CSAT (USAF Cyber Test) key terms

A four-layer framework describing how data moves across networks: link, internet, transport, and application. Each layer adds or strips headers and hands data to the next layer.

A 32-bit value that splits an IP address into network and host portions, letting a device decide whether a destination is local or must be reached through a router.

A hierarchical, distributed service that translates human-readable hostnames into IP addresses, using resolver queries and cached records with time-to-live values that limit staleness.

A link-layer protocol that maps a known IPv4 address to a hardware MAC address by broadcasting a request and caching the reply for later reuse.

The TCP connection setup exchange of SYN, SYN-ACK, and ACK segments that synchronizes sequence numbers and confirms both hosts are reachable and willing to communicate.

The privileged core of an operating system that manages memory, schedules processes, and mediates access to hardware on behalf of user programs.

Flags attached to a file that specify read, write, and execute rights for its owner, group, and other users, enforced by the operating system.

A shell operator that connects the standard output of one command to the standard input of the next, chaining small tools into a single processing pipeline.

A named value held by a shell and inherited by the child processes it launches, commonly used to pass configuration such as file paths and credentials.

The region of a program where a declared name is visible and usable, determined by where the declaration sits and by the language's block rules.

A technique in which a function calls itself on a smaller version of the same problem, requiring a base case that stops the chain.

A language mechanism that transfers control to a handler when an error occurs, separating recovery code from the normal path of execution.

A compact pattern language for matching text that uses character classes, anchors, and quantifiers to search, validate, or extract substrings.

A signed integer encoding in which the highest bit carries negative weight, so negation is done by inverting every bit and adding one.

A base-16 numbering system using digits 0-9 and letters A-F, widely used to write memory addresses and byte values compactly.

The convention that decides byte order in memory: big-endian stores the most significant byte first, while little-endian stores the least significant byte first.

Character encoding standards that assign numeric code points to symbols; ASCII defines 128 English characters, while Unicode covers most of the world's writing systems.

A social-engineering attack that impersonates a trusted party through email, messages, or fake sites to trick a user into revealing credentials or running malware.

A design principle granting each user or process only the access needed to do its job, limiting the damage caused by mistakes or a compromised account.

Layering multiple independent controls across network, host, application, and human factors so that one failure does not expose the entire system.

A software flaw unknown to the vendor, so no patch exists and defenders must rely on behavior-based detection and temporary mitigations until a fix ships.

Malware that encrypts victim data or locks systems and demands payment for restoration, often combined with stolen data and threats to publish it.

A cipher that uses one shared secret key for both encryption and decryption; it is fast enough for bulk data but requires secure key distribution.

An asymmetric scheme with a public key for encryption or verification and a private key for decryption or signing, removing the need for a pre-shared secret.

A one-way algorithm that maps any input to a fixed-length digest; a good one is fast, collision-resistant, and reveals nothing useful about the input.

A value made by hashing a message and encrypting that hash with a private key, letting anyone verify origin and integrity using the matching public key.

An encoding that represents binary data with 64 printable ASCII characters, expanding size by about one third; it hides nothing and is not encryption.

A phase model of an intrusion-reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions-used to plan defenses that break the attack early.

A curated knowledge base of real-world adversary tactics and techniques, used to map detections, prioritize coverage gaps, and describe threat behavior in a consistent vocabulary.

A group authorized to emulate realistic adversaries against an organization's people and systems, testing detection and response rather than only cataloging vulnerabilities.

A device or program that permits or blocks network traffic by inspecting addresses, ports, and connection state against an ordered rule set.

A decoy system or service with no legitimate business purpose, deployed to attract attackers, record their methods, and raise an alert on any interaction.

A column or set of columns whose values uniquely identify each row in a table and which can never be null.

An operation that combines rows from two tables on a matching condition, usually a foreign-key column, with inner, left, right, and full variants.

An auxiliary structure, typically a B-tree, that lets a database locate rows without scanning an entire table, paid for with extra work on writes.

A data point far from the rest of the distribution, which may signal measurement error, fraud, or a genuinely rare event worth investigating.

Drawing a conclusion that must follow from the stated premises; when the premises are true and the form valid, the conclusion cannot be false.

Generalizing from specific observations to a probable rule; the conclusion is likely rather than guaranteed and can be overturned by new evidence.

A common error in reasoning, such as a false dilemma or an appeal to authority, that makes an argument unreliable even when its conclusion happens to be true.