SESKStuff Everyone Should Know

Games · Tech, AI & Security

Stuff Every Security Pro Should Know

Study for the CompTIA Security+ exam: threats, architecture, operations and governance.

Start Stuff Every Security Pro Should Know ⚡ Today's sprint

Print the first 50 cards (free)Get the whole test as a printable PDF: $3 (pre-order)

Free to start, no sign-up. 100 cards so far. One Knowledge Score and day streak across all your courses.

Try 3 cards

  1. Encrypting a laptop's files mainly protects which part of the CIA triad?
    Show the answer

    Confidentiality. Confidentiality means only authorized people can read information. Encryption scrambles the data so a thief without the key sees nothing useful.

  2. A file's hash value no longer matches after someone edits the file. Which CIA property was affected?
    Show the answer

    Integrity. Integrity means information is not improperly modified or destroyed. A hash works like a fingerprint, so a changed file gives a different value.

  3. A flood of fake traffic knocks a website offline. Which CIA property does this attack target?
    Show the answer

    Availability. Availability means timely, reliable access to information and services. Denial of service attacks prevent authorized users from getting in.

All 100 practice questions

Each one has the answer, why it's right, and the official sources. Or play them as a game and track what you've learned.

Show all 100 questions
  1. Encrypting a laptop's files mainly protects which part of the CIA triad?
  2. A file's hash value no longer matches after someone edits the file. Which CIA property was affected?
  3. A flood of fake traffic knocks a website offline. Which CIA property does this attack target?
  4. Which assurance does a digital signature add so a signer cannot later deny signing?
  5. You sign in, and then the system decides which folders you may open. What is that second step?
  6. What is the core premise of zero trust architecture?
  7. In NIST's zero trust model, which component makes the final decision to grant access to a resource?
  8. Which one of these is a security control category, rather than a control type?
  9. A system cannot use the normal required control. What do you call the alternative that gives comparable protection?
  10. Giving each user only the access needed for their assigned tasks follows which principle?
  11. A server set up only to attract attackers so defenders can study them is called what?
  12. Which key lengths does the Advanced Encryption Standard (AES) support?
  13. Which key does a recipient use to verify a digital signature?
  14. How long is a SHA-256 hash output, called the message digest?
  15. Published attacks show MD5 is not prudent to use when you need which property?
  16. Adding a unique random salt to each password before hashing mainly defends against what?
  17. NIST's digital identity guidelines say a password salt must be at least how long?
  18. Which of these is a poor choice for storing passwords because it is a fast hash?
  19. A tamper-resistant chip on a computer's motherboard that generates and stores cryptographic keys is called what?
  20. What do you send to a certificate authority to request a certificate?
  21. What is a certificate revocation list (CRL)?
  22. Which protocol lets software check the revocation status of a certificate online, more timely than CRLs?
  23. A wildcard certificate for *.example.com is presented. Which name does it match?
  24. What did TLS 1.3 change about key exchange?
  25. What cryptographically links each block in a blockchain to the one before it?
  26. Which threat actor already has authorized access to an organization's systems?
  27. Tricking a person into revealing information or taking a harmful action is called what?
  28. What is phishing called when it targets a specific person, company or industry?
  29. Phishing carried out over a phone call is commonly called what?
  30. Compromising a website that a target group often visits, to infect them, is called what?
  31. Registering a domain that looks like a real one, such as exmple.com, is called what?
  32. Which malware spreads by inserting copies of itself into host programs or data files?
  33. Which malware is self-contained and spreads across a network on its own, without user action?
  34. Which malware looks like a useful program but has a hidden malicious purpose and does not replicate?
  35. Malware that hides its own presence by modifying operating system functions is called what?
  36. Code intentionally hidden in software that triggers a malicious action when conditions are met is called what?
  37. Malware that encrypts your files and demands payment for the decryption key is called what?
  38. Which web attack inserts a database query into an input field that the application then runs?
  39. Which web attack injects malicious scripts into otherwise trusted websites so they run in other users' browsers?
  40. Which attack forces a logged-in user's browser to perform an action they did not intend?
  41. Using sequences like ../ to reach files outside a web application's folder is called what?
  42. Capturing valid login data and sending it again later to impersonate a user is called what?
  43. An attacker secretly positions themselves between two devices to sniff or change their traffic. What is this attack called?
  44. Trying stolen username and password pairs from one breach against other websites is called what?
  45. Trying one common password against many different accounts is called what?
  46. In a reflection DDoS attack, what do attackers send to third-party servers?
  47. A user signs in from Nashville and, ten minutes later, from Tokyo. Which indicator of compromise is this?
  48. Which hardening step reduces the attack surface by removing what a system does not need?
  49. A list of applications authorized to run, with everything else blocked by default, is called what?
  50. Which control limits how many failed login attempts can be made on an account?
  51. In which cloud service model does the customer control the operating system but not the physical hardware?
  52. A developer deploys their own app on a provider's platform without managing servers or the operating system. Which model is that?
  53. Which cloud model describes using ready-made apps such as Microsoft 365, with the provider running nearly everything?
  54. What do you call a cloud made of two or more distinct clouds (private, community or public) bound by shared technology?
  55. Under Microsoft's shared responsibility model, who owns and must protect your data and identities in every cloud deployment type?
  56. Which of these address blocks is reserved for private networks by RFC 1918?
  57. Where do network designers commonly place public-facing web and email servers behind a firewall?
  58. NIST recommends a DMZ architecture to stop what kind of direct traffic in industrial environments?
  59. In disaster recovery, what does the Recovery Time Objective (RTO) measure?
  60. In disaster recovery, what does the Recovery Point Objective (RPO) describe?
  61. How should a system's Recovery Time Objective compare with its Maximum Tolerable Downtime?
  62. To restore from differential backups, which backup sets do you need?
  63. Which alternate processing site is fully equipped and ready to take over with the shortest setup time?
  64. What does NIST say to do first about services and protocols when hardening a new server's OS?
  65. What is it called when a firewall blocks all traffic that has not been expressly permitted?
  66. What can an intrusion prevention system (IPS) do that a plain intrusion detection system (IDS) cannot?
  67. Which NIST media sanitization method also leaves the media unusable for storing data afterward?
  68. TACACS+ is used for network device administration. Which transport and port does it use?
  69. On which port do Kerberos servers (KDCs) listen for requests by default?
  70. In TOTP (RFC 6238), what is the default time step for a one-time code?
  71. Under NIST SP 800-63B-4, what is the minimum length for a password used as the only authentication factor?
  72. What does NIST SP 800-63B-4 say about password rules like requiring a mix of symbols, digits and capitals?
  73. Splitting a sensitive task, like creating and approving payments, among different people is called what?
  74. In syslog (RFC 5424), which severity code is the most severe?
  75. Why does NIST advise using NTP to keep log sources' clocks consistent?
  76. What does a SIEM mainly do with the log data it collects?
  77. In a DMARC record, which policy value says the domain owner wants failing mail rejected?
  78. On the CVSS qualitative severity scale, which Base Score range is rated Critical?
  79. In CVSS v4.0, which metric group covers characteristics that change over time, such as exploit code becoming available?
  80. In CVSS, which Attack Vector value scores highest because the attacker can be anywhere on the internet?
  81. In CVSS v4.0, what effect do Supplemental metrics have on the final score?
  82. A legacy device can no longer be patched because the vendor ended support. What does NIST SP 800-40r4 suggest?
  83. In NIST's classic incident response life cycle (SP 800-61 Rev. 2), which phase follows Detection and Analysis?
  84. What is the purpose of a lessons learned meeting after a major security incident?
  85. Which list names all six functions of NIST Cybersecurity Framework 2.0?
  86. When collecting evidence from a live compromised system, which data should you capture first?
  87. According to RFC 3227, what should you avoid doing to a compromised system until evidence collection is complete?
  88. What does a chain of custody record for digital evidence?
  89. In digital forensics, what is a write-blocker used for?
  90. In NIST SP 800-86's forensic process, which phase comes right after collection?
  91. In security testing, what do the rules of engagement (ROE) do?
  92. What is a tabletop exercise in incident response planning?
  93. Which governance document gives detailed, step-by-step instructions for carrying out a security task?
  94. In NIST SP 800-30, risk is a function of which two factors?
  95. Buying cyber insurance to shift financial loss to an insurer is which type of risk response?
  96. Which term describes the broad amount of risk an organization is willing to accept in pursuit of its mission?
  97. Under FIPS 199, a loss of confidentiality, integrity or availability with a serious adverse effect is rated at which impact level?
  98. Which is an awareness activity that NIST SP 800-50 Rev. 1 says suits all users?
  99. NIST describes C-SCRM as a systematic process for managing cybersecurity risk exposure where?
  100. What does a business impact analysis (BIA) help an organization identify and prioritize?