CCSE (CrowdStrike Certifications) cheat sheet

Security policy hierarchy: policy statement sets intent, standards define mandatory requirements, procedures give step-by-step execution, guidelines are recommended practice; a violation of a standard is a policy breach, deviation from a guideline is not.

Risk = likelihood × impact. Risk treatment options are mitigate, transfer, avoid, and accept; residual risk is what remains after controls and must be formally accepted by an accountable owner, not by the implementer.

Defense in depth layers people, process, and technology so no single control failure exposes the asset; a control that only works when another control works is compensating, not redundant.

Separation of duties prevents one identity from initiating and approving the same transaction; least privilege grants the minimum rights needed for the task and rotates them when the task ends.

Incident response phases in order: preparation, detection and analysis, containment, eradication, recovery, lessons learned. Containment precedes eradication because it stops spread before cleanup.

Chain of custody requires documented, unbroken handling of evidence: who collected it, when, where, hash value at collection, and every transfer; a gap can render evidence inadmissible.

Business impact analysis defines RTO (maximum tolerable downtime) and RPO (maximum tolerable data loss); a recovery strategy whose RPO exceeds the backup interval fails the requirement.

Audit findings are rated by risk, and remediation is tracked to closure with an owner and due date; an accepted finding without documented risk acceptance remains open.

Firewall rule order matters: most firewalls evaluate top-down and stop at the first match, so a broad permit above a specific deny silently allows the denied traffic; place specific denies above broad permits.

Stateful inspection tracks the connection table; return traffic for an established session is permitted without an explicit inbound rule, while stateless ACLs require rules in both directions.

A default-deny posture (deny all, then permit by exception) is the baseline; a default-permit rule at the bottom of the policy defeats the model and is a common audit finding.

NAT hides internal addressing but is not a security control; it changes addresses and ports, not trust. Treat NAT'd hosts as still reachable through permitted paths.

Zone design places assets of equal trust and equal data classification in the same segment; a flat network lets one compromised host reach everything, so segmentation limits lateral movement.

DMZ placement: internet-facing services sit in a segment reachable from the internet and from internal clients, but the DMZ cannot initiate connections into the internal trusted zone.

VPN tunnels use IPsec (AH for integrity, ESP for encryption plus integrity) or TLS; IKE negotiates phase 1 (ISAKMP SA) and phase 2 (IPsec SA) with matching proposals on both peers.

Logging and monitoring: firewall logs record source, destination, port, action, and rule ID; a rule with logging disabled produces no evidence, so deny rules and critical permits must log.

Shared responsibility: the provider secures the physical facility, hypervisor, and managed-service infrastructure; the customer secures identity, data, configuration, and workloads. The boundary moves with the service model (IaaS, PaaS, SaaS).

Identity is the primary cloud perimeter: enforce MFA, least-privilege roles, and short-lived credentials; a long-lived access key with broad permissions is the highest-impact cloud finding.

Storage exposure: a bucket or blob container set to public read is reachable by anyone with the URL; block public access at the account level and audit for public objects.

Hypervisor escape breaks the isolation boundary between guests; keep hypervisor and guest tools patched, and do not place workloads of different trust levels on the same host without justification.

VM sprawl and snapshot drift: unmanaged images and forgotten snapshots retain data and stay unpatched; inventory, tag, and expire snapshots by policy.

Cloud network controls: security groups are stateful and instance-level; network ACLs are stateless and subnet-level; a deny in a security group is implicit, so explicit allow rules define reachability.

Encryption: data at rest uses provider-managed or customer-managed keys; customer-managed keys give control over rotation and revocation, provider-managed keys do not. Data in transit requires TLS on every hop.

Logging in cloud: control-plane audit logs (who changed what) and data-plane logs (who accessed what) are separate; enabling one does not enable the other.

Signature detection matches known patterns and misses novel attacks; anomaly and behavioral detection baselines normal activity and flags deviation but produces false positives. Neither alone is sufficient.

IPS versus IDS: an IPS sits inline and can drop traffic; an IDS receives a copy and can only alert. Tuning order is reduce false positives first, then add coverage, or operators disable the sensor.

Malware prevention layers: reputation and hash lookup, static signature, behavioral/emulator analysis, and sandbox detonation. A file that evades one layer may be caught by the next.

URL and DNS filtering block access at resolution or request time; encrypted traffic inspection requires a trusted certificate chain on endpoints, otherwise users see certificate errors.

Troubleshooting method: define the symptom, establish what changed, test the most likely layer first (physical, network, transport, application), and change one variable at a time.

Common connectivity faults: asymmetric routing (return path differs from forward path, so stateful devices drop the reply), MTU mismatch (large packets drop while pings succeed), and duplicate IP addresses.

When a policy change is suspected, compare the effective rule set, hit counters, and logs for the affected flows before altering rules; a zero hit count on a rule suggests it is shadowed.

Containment during an active threat: isolate the host at the network layer, preserve volatile evidence (memory, connections) before rebooting, and block indicators at the perimeter only after confirming them.