GCT-2A-324 flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Residual Risk

The risk remaining after existing controls are applied. It is compared against the organization's risk appetite; if it exceeds tolerance, additional treatment or formal acceptance by an accountable owner is required.

Annualized Loss Expectancy

ALE equals Single Loss Expectancy multiplied by Annualized Rate of Occurrence. SLE is asset value times exposure factor. ALE supports cost-benefit comparison of proposed safeguards against expected annual loss.

Policy Versus Standard

A policy states mandatory management intent and high-level requirements. A standard specifies the mandatory technical or procedural requirements that implement the policy. Procedures give step-by-step instructions; guidelines are recommended, not mandatory.

Separation of Duties

No single person should control all parts of a sensitive transaction, such as requesting, approving, and executing. It reduces fraud and error by requiring collusion across multiple people.

Risk Appetite

The amount and type of risk an organization is willing to accept in pursuit of its objectives. It is set by leadership and used to judge whether residual risk needs treatment or acceptance.

Bell-LaPadula Model

A confidentiality model with two rules: no read up (a subject cannot read data at a higher classification) and no write down (a subject cannot write to a lower classification). It prevents leakage of classified information.

Trust Boundary

A point where data or control passes between components with different trust levels, such as user to application or application to database. Each boundary requires authentication, authorization, input validation, and logging.

STRIDE Threat Categories

Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. Each category maps to a class of design weakness and a corresponding control such as authentication or integrity checking.

Zero Trust Architecture

A design principle that removes implicit trust based on network location. It verifies every request explicitly using identity and device context, grants least privilege, and assumes breach, segmenting access per application.

Defense in Depth

Layering independent controls across people, process, and technology so that failure of one control does not expose the asset. Layers typically include perimeter, network, host, application, and data controls.

Multi-Factor Authentication

Authentication using factors from at least two distinct categories: something you know, something you have, or something you are. Two passwords or two biometrics do not constitute MFA.

Role-Based Access Control

Permissions are assigned to roles rather than individuals, and users are assigned roles. Effective governance requires periodic role review to prevent role explosion and accumulated unnecessary entitlements.

Access Recertification

Periodic review in which resource or role owners confirm that each user's access remains necessary. Unconfirmed or excessive access is revoked. Privileged accounts are reviewed more frequently than standard ones.

Privileged Access Management

Controls for administrative accounts: credential vaulting, just-in-time elevation, session recording, and separation of admin accounts from daily-use accounts. It limits the blast radius of compromised privileged credentials.

SAML Versus OIDC

Both enable single sign-on via a trusted identity provider. SAML exchanges signed XML assertions and is common in enterprise web SSO; OIDC uses JSON Web Tokens on top of OAuth 2.0 and suits APIs and mobile apps.

Password Hashing

Passwords are stored as salted hashes using deliberately slow algorithms such as bcrypt, scrypt, Argon2, or PBKDF2. Fast hashes like MD5 and SHA-1 allow rapid offline cracking and are unsuitable.

Stateful Firewall Inspection

A stateful firewall tracks active connections and automatically permits return traffic for established sessions. Stateless ACLs require explicit rules for both directions and are easier to misconfigure.

IDS Versus IPS

An intrusion detection system passively monitors and alerts on suspicious traffic. An intrusion prevention system sits inline and can block traffic, but a false positive can disrupt legitimate business activity.

Network Segmentation

Dividing a network into zones with controlled traffic between them using VLANs, subnets, or security groups. Segmentation limits lateral movement after a compromise and isolates sensitive systems.

WPA3 SAE

WPA3 uses Simultaneous Authentication of Equals, a password-authenticated key exchange that resists offline dictionary attacks on captured handshakes. It replaces the WPA2 pre-shared key weakness.

IPsec ESP

Encapsulating Security Payload provides confidentiality through encryption and optional integrity for IP packets. AH provides integrity and authentication only, without encryption.

Authenticated Encryption

Modes such as AES-GCM provide confidentiality and integrity in one operation, detecting tampering with ciphertext. Unauthenticated modes like CBC require a separate message authentication code.

Digital Signature

A hash of the message encrypted with the sender's private key. Verification with the sender's public key proves integrity, origin authenticity, and non-repudiation.

Perfect Forward Secrecy

Using ephemeral key exchange such as ECDHE so that compromise of a long-term private key does not decrypt previously recorded sessions. Each session derives a unique key.

Certificate Revocation Checking

Validating that a certificate has not been revoked before its expiry, using CRL distribution points or OCSP. Revocation checking complements chain validation and hostname verification.

Order of Volatility

Evidence collection priority from most to least volatile: CPU registers and cache, memory, network connections, running processes, disk storage, then backups and archival media. Collect volatile data first.

Chain of Custody

A documented, unbroken record of who handled evidence, when, and why. Gaps or undocumented transfers can render evidence inadmissible or unreliable in legal or disciplinary proceedings.

Incident Response Phases

Preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned. Containment aims to stop spread while preserving evidence for analysis.

CVSS Base Score

A 0 to 10 score for intrinsic vulnerability severity derived from exploitability and impact metrics. Bands: low 0.1 to 3.9, medium 4.0 to 6.9, high 7.0 to 8.9, critical 9.0 to 10.0.

SAST Versus DAST

Static analysis examines source code without running it, finding issues early in development. Dynamic analysis tests a running application from outside, finding runtime and configuration issues but later in the cycle.

Software Bill of Materials

A machine-readable inventory of components and dependencies in a product, often in SPDX or CycloneDX format. It enables rapid identification of exposure when a dependency vulnerability is disclosed.

SOC 2 Type II

An independent attestation report covering the design and operating effectiveness of controls over an audit period, typically six to twelve months. Type I covers control design at a single point in time.