100-160 — frequently asked questions

Risk framing sets the context for managing risk, while IA is the actual practice of protecting data attributes like confidentiality and integrity.

No, the Cyber Kill Chain is an offensive model describing attack stages, not a defensive assessment tool for verifying data state.

No. Insider threats include both malicious actions (e.g., theft) and negligent/accidental actions (e.g., misdirected emails) by those with authorized access.

Phishing requires deception by an attacker. Here, the employee sent the email accidentally without being tricked, making it an internal error.

State-sponsored attackers are funded and directed by a nation-state to further geopolitical interests, while hacktivists act independently to promote a social or political cause.

No, an insider threat specifically refers to someone with authorized access to the organization's systems, such as employees or contractors, who misuses that access.

A firewall only protects the network perimeter. Defense-in-depth requires additional layers such as endpoint security, data encryption, and identity management to protect against threats that bypass the perimeter.

Yes, encryption protects the 'Data' layer. Even if an attacker breaches the network or endpoint, encrypted data remains unreadable without the key, adding a critical layer of defense.

Accounting records the data (logs, timestamps), while Auditing is the human or automated review of that recorded data.

No, Authorization grants permission to run commands. Accounting records that the command was actually executed.

A vulnerability is a weakness that exists in an asset regardless of anyone noticing it, such as an unpatched service. A threat is an actor or event with the intent and capability to exploit that weakness, such as a ransomware group or a flood.

Risk is the likelihood and impact that have not yet materialised — it is forward-looking. Once the loss actually happens, you are describing an incident, which triggers incident response rather than risk treatment.

An asset has a vulnerability; a threat can exploit it; if the exploitation is likely, that combination is a risk. Each element drives a different control: patching removes the vulnerability, monitoring detects the threat, and treatment reduces the risk.

GDPR is a broad EU regulation for all personal data, while HIPAA is a US law specifically for protected health information.

No, PCI-DSS applies only to organizations that handle branded credit cards, such as merchants and payment processors.

APTs involve a prolonged, persistent presence and high sophistication, whereas standard breaches are often quicker and less stealthy.

Ransomware seeks immediate financial gain via encryption, while APTs focus on long-term data exfiltration or sabotage without alerting the victim.

Behavioral biometrics fall under 'Something you are'. For exam purposes, stick to the core triad of Know, Have, and Are.

Examples include hardware tokens, smart cards, smartphones receiving OTPs, or YubiKeys.

No. Hashing is a one-way function that does not encrypt data. Confidentiality is provided by encryption algorithms like AES.

Standard hashing verifies only integrity. HMAC adds a secret key to the hash process, providing both integrity and origin authentication.

General phishing is broad and non-targeted. This email is tailored to the accounting department's specific interests, making it spear phishing.

No, smishing is strictly SMS-based. Email links fall under phishing or spear phishing depending on targeting.

No. Using another person's credentials without their knowledge or explicit written authorization is considered impersonation and is a direct violation of the CompTIA Code of Ethics.

It means having explicit permission from management or policy to view specific data for legitimate business purposes, ensuring compliance with privacy regulations and internal security policies.

Single sign-on allows access to multiple systems with one set of credentials. Here, the user must provide two distinct types of evidence to verify identity, which defines multifactor authentication.

No, biometrics involve physiological traits like fingerprints or facial recognition. A code sent to a phone is a possession factor because it relies on having access to the physical device.

Directory listing reveals file structures and names, which is reconnaissance. It does not capture usernames or passwords directly.

A backdoor is installed to maintain persistent access after a breach. Credential harvesting is the initial method used to acquire the login details needed for that breach.

Confidentiality restricts who can see the data, while Integrity ensures the data has not been changed or tampered with by unauthorized parties.

Availability ensures that systems and data are accessible to authorized users when needed, protecting against disruptions like DDoS attacks or hardware failures.

WPA used TKIP as a backward-compatible temporary solution for older hardware that could not support the processing power needed for AES.

No, WEP is obsolete and insecure because its RC4 cipher can be easily cracked using common tools.

IPS devices focus on identifying and blocking malicious attacks based on signatures or behavior, not on categorizing or filtering benign web content by URL or site type.

While modern firewalls may have some URL filtering capabilities, a dedicated proxy server is the standard device specifically designed for deep inspection and granular content filtering of web traffic.

It belongs to a documentation range (RFC 5737), not the RFC 1918 private ranges used for internal LANs.

No, only 172.16.0.0 to 172.31.255.255. Addresses like 172.32.x.x are public.

TFTP transmits data in plaintext without encryption or strong authentication, making it vulnerable to interception on unsecured networks.

Yes, SSH supports secure file transfer protocols like SFTP and SCP, which encrypt the data during transmission.

Because the site works via IP, the database is accessible and functional. The failure is isolated to the URL resolution process.

If the server responds correctly via direct IP but serves incorrect content or errors via URL, the server is up but the name resolution is compromised.