CSAT (USAF Cyber Test) flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

TCP three-way handshake

A connection is established when the client sends SYN, the server replies SYN-ACK, and the client returns ACK, synchronizing sequence numbers before data transfer begins.

Private IPv4 ranges

10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 are not routable on the public internet and are used inside local networks, typically behind NAT.

DNS resolution

The Domain Name System maps human-readable hostnames to IP addresses by querying a hierarchy of name servers, usually over UDP port 53.

UDP versus TCP

UDP is connectionless with no delivery or ordering guarantee, whereas TCP is connection-oriented, reliable, ordered, and uses acknowledgments and flow control.

Pipe operator

The | symbol sends the standard output of the command on its left into the standard input of the command on its right, chaining tools together.

chmod 755 meaning

Grants the owner read, write, and execute, and grants group and others read and execute only, a common setting for directories and executables.

PATH variable

An ordered list of directories the shell searches to locate an executable when a bare command name is typed without a full path.

While loop behavior

A control structure that tests its condition before each iteration and repeats the body while it remains true, so the body may run zero times.

Recursion base case

The terminating condition inside a recursive function that stops further self-calls, preventing infinite recursion and eventual stack overflow.

Big-O notation

Describes an upper bound on how an algorithm's time or space grows with input size, ignoring constants, such as O(n) linear or O(n^2) quadratic.

Pass by value

The called function receives a copy of the argument, so any modification made inside the function leaves the caller's original variable unchanged.

Two's complement negation

To negate an integer, invert all bits and add one; the top bit carries the sign, giving an n-bit range of -2^(n-1) to 2^(n-1)-1.

Hexadecimal bit width

One hexadecimal digit represents exactly four bits, so two hex digits encode a single byte, which ranges from 00 to FF.

UTF-8 encoding

A variable-length Unicode encoding that uses one to four bytes per character, where the first 128 code points match ASCII exactly.

Fetch-decode-execute cycle

The processor repeatedly fetches an instruction from memory, decodes its opcode, executes it using the ALU or registers, and writes back the result.

CIA triad

Confidentiality, integrity, and availability: the three core security objectives covering secrecy of data, its accuracy and trustworthiness, and timely access.

Worm versus virus

A worm self-propagates across networks without needing a host file, while a virus requires a host program and usually user action to spread.

IDS versus IPS

An intrusion detection system passively monitors traffic and raises alerts, while an intrusion prevention system sits inline and can actively block malicious traffic.

Least privilege

Users, services, and processes receive only the minimum permissions needed for their tasks, limiting damage if an account or process is compromised.

Symmetric encryption

A single shared secret key both encrypts and decrypts data, as with AES; it is fast but requires a secure method to distribute the key.

Cryptographic hash function

A one-way function producing a fixed-length digest where any input change alters the output, used for integrity checks and password storage rather than secrecy.

Base64 encoding

Represents binary data using 64 printable ASCII characters, expanding size by roughly one third; it is encoding, not encryption, and provides no confidentiality.

Digital signature

A hash of a message encrypted with the sender's private key and verified with the matching public key, proving origin authenticity and message integrity.

Cyber kill chain

A seven-stage intrusion model: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objective.

SIEM function

A security information and event management system aggregates logs from many sources, correlates events across them, and raises alerts for analyst triage.

Incident response containment

The phase following identification in which affected systems are isolated or segmented to halt further spread before eradication and recovery begin.

SQL INNER JOIN

Returns only the rows where the join condition matches in both tables; rows lacking a counterpart on either side are excluded from the result.

Primary key

A column or combination of columns that uniquely identifies every row in a table and, by definition, cannot contain null values.

Mean versus median

The mean is the arithmetic average and is distorted by extreme values, while the median is the middle value and resists outliers.

Modus tollens

A valid deductive form: if P implies Q, and Q is observed to be false, then P must also be false.

Contrapositive equivalence

The contrapositive of 'if P then Q' is 'if not Q then not P'; the two are logically equivalent, unlike the converse 'if Q then P'.

Correlation versus causation

Two variables moving together does not prove that one causes the other, since a confounding or lurking variable may explain the relationship.