Security+ Exam Prep 2: Performance-Based Questions

Glossary

293 terms from Security+ Exam Prep 2: Performance-Based Questions, in plain words, each with the chapter that teaches it.

Search the glossary

#

-all: The ending of an SPF record that tells receiving servers to fail mail from any server the record does not list. It is stricter than ~all (softfail), and Practice 9 uses it to make every unlisted server fail.
-attime: An option to `openssl verify` that checks a certificate as if the current date were a chosen moment, given in seconds since 1970. It is used to test whether a certificate will still be valid in the future, for example showing that a 199-day web certificate will have expired 200 days from now.
-CAfile: An option to openssl verify that names the root certificate to trust when checking a chain.
-untrusted: An option to openssl verify that supplies the intermediate certificate the server should send. Adding it makes error 20 go away, which shows the chain was incomplete.
/24 (address range): A way of writing a whole block of IP addresses: /24 means every address that shares the first three numbers, such as 203.0.113.0 to 203.0.113.255. Firewall rules use it to match a whole network, such as the attack network or the cafés' range.
/etc/passwd: The Linux file that lists the system's user accounts. Directory traversal attacks in the shop's web log try to reach it.

A

ABAC (attribute-based access control): An access control model that grants or denies access based on attributes of the user, the resource and the situation, such as department, data label or time of day. It is an older Security+ exam term that does not appear in the SY0-801 objectives.
accept (risk treatment): Choosing on purpose to live with a risk, and recording the decision with an owner and a review date. Kettle & Crane accepts the risk from the old label printers because its score is within the risk appetite.
access review: A regular check of every account and its rights, so that leavers, shared accounts and excess rights can be fixed.
account lockout: Disabling an account for a while after too many wrong passwords. Sam's account was locked after five failures in the SSH log.
ACL (access control list): An ordered list of allow and deny rules on a router, switch or firewall. The rules are read from the top, and the first one that matches decides.
adware: Malware that pushes unwanted advertising. It is one of the unused choices in Practice 4.
ALE (annualized loss expectancy): The expected cost of a risk in an average year: SLE × ARO. For ransomware on the file server it is $24,000 × 0.25 = $6,000.
alignment: The DMARC check that the visible From domain matches a domain that passed SPF or DKIM. The spoofed café email failed it because SPF passed only for kc-invoices.example.
allow list: A list of things that are explicitly permitted. The payment plugin update might need a new entry on it.
always-on VPN: A VPN setting that connects the laptop automatically before the user can browse, so Sam never uses the hotel Wi-Fi unprotected.
API (application programming interface): A way for programs to talk to each other. The shop's payment API depends on the plugin, and the café ordering API takes orders from cafés.
application layer (layer 7): The top layer of the network model, where applications such as websites work. Attacks on web forms, such as injection, happen at this layer and are stopped by a WAF.
ARO (annualized rate of occurrence): How many times a year a risk is expected to happen. Once in N years is 1 ÷ N, so a flood once in 50 years has an ARO of 0.02.
ARP (Address Resolution Protocol): The protocol that maps IP addresses to MAC addresses on a local network. An ARP table where the gateway and a staff PC share one MAC address points to ARP spoofing.
ARP spoofing: Sending fake ARP messages that tie the attacker's MAC address to another device's IP address, such as the gateway's, so that device's traffic flows through the attacker. It is used for an on-path attack.
asynchronous replication: Copying data to another system every few minutes, slightly behind the live data. Replicating every 5 minutes meets the shop database's 15-minute RPO.
attack surface: Everything an attacker could try to reach. Every open port adds to it, which is why the unneeded RDP rule is deleted.
authentication log: The record of which accounts signed in, when, and from which address. It answers who signed in to the order server.
AV (asset value): What an asset is worth in money. It is the starting point of the SLE calculation.
availability: The share of time a system is working, calculated as MTBF ÷ (MTBF + MTTR). The order server's availability is about 99.78%.
avoid (risk treatment): Removing a risk by stopping the activity that creates it. Kettle & Crane avoids card theft by no longer taking cards for café billing.

B

backout plan: The written plan for returning to the old version if a change fails. It has a trigger and a decide-by time, and it must be ready before the CAB approves the change.
beaconing: Malware contacting its command server on a fixed timer. The infected PCs connect to update-kc.example every 60 seconds.
BEC (business email compromise): Fraud by email that tricks staff into paying money, such as fake invoices asking Sam's team to change a café's bank details.
BIMI (Brand Indicators for Message Identification): An email standard that shows the sender's logo in the inbox, but only for a domain whose DMARC policy is set to quarantine or reject.
brute force: Trying many passwords against one account. The attack on Sam's account from 203.0.113.66 was brute force, and it triggered the lockout.

C

CA (certificate authority): An organization or system that issues and signs certificates. Browsers trust public CAs, while an internal CA is trusted only where its root is installed.
CAB (change advisory board): The group that reviews a complete change request, including its test results and backout plan, and approves the change before it is made.
cache poisoning: Planting a false answer in a DNS resolver's cache, so that shop.kettleandcrane.com points to the attacker's address.
certificate chain: A site's certificate together with the intermediate certificates that link it to a trusted root. If the server does not send the full chain, checks fail with error 20.
chain of custody: A form that records who handled each piece of evidence and when, so it can be trusted later. Alex logs the memory and disk images on it.
CISA (Cybersecurity and Infrastructure Security Agency): The US government agency that publishes the KEV catalog of flaws attackers are using now.
click rate: The share of staff who clicked the link in a phishing test. At Kettle & Crane it fell from 36% to 14%, which shows fewer staff were fooled.
cloud metadata service: An internal cloud address (169.254.169.254) that gives out details about a server. SSRF attacks try to make the server request it.
command server: The attacker's server that infected hosts contact for instructions, such as update-kc.example.
community string: The shared password used by SNMP versions 1 and 2c. It is sent in plaintext, which is why SNMPv3 replaces them.
compensating control: A control that stands in for one that can't be used. Isolating and monitoring the unpatched card terminal makes up for the missing patch.
concurrent sessions: One account signed in from two devices at the same moment. Priya's account shows it, and it is an indicator of compromise.
confidential: A data class for data whose leak would seriously harm the business. Each person needs the data owner's approval to see it.
containment: The incident response step that stops an incident from spreading, for example by cutting the infected file server off from the network without powering it off.
control category: Who or what makes a control happen: technical, managerial, operational or physical.
control type: What a control does, and when: preventive, deterring, detective, corrective, compensating or directive.
corrective control: A control that repairs damage after it happens, such as rolling the file server back to a snapshot after ransomware.
CPU (central processing unit): The computer's processor. High CPU use counts as an indicator only when nothing normal, such as the nightly backup on BACKUP-SRV, explains it.
credentialed scan: A vulnerability scan that signs in to each host, so it sees more and reports fewer false findings. One showed that the web server flaw reported on Jo's PC was a false positive.
critical (data class): A data class for data the business can't run without if it is lost or wrong. It is about availability, not secrecy, and the order database is an example.
CRL (certificate revocation list): A list published by a CA of certificates it has revoked, for example after a key is stolen. Browsers must download the whole list before using it.
CSR (certificate signing request): A request for a certificate, made on the server that will use it and listing the names it must cover. The wholesale portal needs one.
CSRF (cross-site request forgery): Making a signed-in user's browser send a request from another site, such as the coupon site changing a customer's email address.
CVSS (Common Vulnerability Scoring System): A standard way to score how severe a security flaw is, from 0.0 to 10.0, where 9.0 and above counts as critical. The score alone should not set priority: active exploitation (such as a listing in CISA's KEV catalog) and internet exposure can put a lower-scored finding first.

D

data classification: Giving each data set a class by how bad a leak would be and who may see it. Kettle & Crane's ladder is public, sensitive, confidential and restricted, plus critical for data the business can't run without.
data owner: The person accountable for a set of data, who approves who may see confidential data.
DDoS (distributed denial of service): Overwhelming a service with requests from many sources at once, such as 40,000 requests per second to the shop from thousands of addresses.
deepfake: A voice or video faked with AI to impersonate someone.
deidentification: Removing details from data so that no person can be identified. The university's research export of sales data is protected this way.
deprovisioning: Removing a person's access when they leave. Ben's account, still enabled after Ben left, is a deprovisioning failure, so it is disabled at once.
detective control: A control that finds problems, such as a SIEM alert or Alex reviewing the VPN sign-in report.
deterring control: A control that discourages an attacker but can't stop one, such as floodlights or a warning sign.
device certificate: A certificate installed on a laptop that proves to the VPN which device is connecting. Together with MFA, it means a stolen password alone isn't enough.
differential backup: A backup of every change since the last full backup. A restore needs only the full backup and the latest differential.
digital certificate: A file signed by a CA that ties a public key to a name, such as shop.kettleandcrane.com, so browsers can trust the site. It has an end date and lists the names it covers.
digital signature: A cryptographic proof of who made something and that it wasn't changed, such as proving the price list came from Jo unaltered.
directive control: A control that tells people what to do, such as a policy requiring MFA or a sign saying visitors must wear badges.
directory traversal: Using ../ in a request to climb out of a web folder and read other files, such as /etc/passwd. It worked on line 4 of the shop's log.
discretionary access control: An access model where the owner decides who gets access, as when Jo chooses who may open the supplier spreadsheet Jo created.
DKIM (DomainKeys Identified Mail): An email standard that signs each message, with the public key published in the signer's DNS, to prove the message wasn't changed.
DLP (data loss prevention): Software that spots and stops sensitive data leaving, such as an email that contains card numbers.
DMARC (Domain-based Message Authentication, Reporting, and Conformance): An email standard that requires the visible From domain to align with a domain that passed SPF or DKIM, and sets what happens to failures: p=none only reports, p=quarantine sends them to spam, and p=reject refuses them.
DNS (Domain Name System): The system that turns names such as shop.kettleandcrane.com into IP addresses. It also holds a domain's email records.
DNS filter: A control that blocks lookups of known bad domains. It blocked LABEL-PC's lookup of update-kc.example.
DNS over HTTPS: Encrypting DNS lookups so others can't see which names a laptop looks up; DNS over HTTPS uses port 443, and DNS over TLS is a similar option. It provides privacy, which DNSSEC doesn't.
DNSSEC (DNS Security Extensions): Signing DNS answers so they can't be forged. It protects integrity but hides nothing.
domain administrator: An account with full control of the whole Windows domain. The playbook and the backup service account should never have it, because that breaks least privilege.
DoS (denial of service): Making a service unavailable by overloading it from a single source.

E

EDR (endpoint detection and response): Software on each computer that records processes and file changes, raises alerts, and can isolate a laptop.
EF (exposure factor): The share of an asset's value lost in one event, written as a percentage. Ransomware on the file server has an EF of 40%.
emergency access account: An account kept for when normal sign-in fails. It should stay unused, guarded and monitored, with an alert on any use, so it is never disabled just for being unused.
emergency change: A change made urgently through a faster approval path, such as patching the VPN gateway flaw attackers are exploiting.
encryption: Scrambling data so that only someone with the key can read it back. It fits the payroll file Morgan must read again, but not passwords, which should never be read back.
end of support: When a vendor stops issuing fixes for a product, as with the warehouse PC's operating system.
endpoint log: The record from the EDR agent of the processes that ran on a computer and the files they changed.
enrichment: The playbook step that pulls out the sender, links and attachment hash, and looks up their reputation before anything is decided.
envelope sender: The hidden sender address used in mail delivery, which SPF checks. It is different from the visible From address.
eradication and recovery: The incident response step that removes the malware and its persistence, resets passwords and restores from a clean backup.
evil twin: A rogue access point that copies a real network's name, such as a second KC-Staff network.
exception: A documented, time-limited approval to leave a flaw unfixed, signed by someone senior and backed by compensating controls such as segmentation.
explicit deny: A deny rule written out at the bottom of a rule table. It does what the implicit deny does, but it is visible and its matches can be logged.

F

fail forward: Fixing a failed change in place instead of rolling it back. It is chosen only when going back is impossible or riskier.
false positive: A finding that reports a problem that isn't really there, such as a web server flaw on Jo's PC, which has no web server. Confirm it by hand, then close it.
fileless malware: Malware that runs in memory through built-in admin tools and saves nothing new to disk.
filtering (data): Sending only the fields a receiver needs, such as names and addresses for the shipping partner, without prices or emails.
firewall: A device that allows or denies traffic between networks using an ordered rule table, matching on address, port and protocol. It usually sits at the network edge.
first match: The firewall rule that decides a packet is the first one from the top that matches it, so specific rules must sit above general ones.
forced entry: Breaking in physically. A bent door frame and broken lock on the server closet are its signs.
FTP (File Transfer Protocol): An old file transfer protocol that sends data unencrypted. SFTP replaces it.
full backup: A complete copy of all the data. Every restore starts from the most recent full backup, such as the one taken on Sunday.
full tunnel: A VPN mode that sends all traffic through the company, so all of Sam's browsing passes the web filter.
fwcheck.py: A short Python practice script that tests sample packets against a firewall rule table, reading the rules from the top so the first match decides, the way a real firewall does. Alex uses it to confirm that needed traffic for Kettle & Crane's wholesale portal is allowed and unwanted traffic is denied.

G

gateway: The router that sends a local network's traffic to other networks. ARP spoofing makes a PC pretend to be the gateway.
gMSA (Group Managed Service Account): A Windows service account whose password Windows changes automatically. It fixes backupsvc's password that never changes.
guardrail: A limit that keeps an automated action safe, such as isolating at most one laptop without Alex's approval.

H

handshake: The opening exchange in which a client and server agree how to secure a connection, including the TLS version. Cutting it off can force a downgrade.
hash: A one-way fingerprint of data that can be compared but never turned back into the data. The same malware hash on several hosts shows the same file, and hashing evidence proves it hasn't changed.
hosted checkout: A payment page where a provider stores the cards while the shop still takes payments. Courses call it either avoid or transfer.
hot site: A recovery site that is fully equipped and ready, able to take over in minutes to a few hours.
HSM (hardware security module): A separate, dedicated device that guards keys for many systems.
HTTP status codes: The number a web server returns for each request: 200 OK (it succeeded), 401 Unauthorized (sign-in failed or missing), 403 Forbidden (refused) and 404 Not Found (no such page or user). With the response size, the code shows whether an attack in a log worked.
HTTPS: Web traffic secured with TLS, on TCP port 443.

I

identity provider: The service that signs users in and keeps the sign-in report used in Task 7.
IDS (intrusion detection system): A passive sensor that watches a copy of traffic and alerts on attacks but can't block them, usually placed on a mirror port.
immutable backup: Backups that can't be changed or deleted, kept offline, so ransomware can't destroy them.
impact analysis: Working out what a change touches, which stakeholders to tell, and its technical implications, such as downtime and dependencies.
implicit deny: A firewall's built-in rule at the bottom that denies anything no other rule matched.
impossible travel: Two sign-ins close in time but too far apart for anyone to travel between, such as Sam's sign-ins from Portland and Bucharest 39 minutes apart.
incident response: The activities for handling an incident. CompTIA's eight headings are preparation, identification, investigation, containment, negotiation, eradication and recovery, notification and post-incident.
incremental backup: A backup of only the changes since the last backup of any kind. A restore needs the full backup plus every incremental since it, in order.
indicator of compromise: A clue that a system has been attacked, such as a malware hash, a disguised process name or beaconing.
initial (onboarding) training: Security training for new starters, such as the new packer, tracked in the LMS.
inline: Placed directly in the traffic's path, so the device can block traffic. An IPS must be inline.
intermediate CA: A CA that issues certificates on behalf of a root CA. A server must send the intermediate's certificate along with its own, so clients can build the chain to the root.
IP (Internet Protocol): The protocol that gives each device a network address, such as 10.20.20.10.
IPFIX (Internet Protocol Flow Information Export): The standard form of NetFlow flow records.
IPS (intrusion prevention system): An inline sensor that blocks known attack traffic as it passes.
IPsec (Internet Protocol Security): A VPN protocol that uses UDP ports 500 and 4500, so a hotel network that allows only web ports blocks it.

J

jailbreaking: Talking an AI model into breaking its own safety rules, as when a visitor role-plays the shop's chatbot into writing a phishing email.
just-in-time: Access that is requested, approved and then removed automatically after a short time, such as Alex's two hours of database admin rights.

K

KEV (Known Exploited Vulnerabilities): CISA's catalog of flaws attackers are using now. A KEV finding moves up the priority list even if its score is lower.
key escrow: A trusted party keeping a copy of an encryption key, so data such as a leaver's encrypted files can be recovered.
key pair: A matching private and public key. The private key should be made where it is used, and a new pair is needed if the private key is stolen.
keylogger: Malware that records every keystroke, such as the one uploading the packing PC's typing each night. It is a more specific kind of spyware.

L

LDAP (Lightweight Directory Access Protocol): The protocol for looking up users in a directory. Without TLS it is insecure.
LDAPS: LDAP wrapped in TLS, on port 636.
least privilege: Giving each account only the rights it needs. A backup service account needs backup rights, not global admin.
lessons learned: A blameless meeting after an incident that finds the root cause and what to improve, and ends in a written report.
likelihood and impact: Two 1-to-5 ratings in a risk register. Multiplied together they give the risk's score.
LMS (learning management system): A system that delivers training and records each person's completion.
log manipulation: Tampering with logs to hide activity, shown by a gap in the log while the logging service was stopped.
logic bomb: Hidden code that waits for a condition, such as one employee being removed from payroll, then does damage.

M

MAC address (media access control address): The hardware address of a network card.
maintenance window: The agreed time slot in which an approved change may be made.
malware: Software written to harm a system or its owner, such as ransomware, worms, trojans and keyloggers. Its traces, such as a file hash or a disguised process, are indicators of compromise.
managerial control: A control that comes from a management decision or process, such as a policy or background checks.
mandatory access control: An access model based on labels and clearances that owners can't change, such as Restricted files opening only for people cleared for Restricted.
masking: Hiding part of a value on screen, such as showing Priya's team only the last four digits of a phone number.
MCQ (multiple-choice question): An exam question where you pick one answer from A to D. Most Security+ questions are this kind.
memory image: A copy of a computer's memory taken for evidence. It must be taken before power-off, because memory is lost when the power goes; a disk image copies the stored data.
metadata: Data stored about a file, such as its author and dates. It shows who created the fake invoice document, and when.
MFA (multifactor authentication): Signing in with more than one kind of proof, such as a password and a phone prompt, so a stolen password alone isn't enough.
MFA fatigue: Sending push prompts over and over until the user approves one, as happened to Jo late at night.
mirror port: A switch port that sends a copy of the traffic to a sensor. A device on it can alert but never block.
mitigate (risk treatment): Adding controls that lower a risk's likelihood or impact, such as immutable backups and EDR against ransomware.
MOA (memorandum of agreement): A written agreement that sets each partner's duties.
MOU (memorandum of understanding): A written statement of shared intent with no binding duties, such as Kettle & Crane agreeing with the roasters' association to share threat news.
MSA (master services agreement): The general terms that cover all future jobs with a supplier.
MTBF (mean time between failures): The average time a system runs between failures. It is used to calculate availability.
MTTR (mean time to repair): The average time it takes to repair a system after a failure.

N

NDA (non-disclosure agreement): A signed promise to keep information secret, such as the one the accountant signed before seeing the payroll file.
NetFlow: Records of who talked to whom, when, and how many bytes, without the contents. It answers how much data the file server sent out.
network zone: A part of the network that holds systems with the same exposure and trust, separated from the others by firewalls. Kettle & Crane uses a screened subnet and servers, guest, devices and management zones.
nonce: A value meant to be used only once and checked by the server, so a replayed request is rejected.

O

obfuscation: Making something hard to understand. It hides meaning but protects nothing on its own.
OCSP (Online Certificate Status Protocol): A protocol for asking whether a single certificate has been revoked.
OCSP stapling: The web server attaches a current, signed status answer to its certificate, so browsers needn't contact the CA on every visit or download a revocation list.
on-path attack: An attacker places themselves in the traffic's path, for example with ARP spoofing, so they can read and change the traffic.
one-to-many: Training delivered to a group at once, such as 20 minutes at Sam's team meeting.
one-to-one: Training delivered privately to one person, which lets the trainer find out why that person failed.
OpenSSL: A widely used open-source toolkit for working with certificates and encryption. Its `openssl verify` command checks a certificate much as a browser does and reports errors such as an expired, self-signed or hostname-mismatched certificate.
openssl verify: An OpenSSL command that checks a certificate the way a browser does and prints an error number and cause, such as error 20 or error 62.
operational control: A control carried out by people as a routine, such as Alex reviewing the weekly VPN report.
order of volatility: Collecting evidence from the most short-lived first: memory, then temporary files, then disk, then backup tapes.
out-of-band: Managing devices over a separate network that ordinary traffic doesn't use. It is ideal for the management zone.
owner: The person accountable for a change, named when the change request is recorded.

P

packet capture: A recording of the full contents of network traffic. Use it only when the question needs exactly what was sent.
pam_faillock: The Linux module that counts failed sign-ins and locks the account, as it did to Sam.
partial credit: Points for each correct row or match in some PBQs, even if the whole task isn't right. This is why you should never leave a field empty.
passkey: A phishing-resistant sign-in method that replaces passwords. It cuts the risk of stolen shipping accounts.
password spraying: Trying one password across many accounts slowly, so no single account hits the lockout limit.
patch: A vendor update that fixes a flaw.
PBQ (performance-based question): An exam question where you do a task in a simulation, such as filling a rule table, instead of picking an answer. It is scored on the end state.
persistence: The way malware makes sure it keeps running, for example after a restart. It must be removed during eradication.
phishing: Tricking people with fake messages into clicking links, giving passwords or paying.
phishing simulation: A fake phishing email sent to staff to measure how they react, using the click rate and the report rate.
physical access log: The record of which badge opened which door, and when. It names the badge, not the person who walked in.
physical control: A control you can touch, such as a badge reader, a lock or floodlights.
PKI (public key infrastructure): The system of CAs, certificates and keys used to prove identity and secure connections.
plaintext: Data sent or stored unencrypted, readable by anyone who sees it, such as Telnet passwords.
plaintext strings: Readable text inside a file, such as a web address or the word "password". It can reveal what malware does.
playbook: A written set of steps for handling one kind of event, which can be automated, such as Alex's phishing playbook.
port: A number that identifies which service on a computer traffic is for, such as 443 for HTTPS or 22 for SSH. Firewall rules and secure-protocol choices often turn on the port.
post-incident: The last incident response heading: the lessons learned meeting, the root cause and the report.
preventive control: A control that stops harm before it happens, such as a badge reader or DLP blocking an email.
prompt injection: Hiding instructions in data an AI reads, so it follows them, like the product review that made the shop's AI helper send customers to coupons.example.
protected list: A list of systems an automated playbook must never act on, such as the order system's admin PC.
protocol downgrade: Forcing a connection to use an older, weaker version, such as TLS 1.0. The fix is to disable old versions.
proxy server: A server that forwards web requests for users. Its logs show who clicked a link.
public (data class): The data class for data approved for anyone to see, such as the product photos on the website. It needs no secrecy protection.
push prompt: An MFA request sent to a phone for the user to approve or deny.

Q

QR code (Quick Response code): A square barcode that a phone scans to open a link.
quishing: Phishing through a QR code, such as the fake Wi-Fi sticker over the café's table sign.

R

ransomware: Malware that locks or encrypts files and demands payment, for example by renaming them with .locked.
RDP (Remote Desktop Protocol): A protocol for controlling a computer remotely, on port 3389. Leaving it open without a need adds attack surface.
remote code execution: A flaw that lets an attacker run their own code on a system over the network, such as the one on the VPN gateway.
replay: Resending a captured valid request, such as a refund with the same token and timestamp. One-time tokens stop it.
report rate: The share of staff who reported the phishing test to security. It shows staff act on suspicious email, and at Kettle & Crane it rose from 7% to 50%.
rescan: Scanning again after a fix to confirm it worked.
residual risk: The risk left after a treatment. It is scored again and must fall within the risk appetite.
restore set: The backups needed to rebuild a system, such as Sunday's full backup plus 17 incrementals.
restricted: The data class for data whose leak would cause severe harm, open only to a short list of named people, often under an NDA, such as the payroll file.
RFI (request for information): A request asking suppliers for general information.
RFP (request for proposal): A request asking suppliers to propose how they would meet a need.
RFQ (request for quote): A request for prices on a known item, such as 14 laptops of one model.
risk appetite: How much risk the business is willing to accept. Morgan accepts scores of 4 or less.
risk register: A table of the business's risks with their scores and planned responses.
rogue access point: A Wi-Fi access point nobody authorized. One that copies the real network's name is an evil twin.
role-based access control: An access model where access comes with a job or group, so every new agent gets the same screens as Priya's team.
root CA: The top CA, whose self-signed certificate clients trust directly in their trust store.
rootkit: Malware that hides files and processes from the running system's own tools. It is found only from outside, for example in a disk image.
RPO (recovery point objective): The most data, measured in time, you can afford to lose. It looks back to the last good copy and is met by backup frequency.
RTO (recovery time objective): The longest time a service may be down. It looks forward to service restored and is met by faster recovery steps.
rule shadowing: A general rule placed too high, so it matches first and hides a more specific rule below it.
rule-based access control: An access model based on a condition that applies to everyone, such as only addresses in the VPN range.

S

salted hashing: Adding a random value (a salt) to each password before hashing it, so passwords can be checked but never read back, and two identical passwords give different hashes.
SAN (Subject Alternative Name): The certificate field that lists every name the certificate covers, such as eu.shop.kettleandcrane.com.
screened subnet: A zone for systems the public must reach, such as the wholesale portal, kept apart from the inside network.
segmentation: Splitting a network into separate parts so a weak or risky system can't reach the rest. The unpatched card terminal and the end-of-support warehouse PC are each moved to their own segment as a compensating control.
self-signed certificate: A certificate that vouches for itself, so browsers warn. Replace it on a public site with one from a public CA.
sensitive: A data class for data whose leak would harm a person or the business, open to staff or partners who need it, such as customer phone numbers.
separation of duties: Splitting a task between people so no one person can complete it alone, such as a second approval for large refunds.
service account: An account used by software rather than a person, such as backupsvc.
SFTP (SSH File Transfer Protocol): File transfer that runs inside SSH, on port 22. It is the secure replacement for FTP.
shared account: One account used by several people, such as frontdesk. Nobody can tell who did what, so replace it with named accounts.
shoulder surfing: Watching someone type a PIN or password.
SIEM (security information and event management): A system that collects logs and raises alerts, such as when an admin account is created.
simulation: A limited copy of a real tool, such as a firewall screen or a terminal, that a PBQ is worked in. Security+ uses simulations only.
skimming: Stealing card data with a hidden device fitted to a card reader, such as an overlay on a café's reader.
SLA (service-level agreement): A provider's promise of service levels, such as 99.9% monthly uptime with credits if it misses. That allows about 43 minutes of downtime a month.
SLE (single loss expectancy): The cost of one event: AV × EF.
smishing: Phishing by text message, such as the fake parcel fee sent to Priya.
snapshot: A saved copy of a system's state at a moment, which it can roll back to.
sniffing: Listening to network traffic without changing where it goes.
SNMP (Simple Network Management Protocol): A protocol for polling devices for status on UDP port 161. Version 3 adds authentication and encryption, while 1 and 2c send a plaintext community string.
SOAR (Security Orchestration, Automation, and Response): A platform that runs automated playbooks across security tools.
softfail: The ~all ending of an SPF record. It only marks unlisted servers as suspicious instead of failing them.
SOW (statement of work): A document for one project, with its deliverables, dates and price.
spear phishing: Phishing aimed at chosen people. When the target is an executive, it is called whaling.
SPF (Sender Policy Framework): A DNS record that lists the servers allowed to send a domain's email, checked against the envelope sender. A new sender is added with an include: entry.
split tunnel: A VPN mode where only company traffic goes through the tunnel and web browsing goes straight out.
spyware: Malware that secretly gathers information about the user.
SQL (Structured Query Language): The language used to query databases.
SQL injection: Input that changes the database command, such as id=7' OR 1=1--. A 200 status with a huge response shows it worked.
SSH (Secure Shell): An encrypted protocol for remote command-line access, on TCP port 22. It replaces Telnet.
SSRF (server-side request forgery): Tricking a server into requesting an inside address, such as the cloud metadata service.
staging copy: A test copy of a live system where changes are tried first.
stakeholders: The people affected by a change, who must be told about it.
surveillance footage: Video that shows who actually walked in, which can catch tailgating that a badge log misses.
svchost.exe: A real Windows process name. Malware imitates it, as svch0st.exe does.
SY0-801: The exam code for the version of the CompTIA Security+ certification exam launching around November 17, 2026. Its objectives are grouped into five domains, numbered 1.1 to 5.6.

T

tabletop exercise: A discussion-based rehearsal of an incident plan, such as the ransomware playbook rehearsed in June.
tailgating: Following an authorized person through a secured door without badging in.
tap: A device that copies traffic to a passive sensor, like a mirror port.
targeted training: Training for a group facing a particular threat, such as Sam's sales team and fake invoices.
TCP (Transmission Control Protocol): A connection-based network protocol. Each service listens on a numbered TCP port, such as 443 or 22.
technical control: A control enforced by technology, such as MFA software or a SIEM alert.
Telnet: An old remote command-line protocol that sends passwords in plaintext. SSH replaces it.
time-based access control: An access model that allows access only on certain days and hours or until an end date, such as the holiday packers' shifts.
TLS (Transport Layer Security): The protocol that encrypts web and other connections. TLS 1.3 has built-in protection against downgrade.
TLS VPN: A VPN that runs over TLS on TCP port 443, so it works on networks that allow only web ports.
tokenization: Replacing a stored value, such as a card number, with a token, so the shop's systems hold no card numbers.
TPM (Trusted Platform Module): A chip on a device's own motherboard that guards keys, such as the laptop's disk key.
transfer (risk treatment): Paying another party to carry a risk's cost, such as cyber insurance.
trojan: Malware disguised as something harmless.
trust store: The list of root certificates a client trusts. An internal CA's root must be installed in it.
TXT record: A DNS record that holds text, used to publish SPF and DMARC settings.

U

UDP (User Datagram Protocol): A connectionless network protocol, used by IPsec, WireGuard and SNMP.
URL encoding: Writing characters as % codes in a web address: %27 is a quote, %20 a space and %2f a slash. Attackers use it to hide attack text.
user enumeration: Probing which account names exist, such as admin, oracle and backup, one try each. It works when a system answers differently for real and fake names, for example 401 versus 404.

V

version control: A system that tracks every version of files and configurations. It is updated as the last step of a change.
virtual environment: A full virtual machine used as a PBQ. Security+ doesn't use them.
virus: Malware that spreads when someone runs an infected file.
vishing: Phishing by phone call, such as the fake bank caller asking Sam for a code.
VPN (virtual private network): An encrypted tunnel that connects a remote user to the company network.
vulnerability scan: An automated check of hosts for known flaws. Its findings are validated, ranked and fixed, and it shows weaknesses, not events.

W

WAF (web application firewall): A firewall placed in front of one web application to stop layer 7 attacks such as injection.
whaling: Phishing aimed at a senior executive, such as the email to Morgan.
wildcard certificate: A certificate for *.domain that covers exactly one label in place of the asterisk. It doesn't cover eu.shop.kettleandcrane.com or the bare domain.
WireGuard: A VPN protocol that uses its own UDP port, so networks that allow only web ports block it.
worm: Malware that copies itself to other computers by itself, for example through an unpatched network service.