AI Bot
Security Operations and Incident Investigation Flashcards
CompTIA Security+ SY0-801 (V8) Flashcards
Study our Security Operations and Incident Investigation flashcards for the CompTIA Security+ SY0-801 (V8) exam with 80+ flashcards. View as flashcards, a searchable table, or as a fun matching game.
| Front | Back |
| 802.1X | Standard for port-based network access control on wired and wireless networks. |
| Access review | Periodically checks whether existing permissions remain appropriate and necessary. |
| Account deprovisioning | Disables or removes accounts and associated access when they are no longer authorized. |
| Account provisioning | Creates accounts and assigns the access needed for an authorized role. |
| Agentic AI | Artificial intelligence that plans and takes actions toward a goal with limited human supervision. |
| Alert tuning | Adjusts detection rules and thresholds to reduce noise while preserving useful threat detection. |
| Application allowlisting | Permits only explicitly approved applications or components to run. |
| Asset assignment | Links an asset to its responsible owner or assigned user for accountability. |
| Asset decommissioning | Securely retires an asset from service and updates records to reflect its removal. |
| Asset inventory | Maintained record of organizational assets and their identifying information and ownership. |
| Authentication log | Records authentication attempts and their outcomes to support access investigations. |
| Automation guardrails | Limits and checks that constrain automated actions to reduce unintended harm. |
| Bit-level copy | Bit-for-bit storage image that includes allocated data and unallocated or slack space. |
| Chain of custody | Documented history of evidence collection and handling that tracks possession and transfers. |
| CI/CD | Continuous integration and continuous deployment; automates software integration and testing through deployment. |
| Containment | Limits an incident's spread and additional damage through measures such as isolating affected systems. |
| CSPM | Cloud security posture management; continuously assesses cloud configurations to identify misconfigurations and security risks. |
| DAC | Discretionary access control; allows resource owners to determine who receives access. |
| Data sanitization | Makes access to stored target data infeasible for a defined level of effort before media reuse or disposal. |
| Desired state management | Defines an intended configuration and checks or enforces systems against that state. |
| DKIM | DomainKeys Identified Mail; uses digital signatures to verify a signing domain and detect changes to signed message content. |
| DLP | Data loss prevention; detects sensitive information and restricts unauthorized sharing or transfer. |
| DMARC | Domain-based Message Authentication Reporting and Conformance; checks From-domain alignment with SPF or DKIM and publishes handling policies. |
| E-discovery | Identifies and produces electronically stored information for investigations or legal proceedings. |
| EDR | Endpoint detection and response; monitors endpoint activity to detect threats and support investigation and response. |
| Emergency access account | Reserved administrative account for regaining access when normal authentication or administrative access fails. |
| Eradication | Removes malicious components and persistence mechanisms while addressing exploited weaknesses. |
| Evidence preservation | Protects evidence from alteration or destruction so it remains usable for investigation. |
| Federation | Allows a service to trust authentication assertions from an external identity provider. |
| File and log integrity | Assurance that recorded data has not been improperly altered; cryptographic hash comparisons help detect changes. |
| Hardening | Reduces attack surface through secure configuration and removal of unnecessary services. |
| Honeypot | Decoy system designed to attract attackers and reveal their activity. |
| Honeytoken | Decoy data or credentials whose access or use can trigger an alert. |
| Identity proofing | Establishes that a person claiming an identity is actually that person. |
| Incident recovery | Restores affected systems and services to secure operation after an incident. |
| Incident response playbook | Documented actions for handling a particular incident type consistently. |
| IPAM | Internet Protocol address management; tracks address allocation and usage to support network visibility and asset identification. |
| IPFIX | Internet Protocol Flow Information Export; standardized protocol for exporting network-flow information to collectors. |
| JIT access | Just-in-time access; grants temporary permissions only when needed rather than maintaining standing privileges. |
| LDAP | Lightweight Directory Access Protocol; accesses and modifies directory information and supports authentication operations. |
| Log aggregation | Collects logs from multiple sources into a central location for analysis. |
| Log parsing | Extracts structured fields from log entries so events can be searched and analyzed. |
| Mandatory access control | Enforces centrally defined access rules using resource sensitivity labels and user authorizations. |
| MDM | Mobile device management; centrally configures enrolled devices and enforces security policies. |
| Memory dump | Captured contents of volatile memory that may reveal running processes and other transient evidence. |
| Metadata | Information describing other data such as a file's author or creation time. |
| MFA | Multifactor authentication; requires more than one distinct authentication factor rather than multiple credentials of the same factor type. |
| NAC | Network access control; governs network access using identity and device security posture. |
| NetFlow | Exports traffic-flow summaries that describe communicating endpoints and traffic volume rather than full packet contents. |
| NIDS | Network-based intrusion detection system; monitors network traffic for suspicious activity and generates alerts. |
| NIPS | Network-based intrusion prevention system; detects suspicious network traffic and can actively block it. |
| OAuth | Authorization framework that grants applications limited access to resources without sharing the resource owner's password. |
| Packet capture | Recorded network packets that allow detailed examination of headers and available payload data. |
| Passkey | Public-key credential bound to a website or application that enables phishing-resistant passwordless authentication. |
| PIR | Post-incident reporting; documents incident impact and response actions along with lessons learned and recommended improvements. |
| Port mirroring | Copies selected network traffic to another port for monitoring or packet analysis. |
| RBAC | Role-based access control; assigns permissions through roles associated with job responsibilities. |
| Remediation verification | Rescans or retests affected assets to confirm that a vulnerability was successfully addressed. |
| Responsible disclosure | Privately reports a vulnerability to the responsible party and coordinates remediation and public disclosure. |
| Root cause analysis | Identifies the underlying conditions that allowed an incident to occur. |
| SAML | Security Assertion Markup Language; exchanges identity assertions commonly used for federated single sign-on. |
| Sandboxing | Runs code in a restricted environment to limit its effects on other systems. |
| SCAP | Security Content Automation Protocol; standardizes machine-readable security configuration and vulnerability information for automated assessment. |
| Secrets scanning | Detects exposed credentials and other secrets in repositories. |
| Security automation | Uses software to perform predefined security tasks with reduced manual effort. |
| Security orchestration | Coordinates multiple security tools and their actions within a unified workflow. |
| Segmentation | Divides a network into controlled sections to limit unauthorized communication and lateral movement. |
| Service account | Nonhuman account used by an application or service to access resources. |
| SIEM | Security information and event management; aggregates and analyzes security data to detect threats and support investigations. |
| Snapshot | Point-in-time capture of system state; inclusion of memory depends on the platform and selected options. |
| SNMP | Simple Network Management Protocol; retrieves device management information and supports event notifications. |
| SPF | Sender Policy Framework; identifies hosts authorized to send email for an envelope sender domain. |
| SSO | Single sign-on; lets users access multiple applications after authenticating once. |
| Syslog | Protocol and message format for transmitting event logs to logging systems. |
| Tabletop exercise | Discussion-based rehearsal used to examine response plans and participant responsibilities without executing a live incident response. |
| Threat hunting | Proactive search for threats or malicious behavior that existing detections may have missed. |
| Vulnerability prioritization | Ranks weaknesses using severity and exploitability alongside asset exposure and business impact. |
| Vulnerability remediation | Addresses a weakness through actions such as patching or secure configuration changes. |
| WAF | Web application firewall; filters HTTP and HTTPS traffic to protect web applications from malicious requests. |
| XDR | Extended detection and response; correlates threat signals across multiple security domains rather than endpoints alone. |
Related Study Materials
About the Flashcards
Mastering core security concepts is essential for certification success. These Flashcards for the CompTIA Security+ exam provide a comprehensive review of essential terminology and defensive strategies. Students can reinforce their understanding of access control models, identity management, and network security protocols. The deck also explores critical security operations, including incident response procedures and digital forensics techniques.
Regular practice with these flashcards helps candidates memorize key ideas related to vulnerability management and security automation. By studying these concepts, learners will be better prepared to identify threats, manage organizational assets, and apply appropriate mitigation techniques during the test.
Topics covered in this flashcard deck:
- Identity and access management
- Network security and monitoring
- Incident response and digital forensics
- Vulnerability and asset management
- Security automation and orchestration