Complete CompTIA Security+ (SY0-701), Network+ (N10-009), CEH & OWASP Top 10 Study Guide

Comprehensive Active-Recall Curriculum: Comprehensive cybersecurity certification prep for CompTIA Security+ (SY0-701), CompTIA Network+ (N10-009), and Certified Ethical Hacker (CEH): OSI model, TCP/IP ports, subnetting, cryptography, PKI, IAM/Zero Trust, OWASP Top 10 web vulnerabilities, Nmap/Wireshark, MITRE ATT&CK, and incident response. Practice 6 progressive flashcard decks (192 cards total) spanning foundational principles (basic), intermediate problem-solving (intermediate), and advanced exam mastery (advanced).

👉 Explore All CompTIA Security+ (SY0-701), Network+ (N10-009), CEH Ethical Hacking & OWASP Top 10 Flashcard Decks on Flashcards.World →

---

Why Active Recall & Spaced Repetition Work for This Exam

Mastering CompTIA Security+ (SY0-701), Network+ (N10-009), CEH Ethical Hacking & OWASP Top 10 requires retrieving precise definitions, formulas, diagnostic rules, and edge-case distinctions under timed pressure. Passive re-reading creates an illusion of competence; active recall (testing yourself before viewing the answer) and spaced repetition strengthen long-term synaptic retrieval pathways.

Study Phase	Decks Covered	Target Mastery Level	Daily Active-Recall Protocol
Phase 1: Foundations (Weeks 1–2)	Decks 1 & 2 (Basic)	90%+ Instant Recall	32 new cards/day + full review of missed concepts
Phase 2: Application (Weeks 3–5)	Decks 3 & 4 (Intermediate)	Multi-step synthesis	32 new cards/day + interleaved Phase 1 review
Phase 3: Exam Mastery (Weeks 6–8)	Decks 5 & 6 (Advanced)	Timed exam readiness	Full 192-card spaced-repetition rotation + weak-spot drills

---

Deck 1: Threats, Vulnerabilities, Malware, Social Engineering & MITRE ATT&CK (32 Cards — Basic)

What this deck covers: Comprehensive coverage of CompTIA Security+ (SY0-701) and CEH threat intelligence, threat actor profiles, Cyber Kill Chain vs MITRE ATT&CK vs Diamond Model, malware classifications, social engineering techniques, supply chain/zero-day exploits, password attacks, and memory/race condition vulnerabilities.

High-Yield Prompt / Question	Core Concept & Mechanism	Exam Application & Details
Compare the motivations, resources, and stealth profiles of Advanced Persistent Threats (APTs), Hacktivists, Script Kiddies, and Insider Threats.	APTs: Nation-state/state-sponsored groups with vast funding, zero-day capabilities, and long-term stealth (espionage/sabotage).	Hacktivists: Ideologically/politically motivated actors using DDoS, defacement, or data leaks for publicity. Script Kiddies: Unskilled attackers using off-the-shelf exploit scripts without deep technical understanding. Insiders: Current/former employees or contractors abusing ...
What are the 7 chronological stages of the Lockheed Martin Cyber Kill Chain?	1. Reconnaissance (harvesting emails, OSINT, scanning)	2. Weaponization (coupling exploit with backdoor payload); 3. Delivery (transmitting weapon via email, web, or USB); 4. Exploitation (triggering vulnerability on target); 5. Installation (installing persistent backdoor/RAT); 6. Command and Control (C2 channel establishment); 7...
How does the MITRE ATT&CK framework differ from the Cyber Kill Chain, and what are Tactics, Techniques, and Procedures (TTPs)?	Unlike the linear Cyber Kill Chain, MITRE ATT&CK is a non-linear matrix of post-compromise adversary behaviors across 14 enterprise tactics. Tactics represent the 'why' (adversary's technical goal, e.g., Credential Ac...	Techniques represent the 'how' (method used, e.g., T1003 OS Credential Dumping); Procedures are the specific real-world implementation/tools used by a threat group.
What are the four core nodes and two primary axes of the Diamond Model of Intrusion Analysis?	The four core nodes are Adversary, Capability, Infrastructure, and Victim.	The two primary axes are the Socio-Political axis (Adversary <-> Victim relationship/motivation) and the Technical axis (Capability <-> Infrastructure used to conduct the intrusion), supplemented by meta-features like timestamp, phase, and direction.
How do Viruses, Worms, and Trojans differ in their propagation and activation mechanisms?	Virus: Attaches to a clean host file/boot sector and requires human action (executing the host program) to run and spread. Worm: Standalone self-replicating malware that propagates automatically across networks via un...	does not self-replicate.
What is Fileless Malware (Living-off-the-Land / LotL), and why does it evade traditional signature-based antivirus?	Fileless malware operates almost entirely in volatile RAM without writing malicious executables to disk.	After initial exploitation or macro execution, it abuses built-in, signed OS administrative binaries (LOLBins) such as PowerShell, WMI, certutil, or mshta to inject shellcode into legitimate processes, leaving no traditional file hash on the filesystem.
Compare User-Mode Rootkits, Kernel-Mode Rootkits, and Bootkits.	User-Mode Rootkit: Hooks API calls in ring 3 to hide files/processes from user applications.	Kernel-Mode Rootkit: Runs in ring 0, modifying OS kernel data structures (Direct Kernel Object Manipulation) to conceal presence from the OS itself. Bootkit: Infects the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware to load before the OS kernel and bypas...
What is the difference between Polymorphic Malware and Metamorphic Malware?	Polymorphic malware uses a variable encryption/packing routine with a different key on each iteration to change its file signature on disk, but decrypts to the same original payload in memory (leaving a detectable dec...	Metamorphic malware completely rewrites its own assembly instructions (instruction substitution, register swapping, dead-code insertion) on each iteration so neither disk nor memory code matches prior versions.
How do Logic Bombs, Remote Access Trojans (RATs), and Keyloggers operate?	Logic Bomb: Dormant malicious code (often planted by an insider) that executes a destructive payload only when a specific condition is met (e.g., a date or termination of an employee's AD account).	RAT: Provides covert interactive C2 control over a victim system (screen capture, shell, webcam). Keylogger: Hardware dongle or software hook (API/kernel) that records keystrokes to steal credentials.
What is modern double-extortion Ransomware, and why should victims avoid immediately powering off an infected host before triage?	Double-extortion ransomware exfiltrates sensitive data to attacker C2 servers before encrypting local files (via hybrid symmetric AES/ChaCha20 + asymmetric RSA/ECC encryption), threatening public leaks alongside opera...	Powering off destroys volatile RAM, which may contain ephemeral encryption keys, active C2 connections, or unencrypted file handles.
Distinguish between Phishing, Spear Phishing, Whaling, Vishing, and Smishing.	Phishing: Untargeted mass email campaigns using generic lures.	Spear Phishing: Highly targeted email attacks tailored to a specific individual, role, or organization using OSINT. Whaling: Spear phishing directed specifically at C-level executives (CEO, CFO) or board members. Vishing: Voice phishing via phone/VoIP (often using AI voice clo...
What is Business Email Compromise (BEC), and how does it bypass standard malware email filters?	BEC (CEO Fraud / Invoice Fraud) involves impersonating or compromising an executive's or vendor's email account to trick finance staff into wiring funds or altering ACH routing details.	Because BEC emails typically contain no malicious attachments or phishing links—relying purely on urgency, authority, and social engineering—signature and sandbox filters often miss them.

👉 Practice Deck 1: Threats, Vulnerabilities, Malware, Social Engineering & MITRE ATT&CK (32 Flashcards) →
🔍 Browse All Basic CompTIA Security+ (SY0-701), Network+ (N10-009), CEH Ethical Hacking & OWASP Top 10 Sets →

---

Deck 2: Cryptography (Symmetric/Asymmetric, Hashing, PKI, TLS 1.3 & Post-Quantum) (32 Cards — Basic)

What this deck covers: In-depth cryptographic foundations for CompTIA Security+, CISSP, and CEH: symmetric block/stream ciphers, modes of operation, asymmetric algorithms, PFS, cryptographic hashing, key stretching, PKI hierarchy, X.509 validation, TLS 1.3 handshake, HSM/TPM hardware roots of trust, and NIST Post-Quantum Cryptography.

High-Yield Prompt / Question	Core Concept & Mechanism	Exam Application & Details
Compare Symmetric and Asymmetric cryptography across key usage, performance, key distribution scalability, and security services.	Symmetric uses a single shared secret key for encryption and decryption	it is 100–1000x faster (suited for bulk data) but requires N(N-1)/2 keys for N parties and out-of-band key exchange, providing Confidentiality (and Integrity/Auth in AEAD). Asymmetric uses mathematically linked Public and Private keys (2N keys total); it is computational...
Compare AES, ChaCha20, 3DES, and RC4 symmetric ciphers in terms of block vs stream structure, key sizes, and security status.	AES (Rijndael): 128-bit block cipher with 128-, 192-, or 256-bit keys (10, 12, or 14 rounds)	current gold standard. ChaCha20: High-speed 256-bit stream cipher (usually paired with Poly1305 MAC); ideal for mobile/CPUs without AES-NI hardware acceleration. 3DES: Legacy 64-bit block cipher vulnerable to Sweet32 birthday attacks; deprecated. RC4: Biased stream cipher; cry...
Why is Electronic Codebook (ECB) block cipher mode insecure, and how do CBC and CTR modes improve upon it?	ECB encrypts each 128-bit plaintext block independently with the same key, so identical plaintext blocks produce identical ciphertext blocks (preserving visual patterns like the ECB Penguin).	CBC (Cipher Block Chaining) XORs each plaintext block with the previous ciphertext block (using a random IV for block 1). CTR (Counter) turns a block cipher into a stream cipher by encrypting sequential nonce+counter values and XORing the keystream with plaintext (allowing par...
What is Authenticated Encryption with Associated Data (AEAD), and why is AES-GCM preferred over AES-CBC in TLS 1.3?	AEAD (such as AES-GCM and ChaCha20-Poly1305) simultaneously provides confidentiality and integrity/authenticity in a single cryptographic construct, computing an authentication tag over both the encrypted payload and ...	AES-GCM is parallelizable, hardware-accelerated, and immune to padding oracle attacks (such as POODLE and Lucky13) that plagued AES-CBC.
What is the mathematical trapdoor behind RSA versus Elliptic Curve Cryptography (ECC), and how do their key sizes compare for equivalent security?	RSA relies on the computational difficulty of factoring the product of two large prime numbers (n = p * q).	ECC relies on the Elliptic Curve Discrete Logarithm Problem (ECDLP)—finding scalar k given points P and Q = kP on an elliptic curve. A 256-bit ECC key provides comparable security (~128-bit security level) to a 3072-bit RSA key, requiring far less CPU, memory, and bandwi...
How do Diffie-Hellman (DH) and Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) key exchange work, and why are they vulnerable to MitM without authentication?	DH/ECDHE allow two parties to establish a shared secret over an insecure channel (g^(ab) mod p or a*b*G on an elliptic curve) without transmitting the secret itself.	Because classic DH does not authenticate the participants' identities, an active Man-in-the-Middle can establish separate DH keys with each side unless DH parameters are authenticated via digital certificates/signatures.
What is Perfect Forward Secrecy (PFS), and why does static RSA key exchange fail to provide it?	PFS guarantees that if a server's long-term private key is compromised in the future, past recorded encrypted sessions cannot be decrypted.	Ephemeral key exchanges (DHE or ECDHE) generate unique, temporary session keys per connection that are destroyed after the session ends. With static RSA key exchange, an attacker recording traffic can later use the stolen server private key to decrypt all historical sessions.
What are the three core properties of a cryptographic hash function (Pre-image resistance, Second pre-image resistance, and Collision resistance)?	1.	Pre-image resistance (One-wayness): Given hash h, it is computationally infeasible to find any input m such that H(m) = h. 2. Second pre-image resistance: Given a specific input m1, it is infeasible to find a different input m2 where H(m1) = H(m2). 3. Collision res...
How does the Birthday Attack affect hash collision resistance, and compare MD5, SHA-1, SHA-256, and SHA-3?	By the Birthday Paradox, finding a hash collision for an n-bit hash requires roughly 2^(n/2) operations rather than 2^n.	MD5 (128-bit) and SHA-1 (160-bit, SHAttered attack) are broken for collision resistance. SHA-256 (256-bit, Merkle-Damgard construction, 128-bit collision resistance) is widely secure. SHA-3 (Keccak) uses a completely different 'sponge construction' unaffected by length-extensi...
What is a Length Extension Attack, which hash families are vulnerable, and how does HMAC prevent it?	Hash functions based on the Merkle-Damgard construction (MD5, SHA-1, SHA-256) output their internal state as the final digest.	If a naive MAC is built as H(secret || message), an attacker knowing H(secret || message) and len(secret) can append data and compute a valid hash H(secret || message || padding || extension) without knowing the secret. HMAC (`H((K ^ opad) || H((K ^ ipad) ...
Why are fast cryptographic hashes (like raw SHA-256) unsuitable for password storage, and compare PBKDF2, bcrypt, scrypt, and Argon2id?	GPUs/ASICs can compute billions of raw SHA-256 hashes per second. Key stretching/Password-Based Key Derivation Functions intentionally add tunable work factors: PBKDF2 applies thousands of HMAC iterations (CPU-hard, v...	bcrypt uses the Blowfish state setup (cost factor, 4KB RAM); scrypt and Argon2id (OWASP #1 recommendation) are memory-hard and CPU-hard, thwarting custom ASICs and GPUs.
What is the difference between a Salt and a Pepper in password hashing?	A Salt is a unique, cryptographically random value generated per user and stored alongside the password hash in the database to prevent rainbow tables and identical hashes.	A Pepper is a high-entropy secret key shared across all passwords (or an HMAC secret) stored separately from the database (e.g., in an HSM or environment vault) so that a SQL injection database dump alone cannot be cracked offline.

👉 Practice Deck 2: Cryptography (Symmetric/Asymmetric, Hashing, PKI, TLS 1.3 & Post-Quantum) (32 Flashcards) →
🔍 Browse All Basic CompTIA Security+ (SY0-701), Network+ (N10-009), CEH Ethical Hacking & OWASP Top 10 Sets →

---

Deck 3: Identity & Access Management (OAuth 2.0, OIDC, SAML, Kerberos, MFA & Zero Trust) (32 Cards — Intermediate)

What this deck covers: Deep dive into Identity and Access Management (IAM): AAA framework, MFA and FIDO2/WebAuthn passkeys, access control models (DAC, MAC, RBAC, ABAC), Kerberos protocol flow, SAML 2.0 vs OAuth 2.0 vs OIDC, RADIUS vs TACACS+, Privileged Access Management (PAM), and NIST SP 800-207 Zero Trust Architecture.

High-Yield Prompt / Question	Core Concept & Mechanism	Exam Application & Details
Define the four components of the IAAA (Identification, Authentication, Authorization, and Accounting) security framework.	Identification: Claiming an identity (e.g., entering a username or email).	Authentication (AuthN): Proving that identity claim using one or more factors. Authorization (AuthZ): Determining what actions or resources the authenticated identity is permitted to access. Accounting (Auditing): Logging and tracking user actions, session duration, and resour...
What are the five categories of authentication factors, and what constitutes true Multi-Factor Authentication (MFA)?	1. Something you know (password, PIN)	2. Something you have (smart card, YubiKey, authenticator app); 3. Something you are (fingerprint, iris, facial biometrics); 4. Somewhere you are (geolocation/IP subnet); 5. Something you do (typing cadence, gait). True MFA requires combining factors from AT LEAST TWO DIFFEREN...
Compare HOTP (RFC 4226) and TOTP (RFC 6238) one-time password algorithms.	Both compute an HMAC (typically HMAC-SHA1/256) using a shared secret seed between server and token, then truncate it to a 6–8 digit code.	HOTP uses an incrementing event counter (C) synchronized on each button press. TOTP replaces the counter with the current Unix timestamp divided by a time step (typically 30 seconds), expiring codes automatically.
What is an MFA Fatigue (Push Bombing) or Adversary-in-the-Middle (AitM) reverse-proxy phishing attack, and why does FIDO2/WebAuthn defeat both?	MFA Fatigue floods a user with push notifications until they press 'Approve'	AitM tools (like Evilginx) proxy real-time login sessions to steal session cookies after TOTP entry. FIDO2/WebAuthn (Passkeys) uses asymmetric public-key cryptography bound strictly to the browser's exact origin domain (rpId): the authenticator signs a challenge containing t...
Define False Acceptance Rate (FAR), False Rejection Rate (FRR), and Crossover Error Rate (CER) in biometric authentication.	FAR (Type II Error): The rate at which an unauthorized impostor is erroneously granted access (most dangerous for security). FRR (Type I Error): The rate at which a legitimate enrolled user is erroneously denied acces...	a lower CER indicates a more accurate and reliable biometric system.
Compare Discretionary Access Control (DAC) and Mandatory Access Control (MAC).	DAC: Every resource has an Owner who has full discretion to grant or revoke permissions (ACLs) to other users (e.g., standard NTFS or Unix chmod)	flexible but vulnerable to Trojan horses inheriting user permissions. MAC: System-enforced access based on security clearances of subjects and sensitivity labels of objects (e.g., Top Secret, SELinux); users cannot alter permissions.
In Mandatory Access Control, how does the Bell-LaPadula model differ from the Biba integrity model?	Bell-LaPadula enforces Confidentiality: 'No Read Up' (Simple Security Property: a Secret user cannot read Top Secret files) and 'No Write Down' (*-Property: a Top Secret user cannot write to a Secret file to prevent d...	Biba enforces Integrity: 'No Read Down' (cannot read lower-integrity untrusted data) and 'No Write Up' (cannot corrupt higher-integrity data).
Compare Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC), and Rule-Based Access Control (RuBAC).	RBAC assigns permissions to job functions/Groups (e.g., 'Billing_Admin') rather than individuals, preventing privilege creep when roles change.	ABAC evaluates dynamic boolean policies combining Subject attributes (role, clearance), Resource attributes (classification), Action, and Environmental context (time, device posture, IP—e.g., XACML/AWS IAM tag policies). RuBAC enforces deterministic system rules (e.g., firewal...
Walk through the 6-step Kerberos (TCP/UDP Port 88) authentication flow using the KDC, AS, TGT, TGS, and Service Ticket.	1. Client sends username + timestamp encrypted with password hash to Key Distribution Center (KDC) Authentication Server (AS)	2. AS returns a Ticket Granting Ticket (TGT, encrypted with krbtgt key) + session key; 3. Client sends TGT + SPN to Ticket Granting Server (TGS); 4. TGS returns a Service Ticket encrypted with the target server's secret key; 5. Client presents Service Ticket to target server...
Why does Kerberos require strict NTP clock synchronization (default 5-minute skew tolerance) across all domain hosts?	Kerberos embeds encrypted timestamps inside authenticators and tickets to prevent replay attacks without maintaining stateful challenge databases.	If a client's system clock drifts more than the configured maximum tolerance (default 5 minutes in Active Directory) from the KDC's clock, the KDC rejects the request with KRB_AP_ERR_SKEW.
Compare LDAP (Port 389) and LDAPS (Port 636) / StartTLS, and explain what an X.500 Distinguished Name (DN) looks like.	LDAP (Lightweight Directory Access Protocol) queries and modifies hierarchical directory services (like Active Directory or OpenLDAP) over cleartext TCP/UDP 389 unless upgraded via StartTLS	LDAPS wraps LDAP over TLS on TCP 636. A Distinguished Name (DN) uniquely identifies an entry from leaf to root, e.g., CN=Alice Smith,OU=Security,DC=corp,DC=example,DC=com.
How does SAML 2.0 (Security Assertion Markup Language) enable enterprise Web Single Sign-On (SSO)?	SAML 2.0 is an XML-based federation standard involving three parties: Principal (User/Browser), Identity Provider (IdP, e.g., Okta/Entra ID), and Service Provider (SP, e.g., Salesforce). In SP-initiated SSO, the SP re...	the user authenticates at the IdP, which returns a digitally signed XML SAMLResponse assertion posted via the browser back to the SP's Assertion Consumer Service (ACS).

👉 Practice Deck 3: Identity & Access Management (OAuth 2.0, OIDC, SAML, Kerberos, MFA & Zero Trust) (32 Flashcards) →
🔍 Browse All Intermediate CompTIA Security+ (SY0-701), Network+ (N10-009), CEH Ethical Hacking & OWASP Top 10 Sets →

---

Deck 4: Network Security (Firewalls, IDS/IPS, VPNs, WPA3, DNSSEC & Port Numbers) (32 Cards — Intermediate)

What this deck covers: Enterprise network defense mastery: essential TCP/UDP port numbers, firewall architectures (Stateless/Stateful/NGFW/WAF), IDS/IPS detection models, VLAN segmentation, Layer 2 attacks and Cisco switch mitigations, IPsec IKEv2 VPNs, WPA3 SAE/802.1X wireless security, DNSSEC/DoH/DoT, and DDoS mitigation.

High-Yield Prompt / Question	Core Concept & Mechanism	Exam Application & Details
What are the default TCP/UDP port numbers for SSH, Telnet, SMTP (Relay vs Submission), DNS, DHCP, HTTP, and HTTPS?	SSH ( plus SFTP/SCP): TCP 22	Telnet: TCP 23 (unencrypted); SMTP: TCP 25 (server-to-server relay), TCP 587 (STARTTLS client submission), TCP 465 (SMTPS); DNS: UDP/TCP 53 (UDP for standard queries, TCP for zone transfers AXFR/IXFR and responses >512 bytes); DHCP: UDP 67 (Server) & UDP 68 (Client); HTTP: TCP...
What are the default TCP/UDP port numbers for Kerberos, POP3/POP3S, IMAP/IMAPS, SNMP, LDAP/LDAPS, SMB, Syslog, RADIUS, and RDP?	Kerberos: TCP/UDP 88	POP3: TCP 110 / POP3S: TCP 995; IMAP: TCP 143 / IMAPS: TCP 993; SNMP: UDP 161 (Agent queries) & UDP 162 (Manager traps); LDAP: TCP/UDP 389 / LDAPS: TCP 636; SMB/CIFS: TCP 445; Syslog: UDP 514 / Syslog-TLS: TCP 6514; RADIUS: UDP 1812 (Auth) & UDP 1813 (Accounting); RDP: TCP/UDP...
Compare Stateless Packet Filtering, Stateful Inspection, Next-Generation Firewalls (NGFW), and Web Application Firewalls (WAF).	Stateless (Layer 3/4 ACL): Evaluates each packet in isolation against static IP/port rules without tracking connection state.	Stateful (Layer 3/4): Maintains a state table tracking active TCP handshakes (SYN, ESTABLISHED) and automatically permits return traffic. NGFW (Layer 3–7): Adds Deep Packet Inspection (DPI), Application awareness, user identity (AD integration), and inline IPS. WAF (Layer ...
Compare Network IDS (NIDS) and Network IPS (NIPS) in terms of physical/logical topology, failure modes, and response capabilities.	NIDS is deployed out-of-band (connected to a switch SPAN/mirror port or network TAP)	it passively analyzes copies of traffic to raise alerts and send TCP RSTs, but cannot block the initial malicious packet. NIPS is deployed inline in the active data path; it drops malicious packets in real time and supports Fail-Open (pass traffic if appliance crashes for avai...
Compare Signature-Based, Anomaly/Behavioral-Based, and Heuristic detection engines, and define False Positives vs False Negatives.	Signature-Based: Matches traffic against known exploit patterns/hashes (low false positives, blind to zero-days).	Anomaly-Based: Learns a statistical baseline of normal network behavior and alerts on deviations (can catch zero-days, higher false positives if baseline is noisy). False Positive (Type I): Benign traffic flagged/blocked as malicious. False Negative (Type II): Actual malicious...
How do 802.1Q VLANs, Trunk Ports vs Access Ports, and VLAN Hopping attacks (Switch Spoofing & Double Tagging) work?	IEEE 802.1Q inserts a 4-byte VLAN tag into Ethernet frames to logically segment broadcast domains acrossTrunk Ports (which carry multiple VLANs), while Access Ports carry a single VLAN. Switch Spoofing exploits Cisco ...	Double Tagging prepends two 802.1Q tags when the attacker's VLAN matches the trunk Native VLAN. Mitigation: Disable DTP (switchport mode access, switchport nonegotiate) and change the Native VLAN to an unused ID.
What is a Screened Subnet (DMZ), and how does North-South traffic differ from East-West traffic in Zero Trust Microsegmentation?	A Screened Subnet (DMZ) places public-facing servers (web, mail, reverse proxy) between an external perimeter firewall and an internal firewall (or three-legged firewall) so an external web compromise cannot directly ...	East-West traffic moves laterally between internal servers/workloads and is restricted using host-based or SDN microsegmentation.
How does ARP Poisoning (ARP Spoofing) work at Layer 2, and how does Dynamic ARP Inspection (DAI) prevent it?	Because standard ARP is stateless and unauthenticated, an attacker on the local subnet broadcasts forged gratuitous ARP replies claiming their own MAC address owns the Default Gateway's IP, positioning themselves as a...	Dynamic ARP Inspection (DAI) on managed switches intercepts all ARP packets on untrusted ports and drops any packet whose IP-to-MAC mapping does not match the trusted DHCP Snooping binding database.
How does a MAC Flooding (CAM Table Overflow) attack work, and how does Switch Port Security mitigate it?	A switch stores learned MAC-to-port mappings in fixed-size Content Addressable Memory (CAM).	Flooding a port with thousands of frames containing bogus source MAC addresses fills the CAM table, causing some switches to fail open and broadcast unknown unicast frames out all ports like a Layer 1 hub. Port Security (switchport port-security) limits the maximum number of...
What is a Rogue DHCP Server / DHCP Starvation attack, and how does DHCP Snooping prevent it?	In DHCP Starvation, an attacker exhausts a legitimate DHCP server's IP pool with spoofed DHCPDISCOVER requests, then stands up a Rogue DHCP server handing out a malicious Default Gateway and DNS server.	DHCP Snooping categorizes switch ports as Trusted (uplinks to real DHCP servers) or Untrusted (access ports), immediately dropping any DHCPOFFER or DHCPACK server messages arriving on untrusted ports and building the IP-MAC binding table.
How does a Spanning Tree Protocol (STP) Root Bridge Manipulation attack work, and how do BPDU Guard and Root Guard stop it?	STP (IEEE 802.1D / 802.1w RSTP) prevents Layer 2 switching loops by electing a Root Bridge with the lowest Bridge ID (Priority + MAC). An attacker plugs in a rogue switch broadcasting Superior BPDUs with Priority 0 to...	Root Guard blocks a port (root-inconsistent) if a superior BPDU arrives.
Compare IPsec Authentication Header (AH) and Encapsulating Security Payload (ESP), including protocol numbers and NAT Traversal (NAT-T).	AH (IP Protocol 51): Provides connectionless integrity, data origin authentication, and anti-replay over the entire IP packet (including immutable outer IP header fields), but provides NO encryption (no confidentialit...	ESP (IP Protocol 50): Provides Confidentiality (encryption), Integrity, Authentication, and anti-replay for the payload, and works across NAT by encapsulating ESP inside UDP Port 4500 (NAT-T).

👉 Practice Deck 4: Network Security (Firewalls, IDS/IPS, VPNs, WPA3, DNSSEC & Port Numbers) (32 Flashcards) →
🔍 Browse All Intermediate CompTIA Security+ (SY0-701), Network+ (N10-009), CEH Ethical Hacking & OWASP Top 10 Sets →

---

Deck 5: Web Application Security (OWASP Top 10: SQLi, XSS, CSRF, SSRF & Secure Coding) (32 Cards — Advanced)

What this deck covers: Advanced web and API application security: the complete OWASP Top 10 (A01–A10), SQL Injection and parameterized queries, Cross-Site Scripting (XSS) and CSP, CSRF and SameSite cookies, SSRF and AWS IMDSv2, XXE, Insecure Deserialization, JWT attacks, CORS, HTTP security headers, and SAST/DAST/IAST/SCA/SBOM.

High-Yield Prompt / Question	Core Concept & Mechanism	Exam Application & Details
List all 10 categories of the OWASP Top 10 (2021 edition) in order from A01 to A10.	A01: Broken Access Control	A02: Cryptographic Failures; A03: Injection; A04: Insecure Design; A05: Security Misconfiguration; A06: Vulnerable and Outdated Components; A07: Identification and Authentication Failures; A08: Software and Data Integrity Failures; A09: Security Logging and Monitoring Failures...
What is an Insecure Direct Object Reference (IDOR / BOLA under OWASP A01), and why doesn't replacing sequential integers with UUIDs fix it?	IDOR (or Broken Object Level Authorization in APIs) occurs when an application uses user-supplied identifiers (e.g., /api/invoices/1042 or ?user_id=505) to fetch database records without verifying on the server th...	true remediation requires server-side object-level authorization checks on every request.
Compare Horizontal Privilege Escalation, Vertical Privilege Escalation, and Mass Assignment (Object Injection) in web APIs.	Horizontal Privilege Escalation: Accessing resources belonging to another user at the same permission level (e.g., User A viewing User B's medical record).	Vertical Privilege Escalation: A standard user executing administrative functions (e.g., calling /admin/deleteUser). Mass Assignment: Automatically binding raw JSON request body fields directly to internal data models/ORM entities, allowing an attacker to inject `{"role": "a...
How does Directory Traversal (Path Traversal ../) differ from Local File Inclusion (LFI) and Remote File Inclusion (RFI)?	Path Traversal (../../../../etc/passwd or URL-encoded %2e%2e%2f) manipulates file path parameters to read arbitrary files outside the web root. LFI additionally passes the local file to an interpreter (e.g., PHP `...	validate against a strict allowlist and canonicalize paths (realpath).
Compare In-Band (Union-Based, Error-Based), Inferential (Boolean-Blind, Time-Based Blind), and Out-of-Band SQL Injection (SQLi).	In-Band: Results return directly in the HTTP response via UNION SELECT column appending or verbose database error messages. Blind (Inferential): App returns no data/errors	attacker infers truth bit-by-bit via page changes (AND SUBSTRING((SELECT password FROM users LIMIT 1),1,1)='a') or response delays (SLEEP(5), WAITFOR DELAY). Out-of-Band: Forces the DB server to make an external DNS or HTTP request (xp_dirtree, UTL_HTTP) carrying exf...
Why do Prepared Statements (Parameterized Queries) completely prevent SQL Injection, whereas input blacklisting or escaping often fails?	In a Prepared Statement (SELECT * FROM users WHERE username = ?), the database compiles the SQL query structure and execution plan BEFORE inserting parameters.	User input is bound strictly as a literal scalar value in a separate protocol phase and can never be interpreted as executable SQL syntax (OR 1=1--), even if it contains quotes or SQL keywords. Note: Dynamic table/column names (ORDER BY) cannot be parameterized and require...
What are OS Command Injection and LDAP/NoSQL Injection, and how are they prevented?	OS Command Injection occurs when user input is concatenated into a shell string (e.g., system("ping -c 4 " + ip)), allowing metacharacters (;, &&, |, $()) to execute arbitrary OS commands	prevent by calling safe language APIs (execve/subprocess.run(["ping", ip], shell=False)) that bypass the shell. NoSQL Injection injects operator objects (e.g., MongoDB {"$ne": null} in JSON login bodies) to bypass auth; prevent via strict schema/type validation.
Compare Stored (Persistent), Reflected (Non-Persistent), and DOM-Based Cross-Site Scripting (XSS).	Stored XSS: Malicious script is saved permanently in the backend database (e.g., forum comment or user profile) and executed in the browser of every user who views that page.	Reflected XSS: Payload is part of the crafted URL/request (e.g., ?q=<script>...) and immediately reflected by the server in the HTML response. DOM-Based XSS: Vulnerability exists entirely in client-side JavaScript that reads an untrusted source (location.hash, `location.se...
What is the primary defense against XSS, and how does Content Security Policy (CSP) provide defense-in-depth?	Primary defense: Context-Aware Output Encoding (HTML entity encoding < to &lt; in HTML body, attribute encoding, JavaScript hex encoding) and using safe DOM APIs (textContent instead of innerHTML) or auto-esca...	object-src 'none') blocks inline scripts, eval()`, and unauthorized external script domains.
How does a Cross-Site Request Forgery (CSRF / XSRF) attack work, and why doesn't HttpOnly on session cookies prevent it?	In CSRF, a victim already logged into bank.com visits an attacker's site (evil.com), which triggers an automatic cross-origin HTTP request (e.g., a hidden auto-submitting `<form action="https://bank.com/transfer" ...	the browser still sends the cookie automatically!
What are the two primary defenses against CSRF: Synchronizer Anti-CSRF Tokens and SameSite Cookie attributes?	1. Anti-CSRF Tokens (Synchronizer Token Pattern): The server generates a cryptographically random, user-session-bound token placed in a hidden form field or custom HTTP header (X-CSRF-Token)	because of the Same-Origin Policy, evil.com cannot read the token from bank.com. 2. SameSite Cookie attribute: SameSite=Strict never sends the cookie on cross-site requests; SameSite=Lax (modern browser default)withholds the cookie on cross-site POST/subresource re...
How does Server-Side Request Forgery (SSRF, OWASP A10) exploit cloud environments via 169.254.169.254, and how does AWS IMDSv2 mitigate it?	SSRF tricks a backend server into making HTTP requests to internal-only addresses (e.g., via a webhook or PDF URL fetcher).	In cloud environments, requesting http://169.254.169.254/latest/meta-data/iam/security-credentials/ on IMDSv1 via a simple GET returns temporary IAM role credentials. AWS IMDSv2 mitigates SSRF by requiring a session-oriented PUT request first with a custom `X-aws-ec2-met...

👉 Practice Deck 5: Web Application Security (OWASP Top 10: SQLi, XSS, CSRF, SSRF & Secure Coding) (32 Flashcards) →
🔍 Browse All Advanced CompTIA Security+ (SY0-701), Network+ (N10-009), CEH Ethical Hacking & OWASP Top 10 Sets →

---

Deck 6: Incident Response (NIST/PICERL), Digital Forensics, GRC, Risk Management (ALE/SLE/ARO) & Cloud Security (32 Cards — Advanced)

What this deck covers: Executive and operational mastery for Security+, CISM, CISA, and CISSP: NIST SP 800-61 vs SANS PICERL incident response, RFC 3227 Order of Volatility, digital forensics and chain of custody, SIEM/SOAR/EDR/XDR, quantitative risk formulas (SLE/ALE/ARO), BIA continuity metrics (RTO/RPO/MTD/MTBF/MTTR), DR sites, CISA auditing, and cloud security (CASB/SASE/CSPM/CWPP).

High-Yield Prompt / Question	Core Concept & Mechanism	Exam Application & Details
Compare the 4 phases of the NIST SP 800-61 Incident Response Lifecycle with the 6 phases of the SANS PICERL model.	NIST SP 800-61 combines intermediate steps into 4 phases: 1. Preparation	2. Detection and Analysis; 3. Containment, Eradication, and Recovery; 4. Post-Incident Activity (Lessons Learned). SANS PICERL explicitly separates them into 6 sequential phases: 1. Preparation; 2. Identification; 3. Containment; 4. Eradication; 5. Recovery; 6. Lessons Learned.
During Incident Response, what happens in Containment (Short-Term vs Long-Term), Eradication, and Recovery?	Containment stops the bleeding so damage does not spread: Short-Term Containment immediately isolates the affected host (e.g., EDR network quarantine or VLAN ACL change while keeping power on for memory forensics)	Long-Term Containment applies temporary workarounds/firewall blocks to keep production running while rebuilding clean systems. Eradication removes the root cause (wiping/reimaging hosts, patching the exploited vulnerability, rotating all compromised credentials/keys). Recovery...
What is the RFC 3227 Order of Volatility for Digital Forensics evidence collection, from most volatile to least volatile?	Evidence must be collected from most volatile to least volatile: 1. CPU Registers and L1/L2/L3 Cache	2. System RAM (Memory dump via LiME/WinPmem), routing tables, ARP cache, active network connections (netstat), and running processes; 3. Temporary file systems / Swap space / Pagefile (pagefile.sys, hiberfil.sys); 4. Non-volatile Local Disks (SSD/HDD bit-stream image); 5...
How do you maintain Forensic Integrity and Chain of Custody when acquiring a disk image?	1. Document the Chain of Custody log (who handled the evidence, what item/serial number, when, where stored, and why at every transfer)	2. Connect physical storage through a Hardware Write Blocker so the investigator's OS cannot alter timestamps or metadata; 3. Capture a bit-for-bit forensic image (dd, dcfldd, FTK Imager, E01 format) including unallocated slack space and deleted sectors; 4. Compute SHA-256...
What are Slack Space, Wear Leveling / TRIM challenges on SSDs, and Legal Hold in eDiscovery?	Slack Space is the unused portion of a fixed-size filesystem cluster between the end of a file (EOF) and the end of the allocated cluster—which may retain remnants of previously deleted files.	Modern SSDs use Wear Leveling and garbage collection (TRIM), which automatically zeroes out deleted blocks in the background, making traditional deleted-file recovery nearly impossible compared to magnetic HDDs. A Legal Hold (Litigation Hold) is a mandatory legal directive s...
Why do Cloud Forensics and Container Forensics differ from traditional on-premises disk forensics?	In public cloud and Kubernetes environments, physical hardware is abstracted and multi-tenant (you cannot seize a physical hard drive in AWS/GCP), and containers are ephemeral.	Investigators instead use cloud APIs to take point-in-time EBS/Persistent Disk snapshots, isolate instances via quarantine Security Groups (preserving IAM metadata and memory), inspect immutable CloudTrail/VPC Flow Logs, and pause/checkpoint containers (docker commit / CRIU)...
Compare SIEM, SOAR, EDR, and XDR in modern Security Operations Centers (SOCs).	SIEM (Security Information and Event Management): Aggregates, normalizes, and correlates logs/events from across the enterprise (firewalls, AD, cloud, endpoints) for compliance, alerting, and threat hunting.	SOAR (Security Orchestration, Automation, and Response): Executes automated playbooks/runbooks (e.g., enriching phishing indicators via VirusTotal API, opening a Jira ticket, and isolating a host) to reduce MTTR. EDR (Endpoint Detection and Response): Kernel/user telemetry age...
What is User and Entity Behavior Analytics (UEBA), and how does it detect Insider Threats and compromised credentials?	Unlike static rule-based SIEM correlation, UEBA applies machine learning and statistical profiling to establish baselines of normal behavior for every human user and machine entity (service accounts, IoT, hosts).	When an employee's account suddenly downloads 50 GB of source code from GitHub at 3:00 AM or queries unusual SMB shares laterally, UEBA raises the entity's risk score even though no malware signature was triggered.
State the Quantitative Risk Analysis formulas for Single Loss Expectancy (SLE), Annualized Rate of Occurrence (ARO), and Annualized Loss Expectancy (ALE).	1.	SLE = AV * EF, where AV is Asset Value ($) and EF is Exposure Factor (percentage of asset value lost in a single incident, from 0.0 to 1.0). 2. ARO is the estimated number of times the threat event will occur in one year (e.g., once every 4 years = 0.25). 3. `ALE...
Work through a Quantitative Risk Analysis & Safeguard Cost-Benefit calculation: An asset worth $200,000 faces a threat that destroys 50% of its value once every 5 years. A control costs $12,000/year and reduces ARO to 0.05. Is the safeguard worth buying?	1.	SLE = AV * EF = $200,000 * 0.50 = $100,000. 2. ALE_prior = SLE * ARO_prior = $100,000 * (1/5 = 0.20) = $20,000/year. 3. ALE_post = $100,000 * 0.05 = $5,000/year. 4. `Net Value of Safeguard = (ALE_prior - ALE_post) - Annual Cost of Safeguard = ($20,000 - $5,000) - $12,000...
Compare the four Risk Treatment (Risk Response) strategies: Risk Mitigation, Risk Transfer, Risk Avoidance, and Risk Acceptance.	Mitigation (Reduction): Implementing security controls to reduce the likelihood (ARO) or impact (EF) of a risk.	Transfer (Sharing): Shifting the financial impact of a risk to a third party (e.g., purchasing cyber insurance or outsourcing to a cloud provider—note that legal/regulatory accountability can NEVER be transferred). Avoidance: Ceasing the business activity or decommissioning th...
Define Inherent Risk, Residual Risk, Control Risk, Risk Appetite, and Risk Tolerance.	Inherent Risk: The raw level of risk existing before any security controls are applied. Residual Risk: The remaining risk that persists AFTER security controls have been implemented (`Residual Risk = Inherent Risk - C...	senior management must formally accept residual risk. Risk Appetite: The broad, high-level amount of risk an organization is willing to pursue to achieve strategic objectives. Risk Tolerance: The specific, measurable acceptable variance around risk appetite metrics.

👉 Practice Deck 6: Incident Response (NIST/PICERL), Digital Forensics, GRC, Risk Management (ALE/SLE/ARO) & Cloud Security (32 Flashcards) →
🔍 Browse All Advanced CompTIA Security+ (SY0-701), Network+ (N10-009), CEH Ethical Hacking & OWASP Top 10 Sets →

---

Complete 6-Deck Quick-Access Directory

Deck #	Deck Title	Level	Cards	Direct Practice Link
Deck 1	Threats, Vulnerabilities, Malware, Social Engineering & MITRE ATT&CK	basic	32	Open Deck 1 →
Deck 2	Cryptography (Symmetric/Asymmetric, Hashing, PKI, TLS 1.3 & Post-Quantum)	basic	32	Open Deck 2 →
Deck 3	Identity & Access Management (OAuth 2.0, OIDC, SAML, Kerberos, MFA & Zero Trust)	intermediate	32	Open Deck 3 →
Deck 4	Network Security (Firewalls, IDS/IPS, VPNs, WPA3, DNSSEC & Port Numbers)	intermediate	32	Open Deck 4 →
Deck 5	Web Application Security (OWASP Top 10: SQLi, XSS, CSRF, SSRF & Secure Coding)	advanced	32	Open Deck 5 →
Deck 6	Incident Response (NIST/PICERL), Digital Forensics, GRC, Risk Management (ALE/SLE/ARO) & Cloud Security	advanced	32	Open Deck 6 →

👉 Launch Full CompTIA Security+ (SY0-701), Network+ (N10-009), CEH Ethical Hacking & OWASP Top 10 Spaced-Repetition Track →