The Security+ glossary that actually explains things.
Every entry has a plain-language definition, why it actually matters, a real example, related terms, and its exam domain — not a thin one-liner. Search, filter by domain, or jump straight to a letter.
Three separate security functions: Authentication proves who you are, Authorization decides what you're allowed to do, and Accounting records what you actually did.
Why it matters: These fail independently — a system can authenticate you correctly but still authorize you incorrectly, or authorize correctly but never log the action. The exam tests each failure mode separately.
Example: Logging in with a password is authentication. Being blocked from an admin page you're not permitted to use is authorization. The audit log showing you accessed a file at 2:14pm is accounting.
⚠ Don't confuse Authentication (who) with Authorization (what) — a huge share of missed exam questions come from mixing these two up.
A symmetric encryption algorithm — the current, widely trusted global standard for encrypting data at rest and in transit. AES-256 uses a 256-bit key.
Why it matters: AES is the default answer to 'what strong symmetric algorithm should we use' across the exam and in real deployments (full-disk encryption, VPNs, Wi-Fi security).
Example: BitLocker full-disk encryption and WPA3 Wi-Fi security both rely on AES to encrypt data.
⚠ AES is symmetric (same key encrypts and decrypts) — don't confuse it with asymmetric algorithms like RSA, which use a public/private key pair.
A sophisticated, well-resourced threat actor (often nation-state-affiliated) that gains and maintains long-term, stealthy access to a target rather than a quick smash-and-grab.
Why it matters: APTs represent the high end of the threat-actor sophistication spectrum — recognizing the pattern (patient, persistent, targeted) versus opportunistic attacks is a testable distinction.
Example: An attacker maintains quiet access to a network for months, slowly exfiltrating intellectual property rather than immediately deploying ransomware.
An attack where a device sends forged Address Resolution Protocol messages to associate the attacker's MAC address with another device's IP address, redirecting traffic through the attacker.
Why it matters: It's a classic on-path (man-in-the-middle) technique on local networks and a frequently tested network-attack example.
Example: An attacker on the same office Wi-Fi poisons the ARP cache of a victim's laptop so their traffic to the gateway actually flows through the attacker's device first.
An audit formally verifies compliance against a standard. An assessment more broadly evaluates security posture. A penetration test actively attempts to exploit vulnerabilities to prove real-world impact.
Why it matters: These are three distinct activities with different goals, scopes, and outputs — the exam tests telling them apart.
Example: A PCI DSS audit checks specific compliance requirements; a penetration test actually tries to break into the same environment to prove exploitability.
An attack where a criminal impersonates an executive, vendor, or trusted contact by email to trick someone into a wire transfer, credential handover, or other action — usually without any malware at all.
Why it matters: BEC causes enormous real financial losses precisely because it doesn't trip antivirus or malware defenses — it exploits trust and process gaps.
Example: An email appearing to be from the CFO urgently instructs accounting to wire funds to a 'new vendor account' — which is actually the attacker's.
The three core properties security exists to protect: Confidentiality (only authorized people can see it), Integrity (it hasn't been improperly altered), and Availability (authorized people can access it when they need to).
Why it matters: Almost every Security+ scenario question is secretly asking which of these three an attacker damaged — recognizing which one is under threat tells you which control category actually helps.
Example: A ransomware attack primarily damages Availability (you can't get to your files). A database breach that only reads data damages Confidentiality without touching Integrity.
A standardized, public identifier assigned to a specific, publicly known vulnerability — a shared reference number everyone in the industry can use to talk about the same flaw.
Why it matters: CVE IDs let security teams track and communicate about specific vulnerabilities unambiguously across tools and organizations.
Example: A vulnerability scanner flags 'CVE-2024-XXXXX' on a server — that ID uniquely identifies the exact known flaw, regardless of which vendor's tool found it.
⚠ A CVE identifies WHAT the vulnerability is; a CVSS score tells you HOW SEVERE it is. They're related but answer different questions.
A standardized 0-10 scoring system that rates how severe a vulnerability is, based on factors like exploitability and impact.
Why it matters: CVSS is the primary tool for PRIORITIZING which vulnerabilities to fix first when you can't fix everything at once.
Example: A CVSS 9.8 remote-code-execution flaw on an internet-facing server gets patched before a CVSS 4.1 local information-disclosure bug on an isolated internal system.
⚠ A high CVSS score alone doesn't mean 'fix first' — actual exposure and reachability (is it even internet-facing?) matter just as much in real prioritization.
Meeting the specific requirements of a law, regulation, or framework that applies to your organization or industry.
Why it matters: Compliance and security overlap but aren't identical — an organization can pass a compliance audit and still have real, uncovered security gaps.
Example: A retailer maintaining PCI DSS compliance to legally process credit card payments.
An attack that injects malicious script into a website, which then runs in other users' browsers when they view the affected page.
Why it matters: It's another named web-based vulnerability, and demonstrates that input validation matters for the OUTPUT other users see, not just your own database.
Example: A comment field that doesn't sanitize input lets an attacker post a script that steals other visitors' session cookies when they view the comment.
Categorizing data by sensitivity (public, private, confidential, restricted, critical) so that protection requirements scale with how sensitive the data actually is.
Why it matters: You can't apply the right protection to data you haven't first classified — it's the foundation the rest of data-protection strategy is built on.
Example: Marketing brochures are classified public; a customer database is classified confidential and gets encryption and strict access controls.
The disciplined collection, preservation, and analysis of digital evidence following procedures (chain of custody, legal hold) that keep it admissible and trustworthy.
Why it matters: Sloppy evidence handling can make otherwise solid evidence useless in legal or HR proceedings — the process matters as much as the finding.
Example: Investigators image a compromised laptop's drive and log every person who handled that image, maintaining an unbroken chain of custody.
A cryptographic value created with a sender's private key that lets anyone with the matching public key verify both the sender's identity and that the message wasn't altered.
Why it matters: It provides both integrity AND non-repudiation at once — two separate security properties from one mechanism.
Example: A signed software update lets your OS verify the update really came from the vendor and wasn't tampered with in transit.
An attack that floods a target with traffic from many distributed sources at once, overwhelming it so legitimate users can't get through.
Why it matters: It's a direct, textbook attack on Availability — and 'distributed' (many sources) is the key word distinguishing it from a simple DoS.
Example: Thousands of compromised IoT devices in a botnet simultaneously flood a company's web server with requests, taking the site offline for real customers.
A network zone positioned between the internet and the internal network, hosting public-facing services, so a compromise there doesn't directly expose internal systems.
Why it matters: It's the standard architecture pattern for exposing services to the internet without exposing the internal network itself.
Example: A company's public web server lives in the DMZ, reachable from the internet, while the internal database server sits behind a second firewall the DMZ can't reach directly.
A security tool that continuously monitors endpoint (device) activity, detects threats, and can respond automatically (isolate the device, kill a process).
Why it matters: EDR is the modern evolution beyond basic antivirus — it looks at behavior, not just known malware signatures.
Example: EDR on a laptop notices a process encrypting many files rapidly (ransomware behavior) and automatically isolates the device from the network.
An extension of EDR that correlates signals across endpoints, network, email, and cloud into one unified detection and response view.
Why it matters: XDR reduces the 'too many disconnected alerts' problem by correlating signals that individually might look harmless.
Example: XDR connects a suspicious login (identity signal) with a subsequent unusual file download (endpoint signal) into a single correlated incident.
A dedicated, hardened hardware device for generating, storing, and managing cryptographic keys at enterprise scale — think of it as an industrial-grade TPM.
Why it matters: Organizations that manage large volumes of sensitive keys (like a Certificate Authority) rely on HSMs rather than software-only key storage.
Example: A bank's Certificate Authority stores its root signing key in an HSM rather than on a regular server's disk.
⚠ TPM is typically built into an individual device; an HSM is a separate, dedicated appliance managing keys for an entire organization or service — don't treat them as interchangeable.
A one-way mathematical function that turns data into a fixed-length value (a hash). The same input always produces the same hash, but you cannot reverse a hash back into the original data.
Why it matters: Hashing protects integrity — if a file's hash changes, the file changed. It's how password storage and file-integrity checks both work.
Example: Comparing the published SHA-256 hash of a downloaded file against the hash you calculate yourself confirms the download wasn't corrupted or tampered with.
⚠ Hashing is NOT encryption — hashing is one-way and can't be reversed; encryption is two-way and is meant to be decrypted.
Host-based Intrusion Detection System monitors activity on a single device. Network-based Intrusion Detection System monitors traffic across the network.
Why it matters: Placement matters — a HIDS catches things happening ON a specific machine that network monitoring alone would never see (like local file changes).
Example: A HIDS on a server detects a suspicious local process spawning; a NIDS on the network perimeter detects an unusual volume of outbound traffic.
Deliberately fake systems (honeypot), whole fake networks (honeynet), or fake data (honeytoken) planted to detect, distract, or study attackers, without risking anything real.
Why it matters: These are deception technologies — a proactive detective control that turns an attacker's own behavior into your alert.
Example: A fake 'passwords.xlsx' file (a honeytoken) triggers an alert the moment anyone opens it, since no legitimate process should ever touch it.
The overall discipline and tools for managing digital identities across their full lifecycle: provisioning, authentication, authorization, and de-provisioning.
Why it matters: Poor identity lifecycle management (like former employees keeping access) is one of the most common real-world security failures.
Example: When an employee leaves, an IAM system automatically revokes their accounts across every connected system the same day.
An arrangement that extends trust across separate organizations, letting a user authenticate with their home organization's identity and use that same identity to access a partner organization's systems — without creating a separate account there.
Why it matters: Federation is the trust relationship itself; SAML and OAuth are the protocols commonly used to actually carry it out. The exam names federation as its own item in objective 4.6, separate from SSO.
Example: A university student logs into a partner research library's site using their university credentials, because the university and the library have a federated trust relationship — no separate library account required.
⚠ Federation and SSO are related but not the same thing: SSO is one login working across multiple apps WITHIN one organization; federation extends that trust ACROSS organizational boundaries.
Intrusion Detection System monitors traffic and ALERTS on suspicious activity. Intrusion Prevention System sits inline and can actively BLOCK the traffic in real time.
Why it matters: The exam repeatedly tests this exact distinction: detection (passive, alerts only) versus prevention (active, can block).
Example: An IDS notices a port scan and generates an alert for an analyst to review; an IPS in the same position could drop the scanning traffic automatically.
⚠ IDS = detect and alert only. IPS = detect AND actively block. Mixing these up is one of the most common exam mistakes.
The structured process for handling a security incident: preparation, detection, analysis, containment, eradication, recovery, and lessons learned.
Why it matters: Correct SEQUENCING is tested directly — you contain before you eradicate, and you eradicate before you recover.
Example: Disconnecting an infected server from the network is containment; removing the malware afterward is eradication; restoring from a clean backup is recovery.
A protocol suite that authenticates and encrypts IP packets, commonly used to build secure site-to-site or client-to-site VPN tunnels.
Why it matters: It's one of the two named tunneling protocols in the secure-communication objective (alongside TLS) and appears in real site-to-site VPN configurations.
Example: Two office branches connect over an IPSec tunnel so all traffic between them is encrypted, even though it crosses the public internet.
A network authentication protocol that uses tickets issued by a trusted Key Distribution Center, avoiding the need to send passwords repeatedly across the network.
Why it matters: Kerberos is the authentication backbone of Windows Active Directory environments — extremely common in real enterprise networks.
Example: Logging into a Windows domain computer gets you a ticket-granting ticket, which is then used to request access to other domain resources without re-entering your password.
Collecting log data from many different systems into one centralized location for easier searching, correlation, and retention.
Why it matters: Without aggregation, investigating an incident means manually checking dozens of separate systems — aggregation makes correlation and detection actually feasible.
Example: Firewall logs, server logs, and application logs all flow into a central log store where an analyst can search across all of them at once.
MAC: access is centrally controlled by a strict policy (like classification labels) that users can't override. DAC: the resource's OWNER decides who else gets access.
Why it matters: The exam tests which model fits which scenario — highly regulated/military-style environments favor MAC; typical file-sharing permissions are DAC.
Example: A classified document that only users with the right clearance level can open (MAC) versus a shared drive folder where the file's owner grants a coworker access (DAC).
⚠ Don't confuse Mandatory Access Control (MAC) with Media Access Control (also abbreviated MAC) — same acronym, completely different meaning depending on context.
Requiring two or more different TYPES of authentication factors (something you know, have, are, or somewhere you are) before granting access.
Why it matters: MFA is one of the single highest-impact controls against credential-based attacks — a stolen password alone usually isn't enough to get in.
Example: Logging in with a password (something you know) plus a code from an authenticator app (something you have).
⚠ Two passwords is NOT MFA — both are 'something you know.' True MFA requires factors from different categories.
A system that checks a device's identity and security posture (patched, antivirus running, compliant) before allowing it onto the network.
Why it matters: NAC enforces baseline security requirements automatically, rather than trusting that every device on the network is safe.
Example: A visiting laptop that fails a posture check gets placed on a restricted guest VLAN with internet-only access instead of the full corporate network.
Dividing a network into smaller, isolated zones so a compromise in one segment doesn't automatically grant access to others.
Why it matters: It's one of the single most effective mitigation techniques against lateral movement after a breach.
Example: Putting IoT devices on their own VLAN, separate from the finance department's workstations, so a compromised smart thermostat can't reach payroll data.
Proof that a person genuinely performed an action and cannot credibly deny having done it — typically achieved through digital signatures.
Why it matters: Without non-repudiation, someone could plausibly claim 'that wasn't me' after a transaction or approval, undermining accountability.
Example: A digitally signed purchase order proves the specific signer approved it, using their private key — no one else could have produced that signature.
An attack where the adversary secretly positions themselves between two communicating parties, able to intercept, read, or alter traffic — formerly called 'man-in-the-middle.'
Why it matters: It threatens confidentiality and integrity simultaneously, and is the umbrella category ARP poisoning and some Wi-Fi attacks fall under.
Example: A fake Wi-Fi access point intercepts a victim's traffic, letting the attacker view unencrypted data in transit.
A framework that lets a user grant a third-party application limited access to their data on another service, without handing over their actual password.
Why it matters: It's how most 'log in / connect with' third-party integrations work, and understanding it prevents a common SAML/OAuth mix-up on the exam.
Example: Granting a calendar app permission to read your email's calendar events without giving it your email password.
Password spraying tries a few common passwords across MANY accounts (staying under lockout thresholds). Brute force tries MANY passwords against ONE account.
Why it matters: The exam frequently gives you log evidence and asks you to identify which pattern occurred — the direction of 'many vs. one' is the key clue.
Example: Seeing one failed attempt each on 500 different accounts in an hour points to spraying; seeing 5,000 failed attempts on one account points to brute force.
The process of identifying, testing, and deploying software updates that fix known vulnerabilities, in a controlled and timely way.
Why it matters: Unpatched, known vulnerabilities remain one of the most common ways real breaches happen — patching is one of the highest-leverage mitigations available.
Example: A critical patch for a publicly exploited vulnerability gets tested in a staging environment and deployed to production within 48 hours under an emergency change process.
Social-engineering attacks delivered by channel: phishing (email), vishing (voice call), smishing (SMS text) — all trying to trick you into giving up information or access.
Why it matters: The exam tests recognizing the CHANNEL as part of naming the specific attack, not just 'social engineering' generically.
Example: A text message claiming to be your bank asking you to click a link and 'verify your account' is smishing.
The full system of certificate authorities, certificates, and public/private key pairs that lets parties who've never met establish trust and communicate securely.
Why it matters: PKI underpins HTTPS, code signing, and secure email — understanding the chain of trust is essential for the cryptography objective and for real troubleshooting.
Example: Your browser trusts a website's certificate because it was signed by a Certificate Authority your browser already trusts — a chain of trust back to a root CA.
Malware that encrypts a victim's files (and sometimes threatens to leak them) and demands payment for the decryption key or silence.
Why it matters: It's the malware type most likely to directly damage the Availability leg of the CIA triad, and drives huge real-world incident-response activity.
Example: A hospital's patient-record system becomes encrypted and inaccessible, with a ransom note demanding cryptocurrency payment for the decryption key.
A client-server protocol that centralizes AAA services — commonly used to authenticate users connecting to network devices, VPNs, and Wi-Fi.
Why it matters: It's one of the two named AAA server protocols on the exam (alongside TACACS+), and appears in real enterprise Wi-Fi/VPN authentication.
Example: A corporate Wi-Fi network authenticates each device against a central RADIUS server instead of a single shared password.
⚠ RADIUS combines authentication and authorization in one step and encrypts only the password; TACACS+ separates AAA into distinct steps and encrypts the whole packet — a common exam distinction.
The four ways an organization can respond to an identified risk: transfer (insurance/outsourcing), accept (formally, with documentation), avoid (stop the risky activity), or mitigate (reduce likelihood/impact).
Why it matters: The exam expects you to match a scenario to the correct strategy — 'buying cyber insurance' is transfer, not mitigation, for example.
Example: A company can't justify fixing a low-impact, low-likelihood risk, so leadership formally accepts it with a documented exception.
An access-control model where permissions are assigned to roles (like 'HR Manager'), and users get permissions by being assigned to a role, rather than individually.
Why it matters: RBAC is the most common practical access model in enterprises because it scales — you manage roles, not thousands of individual permission sets.
Example: Every user assigned the 'Help Desk' role automatically gets the same set of ticketing-system permissions.
An XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider — commonly used for enterprise SSO.
Why it matters: It's the backbone of most enterprise federation setups (logging into a third-party app using your company identity).
Example: Logging into a SaaS HR platform using your corporate identity, where SAML passes an assertion proving who you are from your company's identity provider.
⚠ SAML and OAuth solve different problems — SAML is mainly for authentication/SSO, OAuth is mainly for authorization (granting an app limited access to your data) without sharing your password.
Using scripts and tools to perform repetitive security tasks (provisioning, enforcement, response) without manual, one-by-one human action.
Why it matters: Automation is how security teams keep pace with scale — enforcing consistent baselines across thousands of systems isn't realistically a manual task.
Example: A script automatically applies the standard security baseline to every newly provisioned cloud server, with no human touching each one individually.
A platform that aggregates and correlates log data from across the entire environment, giving analysts a centralized place to detect and investigate threats.
Why it matters: Without a SIEM, logs are scattered across dozens of systems — correlation across sources is what turns individually boring log lines into a real detection.
Example: A SIEM correlates a failed login spike on a VPN with a successful login from an unusual country minutes later, flagging the pattern as a likely compromise.
Tools that take detections (often from a SIEM) and automatically execute a predefined response — opening tickets, quarantining hosts, blocking IPs — without waiting on a human for every step.
Why it matters: SOAR is how security teams scale response without proportionally scaling headcount — a core automation/orchestration concept on the exam.
Example: A SOAR playbook automatically disables a user account and opens an incident ticket the moment a SIEM alert crosses a defined severity threshold.
⚠ SIEM primarily detects and correlates; SOAR primarily automates the RESPONSE — they're often used together but are different tools with different jobs.
A system that lets a user authenticate once and gain access to multiple independent applications without logging in separately to each.
Why it matters: SSO reduces password fatigue and the number of credential sets an attacker could target, but it also means a single compromised SSO account can reach everything.
Example: Logging into your company's identity portal once, then clicking through to email, HR, and ticketing systems without another password prompt.
Different agreement types: SLA sets service-level expectations, NDA protects confidential information, MOU/MOA record informal/formal mutual understanding, BPA defines a business-partnership relationship.
Why it matters: Each agreement type solves a distinct legal/business purpose — the exam expects you to match the correct agreement to the correct scenario.
Example: A vendor contract's uptime guarantee is governed by an SLA; the confidentiality of shared data is governed separately by an NDA.
Single Loss Expectancy (cost of one incident) × Annualized Rate of Occurrence (how often it happens per year) = Annualized Loss Expectancy (expected yearly cost).
Why it matters: This is a genuine, testable calculation used to justify whether a security investment is worth its cost.
Example: If a $20,000 outage (SLE) happens about twice a year (ARO of 2), the ALE is $40,000/year — a $15,000/year fix is clearly worth it.
An attack that inserts malicious SQL code into an application's input fields, tricking the backend database into executing unintended commands.
Why it matters: It's one of the most common and historically damaging web-application vulnerabilities, and a named example under application vulnerabilities.
Example: Entering ' OR '1'='1 into a login field that isn't properly sanitized could bypass authentication entirely.
Compromising a target indirectly through a trusted vendor, software dependency, or service provider rather than attacking the target directly.
Why it matters: It bypasses direct defenses entirely by exploiting the trust an organization places in its vendors and software supply chain.
Example: Malicious code inserted into a widely used software library gets pulled into thousands of applications that depend on it, without those developers doing anything wrong themselves.
The process of assessing, monitoring, and contractually governing the security risk introduced by vendors and partners who have access to your systems or data.
Why it matters: Your security is only as strong as your weakest connected vendor — this is a top real-world source of major breaches.
Example: Before granting a vendor access to customer data, the company requires a completed security questionnaire and a right-to-audit clause in the contract.
Categories of who might attack you: nation-state, unskilled attacker, hacktivist, insider threat, organized crime, and shadow IT — each with different sophistication, funding, and motivation.
Why it matters: Matching an attack's characteristics to the likely actor type helps prioritize response and understand motivation.
Example: A politically motivated website defacement points toward a hacktivist; a financially motivated ransomware campaign points toward organized crime.
A one-time authentication code generated from a shared secret and the current time, refreshing every 30-60 seconds — the mechanism behind most authenticator apps.
Why it matters: TOTP is a common, phishing-resistant-ish (though not phishing-proof) 'something you have' factor used across enterprise MFA deployments.
Example: Opening an authenticator app to get a fresh 6-digit code that expires in 30 seconds when logging into a work account.
The cryptographic protocol that secures data in transit over a network — the successor to SSL, and what the 'S' in HTTPS actually stands for.
Why it matters: TLS protects confidentiality and integrity for nearly all secure web, email, and API traffic — it's one of the most frequently referenced protocols on the exam.
Example: When you see the padlock icon in a browser, TLS has negotiated an encrypted session between your browser and the server.
⚠ SSL is deprecated and should not be used — the exam expects you to know TLS is the current standard, not just treat the terms as interchangeable.
A dedicated hardware chip that securely generates and stores cryptographic keys, tied to the specific physical device.
Why it matters: TPM underlies features like full-disk encryption key protection and hardware-backed device attestation.
Example: Windows BitLocker uses the TPM to store the disk-encryption key, so the encrypted drive can't simply be moved to another computer and decrypted there.
The ongoing cycle of identifying (scanning), analyzing (scoring, confirming), remediating (patching or compensating), and validating (rescanning) vulnerabilities.
Why it matters: It's a continuous PROCESS, not a one-time scan — the exam tests understanding of the full cycle and correct prioritization logic.
Example: A monthly vulnerability scan feeds a prioritized remediation backlog, and each fix gets validated with a rescan before being marked closed.
A security model built on 'never trust, always verify' — no device or user is implicitly trusted just because it's on the internal network. Every request is authenticated, authorized, and evaluated against policy.
Why it matters: Traditional 'trusted internal network' assumptions are exactly what attackers exploit once they get past the perimeter. Zero Trust removes that soft, trusted interior.
Example: An employee's laptop must re-authenticate and pass a policy check to reach a sensitive application, even though it's plugged into the office network.
⚠ Zero Trust is a philosophy/architecture, not a single product — vendors sell 'Zero Trust' tools, but the term itself describes an approach.
A vulnerability being actively exploited before the vendor has released (or in some cases even knows about) a patch.
Why it matters: Zero-days can't be defended against with patching alone since no patch exists yet — this is where compensating controls and monitoring matter most.
Example: Attackers exploit a previously unknown flaw in a widely used piece of software before the vendor has issued any fix.
