Cisco 300-220 CBRTHD cheat sheet

CIA triad: Confidentiality (unauthorized disclosure prevented), Integrity (unauthorized modification prevented), Availability (authorized access assured).

Threat vs. vulnerability vs. risk: threat = actor/event with potential to cause harm; vulnerability = weakness exploitable by a threat; risk = likelihood × impact of a threat exploiting a vulnerability.

Defense in depth layers: perimeter (firewall/IPS), network segmentation, endpoint protection, identity/AAA, data protection, monitoring and response.

Exploit kit / malware kill chain stages (Lockheed Martin): reconnaissance, weaponization, delivery, exploitation, installation, command and control (C2), actions on objective.

Encryption basics: symmetric (AES, shared key, fast, bulk data) vs. asymmetric (RSA/ECDSA, public/private key pair, key exchange and signatures); hashing (SHA-256) provides integrity, not confidentiality.

AAA components: Authentication (who you are), Authorization (what you may do), Accounting (what you did); RADIUS (UDP 1812/1813) and TACACS+ (TCP 49, encrypts full payload) are common implementations.

Common attack categories: reconnaissance/scanning, spoofing (IP/MAC/ARP/DNS), MITM, DoS/DDoS, phishing/social engineering, credential attacks (brute force, password spraying), injection and exploitation of unpatched software.

PKI trust: a certificate is trusted when its chain terminates in a trusted root CA, the signature validates, the validity period is current, and the subject/SAN matches the identity being presented.

Zero Trust principle: no implicit trust based on network location; every request is authenticated, authorized, and continuously evaluated using least privilege.

Syslog severity levels 0–7: 0 emergency, 1 alert, 2 critical, 3 error, 4 warning, 5 notice, 6 informational, 7 debug; lower number = higher severity.

Syslog transport is UDP 514 by default; TLS-secured syslog commonly uses TCP 6514. SNMP traps use UDP 162; NetFlow export commonly uses UDP 2055/9995.

SIEM correlation: normalizes and aggregates logs from multiple sources, applies correlation rules to produce alerts, and retains data for investigation and compliance.

Alert triage order: validate the alert is a true positive, determine scope (hosts, accounts, data), identify the technique (map to MITRE ATT&CK), then escalate or close with documentation.

Baseline concept: a baseline is the documented normal behavior of hosts, users, or traffic; anomalies are deviations from that baseline, not inherently malicious events.

FIM (file integrity monitoring) detects changes to critical files by comparing cryptographic hashes against a known-good baseline; it flags change, not intent.

NetFlow/IPFIX records contain 5-tuple plus byte/packet counts and timestamps but not payload; full packet capture is required to inspect content.

Log retention and time sync: consistent NTP across sources is required for correlation; mismatched clocks produce false ordering of events during investigation.

False positive vs. false negative: a false positive is a benign event flagged as malicious; a false negative is malicious activity that was not detected - tuning trades one against the other.

Process lineage: a suspicious parent-child pair (e.g., Word or Excel spawning PowerShell, cmd, or wscript) indicates macro-based or exploit-driven execution.

Windows autoruns/lateral persistence locations: Run/RunOnce registry keys, Startup folder, scheduled tasks, services, WMI event subscriptions, and DLL search-order hijacking.

Windows event IDs to know: 4624 logon success, 4625 logon failure, 4634/4647 logoff, 4672 special privileges assigned, 4688 process creation, 4720 account created, 1102 audit log cleared.

Logon types in 4624: 2 interactive, 3 network, 4 batch, 5 service, 7 unlock, 8 network cleartext, 9 new credentials (typical of pass-the-hash / explicit credential use), 10 RDP.

Linux persistence and evidence: cron jobs, systemd units, ~/.ssh/authorized_keys, /etc/rc.local, LD_PRELOAD, and modified shell profiles; check file mtimes with stat/ls -l.

Memory forensics artifacts: process list, network connections, loaded DLLs/modules, injected code regions (RWX memory), and command history; volatile data is lost on shutdown.

Hash-based malware identification: MD5/SHA-1/SHA-256 of a file are compared against known-bad sets; a changed hash on a known-good file indicates tampering or a new variant.

Endpoint detection and response (EDR) telemetry: process creation, file writes, registry changes, network connections, and script block logging (PowerShell event ID 4104).

Anti-forensics indicators: cleared event logs (1102), timestomping of file timestamps, disabled auditing, deleted but recoverable artifacts, and renamed system binaries.

TCP flag semantics: SYN initiates, SYN-ACK responds, ACK acknowledges, FIN/RST close or reset; a scan of many ports answered with RST or SYN-ACK indicates host discovery/port scanning.

TCP three-way handshake: SYN → SYN-ACK → ACK; half-open (SYN) floods exhaust the connection table because the final ACK never arrives.

Common ports: 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 HTTP, 123 NTP, 135/139/445 SMB/RPC, 161 SNMP, 389/636 LDAP/LDAPS, 443 HTTPS, 3389 RDP, 514 syslog.

DNS tunneling indicators: unusually long or high-entropy query names, high volume of TXT/NULL record queries, and consistent query sizes to a single domain.

ARP spoofing: an attacker sends gratuitous ARP replies mapping the gateway IP to the attacker MAC, enabling MITM; detection is duplicate MAC-to-IP mappings and MAC/IP changes.

IDS vs. IPS: IDS is passive and alerts on a copy of traffic; IPS is inline and can drop or reset offending traffic; signature, anomaly, and policy-based detection are the main methods.

Reconnaissance signatures: sequential port sweeps, ICMP sweep/ping scans, OS fingerprinting via malformed TCP options, and banner grabbing on service ports.

Data exfiltration clues: large outbound transfers to unusual destinations, asymmetric upload vs. download volume, off-hours transfers, and use of non-standard ports or encrypted channels.

PCAP analysis workflow: identify top talkers and conversations, filter by protocol, follow the TCP stream, extract objects, then hash and pivot extracted files to endpoint and log data.

Policy hierarchy: policy (management intent, mandatory) → standard (mandatory specific requirements) → procedure (step-by-step how) → guideline (recommended, non-mandatory).

Incident response lifecycle (NIST SP 800-61): preparation; detection and analysis; containment, eradication, and recovery; post-incident activity.

Evidence handling: maintain chain of custody, document who handled evidence and when, use write blockers and hashing for forensic images, and preserve volatile data first.

Data classification tiers commonly drive handling rules: public, internal, confidential, restricted - each with defined storage, transmission, and retention requirements.

Least privilege and separation of duties: accounts receive only the access required for their role, and no single person controls an entire critical transaction.

Acceptable use policy defines permitted use of organizational assets and typically authorizes monitoring; monitoring without notice can raise legal and privacy issues.

Business impact analysis (BIA) identifies critical systems and defines RTO (recovery time objective) and RPO (recovery point objective) for continuity planning.

Change management requires documented request, risk/impact review, approval, testing, and rollback plan before production changes; emergency changes are reviewed after the fact.

Compliance frameworks map controls to requirements: ISO/IEC 27001 (ISMS), NIST CSF (identify, protect, detect, respond, recover), PCI DSS (cardholder data), HIPAA (health data).