C|CT flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Defense in depth

Layering independent controls so no single failure or bypass exposes the asset. Perimeter filtering, internal segmentation, host hardening, and monitoring each fail separately, so an attacker must defeat multiple barriers.

Stateful vs stateless firewall

A stateful firewall tracks connection state across the 5-tuple and permits return traffic automatically. A stateless ACL evaluates each packet in isolation and cannot distinguish a solicited reply from an unsolicited probe.

DMZ

A screened subnet holding internet-facing services between two filtering points. The internal LAN is not directly reachable from the DMZ, so a compromised public server does not grant immediate internal access.

IDS versus IPS

An IDS is passive and out-of-band, alerting on suspicious traffic without blocking it. An IPS sits inline and can drop or reset malicious traffic, but adds latency and becomes a failure point.

NAT and PAT

NAT rewrites IP addresses; PAT also rewrites ports so many internal hosts share one public address. It conserves IPv4 space and hides topology but is not a security control.

802.1X

Port-based network access control using a supplicant, an authenticator such as a switch, and a RADIUS authentication server. The device is authenticated before being placed on an authorized VLAN.

Network segmentation

Dividing a network into zones separated by policy enforcement points. It limits lateral movement because a compromised host can reach only peers its zone policy permits, not the entire flat network.

NTP in security operations

Synchronizing clocks across hosts, firewalls, and log sources. Consistent timestamps are required to correlate events and build accurate timelines during incident investigation.

Rules of engagement

The signed document defining authorized targets, excluded systems, testing windows, allowed techniques, and escalation contacts. It converts penetration testing from unauthorized access into a lawful engagement.

Passive reconnaissance

Collecting target information without sending traffic to the target, using OSINT, WHOIS, DNS records, certificate transparency logs, and search engines. It leaves no trace in target logs.

SYN scan

A half-open TCP scan that sends SYN and never completes the handshake. Many hosts do not log half-open connections, making it stealthier than a full connect scan.

Nmap port states

Open means a service is listening. Closed means reachable with no listener and a reset returned. Filtered means no reply or an ICMP unreachable, indicating a firewall dropping probes.

CVSS base metrics

Attack vector, attack complexity, privileges required, user interaction, and impact on confidentiality, integrity, and availability. The resulting score indicates severity but not business context.

Online versus offline cracking

Online guessing targets a live authentication service and is limited by rate limiting and lockout. Offline cracking attacks captured hashes and is limited only by algorithm strength, password entropy, and hardware.

Broken access control

An OWASP Top 10 category where users act outside intended permissions, such as reaching another user's records by changing an identifier. It is among the most frequently exploited web weaknesses.

Penetration test report

Deliverable listing each finding with reproduction steps, affected asset, business impact, severity rating, and remediation recommendation. Findings that cannot be verified are excluded from the report.

Order of volatility

Acquisition priority from most to least perishable: registers and cache, RAM, swap and temp files, disk, remote logs and backups, archival media. Capture the fastest-changing evidence first.

Chain of custody

A documented record of who handled evidence, when, where, and why. Gaps or unexplained transfers weaken admissibility even when the technical analysis is sound.

Forensic imaging

Creating a bit-for-bit copy of storage with a write blocker, then hashing the source and image with SHA-256 to prove they match. All analysis is performed on the verified copy.

MACE timestamps

NTFS timestamps for Modified, Accessed, Changed (metadata), and Entry-created. The $STANDARD_INFORMATION and $FILE_NAME attributes can disagree, which is itself evidence of manipulation.

Slack space

The unused remainder of the last allocated cluster in a file. It can retain fragments of previously written content and is a source of deleted or hidden data.

Windows Security event 4624

Records a successful logon and includes logon type, account, and source. Event 4625 records a failed logon; repeated 4625 entries suggest password guessing or a misconfigured service.

Prefetch and Amcache

Windows artifacts that record program execution. Prefetch stores launch counts and referenced files; Amcache holds metadata on executed binaries, useful for proving a program ran on the host.

Memory forensics

Analyzing a RAM capture to recover running processes, network connections, loaded modules, injected code, and encryption keys. These artifacts disappear when the system is powered off.

Timeline normalization

Converting timestamps from all evidence sources to one time zone, preferably UTC, before correlation. Unsynchronized clocks otherwise produce a false ordering of events.

SOC tier structure

Tier 1 triages alerts and closes or escalates them. Tier 2 investigates and contains incidents. Tier 3 performs threat hunting and advanced response. Playbooks define escalation criteria.

SIEM correlation

A platform that centralizes logs, normalizes fields, and applies rules to join events across sources. Detection quality depends on log coverage and tuning; poor tuning causes alert fatigue.

Incident response phases

Preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Containment strategy balances stopping spread against preserving evidence for later analysis.

MTTD and MTTR

Mean time to detect and mean time to respond. Both are measured from when the event occurred, not when the alert fired, so they expose gaps in monitoring coverage.

MITRE ATT&CK

A knowledge base of adversary tactics and techniques observed in real intrusions, used to map detections and threat intelligence indicators to attacker behavior rather than to individual tools.

3-2-1 backup rule

Keep three copies of data on two different media types with one copy offsite. Restore testing proves recoverability, and immutable or offline copies resist ransomware encryption.

Vulnerability management cycle

Inventory assets, scan for weaknesses, prioritize by exploitability and asset criticality, remediate or mitigate, then rescan to verify closure. Prioritization matters more than raw finding counts.