Cisco 350-201 CBRCOR flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

Model of three security objectives: confidentiality prevents unauthorized disclosure, integrity prevents unauthorized modification, and availability ensures timely and reliable access to data and systems.

Risk treatment options

Four responses to identified risk: mitigate by applying controls, transfer by insurance or contract, avoid by removing the activity, or accept and monitor the residual risk.

Cyber Kill Chain

Seven-stage model of an intrusion: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. Defenders aim to interrupt at any stage.

MITRE ATT&CK

Knowledge base of adversary tactics and techniques observed in real intrusions. Tactics describe the goal, techniques describe the method, and each maps to detection opportunities.

Diamond Model

Intrusion analysis framework with four connected vertices: adversary, capability, infrastructure, and victim. Pivoting across vertices links related events into one campaign.

Atomic indicator

Observable artifact such as an IP address, domain name, or file hash. Easy to detect by matching but easy for an adversary to change between operations.

Behavioral indicator

Detection logic based on adversary tactics and techniques rather than fixed artifacts, such as unusual scheduled task creation. Harder for an adversary to alter without changing tradecraft.

CVSS base score

Numeric severity 0.0 to 10.0 derived from exploitability and impact metrics. Bands are None 0.0, Low 0.1-3.9, Medium 4.0-6.9, High 7.0-8.9, Critical 9.0-10.0.

Insider threat

Threat from a person with legitimate authorized access who misuses it. Detection relies on behavioral baselines and access anomaly monitoring rather than perimeter controls.

Defense in depth

Layering independent preventive, detective, and corrective controls so that failure or bypass of one layer does not expose the asset completely.

SIEM correlation

Matching and linking normalized events from multiple sources using rules, thresholds, and time windows to produce a higher-confidence alert than any single event.

Log normalization

Parsing vendor-specific log formats and mapping fields to a common schema so events from different products can be compared, searched, and correlated consistently.

Syslog severity levels

Numeric priorities 0 to 7: emerg, alert, crit, err, warning, notice, info, debug. A lower number indicates higher severity and greater urgency.

IDS versus IPS

An IDS monitors passively and raises alerts without blocking traffic. An IPS sits inline and can drop or reset malicious traffic, risking outage if it blocks legitimate activity.

False positive

An alert raised for activity that is actually benign. High false positive rates cause alert fatigue and can lead analysts to dismiss genuine detections.

False negative

Malicious activity that occurs but generates no alert. The most dangerous detection failure because the intrusion proceeds without any analyst visibility.

NetFlow records

Metadata about network conversations: source and destination addresses and ports, protocol, byte and packet counts, and timestamps. Contains no payload content.

Beaconing detection

Identifying command-and-control by regular connection intervals to the same destination. Low jitter and consistent packet sizes raise confidence; adversaries add jitter to evade.

DNS tunneling indicators

High volumes of TXT or NULL queries, unusually long or high-entropy subdomain labels, and many unique subdomains under one parent domain, indicating data encoded in queries.

JA3 fingerprint

Hash of TLS client hello parameters such as version, cipher suites, and extensions. Matching the fingerprint against known malware clients reveals nonstandard TLS stacks.

Anomaly detection

Detection based on deviations from a learned baseline of normal behavior. Catches novel activity that signatures miss but produces more false positives requiring tuning.

Alert triage order

Validate the alert is real, scope affected hosts and accounts, determine whether activity is ongoing, then escalate with collected evidence or close with documented justification.

NIST SP 800-61 phases

Incident response lifecycle: preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity. Phases overlap in practice rather than running strictly sequentially.

Containment strategy

Short-term action to stop spread, such as network isolation, account disablement, or segmentation. Chosen to preserve evidence while limiting business impact.

Order of volatility

Evidence collection priority from most to least perishable: CPU registers and cache, routing and ARP tables, memory, temporary files, then disk storage and archives.

Chain of custody

Documented record of who collected, handled, and transferred evidence, with times and purposes. Gaps or undocumented handling can render evidence inadmissible or unreliable.

Evidence integrity hashing

Computing a cryptographic hash such as SHA-256 at acquisition and again before analysis. Matching values demonstrate the evidence was not altered in storage or transit.

Eradication versus recovery

Eradication removes the root cause: malware, persistence mechanisms, and exploited vulnerabilities. Recovery restores systems to known-good operation and verifies with heightened monitoring.

Lessons learned

Post-incident review documenting timeline, root cause, detection gaps, and control improvements, with assigned owners and due dates so recommendations are actually implemented.

Credential compromise response

Reset affected passwords, revoke active sessions and tokens, rotate exposed keys and secrets, then hunt for persistence such as newly created accounts or altered MFA settings.

Live response

Collecting volatile data from a running system, including memory, network connections, and processes, before shutdown destroys it. Requires documented tooling to preserve integrity.

Breach notification

Obligation to inform regulators, customers, or partners after a confirmed incident involving protected data. Deadlines vary by jurisdiction and contract, so legal is engaged early.