Cisco SCAZT 300-740 cheat sheet

Zero trust is a resource-access design approach, not a blanket trust label.

Authentication, provisioning, posture and authorization are distinct.

DNS, web, data and private-access controls require the actual traffic path.

Validate workload dependencies and correlate identity/policy telemetry before changing enforcement.

Identification, authentication, authorisation and accounting are four distinct steps.

MFA needs two different factor categories, not two instances of one.

RBAC suits stable job roles; ABAC suits context-dependent, fine-grained rules.

Kerberos uses a KDC with TGT and service tickets for SSO.

Symmetric ciphers handle bulk data; asymmetric ciphers solve key distribution and signatures.

Signing uses a specified signature scheme with the signer’s private key; verification and custody are essential to origin evidence.

ECB leaks patterns; use authenticated modes such as GCM or encrypt-then-MAC.

Internet-facing services belong in a DMZ; data stores sit in a filtered internal zone.

VLANs alone are not a trust boundary - add DAI, private VLANs and 802.1 X.

IPsec AH gives integrity only; ESP adds confidentiality.

IDS is passive and alerts; IPS is inline and blocks.

NAT is not a security control and temporary rules must be removed.

OWASP Top 10 is the standard vocabulary for application weaknesses.

Parameterised queries prevent SQL injection; output encoding prevents XSS.

Authorisation must be checked server-side on every request.

XSS executes script in the victim's browser; CSRF abuses the victim's session.

Classify data first, then apply encryption, masking, DLP and disposal rules by class.

Asset inventory and configuration baselines underpin every operational control.

Changes need an appropriate authorization path, recovery planning and relevant evidence.

Emergency changes still require retrospective documentation within a defined window.

Monitor log sources for silence, not just for events.

Distinguish historical Revision 2 phases from current NIST incident-response guidance integrated with broader risk management.

Containment precedes eradication in almost every scenario.

Capture volatile evidence (memory, connections) before disk and before power-off.

Risk assessment cycles through identification, analysis, and evaluation, producing a maintained risk register

Single loss expectancy = asset value x exposure factor; annualized loss expectancy = SLE x annualized rate of occurrence

Risk requires a threat, a vulnerability, and an impact; none alone is sufficient

Inherent risk is before controls, residual risk after them - always state which is being scored

Control effectiveness and uncertainty affect any expected-loss comparison.

Use the actual cloud responsibility boundary and verified data flows.

Treat AI input and output as untrusted evidence rather than authority.

Assess permissions, data exposure, provenance and evaluation separately.

OT security changes require actual safety, operating and recovery constraints.