Free CC Exam Flashcards

Protecting information from unauthorized disclosure. It matters because privacy, trade secrets, credentials, and regulated data lose value or create legal risk when exposed.

Keeping data accurate, complete, and protected from unauthorized change. Integrity controls matter when decisions depend on trustworthy records, logs, transactions, or configurations.

Ensuring systems and data are accessible to authorized users when needed. Availability matters because outages can stop business operations, patient care, payments, or public services.

Assurance that someone cannot credibly deny an action they performed. Digital signatures, audit logs, and strong identity proofing support accountability in disputes and investigations.

Appropriate collection, use, sharing, retention, and protection of personal information. Privacy matters because security controls must respect legal obligations and individual rights.

The process of identifying threats, vulnerabilities, likelihood, and impact. It matters because controls should be selected based on real risk rather than guesswork or fear.

Reducing risk by applying controls such as patching, training, segmentation, or monitoring. Mitigation lowers likelihood, impact, or both when risk is not acceptable.

Shifting part of the financial impact of risk to another party, often through insurance or contracts. It does not eliminate the underlying security responsibility.

A formal decision to live with a known risk. It matters because acceptance should be documented by an authorized owner, not quietly ignored by a technician.

A policy, procedure, standard, training program, or governance process. Administrative controls guide behavior and define what technical and physical controls must enforce.

A technology-based safeguard such as MFA, encryption, firewalls, access control lists, or endpoint protection. Technical controls enforce security decisions through systems.

A safeguard that protects facilities, devices, and people, such as locks, guards, badges, cameras, and fences. Physical access can bypass many logical controls.

A control designed to stop an incident before it happens, such as MFA, hardening, or deny-by-default firewall rules. Prevention reduces opportunities for attack.

A control that identifies events after or while they occur, such as logs, alerts, IDS, or camera review. Detection matters because prevention is never perfect.

A control that restores or repairs after an incident, such as backups, reimaging, or incident remediation. Corrective controls reduce impact and recovery time.

Planning to keep essential business functions operating during disruption. It matters because the organization may need alternate processes before full systems are restored.

Restoring IT systems, data, and infrastructure after a major outage or disaster. Disaster recovery is narrower than business continuity and focuses on technology recovery.

The organized process for handling suspected or confirmed security events. It matters because evidence, containment, communication, and recovery must follow a known plan.

Recovery Time Objective: the maximum acceptable time a system or process can be down. RTO guides recovery priority and continuity investment.

Recovery Point Objective: the maximum acceptable amount of data loss measured in time. RPO drives backup frequency, replication, and recovery design.

A post-incident review that identifies what worked, what failed, and what should change. It matters because response plans improve only when findings become actions.

Claiming an identity, such as entering a username or presenting an account number. Identification starts access control but does not prove the claim is true.

Proving an identity with factors such as passwords, tokens, biometrics, or certificates. Authentication matters because access decisions rely on knowing who is requesting access.

Granting permissions after identity is established. Authorization answers what an authenticated user or process is allowed to do.

The ability to trace actions to a responsible subject through unique accounts and logs. Shared accounts weaken accountability and complicate investigations.

Multifactor authentication uses two or more different factor types: something you know, have, or are. It reduces account takeover risk if one factor is compromised.

Giving users and systems only the access needed for their duties. It matters because smaller permissions reduce damage from mistakes, misuse, and compromise.

Splitting sensitive tasks among different people or roles. It helps prevent fraud and errors, such as one person both creating and approving payments.

Role-Based Access Control assigns permissions to job roles rather than individual users one by one. RBAC simplifies administration and supports consistent least privilege.

Mandatory Access Control enforces access based on labels and central policy, not user discretion. It is common in highly controlled environments with classification requirements.

Discretionary Access Control lets resource owners decide who can access their objects. It is flexible but can create risk if owners grant access too broadly.

A seven-layer model for understanding network communication: physical, data link, network, transport, session, presentation, and application. It helps locate where problems or controls apply.

TCP is connection-oriented and reliable; UDP is connectionless and lower overhead. Security questions often use this distinction when discussing ports, scanning, and service behavior.

A control that filters traffic based on rules such as source, destination, port, protocol, or application. Firewalls reduce exposure but need correct placement and rules.

An IDS detects and alerts; an IPS can block or prevent traffic inline. The difference matters because prevention can disrupt traffic while detection may require response action.

A Virtual Private Network creates an encrypted tunnel over an untrusted network. VPNs protect remote access traffic but still require authentication and endpoint security.

Dividing a network into zones or segments with controlled communication paths. Segmentation limits lateral movement and keeps sensitive systems away from broad access.

A demilitarized zone is a network segment for public-facing services separated from internal networks. It limits the impact if an exposed service is compromised.

A Virtual LAN logically separates network traffic on shared infrastructure. VLANs support segmentation but must be paired with routing and access controls.

Domain Name System translates names to IP addresses. If a host works by IP but not by name, DNS or name resolution is a likely troubleshooting clue.

Dynamic Host Configuration Protocol assigns IP settings such as address, gateway, and DNS server. DHCP problems can prevent devices from joining a network correctly.

Transforming readable data into unreadable ciphertext using a key. Encryption protects confidentiality for data at rest and in transit when keys are managed properly.

Creating a fixed-length digest from data. Hashing supports integrity checks because a changed file should produce a different hash.

Labeling data by sensitivity, value, or handling requirements. Classification matters because controls should match the importance and risk of the information.

Keeping information for the required period and disposing of it when no longer needed. Retention balances business, legal, privacy, and storage requirements.

Destroying or sanitizing data and media so information cannot be recovered. It matters when retired drives, documents, or devices contain sensitive data.

Collecting and reviewing system activity for errors, attacks, and policy violations. Logs support detection, accountability, troubleshooting, and incident investigation.

Testing, approving, and applying updates that fix vulnerabilities or defects. Patch management reduces known attack paths while managing change risk.

Education that helps users recognize threats, handle data correctly, and follow policy. It matters because people are part of the control environment.

A controlled process for requesting, reviewing, testing, approving, and documenting changes. It reduces outages and security drift caused by unmanaged modifications.