SEC+ Terminology (JUL 2025)

When thinking about risk management, what does ALE stand for?

Moe requests to open a session with a web server using HTTP; which of the below ports might be used on Moe's system?

Select the answer with the correct order of volatility, with 1 being most volatile

Nowadays, organizations often implement some form of RBAC - what does that stand for?

Elliot gains access to Darlene's laptop and opens a listener on her laptop to send commands to. What did Elliot do?

Which of the below security solutions is used to prevent the malicious exfil of data?

When creating a BCP, we need to consider RTO - what does that stand for?

Which of the below techniques is used to identify threat actor activities without impacting production networks?

Which of the below is used to add extra complexity before going through a one-way algorithm?

Which of the below actors is typically financially motivated?

Which of the below controls is used to provide attribution of who conducted an action?

What is a structured process that is used to identify, document, and authorize changes to systems in production?

Which of the following techniques is typically only conducted by APTs?

What is used to document risks, responsible parties, and risk thresholds?

Indicators of a potential insider threat include which of the below? (Select all that apply)

In the field of CTI, we often worry about APTs... what does APT stand for?

What could be used to protect data located on an employee's laptop?

What is done to understand the reason why an incident occurred?

What type of scripts help automate the creation of accounts, removing the need for error-prone manual operations?

For symmetric encryption, we'll use a PSK - what is that?

Which of the below is used with public-facing web applications to prevent attacks like XSS, DOS, and buffer overflows?

What is it called when multiple servers are linked together to create a single logical system?

Which of the below lists the cloud service models in order from least to most risk for the customer

Which of the below sets the terms of a security assessment, stating what the third party can or cannot do?

Which program is used by organizations to compensate people for discovering vulnerabilities in their software?

Which attack makes use of an input field to run commands that allow the attacker to view or change data on the server?

Which of the below risk handling techniques is used when purchasing ransomware insurance?

Which of the below only allows known, trusted programs to execute on an endpoint?

Which of the below allows users users to have a single set of credentials to access multiple applications?

What does EDR stand for?

We sometimes use IKE when establishing secure connections, what does IKE stand for?

A remote attacker gained access to files in the /root directory through a vulnerable web app. What do we KNOW happened?

New employees and contractors often sign an AUP - what does that stand for?

Which of the below is a system used to prevent direct access from one segment of a network to another?

Someone purchases code from the dark web that exploits a known vulnerability. What type of attacker commonly does this?

What is the acceptable amount of time to restore a function?

What is the process of automating tasks across systems and applications, helping reduce human error and save time?

Which of the below security techniques can be used by developers to prevent against code injection?

Which plan is used to guide an organization's actions and objectives during an ongoing incident?

Which of the below is true with regard to XSS and CSRF attacks?

Which is a technical control that requires users to verify their identity by providing multiple pieces of evidence?

What is a low-cost cloud-based application-hosting solution?

MDM is implemented by many organizations to help their employees stay digitally safe. What does MDM stand for?

What does NGFW stand for?

The newest version of WPA (v3) replaced PSK with SAE - what does SAE stand for?

What is the current standard for symmetric encryption?

Which attack involves sending fraudulent text messages to trick individuals into revealing personal information?

Which of the below governs IT security measures for banking institutions?

Dan wants to send a secure message to Jane using asymmetric encryption, which key does Dan use to encrypt the message?

Sometimes we worry about a MITM attack - what is that?

What is the act of installing software outside of the manufacturer's approved software repository?

On which port does LDAP communicate on?

Which of the below techniques would help ensure integrity of data?

What is the process of adjusting a security solution, like a SIEM, to reduce the number of false positives?

In IPsec, we use AH - what does that stand for?