HCIE-Security flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Bell-LaPadula no write down

The *-property of the Bell-LaPadula model: a subject may not write to an object at a lower classification. It prevents secret data from leaking into public files.

Biba integrity model

Integrity model with two rules: no read down and no write up. A low-integrity subject cannot corrupt high-integrity data, the mirror image of Bell-LaPadula confidentiality.

Reference monitor properties

A reference monitor must be tamper-proof, always invoked (complete mediation), and small enough to be verified. It mediates every access between subjects and objects.

Annualized loss expectancy formula

ALE equals single loss expectancy multiplied by annualized rate of occurrence. SLE equals asset value multiplied by exposure factor, giving expected yearly loss for prioritising controls.

EAL4 assurance level

Common Criteria level 4: methodically designed, tested, and reviewed. It is the highest level normally practical for commercial products without formal verification.

Firewall HA session synchronization

In an active-standby pair, HRP replicates sessions and configuration over the heartbeat link, so failover keeps established flows alive without renegotiation.

IKE main versus aggressive mode

Main mode uses six messages and hides identities; aggressive mode uses three, is faster, but exposes identities in cleartext and is unsuitable for pre-shared-key deployments.

ESP versus AH

ESP encrypts payload and offers optional integrity; AH authenticates the whole packet including IP header but does not encrypt and fails across NAT devices.

NAT-Traversal UDP 4500

When NAT is detected, IPsec encapsulates ESP inside UDP port 4500 so NAT devices can translate addresses and ports. AH cannot be used in this mode.

DSVPN NHRP resolution

Dynamic Smart VPN uses NHRP so spokes register their public addresses with the hub; spokes then build direct mGRE tunnels for spoke-to-spoke traffic instead of tromboning.

SSL VPN virtual gateway

A virtual gateway binds a VPN instance, listening address and port, and certificate. Security policy and authentication are applied per virtual gateway, not per physical interface.

SYN flood source authentication

Defense that validates that a SYN sender is real before allocating state, using SYN cookies or a proxy handshake. It defeats spoofed-source SYN floods that exhaust the session table.

802.1X EAP-TLS

Mutual certificate-based authentication where both supplicant and server present certificates. It resists credential theft but requires a PKI issuing client certificates.

WAF semantic analysis

Inspection that parses requests according to protocol grammar rather than matching strings, so obfuscated SQL injection or cross-site scripting is detected without a known signature.

IOA versus IOC

An IOC is a static artifact such as a file hash or domain. An IOA is observed behaviour, like a document reader spawning a shell, and survives hash changes.

EDR network isolation

A response action that blocks a host's network traffic except the management channel to the console, stopping lateral movement while keeping the agent controllable.

Security group statefulness

Cloud security groups are allow-only and stateful: return traffic for permitted connections is automatically allowed. Network ACLs are stateless and need explicit rules both ways.

Cloud shared responsibility split

The provider secures facilities, hardware, and virtualization; the customer secures guest operating systems, identities, data, configurations, and network access rules.

Micro-segmentation east-west control

Policy applied per workload identity rather than per subnet, restricting server-to-server traffic. It limits lateral movement after an attacker compromises one internal host.

CSPM public bucket finding

Cloud security posture management flags storage buckets readable by anonymous users. Remediation is blocking public access and auditing bucket policies and access control lists.

Container image admission control

A cluster gate that permits only signed, scanned images from trusted registries to run. It blocks unpatched or tampered images before they are scheduled.

Zero trust policy decision point

The component that evaluates identity, device posture, and context on every request and grants least-privilege access, rather than trusting the network location.

Incident response containment phase

The stage after identification where spread is stopped by isolating hosts, blocking indicators, disabling accounts, or revoking sessions, while preserving evidence for investigation.

MTTD and MTTR

Mean time to detect measures average time from compromise to alert; mean time to respond measures from alert to resolution. Both drive SOC improvement priorities.

CVSS environmental score

A CVSS component that modifies the base score using the asset's real deployment context, such as network exposure and existing mitigations, to set remediation priority.

STIX and TAXII

STIX is a structured language for expressing threat indicators; TAXII is the transport protocol for exchanging them between intelligence producers and consumers.

Backup 3-2-1 rule

Keep three copies of data on two different media types with one copy offsite. Immutable or offline copies are needed against ransomware that encrypts connected backups.

Emergency change retro-approval

A change implemented before full approval to restore service; it requires a recorded risk acceptance and formal review within a defined window after implementation.

IKE SA up but no traffic

Phase 1 succeeded but phase 2 or forwarding failed. Check traffic selector symmetry, PFS and transform mismatch, NAT exemption, and the interzone security policy.

Policy shadowing diagnosis

A broad permit placed above a specific deny means the deny never matches. Policy hit counters reveal which rule actually handled the traffic.

Asymmetric routing session drop

When the return packet arrives at a different firewall that has no session, the firewall drops it. Fix by symmetric routing or session synchronization between peers.

Firewall HA split-brain

Both cluster members become active because the heartbeat link failed. Verify heartbeat interface status, HRP state, and that both run identical software and configuration.

On-device packet capture localization

Capturing at inbound and outbound interfaces shows whether the device forwarded or dropped a packet, separating a local policy drop from a downstream problem.