CIT Exam #3 Study guide

Vocabulary flashcards covering core cybersecurity concepts, networking, attack techniques, SOC operations, threat intelligence, digital forensics, and cryptography based on the Cybersecurity Fundamentals Study Plan.

IP addresses

Address used to identify a network interface for communication.

MAC addresses

Hardware/link-layer address used on local networks.

DNS

Domain Name System; translates domain names into IP addresses.

DHCP

Dynamic Host Configuration Protocol; automatically provides network configuration such as IP address, gateway, and DNS server.

Switches

Network devices that primarily connect devices within a local network.

Routers

Network devices that move traffic between networks.

NAT

Network Address Translation; translates addresses between private networks and public addressing, common in home networks.

TCP

Transmission Control Protocol; a connection-oriented transport protocol with reliability, ordering, and retransmission.

UDP

User Datagram Protocol; a connectionless transport protocol with less overhead, common for DNS, streaming, gaming, and latency-sensitive traffic.

Ports

Logical endpoints used by network services.

HTTP/HTTPS

Web communication protocols, where HTTPS adds security through TLS encryption and authentication.

Packets

Units of data sent across networks, containing source/destination IPs, ports, and payload data.

VPN

Virtual Private Network; an encrypted/tunneled connection used to protect or route traffic through another network.

CIA Triad

Confidentiality, Integrity, Availability—the basic goals of information security.

Authentication

The process that verifies identity.

Authorization

The process that determines what an authenticated identity is allowed to do.

Accounting/auditing

Tracking actions and events so activity can be reviewed and investigated.

Least privilege

Principle of giving users/processes only the access necessary to perform their tasks.

Defense in depth

Using multiple layers of security so one failed control does not expose everything.

Zero trust

Security model where users/devices are not automatically trusted based only on network location, requiring continuous verification and enforcement of access controls.

Threat

A potential source of harm.

Vulnerability

A weakness in a system or network.

Exploit

A method, code, or action that takes advantage of a weakness.

Risk

The potential impact and likelihood combination of a threat taking advantage of a vulnerability.

Phishing

Social engineering designed to trick users into revealing information, clicking links, opening files, or performing actions.

Malware

Malicious software, including broad categories such as trojans, worms, spyware, and ransomware.

Brute force

Repeatedly trying credentials or keys until one works.

Password spraying

Trying a small number of common passwords across many accounts to avoid triggering account lockouts.

Credential stuffing

Using stolen username/password pairs against other services.

SQL injection

Manipulating application input so unintended SQL commands are executed by a database.

XSS

Cross-Site Scripting; injecting malicious client-side script into content viewed by other users.

DDoS

Distributed Denial of Service; overwhelming a service with traffic or requests from many sources so legitimate users have difficulty accessing it.

Privilege escalation

Obtaining higher permissions than originally granted.

Lateral movement

Moving from one compromised system/account to other systems in an environment.

Firewall

A security device or software that controls network traffic according to predefined rules.

IDS

Intrusion Detection System; monitors activity and generates alerts on potentially malicious behavior.

IPS

Intrusion Prevention System; detects and can actively block or prevent suspicious traffic.

EDR

Endpoint Detection and Response; monitors endpoints and supports investigation and response to suspicious activity.

Logging

Recording events from systems, applications, endpoints, and network devices.

SIEM

Security Information and Event Management; centralizes and analyzes security-relevant logs/events, often correlating activity and generating alerts.

Alert triage

The process to determine whether an alert is benign, suspicious, or malicious and decide what needs investigation.

Incident response

A structured process for preparing for, detecting, containing, eradicating, and recovering from security incidents.

Threat hunting

Proactively searching for signs of malicious or suspicious activity rather than waiting for alerts.

IOC

Indicator of Compromise; observable evidence associated with potentially malicious activity, such as a suspicious hash, domain, IP, or file.

IOA

Indicator of Attack; behavior or activity suggesting an attack is occurring or being attempted.

TTPs

Tactics, Techniques, and Procedures describing what adversaries are trying to accomplish and how they operate.

Threat actor

A person, group, or organization associated with malicious cyber activity.

Campaign

A coordinated set of malicious activities connected by an objective or operation.

Threat intelligence

Collected and analyzed information used to understand threats and support security decisions.

MITRE ATT&CK

A knowledge base describing adversary tactics and techniques based on observed real-world behavior.

Digital evidence

Data that can help establish what happened during a security incident.

Windows event logs

An important source of endpoint activity and authentication information on Windows systems.

File artifacts

Files, metadata, timestamps, browser artifacts, and other traces that can reveal activity on a system.

Memory forensics

Analyzing volatile memory to identify processes, connections, credentials/artifacts, and other evidence.

Disk forensics

Analyzing stored data and filesystem artifacts.

Timeline analysis

Putting events in chronological order to reconstruct activity.

Chain of custody

Documenting how evidence was collected, handled, stored, and transferred.

Symmetric encryption

Cryptographic method that uses the same secret key to encrypt and decrypt data.

Asymmetric encryption

Cryptographic method that uses a public/private key pair for operations such as encryption and digital signatures.

Hashing

A one-way transformation commonly used for integrity checks and password storage (hashes are not encryption).

Salting

Adding unique random data before password hashing to make precomputed attacks harder.

Digital signatures

Cryptographic mechanisms using keys to provide authenticity/integrity and support non-repudiation concepts.

Certificates/TLS

Certificates help authenticate websites/servers, while TLS protects communications in transit.