Core Technical Skills
This domain tests foundational knowledge that underpins every later topic: TCP/IP, ports and protocols, the OSI model, encoding, and basic command-line fluency on Windows and Unix. You should be comfortable mapping common services to ports (e.g., 22 SSH, 25 SMTP, 53 DNS, 80/443 HTTP/S, 139/445 SMB, 1433 MSSQL, 3306 MySQL, 3389 RDP), and knowing whether a protocol is TCP, UDP, or both (DNS uses both; NTP is UDP/123).
Understand the TCP three-way handshake (SYN, SYN-ACK, ACK) and how a half-open SYN scan differs from a full connect scan. Know ICMP types (echo request/reply, destination unreachable, time exceeded) and how they appear in traceroute. Encoding traps are common: distinguish Base64 (reversible encoding, not encryption), URL/percent encoding, hex, and HTML entities. Be able to read a packet capture at a high level and identify source/destination, flags, and payload.
Trap: questions often conflate encoding with hashing or encryption. Base64 is not security; hashing is one-way; encryption requires a key.
Rule of thumb: when asked "which port/protocol", recall the service and default transport first, then confirm whether the question implies TCP or UDP. When asked to decode, identify the alphabet (A–Z a–z 0–9 + / =) before assuming Base64.