CSAT (USAF Cyber Test) cheat sheet

OSI layers 1-7 in order: Physical, Data Link, Network, Transport, Session, Presentation, Application; TCP/IP collapses these into Link, Internet, Transport, and Application.

TCP opens a connection with a three-way handshake (SYN, SYN-ACK, ACK) and closes it with a four-step FIN/ACK exchange; UDP sends datagrams with no handshake, ordering, or delivery guarantee.

IPv4 addresses are 32 bits written in dotted decimal; IPv6 addresses are 128 bits written as colon-separated hexadecimal groups.

Non-routable private IPv4 ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16; 127.0.0.0/8 is loopback and 169.254.0.0/16 is link-local (APIPA).

A /24 mask (255.255.255.0) covers 256 addresses with 254 usable; each borrowed host bit halves the host count and doubles the subnet count.

Well-known ports: 20/21 FTP, 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 HTTP, 110 POP3, 143 IMAP, 443 HTTPS, 3389 RDP.

ARP resolves an IPv4 address to a MAC address inside a broadcast domain; DNS resolves names to IP addresses; DHCP assigns addresses using the DORA sequence (Discover, Offer, Request, Acknowledgment).

ICMP carries echo request/reply for ping and time-exceeded messages for traceroute; each router hop decrements the TTL field and drops the packet at zero.

Linux uses a single inverted tree rooted at /; /etc holds configuration, /var holds variable data such as logs, /bin holds core binaries, /home holds user directories, and /proc exposes kernel and process state.

Permission bits map read=4, write=2, execute=1 per owner/group/other; chmod 755 yields rwxr-xr-x, and chown changes file ownership.

Redirection: > writes stdout and truncates, >> appends, < feeds stdin, 2> redirects stderr; the pipe | connects one command's stdout to the next command's stdin.

Core Linux inspection commands include ls -l, ps aux, top, grep, find, kill (default SIGTERM; -9 sends SIGKILL), and df/du for disk usage.

Windows equivalents include dir, cd, ipconfig /all, netstat -ano, tasklist, taskkill /PID, and PowerShell cmdlets such as Get-Process and Get-Service.

An absolute path begins at the root or a drive letter; a relative path is resolved against the current working directory using . (current) and .. (parent).

Process states are typically running, sleeping/waiting, stopped, and zombie; each process is identified by a unique PID and a parent PID.

The PATH variable is an ordered list of directories the shell searches for an executable when a bare command name is entered.

AND is true only when both operands are true; OR is false only when both are false; NOT inverts a boolean value; XOR is true when exactly one operand is true.

Evaluation precedence: parentheses, then exponentiation, then multiplication/division, then addition/subtraction, then comparisons, then NOT, then AND, then OR.

Loop selection: for when the iteration count is known, while when the condition is tested before each pass, do-while when the body must run at least once.

Arrays are usually zero-indexed, so an array of length n has valid indices 0 through n-1; accessing index n is out of bounds.

A recursive function needs a base case that stops self-calls; each pending call consumes a stack frame, so deep recursion risks stack overflow.

Pass by value copies the argument so callee changes are invisible to the caller; pass by reference passes the address so mutations persist.

Growth classes: O(1) constant lookup, O(log n) binary search, O(n) single scan, O(n log n) efficient sorts such as merge sort, O(n^2) nested loops.

try/catch handles thrown exceptions; a finally block executes whether or not an exception occurred, making it suitable for cleanup.

One byte is 8 bits; 1 KiB = 1024 bytes, 1 MiB = 1024 KiB, 1 GiB = 1024 MiB.

Binary place values double leftward (128, 64, 32, 16, 8, 4, 2, 1), so 1101 in binary equals 13 in decimal.

One hexadecimal digit equals 4 bits, so two hex digits represent one byte with values 00 through FF.

Two's complement negation is invert-all-bits plus one; an n-bit signed field spans -2^(n-1) to 2^(n-1)-1, giving asymmetry around zero.

ASCII defines 128 seven-bit code points; UTF-8 is variable-length (1-4 bytes) and its first 128 code points are identical to ASCII.

The instruction cycle is fetch, decode, execute, (write back); memory hierarchy speed order is registers, cache, RAM, then disk.

Bitwise XOR yields 1 only when the two bits differ, which makes it useful for toggling and simple checksums; left shift by n multiplies by 2^n.

Signed overflow occurs when a result falls outside the representable range, causing wraparound rather than a mathematically correct value.

The CIA triad defines confidentiality (only authorized readers), integrity (data is unaltered and trustworthy), and availability (timely access to resources).

Authentication proves identity, authorization determines permitted actions, and auditing/accounting records what was done for later review.

Social engineering variants include phishing (email), spear phishing (targeted), whaling (executives), vishing (voice), and smishing (SMS).

Malware classes: virus (needs a host and user action), worm (self-propagating over networks), trojan (disguised as legitimate), ransomware, rootkit, spyware, logic bomb.

An IDS passively detects and alerts on suspicious activity, while an IPS is deployed inline and can actively block the matching traffic.

Common web attacks include SQL injection, cross-site scripting, CSRF, and directory traversal; network attacks include MITM, DDoS, and session hijacking.

Defense in depth layers preventive, detective, and corrective controls, supported by least privilege, separation of duties, and mandatory patching.

Risk equals likelihood times impact; treatment options are mitigation, transfer, acceptance, and avoidance.

Symmetric encryption uses one shared secret key for both directions (AES, ChaCha20) and is fast but requires secure key distribution or exchange.

Asymmetric encryption uses a public/private key pair (RSA, ECC); the public key encrypts or verifies, the private key decrypts or signs.

A cryptographic hash is one-way and fixed-length (SHA-256 outputs 256 bits); a small input change produces an unpredictable, large digest change (avalanche effect).

Hashes provide integrity and password storage, not confidentiality; a salt is random data added per password to defeat precomputed rainbow tables.

Base64 maps binary to 64 printable characters and inflates size about 33 percent; hex uses two characters per byte; both are encodings, not encryption.

A digital signature is a message hash signed with the sender's private key and verified with the sender's public key, giving origin authentication and integrity.

TLS uses asymmetric methods for authentication and key agreement, then switches to symmetric session keys for bulk encryption.

Diffie-Hellman lets two parties derive a shared secret over an insecure channel without transmitting the secret itself; classical Caesar/ROT13 shifts are trivially broken.

Offensive phases commonly run: reconnaissance, initial access, exploitation, privilege escalation, persistence, lateral movement, command and control, and exfiltration.

Defensive phases follow prevention, detection, response, and recovery; blue teams defend, red teams emulate adversaries, and purple teams integrate both.

The cyber kill chain stages are reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objective; breaking any stage disrupts the intrusion.

MITRE ATT&CK catalogs real-world adversary tactics and techniques and is used to map detections and gaps.

A SOC triages alerts in tiers, while a SIEM aggregates and correlates logs from endpoints, network devices, and applications to generate those alerts.

Incident response phases are preparation, identification, containment, eradication, recovery, and lessons learned; containment limits spread before cleanup.

Indicators of compromise include anomalous logins, unusual outbound traffic, unexpected scheduled tasks, and known-bad file hashes.

Operations are constrained by rules of engagement, legal authority, and deconfliction; honeypots and deception platforms collect adversary tradecraft.

SQL logical evaluation order is FROM, WHERE, GROUP BY, HAVING, SELECT, ORDER BY; WHERE filters rows before aggregation and HAVING filters after.

A primary key uniquely identifies each row and cannot be null; a foreign key references another table's primary key to enforce referential integrity.

INNER JOIN returns only matched rows; LEFT JOIN keeps every left-side row and fills unmatched right columns with NULL.

Normalization: 1NF requires atomic values, 2NF removes partial dependencies on part of a composite key, 3NF removes transitive dependencies between non-key columns.

Aggregates are COUNT, SUM, AVG, MIN, and MAX; they collapse many rows into one value per group and ignore NULLs except in COUNT(*).

The mean is pulled by outliers, the median is resistant to them, and the mode is the most frequent value; standard deviation is the square root of variance.

Correlation r ranges from -1 to +1 and measures linear association only; correlation does not establish causation.

Indexes accelerate reads but add write and storage overhead; full table scans occur when no usable index exists.

Modus ponens: given P implies Q and P is true, Q follows. Modus tollens: given P implies Q and Q is false, P is false.

Affirming the consequent (P implies Q, Q, therefore P) and denying the antecedent (P implies Q, not P, therefore not Q) are invalid forms.

The contrapositive of P implies Q is not-Q implies not-P and is logically equivalent; the converse (Q implies P) and inverse are not equivalent.

Deductive reasoning moves from general premises to a certain conclusion; inductive reasoning moves from specific observations to a probable generalization.

A necessary condition must hold for the outcome; a sufficient condition guarantees the outcome; one can be necessary without being sufficient.

In categorical logic, 'all A are B' is contradicted by a single A that is not B; 'some A are B' is contradicted by 'no A are B'.

Numeric sequence patterns to test first: constant difference, constant ratio, alternating operations, squares/cubes, and sums of prior terms.

Percent change equals (new minus old) divided by old, times 100; percentage points differ from percent change when comparing two rates.