Security+ cheat sheet

CIA triad: confidentiality protects against unauthorized disclosure, integrity against unauthorized modification, and availability ensures timely authorized access.

Authentication factors are knowledge, possession, inherence, behavior, and location; MFA requires two or more different categories, not two items from one category.

Least privilege grants the minimum rights necessary; separation of duties divides critical tasks so no single subject controls all parts.

Zero trust removes implicit trust based on network location and uses continuous verification, least privilege, and segmentation.

Control categories are technical, managerial, operational, and physical; control types include preventive, detective, corrective, deterrent, compensating, and directive.

Hashing provides integrity, not confidentiality; salting adds unique data per password to defeat precomputed rainbow tables; HMAC uses a keyed hash.

Symmetric encryption is fast and uses one shared key; asymmetric encryption uses public/private key pairs and helps with key exchange and signatures.

Digital signatures provide integrity, authentication, and non-repudiation when the private key is controlled by the signer.

Change management steps include request, review/approval, testing, implementation, documentation, and rollback planning.

Threat actors include nation-states, organized crime, hacktivists, insiders, and script kiddies; motivation and capability affect likelihood and impact.

Social engineering exploits human trust; common forms include phishing, vishing, smishing, pretexting, tailgating, and shoulder surfing.

Malware behaviors: viruses need a host, worms self-propagate, trojans disguise as legitimate software, rootkits hide access, and ransomware blocks access to data.

Common vulnerabilities include unpatched software, misconfiguration, weak or reused credentials, legacy systems, and zero-days without vendor patches.

SQL injection is mitigated with parameterized queries and input validation; cross-site scripting is mitigated with output encoding and content security policy.

DDoS categories include volumetric, protocol, and application-layer attacks; mitigation uses rate limiting, traffic scrubbing, and CDN absorption.

Password attacks include brute force, dictionary, credential stuffing, and spraying; lockout, MFA, length, and breached-password screening reduce effectiveness.

Supply-chain risk includes compromised vendors and counterfeit hardware; controls include due diligence, contractual security requirements, SBOMs, and monitoring.

A DMZ or screened subnet sits between untrusted and internal networks and hosts public services with restricted access to internal systems.

Packet-filtering firewalls inspect headers at layers 3-4; stateful firewalls track connections; application-layer firewalls and WAFs inspect layer 7 content.

IDS is passive and alerts; IPS is inline and can block; NIDS monitors network traffic, while HIDS monitors a single host.

IPsec uses AH for integrity/authentication and ESP for encryption; TLS VPNs protect remote access over untrusted networks.

Segmentation uses VLANs, subnets, and microsegmentation to limit lateral movement and enforce least-privilege network access.

Cloud service models are IaaS, PaaS, and SaaS; the shared responsibility split shifts toward the provider as the model moves from IaaS to SaaS.

Resilience controls include redundancy, high availability, failover, and backups; the 3-2-1 rule keeps three copies, on two media, with one offsite.

RTO is maximum tolerable downtime; RPO is maximum tolerable data loss; both drive backup frequency and recovery architecture.

Secure design principles include defense in depth, least privilege, fail-secure defaults, open design, and isolation.

Incident response phases are preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned.

Containment can be isolation, segmentation, or account disablement; eradication removes the cause, and recovery restores normal operations with monitoring.

SIEM aggregates and correlates logs; SOAR automates playbooks; EDR provides endpoint detection and response telemetry.

Backup types: full copies all selected data; incremental copies changes since the last backup; differential copies changes since the last full backup.

Restore requirements: full alone; full plus latest differential; or full plus every incremental in sequence.

Order of volatility for forensics: CPU/cache and RAM before network state, disk, and remote or archived logs.

Chain of custody records who handled evidence, when, and why; it preserves integrity and admissibility.

AAA is authentication, authorization, and accounting; RADIUS and TACACS+ centralize access control for network devices and remote users.

Risk is commonly calculated as likelihood multiplied by impact; residual risk remains after controls are applied.

Risk responses are avoid, transfer, mitigate, and accept; risk appetite is the amount an organization is willing to accept.

A risk register records identified risks, owners, likelihood, impact, treatment, and status.

Frameworks include NIST CSF, ISO/IEC 27001, and CIS Controls; compliance is meeting requirements, while security is managing actual risk.

Policy is management intent; standards are mandatory requirements; procedures are step-by-step instructions; guidelines are recommended practices.

A BIA identifies critical functions and dependencies and supports RTO and RPO decisions for business continuity and disaster recovery.

Third-party risk controls include vendor due diligence, security requirements in contracts, right-to-audit clauses, SLAs, and ongoing monitoring.

Data classification labels data by sensitivity, such as public, internal, confidential, and restricted, and determines handling and retention controls.