Glossary

298 terms from Security+ Exam Prep 3: Practice Exams, in plain words, each with the chapter that teaches it.

Search the glossary

#

802.1X: A port-based network access control standard that proves who a device or user is before they may join the network. On its own it does not check whether the laptop has its patches.

A

AAA (authentication, authorization, and accounting): Three security steps: authentication proves who the subject is, authorization decides what the subject may do, and accounting records what each subject did, such as sign-ins and changes, so it can be reviewed later.
acceptable use policy (AUP): A policy that tells staff what they may and may not do with company computers, email and internet access.
acknowledgement: One person's confirmation that they received and understood a policy, such as a new hire ticking a box for the acceptable use policy.
active-passive clustering: A setup in which a standby node watches a heartbeat signal from the active node and takes over if the active node stops responding. A load balancer is different: it spreads requests over independent servers.
AES (Advanced Encryption Standard): A widely used symmetric encryption standard. AES-128 gives 128 bits of security, which matches an RSA key of about 3072 bits.
agentic AI: AI that plans its own steps and uses tools to reach a goal, such as isolating a host, without a person carrying out each action.
agentless monitoring: Monitoring that collects data over the network, so nothing has to be installed on the device. It suits printers and switches that cannot run extra software, while agent-based monitoring needs software on each device.
AI-augmented baseline: An AI capability that learns what normal activity looks like now so it can spot unusual activity. It does not forecast future events.
air-gapped network: A system or network with no connection of any kind to any other network, so updates arrive only on approved media. Physical segmentation is different: it uses separate hardware but still lets controlled traffic flow.
ALE (annualized loss expectancy): The loss you expect from one risk over a year, calculated as SLE × ARO. For Kettle & Crane's stolen laptops, $2,000 × 3 = $6,000.
allow list: A list of permitted items, such as programs or destinations. Anything not on the list is blocked by default, so new ransomware that antivirus does not yet recognize cannot run.
anonymization: Removing identifying details from data so that no one can link the records back to people. Unlike pseudonymization, it cannot be undone.
API (application programming interface): An interface that lets programs talk to each other, such as a cloud provider's interface that a CSPM tool calls to read account settings. Each microservice has its own API that must be protected.
application log: A log that records actions inside an application, such as which shop user changed a customer's shipping address.
archiving: Moving older logs to cheaper long-term storage so they are kept as long as a retention rule requires.
ARO (annualized rate of occurrence): How many times a year a risk event is expected to happen, such as 3 laptop thefts a year or 0.5 DDoS outages a year.
attestation: A formal declaration that controls are in place, often made by an executive to a regulator. It is more formal than one employee's acknowledgement.
availability: The security goal that systems and data can be used when needed. When an attacker changes prices but the shop stays online, availability is not harmed.

B

backout plan: The part of a change plan that says when to undo the change, who decides, and how to return to the last known good state, such as when Alex's checkout fails after an upgrade.
backup code: A one-time code saved at MFA enrollment that replaces a lost second factor, such as when Sam's phone with the authenticator app is broken.
baseline: An organization's own required minimum settings for one type of system, often built from a published benchmark.
benchmark: Published, recommended security settings for one product, such as a CIS (Center for Internet Security) Benchmark. Benchmarking in assessments is different: it compares results with peers or industry norms.
bias: An AI concern in which a model's output is unfair. Poor explainability can hide bias, but they are separate problems.
bit-level copy: A forensic copy of every sector of a drive, including deleted files and unallocated space. A file-level backup copies only current files.
blast radius: How far the damage from one breach can spread. Microservices keep it small because each service holds only its own data and rights.
brute force: An attack that tries many passwords against one account and leaves many failed guesses in the logs.
buffer overflow: A flaw in which a program writes more data into memory than the space set aside for it. The ticket-site double booking was not one, because nothing overflowed memory.
bug bounty program: A program that invites outside researchers to report flaws and pays a reward for each valid finding.
BYOD (bring your own device): A policy that covers personal devices used for work. It does not cover all company systems.

C

CA (certificate authority): A trusted organization or system that signs and issues digital certificates. To get a certificate, an administrator sends it a CSR.
CAB (change advisory board): The group that reviews and approves change requests. It wants to see test results, an impact analysis and a backout plan before anything is installed.
canary account: An unused decoy account, such as one Alex makes to look like an old admin login, where any sign-in raises an alert. It is the account form of a honeytoken.
captive portal: A web page that a user must pass through, for example to accept terms or sign in, before a network grants access. It does not check a laptop's patches.
CASB (cloud access security broker): An SSE component that controls which cloud apps staff may use and what they can do inside them.
certificate of destruction: A document from a disposal company that proves each drive was destroyed, listing serial numbers, method and date.
chain of custody: The signed record of every person who handled a piece of evidence, when and why.
change management: The controlled process for making changes: test, submit a request with an impact analysis and backout plan, get CAB approval, install in the maintenance window, verify, then update diagrams and SOPs.
CI/CD (continuous integration and continuous deployment): An automated pipeline that builds, tests and deploys code changes. A security gate in the pipeline can stop vulnerable code before it reaches production.
CISA (Cybersecurity and Infrastructure Security Agency): The US government cybersecurity agency. It gives incident response advice, such as isolating a known infected host at once, and publishes the KEV catalog.
code execution: An AI risk in which the model's output is run as code without review, such as an AI agent's script that installs a backdoor.
cold site: The cheapest and slowest recovery site: space with few or no systems ready, so it takes longer to bring up than a warm or hot site.
command and control (C2): The Cyber Kill Chain stage in which malware calls back to the attacker's server for instructions. It comes after installation.
community cloud: A cloud shared only by a group of organizations with the same needs or laws, such as county health clinics that split the cost.
community string: The shared password used by SNMP version 1 and 2c. It travels in plain text, so a packet capture can read values such as "public".
compensating control: An alternative control used when the normal one cannot be applied, such as a WAF rule that blocks an exploit until the patch arrives. The flaw itself remains.
confidentiality: The security goal of keeping data secret from people who should not see it. A digital signature does not provide it, because it does not hide the content.
configuration drift: When servers slowly move away from their approved settings as staff make small changes. IaC and desired state management reduce it.
containment: The incident response step that stops an attack from spreading, such as disconnecting infected hosts from the network.
COPPA (Children's Online Privacy Protection Act): A US law that requires verifiable parental consent before a website collects personal information from children under 13.
corrective control: A control that repairs damage or restores normal operation after an incident, such as restoring files from a backup. It acts after something has happened.
corrective training: Training given after one person's mistake to fix that behavior, such as a module for an employee who typed a password during a phishing simulation.
credentialed scan: A vulnerability scan that logs in to the systems and reads installed versions, so it gives the most accurate list of missing patches and the fewest false positives. A non-credentialed scan sees only what an outsider sees and must guess.
CRL (certificate revocation list): A full list of revoked certificates published by a CA, which the browser must download and search.
cross-site scripting (XSS): An attack that runs the attacker's script in other users' browsers, for example to steal session cookies. The HttpOnly cookie attribute blocks that theft.
cryptographic erase: A purge method that destroys the encryption key so data on a fully encrypted drive cannot be read, while the drive itself keeps working. That makes it right for leased laptops but not where policy requires physical destruction.
CSPM (cloud security posture management): A tool that checks cloud account settings against security rules continuously through the provider's API, finding public buckets, open network rules and accounts without MFA.
CSR (certificate signing request): A request sent to a CA that holds the server's public key and names and is signed with the private key. The private key never leaves the server.
CVE (Common Vulnerabilities and Exposures): The system that gives each publicly known vulnerability a unique ID, such as CVE-2021-44228, so everyone names a flaw the same way.
CVSS (Common Vulnerability Scoring System): A system that rates how severe a flaw is from 0.0 to 10.0. The base score ignores whether a flaw is exposed or actively exploited.
cyber insurance: Insurance that covers the cost of breaches. Buying it transfers the financial impact of a risk to another party.
Cyber Kill Chain: A model of the stages of an attack, including exploitation, installation, command and control, and actions on objectives.

D

data at rest: Stored data, such as files on a laptop disk or in a backup. Full disk, file or database encryption protects it easily.
data classification: Labeling data by how sensitive it is, which decides how it must be protected, such as the government levels top secret and secret. The data owner sets the class.
data controller: The organization that decides why and how personal data is used, such as Kettle & Crane choosing to email customers an offer.
data custodian: The role, often IT, that carries out protection such as backups and encryption on the owner's behalf.
data in transit: Data moving across a network, usually protected with TLS.
data in use: Data in memory that a program is processing. It is usually plaintext, so it is the hardest state to protect with encryption.
data location: Where in the world data is stored. It is not about where a device is right now.
data owner: The person accountable for a data set, who sets its classification and decides who may access it, such as Kettle & Crane's head of sales for the wholesale price list.
data processor: An organization that handles personal data for the controller and follows the controller's instructions, such as a mailing service sending Kettle & Crane's offers.
data sovereignty: The idea that data falls under the laws of the country where it is stored.
data subprocessor: A firm hired by a processor to do part of the processing, such as a print-and-mail firm working for a payroll company.
data transpose: Moving real values to new places without changing them, such as shuffling zip codes among customers in a test copy so regional totals still work.
DDoS (distributed denial of service): An attack in which many systems flood a service, such as the online shop, so it goes down.
deepfake: AI-made video or voice of a real person, such as a fake CFO on a video call asking for a wire transfer.
default deny: A firewall approach in which anything not explicitly allowed is blocked. In Exam 1 Task 1 it is written out as a final "Any, Any, Any, Deny" rule that must sit last.
deny list: A list of named items to block. It stops only what is already listed, so it misses new malware and cannot open a path through default deny.
dependency: Something a system relies on to work, such as the database account and password the shop uses. A good impact analysis lists dependencies so a change to one does not break the other.
desired state management: An automation use case that checks real settings against the written, approved state again and again and fixes drift.
deterrent control: A control that only discourages an attacker from trying, such as a sign warning of guards and cameras. Unlike a preventive control such as a lock, it can be ignored.
device health: A Zero Trust check of a device's current security state, such as missing updates, which blocks access until the device is fixed. Device inventory only asks whether the device is known and enrolled.
Diamond Model of Intrusion Analysis: A model that describes each attack event by four features (adversary, capability, infrastructure and victim) and the links between them.
Diffie-Hellman: A method for two sides to agree on a key over an open network. The static form reuses long-term values, so it does not give forward secrecy.
digital signature: A value made with the sender's private key that gives integrity, authentication and non-repudiation, such as on a supplier's emailed invoices. It does not encrypt the content.
directory traversal: An attack that uses ../ in a request to climb out of the allowed folder and read system files, such as /etc/passwd.
DKIM (DomainKeys Identified Mail): An email authentication method that signs outgoing mail so receivers can check that it came from the domain. Adding another selector does not make receivers refuse fake mail.
DMARC (Domain-based Message Authentication, Reporting, and Conformance): A policy published in DNS that tells receiving mail servers what to do with mail that fails authentication for a domain. p=none takes no action, p=quarantine sends the mail to spam, and p=reject refuses it.
DNS cache poisoning: An attack that changes the cached answer in a DNS resolver, so browsers are sent to the wrong address for a real name such as shop.kettleandcrane.com.
domain: One of the five big topic areas of the SY0-801 objectives. Each has a published weight that tells you how many of the 90 questions come from it.

E

ECDHE (elliptic-curve Diffie-Hellman ephemeral): A key exchange that makes fresh keys for every session, giving perfect forward secrecy.
EDR (endpoint detection and response): Software on each endpoint that detects threats such as ransomware or malicious PowerShell, can isolate the device, and keeps records that investigators can search.
email header: The metadata at the top of an email. Each Received line records a mail server on the path and the time the message passed it.
emergency access account: An admin account kept for when normal admin access fails. It is excluded from conditional access, and every sign-in raises an alert.
endpoint posture assessment: A check of a device's health, such as current patches and running antivirus, before it may join the network.
enumeration: Scanning the network to discover the devices actually there so they can be compared with the asset inventory.
eradication: The incident response step that removes the threat, such as wiping and rebuilding infected hosts before files are restored from a clean backup in recovery.
espionage: A motivation in which the attacker secretly watches a target over time to learn its plans. Wanting one asset, such as roast recipes, is intellectual property theft instead.
evasion: An attack on AI that crafts one input at the time of use to fool the model. It does not touch the training data.
explainability: Whether anyone can trace why an AI model gave its output back to the factors behind it.
exposure factor: The share of an asset's value lost in one event, such as 20% of the shop's value in a DDoS outage.

F

fail closed: A failure mode in which a security device such as an inline IPS blocks all traffic when it fails, so nothing unchecked gets through.
fail forward: Fixing a failed change with a small, approved, quickly tested fix instead of backing it out, used when undoing the change would be less secure.
fail open: A failure mode in which traffic keeps flowing unchecked when a security device fails. It favors availability.
failover test: A recovery test that actually switches production over to the backup systems. In a parallel test, production stays in charge.
federation: Trust between two organizations, so a partner company's identity provider vouches for its own users and they can sign in to your app without new accounts.
FERPA (Family Educational Rights and Privacy Act): A US law that protects student education records at schools.
fileless malware: Malicious code that runs from memory, often through PowerShell, and leaves no malicious file on disk.
firmware: The built-in software that runs a hardware device, such as Kettle & Crane's edge firewall. Updating it is a change that goes through change management.
first match wins: A firewall reads its rules from the top and applies the first rule that matches, so block rules for an attacking network must sit above allow rules.
FTPS (FTP Secure): FTP (the File Transfer Protocol) with TLS added, on port 21 or 990. It is not the same as SFTP.
full disk encryption: Encryption of everything on a drive, including temporary and page files, which protects a powered-off laptop if it is stolen.
full tunnel: A VPN setting that sends all of a laptop's traffic, including web browsing, through the VPN. Split tunnel sends only company traffic that way.

G

gap analysis: An assessment that measures the difference between an organization's current controls and the requirements of a target standard.
geofencing: Making access depend on whether a device is inside a virtual boundary, such as an inventory app that opens only on the warehouse grounds.
GLBA (Gramm-Leach-Bliley Act): A US law that requires financial institutions to protect customers' personal financial information and explain how they share it. It appears only as a wrong option in Exam 2.
gMSA (group managed service account): A Windows service account whose password Windows sets and rotates itself, and which only allowed servers can fetch, so no person knows it.
guardrail: A limit on what automation may do whatever its input, such as a cap on how many accounts a script may disable in one run.

H

hacktivist: An attacker who chooses targets to serve a political or social cause, for example by defacing a website in protest.
hallucination: When an AI model invents a confident but false answer on its own, such as quoting a section of a standard that does not exist.
hashing: Turning data into a fixed value that cannot be reversed. Investigators record a file's hash at collection; if it matches later, the file is unchanged.
heat map: A colored chart that places risks by likelihood and impact. It is a qualitative tool, not a quantitative one.
HIDS (host-based intrusion detection system): An IDS that runs on the server itself, so it sees traffic after decryption and can watch changes to system files.
HIPAA (Health Insurance Portability and Accountability Act): A US law that protects patients' health information held by healthcare providers, health plans and their partners. It appears only as a wrong option in Exam 2.
honeypot: A whole decoy system set up to attract and detect attackers. A honeynet is a decoy network, and a honeyfile is a decoy file.
hot site: A recovery site that can take over in minutes but costs far more than a warm or cold site.
HSM (hardware security module): A dedicated, tamper-resistant device that creates, stores and uses keys for many systems, such as an internal CA's signing key.
HttpOnly: A cookie attribute that stops scripts in the page from reading the cookie, which blocks session theft through XSS. The Secure attribute only keeps a cookie off unencrypted connections.
HTTPS (Hypertext Transfer Protocol Secure): Encrypted web traffic, normally on TCP port 443. A firewall rule lets anyone reach the Kettle & Crane shop server with it.
hybrid cloud: A mix of two or more deployment models, such as customer records in a private cloud linked to a web storefront in a public cloud.
hypervisor: The software layer that runs virtual machines (VMs). In IaaS it belongs to the provider, not the customer.

I

IaaS (infrastructure as a service): A cloud model in which the customer rents virtual machines and manages their operating systems, apps and data, while the provider handles hardware, power and the hypervisor.
IaC (infrastructure as code): Defining and building servers and other infrastructure from code or configuration files. It reduces drift, but one wrong line, such as open storage, is copied to every system built from the file.
IDS (intrusion detection system): A system that watches traffic and alerts on attacks but cannot block them. A sensor on a mirror port sees only a copy, so its failure never stops business traffic.
immutability: A backup property that stops anyone, even an administrator, from changing or deleting a copy until its retention period ends.
impact analysis: Working out, before a change is approved, what it will affect and what could go wrong, including dependencies such as the account the shop uses.
impossible travel: An indicator in which one account signs in from places too far apart for the time between them, such as Priya's account in Portland and then Singapore 23 minutes later.
incident response process: CompTIA's stages for handling an incident: preparation, identification, investigation, containment, eradication and recovery, notification and post-incident lessons learned, with negotiation where needed.
insider threat: A trusted employee who causes harm on purpose, such as a passed-over database administrator copying the customer table before resigning.
integrity: The security goal that data is correct and not changed by anyone who should not change it, such as an attacker editing prices in the shop's product file.
IPS (intrusion prevention system): A device that sits inline in the traffic path and can block attacks. If it fails, it can either stop traffic or let it through unchecked.

J

jailbreaking: Defeating an AI model's safety rules to get forbidden content, such as using a role-play story to get a chatbot to write malware.
just-in-time (JIT) access: Access that grants a permission on request for a short time and then removes it automatically. Time-based access follows a fixed schedule instead.

K

KEV (Known Exploited Vulnerabilities) catalog: CISA's list of flaws known to be exploited in real attacks. A flaw on the list can deserve fixing before one with a higher CVSS score.
key escrow: A trusted party holds copies of keys so data can be recovered if a key is lost.
keystroke injection device: A USB device that poses as a keyboard and types commands. Blocking USB storage does not stop it.
KMS (key management service): A service that creates, stores and controls the use of keys, including rotation: replacing keys on a fixed schedule.
known environment: A penetration test in which testers get full details of the network, systems and source code before they start. A partially known test gives only some details.

L

layer 4 firewall: A firewall rule that sees only addresses and ports, so it cannot spot SQL injection hidden inside allowed HTTPS traffic.
LDAP (Lightweight Directory Access Protocol): A protocol for reading and searching a directory of users and accounts. It does not let a partner company's staff sign in with their own accounts or give an app scoped access.
least privilege: Giving each person only the access their job needs, such as Write or modify for Priya's address corrections and Read for an auditor.
legal hold: An order to keep records tied to an expected lawsuit, which overrides the normal retention schedule until the hold ends.
likelihood: How probable an attack is. More attacks in the wild raise likelihood, while impact is the harm one attack would do.
living off the land: An attacker misusing tools that already ship with the system, such as remote admin and backup utilities, instead of installing new programs.
LMS (learning management system): A platform that delivers training courses, assigns them to staff and records who completed them.
log aggregation: Collecting logs from many sources into one place now. It does not keep them long term.
log manipulation: An indicator that someone cleared or altered logs to hide their tracks. For example, Windows Event 1102 means the audit (Security) log was cleared.
logic bomb: Malware that stays dormant until a set date or event, such as an account being removed, triggers it.
loss of license: A consequence of non-compliance in which an authority suspends or revokes a company's permission to do business. Sanctions only restrict a company's actions.

M

macro: A small program embedded in an Office file. The m in extensions such as .docm and .xlsm shows the file can hold macros.
maintenance window: An agreed, approved time, such as one slot each week, when changes may be installed so any disruption is planned and expected.
managerial control: A decision or document that directs security, such as a yearly risk assessment. A guard checking badges is an operational control, which is carried out by people.
masking: Hiding part of a value when it is shown, such as showing only the last four card digits on an agent's screen, while the real value stays in storage.
memory dump: A copy of a computer's memory. It is captured first for fileless malware, because memory is the most volatile source and is lost at power-off.
MFA (multifactor authentication): Signing in with more than one kind of proof, such as a password plus an authenticator app or passkey.
MFA fatigue: An attack that sends many sign-in approval prompts after a correct password until the user taps Approve to make them stop.
microservices: An application built as many small services, each holding only its own data and rights, so one breach spreads less far than in a single monolithic application. The trade-off is more APIs to protect.
minimum password age: A setting that blocks another password change for a set number of days, so users cannot cycle through changes to reuse an old password. Maximum age forces a change after N days.
miss log: A study list you keep after scoring a practice exam: for each question you got wrong or only guessed right, you note the question number, your choice, the right answer and the course chapter to reread. When several misses point to the same chapter, it shows you where one study session will close several gaps.
MITRE ATT&CK: A catalog of attacker tactics and techniques, each with an ID.
MOA (memorandum of agreement): A formal agreement that is more detailed than an MOU and states the duties of each party.
MOU (memorandum of understanding): A document that records a shared intent to work together but is usually not legally binding.
MSP (managed service provider): An outside firm that runs a company's IT with admin access, often through an RMM tool. A breach of the MSP can push ransomware to all of its clients.
MTBF (mean time between failures): Total operating time divided by the number of failures. For example, 5,000 hours with 2 failures gives an MTBF of 2,500 hours.
multicloud: Using more than one cloud provider.

N

negotiation: An incident response activity of talking with attackers, such as a ransomware group, to gain time, information or terms.
NetFlow: Flow records of who talked to whom, when and how much, without packet contents. They are small enough to keep for months.
network range (/24): An address with /24, such as 10.30.5.0/24, means a block of 256 addresses that share the first three numbers. In Exam 1 Task 1 it is the range of Kettle & Crane's admin workstations.
NFC (near-field communication): Wireless that works only within a few centimeters, as with tap-to-pay. Bluetooth works over a few meters.
NIDS (network-based intrusion detection system): An IDS that watches network traffic. It sees only encrypted packets in HTTPS sessions and cannot see files on a server's disk.
non-repudiation: Proof strong enough that a person cannot believably deny an action, such as a supplier's digital signature on an invoice.

O

OAuth (Open Authorization): A protocol that gives an app limited access, such as reading a calendar, through a scoped token, so the app never sees the user's password.
OCSP stapling: The server fetches its own signed OCSP (Online Certificate Status Protocol) answer about revocation and attaches it to each connection, so browsers do not have to check with the CA.
on-path attack: An attacker who sits in the traffic path and can change or redirect traffic, not just read it.
open-source intelligence: Threat information anyone can read for free, such as a security company's public blog post. What matters is free access, not who wrote it.
order of volatility: The rule for deciding what evidence to collect first: the most short-lived, such as memory, comes before disks.
OTP (one-time password): A code that works only once. A TOTP changes with time. Both can be typed into a fake page and replayed by the attacker, unlike a passkey.
out-of-band management: Reaching devices such as the core firewall's console over a separate path, such as a console server with a modem, so it works when the production network is down.

P

packet capture: A recording of the actual traffic including its content, such as commands typed in an unencrypted Telnet session. It is far too large to keep for months.
parallel processing test: A recovery test that runs the recovery systems on the same real work as production and compares the results, while production stays in charge.
passkey: A sign-in credential on the user's device that signs only for the real site, so a fake sign-in page has nothing it can capture and replay.
password spraying: An attack that tries one common password, such as Autumn2026!, across many accounts. Brute force does the reverse: many passwords against one account.
PBQ (performance-based question): An exam question that asks you to do a task, such as filling a firewall rule table or ordering steps, instead of picking one letter. On Security+ these are simulations.
perfect forward secrecy: A property in which fresh keys for each session mean a later stolen server key cannot unlock old sessions.
personnel behavior risk scoring: Giving each employee a risk value based on observed security behavior, such as simulation clicks, reported phish and finished training.
phishing: Fake messages, usually emails, that trick people into clicking a link, opening a file or typing a password into a fake page. Targeted forms include spear phishing and whaling.
phishing simulation: A fake phishing email sent to staff to test whether they click or enter passwords.
physical control: A control that protects touchable things such as rooms, cabinets and equipment, for example a locked server cabinet.
poisoning: An attack that plants bad data in an AI model's training data, so all its later decisions are affected.
port mirror: A switch port that receives a copy of traffic. An IDS sensor on it only watches, so its failure never affects business traffic.
power generator: A generator makes power for as long as it has fuel, so it covers outages that last hours. A UPS only bridges the minutes until the generator starts.
PowerShell: Windows' built-in scripting tool. Attackers misuse it to run hidden, encoded code in memory, as in fileless malware.
predictive analysis: An AI capability that forecasts what is likely to happen, such as which vulnerabilities will be exploited in the next 30 days.
preventive control: A control that stops an unwanted act from happening, such as a lock or a firewall rule. A deterrent sign only discourages and can be ignored.
private key: The secret half of a key pair, which must never leave the server. The matching public key goes into the CSR for the CA.
processing restriction: A privacy right in which data is kept but its use is paused, for example while a customer's dispute about their address is settled.
prompt injection: Hidden instructions in content an AI reads that hijack its task, such as an email telling a support chatbot to send out the customer list.
protocol downgrade: An attack that pushes clients to agree on an older, weaker protocol version, such as old SSL instead of TLS 1.3.
pseudonymization: Replacing names with codes while a separate protected table links the codes back to the names, so the process can be reversed.
public object storage: A cloud storage bucket that anyone can read without signing in, such as one made public for a price list that later held invoices.
public repository: A publicly visible code store, such as a public Git project. It is not a bucket of files.

Q

QR (Quick Response) code: A picture that carries an address for phones to scan. Fake QR stickers on café tables are an image-based threat vector.
qualifier: A small word in an exam question, such as best, first, most likely, next or most effective, that decides which answer is right. "First" asks about order; "best" asks you to weigh options that all work.
quantitative risk analysis: Risk analysis with measured numbers: dollars for impact and probability for likelihood, such as a $40,000 loss at a 10% yearly chance. A 1 to 5 rating is qualitative.

R

race condition: A flaw caused by the gap between checking something and using it, so two requests both pass the check, such as two buyers getting the same seat.
rainbow table: A precomputed table of password hashes used to crack them quickly. A unique salt defeats it.
ransomware: Malware that encrypts files and leaves a ransom note, such as 4,000 files renamed to .locked with HOW_TO_RECOVER.txt in each folder.
RCS (Rich Communication Services): A messaging standard that adds media, read receipts and typing indicators to the texting app over mobile data. SMS is plain text only.
readiness rule: A test for deciding when to book the real Security+ exam: your two most recent full practice sittings must both score 85% or more, with no domain below 70% on either. Each score falls into one of three bands: Not yet (below 70%), Close (70% to 84%) or Ready (85% or more).
redundant power supply: A second power supply inside a server, so it keeps running if one supply fails. It is different from a UPS, which covers the building's power.
residual risk: The risk that remains after the chosen controls and treatments are in place.
retention: How long a copy or record is kept. On its own it does not stop someone deleting the copy early.
RFI (request for information): A research request sent to vendors so a buyer can learn what options exist before writing requirements.
RFP (request for proposal): A request for a vendor's full offer, sent once the buyer has defined its requirements.
right to audit: A contract clause that lets a customer, or an auditor it chooses, examine a vendor's controls and records.
risk appetite: How much risk an organization is willing to accept.
risk avoidance: A risk treatment that removes a risk by not doing the activity that creates it, such as dropping a feature that would store card numbers.
risk transfer: A risk treatment that moves the financial impact to another party, such as buying cyber insurance. Mitigating adds controls to shrink the risk, and accepting lives with it.
RMM (remote monitoring and management): A tool an MSP uses for admin access to its clients' systems.
rootkit: Malware that changes the operating system so its own files and processes stay hidden.
RPO (recovery point objective): The most data, measured in time, that may be lost. Backups must run at least that often, so an RPO of 2 hours needs a backup every 2 hours or less.
RSA (Rivest, Shamir and Adleman): A public-key algorithm; using it for key transport gives no forward secrecy. NIST SP 800-57 rates RSA 3072 as equal to AES-128 (128 bits of security) and RSA 2048 as about 112 bits.
RTF (Rich Text Format): A document format that cannot hold macros but can embed objects that exploit word processor flaws.
runbook: Exact, often automated, steps for one technical situation, such as a backup server disk filling up.

S

salt: A unique random value added to each password before hashing, so identical passwords get different hashes. It is stored with the hash. A secret value kept elsewhere is a pepper.
SAML (Security Assertion Markup Language): An XML-based standard that asserts who a user is for sign-in, often between organizations. It does not give an app scoped access to data.
SAN (subject alternative name): An extra name listed in a certificate. The bare domain kettleandcrane.com must be added this way, because the wildcard does not cover it.
sandbox: An isolated place to open an unknown file and watch what it does without risking production systems. Quarantine only holds the file so it cannot run.
sanitization: Making data on media unrecoverable. Clear overwrites, purge (such as cryptographic erase) defeats lab recovery but keeps the drive usable, and destroy, such as shredding, ruins the media.
scaled score: A score that turns your raw exam points into a number on a fixed scale. CompTIA Security+ uses a scale of 100 to 900, uses a formula it does not publish, and sets 750 as the pass mark. Because a scaled score is not a percentage, you cannot convert 750 into a safe percentage, so a practice target of 85% gives you a clear margin.
SCAP (Security Content Automation Protocol): A standard format for configuration checklists and results that lets scanners check settings against a benchmark and prove compliance.
screened subnet: A network zone for public-facing systems, such as the wholesale portal, kept apart from internal systems like the customer database.
secrets manager: A secure store for passwords and keys. A hardcoded password found in source code must be rotated first and then moved into one.
secure web gateway: An SSE component that filters websites and downloads. It does not control what users do inside cloud apps.
security gate: A check in a CI/CD pipeline that fails the build before deployment, so code with a critical flaw never goes live.
serverless: A cloud model in which the provider runs the hardware, operating system and runtime, while the customer still secures the function code and its permissions.
session token: A value that proves a login already happened, so a stolen one lets an attacker act as the user without a password or MFA. A session key only encrypts a connection's traffic.
SFTP: The SSH File Transfer Protocol, which transfers files inside an SSH connection on port 22.
shadow IT: A department using a service without IT's approval, such as marketing uploading customer lists to a file-sharing site paid for with a company card.
SIEM (security information and event management): A system that collects and correlates events from many sources and fires alert rules. Rules need tuning so normal activity does not flood analysts.
SLA (service-level agreement): An agreement that holds service targets (SLOs) and adds remedies, such as service credits, if they are missed. It does not give the customer the right to inspect controls.
SLE (single loss expectancy): The loss from one event: asset value × exposure factor. For example, $50,000 × 20% = $10,000.
SLO (service-level objective): One specific, measurable target for a service, such as 99.9% monthly uptime.
SMS (Short Message Service): Plain text messaging of about 160 characters, with no read receipts. SMS codes can be phished just like other one-time codes.
sniffing: Only reading traffic as it passes, such as unencrypted web traffic on a café's open Wi-Fi, without changing or redirecting it.
SNMP (Simple Network Management Protocol): A protocol for monitoring and managing network devices such as switches. Versions 1 and 2c send the community string in plain text.
SNMPv3: The secure version of SNMP. In authPriv mode it both authenticates and encrypts, so nothing readable crosses the network.
SOAR (security orchestration, automation, and response): A platform that automates security work with playbooks. It only automates the process it is given, so the process must be documented and agreed first.
SOP (standard operating procedure): Step-by-step instructions for doing a routine task the same correct way every time, such as adding a new staff laptop. A policy says what must happen; the SOP says how.
spear phishing: A phishing message aimed at chosen targets. When the target is a senior executive, it is called whaling.
SQL injection: An attack that inserts database query words into input, such as a quote mark and UNION SELECT in a search request, to read data like card numbers.
SSE (Security Service Edge): A group of cloud-delivered security services that includes a CASB, a secure web gateway, zero trust network access and data loss prevention.
SSH (Secure Shell): An encrypted protocol for remote administration on TCP port 22. In Exam 1 Task 1, only Kettle & Crane's admin workstations may use it to reach the shop server.
SSL (Secure Sockets Layer): The old, weak predecessor of TLS. Clients agreeing to it instead of TLS 1.3 is a sign of a protocol downgrade.
SSO (single sign-on): One login for many apps inside one company. It does not cross into another organization the way federation does.
state-sponsored: A threat actor backed by a nation, often keeping hidden access for years with custom malware, such as a group whose servers link to a foreign military.
syslog: A standard way to send log messages over the network, traditionally on UDP 514.

T

tabletop exercise: A discussion-based exercise in which a team talks through a made-up incident, with a facilitator adding injects, and nobody touches real systems.
targeted training: Training given to a group because of its job or risks, such as Kettle & Crane staff who approve supplier payments.
TCP (Transmission Control Protocol): The connection-based internet protocol that carries services on numbered ports, such as SSH on TCP 22 and the order database on TCP 5432.
TDE (transparent data encryption): Database encryption that protects files and backups at rest, but admins still see plaintext through the database. Field encryption in the application hides chosen values even from admins.
Telnet: An old remote-session protocol that sends everything, including typed commands, unencrypted, so a packet capture can read it.
threat hunting: Proactively searching logs from a hypothesis, such as stolen VPN credentials, when no alert has fired.
threat intelligence life cycle: The repeating phases that turn raw threat data into useful intelligence, including collection, processing (removing duplicates and converting to one format), analysis and dissemination.
threat vector: The path or means an attacker uses to reach a target, such as a message, an image like a fake QR code, a USB device, a browser extension or a managed service provider.
TLS (Transport Layer Security): The protocol that encrypts data in transit, such as HTTPS web traffic and database connections.
tokenization: Swapping each real value, such as a card number, for a random token. Only a separate vault can map the token back, so the app database holds no real card numbers.
top secret: The highest government classification, for information whose release could cause exceptionally grave damage. Secret, one level lower, matches serious damage.
TPM (Trusted Platform Module): A security chip inside one computer that protects keys. Unlike an HSM, it is not shared by many servers.
Trojan: Malware that arrives disguised as something the user wants. The name describes how it arrived, not how it hides.
tuning: Narrowing a SIEM rule with an exception for known normal activity, which cuts false positives without the false negatives that disabling the rule would cause.
typosquatting: Registering a new, misspelled lookalike domain name to catch people who mistype the real one.

U

UDP (User Datagram Protocol): A connectionless internet protocol, used for example by syslog on UDP port 514.
unskilled attacker: A threat actor who uses downloaded, ready-made tools against random targets and brags online.
unsupported: A product for which the vendor will never release another security fix. Unpatched means a fix exists but has not been installed.
UPS (uninterruptible power supply): A battery unit that keeps equipment running through short building power cuts, for minutes, which is long enough for a generator to start.

V

virus: Malware that lives in an infected host file and needs a user to run or open it.
vishing: Phishing done by phone call; smishing is the same attack by text message.
VPN (virtual private network): An encrypted tunnel across an untrusted network, such as one linking a sales manager's laptop on hotel Wi-Fi to the company network (remote access) or joining two offices (site-to-site).
vulnerability disclosure policy: A policy that tells outsiders how to report flaws and may promise good-faith reporters safe harbor from legal action. It does not pay rewards.

W

WAF (web application firewall): An inline firewall in front of a web application that reads web requests and blocks attacks such as SQL injection hidden in allowed HTTPS traffic.
warm site: A recovery site with hardware ready that needs recent data loaded. It takes about a day and costs a middle amount.
watering hole: An attack that compromises a real website the targets already visit, such as a coffee trade association's site, to infect visitors.
whaling: Targeted phishing aimed at a senior executive, such as a fake court notice sent only to the CEO.
wildcard certificate: A certificate whose asterisk stands for exactly one label, so *.kettleandcrane.com covers shop.kettleandcrane.com but not the bare domain or eu.shop.kettleandcrane.com.
worm: Malware that copies itself to other computers over the network with no user action.

Z

Zero Trust: A security approach that removes trust based on network location and verifies the user and device health on every request.
zero-day: A flaw attackers exploit before any fix exists. Using zero-days is a sign of a skilled threat actor.