CySA+ key terms

A platform that collects and correlates log and event data from many sources so analysts can detect suspicious patterns, investigate alerts, and keep searchable records for compliance.

Software that automates routine security tasks and coordinates separate tools through playbooks, letting analysts respond to alerts faster and more consistently than manual handling alone.

Endpoint detection and response software on hosts that records process and file activity, flags malicious behavior, and can isolate or investigate a compromised machine remotely.

Analytics that model normal behavior for users and devices, then surface deviations such as unusual logon times or data access that may indicate a compromised account or insider misuse.

Summarized metadata about network conversations, including source, destination, ports, and byte counts, used to spot unusual traffic patterns without capturing full packet contents.

A decoy system or service placed on the network to attract attackers, alert defenders to unauthorized activity, and reveal tactics without exposing real production assets.

A control that redirects queries for known malicious domains to a harmless internal address, blocking command-and-control traffic and revealing infected hosts that keep trying to resolve them.

A proactive, hypothesis-driven search through telemetry for attacker activity that existing alerts missed, rather than waiting for a detection to fire.

A public knowledge base of adversary tactics and techniques organized by attacker goal, used to map detections, find coverage gaps, and describe intrusions in shared language.

STIX is a structured format for describing threat indicators, and TAXII is the transport protocol used to exchange those descriptions automatically between security platforms and intelligence providers.

Dividing a network into smaller zones with controlled traffic between them, which limits how far an intruder can move and reduces the impact of a compromise.

An automated assessment that compares systems against known weakness signatures and configuration checks, producing findings that still need validation and prioritization before remediation.

A scan that logs into each host with read-only credentials, giving deeper visibility into installed software and missing patches than an external, unauthenticated view can provide.

A standardized scoring system that rates vulnerability severity using metrics such as attack vector, complexity, and impact, producing a base score from zero to ten.

A unique public identifier assigned to a specific disclosed vulnerability, allowing vendors, scanners, and analysts to refer to the same flaw consistently.

A data-driven estimate of the probability that a given vulnerability will be exploited in the wild within the next 30 days, used to help rank remediation work.

A finding that reports a weakness which does not actually exist on the system, often caused by version mismatches or incomplete detection logic, and which should be verified first.

An authoritative record of hardware, software, and data assets with owners and criticality, forming the scope that scanning and vulnerability management depend on.

The total set of entry points and exposed services an adversary could use to reach a system, including internet-facing hosts, APIs, remote access, and user endpoints.

An alternative safeguard that reduces risk when a vulnerability cannot be patched directly, such as isolating a legacy host behind a firewall or adding extra monitoring.

The process of testing, approving, deploying, and verifying software updates across assets on a schedule, closing known vulnerabilities before attackers can use them.

An authorized, goal-oriented attack simulation that chains weaknesses together to show real business impact, differing from a scan because humans validate and exploit findings.

A documented set of roles, procedures, and communication paths that guides an organization through detecting, containing, eradicating, and recovering from a security incident.

The response phase where the spread of an incident is limited by isolating hosts, blocking traffic, or disabling accounts while evidence and business needs are considered.

Removing the root cause of an incident, such as deleting malware, closing the exploited vulnerability, and resetting compromised credentials, before recovery begins.

A structured post-incident review that examines what happened, how well response worked, and which detection, process, or control changes should follow.

A documented, unbroken record of who collected, handled, and stored evidence and when, supporting its integrity if findings are used in legal or disciplinary proceedings.

A guideline for collecting the most perishable evidence first, such as memory and active network connections, before slower-changing data like disks and backups.

A bit-for-bit copy of a storage device or memory space, verified by hash, that preserves evidence while allowing analysis without altering the original.

A predefined, step-by-step procedure for handling a specific type of incident or alert, giving responders consistent actions and decision points under pressure.

A discussion-based rehearsal in which stakeholders walk through a simulated incident to test plans, roles, and communications without touching production systems.

A short, nontechnical opening section of a report that states what happened, the business impact, and the recommended actions for senior decision makers.

The average time between an incident actually occurring and being detected, a key metric that shows how well monitoring and alerting perform.

The average time taken to fix a vulnerability or restore normal service after an incident, used to gauge response efficiency and set service targets.

A formal agreement defining expected service levels, such as response times or remediation deadlines, against which security and IT performance is measured and reported.

A living log of identified risks with owners, likelihood, impact, and treatment status, used to track and communicate decisions consistently across the organization.

The legal or contractual duty to inform regulators, customers, or partners within set timeframes when personal or sensitive data is confirmed exposed.

Labeling information by sensitivity and handling requirements so controls, access, and reporting are applied consistently to protect the most valuable data.