CCNA Cybersecurity (200-201 CCNACBR) cheat sheet

CIA triad: Confidentiality protects disclosure, Integrity protects modification, Availability protects timely access; a control is mapped to the property it primarily protects.

Threat, vulnerability, risk, exploit: risk = likelihood of a threat exploiting a vulnerability × impact; a vulnerability alone is not a risk until a threat actor can reach it.

Defense in depth layers preventive, detective, and corrective controls so a single failed control does not expose the asset; no single layer is trusted alone.

Authentication factors: something you know (password), have (token), are (biometric); MFA requires factors from two different categories, so password + PIN is not MFA.

Symmetric ciphers (AES) are fast and used for bulk data; asymmetric ciphers (RSA, ECDSA) solve key exchange and digital signatures but are much slower.

Hashing (SHA-256) is one-way and detects integrity changes; HMAC adds a shared secret so the hash also proves authenticity of the sender.

Common attack categories: reconnaissance, social engineering (phishing, pretexting), malware (ransomware, trojan), and DoS/DDoS; each maps to distinct countermeasures.

Certificate and PKI chain: root CA signs intermediate CA, intermediate signs server certificate; a client validates signature chain, validity dates, and hostname match.

Zero trust principle: never trust implicitly by network location, always verify identity and device posture per request; least privilege limits blast radius.

Log source categories: network (firewall, IDS/IPS, NetFlow), host (OS event logs, EDR), application (web server, database), and identity (AAA, directory).

Syslog severity 0 emerg to 7 debug; lower number is more severe, so alerting thresholds typically trigger on 0-3 and treat 6-7 as noise.

Correlation rule: a single event is weak evidence; an alert gains confidence when multiple sources agree on the same 5-tuple, user, and time window.

NTP synchronization is a prerequisite for correlation; unsynchronized clocks break timeline reconstruction and event ordering across devices.

NetFlow/IPFIX records metadata (src/dst IP, ports, bytes, timestamps) but not payload; full packet capture is required to inspect content.

False positive = benign activity flagged as malicious; false negative = malicious activity not flagged. Tuning trades one against the other; document the accepted risk.

SIEM pipeline: collection, normalization/parsing, correlation, alerting, retention; missing normalization causes the same event to appear as unrelated records.

Baseline first, then anomaly: thresholds set without a known-good baseline produce either alert fatigue or blind spots depending on traffic volume.

Evidence handling: preserve original logs, record hash and chain of custody, and work from copies so investigation does not alter the source.

Windows Event ID anchors: 4624 successful logon, 4625 failed logon, 4672 special privileges assigned, 4688 process creation, 4720 user account created.

Logon type codes: 2 interactive, 3 network, 5 service, 7 unlock, 10 RDP; type 3 followed by type 10 from an unusual source is a lateral-movement indicator.

Linux authentication evidence lives in /var/log/auth.log or /var/log/secure; sudo entries and repeated sshd failures are the primary brute-force signal.

Persistence mechanisms to check: scheduled tasks/cron, run keys, services, WMI subscriptions, systemd units, and startup folders.

Process ancestry matters: office suite spawning cmd.exe or powershell.exe is suspicious; parent-child relationships reveal malicious execution chains.

File integrity monitoring compares cryptographic hashes of critical files against a known-good baseline; a changed hash on a system binary indicates tampering.

EDR telemetry covers process, file, network, registry, and memory events; host antivirus signature matching alone misses fileless and living-off-the-land attacks.

Malware triage order: isolate the host, capture volatile data (memory, connections, processes), then hash and preserve disk before remediation.

TCP flags: SYN starts handshake, SYN-ACK acknowledges, ACK completes; a flood of SYNs without completed handshakes indicates SYN flood.

Port scan signatures: SYN scan sends SYN and resets without completing; connect scan completes the handshake; a single source touching many ports in sequence is scanning.

tcpdump filter syntax: host, net, port, and boolean and/or/not; 'tcp port 443 and host 10.1.1.5' captures only that flow.

PCAP analysis workflow: identify top talkers, then protocol hierarchy, then follow the stream; conversation statistics narrow the suspect flow before payload review.

IDS vs IPS placement: IDS is passive on a span/mirror port and alerts; IPS is inline and can drop, so a false positive becomes an outage.

Signature detection matches known patterns; anomaly detection flags deviation from baseline. Signature catches known attacks, anomaly catches novel behavior with more noise.

DNS tunneling indicators: high volume of TXT or long unique subdomain queries to one domain, unusual query size, and periodic beaconing intervals.

Exfiltration indicators: outbound byte counts exceeding inbound on an internal host, transfers to unusual geographies, and connections at regular off-hours intervals.

Encrypted traffic still yields metadata: TLS SNI, certificate subject, JA3 fingerprint, and flow size/timing support detection without decryption.

Policy hierarchy: policy states intent and is management-approved; standard defines mandatory specifics; procedure gives step-by-step execution; guideline is recommended.

Incident response phases: preparation, detection and analysis, containment/eradication/recovery, post-incident activity; containment precedes eradication.

Data classification drives handling: public, internal, confidential, restricted; each class maps to encryption, retention, and access requirements.

Acceptable use policy defines permitted use of organizational assets and the monitoring notice that supports lawful inspection of user activity.

Chain of custody records who handled evidence, when, and why; a break in the record weakens admissibility of the evidence.

Change management requires documented request, risk assessment, approval, test, and rollback plan; emergency changes still require retroactive approval.

Least privilege and separation of duties limit insider risk; privileged accounts require distinct credentials and logged administrative sessions.

Regulatory drivers: PCI DSS for cardholder data, HIPAA for health information, GDPR for EU personal data; each mandates breach notification timelines.

Business continuity and disaster recovery: RTO is maximum tolerable downtime, RPO is maximum tolerable data loss; backup frequency is set by RPO.

CIA triad: Confidentiality protects disclosure, Integrity protects modification, Availability protects timely access; a control is mapped to the property it primarily protects.

Threat, vulnerability, risk, exploit: risk = likelihood of a threat exploiting a vulnerability × impact; a vulnerability alone is not a risk until a threat actor can reach it.

Defense in depth layers preventive, detective, and corrective controls so a single failed control does not expose the asset; no single layer is trusted alone.

Authentication factors: something you know (password), have (token), are (biometric); MFA requires factors from two different categories, so password + PIN is not MFA.

Symmetric ciphers (AES) are fast and used for bulk data; asymmetric ciphers (RSA, ECDSA) solve key exchange and digital signatures but are much slower.

Hashing (SHA-256) is one-way and detects integrity changes; HMAC adds a shared secret so the hash also proves authenticity of the sender.

Common attack categories: reconnaissance, social engineering (phishing, pretexting), malware (ransomware, trojan), and DoS/DDoS; each maps to distinct countermeasures.

Certificate and PKI chain: root CA signs intermediate CA, intermediate signs server certificate; a client validates signature chain, validity dates, and hostname match.

Zero trust principle: never trust implicitly by network location, always verify identity and device posture per request; least privilege limits blast radius.

Log source categories: network (firewall, IDS/IPS, NetFlow), host (OS event logs, EDR), application (web server, database), and identity (AAA, directory).

Syslog severity 0 emerg to 7 debug; lower number is more severe, so alerting thresholds typically trigger on 0-3 and treat 6-7 as noise.

Correlation rule: a single event is weak evidence; an alert gains confidence when multiple sources agree on the same 5-tuple, user, and time window.

NTP synchronization is a prerequisite for correlation; unsynchronized clocks break timeline reconstruction and event ordering across devices.

NetFlow/IPFIX records metadata (src/dst IP, ports, bytes, timestamps) but not payload; full packet capture is required to inspect content.

False positive = benign activity flagged as malicious; false negative = malicious activity not flagged. Tuning trades one against the other; document the accepted risk.

SIEM pipeline: collection, normalization/parsing, correlation, alerting, retention; missing normalization causes the same event to appear as unrelated records.

Baseline first, then anomaly: thresholds set without a known-good baseline produce either alert fatigue or blind spots depending on traffic volume.

Evidence handling: preserve original logs, record hash and chain of custody, and work from copies so investigation does not alter the source.

Windows Event ID anchors: 4624 successful logon, 4625 failed logon, 4672 special privileges assigned, 4688 process creation, 4720 user account created.

Logon type codes: 2 interactive, 3 network, 5 service, 7 unlock, 10 RDP; type 3 followed by type 10 from an unusual source is a lateral-movement indicator.

Linux authentication evidence lives in /var/log/auth.log or /var/log/secure; sudo entries and repeated sshd failures are the primary brute-force signal.

Persistence mechanisms to check: scheduled tasks/cron, run keys, services, WMI subscriptions, systemd units, and startup folders.

Process ancestry matters: office suite spawning cmd.exe or powershell.exe is suspicious; parent-child relationships reveal malicious execution chains.

File integrity monitoring compares cryptographic hashes of critical files against a known-good baseline; a changed hash on a system binary indicates tampering.

EDR telemetry covers process, file, network, registry, and memory events; host antivirus signature matching alone misses fileless and living-off-the-land attacks.

Malware triage order: isolate the host, capture volatile data (memory, connections, processes), then hash and preserve disk before remediation.

TCP flags: SYN starts handshake, SYN-ACK acknowledges, ACK completes; a flood of SYNs without completed handshakes indicates SYN flood.

Port scan signatures: SYN scan sends SYN and resets without completing; connect scan completes the handshake; a single source touching many ports in sequence is scanning.

tcpdump filter syntax: host, net, port, and boolean and/or/not; 'tcp port 443 and host 10.1.1.5' captures only that flow.

PCAP analysis workflow: identify top talkers, then protocol hierarchy, then follow the stream; conversation statistics narrow the suspect flow before payload review.

IDS vs IPS placement: IDS is passive on a span/mirror port and alerts; IPS is inline and can drop, so a false positive becomes an outage.

Signature detection matches known patterns; anomaly detection flags deviation from baseline. Signature catches known attacks, anomaly catches novel behavior with more noise.

DNS tunneling indicators: high volume of TXT or long unique subdomain queries to one domain, unusual query size, and periodic beaconing intervals.

Exfiltration indicators: outbound byte counts exceeding inbound on an internal host, transfers to unusual geographies, and connections at regular off-hours intervals.

Encrypted traffic still yields metadata: TLS SNI, certificate subject, JA3 fingerprint, and flow size/timing support detection without decryption.

Policy hierarchy: policy states intent and is management-approved; standard defines mandatory specifics; procedure gives step-by-step execution; guideline is recommended.

Incident response phases: preparation, detection and analysis, containment/eradication/recovery, post-incident activity; containment precedes eradication.

Data classification drives handling: public, internal, confidential, restricted; each class maps to encryption, retention, and access requirements.

Acceptable use policy defines permitted use of organizational assets and the monitoring notice that supports lawful inspection of user activity.

Chain of custody records who handled evidence, when, and why; a break in the record weakens admissibility of the evidence.

Change management requires documented request, risk assessment, approval, test, and rollback plan; emergency changes still require retroactive approval.

Least privilege and separation of duties limit insider risk; privileged accounts require distinct credentials and logged administrative sessions.

Regulatory drivers: PCI DSS for cardholder data, HIPAA for health information, GDPR for EU personal data; each mandates breach notification timelines.

Business continuity and disaster recovery: RTO is maximum tolerable downtime, RPO is maximum tolerable data loss; backup frequency is set by RPO.

CIA triad: Confidentiality protects disclosure, Integrity protects modification, Availability protects timely access; a control is mapped to the property it primarily protects.

Threat, vulnerability, risk, exploit: risk = likelihood of a threat exploiting a vulnerability × impact; a vulnerability alone is not a risk until a threat actor can reach it.

Defense in depth layers preventive, detective, and corrective controls so a single failed control does not expose the asset; no single layer is trusted alone.

Authentication factors: something you know (password), have (token), are (biometric); MFA requires factors from two different categories, so password + PIN is not MFA.

Symmetric ciphers (AES) are fast and used for bulk data; asymmetric ciphers (RSA, ECDSA) solve key exchange and digital signatures but are much slower.

Hashing (SHA-256) is one-way and detects integrity changes; HMAC adds a shared secret so the hash also proves authenticity of the sender.

Common attack categories: reconnaissance, social engineering (phishing, pretexting), malware (ransomware, trojan), and DoS/DDoS; each maps to distinct countermeasures.

Certificate and PKI chain: root CA signs intermediate CA, intermediate signs server certificate; a client validates signature chain, validity dates, and hostname match.

Zero trust principle: never trust implicitly by network location, always verify identity and device posture per request; least privilege limits blast radius.

Log source categories: network (firewall, IDS/IPS, NetFlow), host (OS event logs, EDR), application (web server, database), and identity (AAA, directory).

Syslog severity 0 emerg to 7 debug; lower number is more severe, so alerting thresholds typically trigger on 0-3 and treat 6-7 as noise.

Correlation rule: a single event is weak evidence; an alert gains confidence when multiple sources agree on the same 5-tuple, user, and time window.

NTP synchronization is a prerequisite for correlation; unsynchronized clocks break timeline reconstruction and event ordering across devices.

NetFlow/IPFIX records metadata (src/dst IP, ports, bytes, timestamps) but not payload; full packet capture is required to inspect content.

False positive = benign activity flagged as malicious; false negative = malicious activity not flagged. Tuning trades one against the other; document the accepted risk.

SIEM pipeline: collection, normalization/parsing, correlation, alerting, retention; missing normalization causes the same event to appear as unrelated records.

Baseline first, then anomaly: thresholds set without a known-good baseline produce either alert fatigue or blind spots depending on traffic volume.

Evidence handling: preserve original logs, record hash and chain of custody, and work from copies so investigation does not alter the source.

Windows Event ID anchors: 4624 successful logon, 4625 failed logon, 4672 special privileges assigned, 4688 process creation, 4720 user account created.

Logon type codes: 2 interactive, 3 network, 5 service, 7 unlock, 10 RDP; type 3 followed by type 10 from an unusual source is a lateral-movement indicator.

Linux authentication evidence lives in /var/log/auth.log or /var/log/secure; sudo entries and repeated sshd failures are the primary brute-force signal.

Persistence mechanisms to check: scheduled tasks/cron, run keys, services, WMI subscriptions, systemd units, and startup folders.

Process ancestry matters: office suite spawning cmd.exe or powershell.exe is suspicious; parent-child relationships reveal malicious execution chains.

File integrity monitoring compares cryptographic hashes of critical files against a known-good baseline; a changed hash on a system binary indicates tampering.

EDR telemetry covers process, file, network, registry, and memory events; host antivirus signature matching alone misses fileless and living-off-the-land attacks.

Malware triage order: isolate the host, capture volatile data (memory, connections, processes), then hash and preserve disk before remediation.

TCP flags: SYN starts handshake, SYN-ACK acknowledges, ACK completes; a flood of SYNs without completed handshakes indicates SYN flood.

Port scan signatures: SYN scan sends SYN and resets without completing; connect scan completes the handshake; a single source touching many ports in sequence is scanning.

tcpdump filter syntax: host, net, port, and boolean and/or/not; 'tcp port 443 and host 10.1.1.5' captures only that flow.

PCAP analysis workflow: identify top talkers, then protocol hierarchy, then follow the stream; conversation statistics narrow the suspect flow before payload review.

IDS vs IPS placement: IDS is passive on a span/mirror port and alerts; IPS is inline and can drop, so a false positive becomes an outage.

Signature detection matches known patterns; anomaly detection flags deviation from baseline. Signature catches known attacks, anomaly catches novel behavior with more noise.

DNS tunneling indicators: high volume of TXT or long unique subdomain queries to one domain, unusual query size, and periodic beaconing intervals.

Exfiltration indicators: outbound byte counts exceeding inbound on an internal host, transfers to unusual geographies, and connections at regular off-hours intervals.

Encrypted traffic still yields metadata: TLS SNI, certificate subject, JA3 fingerprint, and flow size/timing support detection without decryption.

Policy hierarchy: policy states intent and is management-approved; standard defines mandatory specifics; procedure gives step-by-step execution; guideline is recommended.

Incident response phases: preparation, detection and analysis, containment/eradication/recovery, post-incident activity; containment precedes eradication.

Data classification drives handling: public, internal, confidential, restricted; each class maps to encryption, retention, and access requirements.

Acceptable use policy defines permitted use of organizational assets and the monitoring notice that supports lawful inspection of user activity.

Chain of custody records who handled evidence, when, and why; a break in the record weakens admissibility of the evidence.

Change management requires documented request, risk assessment, approval, test, and rollback plan; emergency changes still require retroactive approval.

Least privilege and separation of duties limit insider risk; privileged accounts require distinct credentials and logged administrative sessions.

Regulatory drivers: PCI DSS for cardholder data, HIPAA for health information, GDPR for EU personal data; each mandates breach notification timelines.

Business continuity and disaster recovery: RTO is maximum tolerable downtime, RPO is maximum tolerable data loss; backup frequency is set by RPO.