Threats, Controls & Troubleshooting

1. Threat Recognition

Phishing: deceptive email or message designed to trick a user. Smishing: phishing by SMS/text. Vishing: voice-based social engineering. Tailgating: unauthorized physical entry by following an authorized person. DDoS: distributed traffic overwhelms a service. Insider threat: risk originating from a person with legitimate access.

2. Malware Clues

Ransomware: encrypts or blocks access and demands payment. Trojan: malicious code disguised as legitimate software. Worm: self-propagates across systems or networks. Rootkit: hides malicious activity and preserves privileged access. Keylogger: records keystrokes to capture information.

3. Security Controls

Preventive: tries to stop an incident. Detective: discovers activity or an incident. Corrective: restores or repairs after an event. Deterrent: discourages an action. Compensating: alternative control used when the preferred control is not feasible.

4. Authentication & Access

Strong access design follows least privilege, need to know, and appropriate separation of duties. MFA should combine different factor types such as something you know, have, or are—not simply two passwords.

5. Troubleshooting Workflow

Identify → Scope → Contain → Investigate → Remediate → Recover → Document/Learn.

Exam habit: identify what the question is really asking—attack type, control type, best next action, or most likely cause—before choosing an answer.

Mini Check

Scenario: A user receives an urgent email linking to a fake company login page. What is the primary attack?

Answer: Phishing. The attacker is using a deceptive message and fraudulent login page to capture credentials.