CNCDP flashcards

36 cards. Read the term and the definition here. The deck at the top of this page is optional.

Defense in Depth

Layering independent preventive and detective controls across network, endpoint, identity, and data so that failure of one layer does not expose the whole environment.

DMZ

A screened subnet between the internet and internal networks that hosts externally reachable services while limiting inbound paths into the trusted internal network.

Microsegmentation

Enforcing granular allow-list policy between individual workloads or hosts, independent of subnet boundaries, to limit lateral movement after compromise.

Zero Trust

An architecture model that grants access based on explicit verification of identity and device posture rather than implicit trust from network location.

Fail-Closed vs Fail-Open

Fail-closed denies traffic when a control fails, protecting confidentiality; fail-open permits traffic to preserve availability where safety requires it.

Pyramid of Pain

A model ranking indicators by how much difficulty changing them causes an adversary, with hashes and IPs easy and tactics and techniques hard.

Diamond Model

An intrusion analysis framework linking adversary, capability, infrastructure, and victim, allowing pivoting from any node to reveal related activity.

MITRE ATT&CK

A knowledge base of adversary tactics and techniques based on observed behavior, used to map detection coverage and prioritize hunting hypotheses.

Cyber Kill Chain

A seven-phase model from reconnaissance through actions on objectives that identifies where an intrusion can be detected or disrupted.

STIX and TAXII

STIX is a structured language for expressing indicators, actors, and relationships; TAXII is the transport protocol used to exchange those collections.

CVSS Base Score

A 0.0 to 10.0 rating of intrinsic vulnerability severity derived from exploitability and impact metrics, independent of local environment or threat activity.

CISA KEV

A catalog of vulnerabilities with confirmed in-the-wild exploitation, used to justify accelerated remediation timelines beyond severity scores alone.

EPSS

A probability estimate, from 0 to 1, that a vulnerability will be exploited in the next 30 days, used alongside severity to prioritize patching.

Authenticated Scan

A vulnerability scan using valid credentials to inspect installed software and configuration locally, producing far fewer false positives than unauthenticated scanning.

Risk-Based Prioritization

Ranking remediation by combining severity, exploitation likelihood, asset criticality, and compensating controls rather than relying on CVSS alone.

Sigma Rules

A vendor-neutral detection rule format describing log-based logic that can be converted into queries for multiple SIEM platforms.

False Positive

An alert generated by a detection rule for activity that is actually benign, consuming analyst time and reducing trust in the detection pipeline.

MTTD

Mean time to detect, the average elapsed time between occurrence of malicious activity and its identification, a core monitoring effectiveness metric.

Log Time Synchronization

Aligning all log sources to a common time reference via NTP so that correlation across systems and forensic timelines remain accurate.

NIST Incident Response Lifecycle

Four phases: preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity including lessons learned.

Order of Volatility

Collecting the most perishable evidence first: memory and network state, then disk, then remote logs and archival media.

Chain of Custody

A documented record of who handled evidence, when, where, and for what purpose, required to demonstrate integrity and support admissibility.

Containment Decision

Choosing isolation, account disablement, or indicator blocking based on spread risk versus business impact and available evidence.

Incident Commander

The single accountable role coordinating response activities, communications, and escalation decisions during an incident.

Write Blocker

A hardware or software device that prevents any write operation to source media during forensic acquisition, preserving evidentiary integrity.

Forensic Image Hash

A cryptographic digest computed on source and acquired copy; matching values demonstrate the copy is a faithful, unaltered reproduction.

Windows Forensic Artifacts

Evidence sources including event logs, registry hives, MFT, USN journal, prefetch, shimcache, AmCache, and LNK files used to reconstruct activity.

Memory Forensics

Analysis of a captured RAM image to recover running processes, network connections, injected code, and credentials absent from disk.

Threat Hunting

Proactive, hypothesis-driven search through telemetry for undetected adversary activity, independent of existing alerting rules.

Living off the Land

Adversary use of legitimate built-in tools such as PowerShell or certutil to perform malicious actions while blending with normal administration.

Beaconing Analysis

Detecting command-and-control by identifying regular connection intervals, consistent payload sizes, and rare destination reputation in network telemetry.

Purple Teaming

Coordinated execution of adversary techniques against defenses to measure whether detections fire and to improve rule coverage.

Risk Treatment Options

The four responses to identified risk: mitigate with controls, transfer via insurance or contract, avoid the activity, or formally accept with documented ownership.

NIST Cybersecurity Framework

A voluntary framework organizing outcomes into identify, protect, detect, respond, recover, and govern functions for managing cyber risk.

Policy Hierarchy

Documents ordered by authority: policy states intent, standards set mandatory requirements, procedures give steps, and guidelines offer recommendations.

Residual Risk

The risk remaining after controls are applied, which must be assessed and formally accepted by an accountable owner.