Cybersecurity Fundamentals Flashcards

Question 1

What does the CIA triad stand for in information security?

Accepted Answer

The CIA triad stands for confidentiality, integrity, and availability, three goals that security programs aim to protect. Confidentiality means only authorized people can view information. Integrity means data stays accurate and is not changed improperly. Availability means systems and data remain accessible to authorized users when needed.

Question 2

What is the difference between a vulnerability and a threat?

Accepted Answer

A vulnerability is a weakness in a system, process, or design that could be exploited, while a threat is any person, event, or circumstance that could take advantage of that weakness. Risk combines how likely a threat is to exploit a vulnerability with the impact if it does.

Question 3

What does the principle of least privilege require?

Accepted Answer

The principle of least privilege requires that every user, program, or process receives only the minimum access rights needed to perform its legitimate tasks, and no more. This limits the damage a compromised account or faulty program can cause. Access should also be reviewed regularly and removed when no longer needed.

Question 4

How does the defense in depth strategy protect an organization?

Accepted Answer

Defense in depth protects an organization by layering several independent security controls, so that if one control fails, others still stand between an attacker and valuable assets. Layers can include policies, physical locks, firewalls, endpoint protection, encryption, and user training. No single control is treated as perfect.

Question 5

What does the term security by design mean?

Accepted Answer

Security by design means building security into a system from the start of its development rather than adding it afterward. Designers consider threats during planning, minimize attack surfaces, and use secure defaults. This approach is generally cheaper and more effective than patching flaws later.

Question 6

What is the purpose of a security policy?

Accepted Answer

A security policy is a written document that states an organization's security goals, rules, and responsibilities, giving staff clear expectations about acceptable behavior. It supports consistent decisions and provides a basis for audits and enforcement. Policies are usually supported by more detailed standards and procedures.

Question 7

How do preventive and detective security controls differ from each other?

Accepted Answer

Preventive controls try to stop an incident before it happens, such as locked doors, password requirements, or input validation. Detective controls identify incidents that are happening or have already happened, such as log monitoring, intrusion alerts, or security cameras. Many programs also use corrective controls to restore systems after an event.

Question 8

What does a security baseline describe for a computer system?

Accepted Answer

A security baseline describes the minimum set of security settings a system must have, such as disabled unused services, enforced strong passwords, and current software updates. Organizations use baselines to make configurations consistent and to measure drift from the expected state. Baselines are often based on recognized hardening guidance and reviewed periodically.

Question 9

What is the general term malware, and what does it cover?

Accepted Answer

Malware is short for malicious software, a broad term for programs designed to damage, disrupt, or gain unauthorized access to systems. It includes viruses, worms, trojans, ransomware, spyware, and rootkits. Malware often spreads through email attachments, infected downloads, or exploited software flaws.

Question 10

How does ransomware typically harm its victims in practice?

Accepted Answer

Ransomware encrypts a victim's files or locks its systems, then demands payment, often in cryptocurrency, in exchange for a decryption key or restored access. Attackers may also threaten to leak stolen data. Paying does not guarantee recovery, so reliable offline backups are a key defense.

Question 11

What is phishing and how does it usually work?

Accepted Answer

Phishing is a social engineering attack in which a message, often an email or text, pretends to come from a trusted source to trick the recipient into revealing credentials, opening a malicious file, or sending money. Messages often create urgency or fear. Spear phishing targets a specific person with tailored details.

Question 12

What is social engineering, and why is it effective?

Accepted Answer

Social engineering is the manipulation of people into performing actions or divulging information that helps an attacker, rather than breaking technical controls directly. It works because it exploits trust, curiosity, urgency, and habits. Pretexting, baiting, and tailgating are common examples. Strong verification procedures and staff training reduce its success.

Question 13

What is a denial-of-service attack, and what is its goal?

Accepted Answer

A denial-of-service attack aims to make a system, network, or service unavailable to its legitimate users by overwhelming it with traffic or exhausting its resources. A distributed version uses many compromised machines to amplify the flood. Attacks may target bandwidth, processing capacity, or application logic.

Question 14

What is an insider threat, and why is it hard to detect?

Accepted Answer

An insider threat is a risk posed by a current or former employee, contractor, or partner who has legitimate access and misuses it, either maliciously or through carelessness. It is hard to detect because the activity often looks like normal work. Monitoring, least privilege, and prompt access removal help reduce this risk.

Question 15

What is a zero-day vulnerability, and why is it dangerous?

Accepted Answer

A zero-day vulnerability is a software flaw that is unknown to the vendor or unpatched at the time it is exploited, so defenders have no fix available. It is dangerous because standard signature-based defenses may not recognize attacks that use it. Layered controls and rapid response help limit the damage.

Question 16

How do attackers differ when they are motivated by financial gain versus espionage?

Accepted Answer

Financially motivated attackers usually seek money through theft, fraud, or ransomware, and they tend to act opportunistically against many targets. Espionage actors seek confidential information such as trade secrets, government data, or intellectual property, and often operate patiently and quietly for long periods. Motivation shapes the tactics, targets, and detection challenges.

Question 17

What is the difference between authentication and authorization?

Accepted Answer

Authentication verifies who a user claims to be, usually by checking credentials such as a password, token, or biometric. Authorization determines what an authenticated user is allowed to do, such as reading a file or changing settings. A system must authenticate a user before it can authorize actions.

Question 18

What is multifactor authentication, and why is it stronger?

Accepted Answer

Multifactor authentication requires a user to present two or more different kinds of evidence, such as something they know, something they have, or something they are. Because an attacker must compromise more than one factor, a stolen password alone is usually not enough. Authenticator apps and hardware security keys are common examples.

Question 19

Why is password reuse across several websites a security risk?

Accepted Answer

Password reuse is risky because a breach at one website can expose the same username and password that attackers then try on other services, a technique called credential stuffing. Unique passwords for each account limit this spread. A password manager can generate and store them securely.

Question 20

What is role-based access control, and how does it work?

Accepted Answer

Role-based access control grants permissions to defined roles, such as accountant or help desk technician, and then assigns users to those roles. Users inherit the permissions of their roles, so access changes can be made by updating a role instead of each individual account. This approach supports least privilege and simplifies audits.

Question 21

How does an access control list differ from role-based access control?

Accepted Answer

An access control list attaches permissions directly to a specific resource, listing which users or groups may perform which actions on it. Role-based control instead ties permissions to job functions, so users receive access through roles. Access control lists give fine detail per object, while roles are easier to manage at scale.

Question 22

What is a session token, and why must it be protected?

Accepted Answer

A session token is a value a server issues after login so that it can recognize subsequent requests from the same user without asking for the password again. Anyone who steals a valid token can act as that user, so tokens should be transmitted over encrypted connections, given expiration times, and invalidated at logout.

Question 23

Why is separation of duties useful in access control?

Accepted Answer

Separation of duties divides a critical task among several people so that no single individual can complete it alone and commit fraud or error undetected. For example, the person who requests a payment should not also approve it. This control reduces the chance of misuse and makes wrongdoing require collusion.

Question 24

What is single sign-on, and what risk does it introduce?

Accepted Answer

Single sign-on lets a user log in once with one set of credentials and then access several related applications without re-entering them. It improves convenience and reduces password fatigue. The risk is that compromising the single login can expose every connected system, so it should be paired with strong authentication and monitoring.

Question 25

What is encryption, and what does it protect?

Accepted Answer

Encryption is the process of transforming readable data, called plaintext, into an unreadable form, called ciphertext, using an algorithm and a key. Only someone with the correct key can reverse the process and recover the original data. Encryption protects confidentiality of data both in storage and while it moves across networks.

Question 26

What is the difference between symmetric and asymmetric encryption?

Accepted Answer

Symmetric encryption uses the same secret key for both encrypting and decrypting, so both parties must share that key securely. Asymmetric encryption uses a mathematically linked pair of public and private keys, where the public key can be shared openly and the private key stays secret. Symmetric methods are usually faster.

Question 27

What is hashing, and how does it differ from encryption?

Accepted Answer

Hashing converts input of any size into a fixed-length digest using a one-way function, so the original data cannot be recovered from the output. Encryption is reversible with the right key, while hashing is designed to be one-way. Hashes are useful for verifying data integrity and for storing passwords more safely.

Question 28

Why should passwords be stored as salted hashes instead of plain text?

Accepted Answer

Passwords should be stored as salted hashes so that a stolen database does not directly reveal the passwords. A salt is a random value added to each password before hashing, which prevents identical passwords from producing identical hashes and defeats precomputed lookup tables. Systems should use slow, purpose-built password hashing functions.

Question 29

What is a digital signature used for in security systems?

Accepted Answer

A digital signature uses a private key to create a value that anyone can verify with the matching public key. It provides authentication of the sender, integrity of the signed data, and non-repudiation, meaning the signer cannot easily deny having signed. Software updates and certificates commonly rely on digital signatures.

Question 30

What is the main purpose of Transport Layer Security (TLS)?

Accepted Answer

Transport Layer Security protects data moving between two systems by providing encryption, integrity checking, and server authentication, typically through certificates. It is the basis for HTTPS, which secures web traffic. Clients verify the server's identity before exchanging data, helping prevent eavesdropping and tampering.

Question 31

What is a public key certificate and who issues it?

Accepted Answer

A public key certificate binds a public key to an identity, such as a website or organization, and is digitally signed by a trusted certificate authority. Browsers and operating systems contain lists of trusted authorities, so they can check whether a certificate is genuine and unexpired.

Question 32

Why is it important to use well-tested cryptographic libraries instead of custom code?

Accepted Answer

Using well-tested cryptographic libraries is important because designing secure cryptography is extremely difficult, and subtle implementation errors can break even strong algorithms. Established libraries have been reviewed by experts and are maintained to address newly discovered flaws. Custom code often introduces weaknesses such as poor randomness or timing leaks.

Question 33

What does a firewall do in a network?

Accepted Answer

A firewall controls network traffic by inspecting packets and allowing or blocking them according to defined rules, such as permitted source addresses, destination ports, and protocols. It creates a boundary between trusted and untrusted networks. Firewalls work best as one layer among others, since they cannot stop every attack.

Question 34

What is the difference between an intrusion detection system and an intrusion prevention system?

Accepted Answer

An intrusion detection system monitors traffic or host activity and alerts staff when it sees suspicious behavior, but it does not block the activity itself. An intrusion prevention system sits inline or responds automatically to stop suspected attacks. Detection-only tools are often safer to deploy first, because blocking false positives can disrupt legitimate business.

Question 35

What is network segmentation, and why does it help?

Accepted Answer

Network segmentation divides a larger network into smaller isolated zones, each with its own access rules, so traffic between them is restricted and controlled. It helps contain an intrusion, because an attacker who compromises one segment cannot freely reach sensitive systems in others. Segmentation also limits the spread of malware and simplifies monitoring.

Question 36

Why is timely patch management important for reducing security risk?

Accepted Answer

Timely patch management means applying vendor updates that fix known vulnerabilities, closing weaknesses before attackers exploit them. Because attackers often target publicly known flaws soon after disclosure, delays leave systems exposed. Effective programs inventory assets, test updates, prioritize by risk, and verify that patches were actually installed.

Question 37

What should a basic incident response plan include, and why?

Accepted Answer

A basic incident response plan defines roles, contact lists, and steps for preparation, detection, containment, eradication, recovery, and lessons learned. Having these steps written in advance lets teams act calmly and quickly instead of improvising during a crisis. Practicing the plan through tabletop exercises reveals gaps before a real incident occurs.

Question 38

Why should backups be stored offline or separated from the main network?

Accepted Answer

Backups should be kept offline or separated from the main network so that malware or an attacker with network access cannot encrypt or delete them along with the production data. Regular testing of restores confirms that backups are complete and usable.

Question 39

What is a virtual private network, and what does it provide?

Accepted Answer

A virtual private network creates an encrypted tunnel between a device and another network across an untrusted network. It protects data in transit from eavesdropping and can authenticate the device or user. A VPN does not make a device safe by itself, since malware on the device can still act within the tunnel.

Question 40

What is the purpose of security logging and monitoring?

Accepted Answer

Security logging records events such as logins, configuration changes, and network connections, while monitoring reviews those records to detect suspicious activity. Together they provide evidence for investigations, support compliance reviews, and help responders understand what happened. Logs must be protected from tampering and kept long enough to be useful.

Cybersecurity Fundamentals Flashcards

1Core Security Principles

2Threats and Attackers

3Authentication and Access Control

4Cryptography Basics

5Network and Operational Defense

Learning Resources