AP®︎ Cybersecurity: Unit 1 Flashcards

Using psychological tactics to manipulate a person into taking an action that benefits an adversary

Manipulating a person into disclosing information, directly or through a disguised request

Message-based social engineering, commonly conducted through email, text, or social media

Phishing conducted through SMS or other text messages

Threatening a target with negative consequences for failing to comply, using fear to encourage action

Creating a reason for a target to act quickly, using time pressure to discourage careful evaluation

Knowledge-based authentication questions whose answers are used to verify identity but may be weak if guessable or publicly discoverable

A code intended for one authentication attempt that an adversary can use while valid to log in as the victim

Tricking users into submitting usernames, passwords, or other authentication information to an adversary-controlled form or service

Malicious software designed to damage systems, disrupt operations, steal information, or provide unauthorized access

An adversary’s attempt to log in to a live device or service using common, patterned, or stolen passwords

A login attempt that differs from expected activity, indicated by many rapid failures, an unusual time, or an unknown device

A predictable password structure, often one or two familiar words followed by a two-digit number and a special character

An attack that systematically tries possible passwords or keys until the correct one is found

Trying previously stolen username-and-password combinations against other live services

A password that is long, random, unique to one account, and free of predictable or personally meaningful content

A tool that generates and stores strong, unique passwords for a user’s accounts

A long, unique sequence used as a password that is easier to remember but should still avoid predictable or personal content

Authentication requiring proof from more than one independent factor category, such as a password plus a one-time code

A category of proof used to verify identity, such as something a person knows, has, or is

An adversary who relies on tools made by others, typically to automate attacks against known vulnerabilities

An adversary capable of creating or substantially modifying malicious tools, adapting to defenses, or discovering undocumented vulnerabilities

A vulnerability previously undocumented or unknown to those responsible for defending or correcting the affected system

Reasons for attacking, including greed, recognition, dedication to a cause, revenge, politics, or beliefs; motivation is separate from skill level

A device that provides network access to wireless devices by radio

The displayed name of a wireless network; it identifies the network by name but does not prove who operates it

An attack in which an adversary-controlled access point uses an identical or similar SSID so users connect and their traffic can be captured; HTTPS-protected contents cannot be read merely from that capture

HTTP protected by encryption and server authentication so the contents exchanged with a website are secured in transit

Flooding an area with a strong electromagnetic signal in a wireless network's frequency range to disrupt legitimate communication

An attack that prevents legitimate users from accessing a system, service, or resource

Moving through an area, by driving or walking, to detect wireless beacons and gather network or signal-reach information

A radio transmission from a wireless access point that advertises the network’s availability and identifying information such as its SSID

A request to the Domain Name System for information such as the IP address associated with a domain name

A service that encrypts all user traffic to the VPN operator's system, hiding it from the local provider while transferring visibility and trust to the VPN provider

A synthetic representation of a person created from existing samples of the person’s voice or appearance

Realistic synthetic media that makes someone appear to say or do something they did not say or do

Using samples of a person’s voice to generate speech that sounds like that person

AI that produces new content such as language, images, audio, video, or code

A type of generative AI trained on large collections of text and other data to produce responses to prompts

Using generative AI to create polished, localized, or personalized phishing messages at scale

A crafted prompt intended to override restrictions or manipulate an AI system’s instructions

Placing false information in potential training sources to influence what a future AI model learns and repeats

Using AI to rapidly collect, connect, and summarize publicly available information about a target

Tools that use AI to generate or modify code, assist malware development, or search large code bases for vulnerabilities

A private word or phrase known only to trusted parties and used to verify identity in a high-stakes situation

Do not enter personal, secure, or sensitive information into AI prompts, chats, uploads, or connected files

Check consequential AI claims against reputable, stable, non-AI-based sources before acting on them

AI examination of current security settings to find excessive, conflicting, missing, or policy-inconsistent controls and recommend safer options for a security technician to review

AI inspection of application code to flag possible vulnerabilities and recommend mitigations that a knowledgeable programmer must verify and test

Conditions an automated detection system treats as suspicious and the action it takes when they occur; AI-suggested rules require review by a detection engineer

Qualified people must review, verify, and test AI-generated security recommendations before relying on or implementing them

Machine-scale analysis that sorts and prioritizes digital events by how likely they are to represent malicious activity rather than harmless activity

Using automated rules or analytics to identify potentially malicious activity and generate alerts requesting human investigation

A corrective action automatically performed after detection when the organization has authorized that action in advance