CySA+ flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

SIEM

A centralized platform that ingests logs from many sources, normalizes and correlates events, and alerts when activity matches detection rules.

MITRE ATT&CK

A knowledge base of adversary tactics (goals) and techniques (methods) built from real-world observations, used to map detections and prioritize threat hunting.

Cyber Kill Chain

A seven-phase intrusion model: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives.

Windows Event ID 4625

Records a failed logon attempt on Windows; repeated 4625 events from one source can indicate brute-force or password-spray activity.

SPF

Sender Policy Framework: a DNS TXT record listing IP addresses authorized to send mail for a domain, checked by receivers against the envelope sender.

DMARC

A policy built on SPF and DKIM that tells receivers how to handle failing mail (none, quarantine, or reject) and where to send aggregate reports.

EDR

Endpoint detection and response: an agent that records host telemetry, detects malicious behavior, and supports response actions such as host isolation and process termination.

Threat hunting

A proactive, hypothesis-driven search through telemetry for threats that existing detections missed; it is analyst-initiated rather than alert-driven.

CVSS

An open framework that scores vulnerability severity from 0 to 10 using base, temporal, and environmental metrics; the base score combines exploitability and impact.

CVSS severity ranges

0.0 none; 0.1–3.9 low; 4.0–6.9 medium; 7.0–8.9 high; 9.0–10.0 critical. These bands are used to set remediation SLAs.

EPSS

Exploit Prediction Scoring System: a 0–1 score estimating the probability that a vulnerability will be exploited in the wild within the next 30 days.

CISA KEV

Known Exploited Vulnerabilities catalog: a list of CVEs with confirmed in-the-wild exploitation; US federal agencies must remediate listed items by the due date.

CVE

A unique public identifier for a specific vulnerability, formatted CVE-YYYY-NNNN and assigned by a CVE Numbering Authority.

CWE

A taxonomy of software weakness types, such as CWE-79 for cross-site scripting, describing root-cause classes rather than individual vulnerabilities.

Credentialed scan

An authenticated vulnerability scan that logs into hosts, enabling deeper configuration and patch inventory with fewer false positives than an unauthenticated scan.

Compensating control

An alternative safeguard that reduces risk when a vulnerability cannot be patched, such as a WAF, network segmentation, virtual patching, or disabling the vulnerable service.

NIST IR phases

Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity - the four phases in NIST SP 800-61.

Order of volatility

Evidence collection priority from most to least volatile: CPU registers and cache, RAM and swap, network state, disk, logs, and backups.

Chain of custody

A documented record of who collected, handled, and transferred evidence, when and why, including cryptographic hashes that prove the evidence was not altered.

Containment

Limiting incident spread through actions such as isolating hosts, disabling accounts, blocking IPs, segmenting networks, or revoking tokens, while balancing business impact.

Eradication

Removing the root cause of an incident: deleting malware, eliminating persistence, patching the exploited vulnerability, and resetting compromised credentials before recovery.

Tabletop exercise

A discussion-based rehearsal of a simulated incident with stakeholders, used to test roles, decision-making, communication, and plan gaps without production impact.

GDPR breach notification

Requires notifying the supervisory authority within 72 hours of becoming aware of a personal data breach, unless it is unlikely to risk individuals' rights.

Lessons learned

A post-incident review that identifies what worked and what failed, producing corrective actions and updates to the incident response plan.

MTTD

Mean Time to Detect: the average time from an incident's occurrence to its detection, calculated as total detection time divided by the number of incidents.

MTTR

Mean Time to Respond or Recover: the average time to contain and remediate incidents, calculated as total response time divided by incident count.

Executive summary

A non-technical report section covering business impact, risk, and decisions required, written for leadership without raw logs or deep technical jargon.

Risk register

A living record of identified risks with likelihood, impact, score, owner, treatment option, and current status, reviewed on a defined cadence.

PCI DSS

A payment card industry standard that requires controls for cardholder data, including quarterly external vulnerability scans by an approved scanning vendor and annual penetration testing.

Data classification

Labeling data by sensitivity, commonly public, internal, confidential, and restricted, to determine handling, encryption, retention, and reporting requirements.

Communication plan

Defines stakeholders, message owners, approved channels, update cadence, and escalation thresholds for incident and vulnerability reporting.

Post-incident report

Documents the incident timeline, root cause, impact, evidence, containment actions, and corrective actions, tailored in detail to each audience.