CCNA Cybersecurity (200-201 CCNACBR) flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Confidentiality

Security property ensuring information is disclosed only to authorized parties. Encryption, access control lists, and data classification enforce it. A breach of confidentiality is unauthorized disclosure of data.

Risk

The combination of the likelihood that a threat exploits a vulnerability and the resulting business impact. Risk exists only when a threat can reach the weakness; a vulnerability alone is not risk.

Multi-factor authentication

Authentication using two or more factors from different categories: knowledge, possession, and inherence. Two passwords or a password plus a PIN count as one factor, not MFA.

Symmetric encryption

Encryption using a single shared key for both encryption and decryption. AES is the common example; it is fast and suited to bulk data, but key distribution must be solved separately.

Digital signature

A value produced by hashing a message and encrypting that hash with the sender private key. It proves origin and integrity, and is verified with the sender public key.

Hashing

A one-way function mapping any input to a fixed-length digest. Identical input yields identical output, and any change alters the digest, so hashes detect integrity changes but cannot be reversed.

Phishing

Social engineering that impersonates a trusted party through email or messaging to induce credential entry or malware execution. Indicators include mismatched sender domains, urgency, and unexpected attachments or links.

Syslog severity levels

Numerical severity from 0 (emergency) to 7 (debug), where lower numbers are more severe. Monitoring rules typically alert on 0 through 3 and suppress 6 and 7.

NetFlow

A flow record summarizing metadata for a conversation: source and destination IP, ports, protocol, byte and packet counts, and timestamps. It contains no payload, so content inspection needs packet capture.

False positive

An alert raised for activity that is actually benign. Excessive false positives cause alert fatigue; tuning reduces them but can increase false negatives if thresholds are set too loosely.

False negative

Malicious or anomalous activity that the detection system fails to flag. It represents undetected risk, and its true rate is hard to measure because missed events produce no alert.

SIEM correlation

Matching normalized events from multiple sources against rules to produce higher-confidence alerts. Correlation depends on consistent field parsing and synchronized clocks across all contributing devices.

NTP in monitoring

Network Time Protocol keeps device clocks synchronized. Accurate time is required to order events across sources and reconstruct an attack timeline during investigation.

Log retention

The period original log data is preserved according to policy and regulatory requirement. Retention must cover investigation and legal hold needs, with integrity protection such as hashing.

Windows event 4625

Records a failed logon attempt on a Windows host. Repeated 4625 events for one account from a single source indicate password guessing or brute-force activity.

Windows logon type 10

Indicates a logon over Remote Desktop. It follows a network logon in the session sequence and, from an unexpected source, suggests remote lateral movement by an attacker.

Windows event 4688

Records process creation, including the process name and often the parent process. It is a primary source for spotting suspicious parent-child chains such as a document viewer launching a shell.

Persistence

Mechanisms that let malware survive reboot or re-login. On Windows this includes run keys, services, scheduled tasks, and WMI subscriptions; on Linux, cron jobs and systemd units.

File integrity monitoring

Compares hashes of critical files against a known-good baseline. A changed hash on a system binary or configuration file signals unauthorized modification or tampering.

Volatile data

Host data lost on shutdown, including memory contents, running processes, active network connections, and logged-in sessions. It should be captured before isolation or power-off during triage.

EDR telemetry

Endpoint detection and response collects process, file, registry, network, and memory events continuously. Behavioral analysis of this data detects fileless and living-off-the-land attacks that signatures miss.

SYN flood

A denial-of-service attack sending many TCP SYN packets without completing the handshake, exhausting the target connection table. Half-open connections and unanswered SYN-ACKs are the signature.

SYN scan

A port scan sending SYN and interpreting SYN-ACK as open and RST as closed, without completing the handshake. It is stealthier than a connect scan but still leaves repeated half-open attempts.

IDS versus IPS

An IDS is passive on a mirrored port and only alerts. An IPS sits inline and can block traffic, so its false positives cause outages and its rules need careful tuning.

tcpdump filter

Capture expression built from primitives such as host, net, port, and protocol joined with and, or, and not. Example: tcp port 443 and host 10.1.1.5 captures only that flow.

DNS tunneling

Encoding data in DNS queries and responses to bypass controls. Indicators include many TXT queries, unusually long unique subdomains, and regular beaconing to one domain.

Beaconing

Periodic outbound connections from an infected host to attacker infrastructure at regular intervals. The consistent timing and small repeated payloads distinguish it from normal user traffic.

Data exfiltration

Unauthorized transfer of data out of the network. Flow evidence includes outbound volume far exceeding inbound for a host, unusual destinations, and transfers during off-hours.

PCAP analysis

Review of captured packets, typically starting with conversation statistics and protocol hierarchy to find top talkers, then following the suspect stream to inspect payload content.

Incident response phases

Preparation, detection and analysis, containment, eradication, recovery, and post-incident activity. Containment limits spread before eradication removes the cause and recovery restores service.

Chain of custody

A documented record of who collected, handled, and transferred evidence, with times and reasons. An unbroken record supports admissibility; any gap weakens the evidence.

Recovery point objective

The maximum tolerable amount of data loss measured in time, which sets backup frequency. A one-hour RPO requires backups or replication at least every hour.