CNCC(C) flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

OSI Model Layers

Seven layers from physical transmission to application services: Physical, Data Link, Network, Transport, Session, Presentation, Application. Each layer serves the layer above and isolates protocol functions for troubleshooting.

TCP Three-Way Handshake

Connection setup using SYN, SYN-ACK, and ACK packets. It confirms both endpoints are reachable and establishes initial sequence numbers before data transfer begins.

DMZ Screened Subnet

A segmented network holding Internet-facing services, positioned between external and internal firewalls. Compromise of a DMZ host does not grant direct access to the internal network.

Defense in Depth

Layering independent preventive, detective, and corrective controls across people, process, and technology so a single control failure does not expose critical assets.

Zero Trust Principle

No implicit trust based on network location. Every access request is authenticated, authorized, and encrypted using identity, device posture, and least privilege.

Subnet Host Capacity

Usable hosts equal two raised to the power of host bits minus two, reserving network and broadcast addresses. A /24 provides 254 usable addresses.

Policy Hierarchy

Policy states mandatory intent, standards specify measurable requirements, procedures give step-by-step instructions, and guidelines offer recommended practice. Higher tiers govern lower tiers.

GDPR Breach Notification

Controllers must notify the supervisory authority within 72 hours of becoming aware of a personal data breach unless the breach is unlikely to result in risk to individuals.

PCI DSS Scope

Applies to organizations that store, process, or transmit cardholder data. Its twelve requirements cover network security, data protection, access control, monitoring, testing, and policy.

ISO 27001 ISMS

Specifies requirements for establishing, operating, monitoring, and continually improving an information security management system driven by risk assessment and treatment.

Separation of Duties

Splitting a sensitive process so no single person controls all stages, such as request, approval, and execution. It reduces fraud and undetected error.

Data Classification

Assigning data to tiers such as public, internal, confidential, and restricted. The tier determines handling, access, encryption, and retention requirements.

Annualized Loss Expectancy

ALE equals single loss expectancy multiplied by annualized rate of occurrence. It expresses expected yearly monetary loss for a given risk scenario.

Risk Treatment Options

Mitigate by applying controls, transfer through insurance or contract, avoid by ceasing the activity, or accept with documented approval by the accountable risk owner.

Residual Risk

The risk remaining after controls are applied. It must be formally accepted by a risk owner with authority, not by the assessor who identified it.

Design vs Operating Effectiveness

Design effectiveness asks whether a control is capable of achieving its objective. Operating effectiveness asks whether it actually functioned consistently throughout the audit period.

Audit Finding Structure

A well-formed finding states condition, criteria, cause, effect, and recommendation, enabling management to remediate without repeating the auditor's investigation.

Risk Assessment Methods

Quantitative assessment assigns monetary values and probabilities. Qualitative assessment uses ordinal ratings and scenario ranking when reliable numerical data is unavailable.

IDS Versus IPS

An intrusion detection system monitors and alerts passively. An intrusion prevention system sits inline and can block traffic in real time when it matches malicious patterns.

Multi-Factor Authentication

Requires two or more distinct factor types: something you know, something you have, something you are. Two passwords are not multi-factor authentication.

Web Application Firewall

Inspects HTTP traffic at layer seven to block injection, cross-site scripting, and similar attacks. It complements secure coding rather than replacing it.

Firewall Default Deny

Rules are evaluated top-down and the implicit final rule denies all traffic. Explicit allow rules must be narrow, because broad rules above specific ones shadow them.

Key Management

Generation, distribution, rotation, storage, and destruction of cryptographic keys. Poor key custody defeats encryption regardless of algorithm strength.

Endpoint Detection and Response

Collects continuous endpoint telemetry, detects behavioral threats, and supports remote containment. It catches fileless and living-off-the-land attacks that signature antivirus misses.

Incident Response Phases

Preparation; detection and analysis; containment, eradication, and recovery; post-incident activity. Containment limits spread before eradication removes the cause.

Order of Volatility

Evidence collection priority: CPU registers and cache, memory, network connections, running processes, disk storage, then backups and archives. Collect most volatile data first.

Chain of Custody

A documented record of who collected, handled, and transferred evidence, with times and purposes. Unbroken custody supports admissibility in legal proceedings.

MTTD and MTTR

Mean time to detect measures average detection latency; mean time to respond or recover measures remediation speed. Both are core security operations performance metrics.

SIEM Alert Tuning

Adjusting correlation rules and thresholds to reduce false positives. Excessive noise causes alert fatigue and increases the chance that genuine incidents are missed.

Rules of Engagement

Written authorization defining testing targets, time windows, permitted techniques, escalation contacts, and prohibited actions. It protects both consultant and client legally.

Scope and Assumptions

Documentation stating in-scope assets, explicit exclusions, dependencies, constraints, and deliverables. Ambiguity here causes disputes and gaps in later assessment work.

Executive Summary Content

A deliverable section stating overall risk posture, key findings with business impact, and prioritized recommendations in language understandable to non-technical leadership.