CCNA Cybersecurity (200-201 CCNACBR) key terms

The three core goals of information security: confidentiality keeps data from unauthorized readers, integrity keeps it unaltered and trustworthy, and availability keeps it reachable when legitimate users need it.

A weakness in software, configuration, or process that an attacker could exploit to damage a system or reach data. It exists independently of whether anyone actually attacks it.

A concrete technique, script, or tool that takes advantage of a specific vulnerability to gain unauthorized behavior on a target, such as remote code execution or privilege escalation.

The likelihood and impact of a threat successfully exploiting a vulnerability. Practitioners weigh it as a combination of threat, vulnerability, and business consequence when prioritizing fixes.

A person or group capable of causing harm to systems, ranging from script kiddies and insiders to organized crime and nation-state groups, each with different motives, resources, and persistence.

A well-resourced intruder, often state-sponsored, that quietly maintains long-term access to a target network to steal data or conduct espionage rather than cause immediate visible damage.

A risk originating from someone with legitimate access, such as an employee or contractor, who misuses that access accidentally or deliberately to expose, alter, or steal organizational data.

A vulnerability that is unknown to the vendor, so no patch exists yet. Attackers exploiting it have an advantage until defenders detect the behavior or a fix is released.

Layering multiple independent controls, such as firewalls, endpoint protection, authentication, and monitoring, so that failure of any single control does not expose the whole environment.

Granting users, services, and processes only the permissions needed for their assigned tasks, which limits the damage an account compromise or insider misuse can cause.

The assurance that a party cannot credibly deny having performed an action, typically achieved with digital signatures and tamper-evident audit logs that bind an identity to an event.

A signed data structure binding a public key to an identity, issued by a certificate authority. It lets parties verify identity and establish encrypted sessions without prior shared secrets.

The policies, roles, and systems that issue, distribute, validate, and revoke digital certificates, including certificate authorities, registration authorities, and revocation services.

An access model where permissions are assigned to roles rather than individuals, and users receive permissions by being placed in roles, simplifying administration and audit.

Dividing a network into isolated zones with controlled paths between them, which limits lateral movement after a compromise and constrains what each zone can reach.

Applying fine-grained, often workload-level policy so that individual hosts or services can communicate only with specifically permitted peers, regardless of physical network layout.

Artifact evidence suggesting a system may already be breached, such as known malicious file hashes, suspicious domains, unusual registry keys, or unexpected outbound connections to command infrastructure.

Evidence of active adversary behavior or intent, such as credential dumping, lateral movement attempts, or exploit sequences, which is more behavior-focused and durable than static file artifacts.

A phased model of an intrusion, from reconnaissance and weaponization through delivery, exploitation, installation, command and control, and actions on objectives, used to place detections along the attack path.

A curated knowledge base of adversary tactics and techniques observed in real intrusions, organized by goal, used by defenders to map detections and prioritize monitoring coverage.

The behavioral patterns of an adversary: high-level goals (tactics), specific methods (techniques), and detailed implementations (procedures). TTPs describe how a group operates, not just what tools it uses.

The channel an intruder uses to send instructions to and receive data from compromised hosts, often disguised as normal web or DNS traffic to blend into legitimate network activity.

Regular, periodic outbound contact from an infected host to attacker infrastructure. Its predictable timing and small repeated payloads are strong detection signals in network flow data.

Malware logic that produces many pseudo-random domain names so the implant can find its control server even if some domains are blocked, producing distinctive DNS query patterns.

Encoding data inside DNS queries and responses to bypass network controls or exfiltrate information, often visible as unusually long labels, high query volume, or odd record types.

Unauthorized transfer of data out of a protected environment, which may occur over web uploads, email, DNS, or encrypted channels and is often preceded by staging and compression.

Techniques an intruder uses to move from one compromised host to others inside a network, such as remote service abuse, stolen credentials, or file-share access, expanding control toward high-value targets.

Extracting stored password hashes or plaintext credentials from a host's memory or database so the attacker can authenticate as legitimate users and move without triggering exploit alarms.

Gaining a higher level of access than initially obtained, either by exploiting a local flaw to become administrator or by stealing credentials of a more privileged account.

A platform that collects logs from many sources, normalizes them, correlates events against rules, and generates alerts, giving analysts a central view for investigation and reporting.

Logic in a monitoring platform that links multiple events across sources or time to raise a higher-confidence alert, such as several failed logins followed by a success from one address.

An alert raised for activity that turns out to be benign. High false positive rates exhaust analysts, so rules are tuned to balance detection coverage against alert volume.

Adjusting detection rules, thresholds, and exclusions over time so alerts reflect real threats rather than known benign behavior, improving signal quality without losing important coverage.

Summarized metadata about network conversations, including source and destination addresses, ports, protocol, byte counts, and timestamps, useful for spotting scanning, beaconing, and large transfers without full packet capture.

Recording full packet contents on a link or host for later analysis, providing the deepest evidence for protocol-level investigation but requiring significant storage and careful privacy handling.

Decrypting and re-encrypting protected traffic at a controlled choke point so security tools can examine payloads, requiring trusted certificates and careful handling of sensitive data.

Agent software on hosts that continuously records process, file, and network behavior, enabling detection of malicious patterns and providing response actions such as isolating a machine or killing a process.

Using legitimate built-in system tools, such as PowerShell or administrative utilities, to perform malicious actions so activity blends with normal administration and evades signature-based detection.

Host configuration that records script block and module activity so investigators can reconstruct what commands ran, which is critical because fileless attacks leave little on disk.

A Windows system service that logs detailed process creation, network connections, file changes, and registry activity to the event log, enriching host telemetry for detection and investigation.

Software on an individual computer that permits or blocks traffic per application, port, and profile, adding a local control layer that follows the device onto untrusted networks.

Watching critical files and directories for unexpected changes in content or attributes, which can reveal tampering with system binaries, configuration, or web content.

Malware that hides its presence by subverting the operating system, often at kernel level, making files, processes, or registry entries invisible to ordinary tools and complicating cleanup.

An ordered set of permit and deny rules applied to traffic or resources. On network devices it filters packets by address, port, and protocol, and the first matching rule usually decides the outcome.

Examining captured traffic field by field to reconstruct sessions and identify anomalies, such as malformed headers, unexpected commands, or data hidden in normally unused fields.

Probing a range of ports to learn which services are listening on a host. Sequential or rapid probes from one source are a common precursor to exploitation and appear clearly in flow data.

The information-gathering phase before an attack, including host discovery, service enumeration, and public data collection, which defenders can detect early to disrupt later stages.

Falsifying an identity in a communication, such as a forged source IP address or email sender, to hide origin, bypass trust rules, or trick users into accepting a message.

A social-engineering message that impersonates a trusted party to lure a recipient into revealing credentials, running an attachment, or visiting a malicious site.

The structured process of preparing for, detecting, containing, eradicating, recovering from, and learning from a security event, with defined roles and communication paths.

A documented, repeatable procedure for handling a specific incident type, listing decision points, required evidence, escalation contacts, and containment steps so responders act consistently under pressure.

A documented, unbroken record of who handled evidence, when, and how, preserving its integrity so findings remain defensible in legal or disciplinary proceedings.

Protecting log data from alteration or deletion, for example by forwarding records to a separate server or using hashing, so evidence and audit trails remain trustworthy after a compromise.

Controls that inspect content in motion, at rest, or in use and block or alert on sensitive data leaving approved boundaries, supporting both compliance and exfiltration detection.

Ongoing education that teaches staff to recognize phishing, handle data correctly, and report suspicious events, reducing the human errors that many intrusions depend on.

A discussion-based rehearsal in which stakeholders walk through a simulated incident to test plans, reveal gaps in roles and communications, and improve readiness without touching production systems.

The process of tracking, testing, and applying software updates that close known vulnerabilities, reducing exposure to exploits that target unpatched systems.

Curated information about current adversaries, their infrastructure, and their methods, used to prioritize defenses and enrich detections with context beyond local observations.

An alert that correctly identifies real malicious or policy-violating activity. Distinguishing it from benign noise is the core judgment analysts apply during triage.