs have replaced. It is often unsupported as well.
On-path attack: The attacker sits between two systems and can read or change everything that passes. Sniffing, by contrast, only listens.
On-premises infrastructure: You own and run everything in your own building, so every security job is yours.
One-time password (OTP): A code that is good for only one sign-in, either time-based (TOTP) or counter-based (HOTP).
Online Certificate Status Protocol (OCSP): Asks about one certificate in real time and gets back good, revoked or unknown. With stapling, the server attaches the answer itself.
Open authorization (OAuth): Lets an app act for a user with a limited token, such as reading your calendar without your password. On its own it handles authorization, not sign-in.
Open source vs proprietary: Proprietary code is secret and comes with vendor support; open source code is public, so anyone can review it. Neither is secure by default.
OpenID Connect (OIDC): Adds sign-in (an ID token) on top of OAuth, as in 'Sign in with Google'.
Operational security: Not revealing useful details, such as travel plans, systems or schedules, in public or online.
Operational technology (OT): Systems that control physical things, such as Kettle & Crane's roasters or pumps. Safety comes first, they last a long time, and they are hard to patch.
Opt-in or opt-out: With opt-in, permission is asked first. With opt-out, use is allowed until the person says no.
Orchestration: Connecting security tools so they act together in order, as SOAR does.
Out-of-band management: Managing devices over a separate network or console line, which still works when the main network is down.

P

Packet analyzer: A tool that captures and decodes network packets. Wireshark and tcpdump are popular examples.
Packet capture: A full copy of network traffic, including its content. It gives the most detail and needs the most storage.
Parallel processing: A recovery test in which recovery systems run real work alongside production and the results are compared.
Partition encryption: Encrypting one fixed section of a disk.
Passkey: A key pair stored on a device or synced between devices, used to sign in instead of a password. It resists phishing and there is nothing to remember.
Password manager: A vault that creates, stores and fills a unique strong password for every site. Its master password and autofill are targets for attackers.
Password spraying: Trying one or a few common passwords against many accounts, such as hundreds of failed logins on an online shop, each for a different user but all with the same password.
Passwordless: Signing in with a device, a biometric or a passkey instead of a password.
Payment Card Industry Data Security Standard (PCI DSS): The industry standard for protecting payment card data, followed by organizations that handle card payments.
Penetration testing: An authorized simulated attack to find weaknesses. Its report can show attack chains a scanner can't.
Performance-based question (PBQ): An exam question in which you do a task in a simulation, such as editing a firewall rule table. It may give partial credit and can be skipped, reset and revisited.
Personnel behavior risk scoring: A risk score for each person based on their security behavior, used to target training.
Phishing: Email lures, such as links, attachments, fake login pages and payment requests, sent to trick people.
Physical segmentation: Separate switches and cables for each network segment. It is stronger than logical segmentation but costs more.
Playbook: A step-by-step guide for handling one kind of incident.
Poisoning: Putting bad data into what an AI model learns from, so it learns the wrong lessons before it is used.
Policy: A management document that says what must be done and why, such as an acceptable use or incident response policy. Standards set the exact rules, and guidelines only advise.
Port mirroring: A switch copies traffic to one port, where a monitoring tool such as an IDS listens.
Portable Document Format (PDF): A document format that can hold links, scripts and embedded files. Fake PDF invoices are a common lure.
Post-incident reporting (PIR): The formal written report on an incident.
PowerShell: Windows' built-in scripting tool, which attackers abuse for fileless and living-off-the-land attacks.
Predictive analysis: AI that forecasts what is likely to happen next from past data, such as which flaw will be exploited.
Preservation: Protecting evidence from change from the moment an incident is found: copy it first, then work on the copy.
Preventive control: A control that stops an incident before it happens, such as a locked door or a firewall deny rule.
Private key: The half of a key pair that only the owner holds. It decrypts what was sent to you and creates your signatures.
Privilege creep: Access rights that pile up as people change jobs. Access reviews fix it.
Privilege escalation: Gaining more rights than allowed, either vertically (to admin) or horizontally (to another user's data).
Privileged account: An account with admin rights, either across the whole environment (global) or on one computer only (local).
Processing restriction: Keeping someone's data but stopping its use for now, or stopping it for one purpose, such as marketing.
Prompt injection: Instructions hidden in input that an AI model obeys instead of its developer's, as when a chatbot is told to ignore its instructions.
Protocol downgrade: An attack that forces a connection to use an older, weaker version of a protocol, such as old TLS.
Provisioning and deprovisioning: Giving people the right access on day one and disabling it promptly when they leave, often automatically from the HR system.
Proxy: One server that makes web requests on everyone's behalf and filters them.
Public key: The half of a key pair you share. Others use it to encrypt messages to you and to check your signatures.
Public key infrastructure (PKI): The system of key pairs, certificates and CAs that lets people trust public keys through a chain up to a root.
Public object storage: Cloud storage buckets left readable by anyone on the internet.
Public repositories: Publicly shared code, which may leak secrets, and public packages, which may be poisoned.

Q

Qualifier: The word in an exam question, such as 'best', 'first', 'most likely' or 'least', that sets the rule for choosing an answer.
Qualitative vs quantitative: Qualitative risk analysis rates risk in words such as high or low; quantitative analysis uses numbers in dollars.
Quick Response (QR) code: A square code that hides a web address. A sticker placed over a real code can send phones to a fake site.

R

Race condition (TOC/TOU): A program checks something, such as a balance, at time-of-check, and acts on it later at time-of-use. An attacker changes things in the gap between the two.
Radio frequency (RF): Radio in general, including Wi-Fi, remotes and wireless keyboards. It can be jammed or listened to.
Ransomware: Malware that encrypts files and demands payment, often stealing data first. A ransom note is the clue.
Rate limiting: Capping the number of requests each client can make per period.
RC4: An old, broken cipher that should never be used.
Reconnaissance (passive and active): Gathering information about a target. Passive reconnaissance doesn't touch the target (public records, search engines); active reconnaissance probes it directly, for example by scanning ports.
Recovery point objective (RPO): How much data, measured in time, you can afford to lose, such as at most one hour of shop orders. It sets how often you back up.
Recovery time objective (RTO): The longest a system may take to be restored, which is how long it may be down.
Red, blue and purple teams: A red team plays the attacker (offensive), a blue team defends (detection and response), and a purple team has both working together openly.
Redundant array of independent disks (RAID): A set of disks that keeps working when one disk fails. It is not a backup: it doesn't survive deletion or ransomware.
Redundant power supply (RPS): A second power supply inside or beside a device.
Reference architecture: A tested template design to build from.
Regular expressions: Search patterns used to filter and find lines in logs.
Remediation: Fixing a vulnerability by patching or reconfiguring. Otherwise you reduce, transfer or accept the risk. Verification by rescanning closes it.
Remote Desktop Protocol (RDP): A protocol for controlling a computer's screen remotely, on port 3389. Never expose it to the internet.
Replay attack: Capturing a valid message, credential or token and sending it again later, for example to sign in without knowing the password.
Replication: Copying data to another place as it changes. Like RAID, it is not a backup.
Request for comments (RFC): Numbered technical documents about the internet. Many become the standards that protocols follow.
Request for information (RFI): Asks vendors to describe what they offer. It is for learning, not buying.
Request for proposal (RFP): Asks vendors for a full offer to solve a stated problem.
Request for quote (RFQ): Asks vendors only for a price for something already exactly specified.
Residual risk: The risk left over after treatment.
Resilience: The ability to keep working through a failure and recover quickly. It is what produces availability.
Responsible disclosure: A policy for how outsiders may report a flaw privately, including a promise not to sue good-faith reporters.
Restoration testing: Actually restoring backups on a schedule, because an untested backup may not work.
Rich Communication Services (RCS): The richer upgrade to SMS. It carries the same lures, now with images and files.
Rich Text Format (RTF): An old text format with formatting codes. It can embed objects that exploit the program reading it.
Right to audit: A contract clause that lets you audit the vendor yourself.
Right to be forgotten: A person's right to ask for their personal data to be deleted.
Risk: The chance of harm, judged by weighing how likely a threat is (likelihood) against how much harm it would do (impact).
Risk appetite: How much risk, and what kind, the organization is willing to accept.
Risk register: The document listing each risk with its score, owner and treatment. It is shared with each audience and reviewed to keep it current.
Risk treatment: The four ways to handle a risk: transfer its cost (for example Kettle & Crane buying cyber insurance), accept it with sign-off, avoid it by stopping the activity, or mitigate it with controls.
Rivest-Shamir-Adleman (RSA): A widely used asymmetric algorithm, named after its inventors. It needs longer keys than ECC for the same strength.
Rogue devices: Any device connected without approval, such as a personal access point. Shadow IT is the software and cloud equivalent.
Role-based access control (RBAC): An access model in which permissions are given to roles, and people are given roles.
Root cause analysis: Finding the deepest reason an incident happened.
Root of trust: The starting point that is trusted by default, such as a root CA in the trust store or a security chip.
Rootkit: Malware that hides itself and other malware by changing the operating system or what runs beneath it.
Rule-based access control: An access model in which the system applies rules an administrator wrote, such as firewall rules.
Rule-based firewall: A firewall that reads its ordered rule list from the top, where the first matching rule wins and an implicit deny ends the list.
Rules of engagement: Written rules for a security test, setting out its scope, times, methods and limits.
Runbook: Technical steps for one operational situation, often automated. An SOP, by contrast, covers a routine task.

S

Salting: Adding a random value per user before hashing, so that equal passwords get different hashes.
Sanctions: Official penalties from a government or regulator for non-compliance, such as bans and restrictions.
Sandboxing: Running something untrusted in isolation so that any harm stays inside.
Scalability: Handling more work by adding resources, either bigger machines (vertical) or more machines (horizontal).
Scaled score: The exam result, on a scale of 100 to 900, with a pass at 750. It is not a percentage, so 750 does not mean 75% correct.
Screened subnet: A zone between the internet and the internal network, with a firewall at each border, where public servers such as Kettle & Crane's web shop go.
Secrets scanning: Searching code and its history for passwords and keys. Anything it finds should be revoked.
Secure cookies: Cookie flags that protect a session: Secure (sent only over HTTPS), HttpOnly (no script access) and SameSite.
Secure enclave: An isolated part of a processor that keeps keys and data safe.
Secure Hash Algorithm (SHA): A family of hashing algorithms. Use SHA-256 or SHA-3; SHA-1 is broken for security use.
Secure Shell (SSH): An encrypted protocol for remote command-line access. Use it instead of Telnet.
Secure Sockets Layer (SSL): The broken ancestor of TLS. Never use it.
Security Assertion Markup Language (SAML): An XML-based single sign-on protocol in which the identity provider sends a signed assertion to a web application, mostly for enterprise web SSO.
Security Content Automation Protocol (SCAP): Standard formats that let tools check settings and flaws automatically.
Security information and event management (SIEM): A system that collects and correlates logs from everywhere, then alerts and reports.
Security Operations Center (SOC): The team that watches for and responds to security events.
Security orchestration, automation, and response (SOAR): A tool that runs response steps automatically across connected tools. A SIEM correlates and alerts; SOAR acts.
Security Service Edge (SSE): Cloud-delivered security for users anywhere: a web gateway, a CASB and Zero Trust network access.
Security zones: Groups of systems with the same trust level, such as internet, screened subnet, internal, guest and management.
Security-enhanced Linux (SELinux): Mandatory access control for Linux, in which labels limit what each process may touch.
Self-signed certificate: A certificate signed by its own key, so nobody vouches for it. Fine for tests, but not for a public site.
Sender Policy Framework (SPF): A DNS record listing which mail servers may send email for a domain such as kettleandcrane.com.
Server-side request forgery (SSRF): A forgery attack that tricks a server into sending a request the attacker chose, often to internal systems the attacker can't reach directly.
Serverless: A cloud model in which the provider runs every server. You still secure the code, permissions and data.
Service account: An account used by a program rather than a person. It gets least privilege and no interactive sign-in.
Service restart: Stopping and starting a background program so that a change takes effect. It causes a short outage.
Service-level agreement (SLA): The service level a provider promises, with remedies if it misses.
Service-level objective (SLO): One measurable target inside an SLA, such as 99.9% uptime.
Session hijacking: Stealing a user's session with a service, such as an AI tool, in order to act as that user.
Session keys: The symmetric keys that encrypt one connection. Weak or stolen session keys expose the traffic.
Session tokens: The value that says 'already signed in'. If stolen, it skips both the password and the multifactor check.
Shadow IT: Technology staff use for work without the IT team knowing, often a cloud service.
Short Message Service (SMS): Plain text messages on the carrier network, often used for fake delivery and bank texts.
Shoulder surfing: Watching someone type a password or read data.
Sideloading: Installing apps on a phone from outside the official store.
Simple Network Management Protocol (SNMP): Polls network devices for status and receives traps from them. Use version 3, which encrypts.
Simulation (exam question): The kind of PBQ Security+ uses: a limited copy of a real tool, such as a firewall rule table or log viewer. It has a reset button and judges your end state.
Simulation (exercise): A realistic hands-on rehearsal of recovery or incident response in which people act but production isn't switched over.
Single loss expectancy (SLE): The dollars lost each time an event happens: asset value × exposure factor, such as $8,000 × 0.75 = $6,000 for a van theft.
Single point of failure: One part whose failure stops the whole system. High availability designs remove them, and automation can become one.
Single sign-on (SSO): One sign-in that gives access to many services. Federation extends that trust to another organization's sign-in.
Skimming: A device fitted to a real card reader copies card data.
Smishing: Phishing by text message.
Snapshot: A point-in-time copy of a virtual machine or volume.
Sniffing: Capturing network traffic to read it. Plaintext protocols give away passwords this way.
SOC 2 Type I and Type II: Formal reports on a company's controls by independent accountants. Type I covers design at one point in time; Type II covers design and operation over a period, such as six months.
Soft token: An authenticator app on a phone, used as a sign-in factor.
Software as a service (SaaS): Cloud applications that hold your data. A breach at the provider, or a weak account, exposes it.
Spear phishing: Phishing aimed at one chosen person or small group, using personal details.
Spoofing: Faking an identity, such as an address, an email sender or a caller ID.
Spyware: Malware that secretly watches the user and reports back.
SSH File Transfer Protocol (SFTP): Secure file transfer carried over SSH.
Stakeholders: Everyone a change or risk decision affects. Consult them before approval.
Standard: Specific, measurable rules that must be followed, such as minimum password length. A policy says what and why; a guideline only advises.
Standard operating procedure (SOP): Step-by-step instructions for a routine task.
State-sponsored: An attacker working for a government, with the most skill and money.
Statement of work (SOW): Describes one specific job: its tasks, deliverables, dates and price.
Static code analysis: Checking source code for weaknesses without running it.
Structured and unstructured data: Structured data has fixed fields, like a database table. Unstructured data is free-form, such as email, documents, images and chat.
Structured Query Language (SQL) injection: Input such as ' OR 1=1 that a database runs as part of its query. Input validation stops it.
Subject Alternative Name (SAN): The certificate field that lists every name the certificate covers, exact or wildcard.
Surge protector: A device that blocks short voltage spikes.
SY0-701: The older Security+ exam. It has the same format but different objectives, and as of November 2026 it retires in English on June 11, 2027.
SY0-801: The current CompTIA Security+ exam (version 8): up to 90 questions in 90 minutes, with a pass at 750 on a scale of 100 to 900. It is the exam Alex books.
Symmetric encryption: Encryption where one shared key both encrypts and decrypts. It is fast for bulk data, but sharing the key is hard.
syslog: The standard way to send event messages to a central collector, each with a severity from 0 (emergency) to 7 (debug).

T

Tabletop exercise: A discussion of a made-up incident around a table, where nothing is touched.
Tailgating: Following an authorized person through a secured door.
Telnet: An old, unencrypted remote command-line protocol. Use SSH instead.
Terrorist: An attacker who aims to cause fear or harm for a political, religious or ideological cause. A hacktivist, by contrast, mainly wants attention.
Third-party certificate: A certificate signed by a CA that browsers already trust. It is the right choice for a public website like shop.kettleandcrane.com.
Threat actor: The person or group behind an attack, such as an unskilled attacker, hacktivist, insider, organized crime or a state. Exam questions identify them by what they want and what they have.
Threat feeds: Streams of checked threat data, such as bad addresses and file hashes, for defenders' tools.
Threat hunting: Proactively searching for attackers who haven't triggered any alert.
Threat vector: The path an attacker uses to get in, such as email, a QR code, a USB stick or a supplier.
Time-based access control: Allowing access only at certain hours or on certain days, or until a set date.
Time-based one-time password (TOTP): A one-time password that changes with the clock, as in an authenticator app.
Tokenization: Swapping a value, such as a card number, for a random token, while the real value sits in a separate vault.
Transport Layer Security (TLS): The protocol that encrypts data in transit, for example for HTTPS. Use version 1.2 or 1.3.
Triple DES (3DES): An outdated cipher that applies DES three times. Don't use it.
Trojan: Malware disguised as something wanted, so the user installs it willingly. It doesn't copy itself.
Trusted Platform Module (TPM): A security chip in one computer that can hold its disk encryption key. An HSM, by contrast, is a dedicated device serving many systems.

U

UEFI: The modern start-up firmware that replaced BIOS. Its Secure Boot feature helps ensure only trusted code starts.
Unified threat management (UTM): Many security tools in one box: firewall, intrusion prevention, filtering and antivirus.
Uninterruptible power supply (UPS): Batteries that bridge short power outages and allow a clean shutdown, covering the seconds until a generator starts.
Universal Serial Bus (USB): The common plug for sticks and cables. Malicious USB devices include dropped sticks and devices that pose as keyboards and type commands.
Unmanaged systems: Devices IT doesn't control: not in the inventory, not updated, not watched. Stale credentials are the account equivalent, such as a former employee's login nobody tracks.
Unpatched systems: Systems where a fix exists but nobody installed it. This is the most common vulnerability.
Unsafe exception handling: Errors that reveal a program's internals or leave it unsafe, for example by failing open.
Unskilled attacker: Someone who uses tools others wrote without understanding them; the old 'script kiddie'.
Unsupported products: Products whose maker no longer sends fixes, so new flaws stay open forever.
User enumeration: Finding valid usernames from differences in error messages or responses.

V

Vendor lock-in: When leaving a vendor becomes so hard or costly that you are stuck with it.
Verification: Rescanning and testing to prove a fix worked and broke nothing. It closes remediation.
Version control: Records every change to code or configuration (who, when, why), so you can roll back.
Virtual local area network (VLAN): A separate network created in software on shared switches, used for logical segmentation.
Virtual machine (VM) escape: Breaking out of a virtual machine (the guest) into its host. VM sprawl is the related risk of forgotten VMs.
Virtual Network Computing (VNC): Cross-platform screen sharing, often set up with weak passwords and no encryption by default.
Virtual private network (VPN): An encrypted tunnel into a network. Site-to-site joins offices; remote access joins one user, such as someone working from home.
Virus: Malware that attaches to a host file and spreads when a person runs that file.
Vishing: Phishing by voice call or voicemail.
Volume encryption: Encrypting one mounted drive, such as a USB stick or a data drive.
Vulnerability: A weakness a threat can use, such as a software flaw, misconfiguration, missing patch or weak credentials. A threat is whatever could cause the harm.
Vulnerability scanner: A tool that discovers devices, ports, services and known flaws.

W

Warm site: A recovery site with some equipment and connectivity ready, but the data must be loaded. It takes hours to days.
Watering hole: The attacker infects a website the targets already visit, then waits for them.
Web application firewall (WAF): A layer 7 firewall in front of web applications such as Kettle & Crane's shop. It blocks injection and cross-site scripting.
Whaling: Phishing aimed at a senior executive.
Wildcard certificate: A certificate for a name like *.kettleandcrane.com. It covers every name one level below the domain, but not the bare domain or deeper names.
Wireless intrusion prevention system (WIPS): A system that finds and blocks rogue access points and evil twins.
Worm: Malware that spreads by itself across the network through a weak service, with no user action.

Z

Zero Trust: 'Never trust, always verify': every request is checked, wherever it comes from, using user identity, device health and per-application access.
Zero-day: A flaw with no fix yet. Patching can't help, so other layers of defense must.