Certified CyberDefender Level 2 (CCDL2) preparation flashcards

23 cards. Read the term and the definition here. The deck at the top of this page is optional.

Security Information and Event Management (SIEM)

A system that collects, aggregates, and analyzes log data from various sources to detect security incidents and support compliance reporting.

Incident Response

A structured approach to handling security incidents, typically including preparation, detection, containment, eradication, recovery, and lessons learned.

Evidence provenance

The recorded source, collection method, identity and handling history supporting interpretation of an artifact, distinct from an automatic guarantee of admissibility or truth.

Integrity hash comparison

A comparison supporting equality of captured byte sequences under a method, not proof of the identity or intent of a human actor.

Timeline normalization

Explicit treatment of time zones, offsets and timestamp meanings before correlating events across sources, rather than sorting unlike clocks as if identical.

Capture coverage

The monitored point, filters, length, losses, time and encryption conditions that limit what a packet or other collection can establish.

STIX

A structured language for representing relevant threat and observable information, distinct from the transport/exchange mechanism or a conclusive attribution guarantee.

TAXII

A supported threat-intelligence exchange model whose access, version and server/client behavior require review separately from the represented STIX content.

Hunt hypothesis

A testable proposition about activity and expected observations that guides analysis, with data coverage and alternatives explicitly considered.

Containment impact

The operational and evidentiary consequences of a proposed restriction or isolation, assessed alongside incident harm and responsible authorization.

Evidence preservation

Actions intended to retain relevant incident data and context under the actual authorized priorities, not a guarantee that every changing system state remains untouched.

Chain of custody

A documented record of possession, transfer and handling linked to the identified evidence, supporting accountability without independently proving every investigative conclusion.

Acquisition verification

Comparison of appropriate records and digest evidence for the acquired data, interpreted under the actual method rather than assuming live systems never change.

Logical acquisition

Collection of selected logical objects or data through their available interfaces, which may differ in coverage from a physical device image.

Physical acquisition

Acquisition addressing the relevant device or storage representation at a lower level, whose actual coverage and limitations must be documented.

Unallocated space

Storage not currently allocated to an active object under the relevant filesystem view, potentially containing residual data but not guaranteeing complete recovery.

File carving

Recovery attempts based on content patterns or structure rather than intact filesystem directory information, subject to fragmentation and false-positive limitations.

Filesystem timestamp

A recorded time associated with a defined filesystem event or field, requiring context rather than automatically proving a human action.

Volatile memory

Runtime data that can change or disappear with execution and power state, requiring an acquisition decision appropriate to incident priorities and authority.

Clock skew

A difference between a recorded source clock and the relevant reference, which can distort event order if not assessed consistently.

Network reassembly

Reconstruction of relevant higher-level communication from captured packets, limited by collection coverage, loss, encryption and protocol behavior.

Alternative hypothesis

A competing explanation evaluated against available evidence, helping avoid treating a single anomalous artifact as proof of one cause.

Detection coverage

The relevant events, assets and behavior a detection can observe under its actual data and rule configuration, distinct from guaranteed attack prevention.