Security Fundamentals and the Threat Landscape
Core concepts
Start with the CIA triad: confidentiality, integrity, availability. Every control you meet later maps to one of these. Know the difference between a vulnerability (a weakness), a threat (a potential actor or event), and a risk (the combination of likelihood and impact). Questions often swap these terms to test precision.
Understand the common attack categories: reconnaissance, spoofing, man-in-the-middle, denial of service, credential theft, and social engineering such as phishing and its targeted variant, spear phishing. On wireless, know evil twin access points, rogue APs, deauthentication floods, and the difference between an authorized-but-unmanaged AP and a truly malicious one.
Traps to watch
- Encryption vs. authentication confusion. WEP and WPA-PSK encrypt traffic but do not authenticate users individually; enterprise 802.1X does. A question asking "which provides per-user authentication" wants the enterprise option.
- Rogue vs. interfering vs. neighbor AP. Only an AP on your wired network is a true security rogue; a neighboring AP is usually just interference to be mitigated, not blocked.
- DoS is an availability attack first, even when it disrupts authentication.
Rule of thumb
Match the control to the CIA leg it protects before answering: if the question is about preventing data disclosure, you want confidentiality controls (encryption, segmentation), not integrity controls (hashing). This single check eliminates most distractors.
Worked example
"An attacker sets up an AP with the same SSID as the corporate network to capture credentials." This is an evil twin attack, a man-in-the-middle variant targeting confidentiality of credentials. The right defense is mutual authentication (802.1X with server certificate validation), not simply a stronger passphrase.