CompTIA A+ Security Summary

Phishing uses fake emails or websites that look real to trick people into giving up passwords or other information. Banks do not ask you to confirm your password through an email link. When in doubt, go to the site by typing its address yourself.

Wrong choices

• Shoulder surfing: Shoulder surfing is watching someone's screen or keyboard to steal information.
• Vishing: Vishing is the same kind of trick done over a voice phone call, not email.
• Tailgating: Tailgating is following someone through a secure door, not sending an email.

Ransomware encrypts a victim's files and demands money for the key. The best protection is good backups kept separate from the network, along with updates and careful email habits.

Wrong choices

• Adware: Adware shows unwanted ads. It does not encrypt files.
• Keylogger: A keylogger records keystrokes. It does not lock files for ransom.
• Spyware: Spyware secretly watches and reports what a user does. It does not lock files and demand payment.

WPA3 is the newest Wi-Fi security standard and gives the strongest protection. If an older device cannot use WPA3, WPA2 with AES is the next choice. WEP and TKIP are outdated and should not be used.

Wrong choices

• An open network with MAC filtering: An open network has no encryption, and MAC addresses are easy to copy.
• WPA2 with TKIP: WPA2 should use AES. TKIP is an older, weaker method.
• WEP: WEP is very old and can be cracked quickly.

MFA requires proof from at least two different kinds of factors: something you know (a password), something you have (a phone or token), or something you are (a fingerprint). A password plus a phone code combines know and have.

Wrong choices

• A very long password: A long password is stronger, but it is still a single factor.
• Two different passwords: Two passwords are both something you know, so this is one factor type.
• A password plus an answer to a security question: Both are things the user knows, so this is still only one factor type.

The principle of least privilege gives each user or program only the permissions needed for its job. For example, staff use standard accounts for daily work and use administrator rights only when truly needed. This limits the damage if an account is misused.

Wrong choices

• Single sign-on: Single sign-on lets users sign in once to reach many systems. It does not limit what they can access.
• Zero-day: A zero-day is a flaw that has no fix yet. It is not an access principle.
• Multifactor authentication: MFA strengthens sign-in. It does not decide how much access a user gets.

Vishing (voice phishing) is a phone call that tries to trick someone into giving away information. A real help desk should never ask for your password. Hang up and call the help desk back on its known number.

Wrong choices

• Smishing: Smishing uses text messages, not voice calls.
• Whaling: Whaling targets top executives, usually through tailored emails.
• Phishing: Phishing usually means fake emails. A phone call is called vishing.

Tailgating happens when an unauthorized person slips through a secured door behind someone who has access. Staff training and access control vestibules (two-door entry areas) help stop it.

Wrong choices

• Dumpster diving: Dumpster diving is searching trash for useful information.
• Impersonation: Impersonation means pretending to be someone else, such as a repair person. Simply following someone through a door is tailgating.
• Shoulder surfing: Shoulder surfing is watching a person's screen or keypad to steal information.

Locking the screen keeps the session open but requires a password, PIN, or other sign-in to use it again. In Windows, the quickest way is Windows key + L.

Wrong choices

• Close all open programs and leave it signed in: Anyone could still sit down and use the signed-in account.
• Turn off only the monitor: The computer is still signed in. Anyone can turn the monitor back on and use it.
• Leave it as is, because the office is safe: Unattended, signed-in computers are an easy target, even in a trusted office.

A worm copies itself across networks by using security holes, with no help from users. A virus needs a person to run or share an infected file. Keeping systems updated closes the holes worms use.

Wrong choices

• Trojan: A trojan hides inside software that looks useful and needs a user to install it.
• Virus: A virus attaches to files or programs and spreads when users run or share them.
• Rootkit: A rootkit hides deep in a system. Spreading across a network by itself is what a worm does.

A trojan pretends to be something useful, such as a free game or tool, while it secretly installs harmful code. Remote access trojans give an attacker control of the computer. Only installing software from trusted sources helps prevent them.

Wrong choices

• Worm: A worm spreads by itself across a network. This malware came hidden inside something the user chose to install.
• Ransomware: Ransomware encrypts files and demands payment, which did not happen here.
• Adware: Adware shows unwanted ads. It does not give an attacker remote control.