Domain 1
What does the "C" stand for in the CIA Triad?
Confidentiality
What software runs in the background to detect and block malicious programs?
Antivirus/anti-malware software
What wireless encryption standard is considered current best practice today?
WPA3
What email attack impersonates a trusted sender's address to deceive the recipient?
Spoofing
What term describes reducing a system's attack surface by disabling unused ports, services, and default accounts?
Hardening
What type of malware self-replicates across a network without needing to attach to a host file?
A worm
What authentication method requires two or more different factor types (e.g., password + code)?
Multi-Factor Authentication (MFA)
What device monitors network traffic and can actively block malicious activity in real time?
An Intrusion Prevention System (IPS)
What browsing mode prevents history, cookies, and cache from being saved after the session ends?
Private/incognito browsing
What authentication protocol uses tickets issued by a KDC so users don't have to keep re-entering passwords across a network?
Kerberos
What backup type only captures data changed since the last full backup (not the last backup of any kind)?
Differential backup
In Linux's rwx notation, what do the three permission sets represent, in order?
Owner (user), group, and others
What isolated network segment sits between a trusted internal network and the untrusted internet, hosting public-facing servers?
A DMZ (Demilitarized Zone)
What ongoing user activity is considered the most effective defense against phishing, even more than technical filters?
Security awareness training
What isolated network zone hosts public-facing servers, keeping them separate from the trusted internal network?
DMZ
What social engineering attack uses a fraudulent, official-looking email to trick a user into revealing credentials?
Phishing
What Windows feature provides full-disk encryption built into the OS?
BitLocker
What security extension adds cryptographic signatures to DNS records to prevent spoofing and cache poisoning?
DNSSEC
A browser stores site data locally to load pages faster on repeat visits, but this same data can let others see what sites you've been on. Clearing it regularly is part of managing what?
What is cache management?
A user claims they never authorized a transaction that system logs and a matching digital signature both confirm came from their account. What security principle is being enforced against their denial?
Non-repudiation
Named for the two-faced Roman god, this attack doesn't touch the target directly — instead, it poisons the resolution process so victims are silently redirected to a malicious site even when they type the correct URL themselves.
What is pharming (via DNS cache poisoning / DNS spoofing)
A software vendor distributes an update, digitally stamped with a credential only they possess, so that your system can verify — using a separate, freely distributed credential mathematically bound to it — that the update wasn't tampered with in transit.
What are public and private keys (a public/private key pair)
Part A — Name the service that runs on each port:
Part B — Name the port number(s) used by each service:
3. SSH — ?
4. Telnet — ?
A file downloaded from a server matches its published checksum, but weeks later the same checksum comes back different even though no user modified it and no attacker was found on the system. What property was compromised?
Integrity
After removing a rootkit infection, a technician doesn't just delete the malware and call it done — they also restore altered system files, revert unauthorized registry changes, reset compromised credentials, and confirm the system returns to a known-clean baseline. What is this overall post-detection process called?
What is remediation?