Your FREE CySA+ Flashcards 2026 – 250+ Cards

Security Information and Event Management — collects and correlates logs across the enterprise to detect, investigate, and report on threats.

A forensic artifact (malicious IP/domain, file hash, registry key, beaconing) that signals a system may have been breached.

Detection that matches known patterns (hashes, rules, byte sequences). Precise on known threats but blind to novel ones.

Detection that flags deviations from a defined baseline of normal activity; catches unknown threats but needs a good baseline.

Detecting threats by modeling normal user, host, and network behavior and flagging deviations — finds insider and novel threats.

Detection that identifies threats by characteristics/rules of suspicious behavior rather than exact signatures.

User and Entity Behavior Analytics — uses machine learning to baseline normal behavior and detect anomalies like compromised accounts.

Evidence-based knowledge about adversaries — actors, their TTPs, and indicators — used to inform and improve defense.

The repeating process: planning & direction → collection → processing → analysis → dissemination → feedback.

High-level intelligence on trends and risk, aimed at executives and long-term decision-making.

Intelligence about specific campaigns and adversary operations, aimed at defenders.

Technical, immediate intelligence — IoCs and TTPs — consumed by security tools and analysts.

Tactics, Techniques, and Procedures — how an adversary operates; the most durable, hardest-to-change indicator.

An assessment of how reliable a piece of intelligence is, so consumers know how much to trust it.

A knowledge base of real-world adversary tactics (goals) and techniques (methods) used to map detections and drive threat hunting.

The proactive, hypothesis-driven search for adversaries that have evaded existing detections, before any alert fires.

The length of time an attacker remains undetected in an environment; threat hunting aims to reduce it.

Structured Threat Information Expression — a standardized language for representing and sharing cyber threat intelligence.

Trusted Automated Exchange of Intelligence Information — the protocol for transporting STIX threat-intelligence data.

Information Sharing and Analysis Center/Organization — communities that share threat intelligence among members.

Open-Source Intelligence — intelligence gathered from publicly available sources.

A model that removes implicit trust and verifies every request based on identity, device, and context — 'never trust, always verify.'

Secure Access Service Edge — converges networking (SD-WAN) and security (SWG, CASB, ZTNA, FWaaS) into one cloud-delivered service.

Dividing a network into zones to limit lateral movement and contain the blast radius of a compromise.

Software-Defined Networking — separates the network control plane from the data plane for centralized, programmable control.

Security Orchestration, Automation, and Response — automates and coordinates incident response via playbooks and tool integrations.

A documented, repeatable set of response steps for a given alert or incident type, often automated through SOAR.

Recording raw network traffic (e.g., with tcpdump or Wireshark) so analysts can inspect its contents and flow.

A graphical packet-capture and protocol-analysis tool used to inspect network traffic in detail.

A command-line packet-capture tool for recording and inspecting network traffic.

A protocol that records metadata about network flows (who talked to whom, when, how much) — useful for spotting beaconing and exfiltration.

Reviewing and correlating system, network, and application logs to detect, scope, and investigate suspicious activity.

Endpoint Detection and Response — continuously monitors endpoints to detect, investigate, and respond to threats.

Extended Detection and Response — correlates detection and response across endpoints, network, email, and cloud.

Sender Policy Framework — a DNS record listing the mail servers authorized to send email for a domain.

DomainKeys Identified Mail — a cryptographic signature on outbound email so receivers can detect tampering and forged senders.

Domain-based Message Authentication, Reporting & Conformance — ties SPF and DKIM together and tells receivers how to handle failures.

Examining headers (Received, Authentication-Results) to trace an email's path and verify SPF/DKIM/DMARC results.

A social-engineering attack using fraudulent messages to steal credentials, deliver malware, or trick users into actions.

A phishing attack targeted at a specific individual or organization, using personalized details.

A phishing attack that targets high-value executives such as a CEO or CFO.

Voice phishing — a social-engineering attack carried out over a phone call.

SMS phishing — a social-engineering attack delivered by text message.

An attack impersonating a trusted executive or vendor to authorize fraudulent payments or data transfers.

An attacker secretly relaying or altering traffic between two parties (formerly 'man-in-the-middle').

Distributed Denial of Service — overwhelming a target with traffic from many sources to make it unavailable.

Corrupting DNS resolution so victims are sent to attacker-controlled addresses.

Sending forged ARP messages to associate the attacker's MAC with a victim's IP, enabling interception on a LAN.

Periodic, regular network callbacks from a compromised host to a command-and-control server.

The channel and infrastructure an attacker uses to remotely control compromised systems.

Using legitimate, built-in system tools (e.g., PowerShell, WMI) to carry out an attack and evade detection.

Deliberately making code or data hard to understand to evade detection or analysis.

A pattern-matching syntax analysts use to search and filter logs and data.

An alert that flags benign activity as malicious — a source of analyst alert fatigue.

Desensitization caused by too many alerts (often from an untuned SIEM), risking missed real threats.

Running suspicious code in an isolated environment to observe its behavior safely.

Alerting when critical files change unexpectedly, indicating possible tampering.

Data Loss Prevention — tools that detect and block unauthorized movement of sensitive data.

Lockheed Martin's linear 7-stage intrusion model used to detect and disrupt attacks early.

An intrusion-analysis model linking four features of every event: adversary, capability, infrastructure, and victim.

Confidentiality, Integrity, Availability — the three core goals of information security.

Ensuring only authorized people can read data; enforced by encryption and access control.

Ensuring data is accurate and unaltered; enforced by hashing and digital signatures.

Ensuring authorized users can access data and systems when needed; enforced by redundancy and backups.

Identity and Access Management — the policies and tools that manage digital identities and control access.

Multi-factor authentication — requiring two or more factors from different categories (know, have, are).

Granting only the minimum access needed to perform a task, limiting the blast radius of a compromise.

Transforming data so only authorized parties with the key can read it; protects confidentiality.

Encryption using one shared secret key to both encrypt and decrypt (e.g., AES) — fast.

Encryption using a public/private key pair (e.g., RSA, ECC) for key exchange and digital signatures.

A one-way function producing a fixed-length digest (e.g., SHA-256); used for integrity, not reversible.

A decoy system that lures attackers away from real assets and records their behavior.

Fake data (a credential, record, or key) that signals compromise the moment it is used.

Malicious software — ransomware, trojans, worms, viruses, spyware, rootkits, and keyloggers.

Malware that hides deep in the system (often the kernel) to maintain stealthy, privileged access.

Malware disguised as legitimate software that performs a hidden malicious action when run.

An attacker moving from an initial foothold to other systems within the network.

Gaining higher access rights than granted — vertical (to admin) or horizontal (to another user).

Techniques an attacker uses to maintain access across reboots and credential changes.

Examining a host for malicious processes, persistence, and artifacts during detection or response.

Examining messages, attachments, and headers for phishing, spoofing, and malicious payloads.

Inspecting a file's properties, hash, and behavior to determine if it is malicious.

A reference profile of normal activity against which anomaly detection compares current behavior.

Reading Python, PowerShell, shell, or JavaScript snippets and regex to analyze and automate — not writing production code.

Connecting security tools through APIs and webhooks to share data and automate workflows.

Defining consistent processes and configurations to reduce error and enable automation.

Coordinating multiple security tools and tasks into a unified, often automated, workflow.

A standard protocol for forwarding log messages, commonly aggregated centrally by a SIEM.

The Windows logging system (Security, System, Application logs) analysts review for host activity.

A Windows system-monitoring tool that logs detailed process, network, and file events for analysis.

Linking events across multiple sources to reveal an attack that no single log shows alone.

A defined detection scenario with the logic and data sources needed to catch a specific threat.

Adjusting detection rules and thresholds to reduce false positives and surface true threats.

A stream of indicators (IPs, domains, hashes) consumed to enrich detection and hunting.

A model ranking indicators by how much disrupting them hurts an attacker — TTPs hurt most, hashes least.

Cloud Access Security Broker — enforces security policy between users and cloud services.

Zero Trust Network Access — grants per-application access based on identity and context, not network location.

Detecting logins from locations too far apart in time to be legitimate.

Common Vulnerability Scoring System — a 0.0–10.0 score (Base, Temporal, Environmental groups) rating a vulnerability's severity.

The intrinsic, constant severity: attack vector, attack complexity, privileges required, user interaction, scope, and CIA impact.

Severity factors that change over time: exploit code maturity, remediation level, and report confidence.

Severity tailored to your organization, including asset-value (CIA) requirements and modified base metrics.

None 0.0, Low 0.1–3.9, Medium 4.0–6.9, High 7.0–8.9, Critical 9.0–10.0.

A CVSS base metric describing how a vulnerability is exploited: Network, Adjacent, Local, or Physical.

A CVSS base metric for how hard the attack is to carry out beyond the attacker's control.

A CVSS base metric for the level of access an attacker needs before exploiting the flaw.

A CVSS base metric indicating whether exploiting the vulnerability impacts resources beyond its security scope.

Common Vulnerabilities and Exposures — a unique public identifier for one specific known vulnerability.

Common Weakness Enumeration — a catalog of software and hardware weakness types.

The continuous cycle of identifying, scanning, analyzing, prioritizing, remediating, validating, and reporting on vulnerabilities.

Inventorying and mapping the systems and services in an environment — the first step in vulnerability management.

The total set of points where an attacker could attempt to enter or extract data; reducing it is a core goal.

Continuously discovering, inventorying, and reducing an organization's exposed footprint.

Scanning that sends probes directly to targets — thorough but can disrupt fragile systems.

Identifying assets and issues by observing existing traffic without sending probes — non-disruptive but less complete.

A vulnerability scan that logs into the target — deeper, more accurate, fewer false positives.

A scan that probes only from the outside, like an unauthenticated attacker — a shallower, attacker's-eye view.

A scan run by software installed on the host; works offline and for roaming assets.

A scan run from the network with no software installed on the target.

A vulnerability scan run from inside the network perimeter.

A vulnerability scan run from outside the perimeter to show internet-facing exposure.

Static Application Security Testing — analyzing source code or binaries for flaws without running the application.

Dynamic Application Security Testing — testing a running application from the outside for exploitable flaws.

Scanning an application's third-party and open-source components for known vulnerabilities and license risk.

Scanning infrastructure-as-code templates for misconfigurations before deployment.

Widely used vulnerability scanners that identify and report known vulnerabilities across assets.

A reported vulnerability that is not actually present or exploitable; must be validated before acting.

A real vulnerability the scanner failed to report — the more dangerous error.

A correctly reported, confirmed vulnerability that proceeds to prioritization and remediation.

Confirming a finding is real and exploitable — via manual checks, correlating tools, and verifying the configuration.

Ranking vulnerabilities by combining CVSS with asset value, exposure, criticality, and active exploitation.

A vulnerability unknown to the vendor with no patch available, leaving 'zero days' to fix it before exploitation.

How feasible it is to exploit a vulnerability, including whether a working exploit exists in the wild.

Turning a vulnerability into a usable exploit or payload.

An alternative safeguard used when the primary control (e.g., a patch) cannot be applied, to reduce residual risk.

The process of acquiring, testing, and applying updates to remediate vulnerabilities.

Inserting malicious SQL into input so the database runs unintended commands. Fix: parameterized queries + input validation.

Injecting script into a trusted site that runs in another user's browser. Fix: output encoding + Content Security Policy.

Missing or flawed authorization checks. Fix: enforce least privilege and deny by default.

Weak or missing encryption of sensitive data. Fix: strong algorithms, proper key management, and TLS.

Writing more data than a buffer holds, overwriting adjacent memory. Fix: bounds checking, ASLR/DEP, secure coding.

Corrupting the training data of a machine-learning model so it behaves incorrectly.

Processing untrusted serialized data unsafely, potentially allowing code execution.

Service-Level Objective — a target timeframe for remediating vulnerabilities by severity.

Systematically identifying potential threats and weaknesses in a design so they can be mitigated early.

Building security into every phase of the software development lifecycle.

OWASP's regularly updated list of the most critical web-application security risks.

A compact text encoding of a vulnerability's CVSS metrics (e.g., AV:N/AC:L/PR:N) used to compute the score.

A CVSS base metric for whether exploitation requires a user to take some action.

A CVSS base metric rating the loss of confidentiality if the vulnerability is exploited.

Once a patch is released, an unpatched flaw is an 'n-day' — still dangerous on unpatched systems.

A vulnerability is a weakness; an exploit is the code or technique that takes advantage of it.

A vulnerability is a weakness; a threat is a potential danger that could exploit it.

The potential for loss when a threat exploits a vulnerability; a function of likelihood and impact.

An insecure default or setting (e.g., open cloud storage) — a leading cause of breaches; fix with secure baselines.

Unchanged factory usernames/passwords that attackers easily abuse; a common scan finding.

Reducing a system's attack surface by removing unneeded services, applying secure baselines, and patching.

A defined, minimum-security configuration applied consistently across systems.

Validating a patch in a controlled environment before deploying it broadly to avoid breakage.

Ranking remediation by real-world risk (exposure, exploitability, asset value), not raw CVSS alone.

Eliminating a vulnerability by patching, reconfiguring, or replacing the affected component.

Reducing the likelihood or impact of a vulnerability when full remediation isn't possible.

A tool that tests web apps for flaws like injection, XSS, and misconfiguration.

A tool that probes networked hosts and services for known vulnerabilities.

An attack that accesses files outside the intended directory via crafted path input ('../').

Cross-Site Request Forgery — tricking a logged-in user's browser into submitting an unwanted request.

A flaw where timing between a check and use (TOCTOU) can be exploited.

Server-Side Request Forgery — coercing a server into making requests to unintended internal resources.

The gradual accumulation of access rights a user no longer needs; reduced by access reviews.

Sequencing patches by severity, exposure, and exploitability rather than applying all at once.

How important an asset is to the business; a key factor in prioritizing its vulnerabilities.

Whether a vulnerable asset is reachable (e.g., internet-facing); raises real-world risk.

How often scans run; continuous or frequent scanning catches new vulnerabilities sooner.

Scanning again after remediation to confirm the vulnerability is actually closed.

The National Vulnerability Database — the U.S. government repository of CVEs and CVSS data.

An authorized simulated attack that exploits weaknesses to demonstrate real-world impact.

A program that pays external researchers to responsibly disclose vulnerabilities.

NIST's four phases: preparation; detection & analysis; containment, eradication & recovery; post-incident activity.

Building the team, tools, playbooks, training, logging, and communication plan before an incident occurs.

Identifying and validating an incident from IoCs, SIEM alerts, and logs, then determining its scope and impact.

Limiting the spread and impact of an incident (e.g., isolating a host) — usually the first action in a live incident.

Removing the threat — malware, attacker footholds, compromised accounts — from the environment.

Restoring affected systems to normal operation from known-good, tested backups and monitoring for reinfection.

Lessons learned, root cause analysis, IoC generation, and reporting that feed back into preparation.

Determining the underlying reason an incident occurred so the same issue can be prevented from recurring.

The post-incident review that captures what went well and what to improve for next time.

Establishing how far an incident reaches — which systems, accounts, and data are affected.

Collecting data relevant to an incident in a forensically sound manner.

Protecting collected evidence from alteration so it remains reliable and admissible.

The documented, unbroken record of who handled evidence and when — to keep it admissible.

Collecting evidence most-volatile-first (CPU/RAM, network state) before less-volatile data (disk, archives).

A bit-for-bit copy of storage made for analysis so the original evidence is never altered; verified with a hash.

A device or software that prevents any writes to evidence media during forensic acquisition.

Computing a hash of evidence to prove it has not changed; the same hash means an exact, unaltered copy.

A directive to preserve relevant data when litigation or an investigation is anticipated.

Analyzing a captured copy of RAM to find running malware, network connections, and artifacts not on disk.

Analyzing storage media (from a forensic image) for files, deleted data, and artifacts.

Reconnaissance, weaponization, delivery, exploitation, installation, command & control, and actions on objectives.

The first kill-chain stage: gathering information about the target before attacking.

Coupling an exploit with a deliverable payload (e.g., a malicious document).

The final kill-chain stage where the attacker achieves their goal (e.g., data theft or destruction).

Adversary, capability, infrastructure, and victim — the four core features linked in each intrusion event.

Using one known fact about an intrusion (e.g., an IP) to discover related facts, often via the Diamond Model.

A column in the ATT&CK matrix representing an attacker's goal (e.g., persistence, exfiltration).

A specific method an attacker uses to achieve a tactic (e.g., a particular persistence mechanism).

Open Worldwide Application Security Project — a community producing resources like the OWASP Top 10.

The formal decision that an event is a security incident, triggering the response process.

Routing an incident to higher-tier responders or management based on severity and predefined criteria.

The plan defining who is informed, how, and when during an incident — internal and external.

A discussion-based drill that walks a team through an incident scenario to test the plan and readiness.

Evidence of an attack in progress based on intent/behavior, as opposed to a backward-looking IoC.

Malware that encrypts data and demands payment; recover from tested backups rather than paying.

Choosing between isolation, segmentation, or removal based on impact, evidence needs, and business continuity.

Disconnecting an affected system from the network to stop an incident from spreading.

Restricting affected systems to a network segment to limit an incident while preserving some operation.

A documented set of response steps for a specific incident type, ensuring a consistent response.

Computer Security Incident Response Team — the group responsible for handling incidents.

Confirming the threat and its persistence are fully removed before returning systems to service.

An individual or group that carries out an attack — nation-state, organized crime, hacktivist, insider, or unskilled.

A highly sophisticated, well-resourced adversary (APT) usually motivated by espionage or strategic disruption.

Advanced Persistent Threat — a skilled, well-resourced adversary that maintains long-term, stealthy access.

A current or former employee, contractor, or partner who misuses authorized access to cause harm.

A threat actor motivated by an ideological cause rather than profit.

Observable signs of an incident — from IoCs and IoAs to anomalies in logs and behavior.

A chronological reconstruction of an incident's events, essential for root cause and reporting.

Failing to bound an investigation, leading to wasted effort; scope determination prevents it.

The correct sequence of response actions; getting it wrong can destroy evidence.

Rebuilding a compromised host from a known-good image to ensure no attacker artifacts remain.

A verified, uncompromised backup used to restore systems during recovery.

Unauthorized transfer of data out of an organization — a common attacker objective.

Identifying C2 channels (beaconing, unusual destinations) during analysis.

Mean Time to Detect — the average time from when an incident begins to when it is detected.

Mean Time to Respond/Remediate — the average time to contain and resolve an incident or remediate a vulnerability.

Mean Time to Acknowledge — the average time from an alert to a responder acknowledging it.

Mean Time to Contain — the average time to stop an incident from spreading once it is detected.

Key Performance Indicator — a measurable value (e.g., MTTD, MTTR, recurrence) showing how a program performs.

A metric tracking how often the same vulnerability or incident type reappears.

A report of the most frequent or highest-risk vulnerabilities, used to focus remediation.

A combined measure of a finding's likelihood and impact used to prioritize and communicate risk.

Anyone who needs incident or vulnerability information — technical teams, executives, legal, HR, PR, customers, or regulators.

Determining who must receive which information so the right message reaches the right audience.

A report demonstrating that vulnerability or security posture meets a regulatory or contractual requirement.

A report pairing each finding with an owner, remediation steps, and a realistic timeline.

A real-world constraint (MOU/SLA, business interruption, legacy system, downtime cost) that delays or prevents a fix.

Memorandum of Understanding — a non-binding agreement outlining mutual intentions between parties.

Service Level Agreement — a contract defining expected service levels and metrics with a provider.

An inhibitor where patching requires downtime the business cannot yet absorb.

An inhibitor where a fix breaks a needed feature or integration.

An older or proprietary system with no available patch — mitigate with compensating controls.

The remaining risk an organization knowingly and formally accepts after applying controls.

Producing new IoCs from an incident so detection can be improved going forward.

A document summarizing what happened, impact, timeline, root cause, response, and lessons learned.

A concise, business-focused overview of an incident or assessment for leadership.

A detailed report for responders covering timeline, affected systems, root cause, and remediation.

A required disclosure to regulators and affected individuals after a data breach, within set timeframes.

A visual summary of security KPIs (MTTD, MTTR, open vulnerabilities) for ongoing monitoring.

Tracking metrics over time to show whether the security program is improving or declining.

Adjusting a report's depth and framing for its audience — risk for executives, detail for technical teams.

The policies and oversight structures that direct how vulnerabilities and incidents are reported and handled.

A report communicating findings, severity, affected assets, and remediation guidance to stakeholders.

A realistic schedule for fixing findings that accounts for inhibitors and SLOs.

The person or team accountable for remediating a specific finding.

Predefined thresholds that determine when to notify higher tiers or management.

A table mapping stakeholders to what information they receive and through which channel.

Disclosing incidents or compliance status to regulators as required by law or contract.

Coordinated external messaging about an incident to customers and the public.

Counsel involved to manage liability, evidence, and breach-notification obligations.

Human Resources, engaged when an incident involves an employee (e.g., insider threat).

Informing affected customers of a breach within legally required timeframes.

Improving MTTD/MTTR and recurrence over time as a sign of a maturing security program.

Feeding lessons learned and generated IoCs back into detection and preparation.

A documented list of risks with owner, likelihood, impact, and treatment, referenced in reports.

Compliance proves a standard is met; security reduces actual risk — they overlap but aren't identical.

Including verified facts and, where needed, forensic findings (with chain of custody) to support conclusions.