CNCC(C) cheat sheet

OSI layers 1-7: Physical, Data Link, Network, Transport, Session, Presentation, Application; TCP/IP collapses to Link, Internet, Transport, Application.

TCP is connection-oriented with a 3-way handshake (SYN, SYN-ACK, ACK); UDP is connectionless and does not guarantee delivery or ordering.

Private IPv4 ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16; RFC 1918 addresses are not routable on the public Internet.

Subnet host count = 2^(32 - prefix length) - 2; a /24 yields 254 usable hosts, a /30 yields 2.

DMZ segmentation places Internet-facing services in a screened subnet between external and internal firewalls; internal hosts are not directly reachable from the Internet.

Defense in depth layers preventive, detective, and corrective controls so that failure of one control does not expose the asset.

TLS provides confidentiality and integrity in transit via symmetric session keys negotiated with asymmetric cryptography; it does not by itself authenticate endpoints unless certificates are validated.

Zero trust replaces implicit network trust with per-request verification based on identity, device posture, and least privilege.

Governance assigns accountability: board and executive ownership of risk appetite, policies, and oversight; management implements controls.

Policy hierarchy: policy (mandatory intent) > standard (specific requirements) > procedure (step-by-step) > guideline (recommended).

GDPR lawful bases include consent, contract, legal obligation, vital interests, public task, and legitimate interests; breach notification to the supervisory authority is generally within 72 hours of awareness.

PCI DSS applies to any entity storing, processing, or transmitting cardholder data; the 12 requirements cover network security, data protection, vulnerability management, access control, monitoring, and policy.

ISO/IEC 27001 specifies requirements for an information security management system (ISMS) built on risk assessment, treatment, and continual improvement (Plan-Do-Check-Act).

Data classification tiers (public, internal, confidential, restricted) drive handling, retention, and access rules; retention periods must map to legal and regulatory obligations.

Separation of duties and least privilege are governance controls that reduce fraud and error by preventing one person from controlling an entire transaction.

Risk = likelihood x impact; qualitative scales (low/medium/high) are used when quantitative data is unavailable.

Annualized loss expectancy (ALE) = single loss expectancy (SLE) x annualized rate of occurrence (ARO).

Risk treatment options: mitigate (reduce), transfer (insurance, contract), avoid (stop activity), accept (documented residual risk).

Residual risk is the risk remaining after controls; it must be accepted by an accountable owner, not by the assessor.

Quantitative assessment uses monetary values and probabilities; qualitative uses ordinal ratings and scenario ranking.

Audit evidence types: inspection of documents, observation of processes, interviews, and technical testing (configuration review, sampling).

Control testing distinguishes design effectiveness (is the control designed correctly) from operating effectiveness (does it work over the period).

Findings should state condition, criteria, cause, effect, and recommendation so management can act without re-investigation.

Firewall rule sets should be default-deny with explicit allows; rules are evaluated top-down, and broad rules above specific rules shadow them.

IDS detects and alerts (passive); IPS detects and blocks inline (active); signature, anomaly, and behavior-based detection are the main methods.

WAF protects web applications at layer 7 against injection and cross-site scripting; it complements, not replaces, secure coding.

MFA combines knowledge, possession, and inherence factors; two instances of the same factor do not constitute MFA.

Encryption at rest protects stored data; key management (rotation, separation, custody) determines whether encryption is effective.

EDR collects endpoint telemetry and enables containment; antivirus signature matching alone misses fileless and living-off-the-land attacks.

Vulnerability scanning identifies known weaknesses; penetration testing validates exploitability and business impact through authorized simulated attack.

Logging must capture who, what, when, where, and outcome; centralized, time-synchronized logs support correlation and are protected from tampering.

Incident response phases: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity.

Containment options include isolating the host from the network, disabling accounts, blocking indicators, and segmenting affected systems; preserve volatile evidence before powering off.

Order of volatility: CPU registers and cache, memory, network state, running processes, disk, backups and archives.

Chain of custody records who handled evidence, when, and why; a break in the chain can render evidence inadmissible.

MTTD measures time to detect, MTTR measures time to respond and recover; both are core SOC performance metrics.

SIEM correlates logs and triggers alerts; tuning reduces false positives, which otherwise cause alert fatigue and missed true positives.

Severity classification drives escalation: critical incidents (data breach, ransomware, outage) require immediate notification to management and, where regulated, to authorities.

Lessons-learned review after closure identifies root cause and control gaps and feeds corrective actions back into preparation.

Scope definition must state in-scope assets, out-of-scope items, assumptions, constraints, and deliverables before work begins.

Rules of engagement authorize testing windows, targets, escalation contacts, and prohibited techniques; written authorization protects both parties.

Requirements are gathered as functional (what the system must do) and non-functional (performance, availability, compliance) before selecting controls.

Solution design trades off security, cost, usability, and operability; document rejected alternatives and rationale.

Client communication uses business language: translate technical findings into risk, impact, and cost, avoiding unexplained jargon.

Deliverable structure: executive summary, scope and approach, findings with severity ratings, evidence, and prioritized recommendations.

Change control ensures modifications are assessed, approved, tested, and recorded; undocumented changes undermine auditability.

Engagement closure includes acceptance of deliverables, knowledge transfer, and a defined support or remediation follow-up period.