Google Cybersecurity flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

Confidentiality prevents unauthorized disclosure, integrity prevents unauthorized modification, and availability ensures authorized users can access systems and data when needed.

NIST Cybersecurity Framework

A voluntary framework organized around five core functions: Identify, Protect, Detect, Respond, and Recover, used to structure cybersecurity risk management.

Incident response lifecycle

A repeatable process: preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity to improve future response.

Security control categories

Controls are classified as technical, operational, or managerial and as preventive, detective, or corrective, depending on how and when they reduce risk.

Risk treatment options

Accept, avoid, transfer, or mitigate. Selection depends on risk appetite, cost, legal requirements, and the likelihood and impact of the risk.

NIST RMF

A seven-step risk management process: prepare, categorize, select, implement, assess, authorize, and monitor controls for systems and information.

SIEM

Security information and event management collects and correlates logs from multiple sources, generates alerts, and supports investigation of security events.

Business impact analysis

A process that identifies critical business functions and sets recovery time and recovery point objectives to guide continuity and disaster recovery planning.

OSI model layers

Seven layers from top to bottom: application, presentation, session, transport, network, data link, and physical, each handling a distinct part of network communication.

TCP three-way handshake

A connection setup using SYN, SYN-ACK, and ACK packets so both hosts agree on sequence numbers and establish a reliable session before data transfer.

Stateful firewall

A firewall that tracks active connections and allows return traffic for established sessions, unlike a stateless firewall that evaluates each packet independently.

Network segmentation

Dividing a network into zones with controlled traffic between them, which limits lateral movement and reduces the blast radius of a compromise.

chmod 755

Sets owner read-write-execute, group read-execute, and others read-execute; numerically rwx equals 7, r-x equals 5, and r-x equals 5.

SQL WHERE clause

Filters rows before grouping or aggregation, returning only records that satisfy a condition such as status = 'failed'.

SQL INNER JOIN

Returns only rows with matching keys in both tables; unmatched rows from either table are excluded from the result set.

Linux sudo command

Runs a command with elevated privileges after authorization, supporting least privilege by limiting administrative actions to approved users.

CVSS score ranges

CVSS base scores run from 0 to 10: none 0.0, low 0.1-3.9, medium 4.0-6.9, high 7.0-8.9, and critical 9.0-10.0.

Worm versus virus

A virus requires a host file or program to spread, while a worm self-replicates across networks without user action or a host file.

RBAC

Role-based access control grants permissions according to job roles rather than individual identities, simplifying administration and supporting least privilege.

Hashing versus encryption

Hashing is one-way and verifies integrity, while encryption is reversible with a key and protects confidentiality of data at rest or in transit.

SOC alert triage

Prioritizing alerts by severity, asset criticality, confidence, and business impact, then escalating true positives and documenting false positives for tuning.

MITRE ATT&CK

A knowledge base of adversary tactics and techniques observed in real incidents, used for detection engineering, threat hunting, and gap analysis.

Chain of custody

A documented record of who collected, handled, and stored evidence, when, and why, used to preserve admissibility and prove integrity.

Threat hunting

A proactive, hypothesis-driven search for threats that evade existing detections, using telemetry, threat intelligence, and analyst expertise.

Python list

An ordered, mutable collection written with square brackets that can hold mixed types and supports indexing, slicing, appending, and iteration.

try except finally

Python error handling: try runs risky code, except handles exceptions, and finally runs cleanup whether or not an exception occurred.

Python dictionary

A mutable mapping of unique keys to values, written with braces, optimized for fast lookup by key rather than positional index.

with open statement

A context manager that opens a file and automatically closes it when the block exits, even if an exception occurs.

STAR interview method

Structures behavioral answers as Situation, Task, Action, and Result, giving concrete evidence of skills and measurable outcomes.

Security resume keyword

A term matching the job description, such as SIEM, incident response, or Python, placed truthfully in skills or experience to pass screening.

Incident stakeholder update

A concise communication stating what is known, business impact, actions taken, next update time, and avoiding speculation or unverified attribution.

Home lab portfolio

A personal environment for practicing tools and documenting projects; it demonstrates hands-on skill without exposing employer or customer data.