CPTE key terms

A written agreement signed before testing that defines the authorized scope, permitted techniques, testing windows, emergency contacts, and limits of liability. It protects both the tester and the client by documenting exactly what activity was approved.

The gradual, unapproved expansion of testing beyond the agreed target list, such as pivoting into a newly discovered subnet. It risks legal exposure and invalidates results, so testers must confirm written authorization before touching any new asset.

A signed authorization document carried by the tester that states the holder is conducting an approved assessment. It is produced if law enforcement or a network defender intervenes, and it lists contacts who can verify the engagement.

An assessment in which the tester receives no prior information about the target beyond a name or address. It mimics an external attacker's view but may waste time rediscovering internal details that a real adversary would already know.

An assessment where the tester is given architecture diagrams, source code, credentials, or other internal knowledge. It produces deeper coverage per hour but may not reflect the difficulty an outside attacker would face.

A hybrid approach in which the tester receives partial information, such as a user-level account or a network map, but not full administrative access. It balances realism against efficiency and is common for internal network assessments.

The information-gathering phase that precedes exploitation, covering both passive collection from public sources and active probing of the target. Good reconnaissance identifies live hosts, exposed services, employee details, and technology versions that shape later attack choices.

Open-source intelligence: information lawfully gathered from public sources such as websites, social media, domain registrations, and job postings. Testers use it to map an organization's people, technologies, and exposed infrastructure without sending traffic to the target.

Actively probing target systems to identify live hosts, open ports, and running services. Scanning generates traffic that intrusion detection systems may log, so timing and source addresses must stay within the agreed rules of engagement.

Monitoring or capturing network traffic to learn about hosts and services without sending probes to them. Because no packets reach the target, it is harder to detect, but it yields results only for traffic the tester can observe.

The process of extracting detailed information from discovered services, such as user accounts, share names, software versions, and group memberships. Enumeration turns a list of open ports into specific targets for exploitation or credential attacks.

Using a vulnerability, misconfiguration, or weak credential to gain unauthorized access or execute code on a target. In a penetration test, exploitation must be limited to what the rules of engagement authorize and documented with evidence.

The code or command delivered by an exploit that runs on the target after a vulnerability is triggered. Payloads range from a simple command that proves execution to a reverse shell that grants interactive access.

A connection in which the compromised host initiates outbound contact back to the tester's listener, then hands over a command interpreter. Outbound connections often bypass firewall rules that block inbound access, making this a common post-exploitation technique.

Gaining a higher level of access than initially obtained, such as moving from a standard user to administrator or root. It may exploit a local vulnerability, a misconfigured service, or exposed credentials and is a key milestone in most tests.

Moving from one compromised host to other systems within the same network to expand control. Techniques include reusing harvested credentials, remote service execution, and trusted administrative protocols, and defenders detect it through unusual authentication patterns.

Using a compromised host as a relay to reach network segments that the tester cannot access directly. It turns one foothold into a route into protected internal networks, which is why segmentation and egress filtering limit an intruder's reach.

Extracting stored password hashes or plaintext credentials from a compromised system's memory or credential stores. Harvested credentials enable lateral movement and privilege escalation without exploiting new software vulnerabilities.

An attack that authenticates using a captured password hash directly, without ever recovering the plaintext password. It works where protocols accept hash-based authentication, which is why protecting credential stores and restricting administrative reuse matters.

The channel through which an attacker or tester remotely directs compromised systems. It may use periodic beacons over HTTP, DNS, or other protocols, and defenders hunt for its regular timing and unusual destinations.

A minimal, documented demonstration that a vulnerability is exploitable, such as a screenshot or captured command output. It gives the client verifiable evidence without requiring the tester to cause damage or exfiltrate real data.

The formal deliverable that records scope, methodology, findings, evidence, risk ratings, and remediation guidance. A good report separates executive summary from technical detail so both management and engineers can act on it.

A score assigned to a finding that combines likelihood and impact, often using a standard framework or a custom scale. Consistent ratings help clients prioritize remediation and compare findings across multiple assessments.

A reported vulnerability that does not actually exist or cannot be exploited in the target's configuration. Testers manually validate scanner output to remove false positives before delivering results, since credibility depends on accuracy.

A tool that automatically probes systems for known weaknesses by comparing detected versions and configurations against a signature database. It speeds discovery but produces false positives and cannot judge business context, so results need human validation.

A study that identifies critical business functions and quantifies the effect of their disruption over time. Its outputs, including recovery priorities and tolerance thresholds, drive the recovery objectives set in continuity and disaster recovery plans.

The maximum acceptable elapsed time to restore a function or system after disruption. It sets how fast recovery must occur and therefore determines architecture choices such as redundancy, standby sites, and staffing levels.

The maximum acceptable amount of data loss measured in time before the disruption. It drives backup frequency and replication design: an RPO of one hour means backups or replication must occur at least that often.

Documented procedures for restoring technology infrastructure and data after a major disruption. It defines roles, activation criteria, recovery sequences, and alternate sites, and must be tested periodically to remain credible.

A broader plan that keeps essential business functions running during and after a disruption, including people, facilities, and suppliers. It complements the technology-focused DRP and typically covers longer time horizons and manual workarounds.

A fully equipped alternate facility with hardware, software, and near-real-time data replication that can take over operations almost immediately. It offers the shortest recovery time but carries the highest ongoing cost.

An alternate facility with some pre-installed infrastructure and connectivity but incomplete or older data. It recovers faster than a cold site but slower than a hot site, and requires restoring backups before operations resume.

An alternate space with power, cooling, and network connections but no pre-installed systems or current data. It is inexpensive to maintain yet demands the longest rebuild time, so it suits functions with generous recovery objectives.

A scheduled scheme, such as grandfather-father-son, that cycles full and incremental backups across media and offsite storage. Rotation balances restore speed, media cost, and retention requirements while ensuring multiple recovery points exist.

The practice of actually recovering data from backups and confirming it is complete and usable. Untested backups frequently fail during real disasters, so periodic restore drills are the only reliable proof of recoverability.

A discussion-based drill in which participants walk through a simulated disaster scenario and their planned responses. It reveals gaps in roles, communication, and procedures without disrupting production systems.

A documented set of roles, communication paths, and step-by-step procedures for detecting, containing, eradicating, and recovering from security incidents. It should define severity levels and escalation triggers so responders act quickly under pressure.

The ordered phases of handling a security incident: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned. Following the phases prevents premature cleanup that destroys evidence or lets an intruder return.

The phase that stops an incident from spreading, for example by isolating hosts, blocking addresses, or disabling accounts. Responders weigh short-term containment against a full rebuild, and must preserve evidence before making changes.

Removing the root cause of an incident, such as deleting malware, closing the exploited vulnerability, and resetting compromised credentials. It follows containment and precedes recovery, and skipping it often leads to reinfection.

A post-incident review that examines what happened, how well the response performed, and which controls or procedures should change. Documented findings feed back into preparation and improve future detection and response.

A documented record of who handled evidence, when, where, and for what purpose, from collection through storage and analysis. An unbroken chain supports the evidence's integrity if findings are used in legal or disciplinary proceedings.

The principle of collecting the most perishable evidence first, such as memory and network connections, before slower-changing disks and logs. Following it preserves data that would otherwise be lost when systems are powered off or overwritten.

A bit-for-bit copy of a storage device or memory region, often with a hash recorded at acquisition. Investigators analyze the copy rather than the original so the source remains unaltered and the hash can prove integrity.

Computing a fixed-length digest of evidence, such as SHA-256, before and after acquisition or analysis. Matching values demonstrate that the data was not altered, which is essential for admissibility and for verifying forensic copies.

Analyzing a captured image of volatile memory to recover running processes, network connections, injected code, and encryption keys. It often reveals malware activity that leaves no trace on disk and must be captured before shutdown.

Recording network traffic for later analysis, typically in a file format that preserves headers and payloads with timestamps. Captures let investigators reconstruct sessions, identify malicious payloads, and establish a timeline of activity.

The standard file format for storing captured packets, containing per-packet timestamps, headers, and data. Analysts open PCAP files in protocol analyzers to follow streams, extract objects, and correlate events with other logs.

Examining metadata records of network conversations, such as source and destination addresses, ports, byte counts, and durations, without payload content. It scales to large networks and quickly highlights beaconing, scanning, and data-transfer anomalies.

A widely supported format in which routers and switches export summarized records of traffic flows. Because it stores no payload, it is compact and privacy-friendly, yet it still exposes communication patterns useful for hunting threats.

Regular, repeated outbound connections from an infected host to an attacker-controlled server, used to receive instructions. Its predictable interval and consistent destination distinguish it from normal user traffic and are a classic hunting signature.

Decoding captured packets layer by layer to interpret fields and reconstruct application sessions. It reveals malformed requests, credential exposure in cleartext protocols, and tunneling hidden inside allowed traffic.

Encoding data inside DNS queries and responses to bypass network controls that permit name resolution but block other traffic. Long or high-entropy subdomain labels and unusually frequent lookups to one domain are common indicators.

The unauthorized transfer of data from a compromised network to an external destination. Investigators detect it through volume anomalies, off-hours transfers, unusual destinations, and encoded channels such as DNS or HTTPS.