TS-C (NCCT) cheat sheet

CIA triad: confidentiality (no unauthorized disclosure), integrity (no unauthorized modification), availability (timely access for authorized users).

Risk combines likelihood and impact; ALE = SLE × ARO, and SLE = asset value × exposure factor (the percentage of the asset lost in one event).

Threat is an actor or event with potential to cause harm; vulnerability is a weakness; exploit is the technique that abuses it; risk is the probability and impact of that abuse succeeding.

AAA separation: authentication proves identity, authorization grants permissions, accounting records activity for later audit and forensics.

Symmetric encryption (AES) uses one shared key and is fast; asymmetric (RSA, ECDSA) uses a public/private pair and is slow but solves key exchange; hashing (SHA-256) is one-way and gives integrity, not confidentiality.

OSI layers 7 to 1: application, presentation, session, transport, network, data link, physical; TCP operates at layer 4, IP at layer 3, Ethernet at layer 2.

Availability = MTBF ÷ (MTBF + MTTR); raising mean time between failures or lowering mean time to repair both increase availability.

Stateful firewalls track connection state and allow return traffic automatically; stateless ACLs require explicit rules in both directions.

The business impact analysis comes before disaster recovery design: it ranks processes by outage impact and produces the RTO and RPO targets used to size redundancy and backup frequency.

RTO is the maximum tolerable elapsed downtime before service restoration; RPO is the maximum tolerable data loss measured in time before the disruption.

IPv4 usable hosts = 2^h − 2 for h host bits: /24 gives 254, /25 gives 126, /26 gives 62, /27 gives 30, /30 gives 2.

Default-deny posture: order rules most-specific first, scope each rule by source, destination, port, and protocol, and require a documented exception for any-any rules.

Segmentation pattern: internet-facing services in a DMZ, management planes on an out-of-band management VLAN, and restricted east-west traffic between trust zones.

Redundancy notation: N+1 tolerates one component failure, 2N tolerates loss of an entire mirrored set; active-passive failover is simpler while active-active adds capacity but requires session handling.

Build systems from a hardened golden image per CIS Benchmarks or the vendor hardening guide, then monitor drift against the approved configuration baseline.

Change workflow: request, risk assessment and categorization, CAB approval for normal changes or pre-authorization for standard changes, implementation in the window, verification, CMDB update; emergency changes are reviewed retrospectively.

Deployment patterns ranked by blast radius: big-bang (all at once), phased or pilot (limited scope first), blue-green (parallel environment with instant switchback), canary (a percentage of live traffic).

Define rollback triggers before deployment - error rate, latency, failed health check - so abort decisions are objective rather than debated during an incident.

Well-known ports: 22 SSH, 25 SMTP, 53 DNS, 80 HTTP, 123 NTP, 389 LDAP, 443 HTTPS, 636 LDAPS, 1433 SQL Server, 3306 MySQL, 3389 RDP.

DHCP DORA: Discover, Offer, Request, Acknowledge; renewal is unicast at T1 = 50 percent of the lease and rebinding starts at T2 = 87.5 percent.

DNS records: A maps to IPv4, AAAA to IPv6, CNAME aliases one name to another, MX identifies mail exchangers, TXT carries verification and SPF/DKIM data, PTR supports reverse lookup; a lower TTL speeds cutover but raises query load.

TLS validation: the server presents the leaf certificate plus intermediates, and the client checks the chain to a trusted root, the hostname against the SAN, validity dates, and revocation status; enforce TLS 1.2 or higher.

Infrastructure as code must be idempotent and version-controlled, and the same artifact validated in non-production is promoted unchanged to production.

Deployment exit criteria: health checks green, monitoring and log shipping confirmed, fresh backup taken, runbook and CMDB updated, sign-off recorded.

Service management distinction: an incident restores service quickly, a problem removes the underlying root cause, a change is a controlled modification, and a service request is a routine user ask.

NIST SP 800-61 incident response lifecycle: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity.

Troubleshooting order: define the symptom and scope, gather evidence, form a testable hypothesis, test the cheapest and most likely cause first, implement the fix, verify, then document.

Layered isolation: test upward from physical and link (cable, switch port, VLAN), through IP routing, DNS resolution, and port reachability, to the application layer to locate the failing layer.

3-2-1 backup rule: three copies of data, on two media types, with one copy offsite or offline; restore tests are required because an untested backup is only an assumption.

All devices must synchronize to a common NTP source; unsynchronized clocks break SIEM correlation, log ordering, and forensic timelines.

Alert design: baseline normal behavior, alert on deviations with thresholds, and tune out false positives, because alert fatigue is itself an operational risk.

MTTR = detection + response + diagnosis + repair + verification time; shortening any component raises availability more cheaply than adding redundant hardware.

Patch tiers by severity: critical internet-facing issues within days, high severity within weeks, routine updates in the standard monthly cycle, with documented compensating controls for exceptions.

NIST Cybersecurity Framework core functions: Identify, Protect, Detect, Respond, Recover; CSF 2.0 adds Govern as an oversight function.

Policy hierarchy: policy states mandatory management intent, a standard sets measurable requirements, a procedure gives step-by-step instructions, and a guideline is recommended but not mandatory.

Access governance: least privilege, role-based access, joiner-mover-leaver workflows, and periodic recertification of entitlements by the asset owner.

Segregation of duties: no single identity should be able to request, approve, and execute the same sensitive transaction; production administrator rights are held separately from change approval.

Regulatory anchors: PCI DSS for cardholder data, HIPAA for protected health information, GDPR for EU personal data including 72-hour breach notification and data subject rights, SOX for financial controls.

CVSS base score bands: 0.1 to 3.9 low, 4.0 to 6.9 medium, 7.0 to 8.9 high, 9.0 to 10.0 critical; the score expresses technical severity, while business risk also depends on asset criticality and exposure.

Data protection controls: AES-256 at rest and TLS 1.2 or higher in transit, keys stored separately from data in a KMS or HSM, and rotation on a defined schedule or immediately on suspected compromise.

Audit readiness: retain evidence for the defined retention period, store logs immutably, and maintain documented chain of custody for every collected forensic artifact.