TCTCN key terms

A seven-layer framework describing how data moves from an application on one host to an application on another, separating functions such as addressing, routing, and physical transmission into distinct layers.

A four-layer model (link, internet, transport, application) describing how data is packaged and delivered across interconnected networks; it reflects how the internet actually operates in practice.

The process of wrapping data with protocol headers as it moves down the stack, so each layer adds the information its peer needs to deliver and interpret the payload.

A way of writing an IP address with its prefix length, such as 192.0.2.0/24, where the number after the slash states how many leading bits identify the network.

A logical grouping of switch ports or devices that behaves like a separate broadcast domain on shared physical hardware, used to segment traffic and apply distinct policies.

The router address a host sends traffic to when the destination is not on its own local subnet; without a correct gateway, off-subnet communication fails.

A list of destination networks paired with the next hops or interfaces used to reach them; routers consult it to decide where to forward each packet.

A technique that rewrites source or destination IP addresses as packets cross a boundary, commonly letting many private hosts share one public address.

A protocol that automatically supplies hosts with an IP address, subnet mask, default gateway, and DNS servers, reducing manual configuration errors and address conflicts.

A hierarchical naming system that maps human-readable names to IP addresses and other records, letting users and applications locate services without hardcoding addresses.

A protocol used on local IPv4 networks to discover the hardware address associated with a known IP address before frames can be delivered on the link.

The largest packet or frame payload a link can carry in one piece; mismatches cause fragmentation or dropped traffic, especially over tunnels and encrypted paths.

A set of mechanisms that classify and prioritize traffic so latency-sensitive or business-critical flows keep acceptable service when the network is congested.

The time a packet takes to travel from source to destination, including propagation, serialization, queuing, and processing delays; it strongly affects interactive application performance.

A device or software function that permits or blocks traffic based on rules about addresses, ports, protocols, or application content, enforcing a boundary between trust zones.

A segmented network hosting services reachable from untrusted networks while keeping them separated from internal systems, limiting damage if a public-facing host is compromised.

An encrypted tunnel between sites or between a user and a network that carries traffic over an untrusted medium while preserving confidentiality and, usually, authenticating both ends.

Systems that inspect traffic for known attack patterns or anomalies; an intrusion detection system only alerts, while an intrusion prevention system can also block offending traffic inline.

The combined processes of authenticating who a user is, authorizing what they may do, and accounting for what they did, typically through a central server such as RADIUS or TACACS+.

Requiring two or more independent evidence types, something you know, have, or are, before granting access, which reduces the impact of a stolen or guessed password.

A signed data structure binding a public key to an identity, issued by a certificate authority so relying parties can verify authenticity and detect tampering.

An asymmetric scheme using a key pair, where one key encrypts or signs and the other decrypts or verifies, easing key distribution and enabling digital signatures.

A protocol that encrypts and authenticates application traffic such as HTTPS, negotiating session keys and verifying the server certificate before data is exchanged.

A security model that grants access per request based on identity, device posture, and context rather than assuming anything inside the network perimeter is automatically safe.

Granting each user, service, or process only the access needed to perform its task and nothing more, which shrinks the blast radius of mistakes and compromised accounts.

Designing systems so services remain accessible despite component failures, usually through redundancy, health checks, and automatic failover with minimal downtime.

The automatic or manual shift of traffic or workload from a failed component to a standby one so that service continues with limited interruption.

Distributing incoming requests across multiple servers to improve responsiveness, avoid overload, and keep service running when individual nodes fail.

Duplicating critical components, links, or paths so a single failure does not interrupt service; redundancy fails to help when the copies share a common point of failure.

The maximum acceptable time to restore a service after a disruption; it drives choices about standby capacity, replication method, and recovery procedures.

The maximum acceptable amount of data loss measured in time; it determines how frequently backups or replication must run to meet the business requirement.

A controlled process for requesting, reviewing, approving, and recording changes to production systems so risk, dependencies, and rollback plans are examined before implementation.

Forecasting future demand for bandwidth, storage, and compute, then provisioning resources ahead of need so performance targets are met without wasteful overbuilding.

The arrangement of links and nodes in a network, such as star, mesh, or hub-and-spoke, which determines path redundancy, cost, and failure behavior.

An architecture that separates network control logic from forwarding devices, letting a centralized controller program traffic behavior through interfaces instead of per-device configuration.

A platform that collects and correlates logs and events from many sources to detect suspicious activity, support investigations, and retain evidence for compliance.

A structured sequence of preparation, detection, containment, eradication, recovery, and lessons learned used to handle security events and limit their damage.

The practice of identifying, testing, and deploying software updates that fix vulnerabilities and bugs, on a defined schedule or when urgent risk appears.

A documented, approved set of settings for a system that serves as the reference for detecting drift and for rebuilding or auditing that system consistently.