Network Security Analyst flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Stateful vs stateless firewall

A stateful firewall tracks connection state in a session table and permits return traffic automatically, while a stateless firewall evaluates each packet independently and requires explicit rules for both directions.

Usable hosts in a /26

A /26 leaves 6 host bits, giving 64 addresses. Subtracting the network and broadcast addresses yields 62 usable host addresses, commonly used for small server subnets.

IPsec transport vs tunnel mode

Transport mode encrypts only the payload and keeps the original IP header, suiting host-to-host links. Tunnel mode encrypts the whole packet and wraps it in a new header, suiting gateway-to-gateway VPNs.

SYN flood signature

Many half-open TCP connections from spoofed or distributed sources to one destination, exhausting the backlog queue. The victim replies SYN-ACK to addresses that never complete the handshake.

APIPA address meaning

An address in 169.254.0.0/16 is self-assigned because the host received no DHCP response. Its presence indicates DHCP failure, VLAN misconfiguration, or an isolated segment.

Forward secrecy in TLS

Ephemeral ECDHE key exchange produces a unique session key per connection, so compromise of the server's long-term private key cannot decrypt previously recorded sessions.

ESP versus AH

ESP encrypts and authenticates the payload, providing confidentiality and integrity. AH authenticates the packet including the IP header but provides no encryption, and AH breaks under NAT.

NAT and inbound connections

NAT hides internal addresses behind a public one and blocks unsolicited inbound connections unless a port-forward or static mapping exists, which effectively acts as a default-deny boundary.

Signature-based detection limits

Signature detection matches known patterns with low false positives but cannot detect novel or heavily obfuscated attacks, because no matching pattern exists in the rule set yet.

SPAN port blind spots

A mirror port drops frames when mirrored traffic exceeds link capacity, so a saturated sensor misses packets. Absence of alerts on such a link is not evidence of absence of attack.

Beaconing detection signal

Periodic outbound connections at near-constant intervals with low jitter and consistent packet sizes suggest command-and-control beaconing rather than normal user-driven traffic patterns.

NetFlow versus packet capture

NetFlow records connection metadata such as addresses, ports, byte counts, and timestamps without payload. Full packet capture retains payload, enabling content-level analysis at much higher storage cost.

Syslog severity scale

Syslog levels run 0 emergency, 1 alert, 2 critical, 3 error, 4 warning, 5 notice, 6 informational, 7 debug. A lower number indicates a more severe event.

False positive versus negative

A false positive flags benign activity as malicious, wasting analyst time. A false negative misses malicious activity, allowing compromise. Tuning to reduce one often increases the other.

JA3 fingerprint use

JA3 hashes TLS client handshake parameters such as version, ciphers, and extensions. A rare or known-malicious JA3 identifies tooling even when payload traffic is encrypted.

Alert priority formula

Priority combines alert severity, asset criticality, and detection confidence. A medium-severity alert on a domain controller can outrank a high-severity alert on an isolated test machine.

Port scan pattern

One source contacting many destination ports, or many hosts, in a short window. Sequential scanning is noisy; randomized scanning evades simple thresholds but still shows breadth.

NIST incident response phases

Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity. Containment stops spread before eradication removes the cause, preserving evidence where possible.

Order of volatility

Collect most volatile evidence first: CPU registers and cache, then RAM, swap, network and process state, disk, remote logs, and archival media, because each decays or is overwritten faster.

Chain of custody

A documented record of who handled evidence, when, where, and how. Hash images at acquisition, verify before analysis, and work on copies to keep evidence admissible.

Containment tradeoffs

Isolating a host stops spread but may alert the attacker; disabling an account blocks access but destroys session evidence. The choice depends on whether monitoring or stopping the threat is the priority.

Atomic versus behavioral indicators

Atomic indicators such as IPs, domains, and hashes are easy for attackers to change and age quickly. Behavioral indicators describing techniques persist longer and map to MITRE ATT&CK.

MITRE ATT&CK purpose

A knowledge base of adversary tactics and techniques observed in real intrusions, organized by tactic. Analysts use it to map detections and identify coverage gaps.

Root cause analysis output

A statement of the underlying weakness or control failure that permitted the incident, distinct from the immediate trigger, plus corrective actions to prevent recurrence.

Breach notification clock

Regulatory deadlines such as GDPR's 72 hours run from the moment the organization becomes aware of a personal data breach, so discovery time must be documented precisely.

SOC tier structure

Tier 1 triages alerts and opens tickets; Tier 2 investigates and contains; Tier 3 performs hunting, malware analysis, and detection engineering. Escalation moves work up the tiers.

MTTD and MTTR

Mean time to detect measures elapsed time from event occurrence to alert, while mean time to respond or resolve measures from alert to closure. Both are reported against SLA targets.

Escalation trigger examples

Confirmed compromise of a critical asset, evidence of data exfiltration, ransomware behavior, or an incident exceeding the analyst's authority or SLA window warrants immediate escalation.

Incident report contents

Summary, UTC timeline, affected assets and data classification, root cause, containment and recovery actions, extracted indicators, and recommendations. Timestamps must be consistent and timezone-explicit.

Detection engineering loop

Form a hypothesis, validate data sources, author the rule, backtest against historical data, deploy, then tune on false positives and reassess coverage gaps in a repeating cycle.

Threat intelligence tiers

Strategic intelligence informs leadership on trends; operational covers campaigns and actor behavior; tactical supplies IOCs for tooling. Tactical indicators expire fastest and require frequent refresh.

Logging versus review evidence

An audit log proves an action occurred; a monitoring report proves logs were reviewed. Compliance audits typically require evidence of both collection and active review.