HCIE-Security key terms

A logical grouping of interfaces and networks that share the same trust level and security policy, so traffic between zones is controlled by inter-zone rules rather than per-interface rules.

An ordered set of rules that matches traffic by source, destination, service, user, and application, then permits, denies, or inspects it according to the organization's intent.

A baseline posture in which any traffic not explicitly permitted by a policy is dropped, ensuring unknown or misconfigured flows never traverse the device unchecked.

The principle of granting users, services, and devices only the minimum access needed to perform their function, reducing the blast radius of compromise or misuse.

Layering independent controls such as perimeter filtering, segmentation, endpoint protection, and monitoring so that failure of one control does not expose the whole environment.

An architecture that removes implicit trust from network location and instead verifies identity and device posture for every request before granting access to a resource.

Dividing a data center or campus into fine-grained segments with per-workload policies, so lateral movement between compromised hosts is blocked even inside one VLAN.

An access model where permissions are assigned to roles rather than individuals, and administrators grant users roles, simplifying auditing and consistent enforcement.

Authentication, authorization, and accounting: the framework that verifies who a user is, what they may do, and records what they did for audit and billing.

A UDP-based protocol that centralizes authentication, authorization, and accounting for network access, commonly used for VPN, 802.1X, and administrative login.

A TCP-based AAA protocol that separates authentication, authorization, and accounting and offers per-command authorization, making it popular for device administration.

A port-based network access control standard where a supplicant authenticates through an authenticator to a RADIUS server before the switch port grants network access.

Network access control: a system that checks endpoint identity and posture before admitting a device, then places compliant, noncompliant, or guest devices into appropriate network segments.

The assessed security state of a device, such as patch level, antivirus status, disk encryption, and firewall state, used to decide whether access is allowed.

A firewall technique that records connection state in a session table so return traffic is permitted automatically and packets outside an established flow are dropped.

The in-memory record of active flows, including addresses, ports, sequence state, and application layer context, used to forward return traffic and enforce timeouts.

Deep inspection that recognizes the actual protocol or application in a flow, even when it uses nonstandard ports or evades signature matching through encryption or tunneling.

Decrypting TLS traffic at a gateway, inspecting the plaintext with security engines, then re-encrypting it, typically using a trusted certificate authority to avoid client warnings.

An inline sensor that inspects traffic against signatures and behavioral rules and can drop malicious packets or reset connections in real time before they reach the target.

Identifying attacks by matching traffic or files against known patterns, which is precise and fast for known threats but blind to novel or heavily obfuscated variants.

Establishing a baseline of normal behavior and flagging deviations, which can catch unknown threats but produces more false positives than signature matching.

Monitoring user, host, and network activity over time to detect patterns such as unusual data access or lateral movement that individual events would not reveal.

Security information and event management: a platform that collects logs from many sources, normalizes them, correlates events, and raises alerts for analyst investigation.

Security orchestration, automation, and response: tooling that runs playbooks to enrich alerts, coordinate tools, and execute repetitive response steps with less manual effort.

A structured process of preparation, detection, containment, eradication, recovery, and lessons learned that limits damage and restores normal operations after a security event.

The disciplined collection and preservation of evidence, including memory, disk, and logs, with documented chain of custody so findings remain defensible in investigations.

The policy and configuration that determines how long event and traffic logs are stored, balancing investigation needs and compliance rules against storage cost.

Endpoint detection and response: agent software that records process, file, and network behavior on hosts, detects malicious activity, and supports remote containment actions.

Detonating suspicious files or URLs in an isolated instrumented environment to observe behavior, then using the verdict to block or allow them at the gateway.

A vulnerability with no vendor patch available at the time of exploitation, so defenses must rely on behavior, segmentation, and virtual patching rather than signatures alone.

Blocking exploitation of a known vulnerability at the network or host layer with compensating rules, buying time until the affected software can actually be updated.

Cloud access security broker: a control point that discovers sanctioned and unsanctioned cloud services and enforces data loss prevention, access, and encryption policies for them.

Cloud services and applications adopted by users without security or IT approval, creating unmonitored data flows that discovery tools and CASB policies aim to expose and govern.

Data loss prevention: identifying sensitive data by pattern, label, or fingerprint and blocking or logging its movement outside approved boundaries.

Labeling data by sensitivity, such as public, internal, confidential, and restricted, so handling, encryption, and retention rules can be applied consistently.

A tunnel built with IKE negotiation and ESP or AH protection that authenticates peers and encrypts traffic between sites or remote users at the network layer.

Internet Key Exchange: the protocol that negotiates security associations, authenticates peers, and derives keys for IPsec, commonly in version 2 for site-to-site tunnels.

A property where each session uses ephemeral key material, so compromise of a long-term key does not allow decryption of previously recorded traffic.

Encapsulating IPsec ESP packets in UDP so they pass through NAT devices that cannot translate ESP or track its state, keeping remote-access tunnels working.

Deploying redundant devices with synchronized sessions and state so a peer failure fails over traffic with minimal interruption and no need to re-establish flows.

Bonding multiple physical links into one logical interface to increase bandwidth and provide link-level redundancy, requiring matching configuration on both ends.

An alert or block triggered on legitimate traffic, which erodes trust in controls and must be tuned down without creating matching blind spots.

Malicious activity that a control fails to detect or block, the more dangerous error class because it leaves real attacks unaddressed while dashboards look clean.