CP-C flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

The three core security objectives: confidentiality, meaning only authorized parties can read data; integrity, meaning data is accurate and unaltered; availability, meaning systems respond when needed.

Residual risk

The risk remaining after controls are applied. It equals inherent risk reduced by the effect of implemented controls, and it is the level an organization knowingly accepts.

Authentication versus authorization

Authentication confirms who a subject is, usually through credentials or tokens. Authorization then determines which resources and actions that identified subject is permitted to use.

Policy, standard, procedure

A policy states management intent and mandatory rules. A standard sets mandatory requirements such as approved algorithms. A procedure documents step-by-step actions and responsible roles.

OSI reference model

A seven-layer conceptual model numbered from physical at layer one to application at layer seven. It separates concerns so protocols can be designed and troubleshot layer by layer.

Bit and byte

A bit is one binary digit, either zero or one. A byte is eight bits. Binary prefixes scale by 1024, so one KiB equals 1024 bytes and one MiB equals 1024 KiB.

Likelihood times impact

A qualitative risk scoring formula in which the risk score equals the probability of an event multiplied by the severity of its consequence, used to rank risks for treatment.

Inherent risk

The level of risk that exists before any controls or mitigations are applied. Comparing it with residual risk shows how much protection existing controls genuinely provide.

IPv4 address size

An IPv4 address is 32 bits, written as four dotted-decimal octets. It provides roughly 4.3 billion unique addresses, which is why NAT and IPv6 are widely used.

Private IPv4 ranges

The RFC 1918 ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. They are not routable on the public internet and require NAT for external connectivity.

Subnet usable host count

Usable hosts equal two raised to the number of host bits, minus two, because the network and broadcast addresses cannot be assigned. A /24 subnet has 254 usable hosts.

TCP three-way handshake

Connection setup in three messages: the client sends SYN, the server replies SYN-ACK, and the client sends ACK. This synchronizes sequence numbers and confirms reachability both ways.

Well-known port numbers

Common default ports are 22 for SSH, 25 for SMTP, 53 for DNS, 80 for HTTP, 443 for HTTPS, and 3389 for RDP. Firewall rules commonly reference these defaults.

HTTP status code classes

The first digit signals outcome: 2xx success, 3xx redirection, 4xx client error such as 404 not found, and 5xx server error such as 500 internal server error.

Idempotent HTTP methods

Methods that leave the server in the same state when repeated: GET, PUT, DELETE, HEAD. POST is not idempotent, so retrying a failed POST may create duplicate records.

Third normal form

A relational table in second normal form with no transitive dependencies, meaning every non-key column depends on the key rather than on another non-key column.

Defense in depth

Layering independent controls across network, host, application, and data boundaries so that one failed, misconfigured, or bypassed control does not expose the protected asset.

Least privilege

Granting each user, service, or process only the access needed to perform its function, and only for as long as needed, limiting the impact of compromise or error.

Multi-factor authentication

Requiring two or more different factor types drawn from knowledge, possession, and inherence. Two passwords do not qualify because both are the same factor type.

Fail closed versus fail open

Fail closed denies access when a control fails; fail open permits it. Fail closed suits security-critical systems, fail open only where safety or availability dominates.

3-2-1 backup rule

Keep at least three copies of data, on two different media types, with one copy stored offsite or offline. The offline copy protects against ransomware encryption.

Patch management cycle

The ordered stages of identifying and classifying vulnerabilities, testing patches, deploying them, verifying installation, and reporting status to management.

Log clock synchronization

Hosts should synchronize time using NTP so events recorded on different systems can be correlated. Unsynchronized clocks make log analysis and forensic timelines unreliable.

Separation of duties

A control ensuring no single person controls all stages of a sensitive transaction, so that different people initiate, approve, and record, preventing fraud and undetected error.

Governance versus management

Governance sets direction through risk appetite, policies, roles, and oversight. Management executes that direction through day-to-day planning, operation, and monitoring of activities.

Plan-Do-Check-Act

A four-stage continuous improvement cycle: plan the change, do it on a small scale, check results against expectations, then act to standardize or correct the approach.

Service level agreement

A documented commitment between provider and customer defining measurable service targets such as availability and response time, along with remedies when targets are missed.

Change advisory board

A group that reviews proposed changes for risk, impact, and readiness before approval, and schedules them to minimize disruption to live services and customers.

Testable acceptance criteria

Conditions written so pass or fail can be judged objectively, for example a stated response time or error rate, rather than a vague statement of intent.

Data retention period

The defined length of time data is kept, driven by legal, regulatory, and business requirements. Data should be deleted or anonymized once that period ends.

Audit trail attributes

Logs should record who did what, when, and from where, and be protected from alteration. Tamper-evident storage and defined retention keep them usable as evidence.

Job rotation control

Periodically moving staff between roles so no person permanently and exclusively controls one function, which helps surface concealed fraud, error, or single points of failure.