Free CySA+ Exam Flashcards

A platform that aggregates, normalizes, and correlates log and event data from many sources for detection, alerting, and investigation. Combines SIM (log retention/reporting) and SEM (real-time monitoring/correlation). It surfaces patterns no single log shows alone.

The log collector/forwarder ingests raw logs and normalizes them into a common schema. The correlation engine then applies rules across normalized events to detect multi-step activity. Bad parsing at the collector means the correlation engine never sees the attack.

A standardized logging protocol for network devices and Unix/Linux hosts using priority, timestamp, hostname, and message fields. It is the most common cross-vendor log format, which is why SIEMs ingest it natively. Compare with Windows Event Log for hosts.

True positive: an alert that reflects real malicious activity. False positive: an alert on benign activity (causes alert fatigue). False negative: real malicious activity that produced no alert - the most dangerous because it goes uninvestigated.

Adjusting rule thresholds, exclusions, and logic to reduce false positives without creating false negatives. Done by analyzing alert history and baselining normal behavior. Over-tuning silences alerts and creates blind spots; under-tuning buries analysts in noise.

User and Entity Behavior Analytics builds a baseline of normal behavior, then flags deviations (anomalies) instead of matching known signatures. Strong against insider threats and novel attacks; weak when the baseline itself includes malicious activity.

Automates repetitive SOC work through playbooks that orchestrate tools (enrich an IOC, isolate a host, open a ticket) without manual steps. Reduces mean time to respond. Compare with XDR, which unifies detection telemetry rather than automating workflow.

Correlates and analyzes telemetry across endpoint, network, cloud, and identity in one platform for unified detection and response. Broader than EDR (endpoint only). XDR focuses on cross-domain detection; SOAR focuses on automating the response workflow.

Continuously monitors endpoints, records process/file/registry activity, and enables response actions like host isolation and rollback. Goes beyond signature antivirus by capturing behavior for hunting and forensics. Endpoint-scoped; broaden with XDR.

Proactively searching for adversaries that evaded existing controls, driven by a hypothesis (e.g., 'an attacker is using scheduled tasks for persistence'). It is hypothesis-led, not alert-led. Hunting finds the false negatives monitoring missed.

A forensic artifact suggesting a host or network is compromised: file hash, malicious IP/domain, registry key, mutex, or unusual outbound traffic. IOCs are reactive evidence of a known threat. Contrast with IOAs, which describe attacker behavior.

An IOA describes attacker behavior/intent in progress (e.g., credential dumping then lateral movement) and can catch unknown malware. An IOC is a static artifact of a known compromise. IOAs detect earlier; IOCs confirm and scope after the fact.

Strategic: high-level trends and adversary motivations for leadership. Operational: details of specific campaigns/actors. Tactical: TTPs analysts use to build detections. Technical: short-lived IOCs (hashes, IPs). Audience and shelf life differ by level.

Nation-state/APT (well-resourced, stealthy, long dwell), organized crime (financially motivated, ransomware), hacktivist (ideological, often disruptive/defacement), insider (legitimate access), and script kiddie (low skill, opportunistic). Motivation drives expected TTPs.

STIX is the standardized language/format for describing cyber threat intelligence; TAXII is the transport protocol used to share STIX data between systems and feeds. STIX = what the intel says; TAXII = how it travels. Used together for automated sharing.

Intel should carry a confidence rating and a source reliability assessment before you act on it. Acting on low-confidence indicators causes false positives and wasted response; ignoring high-confidence intel causes missed compromise. Always weigh source quality.

Ranks indicators by how much it hurts an adversary to change them: hash values (trivial) < IP < domain < network/host artifacts < tools < TTPs (hardest). Detecting at the TTP level forces attackers to change their playbook, not just an indicator.

A knowledge base of real-world adversary tactics (the 'why', e.g., Persistence, Lateral Movement) and techniques (the 'how'). Used to map detections, find coverage gaps, and describe an intrusion. ATT&CK is post-compromise behavior; contrast with the kill chain.

Lockheed Martin's 7 sequential stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives. Linear and defender-focused on breaking the chain early. ATT&CK is non-linear and behavior-focused.

Models an intrusion event with four linked vertices: adversary, capability, infrastructure, and victim. Pivoting from one vertex (e.g., a known C2 domain) reveals others. Best for analyzing relationships and attribution, not for a step-by-step timeline.

A counterpart to ATT&CK that catalogs defensive countermeasures and maps them to the offensive techniques they mitigate. Use it to answer 'what defense addresses this technique?' rather than 'what did the attacker do?'

Identify, Protect, Detect, Respond, Recover (CSF 2.0 adds Govern). A risk-based structure for organizing a security program and communicating posture to leadership. It is a program framework, not an incident-response playbook like SP 800-61.

Vulnerability: a weakness. Threat: something that could exploit it. Exploit: the actual code/method that uses the weakness. Risk: the likelihood and impact of a threat exploiting a vulnerability. Risk = the prioritized concern; the others are inputs to it.

An authenticated scan logs into the host and sees patch levels, configs, and local issues - far more accurate, fewer false positives. An unauthenticated scan only sees what's exposed to the network (an attacker's external view). Use credentialed scans for patch posture.

Active scanning sends probes/packets to systems - thorough but can disrupt fragile hosts (OT/ICS, legacy). Passive scanning observes network traffic with no probing - safe for sensitive environments but only finds what communicates. Choose by environment risk tolerance.

Scanners flag issues that may not be exploitable (false positive) or miss real ones (false negative). Always validate findings before remediation - confirm the vulnerability exists and is reachable. Acting on unvalidated output wastes effort and erodes trust in the program.

A 0.0-10.0 standardized severity score. Bands: None 0.0, Low 0.1-3.9, Medium 4.0-6.9, High 7.0-8.9, Critical 9.0-10.0. It rates technical severity, not business risk - a Critical CVSS on an isolated test box may be low priority in context.

Base: intrinsic, unchanging severity (attack vector, complexity, impact). Temporal: changes over time (exploit maturity, remediation availability). Environmental: tailors the score to your organization's asset value and controls. Always contextualize Base with Environmental.

Network (remote, internet-reachable) is the most severe and highest priority; Adjacent requires same subnet/segment; Local requires existing access; Physical requires hands-on the device. Prioritize network-exploitable findings on exposed assets first.

CVE: a unique ID for a specific known vulnerability instance. CWE: a category of weakness type (e.g., CWE-79 cross-site scripting). CPE: a standardized naming scheme for platforms/products. CVE = the bug, CWE = the bug class, CPE = the affected product.

Rank remediation by CVSS plus asset criticality, data sensitivity, exposure, and active exploitation (e.g., CISA KEV / EPSS likelihood) - not by raw score alone. An exploited Medium on an internet-facing crown-jewel outranks a Critical on an air-gapped lab box.

A flaw unknown to the vendor with no patch available, so signature defenses fail. Mitigate with compensating controls: virtual patching/WAF, segmentation, least privilege, and behavioral detection until a fix ships. Patch management alone cannot address it.

Remediation fully fixes the issue (patch/upgrade). Mitigation reduces likelihood/impact without fixing it. A compensating control is an alternate safeguard when the fix isn't feasible. Risk acceptance is a documented, approved decision to live with residual risk.

A remediation SLA defines the required fix timeframe by severity (e.g., Critical in days, Low in months). A maintenance window is the approved change window to apply fixes safely. Patching outside change control can cause outages; missing the SLA leaves exposure.

Continuously discovering, inventorying, and reducing all points an attacker could target - external services, shadow IT, exposed APIs, and cloud assets. You cannot protect or scan assets you don't know exist; unknown internet-facing assets are a top breach cause.

Scan container images for vulnerable libraries and misconfigurations before deployment, and keep scanning in the registry/runtime. A vulnerable base image multiplies risk across every container built from it. Image scanning differs from host scanning - shift it left.

Four phases: (1) Preparation, (2) Detection and Analysis, (3) Containment, Eradication, and Recovery, (4) Post-Incident Activity. It is a cycle - lessons learned feed back into preparation. Most exam errors come from doing steps out of order.

Short-term containment stops the bleeding fast (isolate/disconnect a host). Long-term containment applies durable changes (rebuild, patch, segment) while you prepare eradication. Contain before eradicating - eradicating first can destroy evidence and tip off the attacker.

Eradication removes the threat: delete malware, disable breached accounts, close the entry vector. Recovery restores systems to normal and validated operation with monitoring. Recovering before full eradication reinfects the environment.

Collect evidence from most to least volatile: CPU registers/cache, RAM and running state, network connections, disk, then logs/backups/archival media. Powering off or imaging disk first destroys memory-resident artifacts like injected code and encryption keys.

A documented record of who collected, accessed, transferred, and stored each piece of evidence, with timestamps and hashes. Breaks in the chain make evidence inadmissible and undermine attribution. Required even if prosecution seems unlikely.

Work from a bit-for-bit forensic image, never the original. A write blocker prevents accidental modification of the source media. Hash (e.g., SHA-256) the source and image and confirm they match to prove the copy is unaltered. Investigating the live original spoils evidence.

Capturing and analyzing RAM reveals running processes, injected code, network sockets, decrypted data, and credentials that never touch disk. Essential for fileless and in-memory malware. Must be captured before shutdown - it is the most volatile evidence.

Determining the underlying reason an incident occurred (e.g., an unpatched VPN gateway), not just the symptom. Without RCA, the same incident recurs. RCA output drives lessons learned and concrete preventive actions in post-incident activity.

A structured review after recovery to capture what worked, what failed, and improvements - feeding back into the Preparation phase. Hold it promptly while details are fresh; focus on process improvement, not blame. Skipping it guarantees repeat incidents.

Classify incidents by impact and scope (e.g., functional/informational impact, data sensitivity, recoverability) to drive escalation, resourcing, and notification. Misclassifying low keeps a major breach under-resourced; over-classifying drains the team and credibility.

Technical teams need IOCs, affected assets, and remediation steps. Executives/board need business impact, risk, cost, and decisions required - not packet captures. Same incident, different abstraction. The wrong altitude of detail loses the audience and delays action.

Mean Time To Detect measures how long a threat goes unnoticed; Mean Time To Respond/Recover measures how fast it is contained and resolved. Trending them shows SOC effectiveness over time. A single number without a trend or baseline is not actionable.

Breaches involving regulated data trigger mandatory notifications with strict timelines (e.g., GDPR generally 72 hours to the supervisory authority). Reporting must satisfy legal/compliance requirements, not just internal needs. Missing a deadline adds regulatory penalties to the incident.

Reports must tie every finding and recommendation to evidence (logs, scan output, scoring rationale) and a clear action owner. Vague, unsupported claims erode trust and stall remediation; an auditable, prioritized report drives funded, accountable fixes.