Free Google Cybersecurity Certificate Exam Flashcards

The foundational model of cybersecurity consisting of three principles: Confidentiality (protecting sensitive information from unauthorized access), Integrity (ensuring data is accurate and unaltered), and Availability (ensuring systems and data are accessible when needed). Security professionals use this framework to assess threats and implement appropriate controls.

An entry-level cybersecurity professional responsible for monitoring networks, investigating security alerts, and protecting organizational assets. Daily tasks include analyzing logs, responding to incidents, conducting vulnerability assessments, and implementing security tools. The Google Cybersecurity Certificate prepares learners for this role.

Guidelines and best practices that organizations use to manage security risks and protect assets. Common frameworks include NIST Cybersecurity Framework (CSF), ISO 27001, and CIS Controls. Frameworks help establish security baselines, ensure compliance, and provide structured approaches to implementing security controls.

Safeguards designed to reduce specific security risks. Controls are categorized as technical (encryption, firewalls), operational (security awareness training, incident response procedures), and managerial (risk assessments, security policies). Effective security requires implementing layered controls across all categories.

The process of adhering to internal standards, external regulations, and laws related to data protection and security. Examples include HIPAA for healthcare data, PCI-DSS for payment card information, and GDPR for EU personal data. Non-compliance can result in fines, legal action, and reputational damage.

Principles guiding professional conduct in cybersecurity, including confidentiality, honesty, and responsible disclosure. Security professionals have access to sensitive systems and data, making ethical behavior critical. Unethical actions can lead to legal consequences, job loss, and damage to the profession.

A critical thinking approach where security professionals constantly evaluate potential threats and vulnerabilities. This involves questioning assumptions, anticipating attack vectors, and thinking like an adversary. Developing this mindset helps identify security gaps before malicious actors can exploit them.

Eight areas of cybersecurity expertise defined by ISC2: Security and Risk Management, Asset Security, Security Architecture, Communication and Network Security, Identity and Access Management, Security Assessment and Testing, Security Operations, and Software Development Security. Understanding these domains provides a comprehensive view of the security field.

Rules governing how data is transmitted across networks. TCP/IP is the foundational protocol suite for internet communication. HTTP/HTTPS handles web traffic, DNS translates domain names to IP addresses, and DHCP automatically assigns IP addresses. Understanding protocols is essential for analyzing network traffic and detecting anomalies.

A network security device that monitors and filters incoming and outgoing traffic based on defined security rules. Firewalls can be hardware-based, software-based, or cloud-based. They create a barrier between trusted internal networks and untrusted external networks, blocking malicious traffic while allowing legitimate communication.

A technology that creates an encrypted tunnel for secure data transmission over public networks. VPNs protect data confidentiality and integrity when accessing corporate resources remotely or using public WiFi. They mask the user's IP address and encrypt all traffic between the client and VPN server.

The practice of capturing and analyzing network packets to monitor traffic or troubleshoot issues. Security analysts use tools like Wireshark and tcpdump for legitimate purposes. However, attackers use packet sniffing to intercept sensitive data like credentials on unencrypted networks, making encryption essential.

Dividing a network into smaller, isolated sections to limit the spread of attacks and control access. If one segment is compromised, attackers cannot easily move to other segments. This is implemented using VLANs, subnets, and firewalls, following the principle of least privilege for network access.

A seven-layer conceptual framework describing how data moves through networks: Physical, Data Link, Network, Transport, Session, Presentation, and Application. Security analysts use this model to understand where attacks occur and which controls apply. For example, firewalls typically operate at layers 3-4, while WAFs work at layer 7.

A four-layer model describing internet communication: Network Access (physical transmission), Internet (IP addressing and routing), Transport (TCP/UDP for reliable/unreliable delivery), and Application (user-facing protocols). Understanding TCP/IP is essential for analyzing network traffic, configuring firewalls, and troubleshooting connectivity issues.

An intermediary server that sits between clients and the internet, forwarding requests on behalf of users. Proxies can filter content, cache data, and hide client IP addresses. Security teams use proxies to monitor web traffic, enforce acceptable use policies, and block access to malicious websites.

The process of securing network infrastructure by reducing vulnerabilities and attack surfaces. This includes disabling unnecessary services, closing unused ports, implementing strong encryption, updating firmware, using secure protocols, and configuring proper access controls. Regular hardening reviews help maintain network security.

A text-based interface for interacting with Linux operating systems. Security analysts use the command line for tasks like navigating file systems (cd, ls, pwd), managing files (cp, mv, rm), viewing file contents (cat, head, tail), and searching (grep, find). Command line proficiency is essential for security operations and automation.

A system controlling read (r), write (w), and execute (x) access for three categories: owner, group, and others. Permissions are displayed as a 10-character string (e.g., -rwxr-xr--) or numeric notation (e.g., 754). The chmod command modifies permissions. Proper permission management prevents unauthorized access to sensitive files.

A programming language for managing and querying relational databases. Security analysts use SQL to query security logs, investigate incidents, and extract relevant data. Basic commands include SELECT (retrieve data), FROM (specify table), WHERE (filter results), and JOIN (combine tables). SQL skills are essential for log analysis.

Using WHERE clauses and operators to retrieve specific data from databases. Common operators include = (equals), <> (not equal), LIKE (pattern matching with %), AND/OR (combining conditions), and BETWEEN (range). Security analysts filter logs to find specific events, time ranges, or suspicious activities during investigations.

Different versions of Linux operating systems built on the Linux kernel. Security-focused distributions include Kali Linux (penetration testing tools), Ubuntu (user-friendly), CentOS/RHEL (enterprise servers), and Parrot OS (security auditing). Each distribution has different package managers, configurations, and use cases.

The root user has unrestricted administrative access to a Linux system. The sudo command allows regular users to execute commands with root privileges temporarily. Security best practices include avoiding direct root login, using sudo for specific commands, and logging all sudo usage for accountability.

The hierarchical organization of files in Linux. Key directories include / (root), /home (user files), /etc (configuration files), /var (variable data like logs), /bin (essential binaries), and /tmp (temporary files). Understanding directory structure helps security analysts locate logs, configurations, and potential indicators of compromise.

A Linux command for searching text patterns within files or output. Syntax: grep [pattern] [file]. Common options include -i (case insensitive), -r (recursive search), and -v (invert match). Security analysts use grep extensively to search through logs, find specific error messages, or identify suspicious patterns.

Anything of value that an organization needs to protect, including hardware (servers, laptops), software (applications, operating systems), data (customer information, intellectual property), and people. Asset management involves inventorying, classifying, and prioritizing assets based on their value and sensitivity to guide security decisions.

Any circumstance or event with the potential to harm assets through unauthorized access, destruction, disclosure, or denial of service. Threats can be internal (disgruntled employees) or external (hackers, nation-states), intentional (cyberattacks) or unintentional (accidents), and natural (disasters) or human-made.

A weakness that can be exploited by threats to gain unauthorized access or cause harm. Vulnerabilities exist in software (unpatched systems), hardware (outdated firmware), processes (weak procedures), and people (susceptibility to social engineering). Vulnerability management involves identifying, assessing, and remediating weaknesses.

The possibility of a threat exploiting a vulnerability to cause harm. Risk is calculated by considering the likelihood of an event and its potential impact. Risk management strategies include acceptance (tolerate risk), avoidance (eliminate risk source), transfer (insurance), and mitigation (reduce likelihood or impact).

A systematic process for identifying potential threats and vulnerabilities in systems or applications. Common frameworks include STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) and PASTA (Process for Attack Simulation and Threat Analysis). Threat modeling helps prioritize security efforts.

Manipulation techniques that exploit human psychology to gain unauthorized access or information. Common attacks include phishing (fraudulent emails), pretexting (fabricated scenarios), baiting (malware-infected devices), and tailgating (following authorized personnel). Security awareness training is the primary defense against social engineering.

Malicious software designed to damage, disrupt, or gain unauthorized access to systems. Types include viruses (self-replicating), worms (spread without user action), trojans (disguised as legitimate software), ransomware (encrypts data for payment), and spyware (monitors user activity). Antivirus and endpoint detection help prevent malware.

The practice of securing information by transforming it into an unreadable format. Encryption protects data confidentiality, hashing ensures integrity, and digital signatures provide authentication and non-repudiation. Security analysts must understand symmetric encryption (AES), asymmetric encryption (RSA), and common hashing algorithms (SHA-256).

Authentication verifies identity (confirming who you are) through credentials like passwords, biometrics, or tokens. Authorization determines what authenticated users can access (confirming what you can do) based on permissions and policies. Both are essential for access control, but serve different purposes in the security process.

A platform that collects, aggregates, and analyzes log data from across an organization's infrastructure to detect security threats. SIEM tools like Splunk, Chronicle, and Microsoft Sentinel correlate events, generate alerts, and provide dashboards for security monitoring. SIEM is central to security operations center (SOC) activities.

A system that monitors network traffic or host activity for suspicious patterns and alerts security teams. IDS can be network-based (NIDS) or host-based (HIDS). Detection methods include signature-based (known attack patterns) and anomaly-based (deviations from normal behavior). IDS detects but does not block threats.

An active security system that monitors traffic and automatically blocks detected threats in real-time. IPS sits inline with network traffic, unlike IDS which only monitors passively. When malicious activity is detected, IPS can drop packets, reset connections, or block source IP addresses.

The organized approach to addressing and managing security incidents. The NIST framework includes six phases: Preparation (policies and tools), Detection and Analysis (identify incidents), Containment (limit damage), Eradication (remove threat), Recovery (restore systems), and Post-Incident Activity (lessons learned). Documentation is crucial throughout.

A documented set of procedures that security analysts follow when responding to specific types of incidents. Playbooks ensure consistent, efficient responses by providing step-by-step instructions for common scenarios like phishing attacks, malware infections, or data breaches. They reduce response time and human error during incidents.

Evidence that a security breach has occurred. IoCs include unusual network traffic, unexpected file changes, suspicious login attempts, unknown processes, and registry modifications. Security analysts hunt for IoCs during investigations and use threat intelligence feeds to identify known malicious IoCs like malware hashes or command-and-control IP addresses.

The process of examining recorded events from systems, applications, and network devices to identify security issues. Common log sources include firewall logs, authentication logs, system logs, and application logs. Analysts look for patterns, anomalies, and indicators of compromise. Log analysis is fundamental to threat detection and incident investigation.

Google Cloud's security analytics platform designed to help security teams investigate threats at scale. Chronicle normalizes and indexes security telemetry, enabling fast searches across massive datasets. It uses Google's infrastructure for petabyte-scale data retention and includes built-in threat intelligence from VirusTotal and Mandiant.

A leading SIEM and log management platform used by security teams to monitor, search, and analyze machine-generated data. Splunk uses SPL (Search Processing Language) for queries. Security analysts use Splunk to create dashboards, set up alerts, and investigate incidents by correlating data from multiple sources.

Python is widely used in security for automation, scripting, and tool development. Security analysts use Python to parse logs, automate repetitive tasks, analyze data, and interact with APIs. Python's extensive libraries (like requests, scapy, and pandas) and readable syntax make it ideal for security operations and incident response.

Reusable blocks of code that perform specific tasks. Functions are defined using 'def' keyword, can accept parameters, and return values. Security analysts write functions to modularize code for tasks like log parsing, hash checking, or IP address validation. Functions improve code organization, reusability, and maintenance.

The ability to read from and write to files using Python. The open() function with modes like 'r' (read), 'w' (write), and 'a' (append) provides file access. Security analysts use file handling to process log files, export analysis results, and manage configuration files. Using 'with' statements ensures proper file closure.

Pattern matching syntax used to search, match, and manipulate text. Python's 're' module provides functions like search(), match(), and findall(). Security analysts use regex to extract IP addresses from logs, validate input formats, identify patterns in data, and parse structured text for investigations.

The process of identifying and fixing errors in code. Python errors include syntax errors (code structure), runtime errors (exceptions), and logic errors (incorrect results). Debugging techniques include reading error messages, using print statements, and stepping through code with debuggers. Error handling with try/except prevents crashes.

Using Python scripts to automate repetitive security tasks. Examples include automatically parsing logs for suspicious activity, checking file hashes against threat intelligence databases, managing user accounts, generating reports, and responding to common alerts. Automation reduces manual effort and enables faster, more consistent security operations.

Pre-built code modules that extend Python's capabilities. Key security libraries include 'requests' (HTTP communication), 'scapy' (packet manipulation), 'hashlib' (cryptographic hashing), 'pandas' (data analysis), and 'socket' (network connections). Understanding and using these libraries accelerates security tool development and automation.