RCE flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Recovery Point Objective

The maximum amount of data loss, expressed as time, that the business can tolerate. It drives backup frequency and is defined by business owners rather than by technical teams.

Recovery Time Objective

The maximum acceptable elapsed time to restore a service after disruption. It must be proven by measured restore tests, because backup job success does not demonstrate restore speed.

3-2-1 backup rule

Keep at least three copies of data, on two different media types, with one copy offsite. A common modern extension adds one immutable or offline copy to resist ransomware.

Differential versus incremental backup

A differential captures everything changed since the last full backup; an incremental captures changes since the most recent backup of any type. Differentials restore faster, incrementals store smaller.

Synthetic full backup

A new full backup reference point created by merging the prior full with subsequent incremental backups, without reading production data again. It shortens restore chains and reduces production load.

Immutable backup retention

Backups written under WORM or object-lock policy that cannot be altered or deleted until the retention period expires. The lock period must exceed expected attacker dwell time.

Snapshot is not a backup

Snapshots usually reside in the same array or cloud account as production data. An attacker with production credentials can delete or encrypt both, so snapshots alone fail resilience requirements.

Tier-0 identity assets

Directory services, identity providers, federation services, privileged access management, and the backup platform itself. Compromise of any Tier-0 asset invalidates controls that depend on it.

Phishing-resistant MFA

Authentication bound to origin using FIDO2, WebAuthn security keys, or passkeys. Push notifications and SMS codes can be defeated by MFA fatigue and adversary-in-the-middle proxy kits.

Break-glass account

A cloud-only emergency account excluded from conditional access, with a long random credential stored offline. At least two should exist, and any sign-in use should trigger an alert.

Golden SAML attack

Theft of the token-signing key lets an attacker forge valid SAML assertions for any user. Response requires rotating the signing certificate and revoking all issued refresh tokens.

Identity recovery order

Restore the identity provider first, then federation trust, then privileged accounts, then standard users and service principals. Restoring applications before identity leaves them unreachable and unmanageable.

Non-human identity governance

Service accounts, API keys, and application registrations require named owners, rotation schedules, and least-privilege scoping. Unowned credentials are a frequent attacker persistence mechanism.

Conditional access inputs

Signals evaluated per request: user or group, device compliance, network location, application sensitivity, sign-in risk, and session controls. Policies combine these into allow, block, or require-step-up decisions.

Cyber recovery versus disaster recovery

Disaster recovery assumes an accidental failure with a stable environment. Cyber recovery assumes an active adversary, so containment and scoping precede any restore activity.

Isolated recovery environment

A clean-room network with separate credentials, separate management plane, and no standing trust back to production. Restores are validated there before reintroduction to the enterprise.

Recovery point triage

Scanning candidate restore points for compromise indicators such as ransomware notes, unexpected encryption, anomalous file extensions, or new admin accounts to select the last known-good point.

Dwell time and retention gap

Attackers often persist for days or weeks before detonation, so the clean restore point frequently predates the incident date. Backup retention must span that gap.

Restore order for cyber incidents

Identity and authentication first, then network and security telemetry such as logging, EDR, and DNS, then core infrastructure, then business applications and data.

Pre-rejoin validation

Before a restored host rejoins production, rotate credentials, scan for malware, verify data integrity, and obtain application owner sign-off. Restored systems often carry the original persistence.

Cyber recovery exercise

A tabletop or full-scale test that exercises decision authority, communications, isolation procedures, and measured RTO against the documented recovery plan rather than only backup jobs.

Shared responsibility model

The provider secures the physical and virtual infrastructure and managed service availability. The customer secures data, identities, configuration, and access inside the cloud service.

SaaS vendor retention limits

Microsoft 365, Google Workspace, and Salesforce retain deleted data only briefly in recycle bins. Vendor retention does not protect against malicious deletion by an authorized account.

S3 Object Lock modes

Governance mode can be bypassed by users with special permissions; compliance mode cannot be shortened or removed, even by the root account, until retention expires.

Backup role separation

The backup service principal should lack delete rights on its own repository, and production administrators should lack delete rights on backup storage. This prevents a single compromised identity from erasing recovery points.

SaaS restore scope

SaaS recovery covers mailboxes, OneDrive and SharePoint sites, Teams channels, plus metadata and permissions. Restoring content without permissions leaves users unable to access recovered data.

Cross-account backup isolation

Writing backups to a separate cloud account or region with distinct credentials prevents an attacker holding production account rights from deleting or encrypting the backup copies.

Agent least privilege

Each platform agent role, whether discovery, protection, detection, or recovery, should carry its own narrowly scoped credential rather than sharing a broad administrative service account.

Agent heartbeat monitoring

A silent agent represents an unprotected workload, not a neutral state. Track heartbeat, last successful policy run, version currency, and credential expiry as health signals.

Policy precedence

When multiple policies apply, the most specific scope wins: object over group over global. Precedence changes should be tested in a non-production scope before rollout.

Staged agent upgrade

Upgrade a pilot group first, verify policy execution and a test restore, then roll out broadly while retaining a rollback path to the previous agent version.

Platform RBAC separation

Separate platform administrator, operator, and read-only auditor roles. Every recovery action should be logged with actor, timestamp, and target for audit reconstruction.