CPTE flashcards
CPTE · Build recall with a focused review session.
31 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Rules of engagement
- The written document defining authorized targets, time windows, excluded systems, testing techniques permitted, emergency contacts, and escalation paths. It converts a penetration test from unauthorized access into authorized assessment.
- Recovery Point Objective
- The maximum amount of data, expressed as time, that an organization can tolerate losing. It determines how frequently backups or replication must occur.
- Recovery Time Objective
- The maximum acceptable elapsed time to restore a system or process after disruption. It drives the choice between hot, warm, and cold recovery architectures.
- Chain of custody
- A documented, unbroken record of who collected, handled, transferred, and stored evidence and when. Gaps in the record can render evidence inadmissible or unusable.
- Order of volatility
- The sequence for collecting evidence from most to least perishable: registers and cache, RAM, network state, processes, disk, remote logs, archival media. Collect volatile data first.
- Differential backup
- A backup of all files changed since the last full backup. It grows in size each day but requires only the last full plus the latest differential to restore.
- Incremental backup
- A backup of changes since the most recent backup of any type. It is fast to write and small, but restoration requires the full plus every incremental in sequence.
- Hot site
- A fully equipped alternate facility with hardware, software, and data already synchronized, enabling near-immediate failover with the shortest recovery time objective.
- Business Impact Analysis
- The process that identifies critical business functions, their dependencies, and the financial and operational impact of their loss, producing the RTO and RPO targets.
- Half-open SYN scan
- A port scan that sends SYN and never completes the handshake, resetting instead. It is faster and less likely to be logged by the application than a full connect scan.
- IDOR vulnerability
- Insecure Direct Object Reference: an application exposes an internal identifier and fails to verify that the requesting user is authorized to access that object.
- Unquoted service path
- A Windows service configuration whose executable path contains spaces without quotes, allowing an attacker who can write to an intermediate directory to hijack execution.
- SUID binary
- A Linux executable that runs with the file owner's privileges rather than the caller's. Misconfigured SUID binaries are a standard local privilege escalation vector.
- CVSS base score
- A 0-10 severity metric derived from exploitability and impact characteristics of a vulnerability, independent of the environment in which the affected system operates.
- Post-exploitation
- The phase after initial access covering privilege escalation, credential harvesting, lateral movement, persistence, and data collection, all bounded by the engagement scope.
- NIST incident lifecycle
- Four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. Each phase has defined outputs that feed the next.
- Containment strategy
- The decision to isolate, block, or shut down affected systems. Isolation preserves volatile evidence; powering off destroys memory but guarantees the threat stops.
- Eradication phase
- Removing the root cause of an incident: deleting malware and persistence, patching the exploited entry vector, and resetting credentials exposed during the compromise.
- Lessons learned report
- The post-incident document recording the timeline, root cause, control failures, cost, and corrective actions with named owners and due dates.
- Incident severity matrix
- A predefined table mapping impact, data sensitivity, and scope to a severity level, which in turn determines notification, escalation, and response-time requirements.
- Volatile evidence
- Data that disappears when a system loses power, such as RAM contents, running processes, network connections, and ARP cache. It must be captured before shutdown.
- Evidence hashing
- Computing a cryptographic digest such as SHA-256 of acquired media at collection and re-verifying it later to demonstrate the evidence was not altered.
- PCAP capture format
- The standard file format storing packet-level network data with timestamps, used by tcpdump, Wireshark, and most intrusion detection systems for later analysis.
- BPF capture filter
- A Berkeley Packet Filter expression applied at capture time, such as host 10.0.0.5 and port 443, which reduces stored volume before packets reach disk.
- Wireshark display filter
- An analysis-time expression applied to already captured packets, such as tcp.flags.syn==1 && tcp.flags.ack==0, which hides non-matching frames without discarding data.
- TCP RST analysis
- A reset packet indicates a closed port, a rejected connection, or a middlebox terminating the flow. Repeated RSTs to many ports suggest scanning or filtering.
- NetFlow records
- Metadata about network conversations including source and destination addresses, ports, protocol, byte and packet counts, and timestamps, but never payload content.
- Beaconing detection
- Identifying command-and-control traffic by its regular connection intervals to the same destination. Implants add jitter and random sleep timers to defeat this analysis.
- TLS SNI metadata
- The Server Name Indication field in a TLS handshake reveals the requested hostname even when payload is encrypted, making it a key forensic pivot point.
- JA3 fingerprint
- A hash of TLS client hello parameters such as version, cipher suites, and extensions. It identifies client software families even when traffic is encrypted.
- Log time normalization
- Converting timestamps from multiple sources to a single time zone and verifying NTP synchronization, so that correlated events are ordered correctly in a timeline.