Cisco 350-201 CBRCOR cheat sheet

CIA triad: confidentiality protects disclosure, integrity protects unauthorized modification, availability protects timely access; a control is classified by the property it primarily protects.

Risk = likelihood x impact; risk treatment options are mitigate, transfer, avoid, and accept, and residual risk is what remains after controls are applied.

Defense in depth layers preventive, detective, and corrective controls; no single layer is trusted alone, and compensating controls are used when a primary control cannot be implemented.

Threat actor tiers: script kiddie (low skill, existing tools), insider (authorized access, hardest to detect), organized crime (financial motive), nation-state (APT, long dwell time, custom tooling).

Cyber Kill Chain order: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives; breaking any link interrupts the chain.

MITRE ATT&CK organizes adversary behavior into tactics (the why, e.g. persistence) and techniques (the how, e.g. T1053 scheduled task); ATT&CK is behavior-based, not signature-based.

Diamond Model has four vertices: adversary, capability, infrastructure, victim; pivoting on any vertex expands the intelligence picture around an event.

Indicator types: atomic (IP, hash, domain) is easy to change, computed (regex, YARA rule) is more durable, behavioral (TTP) is hardest for an adversary to alter.

Vulnerability scoring: CVSS base score 0.0-10.0 with qualitative bands None 0.0, Low 0.1-3.9, Medium 4.0-6.9, High 7.0-8.9, Critical 9.0-10.0; base score excludes environmental and temporal factors.

Indicator matching is signature detection and catches known-bad artifacts; anomaly detection baselines normal behavior and flags deviations, producing more false positives but catching novel activity.

SIEM correlation combines normalized events across sources using rules and thresholds; log normalization maps vendor fields to a common schema before correlation can work.

Syslog severity 0 emerg, 1 alert, 2 crit, 3 err, 4 warning, 5 notice, 6 info, 7 debug; lower number is more severe.

Network detection: IDS is passive and alerts, IPS is inline and can block; a false positive blocks legitimate traffic, a false negative lets malicious traffic through.

NetFlow/IPFIX records are metadata only (5-tuple, bytes, timestamps) with no payload, so they reveal beaconing patterns and data-volume anomalies but not content.

Beaconing detection keys on regular intervals with low jitter to the same destination; jitter and randomized sleep timers are common evasions.

DNS tunneling signs: high volume of TXT/NULL queries, unusually long subdomain labels, high entropy in query names, and a single domain with many unique subdomains.

TLS inspection signals: self-signed or mismatched certificates, rare or newly registered certificate issuers, SNI mismatch with the HTTP Host header, and JA3 fingerprint mismatches.

Triage order: validate the alert, scope affected hosts and accounts, determine whether activity is ongoing, then escalate with evidence; closing without validation creates false negatives.

NIST SP 800-61 phases in order: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity.

Containment choices: isolation (host removed from network) preserves evidence but stops spread; segmentation limits blast radius; full shutdown destroys volatile memory and is a last resort.

Volatile evidence collection order (RFC 3227): registers and cache, routing table and ARP cache, memory, temporary files, then disk; collect most volatile first.

Chain of custody records who handled evidence, when, where, and why; a hash (SHA-256) taken at acquisition proves integrity, and any gap weakens admissibility.

Order of volatility and live response: capture memory and network connections before pulling power; pulling the plug loses running processes, encryption keys, and unflushed logs.

Eradication removes root cause (malware, persistence, vulnerable service); recovery restores from known-good state and verifies with monitoring before returning to production.

Credential compromise response: reset affected credentials, revoke sessions and tokens, rotate keys and secrets, then hunt for persistence such as new accounts or MFA changes.

Lessons learned is the post-incident phase: document timeline, root cause, detection gaps, and control improvements, and assign owners with due dates.

Notification obligations depend on data type and jurisdiction; regulatory and contractual deadlines can be shorter than internal investigation timelines, so legal is engaged early.

CIA triad: confidentiality protects disclosure, integrity protects unauthorized modification, availability protects timely access; a control is classified by the property it primarily protects.

Risk = likelihood x impact; risk treatment options are mitigate, transfer, avoid, and accept, and residual risk is what remains after controls are applied.

Defense in depth layers preventive, detective, and corrective controls; no single layer is trusted alone, and compensating controls are used when a primary control cannot be implemented.

Threat actor tiers: script kiddie (low skill, existing tools), insider (authorized access, hardest to detect), organized crime (financial motive), nation-state (APT, long dwell time, custom tooling).

Cyber Kill Chain order: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives; breaking any link interrupts the chain.

MITRE ATT&CK organizes adversary behavior into tactics (the why, e.g. persistence) and techniques (the how, e.g. T1053 scheduled task); ATT&CK is behavior-based, not signature-based.

Diamond Model has four vertices: adversary, capability, infrastructure, victim; pivoting on any vertex expands the intelligence picture around an event.

Indicator types: atomic (IP, hash, domain) is easy to change, computed (regex, YARA rule) is more durable, behavioral (TTP) is hardest for an adversary to alter.

Vulnerability scoring: CVSS base score 0.0-10.0 with qualitative bands None 0.0, Low 0.1-3.9, Medium 4.0-6.9, High 7.0-8.9, Critical 9.0-10.0; base score excludes environmental and temporal factors.

Indicator matching is signature detection and catches known-bad artifacts; anomaly detection baselines normal behavior and flags deviations, producing more false positives but catching novel activity.

SIEM correlation combines normalized events across sources using rules and thresholds; log normalization maps vendor fields to a common schema before correlation can work.

Syslog severity 0 emerg, 1 alert, 2 crit, 3 err, 4 warning, 5 notice, 6 info, 7 debug; lower number is more severe.

Network detection: IDS is passive and alerts, IPS is inline and can block; a false positive blocks legitimate traffic, a false negative lets malicious traffic through.

NetFlow/IPFIX records are metadata only (5-tuple, bytes, timestamps) with no payload, so they reveal beaconing patterns and data-volume anomalies but not content.

Beaconing detection keys on regular intervals with low jitter to the same destination; jitter and randomized sleep timers are common evasions.

DNS tunneling signs: high volume of TXT/NULL queries, unusually long subdomain labels, high entropy in query names, and a single domain with many unique subdomains.

TLS inspection signals: self-signed or mismatched certificates, rare or newly registered certificate issuers, SNI mismatch with the HTTP Host header, and JA3 fingerprint mismatches.

Triage order: validate the alert, scope affected hosts and accounts, determine whether activity is ongoing, then escalate with evidence; closing without validation creates false negatives.

NIST SP 800-61 phases in order: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity.

Containment choices: isolation (host removed from network) preserves evidence but stops spread; segmentation limits blast radius; full shutdown destroys volatile memory and is a last resort.

Volatile evidence collection order (RFC 3227): registers and cache, routing table and ARP cache, memory, temporary files, then disk; collect most volatile first.

Chain of custody records who handled evidence, when, where, and why; a hash (SHA-256) taken at acquisition proves integrity, and any gap weakens admissibility.

Order of volatility and live response: capture memory and network connections before pulling power; pulling the plug loses running processes, encryption keys, and unflushed logs.

Eradication removes root cause (malware, persistence, vulnerable service); recovery restores from known-good state and verifies with monitoring before returning to production.

Credential compromise response: reset affected credentials, revoke sessions and tokens, rotate keys and secrets, then hunt for persistence such as new accounts or MFA changes.

Lessons learned is the post-incident phase: document timeline, root cause, detection gaps, and control improvements, and assign owners with due dates.

Notification obligations depend on data type and jurisdiction; regulatory and contractual deadlines can be shorter than internal investigation timelines, so legal is engaged early.

CIA triad: confidentiality protects disclosure, integrity protects unauthorized modification, availability protects timely access; a control is classified by the property it primarily protects.

Risk = likelihood x impact; risk treatment options are mitigate, transfer, avoid, and accept, and residual risk is what remains after controls are applied.

Defense in depth layers preventive, detective, and corrective controls; no single layer is trusted alone, and compensating controls are used when a primary control cannot be implemented.

Threat actor tiers: script kiddie (low skill, existing tools), insider (authorized access, hardest to detect), organized crime (financial motive), nation-state (APT, long dwell time, custom tooling).

Cyber Kill Chain order: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives; breaking any link interrupts the chain.

MITRE ATT&CK organizes adversary behavior into tactics (the why, e.g. persistence) and techniques (the how, e.g. T1053 scheduled task); ATT&CK is behavior-based, not signature-based.

Diamond Model has four vertices: adversary, capability, infrastructure, victim; pivoting on any vertex expands the intelligence picture around an event.

Indicator types: atomic (IP, hash, domain) is easy to change, computed (regex, YARA rule) is more durable, behavioral (TTP) is hardest for an adversary to alter.

Vulnerability scoring: CVSS base score 0.0-10.0 with qualitative bands None 0.0, Low 0.1-3.9, Medium 4.0-6.9, High 7.0-8.9, Critical 9.0-10.0; base score excludes environmental and temporal factors.

Indicator matching is signature detection and catches known-bad artifacts; anomaly detection baselines normal behavior and flags deviations, producing more false positives but catching novel activity.

SIEM correlation combines normalized events across sources using rules and thresholds; log normalization maps vendor fields to a common schema before correlation can work.

Syslog severity 0 emerg, 1 alert, 2 crit, 3 err, 4 warning, 5 notice, 6 info, 7 debug; lower number is more severe.

Network detection: IDS is passive and alerts, IPS is inline and can block; a false positive blocks legitimate traffic, a false negative lets malicious traffic through.

NetFlow/IPFIX records are metadata only (5-tuple, bytes, timestamps) with no payload, so they reveal beaconing patterns and data-volume anomalies but not content.

Beaconing detection keys on regular intervals with low jitter to the same destination; jitter and randomized sleep timers are common evasions.

DNS tunneling signs: high volume of TXT/NULL queries, unusually long subdomain labels, high entropy in query names, and a single domain with many unique subdomains.

TLS inspection signals: self-signed or mismatched certificates, rare or newly registered certificate issuers, SNI mismatch with the HTTP Host header, and JA3 fingerprint mismatches.

Triage order: validate the alert, scope affected hosts and accounts, determine whether activity is ongoing, then escalate with evidence; closing without validation creates false negatives.

NIST SP 800-61 phases in order: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity.

Containment choices: isolation (host removed from network) preserves evidence but stops spread; segmentation limits blast radius; full shutdown destroys volatile memory and is a last resort.

Volatile evidence collection order (RFC 3227): registers and cache, routing table and ARP cache, memory, temporary files, then disk; collect most volatile first.

Chain of custody records who handled evidence, when, where, and why; a hash (SHA-256) taken at acquisition proves integrity, and any gap weakens admissibility.

Order of volatility and live response: capture memory and network connections before pulling power; pulling the plug loses running processes, encryption keys, and unflushed logs.

Eradication removes root cause (malware, persistence, vulnerable service); recovery restores from known-good state and verifies with monitoring before returning to production.

Credential compromise response: reset affected credentials, revoke sessions and tokens, rotate keys and secrets, then hunt for persistence such as new accounts or MFA changes.

Lessons learned is the post-incident phase: document timeline, root cause, detection gaps, and control improvements, and assign owners with due dates.

Notification obligations depend on data type and jurisdiction; regulatory and contractual deadlines can be shorter than internal investigation timelines, so legal is engaged early.