CompTIA Security+ Domains 1- 3

Keep data away from people who should not see it. Encryption, access controls, and classification all serve this.

Data stays accurate and unaltered except by authorized changes. Hashes, signatures, and FIM help prove it.

Systems and data are usable when needed. Think redundancy, backups, patching, and DDoS defenses.

You cannot credibly deny you did something. Digital signatures and solid audit logs are the usual proof.

Authentication, Authorization, Accounting. Prove who you are, what you can do, and keep a record of it.

Proving identity. Password, cert, token, biometric, or a mix.

Deciding what an authenticated identity is allowed to do.

Give only the access needed for the job. Nothing extra "just in case."

Split critical tasks so one person cannot complete a risky action alone.

Layer controls so one failure does not sink you. Firewall plus EDR plus MFA plus logging, etc.

Never trust by default. Continuously verify user, device, and context no matter where the request comes from.

Policies, standards, risk decisions, awareness programs. People and paperwork side of security.

Stuff systems enforce: MFA, ACLs, encryption, EDR, DLP, IDS/IPS.

Day to day processes: change management, incident response drills, vulnerability management.

Locks, badges, guards, cameras, mantraps, bollards. Tangible protection of facilities and gear.

Stops an incident before it happens. Firewall rule, MFA, allow list.

Finds something that already happened or is happening. SIEM alert, IDS, CCTV review.

Fixes after the fact. Restore from backup, patch, reimage.

Discourages an attacker. Warning banner, visible cameras, guards.

Alternate control when the preferred one is not feasible. Extra monitoring when MFA cannot be added.

Same shared key encrypts and decrypts. Fast for bulk data. AES is the modern default.

Public and private key pair. Great for key exchange, signatures, and identity. RSA and ECC are common.

Advanced Encryption Standard. Symmetric block cipher. AES 256 is what you will hear most on the exam.

One way function that outputs a fixed digest. Used for integrity and password storage. SHA 256 is common.

Random data mixed with a password before hashing so identical passwords do not share the same hash.

Run a password hash many times (PBKDF2, bcrypt, scrypt) so offline guessing gets expensive.

Hash of data signed with the sender private key. Proves integrity and who signed it.

Public Key Infrastructure. Policies, CAs, and certificates that bind public keys to identities.

Trusted issuer of digital certificates. Root CA is the trust anchor.

Certificate Signing Request. You send your public key and identity info to a CA to get a cert.

Certificate Revocation List. Published list of certs that were revoked early.

Online Certificate Status Protocol. Live check of whether a cert is still valid.

Trusted Platform Module. Hardware chip on a device that stores keys and supports secure boot and disk crypto.

Hardware Security Module. Dedicated appliance for generating and guarding enterprise crypto keys.

Replace sensitive values with tokens that map back through a vault. Common in payment systems.

Anyone or anything that can exploit a vulnerability. Nation states, criminals, insiders, hacktivists, script kiddies.

Advanced Persistent Threat. Usually nation state level. Quiet, long dwell, targeted.

Attacks for a cause. Defacements, leaks, and DDoS are typical.

Risk from someone with legitimate access. Can be malicious or just careless.

Systems or SaaS people use without IT approval. Convenience first, visibility last.

Profit driven groups. Ransomware, fraud, credential theft.

Malware that attaches to a host file and needs that file to run.

Self spreading malware that moves across networks without a user opening a file each time.

Looks useful or legit, but carries a malicious payload.

Encrypts or locks data and demands payment. Immutable backups and least privilege matter a lot.

Hides malicious activity deep in the OS. Reimaging is often safer than "cleaning."

Malware that waits for a time or condition before firing.

Lives in memory and abuses trusted tools. Behavior based EDR helps more than simple signatures.

Broad fraudulent messages, usually email, tricking people into clicking or giving up secrets.

Targeted phishing aimed at a specific person or group.

Phishing aimed at executives or other high value targets.

Voice phishing over phone or voicemail.

Phishing over SMS.

Business Email Compromise. Impersonates a trusted party to push money or data transfers.

Builds a fake story to get the victim to cooperate.

Following an authorized person into a secure area without badging in.

Compromise a site your targets already trust, then wait for them to visit.

Malicious input changes a database query. Parameterized queries are the fix.

Cross site scripting. Attacker script runs in another user browser. Encode output and use CSP.

Server is tricked into calling an attacker chosen URL. Cloud metadata endpoints are a classic target.

Move from a lower privilege account or process to a higher one.

Attacker sits between two parties and can read or alter traffic. Old name was MITM.

Rogue access point that mimics a real SSID to lure clients.

Unauthorized wireless access point plugged into your network.

Flood a service from many sources until legit users cannot get through.

Try a few common passwords across many accounts to dodge lockouts.

Vulnerability with no vendor patch yet. Defense in depth matters because you cannot just "update."

Hit a vendor or update channel so you can reach many downstream customers.

Indicator of Compromise. Evidence that something bad may have happened. Odd traffic, new admin accounts, disabled AV.

Infrastructure as a Service. You manage OS, apps, and data. Provider owns the hardware layer.

Platform as a Service. Provider runs more of the stack. You still own apps, data, and access.

Software as a Service. Provider runs the app. You still own identities, data, and config choices.

Cloud security split. Provider secures the cloud. You secure what you put in it and how you configure it.

Filters traffic by rules. NGFW adds app awareness and deeper inspection.

Web Application Firewall. Focused on HTTP attacks like SQLi and XSS.

Intrusion Detection System. Alerts on suspicious activity. Does not block by itself.

Intrusion Prevention System. Inline and can block bad traffic.

Segment for public facing services so the internet does not talk straight into the internal LAN.

Logical network segment. Needs routing and firewall policy to actually enforce security.

Fine grained isolation between workloads, common in virtual and cloud environments.

Network Access Control. Check user or device before granting network access. Often with 802.1X.

Port based network access control. Supplicant, authenticator, and authentication server.

Encrypted tunnel over an untrusted network. Can be remote access or site to site.

Network layer VPN suite. Common for site to site tunnels.

Zero Trust Network Access. Grants app specific access instead of dumping someone on the whole LAN.

Hardened admin entry point. Funnel privileged access through one monitored box.

Cloud Access Security Broker. Visibility and control for SaaS use and shadow IT.

Cloud Security Posture Management. Finds risky cloud configs like public buckets.

On failure, deny access or shut down. Safer default for many security devices.

Recovery Time Objective. How long a system can be down before the business is in real trouble.

Recovery Point Objective. How much data loss you can tolerate, measured in time.

Near ready disaster recovery site with systems and recent data. Fast and expensive.

Partially ready DR site. Hardware may be there, but data and config still need work.

Facility with power and space. You bring everything else. Cheap and slow.

Copy everything selected. Slowest backup, simplest restore.

Only changes since the last backup of any type. Fast backup, more pieces to restore.

Stored data on disk, database, or object storage. Encrypt and control access.

Data moving across a network. Protect with TLS or VPN.

Data actively processed in memory or by an app. Access control and secure enclaves matter here.

Data Loss Prevention. Detect or block sensitive data from leaving in email, USB, cloud, etc.

SSH. Secure remote shell and SFTP. Preferred over Telnet.

Telnet. Cleartext remote shell. Replace with SSH.

HTTP. Unencrypted web. Prefer HTTPS on 443.

HTTPS. Web and APIs over TLS.

LDAPS. LDAP wrapped in TLS.

RDP. Encrypted but high risk if exposed. Restrict, MFA, jump hosts.

SMB. Windows file sharing. A favorite lateral movement target.

DNS. Name resolution. Watch it for malware callback patterns too.

Kerberos. Ticket based auth in Windows domains.