Term 151
CSRF
Cross-Site Request Forgery is an attack that tricks a user into performing an unwanted action on a web application where they are currently authenticated.
Acronym study
Terms 151–180 of 754 ISC2 CC acronyms and key terms. Each entry includes a plain-English definition and a link to the full 800-word glossary page with exam context and practice questions.
Term 151
Cross-Site Request Forgery is an attack that tricks a user into performing an unwanted action on a web application where they are currently authenticated.
Term 152
A custom domain is a personalized internet address (like contoso.com) that you can use with cloud services instead of the default domain provided by the service provider.
Term 153
Customer Lockbox is a Microsoft 365 service that gives customers explicit control over granting Microsoft support engineers temporary access to their tenant data for troubleshooting and issue resolution.
Term 154
Discretionary Access Control is a security model where the owner of a resource decides who can access it and what permissions they have.
Term 155
DAST (Dynamic Application Security Testing) is a security testing method that finds vulnerabilities in running web applications by simulating real attacks from the outside.
Term 156
A data catalog is a centralized inventory of data assets that helps people find, understand, and trust the data they need for analytics or business decisions.
Term 157
Data classification is the process of organizing data into categories based on its sensitivity, value, and criticality to an organization, so that appropriate security controls can be applied.
Term 158
An entity that determines the purposes and means of processing personal data.
Term 159
A data custodian is the person or team responsible for the safe handling, storage, and transport of data on behalf of the data owner.
Term 160
Data governance is the overall process of managing the availability, usability, integrity, and security of data used in an organization, based on internal standards and policies.
Term 161
Data ingestion is the process of moving data from various sources into a storage system where it can be accessed, analyzed, and used.
Term 162
Data lifecycle management is the process of managing data from its creation to its deletion, ensuring it is stored, used, and disposed of in a way that meets security, compliance, and business needs.
Term 163
Data lineage is the process of tracking the origin, movement, and transformation of data as it flows through various systems and steps in a data pipeline.
Term 164
Data Loss Prevention (DLP) is a set of tools and processes that help organizations stop sensitive information from being shared, leaked, or stolen, whether accidentally or on purpose.
Term 165
Data masking is a security technique that replaces sensitive data with realistic but fictional data so it can be used safely in non-production environments.
Term 166
A senior-level person who is accountable for the classification, protection, and appropriate use of a specific set of data within an organization.
Term 167
The part of a network device that actually forwards data packets from one interface to another based on decisions made by the control plane.
Term 168
A data processor is a person or organization that processes personal data on behalf of a data controller, following the controller's instructions and under their authority.
Term 169
Data protection refers to the practices and technologies used to safeguard personal and sensitive information from unauthorized access, loss, or corruption.
Term 170
Data remanence is the residual representation of data that remains on a storage medium even after attempts to erase or remove it.
Term 171
Data retention is the practice of keeping data for a specific period to meet legal, business, or compliance needs, and then securely disposing of it.
Term 172
Data sanitization is the process of deliberately, permanently, and irreversibly removing or destroying data stored on a device or media so that it cannot be recovered or reconstructed by any known method.
Term 173
Data security is the practice of protecting digital information from unauthorized access, corruption, or theft throughout its lifecycle.
Term 174
Data transformation is the process of converting data from one format, structure, or value into another to make it usable for analysis, storage, or reporting.
Term 175
Data visualization is the practice of translating data and information into visual context, such as charts and graphs, to make complex data easier to understand and use for decision-making.
Term 176
A DDoS (Distributed Denial-of-Service) attack is a malicious attempt to disrupt normal traffic of a targeted server, service, or network by overwhelming it with a flood of internet traffic from multiple compromised systems.
Term 177
A deauthentication attack is a wireless network exploit where an attacker sends fake disconnection frames to force devices off a Wi-Fi network, often used to capture handshake data or disrupt connectivity.
Term 178
Decryption is the process of converting encrypted or scrambled data back into its original, readable form using a specific key or method.
Term 179
A configuration in IT systems where security services or appliances operate in an isolated, single-purpose environment to prevent interference with other functions and reduce attack surface.
Term 180
Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that provides unified security management and threat protection across hybrid and multi-cloud environments.