Contrast Cross-Site Request Forgery (CSRF) and Server-Side Request Forgery (SSRF).

CSRF tricks an authenticated user's browser into transmitting unauthorized commands to a vulnerable web application where the user is already logged in, piggybacking on existing session cookies (mitigated by anti-CSRF tokens and SameSite cookies). SSRF exploits a vulnerable web server into forging HTTP requests to internal, non-internet-facing internal infrastructure.

How does SQL Injection (SQLi) occur, and what is the primary defensive programming technique to eliminate it?

SQLi occurs when untrusted user input is directly concatenated into a dynamic SQL query, allowing an attacker to manipulate SQL syntax (e.g., `' OR '1'='1`). Primary defense: Prepared Statements with Parameterized Queries, which treat all user inputs strictly as data literals rather than executable SQL code, combined with stored procedures and input validation.

Define Recovery Time Objective (RTO), Recovery Point Objective (RPO), MTBF, and MTTR.

RTO: maximum acceptable duration of system downtime before business operations must be restored. RPO: maximum acceptable data loss measured in time (how far back data must be recovered). MTBF (Mean Time Between Failures): average operating time between hardware failures, measuring reliability. MTTR (Mean Time to Repair): average time required to repair or replace a failed system.

Compare Signature-Based, Anomaly-Based, and Heuristic Detection engines.

Signature-Based: compares network traffic or file hashes against a database of known threat patterns; highly accurate for known malware but blind to zero-day attacks. Anomaly-Based: establishes a baseline of normal network activity and alerts on statistical deviations; detects novel attacks but suffers from high false-positive rates. Heuristic: uses rules of thumb and algorithmic logic to detect suspicious behavior.

What are the five authentication factor categories in Multi-Factor Authentication (MFA)?

1. Something you know (password, PIN); 2. Something you have (smartcard, hardware token, TOTP authenticator app); 3. Something you are (biometrics: fingerprint, facial recognition, retina scan); 4. Somewhere you are (GPS coordinates, specific IP subnet); 5. Something you do (typing cadence, gait, handwriting dynamics). True MFA requires at least two DIFFERENT factor categories.

Compare SAML 2.0, OAuth 2.0, and OpenID Connect (OIDC) regarding federation, authentication, and authorization.

SAML 2.0: XML-based protocol providing web-based Single Sign-On (SSO) and federated authentication between an Identity Provider (IdP) and Service Provider (SP). OAuth 2.0: token-based framework designed strictly for API authorization/delegation (issuing scoped access tokens). OpenID Connect (OIDC): lightweight identity/authentication layer built directly on top of OAuth 2.0 using JSON Web Tokens (JWT).

Compare Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) in deployment and response.

IDS: deployed out-of-band via switch SPAN port or network TAP; passively monitors traffic copies; detects attacks and generates alerts, but cannot block malicious traffic in real time. IPS: deployed in-line directly in the network data path; actively inspects packets as they transit and can immediately drop malicious packets, terminate TCP sessions (TCP reset), and reconfigure firewall rules.

Compare Black Box, White Box, and Gray Box penetration testing.

Black Box: tester has zero prior knowledge of target environment, simulating an unprivileged external attacker. White Box (Clear Box): tester has full access to architectural documentation, source code, network diagrams, and credentials, simulating an insider or rigorous audit. Gray Box: tester has partial knowledge (e.g., standard user credentials), simulating an insider or contractor.

In a Public Key Infrastructure (PKI), compare Certificate Revocation Lists (CRLs), OCSP, and OCSP Stapling.

CRL: CA publishes a periodic list of revoked certificates; clients download large files, creating latency and bandwidth overhead. OCSP: client queries CA responder in real-time; causes latency and leaks client browsing history to CA. OCSP Stapling: web server periodically queries CA for signed OCSP response and 'staples' it directly to the initial TLS handshake, eliminating CA bottlenecks and privacy concerns.

What are the six phases of the NIST SP 800-61 Incident Response Lifecycle?

1. Preparation (tools, policies, team training); 2. Detection and Analysis (identifying and validating security incidents); 3. Containment (short-term isolation and segmentation); 4. Eradication (removing malware, eliminating root causes); 5. Recovery (restoring systems from clean backups and testing); 6. Post-Incident Activity (Lessons Learned review to improve posture).

Compare Stored XSS, Reflected XSS, and DOM-based Cross-Site Scripting (XSS).

Stored XSS: malicious JavaScript is permanently stored in a database (e.g., comment section) and executes in victim browsers when viewing the page. Reflected XSS: malicious script is embedded in a URL/link and reflected off the web server in the immediate response. DOM-based XSS: attack payload executes entirely client-side in the browser's Document Object Model without server reflection.

Explain the AAA Security Framework: Authentication, Authorization, and Accounting.

Authentication: proves the identity of a subject requesting access (e.g., credentials, certificates, biometrics). Authorization: determines what permissions, resources, and actions the authenticated subject is allowed to access (e.g., ACLs, RBAC policies). Accounting: tracks and logs the actions, duration, and resource utilization performed by the subject (e.g., audit trails, SIEM).

Compare Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR).

EDR: endpoint-installed software agent that continuously monitors, records host telemetry, detects behavioral anomalies, and automates host-level remediation (isolation, process termination). XDR: unifies and correlates detection telemetry across endpoints, network infrastructure, cloud workloads, and identity providers into a centralized console for coordinated threat response.

Explain the mechanics of a Rogue Access Point, an Evil Twin, and a Wi-Fi Deauthentication Attack.

Rogue AP: unauthorized access point connected directly to an enterprise wired network without IT permission. Evil Twin: rogue AP configured with identical SSID and MAC to a legitimate AP, overpowering the signal to harvest user credentials. Deauthentication Attack: spoofed 802.11 management frames sent to disconnect clients from an AP, forcing re-association to capture WPA handshakes.

Compare Virus, Worm, Trojan, Rootkit, and Ransomware malware mechanisms.

Virus: attaches to host file and requires human action to execute and spread. Worm: standalone self-replicating malware that spreads autonomously across network vulnerabilities without user intervention. Trojan: appears benign/useful but conceals a malicious payload. Rootkit: gains kernel/ring-0 access and conceals processes/files from OS detection. Ransomware: encrypts victim files and extorts cryptocurrency payment for decryption.

Why does Elliptic Curve Cryptography (ECC) provide significant advantages over RSA in modern cryptosystems?

ECC provides equivalent mathematical security strength with drastically smaller key sizes (e.g., a 256-bit ECC key offers comparable security to a 3072-bit RSA key). This results in significantly faster computations, reduced memory usage, lower network transmission overhead, and reduced battery power consumption on mobile and IoT devices.

In security governance, distinguish between Policies, Standards, Baselines, and Guidelines.

Policies: high-level executive statements of management intent, governance, and organizational direction; mandatory. Standards: specific, mandatory technical rules, protocols, or requirements that support policies. Baselines: minimum acceptable security configurations or operational thresholds. Guidelines: recommended best practices and operational guidance; discretionary/non-mandatory.

Compare Discretionary Access Control (DAC), Mandatory Access Control (MAC), and Attribute-Based Access Control (ABAC).

DAC: resource owner has complete discretion to assign permissions to other users (common in NTFS/Linux file permissions). MAC: OS enforces access based on fixed security labels (e.g., Confidential, Secret) and subject clearances; users cannot alter permissions (SELinux). ABAC: dynamically evaluates policies based on user attributes, resource attributes, environment context (time/location), and action requested.

Compare AES operating modes: Electronic Codebook (ECB), Cipher Block Chaining (CBC), and Galois/Counter Mode (GCM).

ECB: encrypts identical 128-bit plaintext blocks into identical ciphertext blocks, preserving data patterns; cryptographically insecure. CBC: XORs each plaintext block with the previous ciphertext block using an Initialization Vector (IV); provides confidentiality but no integrity. GCM: counter-based mode providing both high-speed encryption and built-in cryptographic integrity/authentication (AEAD).

Compare the security functions of CASB, CSPM, and CWPP in cloud security.

CASB (Cloud Access Security Broker): enforces enterprise security, DLP, and compliance policies between on-prem users and cloud SaaS applications. CSPM (Cloud Security Posture Management): continuously scans cloud infrastructure (IaaS) for configuration drifts, compliance violations, and public storage exposure. CWPP (Cloud Workload Protection Platform): secures VMs, containers, and serverless functions.

Distinguish between Salting, Pepper, and Key Stretching (bcrypt, PBKDF2, Argon2) in password storage.

Salt: unique random string appended to each password before hashing to defeat precomputed rainbow tables. Pepper: secret constant value stored separately (e.g., HSM) appended across all passwords. Key Stretching: deliberately runs hashing through thousands of iterations/work factors (bcrypt, PBKDF2, Argon2) to make GPU/ASIC offline brute-force attacks computationally infeasible.

What are the foundational principles of Zero Trust Architecture (ZTA)?

Core tenet: 'Never trust, always verify.' Key principles: 1. Assume breach (treat internal network as hostile); 2. Explicitly verify all access requests based on all available data points (identity, location, device health, service context); 3. Apply Least Privilege access (Just-In-Time and Just-Enough-Access); 4. Implement micro-segmentation to prevent lateral movement.

Compare Stateless Packet Filtering, Stateful Inspection, and Next-Generation Firewalls (NGFW).

Stateless: inspects individual packets against static IP/port header rules in isolation; cannot track connection state. Stateful: tracks full TCP/UDP connection state in a dynamic state table, automatically allowing return traffic. NGFW: inspects traffic at Layer 7 (Application layer), performs Deep Packet Inspection (DPI), detects application-specific attacks, and integrates IPS and SSL/TLS decryption.

In cloud computing, compare customer versus provider responsibilities under the Shared Responsibility Model across IaaS, PaaS, and SaaS.

IaaS: provider manages physical datacenter, hypervisor, and hardware; customer manages OS, middleware, runtime, applications, and data. PaaS: provider manages hardware, OS, and runtime environment; customer manages applications and data. SaaS: provider manages entire underlying software stack, infrastructure, and updates; customer is responsible only for data and access configuration.

What is the difference between Polymorphic Malware and Metamorphic Malware?

Polymorphic Malware modifies its external appearance, decryptor routine, or encryption key with every infection while keeping the core underlying payload unchanged, altering its file hash. Metamorphic Malware completely rewrites, decompiles, and re-engineers its own internal code structure and logic each generation, altering both hash and behavioral signature.

Distinguish between Phishing, Spear Phishing, Whaling, Vishing, Smishing, and Watering Hole attacks.

Phishing: mass broadcast deceptive emails. Spear Phishing: highly customized attack targeting a specific individual or organization. Whaling: spear phishing targeting high-profile C-level executives. Vishing: voice/telephone phishing. Smishing: SMS text message phishing. Watering Hole: compromising a legitimate website frequently visited by a target organization to infect visitors.

What properties define a Cryptographic Hash Function, and why are MD5 and SHA-1 deprecated?

Properties: deterministic, fixed output length, fast computation, pre-image resistant (one-way), second pre-image resistant, and collision resistant. MD5 (128-bit) and SHA-1 (160-bit) are deprecated and prohibited because practical collision attacks have been demonstrated, where two distinct inputs generate the identical hash output.

Compare Symmetric Encryption and Asymmetric Encryption across speed, key distribution, and use cases.

Symmetric: uses a single shared secret key for encryption and decryption; extremely fast and computationally efficient; used for bulk data encryption (AES, ChaCha20, 3DES); key distribution is challenging. Asymmetric: uses a mathematically related public/private key pair; computationally slower; solves key exchange (Diffie-Hellman) and provides digital signatures/identity verification (RSA, ECC).

What are the secure replacements for the cleartext protocols Telnet, HTTP, FTP, SNMPv1/v2, and unencrypted DNS?

Telnet -> SSH (TCP 22); HTTP -> HTTPS (TCP 443 via TLS); FTP -> SFTP (TCP 22 via SSH) or FTPS (TCP 989/990 via TLS); SNMPv1/v2 -> SNMPv3 (UDP 161 with USM cryptographic authentication/encryption); DNS -> DNSSEC (integrity) and DoH (DNS over HTTPS, TCP 443) / DoT (DNS over TLS, TCP 853).

Compare Domain Validation (DV), Organization Validation (OV), Extended Validation (EV), and Wildcard Certificates.

DV: verifies domain control only via DNS/email; automated and fast. OV: verifies domain ownership and legal organization existence. EV: undergoes rigorous identity verification, used for high-trust enterprise sites. Wildcard Certificate (*.example.com): secures the base domain and an unlimited number of first-level subdomains using a single certificate and private key.

Compare IPsec VPN and SSL/TLS VPN across OSI layer, client requirements, and deployment model.

IPsec VPN: operates at OSI Layer 3 (Network); requires dedicated client software; provides full network access; ideal for secure Site-to-Site tunnels between enterprise branch routers. SSL/TLS VPN: operates at Layer 7 (Application); accessible via standard web browsers over TCP 443 without client installation; enables granular, per-application remote access for mobile workers.

How does a Digital Signature provide Authentication, Integrity, and Non-Repudiation?

Sender hashes the message and encrypts the resulting hash with the sender's Private Key, creating the digital signature. The recipient decrypts the signature using the sender's Public Key to recover the hash and compares it to their own computed hash of the message. If hashes match, it proves message integrity, sender authenticity, and prevents sender non-repudiation.

CompTIA Security+ (SY0-701) — Threats, Malware, Cryptography, PKI, IAM (AAA, MFA, SAML/OAuth) & Zero Trust

CompTIA Security+ (SY0-701) exam domain mastery covering social engineering vectors, malware classifications, symmetric vs asymmetric cryptography, PKI and certificate management, IAM architectures (AAA, MFA, federation with SAML and OAuth 2.0/OIDC), and Zero Trust Architecture.

Level: basic
Languages: en → en
Cards: 32
Markdown: CompTIA Security+ (SY0-701) — Threats, Malware, Cryptography, PKI, IAM (AAA, MFA, SAML/OAuth) & Zero Trust (.md)

Flashcards (32)

#	Front (Term / Question)	Back (Definition / Answer)
1	Contrast Cross-Site Request Forgery (CSRF) and Server-Side Request Forgery (SSRF).	CSRF tricks an authenticated user's browser into transmitting unauthorized commands to a vulnerable web application where the user is already logged in, piggybacking on existing session cookies (mitigated by anti-CSRF tokens and SameSite cookies). SSRF exploits a vulnerable web server into forging HTTP requests to internal, non-internet-facing internal infrastructure.
2	How does SQL Injection (SQLi) occur, and what is the primary defensive programming technique to eliminate it?	SQLi occurs when untrusted user input is directly concatenated into a dynamic SQL query, allowing an attacker to manipulate SQL syntax (e.g., `' OR '1'='1`). Primary defense: Prepared Statements with Parameterized Queries, which treat all user inputs strictly as data literals rather than executable SQL code, combined with stored procedures and input validation.
3	Define Recovery Time Objective (RTO), Recovery Point Objective (RPO), MTBF, and MTTR.	RTO: maximum acceptable duration of system downtime before business operations must be restored. RPO: maximum acceptable data loss measured in time (how far back data must be recovered). MTBF (Mean Time Between Failures): average operating time between hardware failures, measuring reliability. MTTR (Mean Time to Repair): average time required to repair or replace a failed system.
4	Compare Signature-Based, Anomaly-Based, and Heuristic Detection engines.	Signature-Based: compares network traffic or file hashes against a database of known threat patterns; highly accurate for known malware but blind to zero-day attacks. Anomaly-Based: establishes a baseline of normal network activity and alerts on statistical deviations; detects novel attacks but suffers from high false-positive rates. Heuristic: uses rules of thumb and algorithmic logic to detect suspicious behavior.
5	What are the five authentication factor categories in Multi-Factor Authentication (MFA)?	1. Something you know (password, PIN); 2. Something you have (smartcard, hardware token, TOTP authenticator app); 3. Something you are (biometrics: fingerprint, facial recognition, retina scan); 4. Somewhere you are (GPS coordinates, specific IP subnet); 5. Something you do (typing cadence, gait, handwriting dynamics). True MFA requires at least two DIFFERENT factor categories.
6	Compare SAML 2.0, OAuth 2.0, and OpenID Connect (OIDC) regarding federation, authentication, and authorization.	SAML 2.0: XML-based protocol providing web-based Single Sign-On (SSO) and federated authentication between an Identity Provider (IdP) and Service Provider (SP). OAuth 2.0: token-based framework designed strictly for API authorization/delegation (issuing scoped access tokens). OpenID Connect (OIDC): lightweight identity/authentication layer built directly on top of OAuth 2.0 using JSON Web Tokens (JWT).
7	Compare Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) in deployment and response.	IDS: deployed out-of-band via switch SPAN port or network TAP; passively monitors traffic copies; detects attacks and generates alerts, but cannot block malicious traffic in real time. IPS: deployed in-line directly in the network data path; actively inspects packets as they transit and can immediately drop malicious packets, terminate TCP sessions (TCP reset), and reconfigure firewall rules.
8	Compare Black Box, White Box, and Gray Box penetration testing.	Black Box: tester has zero prior knowledge of target environment, simulating an unprivileged external attacker. White Box (Clear Box): tester has full access to architectural documentation, source code, network diagrams, and credentials, simulating an insider or rigorous audit. Gray Box: tester has partial knowledge (e.g., standard user credentials), simulating an insider or contractor.
9	In a Public Key Infrastructure (PKI), compare Certificate Revocation Lists (CRLs), OCSP, and OCSP Stapling.	CRL: CA publishes a periodic list of revoked certificates; clients download large files, creating latency and bandwidth overhead. OCSP: client queries CA responder in real-time; causes latency and leaks client browsing history to CA. OCSP Stapling: web server periodically queries CA for signed OCSP response and 'staples' it directly to the initial TLS handshake, eliminating CA bottlenecks and privacy concerns.
10	What are the six phases of the NIST SP 800-61 Incident Response Lifecycle?	1. Preparation (tools, policies, team training); 2. Detection and Analysis (identifying and validating security incidents); 3. Containment (short-term isolation and segmentation); 4. Eradication (removing malware, eliminating root causes); 5. Recovery (restoring systems from clean backups and testing); 6. Post-Incident Activity (Lessons Learned review to improve posture).
11	Compare Stored XSS, Reflected XSS, and DOM-based Cross-Site Scripting (XSS).	Stored XSS: malicious JavaScript is permanently stored in a database (e.g., comment section) and executes in victim browsers when viewing the page. Reflected XSS: malicious script is embedded in a URL/link and reflected off the web server in the immediate response. DOM-based XSS: attack payload executes entirely client-side in the browser's Document Object Model without server reflection.
12	Explain the AAA Security Framework: Authentication, Authorization, and Accounting.	Authentication: proves the identity of a subject requesting access (e.g., credentials, certificates, biometrics). Authorization: determines what permissions, resources, and actions the authenticated subject is allowed to access (e.g., ACLs, RBAC policies). Accounting: tracks and logs the actions, duration, and resource utilization performed by the subject (e.g., audit trails, SIEM).
13	Compare Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR).	EDR: endpoint-installed software agent that continuously monitors, records host telemetry, detects behavioral anomalies, and automates host-level remediation (isolation, process termination). XDR: unifies and correlates detection telemetry across endpoints, network infrastructure, cloud workloads, and identity providers into a centralized console for coordinated threat response.
14	Explain the mechanics of a Rogue Access Point, an Evil Twin, and a Wi-Fi Deauthentication Attack.	Rogue AP: unauthorized access point connected directly to an enterprise wired network without IT permission. Evil Twin: rogue AP configured with identical SSID and MAC to a legitimate AP, overpowering the signal to harvest user credentials. Deauthentication Attack: spoofed 802.11 management frames sent to disconnect clients from an AP, forcing re-association to capture WPA handshakes.
15	Compare Virus, Worm, Trojan, Rootkit, and Ransomware malware mechanisms.	Virus: attaches to host file and requires human action to execute and spread. Worm: standalone self-replicating malware that spreads autonomously across network vulnerabilities without user intervention. Trojan: appears benign/useful but conceals a malicious payload. Rootkit: gains kernel/ring-0 access and conceals processes/files from OS detection. Ransomware: encrypts victim files and extorts cryptocurrency payment for decryption.
16	Why does Elliptic Curve Cryptography (ECC) provide significant advantages over RSA in modern cryptosystems?	ECC provides equivalent mathematical security strength with drastically smaller key sizes (e.g., a 256-bit ECC key offers comparable security to a 3072-bit RSA key). This results in significantly faster computations, reduced memory usage, lower network transmission overhead, and reduced battery power consumption on mobile and IoT devices.
17	In security governance, distinguish between Policies, Standards, Baselines, and Guidelines.	Policies: high-level executive statements of management intent, governance, and organizational direction; mandatory. Standards: specific, mandatory technical rules, protocols, or requirements that support policies. Baselines: minimum acceptable security configurations or operational thresholds. Guidelines: recommended best practices and operational guidance; discretionary/non-mandatory.
18	Compare Discretionary Access Control (DAC), Mandatory Access Control (MAC), and Attribute-Based Access Control (ABAC).	DAC: resource owner has complete discretion to assign permissions to other users (common in NTFS/Linux file permissions). MAC: OS enforces access based on fixed security labels (e.g., Confidential, Secret) and subject clearances; users cannot alter permissions (SELinux). ABAC: dynamically evaluates policies based on user attributes, resource attributes, environment context (time/location), and action requested.
19	Compare AES operating modes: Electronic Codebook (ECB), Cipher Block Chaining (CBC), and Galois/Counter Mode (GCM).	ECB: encrypts identical 128-bit plaintext blocks into identical ciphertext blocks, preserving data patterns; cryptographically insecure. CBC: XORs each plaintext block with the previous ciphertext block using an Initialization Vector (IV); provides confidentiality but no integrity. GCM: counter-based mode providing both high-speed encryption and built-in cryptographic integrity/authentication (AEAD).
20	Compare the security functions of CASB, CSPM, and CWPP in cloud security.	CASB (Cloud Access Security Broker): enforces enterprise security, DLP, and compliance policies between on-prem users and cloud SaaS applications. CSPM (Cloud Security Posture Management): continuously scans cloud infrastructure (IaaS) for configuration drifts, compliance violations, and public storage exposure. CWPP (Cloud Workload Protection Platform): secures VMs, containers, and serverless functions.
21	Distinguish between Salting, Pepper, and Key Stretching (bcrypt, PBKDF2, Argon2) in password storage.	Salt: unique random string appended to each password before hashing to defeat precomputed rainbow tables. Pepper: secret constant value stored separately (e.g., HSM) appended across all passwords. Key Stretching: deliberately runs hashing through thousands of iterations/work factors (bcrypt, PBKDF2, Argon2) to make GPU/ASIC offline brute-force attacks computationally infeasible.
22	What are the foundational principles of Zero Trust Architecture (ZTA)?	Core tenet: 'Never trust, always verify.' Key principles: 1. Assume breach (treat internal network as hostile); 2. Explicitly verify all access requests based on all available data points (identity, location, device health, service context); 3. Apply Least Privilege access (Just-In-Time and Just-Enough-Access); 4. Implement micro-segmentation to prevent lateral movement.
23	Compare Stateless Packet Filtering, Stateful Inspection, and Next-Generation Firewalls (NGFW).	Stateless: inspects individual packets against static IP/port header rules in isolation; cannot track connection state. Stateful: tracks full TCP/UDP connection state in a dynamic state table, automatically allowing return traffic. NGFW: inspects traffic at Layer 7 (Application layer), performs Deep Packet Inspection (DPI), detects application-specific attacks, and integrates IPS and SSL/TLS decryption.
24	In cloud computing, compare customer versus provider responsibilities under the Shared Responsibility Model across IaaS, PaaS, and SaaS.	IaaS: provider manages physical datacenter, hypervisor, and hardware; customer manages OS, middleware, runtime, applications, and data. PaaS: provider manages hardware, OS, and runtime environment; customer manages applications and data. SaaS: provider manages entire underlying software stack, infrastructure, and updates; customer is responsible only for data and access configuration.
25	What is the difference between Polymorphic Malware and Metamorphic Malware?	Polymorphic Malware modifies its external appearance, decryptor routine, or encryption key with every infection while keeping the core underlying payload unchanged, altering its file hash. Metamorphic Malware completely rewrites, decompiles, and re-engineers its own internal code structure and logic each generation, altering both hash and behavioral signature.
26	Distinguish between Phishing, Spear Phishing, Whaling, Vishing, Smishing, and Watering Hole attacks.	Phishing: mass broadcast deceptive emails. Spear Phishing: highly customized attack targeting a specific individual or organization. Whaling: spear phishing targeting high-profile C-level executives. Vishing: voice/telephone phishing. Smishing: SMS text message phishing. Watering Hole: compromising a legitimate website frequently visited by a target organization to infect visitors.
27	What properties define a Cryptographic Hash Function, and why are MD5 and SHA-1 deprecated?	Properties: deterministic, fixed output length, fast computation, pre-image resistant (one-way), second pre-image resistant, and collision resistant. MD5 (128-bit) and SHA-1 (160-bit) are deprecated and prohibited because practical collision attacks have been demonstrated, where two distinct inputs generate the identical hash output.
28	Compare Symmetric Encryption and Asymmetric Encryption across speed, key distribution, and use cases.	Symmetric: uses a single shared secret key for encryption and decryption; extremely fast and computationally efficient; used for bulk data encryption (AES, ChaCha20, 3DES); key distribution is challenging. Asymmetric: uses a mathematically related public/private key pair; computationally slower; solves key exchange (Diffie-Hellman) and provides digital signatures/identity verification (RSA, ECC).
29	What are the secure replacements for the cleartext protocols Telnet, HTTP, FTP, SNMPv1/v2, and unencrypted DNS?	Telnet -> SSH (TCP 22); HTTP -> HTTPS (TCP 443 via TLS); FTP -> SFTP (TCP 22 via SSH) or FTPS (TCP 989/990 via TLS); SNMPv1/v2 -> SNMPv3 (UDP 161 with USM cryptographic authentication/encryption); DNS -> DNSSEC (integrity) and DoH (DNS over HTTPS, TCP 443) / DoT (DNS over TLS, TCP 853).
30	Compare Domain Validation (DV), Organization Validation (OV), Extended Validation (EV), and Wildcard Certificates.	DV: verifies domain control only via DNS/email; automated and fast. OV: verifies domain ownership and legal organization existence. EV: undergoes rigorous identity verification, used for high-trust enterprise sites. Wildcard Certificate (*.example.com): secures the base domain and an unlimited number of first-level subdomains using a single certificate and private key.
31	Compare IPsec VPN and SSL/TLS VPN across OSI layer, client requirements, and deployment model.	IPsec VPN: operates at OSI Layer 3 (Network); requires dedicated client software; provides full network access; ideal for secure Site-to-Site tunnels between enterprise branch routers. SSL/TLS VPN: operates at Layer 7 (Application); accessible via standard web browsers over TCP 443 without client installation; enables granular, per-application remote access for mobile workers.
32	How does a Digital Signature provide Authentication, Integrity, and Non-Repudiation?	Sender hashes the message and encrypts the resulting hash with the sender's Private Key, creating the digital signature. The recipient decrypts the signature using the sender's Public Key to recover the hash and compares it to their own computed hash of the message. If hashes match, it proves message integrity, sender authenticity, and prevents sender non-repudiation.