Certified CyberDefender Level 2 (CCDL2) preparation cheat sheet
Certified CyberDefender Level 2 (CCDL2) preparation · Keep the key ideas within reach.
Security operations, monitoring and response
Asset inventory and configuration baselines underpin every operational control.
Changes need an appropriate authorization path, recovery planning and relevant evidence.
Emergency changes still require retrospective documentation within a defined window.
Monitor log sources for silence, not just for events.
Distinguish historical Revision 2 phases from current NIST incident-response guidance integrated with broader risk management.
Containment precedes eradication in almost every scenario.
Capture volatile evidence (memory, connections) before disk and before power-off.
Digital evidence, acquisition and bounded forensic conclusions
Authority and the investigative question lead evidence work.
Hashes and custody records support specific limited claims.
Volatility priorities depend on feasible approved conditions.
Acquisition success needs coverage/error review and honest conclusions.
Filesystem, memory, network and timeline evidence
Different artifacts answer different evidence questions.
Execution/logging inferences depend on version, configuration and context.
Memory and packet captures have collection and encryption limits.
Timeline order needs timestamp semantics and clock assumptions.
Threat models, structured sharing and evidence-based hunting
Technique mappings and models support analysis, not conclusive attribution.
STIX representation, TAXII exchange and detection rules have different roles.
A hunt needs a falsifiable question and adequate telemetry.
Positive and negative results require context before action.