NCJOSI flashcards

34 cards. Read the term and the definition here. The deck at the top of this page is optional.

VLAN hopping

An attack where a host sends double-tagged 802.1Q frames or abuses the native VLAN to send traffic into a VLAN it should not reach. Mitigate by disabling unused ports and changing the native VLAN.

Stateful inspection

A firewall technique that records active connections in a state table and permits return traffic belonging to an established session, instead of writing a separate rule for every reply direction.

IPsec ESP

Encapsulating Security Payload provides confidentiality through encryption plus integrity and authentication. It is used in tunnel mode for site-to-site VPNs and transport mode for host-to-host protection.

DMZ

A segmented network zone hosting internet-facing services, separated from the internal LAN by firewalls so that a compromised public server cannot directly reach internal systems.

Spear phishing

A targeted phishing message crafted for a specific person or team using researched details such as colleagues, projects, or vendors to make the request appear legitimate.

SQL injection

Inserting SQL syntax through user input so the query executes attacker-controlled logic. Parameterized queries and prepared statements separate code from data and prevent it.

Stored XSS

A cross-site scripting variant where the malicious script is saved on the server, for example in a comment or profile, and executes in every visitor's browser that renders the content.

Ransomware

Malware that encrypts or steals data and demands payment. Reliable recovery depends on offline, immutable backups and tested restoration, not on paying the ransom.

MITRE ATT&CK

A knowledge base of adversary tactics and techniques observed in real intrusions, used to map detections, prioritize gaps, and describe attacker behavior consistently across teams.

Beaconing

Regular, low-volume outbound connections from an infected host to a command-and-control server at consistent intervals. The pattern is detectable in flow data even when payloads are encrypted.

SIEM

Security information and event management collects and normalizes logs from many sources, correlates them against detection rules, and alerts analysts to suspicious patterns.

NIDS versus NIPS

A network intrusion detection system passively inspects a traffic copy and alerts. A network intrusion prevention system sits inline and can block packets, adding latency and a failure point.

Syslog severity 0

In syslog, severity level 0 is Emergency, the most severe, and 7 is Debug, the least severe. Lower numbers indicate higher priority in filtering and alerting.

Order of volatility

A forensic collection priority ranking evidence by how quickly it disappears: CPU registers and cache, memory, network state, running processes, disk, remote logs, archival media.

Chain of custody

Documentation tracking who collected, handled, and transferred evidence, with times and reasons. Gaps or undocumented handling can make evidence inadmissible or unusable.

Write blocker

A hardware or software device that permits read-only access to storage during imaging, preventing modification of the source and preserving its hash value for integrity verification.

NIST IR lifecycle

Four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity, which captures lessons learned and corrective actions.

Event ID 4625

A Windows Security log event recording a failed logon attempt. Repeated 4625 events across many accounts suggest password spraying or brute force.

CVSS base score

A 0.0 to 10.0 severity rating from exploitability and impact metrics. Bands: None 0.0, Low 0.1-3.9, Medium 4.0-6.9, High 7.0-8.9, Critical 9.0-10.0.

Annualized loss expectancy

ALE equals single loss expectancy multiplied by annualized rate of occurrence. It estimates expected yearly loss and supports comparing a control's cost against the risk reduction it delivers.

False negative

A vulnerability scanner result where an existing weakness is missed and not reported. False negatives create unpatched exposure because the gap never appears in the remediation queue.

Authenticated scan

A vulnerability scan that logs into the target with credentials, allowing it to read installed package versions and configuration directly, producing fewer false positives than unauthenticated scanning.

Risk formula

Risk is commonly expressed as likelihood multiplied by impact. A high-severity vulnerability on an unreachable, isolated system may still represent low organizational risk.

AES-GCM

An authenticated encryption mode combining AES counter-mode encryption with Galois field authentication. It provides confidentiality and integrity in one pass and is standard in TLS 1.3.

Digital signature

A hash of a message encrypted with the sender's private key. The recipient verifies it with the sender's public key, proving integrity and origin, and providing non-repudiation.

ECB mode weakness

Electronic codebook encrypts each block independently, so identical plaintext blocks yield identical ciphertext. The pattern leakage makes it unsuitable for protecting structured data.

Forward secrecy

A property where each session uses ephemeral key exchange such as ECDHE, so compromise of the server's long-term private key does not decrypt previously recorded sessions.

Salted password hashing

Adding a unique random salt per password before applying a deliberately slow hash such as bcrypt, scrypt, or Argon2, which defeats rainbow tables and slows offline cracking.

RBAC versus ABAC

Role-based access control grants permissions by job role. Attribute-based access control evaluates attributes such as department, time, and device, enabling finer, context-aware decisions.

OAuth versus OpenID Connect

OAuth 2.0 is an authorization framework issuing access tokens for resource access. OpenID Connect adds authentication on top, returning a signed ID token identifying the user.

Separation of duties

A control requiring that no single person can complete a sensitive transaction alone, such as both requesting and approving a payment, reducing fraud and error risk.

Policy versus standard

A policy states management's mandatory intent and goals. A standard specifies the mandatory technical requirements that implement the policy. Procedures give steps; guidelines are recommendations.

GDPR breach notification

The EU General Data Protection Regulation requires notifying the supervisory authority of a personal data breach within 72 hours of becoming aware, where the breach risks individuals' rights.

NIST CSF functions

The framework's core functions are Identify, Protect, Detect, Respond, and Recover; version 2.0 adds Govern as a sixth function spanning the others.