CertNexus CET cheat sheet

CIA triad: Confidentiality (encryption, access control), Integrity (hashing, digital signatures), Availability (redundancy, DDoS mitigation).

Symmetric encryption (AES, 3DES) uses one shared key and is fast; asymmetric encryption (RSA, ECC) uses a public/private key pair and solves key distribution.

TLS handshake: client hello → server hello + certificate → key exchange → finished; provides confidentiality, integrity, and server authentication.

Defense in depth layers: physical, network (firewall, IDS/IPS, segmentation), endpoint (EDR, antivirus), application (input validation, WAF), data (encryption, DLP), identity (MFA, least privilege).

Risk = Threat × Vulnerability × Impact; residual risk = inherent risk − control effectiveness. Risk treatment options: mitigate, transfer, avoid, accept.

Authentication factors: something you know (password), have (token), are (biometrics), do (behavior), somewhere you are (location); MFA requires two or more distinct factors.

Common attacks: phishing/social engineering, SQL injection, XSS, CSRF, MITM, ransomware, privilege escalation, zero-day exploitation.

Incident response phases (NIST): Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity.

Zero Trust principles: verify explicitly, use least privilege access, assume breach; microsegmentation and continuous authentication replace perimeter-only trust.

IoT architecture layers: perception/device (sensors, actuators), network (connectivity), edge/fog (local processing), cloud/application (analytics, storage), and business layer.

Connectivity options: Wi-Fi (high bandwidth, high power), Bluetooth/BLE (short range, low power), Zigbee/Z-Wave (mesh, low power), LoRaWAN/NB-IoT (long range, low bandwidth), cellular 4G/5G.

MQTT is publish/subscribe over TCP with a broker; CoAP is REST-like over UDP for constrained devices; AMQP is a reliable message-queue protocol.

IoT security risks: default/hardcoded credentials, unpatched firmware, insecure update mechanisms, weak encryption, exposed APIs, and physical tampering.

Device identity and lifecycle: secure boot, hardware root of trust, unique device certificates, over-the-air (OTA) signed updates, and decommissioning.

Edge computing reduces latency and bandwidth by processing data near the source; fog computing extends cloud services to the network edge.

IoT data pipeline: sensor → gateway → edge/cloud ingestion → stream processing → storage → analytics/ML → actuation or alerting.

Protocols for constrained devices: 6LoWPAN (IPv6 over low-power networks), RPL (routing), DTLS (security for UDP), and MQTT-SN.

AI categories: narrow (task-specific, current systems), general (human-level across tasks), superintelligent (beyond human); most deployed systems are narrow AI.

Machine learning types: supervised (labeled data, classification/regression), unsupervised (clustering, dimensionality reduction), semi-supervised, and reinforcement learning (reward-driven agents).

Model evaluation metrics: accuracy, precision = TP/(TP+FP), recall = TP/(TP+FN), F1 = 2·(precision·recall)/(precision+recall), ROC-AUC; choose metrics based on class balance and cost of errors.

Overfitting occurs when a model fits training noise; mitigate with more data, regularization (L1/L2), dropout, cross-validation, and early stopping.

Bias–variance tradeoff: high bias → underfitting; high variance → overfitting; total error = bias² + variance + irreducible error.

Neural network basics: layers of weighted nodes, activation functions (ReLU, sigmoid, softmax), loss function, backpropagation, and gradient descent optimization.

Generative AI (LLMs, GANs, diffusion models) produces new content; risks include hallucination, prompt injection, data leakage, and copyright concerns.

Responsible AI pillars: fairness, accountability, transparency/explainability, privacy, safety/robustness, and human oversight.

Data science lifecycle: problem definition → data acquisition → cleaning/wrangling → exploratory analysis → modeling → evaluation → deployment → monitoring.

Data types: structured (tables, relational), semi-structured (JSON, XML, logs), unstructured (text, images, audio); statistics split into descriptive (summarize) and inferential (generalize).

Central tendency: mean (sensitive to outliers), median (robust), mode (most frequent); dispersion: range, variance, standard deviation, IQR.

Correlation (r between −1 and 1) measures linear association, not causation; confounding variables and selection bias can create spurious correlations.

Hypothesis testing: null vs alternative hypothesis, p-value (probability of data given null), significance level α, Type I error (false positive), Type II error (false negative).

Sampling methods: random, stratified, systematic, cluster; sampling bias (survivorship, selection, response) threatens validity.

Data preparation: handle missing values (imputation or deletion), normalize/standardize features, encode categorical variables, detect and treat outliers.

Visualization selection: bar charts for categorical comparison, histograms for distribution, scatter plots for relationships, line charts for trends over time, box plots for spread/outliers.

Core ethical principles: beneficence, non-maleficence, autonomy, justice/fairness, transparency, and accountability.

Privacy regulations: GDPR (EU, lawful basis, data subject rights, 72-hour breach notification), CCPA/CPRA (California, opt-out of sale), HIPAA (US health data), PIPEDA (Canada).

Data subject rights under GDPR: access, rectification, erasure ('right to be forgotten'), restriction, portability, and objection.

Data minimization, purpose limitation, storage limitation, and consent are foundational privacy-by-design principles.

Anonymization vs pseudonymization: anonymized data cannot be re-identified; pseudonymized data replaces identifiers but remains re-identifiable with additional data.

Algorithmic bias sources: biased training data, proxy variables, sampling error, and feedback loops; mitigation includes diverse datasets, fairness metrics, and audits.

Ethical decision framework: identify stakeholders → assess harms and benefits → check legal/regulatory compliance → apply ethical principles → document and review.

Data governance roles: data owner (accountable), data steward (quality and policy), data custodian (technical controls), and privacy officer (compliance).