TS-C (NCCT) flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

The three core security objectives: confidentiality keeps data from unauthorized disclosure, integrity prevents unauthorized modification, and availability ensures systems and data remain accessible to authorized users when needed.

Annualized loss expectancy

ALE estimates yearly financial loss from a risk by multiplying single loss expectancy, the cost of one incident, by annualized rate of occurrence, the expected number of incidents per year.

Single loss expectancy

SLE is the monetary cost of a single risk event, calculated as asset value multiplied by exposure factor, where exposure factor is the percentage of the asset lost in that event.

Authentication versus authorization

Authentication verifies an identity using factors such as passwords, tokens, or biometrics; authorization then determines which resources and actions that verified identity is permitted to access.

Hashing versus encryption

Hashing is a one-way function producing a fixed-length digest used for integrity checks; encryption is reversible with a key and protects the confidentiality of data at rest or in transit.

Defense in depth

A layered control strategy stacking preventive, detective, and corrective safeguards across people, process, and technology, so that failure of any single control does not expose the asset.

Least privilege

The principle that each user, service, or process receives only the minimum permissions required to perform its function, and only as long as needed, reducing the blast radius of compromise or error.

Recovery time objective

RTO is the maximum acceptable elapsed time to restore a service after disruption; it drives architecture choices such as redundancy, failover automation, and spare capacity, and is set by the business impact analysis.

Recovery point objective

RPO is the maximum acceptable amount of data loss measured in time before a disruption; it sets backup frequency and replication interval, since data written after the last copy is lost.

Business impact analysis

A BIA identifies critical business processes, quantifies the impact of their outage over time, and derives recovery priorities, RTOs, and RPOs that guide continuity and disaster recovery design.

N plus one redundancy

A high-availability design where one additional component beyond the number required to carry the load is provisioned, so a single component failure does not cause service loss.

Default-deny firewall policy

A rule-set posture where all traffic is blocked unless explicitly permitted by a documented rule; permitted flows are narrowly scoped by source, destination, port, and protocol.

Usable hosts per subnet

For an IPv4 subnet with h host bits remaining, usable addresses equal 2^h minus 2, because the all-zeros network address and all-ones broadcast address cannot be assigned to hosts.

Change advisory board

A group that reviews proposed changes for risk, impact, scheduling conflicts, and rollback readiness before approval; it is separate from the implementer, supporting segregation of duties over production changes.

Blue-green deployment

Two identical environments are maintained, with traffic switched from the active blue environment to the updated green environment after validation; rollback is simply switching traffic back.

Canary release

A deployment pattern that routes a small percentage of live traffic to the new version first, comparing error rates and latency against the baseline before progressively expanding exposure to all users.

DHCP DORA sequence

The four-step address assignment exchange: Discover broadcast by the client, Offer from a server, Request by the client accepting an offer, and Acknowledgement from the server confirming the lease.

DNS A record

A DNS resource record mapping a fully qualified hostname to one IPv4 address; the AAAA record performs the equivalent mapping for IPv6, and a CNAME aliases one name to another.

TLS certificate chain

A trust path from the server certificate through intermediate certificate authorities to a root CA trusted by the client; a missing intermediate or expired link causes validation failure.

Idempotent configuration management

A property of automation where repeatedly applying the same configuration produces the same end state without duplicate or cumulative effects, enabling safe re-runs and correction of configuration drift.

Incident versus problem

An incident is an unplanned interruption or degradation of service requiring restoration; a problem is the underlying cause of one or more incidents, managed through root cause analysis and permanent fixes.

Incident response lifecycle

NIST SP 800-61 phases: preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity, where lessons learned feed back into preparation and control improvements.

Three-two-one backup rule

Keep at least three copies of data, on two different media types, with one copy stored offsite or offline; the offline copy protects against ransomware that encrypts reachable systems.

NTP for log correlation

Synchronizing all devices to a common time source aligns event timestamps, which is required to reconstruct an attack sequence accurately in SIEM platforms and forensic analysis.

Mean time to repair

MTTR is the average elapsed time to restore a failed component or service to normal operation, including detection, diagnosis, and fix; availability equals MTBF divided by MTBF plus MTTR.

Root cause analysis

A structured investigation using techniques such as the five whys or fishbone diagrams to identify why an incident occurred, so recurrence is prevented rather than symptoms merely repaired.

NIST CSF functions

Five core functions: Identify, Protect, Detect, Respond, and Recover. Version 2.0 adds Govern as a sixth function, emphasizing risk management strategy and executive oversight.

Policy standard procedure guideline

A governance hierarchy: policy states mandatory management intent, standards specify measurable requirements, procedures give step-by-step instructions, and guidelines are recommended, non-mandatory advice.

GDPR breach notification window

Under the EU General Data Protection Regulation, controllers must notify the supervisory authority of a personal data breach within 72 hours of becoming aware, unless it is unlikely to pose a risk.

CVSS severity ranges

CVSS base scores map to qualitative ratings: 0.1 to 3.9 low, 4.0 to 6.9 medium, 7.0 to 8.9 high, and 9.0 to 10.0 critical, commonly used to set remediation timeframes.

Segregation of duties

Splitting sensitive tasks, such as requesting, approving, and executing a change or payment, among different people so no single individual can complete a high-risk action alone.

SOC 2 trust services criteria

An attestation framework covering security, availability, processing integrity, confidentiality, and privacy; a Type II report evaluates whether controls operated effectively over a defined observation period.