CAP-PL ENS flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Rules of engagement document

Written agreement defining authorized targets, time windows, permitted and prohibited techniques, emergency contacts, and data-handling constraints that bound every action during the test.

Scope creep risk

Testing beyond the authorized target list, even accidentally via discovered linked systems, becomes unauthorized activity; confirm written approval before touching any newly discovered host.

Deconfliction

Pre-arranged process with the client's defenders to distinguish tester traffic from a real intrusion, usually via a shared contact and known source IPs or user agents.

Passive reconnaissance

Collecting information from public sources such as DNS records, certificate transparency logs, and search engines without sending traffic directly to the target infrastructure.

Active enumeration

Directly probing in-scope hosts and services to identify open ports, software versions, shares, and users, producing traffic that defenders and logs can observe.

Exploitation validation

Confirming a vulnerability is genuinely exploitable with the least intrusive proof, such as a benign command execution or file read, rather than destructive payloads.

SUID privilege escalation

A Linux binary with the SUID bit runs as its owner; if it is a known abusable binary or has a writable dependency, it can yield execution as root.

Unquoted service path

A Windows service whose executable path contains spaces without quotes lets an attacker place a malicious binary in an earlier searched directory, running code as the service account.

AlwaysInstallElevated

A Windows policy pair that, when enabled in both machine and user hives, allows any user to install MSI packages with SYSTEM privileges.

Lateral movement

Moving from a compromised host to other systems using harvested credentials, trust relationships, or remote execution protocols, always staying within authorized scope.

Evidence integrity

Captured proof must include timestamps, target identifiers, and unaltered tool output so a reviewer can independently verify the finding and its reproduction steps.

Post-exploitation cleanup

Removing tools, accounts, shells, and configuration changes created during testing, and documenting each artifact so the client can confirm the environment is restored.

Retest validation

Confirming remediation by re-running the original exploit path and observing failure, rather than accepting a statement that a patch or configuration change was applied.

Executive summary

A short, jargon-free opening section stating overall risk posture, the most business-critical issues, and the recommended priority order for remediation.

Finding write-up

A structured entry containing title, affected asset, severity justification, reproduction steps, evidence, business impact, and a specific remediation with verification method.

CVSS base score

A 0 to 10 rating derived from exploitability metrics (attack vector, complexity, privileges, user interaction) and impact metrics (confidentiality, integrity, availability).

CVSS attack vector

The metric describing how a vulnerability is reached: network, adjacent network, local, or physical; network-reachable issues score higher than locally exploitable ones.

CVSS environmental metric

A client-specific adjustment reflecting asset criticality, existing controls, and data sensitivity, which can raise or lower the practical severity of a finding.

Risk versus CVSS score

CVSS measures technical severity; risk also depends on business context such as data sensitivity, exposure, and compensating controls, so the two can differ substantially.

Business impact statement

A plain-language description of what an attacker could achieve and which data, funds, or operations are at risk, written without exploit jargon for decision makers.

Remediation specificity

Guidance naming the exact control to change, such as a patch version, configuration setting, or network rule, plus how the fix will be verified during retest.

Compensating control

An alternative safeguard, such as network segmentation or monitoring, that reduces risk when the primary fix cannot be applied within the desired timeframe.

Report classification

A handling label on the deliverable, such as confidential, that governs encryption, distribution list, storage location, and eventual destruction of the document.

Debrief meeting

A closing session restating objectives, presenting top risks, agreeing remediation owners and dates, and confirming the retest window with client stakeholders.

Prioritized remediation roadmap

An ordered plan sequencing fixes by risk reduction and effort, so the client addresses the highest-impact issues first rather than by finding order.

Mean time to remediate

The average elapsed time from finding disclosure to verified closure, a metric that shows whether the client's remediation process is improving over engagements.

False positive handling

When a reported issue cannot be reproduced, the report must state the conditions tested and evidence collected, and either downgrade or withdraw the finding explicitly.

Advisory neutrality

Reporting facts and impact without blame or unverifiable certainty, so findings remain credible and the client's teams stay receptive to remediation guidance.

Attack surface coverage

The proportion of in-scope assets and services actually exercised during testing, stated in the report so readers know what was and was not assessed.

Proof-of-concept restraint

Using the minimum action needed to demonstrate exploitability, such as reading a test file, to avoid data loss or service disruption during validation.

Credential harvesting

Collecting passwords, hashes, or tokens from memory, configuration files, or shares after access, then reusing them within scope to demonstrate privilege and lateral reach.

Testing window constraint

The agreed time period during which active testing is permitted; activity outside it can disrupt business operations and breaches the engagement agreement.

Finding severity justification

A short rationale explaining why a finding received its rating, referencing exploitability, data exposure, and compensating controls rather than the score alone.