HTB CJCA flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA Triad

Core security model of Confidentiality, Integrity, and Availability. Controls are classified by which property they protect, and trade-offs between the three are explicit design decisions.

Defense in Depth

Layering independent preventive, detective, and corrective controls so that failure of any single control does not expose the asset. Assumes every layer can eventually fail.

Least Privilege

Principle that each identity receives only the permissions required for its task, for the shortest practical time, reducing the impact of credential compromise or insider misuse.

Non-repudiation

Assurance that an action cannot later be credibly denied, achieved through digital signatures, trusted timestamps, and tamper-evident audit records bound to a specific key holder.

TCP Three-Way Handshake

Connection setup using SYN, SYN-ACK, and ACK. Confirms bidirectional reachability before data transfer; a half-open SYN flood exhausts server connection state.

RFC 1918 Private Ranges

Non-routable address space 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Internal use only; internet reachability requires NAT or a proxy.

Usable Hosts Formula

Usable hosts in a subnet equal 2 to the power of host bits, minus two for the network and broadcast addresses. A /26 provides 62 usable addresses.

DNS Record Types

A maps names to IPv4, AAAA to IPv6, CNAME aliases another name, MX routes mail, TXT carries SPF and verification data, NS delegates zones, PTR supports reverse lookups.

Stateful Firewall

Filters packets while tracking connection state, so return traffic for an allowed outbound session is permitted automatically without a separate inbound rule.

Windows Access Token

Object created at logon containing the user SID, group SIDs, privileges, and integrity level. Every process runs with a token that access checks evaluate.

Setuid Binary Risk

Linux executables with the setuid bit run as the file owner, often root. A vulnerable or writable setuid binary is a common local privilege escalation path.

Sysmon Event ID 1

Process creation record including image path, command line, parent process, user, and hashes. Primary telemetry for detecting script interpreters and unusual parent-child chains.

BitLocker and LUKS

Full-disk encryption for Windows and Linux respectively. Protects data at rest against offline disk access; ineffective while the volume is unlocked and running.

Kerberoasting

Attack requesting Kerberos service tickets for accounts with service principal names, then cracking them offline. Defeated by long random service-account passwords and managed accounts.

MFA Factor Categories

Multi-factor authentication requires factors from distinct categories: knowledge, possession, and inherence. Two passwords or two hardware tokens are not multi-factor.

SAML Assertion Validation

Verify the XML signature, audience, recipient, and validity window before trusting an assertion. Skipping these checks enables assertion injection and replay attacks.

RBAC vs ABAC

RBAC grants permissions through assigned roles, simple to audit. ABAC evaluates user, resource, and environmental attributes in policy, offering finer granularity at higher complexity.

Password Spraying

Trying a small set of common passwords across many accounts to stay under lockout thresholds. Detectable through distributed failed logons from few source addresses.

Pass-the-Hash

Reusing a captured NTLM hash to authenticate without knowing the plaintext password. Mitigated by credential protection, tiered administration, and disabling NTLM where feasible.

SQL Injection

Untrusted input interpreted as SQL syntax, altering query logic. Parameterized queries and least-privilege database accounts are structural fixes; input filtering alone is insufficient.

CVSS Base Score

Numeric 0.0 to 10.0 severity from exploitability and impact metrics. Reflects intrinsic severity, not whether the vulnerability is actively exploited in a given environment.

Business Email Compromise

Fraud impersonating an executive or vendor to redirect payments or obtain data. Defenses include out-of-band verification, DMARC enforcement, and payment-change callbacks.

Order of Volatility

Evidence collection priority from most to least fragile: CPU and memory, network state, running processes, disk, backups, and archived media. Collect volatile data first.

Containment Before Eradication

Incident response step that limits spread, such as host isolation or account disable, before removing malware. Prevents re-infection while scope is still being determined.

Chain of Custody

Chronological record of who handled evidence, when, and how. Gaps or unhashed copies undermine admissibility and forensic credibility.

MTTD and MTTR

Mean time to detect and mean time to respond or resolve. Paired metrics that show whether detection or response capability limits overall incident handling performance.

Windows Logon Type 10

Event 4624 logon type indicating Remote Desktop access. Repeated type 10 logons from unusual sources often indicate lateral movement with stolen credentials.

Windows Event 4688

Security log record of process creation when audit policy enables it. Command-line inclusion makes it valuable for spotting script interpreters and living-off-the-land binaries.

Sigma Rules

Vendor-neutral YAML format describing detection logic. Converted into queries for different SIEM platforms, enabling portable, reviewable detection content.

DNS Beaconing Detection

Identifying command-and-control by periodic, low-volume DNS queries to a consistent domain with regular intervals and unusual subdomain entropy.

Annualized Loss Expectancy

ALE equals single loss expectancy multiplied by annualized rate of occurrence. Used to compare control cost against expected yearly loss from a given risk.

RTO and RPO

Recovery Time Objective is maximum tolerable downtime; Recovery Point Objective is maximum tolerable data loss measured in time. Both derive from business impact analysis.