Cisco 300-220 CBRTHD flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

Core security model: confidentiality prevents unauthorized disclosure, integrity prevents unauthorized modification, and availability ensures timely authorized access to systems and data.

Risk definition

Risk is the combination of the likelihood that a threat exploits a vulnerability and the resulting business impact; it is reduced by controls, not eliminated.

Symmetric vs. asymmetric encryption

Symmetric uses one shared key and is fast, suited to bulk data. Asymmetric uses a public/private key pair for key exchange and signatures but is computationally slower.

TACACS+ versus RADIUS

TACACS+ runs over TCP 49 and encrypts the entire payload, separating authentication, authorization, and accounting. RADIUS uses UDP 1812/1813 and encrypts only the password field.

ARP spoofing attack

An attacker sends forged ARP replies mapping a gateway or host IP to the attacker's MAC address, redirecting traffic for man-in-the-middle interception or denial of service.

Certificate chain validation

A certificate is trusted when its signature validates up the chain to a trusted root CA, the validity dates are current, and the subject matches the presented identity.

Zero Trust model

No user or device is implicitly trusted based on network location; every access request is authenticated, authorized, and continuously evaluated under least privilege.

Syslog severity levels

Numbered 0 through 7: emergency, alert, critical, error, warning, notice, informational, debug. Lower numbers indicate higher severity and demand faster attention.

SIEM correlation

A SIEM centralizes and normalizes logs from many sources, applies correlation rules across events, generates alerts, and retains data for investigation and compliance reporting.

File integrity monitoring

FIM hashes critical files and compares them against a known-good baseline, alerting when content changes; it detects modification but not the intent behind it.

NetFlow record contents

Flow records capture the five-tuple, byte and packet counts, timestamps, and interface data, but never payload content, so full packet capture is needed for content inspection.

False positive versus negative

A false positive is benign activity flagged as malicious; a false negative is malicious activity that went undetected. Tuning detection rules shifts the balance between them.

Alert triage sequence

Confirm the alert is a true positive, determine scope across hosts and accounts, map the technique to a framework such as MITRE ATT&CK, then escalate or close with documentation.

NTP importance for log correlation

Accurate, consistent time synchronization across log sources is required; clock drift between devices produces incorrect event ordering and breaks correlation during investigations.

Suspicious process lineage

A parent-child process pair such as an Office application spawning PowerShell, cmd, or wscript strongly suggests macro-based execution or exploitation rather than normal user activity.

Windows event ID 4688

Records process creation on Windows, including the image name and parent process, making it a primary source for detecting anomalous execution and building process lineage.

Windows logon type 3

A network logon recorded in event 4624, typical of SMB or remote service access; repeated type 3 logons across many hosts can indicate lateral movement.

Windows logon type 10

Indicates a Remote Desktop session recorded in event 4624; unusual source addresses or off-hours type 10 logons are common lateral movement indicators.

Event ID 1102

Signals that the Windows security audit log was cleared. It frequently accompanies anti-forensics activity and should be treated as a high-priority indicator.

Linux persistence locations

Common footholds include cron jobs, systemd unit files, ~/.ssh/authorized_keys, /etc/rc.local, LD_PRELOAD entries, and modified shell profile scripts executed at login.

Memory forensics value

RAM holds running processes, network connections, loaded modules, and injected code that vanish on shutdown, so volatile memory should be captured before powering a host off.

File hash comparison

MD5, SHA-1, or SHA-256 values identify file content; matching a known-bad hash confirms malware, while an unexpected hash change on a system file indicates tampering.

PowerShell script block logging

Event ID 4104 records PowerShell script block content as executed, exposing obfuscated or encoded commands that would otherwise be invisible in process creation logs.

TCP three-way handshake

Connection setup uses SYN, then SYN-ACK, then ACK. A SYN flood exhausts the connection table because the final ACK is never sent, leaving half-open sessions.

Port scan detection

Many destination ports contacted in a short interval from one source, answered by RST or SYN-ACK, indicates host discovery or service enumeration activity.

DNS tunneling indicators

Long, high-entropy subdomain labels, frequent TXT or NULL record queries, and uniform query sizes to one domain suggest data being encoded into DNS requests.

IDS versus IPS

An IDS passively inspects a copy of traffic and alerts; an IPS sits inline and can drop or reset malicious traffic. Both may use signature, anomaly, or policy detection.

Data exfiltration clues

Large outbound transfers to unusual destinations, upload volume exceeding download, off-hours activity, and non-standard ports or encrypted channels all suggest data theft.

PCAP analysis workflow

Review top talkers and conversations, filter by protocol, follow TCP streams, extract transferred objects, hash them, and pivot results to endpoint and log sources.

Policy versus procedure

A policy states mandatory management intent and high-level requirements; a procedure documents the specific step-by-step actions used to implement that policy in operations.

Incident response phases

NIST SP 800-61 defines preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity, where lessons learned feed back into preparation.

Chain of custody

A documented, unbroken record of who collected, accessed, transferred, and stored evidence and when, required for the evidence to remain admissible and credible.

RTO and RPO

Recovery time objective is the maximum acceptable downtime for a system; recovery point objective is the maximum acceptable data loss measured in time.