CND flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

SYN flood

A denial-of-service attack that sends many TCP SYN packets without completing the handshake, exhausting the server's connection table. SYN cookies and rate limiting mitigate it.

ARP spoofing

An attacker sends forged ARP replies binding their MAC address to a victim's IP, enabling an on-path attack. Dynamic ARP inspection and static ARP entries mitigate it.

DNS amplification attack

A reflection attack that spoofs the victim's IP as the query source and sends small requests to open resolvers, whose large responses flood the victim. Response rate limiting defends.

TACACS+ versus RADIUS

TACACS+ is a Cisco TCP 49 protocol that encrypts the entire payload and separates AAA functions; RADIUS uses UDP 1812 and 1813 and encrypts only the password field.

802.1X roles

Port-based access control with three roles: the supplicant on the client, the authenticator on the switch or access point, and the authentication server, typically RADIUS, exchanging EAP.

Separation of duties

A control requiring that no single person can complete a critical transaction alone, which prevents fraud and error. Job rotation and mandatory vacations complement it.

Stateful firewall

A firewall that tracks connection state in a session table and automatically permits return traffic for established flows, unlike stateless filters that judge each packet independently.

IPsec ESP versus AH

ESP provides confidentiality plus integrity and authentication through encryption; AH provides integrity and authentication only with no encryption, so ESP is normally preferred.

Web application firewall

A layer-7 device that inspects HTTP and HTTPS traffic, blocking injection, cross-site scripting, and malicious bots using signature or allow-list models.

BitLocker

Windows full-disk encryption that uses AES and seals keys with a TPM, protecting data at rest against offline attacks when the device is powered off.

SELinux

A Linux mandatory access control system that labels processes and files with security contexts and enforces policy beyond standard Unix discretionary permissions.

MDM versus MAM

Mobile device management controls the whole device including enrollment and remote wipe; mobile application management controls only application data, which suits BYOD programs.

SQL injection defense

Use parameterized queries or prepared statements so user input never becomes executable SQL; add input validation and least-privilege database accounts as supporting controls.

SAST versus DAST

Static application security testing analyzes source code without running it in a white-box, early-phase approach; dynamic testing attacks a running application from outside later in the cycle.

Password salting

Adding unique random data to each password before hashing so identical passwords produce different hashes, defeating precomputed rainbow tables and forcing per-user cracking effort.

Type 1 hypervisor

A hypervisor that runs directly on hardware as a bare-metal layer, such as ESXi; it offers better performance and a smaller attack surface than hosted type 2 products.

Cloud shared responsibility

The provider secures facilities, hardware, and the hypervisor while the customer secures identity, data, and configuration; the split shifts between IaaS, PaaS, and SaaS.

WPA3 SAE

Simultaneous Authentication of Equals replaces the WPA2 pre-shared key handshake with a password-authenticated exchange that resists offline dictionary attacks and adds forward secrecy.

NetFlow

A flow-export standard recording conversation metadata such as source, destination, ports, byte counts, and timestamps without payload, enabling traffic baselining at scale.

SIEM correlation

Aggregating and normalizing logs from many sources, then applying rules that link individual events into alerts no single system would have raised alone.

Syslog ports

Traditional syslog uses UDP 514 in cleartext and is unreliable; TCP 514 provides reliable plaintext delivery, and TCP 6514 carries TLS-protected syslog.

Incident response phases

NIST SP 800-61 defines preparation; detection and analysis; containment, eradication and recovery; and post-incident activity, with lessons learned closing the cycle.

Order of volatility

Collect the most perishable evidence first: CPU registers and cache, then RAM and swap, then network state, then disk, then remote logs and backups.

Containment strategy

Short-term action such as isolating a host, blocking ports, or disabling an account to stop spread, chosen by balancing business impact against evidence preservation.

Chain of custody

Chronological documentation of who handled evidence, when, where, and why, showing unbroken control from seizure to courtroom and supporting admissibility.

Write blocker

A hardware or software device that prevents write operations to a suspect drive during imaging, preserving integrity so pre- and post-image hashes match.

Windows event 4625

Records a failed logon attempt including account name, source workstation, and failure reason; repeated occurrences indicate password guessing or credential attacks.

RTO versus RPO

Recovery time objective is the maximum acceptable downtime after an outage; recovery point objective is the maximum acceptable data loss measured backward in time.

Differential backup

Copies all data changed since the last full backup; restoration requires the last full plus the latest differential, and each differential grows larger over time.

Hot site

A fully equipped alternate facility with hardware, data, and connectivity already in place, giving recovery time near zero at the highest cost of the site types.

Single loss expectancy

SLE equals asset value multiplied by exposure factor, expressing the monetary loss from one risk occurrence; multiplying SLE by annualized rate of occurrence gives ALE.

Quantitative risk analysis

Assigns monetary values to assets, threats, and losses using formulas such as SLE and ALE, producing defensible cost figures that justify security control spending.