CSA (EC-Council Certifications) flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Mean time to detect

Average elapsed time between an incident occurring and its detection. Calculated as total detection time divided by the number of incidents detected.

Recovery point objective

The maximum tolerable amount of data loss, expressed as time. It determines backup frequency requirements for a system.

Separation of duties

A control ensuring no single individual can both authorize and execute a sensitive action, reducing fraud and insider misuse risk.

SOC tier structure

Tier 1 performs alert triage and escalation, Tier 2 investigates and contains, Tier 3 hunts threats and handles advanced response.

Cyber Kill Chain

Seven-phase model: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives. Used to map adversary progress.

MITRE ATT&CK tactic

The adversary's tactical goal, such as persistence or credential access. Techniques describe how each tactic is technically accomplished.

Indicator of compromise

Observable evidence of intrusion such as malicious IP, hash, domain, or behavior. Atomic indicators expire faster than behavioral TTPs.

Living off the land

Attack technique abusing legitimate built-in tools like PowerShell, WMI, or certutil to evade signature-based detection.

Spear phishing

A targeted phishing message crafted for a specific individual or group using researched details to increase credibility and success rate.

SIEM correlation rule

Logic that matches events across multiple log sources within a time window to generate a single meaningful alert.

Alert tuning

Iterative adjustment of detection thresholds, exclusions, and logic to reduce false positives while preserving true positive coverage.

Log source health monitoring

Tracking whether log feeds are active and timely. A silent feed causes undetected incidents, not merely missing records.

Baseline deviation detection

Alerting when current activity diverges significantly from a learned normal profile for a user, host, or network segment.

Threat intelligence enrichment

Adding reputation and context from external feeds to alerts so priority reflects known-bad indicators and actor activity.

Centralized log collection

Shipping logs from many sources to a protected central store, preserving integrity and enabling cross-source correlation.

NTP log synchronization

Synchronizing clocks across log sources so events share a consistent timeline, which is required for reliable correlation.

Log retention period

The defined duration logs are kept, set by legal, regulatory, and investigative requirements before scheduled deletion.

Log integrity protection

Controls such as hashing, append-only storage, and restricted access that prevent tampering with retained log evidence.

Log rotation

Archiving or deleting old log files at defined size or time thresholds to prevent disk exhaustion while preserving retention.

Endpoint detection and response

Agent-based tooling that records process, file, network, and registry telemetry on hosts to support hunting, detection, and containment.

Network segmentation

Dividing a network into zones with controlled inter-zone traffic, limiting an attacker's ability to move laterally after compromise.

Application allowlisting

A control permitting execution only of explicitly approved binaries, blocking many droppers and unauthorized tools.

Egress filtering

Restricting outbound traffic to approved destinations, which blocks command-and-control callbacks and data exfiltration channels.

Order of volatility

Evidence collection priority from most to least transient: cache and memory, network state, processes, disk, backups, archival media.

Chain of custody

Documentation tracking who handled evidence, when, and where, from seizure through analysis to presentation, proving integrity.

Forensic image verification

Hashing source media and the acquired image with the same algorithm to prove the copy is bit-for-bit identical.

NIST incident response lifecycle

Four phases: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity and lessons learned.

SYN scan

A port scan sending SYN packets and never completing the handshake; open ports reply SYN-ACK, making it quieter than a full connect scan.

DNS tunneling indicator

Unusually long, high-entropy subdomains and elevated query volume to a single domain, indicating data smuggled through DNS.

Beaconing detection

Identifying periodic, regular-interval connections from a host to the same external destination, a common command-and-control pattern.

Incident severity tiers

Predefined levels that determine notification scope, escalation path, and reporting deadlines for an incident.

Out-of-band communication

Using a channel independent of the compromised network or email system so incident coordination continues during an outage or breach.