Authentication, Authorization and Accounting: Proving who someone is, deciding what they may do, and recording what they did.

Access Control List: An ordered list of allow and deny rules on a firewall, router or resource.

Advanced Encryption Standard: The standard symmetric block cipher, with 128-, 192- or 256-bit keys.

Artificial Intelligence: Systems that do tasks needing human-like judgment; objective 2.6 covers the risks of using them.

Annualized Loss Expectancy: Expected loss per year: SLE × ARO.

Anti-Money Laundering / Counter-Terrorism Financing: Laws and staff training that stop the financial system being used for crime or terrorism.

Application Programming Interface: A defined way for software to talk to software; APIs need authentication and rate limits.

Advanced Persistent Threat: A well-resourced attacker that gets quiet, long-term access and moves slowly.

Annualized Rate of Occurrence: How many times a year a risk is expected to happen.

Adversarial Tactics, Techniques, and Common Knowledge: MITRE's knowledge base of attacker tactics and techniques, used to map detections.

Acceptable Use Policy: Rules for how people may use the organization's systems and data.

Business Email Compromise: Fraud from a hijacked or spoofed business mailbox, often to redirect a payment.

Business Impact Analysis: Works out which business functions matter most and what disruption to each would cost.

Brand Indicators for Message Identification: Shows a verified brand logo beside authenticated mail; it needs DMARC at enforcement.

Bring Your Own Device: Staff using personal devices for work, under a BYOD policy.

Certificate Authority: A trusted party that checks identities and signs digital certificates.

Change Advisory Board: The group that reviews and approves significant changes.

Completely Automated Public Turing test to tell Computers and Humans Apart: A “prove you're human” check; fake ones trick people into running pasted commands.

Cloud Access Security Broker: Sits between users and cloud apps to enforce policy and spot risky use.

Computer Emergency Response Team: An incident response team; national CERTs publish external advisories.

Continuous Integration / Continuous Delivery (or Deployment): Automated pipelines that build, test and ship code, with security checks built in.

Certificate Revocation List: A list a CA publishes of certificates it has revoked before they expire.

Cloud Security Posture Management: Continuously checks cloud settings against policy, such as public storage or open ports.

Certificate Signing Request: What you send a CA to get a certificate: your public key and identity details, never the private key.

Cross-Site Request Forgery: Tricking a signed-in user's browser into sending a request they didn't mean to.

Common Vulnerabilities and Exposures: The public ID system for known vulnerabilities, written like CVE-2024-12345.

Common Vulnerability Scoring System: FIRST's 0 to 10 score for how severe a vulnerability is.

Common Weakness Enumeration: A catalog of the underlying kinds of software weakness, such as improper input validation.

Discretionary Access Control: The owner of a file or resource decides who may use it.

Distributed Denial of Service: A denial-of-service flood from many sources at once, such as a botnet.

Diffie-Hellman: A key exchange that lets two parties agree a shared secret over an untrusted network.

Dynamic Host Configuration Protocol: Hands out IP addresses and network settings automatically; a rogue DHCP server can redirect traffic.

DomainKeys Identified Mail: Signs outgoing mail so receivers can check it came from the domain and wasn't altered.

Data Loss Prevention: Detects or blocks sensitive data leaving by email, web, USB or cloud.

Domain-based Message Authentication, Reporting and Conformance: Tells receivers what to do with mail that fails SPF or DKIM, and sends reports back.

Demilitarized Zone: A segment for public-facing servers between the internet and the internal network; also called a screened subnet.

Domain Name System: Turns names like example.com into IP addresses; port 53.

Domain Name System Security Extensions: Signs DNS records so resolvers can spot forged answers. It doesn't encrypt them.

End-to-End Encryption: Only the two endpoints can read the messages, not the service in between.

Extensible Authentication Protocol: The framework of sign-in methods used with 802.1X on wired and wireless networks.

Elliptic-Curve Cryptography: Asymmetric cryptography that gives strong security with much shorter keys than RSA.

Endpoint Detection and Response: Records activity on endpoints, detects threats and helps responders contain them.

Expression of Interest: An early call to see which vendors are interested, used to build a shortlist.

Full Disk Encryption: Encrypting a whole drive, so a lost or stolen device's data is unreadable without the key.

File Transfer Protocol: Unencrypted file transfer on ports 20 and 21.

Study tool · SY0-801

Free Security+ flashcards for 2026, with spaced repetition

Four decks for CompTIA Security+® SY0-801: acronyms, ports, the new AI threats and the eight incident response headings. Flip a card, mark it Got it or Again, and the ones you miss come back sooner.

Start flipping Browse every card

4 decks
252 cards
Works with the keyboard
No sign-up

Loading cards…

0 known
0 learning
0 new

Space or Enter flips the card. Then press 1 for Again or 2 for Got it.

Progress is saved in this browser only. Nothing is sent to us.

The interactive cards need JavaScript. Every card is listed below, so you can still study from the lists.

Spaced repetition

Cards you miss come back sooner

Each time you get a card right, its next review moves further away. Miss it and it comes straight back. Your time goes on the cards you don’t know yet.

Againa few cards later
1 dayafter your first Got it
3 dayssecond Got it
7 daysthird
14 daysfourth
30 daysfifth and after

The bars are drawn to scale. Pressing Again sends a card back to the start of the ladder. A card counts as known once you’ve marked it Got it at least once. Each deck keeps its own progress, and Reset clears it.

Every card

All four Security+ flashcard decks, as lists

Prefer to read? Open a deck to see every card and its answer. The acronym and port decks come from our acronym glossary and ports table.

Acronyms180 cards

AAA: Authentication, Authorization and Accounting Proving who someone is, deciding what they may do, and recording what they did.
ACL: Access Control List An ordered list of allow and deny rules on a firewall, router or resource.
AES: Advanced Encryption Standard The standard symmetric block cipher, with 128-, 192- or 256-bit keys.
AI: Artificial Intelligence Systems that do tasks needing human-like judgment; objective 2.6 covers the risks of using them.
ALE: Annualized Loss Expectancy Expected loss per year: SLE × ARO.
AML/CTF: Anti-Money Laundering / Counter-Terrorism Financing Laws and staff training that stop the financial system being used for crime or terrorism.
API: Application Programming Interface A defined way for software to talk to software; APIs need authentication and rate limits.
APT: Advanced Persistent Threat A well-resourced attacker that gets quiet, long-term access and moves slowly.
ARO: Annualized Rate of Occurrence How many times a year a risk is expected to happen.
ATT&CK: Adversarial Tactics, Techniques, and Common Knowledge MITRE's knowledge base of attacker tactics and techniques, used to map detections.
AUP: Acceptable Use Policy Rules for how people may use the organization's systems and data.
BEC: Business Email Compromise Fraud from a hijacked or spoofed business mailbox, often to redirect a payment.
BIA: Business Impact Analysis Works out which business functions matter most and what disruption to each would cost.
BIMI: Brand Indicators for Message Identification Shows a verified brand logo beside authenticated mail; it needs DMARC at enforcement.
BYOD: Bring Your Own Device Staff using personal devices for work, under a BYOD policy.
CA: Certificate Authority A trusted party that checks identities and signs digital certificates.
CAB: Change Advisory Board The group that reviews and approves significant changes.
CAPTCHA: Completely Automated Public Turing test to tell Computers and Humans Apart A “prove you're human” check; fake ones trick people into running pasted commands.
CASB: Cloud Access Security Broker Sits between users and cloud apps to enforce policy and spot risky use.
CERT: Computer Emergency Response Team An incident response team; national CERTs publish external advisories.
CI/CD: Continuous Integration / Continuous Delivery (or Deployment) Automated pipelines that build, test and ship code, with security checks built in.
CRL: Certificate Revocation List A list a CA publishes of certificates it has revoked before they expire.
CSPM: Cloud Security Posture Management Continuously checks cloud settings against policy, such as public storage or open ports.
CSR: Certificate Signing Request What you send a CA to get a certificate: your public key and identity details, never the private key.
CSRF: Cross-Site Request Forgery Tricking a signed-in user's browser into sending a request they didn't mean to.
CVE: Common Vulnerabilities and Exposures The public ID system for known vulnerabilities, written like CVE-2024-12345.
CVSS: Common Vulnerability Scoring System FIRST's 0 to 10 score for how severe a vulnerability is.
CWE: Common Weakness Enumeration A catalog of the underlying kinds of software weakness, such as improper input validation.
DAC: Discretionary Access Control The owner of a file or resource decides who may use it.
DDoS: Distributed Denial of Service A denial-of-service flood from many sources at once, such as a botnet.
DH: Diffie-Hellman A key exchange that lets two parties agree a shared secret over an untrusted network.
DHCP: Dynamic Host Configuration Protocol Hands out IP addresses and network settings automatically; a rogue DHCP server can redirect traffic.
DKIM: DomainKeys Identified Mail Signs outgoing mail so receivers can check it came from the domain and wasn't altered.
DLP: Data Loss Prevention Detects or blocks sensitive data leaving by email, web, USB or cloud.
DMARC: Domain-based Message Authentication, Reporting and Conformance Tells receivers what to do with mail that fails SPF or DKIM, and sends reports back.
DMZ: Demilitarized Zone A segment for public-facing servers between the internet and the internal network; also called a screened subnet.
DNS: Domain Name System Turns names like example.com into IP addresses; port 53.
DNSSEC: Domain Name System Security Extensions Signs DNS records so resolvers can spot forged answers. It doesn't encrypt them.
E2EE: End-to-End Encryption Only the two endpoints can read the messages, not the service in between.
EAP: Extensible Authentication Protocol The framework of sign-in methods used with 802.1X on wired and wireless networks.
ECC: Elliptic-Curve Cryptography Asymmetric cryptography that gives strong security with much shorter keys than RSA.
EDR: Endpoint Detection and Response Records activity on endpoints, detects threats and helps responders contain them.
EOI: Expression of Interest An early call to see which vendors are interested, used to build a shortlist.
FDE: Full Disk Encryption Encrypting a whole drive, so a lost or stolen device's data is unreadable without the key.
FTP: File Transfer Protocol Unencrypted file transfer on ports 20 and 21.
FTPS: FTP Secure FTP with TLS: port 990 for implicit TLS, or 21 when TLS is negotiated.
GBIC: Gigabit Interface Converter An older, larger hot-swappable network transceiver, since replaced by SFP.
GDPR: General Data Protection Regulation The EU law on personal data, with rights such as erasure and correction.
gMSA: Group Managed Service Account A Windows service account whose password the directory rotates automatically.
GRC: Governance, Risk and Compliance How an organization sets direction, manages risk and meets its obligations, as one program.
HIPAA: Health Insurance Portability and Accountability Act The US law that protects health information.
HMAC: Hash-based Message Authentication Code A hash mixed with a secret key, proving a message is unchanged and came from a key holder.
HR: Human Resources The team to involve when an investigation concerns an employee.
HSM: Hardware Security Module A tamper-resistant device that generates, stores and uses cryptographic keys.
HTTP: Hypertext Transfer Protocol The web's protocol, unencrypted; port 80.
HTTPS: HTTP Secure HTTP inside TLS; port 443.
IaaS: Infrastructure as a Service The provider supplies servers, storage and networks; you secure the OS and everything above it.
IaC: Infrastructure as Code Infrastructure defined in version-controlled templates instead of built by hand.
IAM: Identity and Access Management The processes and tools that create identities, grant access and take it away.
IdP: Identity Provider The central sign-in service that vouches for users to other apps, which makes it a high-value target.
IDS: Intrusion Detection System Watches network traffic or a host and alerts on suspicious activity.
IMAP: Internet Message Access Protocol Reads and syncs email kept on the server; port 143, or 993 over TLS.
IoC: Indicator of Compromise Evidence of a possible breach, such as a malicious file hash, IP address or domain.
IoT: Internet of Things Connected cameras, sensors, printers and the like, often hard to patch.
IPAM: IP Address Management Tracking IP address use, which helps find live hosts missing from inventory and scans.
IPFIX: IP Flow Information Export The standard format for flow records: who talked to whom, when and how much, without contents.
IPS: Intrusion Prevention System Like an IDS, but sits inline and can block what it detects.
IPsec: Internet Protocol Security Authenticates and encrypts IP packets; common for site-to-site VPNs.
IR: Incident Response Preparing for, handling and learning from security incidents.
ISAC: Information Sharing and Analysis Center A sector group where organizations share threat intelligence.
JIT: Just-in-Time (access) Elevated rights granted on request for a limited time, then removed automatically.
KEV: Known Exploited Vulnerabilities (catalog) CISA's list of vulnerabilities seen exploited in the wild, useful for deciding what to patch first.
LDAP: Lightweight Directory Access Protocol Queries and updates directories such as Active Directory; port 389.
LDAPS: LDAP over SSL/TLS Encrypted LDAP, on port 636.
LLM: Large Language Model An AI model trained on huge amounts of text that generates language, and an attack surface in its own right.
LMS: Learning Management System The platform that delivers and tracks security awareness training.
MAC: Mandatory Access Control Access is decided centrally by labels and clearances, not by the data's owner. (Also: media access control address.)
MD5: Message Digest 5 An old 128-bit hash that is broken for security use because collisions are easy to make.
MDM: Mobile Device Management Central control of phones and tablets: policies, apps, encryption and remote wipe.
MFA: Multifactor Authentication Signing in with two or more different kinds of factor, such as a password plus an app prompt.
MITM: Man-in-the-Middle The older name for an on-path attack, where someone secretly sits between two parties.
ML: Machine Learning AI that learns patterns from data instead of following hand-written rules.
MOU: Memorandum of Understanding A written statement of shared intent, usually less formal than a contract.
MSA: Master Service Agreement The umbrella contract whose terms apply to each later piece of work.
MTBF: Mean Time Between Failures The average time a system runs before it fails.
MTTR: Mean Time to Repair (or Recover) The average time it takes to fix a failure and restore service.
NAC: Network Access Control Checks a device's identity and health before letting it onto the network.
NAT: Network Address Translation Rewrites private addresses to public ones at the edge; NAT logs link the two in investigations.
NDA: Non-Disclosure Agreement A contract that obliges the parties to keep shared information confidential.
NIC: Network Interface Card The hardware that connects a device to a network.
NIST: National Institute of Standards and Technology The US agency behind widely used security frameworks and guidance.
NTP: Network Time Protocol Keeps clocks in sync, which log timelines depend on; UDP 123.
NVD: National Vulnerability Database NIST's database that adds scores and details to CVE records.
OAuth: Open Authorization Lets an app act for a user with limited, delegated access, without seeing the password.
OCSP: Online Certificate Status Protocol A real-time check of whether one certificate has been revoked.
OIDC: OpenID Connect An identity layer on top of OAuth that adds user authentication.
OSINT: Open-Source Intelligence Intelligence gathered from public sources such as websites, social media and records.
OT: Operational Technology Systems that control physical processes, where safety and uptime come first.
OTP: One-Time Password A code that works only once, sent by text or generated by an app or token.
PaaS: Platform as a Service The provider runs the platform; you secure your code, data and access.
PAM: Privileged Access Management Tools and processes that control, monitor and limit the use of admin accounts.
PCAP: Packet Capture A recording of network packets, and the common file format for one.
PCI DSS: Payment Card Industry Data Security Standard The security standard for anyone who stores, processes or sends card payments.
PDF: Portable Document Format A document format that can carry malicious links or code as an attachment.
PHI: Protected Health Information Health information linked to a person, protected by laws such as HIPAA.
PII: Personally Identifiable Information Data that can identify a person, such as a name together with a date of birth.
PIR: Post-Incident Report The written record of an incident: timeline, impact, root cause and agreed fixes.
PKI: Public Key Infrastructure The certificate authorities, certificates and rules that bind public keys to identities.
POP3: Post Office Protocol version 3 Downloads email from a server; port 110, or 995 over TLS.
QR: Quick Response (code) A 2D barcode that hides a link; quishing uses one to lure people to a malicious page.
RADIUS: Remote Authentication Dial-In User Service Central authentication for network access such as Wi-Fi and VPN; UDP 1812 and 1813.
RAG: Retrieval-Augmented Generation An LLM that pulls documents from a knowledge base into its prompt; poison the base and you poison the answers.
RAID: Redundant Array of Independent Disks Spreads data across disks for speed, redundancy or both. It isn't a backup.
RAT: Remote Access Trojan Malware that gives an attacker hidden remote control of a machine.
RBAC: Role-Based Access Control Permissions are given to roles, and people get access through their role.
RCA: Root Cause Analysis Finding the underlying reason an incident happened so it doesn't happen again.
RCS: Rich Communication Services The richer successor to SMS texting, and another channel for phishing lures.
RDP: Remote Desktop Protocol Microsoft's remote desktop protocol on port 3389; a frequent target when exposed to the internet.
RF: Radio Frequency Wireless signals such as Wi-Fi, Bluetooth and NFC, which can be sniffed, spoofed or jammed.
RFC: Request for Comments The document series that defines internet protocols and practices.
RFI: Request for Information Gathers facts about what vendors can offer.
RFP: Request for Proposal Asks vendors for a full proposed solution and approach.
RFQ: Request for Quotation Asks vendors to price a clearly defined product or service.
RPO: Recovery Point Objective How much data, measured in time, you can afford to lose.
RPS: Redundant Power Supply A second power supply that keeps a device running if the first one fails.
RSA: Rivest–Shamir–Adleman An asymmetric algorithm used for digital signatures and protecting keys.
RTF: Rich Text Format A document format abused to deliver exploits inside attachments.
RTO: Recovery Time Objective How quickly a service must be back after a disruption.
SaaS: Software as a Service Ready-made apps run by the provider; you still own users, data and settings.
SAML: Security Assertion Markup Language An XML standard that carries sign-in assertions from an identity provider to an application.
SASE: Secure Access Service Edge SSE combined with SD-WAN networking as one cloud service.
SCAP: Security Content Automation Protocol Standards for automated configuration and vulnerability checks against a baseline.
SD-WAN: Software-Defined Wide Area Network Software that steers traffic between sites across several kinds of link.
SELinux: Security-Enhanced Linux A Linux kernel feature that enforces mandatory access control policies.
SFP: Small Form-factor Pluggable A hot-swappable network transceiver module for fiber or copper.
SFTP: SSH File Transfer Protocol File transfer inside an SSH connection, on port 22.
SHA: Secure Hash Algorithm A family of hash functions: SHA-2 and SHA-3 are current, SHA-1 is deprecated.
SIEM: Security Information and Event Management Collects logs in one place and correlates them to raise alerts.
SIM: Subscriber Identity Module The chip that links a phone to an account; SIM swapping lets attackers take over text-message codes.
SIP: Session Initiation Protocol Sets up voice and video calls; port 5060, or 5061 with TLS.
SLA: Service Level Agreement A contractual promise about service levels, often with penalties if missed.
SLE: Single Loss Expectancy The expected cost of one occurrence of a risk.
SLO: Service Level Objective The measurable target behind an SLA, such as 99.9% uptime.
SMB: Server Message Block Windows file and printer sharing on TCP 445; never expose it to the internet.
S/MIME: Secure/Multipurpose Internet Mail Extensions Signs and encrypts email using certificates.
SMS: Short Message Service Text messaging: the channel for smishing, and a weak way to deliver one-time codes.
SMTP: Simple Mail Transfer Protocol Sends and relays email: port 25 between servers, 587 or 465 for sending from a client.
SNMP: Simple Network Management Protocol Monitors and manages network devices on UDP 161, with traps on 162; only version 3 encrypts.
SOAR: Security Orchestration, Automation and Response Playbook-driven automation that links security tools and speeds up response.
SOC: Security Operations Center The team, and often the room, that monitors for and responds to threats.
SOP: Standard Operating Procedure Written steps for routine work; a standard change that follows an approved SOP can be pre-approved.
SOW: Statement of Work Defines the deliverables, timeline and price for one piece of work.
SPF: Sender Policy Framework A DNS record listing the servers allowed to send mail for a domain.
SQLi: SQL Injection Slipping database commands into input so the application runs them.
SSE: Security Service Edge Cloud-delivered security for users anywhere: secure web gateway, CASB and zero trust access in one service.
SSH: Secure Shell Encrypted remote command line, file copy and tunneling; port 22.
SSO: Single Sign-On Signing in once to reach many applications.
SWG: Secure Web Gateway Filters users' web traffic for policy and malware, often from the cloud.
TCP: Transmission Control Protocol Connection-based transport with a handshake and guaranteed, ordered delivery.
TFTP: Trivial File Transfer Protocol Bare-bones file transfer with no authentication; UDP 69.
TLS: Transport Layer Security The protocol that encrypts data in transit for HTTPS, email and many other services.
TOCTOU: Time-of-Check to Time-of-Use A race condition where something changes between being checked and being used.
TOTP: Time-based One-Time Password An authenticator-app code that changes every 30 seconds or so.
TPM: Trusted Platform Module A chip in the computer that stores keys and checks that the boot process hasn't been tampered with.
TTP: Tactics, Techniques and Procedures How an attacker operates; MITRE ATT&CK catalogs them.
UDP: User Datagram Protocol Connectionless transport: fast, but with no handshake or delivery guarantee.
UEFI: Unified Extensible Firmware Interface Modern startup firmware that supports Secure Boot.
UPS: Uninterruptible Power Supply A battery unit that keeps equipment running through short power cuts.
USB: Universal Serial Bus The everyday connector; a malicious USB device can pose as a keyboard and type commands.
UTM: Unified Threat Management One appliance that combines firewall, intrusion prevention, filtering and antivirus.
VLAN: Virtual Local Area Network Splits one physical switched network into separate logical networks.
VM: Virtual Machine A software computer on a hypervisor; VM snapshots can preserve evidence.
VNC: Virtual Network Computing Cross-platform remote desktop sharing, usually from port 5900.
VPN: Virtual Private Network An encrypted tunnel that carries traffic across an untrusted network.
WAF: Web Application Firewall Filters HTTP traffic to block attacks such as injection against web apps.
WIPS: Wireless Intrusion Prevention System Finds and contains rogue access points and wireless attacks.
WPA3: Wi-Fi Protected Access 3 The current Wi-Fi security standard, replacing WPA2.
XDR: Extended Detection and Response Detection and response that correlates endpoint, network, email and cloud data together.
XSS: Cross-Site Scripting Injecting script into a web page so it runs in other visitors' browsers.
ZTNA: Zero Trust Network Access Grants access to one application at a time after checking user and device, instead of the whole network.

Ports43 cards

20, 21 · TCP: FTP File transfer: 21 carries commands, 20 carries data in active mode. Everything, including the password, is in plain text.
22 · TCP: SSH, SFTP, SCP Encrypted remote command line. SFTP and SCP file transfers run inside SSH on the same port.
23 · TCP: Telnet Unencrypted remote command line; anyone on the path can read the session, password included.
25 · TCP: SMTP Mail servers relaying email to each other.
49 · TCP: TACACS+ Central sign-in and command authorization for network devices.
53 · UDP, TCP: DNS Name lookups on UDP; TCP for zone transfers and large answers.
67, 68 · UDP: DHCP Hands out IP addresses: the server listens on 67, clients on 68.
69 · UDP: TFTP Bare-bones file transfer with no sign-in, used to load device configs and boot images.
80 · TCP: HTTP Unencrypted web traffic.
88 · TCP, UDP: Kerberos Ticket-based sign-in, used by Active Directory.
110 · TCP: POP3 Downloads email from a mail server, in plain text.
123 · UDP: NTP Keeps clocks in sync, which log timelines and Kerberos depend on.
137–139 · UDP, TCP: NetBIOS Legacy Windows name, datagram and session services.
143 · TCP: IMAP Reads and syncs email kept on the server, in plain text.
161, 162 · UDP: SNMP Device monitoring: managers poll agents on 161, and agents send traps to 162.
389 · TCP, UDP: LDAP Directory lookups and changes, for example against Active Directory.
443 · TCP, UDP: HTTPS Web traffic inside TLS; HTTP/3 runs over UDP 443.
445 · TCP: SMB Windows file and printer sharing.
465 · TCP: SMTPS (submission) Mail clients sending email over TLS from the first byte (implicit TLS).
500 · UDP: IKE (IPsec) Negotiates the keys for an IPsec VPN tunnel.
514 · UDP: Syslog Devices and servers sending log messages to a collector, in plain text.
587 · TCP: SMTP submission Mail clients sending email to their server, upgraded with STARTTLS.
636 · TCP: LDAPS LDAP inside TLS.
853 · TCP: DNS over TLS Encrypted DNS lookups between a client and its resolver.
989, 990 · TCP: FTPS (implicit TLS) FTP inside TLS: 990 for commands, 989 for data.
993 · TCP: IMAPS IMAP inside TLS.
995 · TCP: POP3S POP3 inside TLS.
1433 · TCP: Microsoft SQL Server The default port for SQL Server databases.
1521 · TCP: Oracle Database The default Oracle database listener.
1701 · UDP: L2TP A VPN tunnel that doesn't encrypt anything on its own.
1723 · TCP: PPTP An old VPN protocol with broken security.
1812, 1813 · UDP: RADIUS Central sign-in for Wi-Fi, VPN and network access: 1812 for authentication, 1813 for accounting.
3306 · TCP: MySQL The default MySQL and MariaDB database port.
3389 · TCP, UDP: RDP Windows Remote Desktop; a favorite target when it's open to the internet.
4500 · UDP: IPsec NAT traversal Carries IPsec traffic through devices that do NAT.
5060 · TCP, UDP: SIP Sets up voice and video calls, in plain text.
5061 · TCP: SIP over TLS Encrypted call setup.
5432 · TCP: PostgreSQL The default PostgreSQL database port.
5900 · TCP: VNC Remote desktop sharing; extra screens use 5901, 5902 and so on.
5985, 5986 · TCP: WinRM Windows Remote Management, often used by PowerShell remoting: 5985 over HTTP, 5986 over HTTPS.
6514 · TCP: Syslog over TLS Sending logs to a collector inside TLS.
8080 · TCP: HTTP alternate A common extra port for web servers, proxies and admin consoles, in plain text.
8443 · TCP: HTTPS alternate A common extra port for TLS-protected web apps and admin consoles.

AI threats13 cards

Prompt injection: Attacker-written instructions in the model's input override the application's own instructions. They can be typed directly or hidden in a page, file or email the model reads, so it leaks data or takes actions it shouldn't.
Jailbreaking: A user crafts prompts (role-play, obfuscation, slow coaxing) to talk the model out of its own safety rules and get restricted output.
Poisoning: Corrupting the data a model learns from or looks things up in (training sets, fine-tuning data, a knowledge base) to plant wrong behavior, bias or a hidden trigger.
Model manipulation: Tampering with the model itself or its settings rather than its data: altered weights, a backdoored model file from a public hub, or changed system prompts.
Evasion: Input crafted at decision time so a trained model misjudges it, such as malware tweaked to slip past a machine-learning detector.
Data loss (AI): Sensitive business data leaves through AI: staff paste confidential material into public tools, or an assistant hands a user documents they shouldn't see.
Privacy (AI): Personal data exposed or misused: a model repeats personal details it memorized, or prompts full of personal data go to an outside provider.
Hallucinations: Confident but false output (made-up facts, citations, commands or package names) that turns into a security problem when people or systems act on it.
Bias: Results that are skewed in a consistent direction because of unrepresentative data or design, leading to unfair or unsafe decisions.
Explainability: How well people can understand why a model gave an output. When it's low, mistakes, attacks and compliance questions are hard to investigate.
Ethical considerations: Using AI responsibly: being open with users, getting consent for data use, keeping people accountable for AI-driven decisions and preventing misuse.
Session hijacking (AI): An attacker takes over someone else's signed-in AI session, for example by stealing its session token. A leaked chat link alone is data exposure, not a takeover.
Code execution (AI): Model output or an agent's tool call ends up running attacker-chosen code, for example when generated text goes straight to a shell without checks.

Incident response16 cards

Preparation: Getting ready before anything happens: roles and contacts, playbooks, training, tools, and testing the plan with tabletop exercises and simulations.
Identification: Spotting and confirming an incident from alerts, user reports, threat hunting, and internal or external advisories.
Investigation: Gathering and analyzing evidence to learn what happened, how and how far: digital forensics, chain of custody, preservation and e-discovery.
Containment: Stopping the spread by quarantining or isolating hosts, accounts or network segments, while keeping evidence intact.
Negotiation: Deciding whether and how to deal with an extortionist such as a ransomware group, usually with specialists, legal counsel and law enforcement, and checking sanctions before any payment.
Eradication and recovery: Removing the attacker's foothold (malware, persistence, compromised accounts) and safely bringing systems and data back to normal service.
Notification and external reporting: Telling stakeholders, affected customers, law enforcement and regulators, including mandatory reports with legal deadlines.
Post-incident: Looking back: lessons learned, root cause analysis and the post-incident report (PIR), so it doesn't happen again.
Which heading? Running a tabletop exercise on a ransomware scenario: Preparation
Which heading? Searching logs for attacker activity that no alert has flagged: Identification
Which heading? Recording every handover of a seized laptop: Investigation
Which heading? Taking an infected server off the network: Containment
Which heading? Working with counsel on whether to answer a ransom demand: Negotiation
Which heading? Removing a backdoor account and restoring files from clean backups: Eradication and recovery
Which heading? Reporting a breach to a regulator before the legal deadline: Notification and external reporting
Which heading? Writing up the root cause and the fixes agreed afterwards: Post-incident

The incident response list starts with SY0-801’s eight headings in the order CompTIA gives them. CompTIA doesn’t say they’re a strict sequence. Read how they differ from SY0-701’s seven steps.

FAQ

Security+ flashcards, answered

Are these Security+ flashcards free?

Yes. The flashcards are a free study tool with no sign-up. They run in your browser, and the acronym and port decks are built from our free glossary and ports table.

How does the spaced repetition work?

Every Got it pushes a card’s next review further out: 1 day, then 3, 7, 14 and 30 days. Again puts it back a few cards later in the same session and restarts its schedule. When nothing is due, you can still review the whole deck.

Where is my flashcard progress saved?

In your browser’s storage on this device. Nothing is sent to us, so your progress won’t follow you to another device, and clearing your browser data resets it. Each deck also has its own Reset button.

What are the incident response steps in SY0-801?

SY0-801 groups incident response under eight headings: preparation, identification, investigation, containment, negotiation, eradication and recovery, notification and external reporting, and post-incident. They replace SY0-701’s seven steps. CompTIA lists them in that order but doesn’t say they must happen in strict sequence.

What AI threats are on Security+ SY0-801?

Objective 2.6 is new in SY0-801 and covers the risks of using AI: prompt injection, jailbreaking, poisoning, model manipulation, evasion, data loss, privacy, hallucinations, bias, explainability, ethics, session hijacking and code execution. The AI deck has a card for each, in plain English.

Are flashcards enough to pass Security+?

No. Flashcards are good for terms, ports and lists, but nine of the 27 SY0-801 objectives are scenario-based, which means applying what you know. Pair the cards with full practice tests that explain every answer.

From flashcards to full questions

Mock Test 1 is a free, full-length SY0-801 practice exam with PBQs, and every option comes with the reason it’s right or wrong.

Start free Mock Test 1 Objectives checklist

Illustration of a magnifying lens over a fan of four answer cards, one glowing with a tick