IT and Tech Certifications 30 flashcards ~15 min

Cybersecurity Fundamentals

About this deck

Build a strong foundation in cybersecurity with this comprehensive flashcard deck covering the core concepts every IT professional needs to understand — whether you're studying for CompTIA Security+, starting a career in IT support, or simply want to protect your own systems and data. Cybersecurity threats grow more sophisticated every year, making foundational knowledge essential across virtually every technology role.

This deck covers the CIA triad, common malware types, authentication factors and multi-factor authentication, encryption basics (symmetric vs asymmetric), common network attacks (phishing, DDoS, man-in-the- middle), social engineering tactics, password security, firewalls and VPNs, and general security best practices. Based on publicly available CompTIA Security+ exam objectives and standard cybersecurity frameworks.

Ready to test yourself?

Flip through all 30 cards in interactive study mode.

Launch study mode

All flashcards

Click any question to reveal the answer.

Confidentiality, Integrity, Availability — the three foundational goals of information security.

Malicious software designed to damage or gain unauthorized access. Covers viruses, worms, trojans, ransomware, spyware, adware.

Malicious code that attaches to a legitimate file and requires human action (opening/running it) to spread.

Self-replicating malware that spreads across networks without human interaction, exploiting vulnerabilities.

Malware disguised as legitimate software, relying on deception rather than self-replication to gain access.

Malware that encrypts a victim's files and demands payment for the decryption key.

Malware that secretly monitors user activity (keystrokes, browsing) to steal sensitive data.

Malware that gains privileged (admin/root) access while hiding its own presence, making it hard to detect.

A social engineering attack using fraudulent emails/messages that appear trustworthy, tricking victims into revealing information.

Targeted phishing directed at a specific individual, personalized to appear more credible.

Manipulating people psychologically into breaking security procedures, exploiting trust or urgency rather than technical flaws.

Creating a fabricated scenario (e.g., posing as IT support) to gain a victim's trust and extract information.

Flooding a target with overwhelming traffic from multiple compromised devices (a botnet), making the service unavailable.

Secretly intercepting communication between two parties who believe they're communicating directly.

Systematically trying every possible password combination until the correct one is found.

Trying common words/leaked passwords rather than every combination — faster than brute force against weak passwords.

Requiring 2+ factors: something you know, have, and are — greatly reduces unauthorized access risk.

Authentication: verifying who you are. Authorization: determining what you're allowed to access.

Converting readable data (plaintext) into unreadable ciphertext, decryptable only with the correct key.

Symmetric: same key encrypts/decrypts (fast, e.g. AES). Asymmetric: public/private key pair (slower, e.g. RSA).

An electronic document verifying identity, issued by a Certificate Authority, used in HTTPS.

A device/software that filters network traffic based on security rules, blocking unauthorized access.

Creates an encrypted tunnel over a public network, hiding traffic and enabling secure remote access.

Two-step may reuse the same factor type; two-factor requires genuinely different factor types.

Regularly applying updates that fix known vulnerabilities — unpatched software is a common attack vector.

Granting users only the minimum access needed for their role, limiting potential damage.

A flaw unknown to the vendor (no patch exists) at time of discovery or exploitation.

At rest: stored data (disk encryption). In transit: moving data (TLS/SSL, VPNs).

A decoy system set up to attract attackers so security teams can study their methods.

Long (12+ chars), mixed case/numbers/symbols, unique per account, ideally managed with a password manager.