SNAP flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Stateful vs stateless firewall

A stateful firewall tracks connection state in a session table and permits return traffic for established sessions. A stateless ACL inspects each packet alone, so it must explicitly permit both directions.

IPsec ESP versus AH

ESP encrypts payload and provides integrity and authentication. AH provides integrity and authentication only, with no encryption, so AH alone does not conceal data contents on the wire.

RFC 1918 private ranges

The non-routable private address blocks are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Hosts using them require NAT or a proxy to reach public internet addresses.

SYN flood signature

A flood of TCP SYN packets without completing the three-way handshake exhausts the connection table. Mitigations include SYN cookies, rate limiting, and upstream scrubbing.

SEPM role

Symantec Endpoint Protection Manager is the central console and policy repository. Clients check in over HTTPS to receive policy, content updates, and administrative commands.

SEP client communication modes

Push mode has the server initiate contact, pull mode has the client poll on a schedule, and mixed mode combines both. Pull mode suits clients behind NAT or on intermittent links.

Group Update Provider

A GUP is a designated client that downloads content from SEPM and redistributes it to peer clients. It reduces WAN bandwidth when many endpoints sit at a remote site.

SEP policy inheritance

A client inherits the policy assigned to its group unless an explicit policy is applied to that client or subgroup. Group design therefore controls scoped enforcement across the estate.

Static versus dynamic analysis

Static analysis examines a sample without running it, using strings, headers, imports, and hashes. Dynamic analysis executes it in a sandbox and observes file, registry, process, and network behavior.

Polymorphic versus metamorphic malware

Polymorphic malware changes its code on each infection but keeps behavior constant. Metamorphic malware rewrites its own code structure, defeating signature matching and requiring behavior-based detection.

MITRE ATT&CK tactics

ATT&CK organizes adversary behavior into tactics, which are goals such as Initial Access or Defense Evasion, and techniques, which are the specific methods used to achieve each goal.

Indicators of compromise

IOCs are observable artifacts of intrusion such as file hashes, command-and-control domains, URI patterns, registry keys, and mutex names. They are atomic and decay as attackers rotate infrastructure.

Quarantine versus delete

Quarantine moves a detected file to a protected location and blocks execution while preserving it for review. Deletion removes it permanently, so quarantine is preferred for suspected false positives.

Tamper protection purpose

Tamper protection stops local users and non-admin processes from stopping the endpoint security service, disabling the firewall, or altering policy, blocking a common attacker step.

SEP exclusions risk

File, folder, process, and threat-name exclusions reduce scan overhead but create uninspected blind spots. Each exclusion should be documented as an accepted risk with an owner.

Application and device control

These endpoint policies restrict which executables may run and which devices such as USB storage may mount. Device control is the primary technical barrier against removable-media exfiltration.

802.1X three roles

The supplicant is the client device, the authenticator is the switch or wireless access point, and the authentication server is RADIUS. EAP carries the exchange between supplicant and server.

EAP-TLS versus PEAP

EAP-TLS requires mutual certificate authentication on both client and server. PEAP uses a server certificate plus an inner username and password, so it is weaker but easier to deploy.

MAC authentication bypass

MAB authenticates devices that cannot run an 802.1X supplicant by their MAC address. Because MAC addresses are spoofable, MAB is a fallback rather than a primary control.

NAC posture check

Posture assesses patch level, antivirus presence, and definition currency before granting access. Non-compliant hosts are placed in a remediation VLAN until they pass re-check.

Incident response phase order

The sequence is preparation, identification, containment, eradication, recovery, and lessons learned. Containment precedes eradication so spread is stopped before cleanup begins.

Windows event ID 4625

Event 4625 records a failed logon attempt and includes account name, logon type, and source workstation. Repeated occurrences indicate brute force or credential stuffing against the host.

Chain of custody

Chain of custody documents who handled evidence, when, and how. Volatile data such as memory and active connections is captured before disk imaging because shutdown destroys it.

MTTD and MTTR

Mean time to detect measures how quickly monitoring identifies an incident. Mean time to respond measures time to contain it. Lowering MTTD needs coverage; lowering MTTR needs runbooks and isolation authority.

Symmetric versus asymmetric encryption

Symmetric algorithms such as AES are fast and encrypt bulk data. Asymmetric algorithms such as RSA and ECC are slow and handle key exchange and signatures. TLS combines both.

Hashing versus encryption

Hashing is one-way and provides integrity verification but not confidentiality. Encryption is reversible with the correct key and provides confidentiality. Password storage requires salted slow hashing.

Tokenization versus encryption

Tokenization replaces sensitive data with a surrogate token mapped in a secured vault, with no mathematical relationship to the original. Encryption output is reversible with the key.

Full-disk encryption limitation

Full-disk encryption protects data at rest on a lost or stolen device, but not data in use once the system is booted and the user is logged in. File-level controls address narrower scopes.

Risk formula and register

Risk equals likelihood multiplied by impact. A risk register records each risk with its owner, rating, treatment choice among mitigate, transfer, avoid, or accept, and residual risk after controls.

RTO versus RPO

Recovery time objective is the maximum acceptable time to restore a process. Recovery point objective is the maximum acceptable data loss measured in time. DR strategy must satisfy both.

Defense in depth

Defense in depth layers preventive, detective, and corrective controls so that failure of any single control does not result in compromise of the protected asset.

Compliance framework mapping

PCI DSS covers cardholder data, HIPAA covers protected health information, GDPR covers EU personal data, ISO/IEC 27001 defines an information security management system, and SOX covers financial reporting controls.