CCSE (CrowdStrike Certifications) flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Residual risk

The risk that remains after controls are applied. It must be documented and formally accepted by an accountable business owner, not by the person who implemented the controls.

Risk treatment options

Mitigate (reduce likelihood or impact), transfer (insurance or contract), avoid (stop the activity), and accept (documented decision to tolerate). Every identified risk takes one of these paths.

Separation of duties

A control requiring that no single identity can both initiate and approve a sensitive action. It limits fraud and error by forcing collusion or a second actor.

Least privilege

Granting an identity only the access needed for its current task, for only as long as needed. Excess rights are removed when the task ends, reducing the blast radius of compromise.

Incident response phases

Preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Containment comes before eradication so the threat cannot spread during cleanup.

Chain of custody

Documented, unbroken record of evidence handling: collector, time, location, hash at collection, and every transfer. Any gap can make the evidence inadmissible or unusable.

RTO versus RPO

RTO is the maximum tolerable downtime before a service must be restored. RPO is the maximum tolerable data loss measured in time. A backup interval longer than the RPO fails the requirement.

Policy versus standard versus procedure

Policy states intent and is mandatory in spirit; standards are mandatory specific requirements; procedures are step-by-step instructions. Violating a standard is a breach; deviating from a guideline is not.

Default-deny rule base

A firewall posture that blocks all traffic and permits only explicit exceptions. A default-permit rule at the bottom of the policy silently defeats every deny above it.

First-match rule evaluation

Most firewalls evaluate rules top-down and act on the first match. A broad permit placed above a specific deny allows the traffic the deny was meant to stop.

Stateful inspection

The firewall records each session in a connection table and automatically permits return traffic for established flows. Stateless ACLs require explicit rules in both directions.

NAT is not security

Network address translation changes addresses and ports to hide internal topology. It does not authenticate or authorize, and NAT'd hosts remain reachable through any permitted path.

DMZ traffic direction

Internet-facing services sit in a DMZ reachable from the internet and from internal clients. The DMZ may not initiate connections into the internal trusted zone.

IPsec AH versus ESP

AH provides integrity and authentication but no encryption. ESP provides confidentiality plus integrity. IKE negotiates phase 1 (ISAKMP SA) and phase 2 (IPsec SA) using matching proposals.

Zone and segmentation design

Assets of equal trust and equal data classification share a segment. Segmentation limits lateral movement, so one compromised host cannot reach every other host on a flat network.

Firewall log fields

A firewall log entry records source, destination, port, protocol, action, and the matching rule ID. Rules with logging disabled produce no evidence, so critical denies and permits must log.

Shadowed firewall rule

A rule that never matches because an earlier broader rule already handles its traffic. Zero hit counters on a rule are a strong indicator it is shadowed or unused.

Cloud shared responsibility

The provider secures facilities, hypervisor, and managed-service infrastructure. The customer secures identity, data, configuration, and workloads. The boundary shifts with IaaS, PaaS, and SaaS.

Long-lived cloud access key

A static credential with broad permissions that does not expire. It is a highest-impact cloud finding because theft grants persistent access with no MFA challenge.

Public storage bucket exposure

A bucket or container configured for public read is reachable by anyone holding the URL. Account-level public-access blocks plus object audits are the standard mitigation.

Hypervisor escape

An attack that breaks guest-to-host isolation and lets a virtual machine affect the hypervisor or other guests. Patching hypervisor and guest tools is the primary defense.

Security group versus network ACL

Security groups are stateful and attach to instances. Network ACLs are stateless and attach to subnets. Security groups have an implicit deny, so explicit allow rules define reachability.

Customer-managed encryption keys

Keys the customer controls for rotation and revocation, unlike provider-managed keys. They give the customer the ability to disable access by revoking the key.

VM sprawl and snapshot drift

Unmanaged virtual machines and forgotten snapshots retain sensitive data and stay unpatched. Inventory, tagging, and snapshot expiration policies keep the estate controlled.

Control-plane versus data-plane logs

Control-plane logs record configuration and permission changes (who changed what). Data-plane logs record access to data (who read what). Enabling one does not enable the other.

Signature-based detection limits

Signature detection matches known patterns and therefore misses novel or heavily modified attacks. It is fast and low-noise but requires current signatures and cannot detect unknown behavior.

Anomaly-based detection

Detection that baselines normal activity and flags deviation from it. It can catch novel attacks but produces false positives when legitimate behavior changes.

IPS versus IDS

An IPS sits inline and can drop malicious traffic. An IDS receives a copy and can only alert. Tuning false positives first prevents operators from disabling the sensor.

Layered malware prevention

Reputation and hash lookup, static signatures, behavioral emulation, and sandbox detonation. A file that evades one layer may still be caught by the next.

Asymmetric routing failure

The return path differs from the forward path, so a stateful device sees the reply as unsolicited and drops it. Connections fail while one-way traffic may still work.

MTU mismatch symptom

Small packets such as pings succeed while large transfers stall, because oversized packets are dropped and fragmentation is blocked. Testing with large payloads confirms the fault.

Containment evidence order

Isolate the host at the network layer, then capture volatile evidence such as memory and active connections before rebooting. Block indicators at the perimeter only after confirming them.