CompTIA Exam Prep - ITF+, A+, Network+, Security+, CySA+

 Mandatory Vacation A mandatory vacation (also called forced vacation or required time off) is a policy requiring employees to take a minimum number of consecutive days away from work each year. During this time, the employee must fully disconnect, no emails, calls, or remote work. Unlike regular PTO, which employees may choose to use or not, mandatory vacation is enforced by the organization. Why Organizations Use Mandatory Vacation 1. Fraud Prevention & Internal Controls Mandatory vacation is widely used in industries like finance, banking, auditing, and cybersecurity because taking employees out of their routine for consecutive days can: Expose fraudulent activity Reveal irregularities that might go unnoticed Break the ability to conceal ongoing misconduct Many financial institutions require at least 5–10 consecutive business days away for this reason. 2. Risk Management & Business Continuity Organizations use it to ensure: Teams do not rely too heavily on a single perso...

An insider threat is a security risk originating from someone who already has legitimate access — an employee, contractor, vendor, or partner. They are not breaking in. They are already inside, and the access they are using was granted deliberately. Every other threat actor has to get in first. The insider's advantage is that the hardest step has already been completed, legitimately, by you. That is what makes insiders difficult in a way that is different from the other threat actor types . Perimeter controls, phishing filters and patching do nothing. The insider is authenticating correctly, from an expected location, on a managed device. The Three Types CompTIA distinguishes these, and the distinction drives the response. Malicious insiders act deliberately. Motivations are typically financial — selling data or credentials — revenge after a grievance or termination, ideology, or recruitment by an outside party. This is the smallest category and the most damaging per in...

Access control models define who decides what a subject may do with an object. Security+ tests five, and the questions are nearly always scenarios where one phrase identifies the model. The five models Model Who decides Scenario clue DAC — discretionary The data owner "The file owner grants access" MAC — mandatory The system, by policy Clearances and classification labels RBAC — role-based Assigned roles "Members of the Accounting role" ABAC — attribute-based Evaluated attributes Conditions: department, time, location, device Rule-based Predefined rules Firewall ACLs, time-of-day restrictions Discretionary access control The owner of a resource decides who may access it and can pass that permission on at their discretion. Standard file systems work this way — NTFS permissions and Linux file permissions are both DAC. It is flexible and it is why most data sprawls. A user can share a sensitive file with anyone, and nothing at the system level prevents it. ...