CFR-410 flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

SYN scan vs connect scan

A SYN scan sends a SYN and resets before the handshake completes, so the target application rarely logs it. A connect scan completes the handshake and appears in application logs.

open|filtered port state

Nmap reports open|filtered when no response arrives: the port may be open but silently dropping probes, or a firewall may be filtering. It is not proof the port is open.

Reverse vs bind shell

A reverse shell has the compromised target connect outbound to the attacker, bypassing inbound firewall rules. A bind shell listens on the target and requires inbound reachability.

Meterpreter characteristics

Meterpreter is an in-memory reflective DLL payload that avoids writing an executable to disk and provides post-exploitation modules such as hashdump, kiwi, portfwd, and getsystem.

msfvenom purpose

msfvenom generates standalone payloads and shellcode outside the Metasploit console, for example a Windows executable with a reverse TCP meterpreter payload and specified LHOST and LPORT.

Time-based SQL injection

Time-based SQL injection infers conditions from deliberate database delays such as SLEEP or pg_sleep. The response time difference reveals true or false answers when page content does not change.

Stored cross-site scripting

Stored XSS persists the malicious script server-side, for example in a comment or profile field, so every user who views the content executes it. Output encoding and CSP mitigate it.

IDOR root cause

Insecure direct object reference occurs when an application exposes objects by predictable identifier without a server-side authorization check, letting a user read or modify another user's records.

SSRF mitigation

Server-side request forgery is mitigated by allowlisting permitted outbound destinations, blocking link-local and internal address ranges, and disabling unnecessary URL-fetch features.

Windows event 4625

Event ID 4625 records a failed logon attempt. Repeated 4625 events across many accounts from one source suggest password spraying; against one account they suggest brute force.

Logon type 10

Windows logon type 10 is RemoteInteractive, used for RDP sessions. It commonly follows a network logon and can indicate lateral movement when seen from unusual sources.

Order of volatility

Forensic acquisition proceeds from most to least volatile: registers and cache, memory, network state, running processes, disk, remote logs, archival media. Memory capture preserves keys and injected code.

Chain of custody

A documented record of who handled evidence, when, and how. Combined with acquisition and verification hashes, it establishes that evidence was not altered after seizure.

NTFS $MFT

The Master File Table records every file entry on an NTFS volume, including timestamps and attributes. Analysts parse it to reconstruct file creation, modification, and deletion activity.

Timestomping detection

Timestomping backdates file timestamps to hide activity. It is detected when the standard information modified timestamp precedes the file entry creation timestamp in the MFT.

Prefetch forensic value

Windows prefetch files record program execution, including run count and referenced file paths. They support proving that an executable ran, though they are not a complete execution history.

YARA rule purpose

YARA matches textual and binary patterns against files or memory to identify malware families. Rules are portable across scanners and are commonly used in incident triage.

Sigma rule purpose

Sigma is a vendor-neutral format for describing log-based detection rules. Rules are converted into queries for specific SIEM platforms, making detections portable.

Indicator durability

Threat indicators decay at different rates: file hashes are precise but change easily, domains and IPs expire, and adversary tactics, techniques, and procedures remain useful longest.

Log source time synchronization

Accurate NTP synchronization across log sources is required to correlate events. Skewed clocks can make an attack chain appear out of order or hide the initial access event.

Windows event 4688

Event ID 4688 records process creation when audit policy enables it. It captures the process name, parent process, and command line, which is essential for detecting script-based attacks.

Password spraying signature

Password spraying tries a few common passwords across many accounts to avoid lockout. In logs it appears as many 4625 failures across distinct accounts from a single source.

Three data states

Data exists at rest on storage, in transit across networks, and in use in memory. Each state needs distinct controls such as encryption, TLS, and memory protection.

ABAC vs RBAC

Role-based access control grants permissions by job role. Attribute-based access control evaluates attributes of user, resource, and context, enabling finer, policy-driven decisions such as time or location conditions.

Phishing-resistant MFA

FIDO2 and WebAuthn security keys and passkeys bind authentication to the legitimate origin, resisting real-time phishing proxies. SMS one-time codes are weaker due to SIM swap and interception.

Least privilege

Users and services receive only the access needed for their tasks, for the time needed. It limits blast radius when an account is compromised and reduces standing administrative exposure.

Separation of duties

No single person can complete a sensitive transaction alone, such as both requesting and approving a payment. It prevents fraud and single-actor misuse of privileged access.

Deny-by-default egress

Outbound network traffic is blocked unless explicitly permitted. This limits command-and-control callbacks and data exfiltration even after an endpoint is compromised.

DMZ placement

Internet-facing services are placed in a segmented demilitarized zone separated from internal networks by firewalls, so compromise of a public service does not grant direct internal access.

Application allowlisting

Only approved executables may run, enforced by hash or publisher signature. It blocks unapproved malware and unauthorized tools even when an attacker gains user-level access.

SBOM role

A software bill of materials lists components and versions in a product. It lets defenders rapidly identify exposure when a dependency vulnerability is disclosed.

CVSS is not priority

CVSS measures technical severity, not business risk. Prioritization also weighs internet exposure, exploit availability, data sensitivity, and compensating controls.

3-2-1 backup rule

Keep three copies of data on two different media, with one copy offsite or offline. Tested restores are required; ransomware specifically targets reachable backups.