Free Military Cyber Test Exam Flashcards

Each term multiplies by a constant ratio (e.g., 2, 6, 18, 54 multiplies by 3). Distinct from an arithmetic sequence, where each term adds a constant difference. Identifying the ratio versus the addend is the first step in most pattern questions.

Each term equals the sum of the two preceding terms (1, 1, 2, 3, 5, 8, 13...). It is neither arithmetic (no constant difference) nor geometric (no constant ratio). Recognizing it unlocks an entire family of pattern-recognition questions.

If P implies Q, and Q is false, then P is false. Example: if all Building A servers run Linux and Server X does not run Linux, Server X is not in Building A. This deductive form lets you exclude possibilities with certainty rather than probability.

The contrapositive of 'if P then Q' is 'if not Q then not P' and is always true when the original is true. The converse 'if Q then P' is NOT necessarily true. Confusing them is the most common deductive-logic error on the test.

An AND condition requires every clause true for the whole to be true; failing one clause fails the action. An OR condition requires at least one clause true. Firewall and access rules on the Cyber Test hinge on this distinction.

An inner IF is only evaluated if the outer IF passes. A non-admin user fails the outer check, so the inner MFA check is never reached and access is denied regardless of MFA state. Reading outer-to-inner in order prevents wrong conclusions.

Test localhost first (TCP/IP stack), then the local router (local network), then an external host (internet). Each layer that passes narrows the failure to the next layer out. Skipping to the internet first hides which layer is broken.

An APIPA self-assigned address means the device reached the local network but could not contact a DHCP server for a real IP. Wi-Fi itself is fine; the failure is at IP assignment. It is not a sign of a bad password or a full network.

A differential backup captures all changes since the last FULL backup; restoring needs only the full plus the latest differential. An incremental captures changes since the last backup of any kind; restoring needs the full plus every incremental in order.

A loop that runs 'for i = 1 to 99' processes 99 items instead of 100, one too few. The boundary should match the count exactly. Off-by-one is the most common boundary bug and appears often in debugging scenarios on the test.

Adding output statements at each stage (input, calculation, formatting, output) pinpoints which stage first produces wrong values. The bug lives in the stage where values first go wrong, not downstream of it.

When a performance trace shows one stage dominates total time (e.g., 4,200 ms server processing out of 4,400 ms total), optimize that stage. Improving stages that consume 1% of total time yields negligible gains. Always size relative to the total.

Class A uses 1-126. Although 0 and 127 begin with the Class A bit pattern, 0 is reserved for the default network and 127 for loopback, so neither is assignable. Class B starts at 128, Class C at 192.

A /24 (255.255.255.0) gives 256 total addresses. Two are reserved: the network address (all host bits 0) and the broadcast address (all host bits 1), leaving 254 usable host addresses.

Each bit borrowed doubles the subnet count: 2^2 = 4. Adding 2 bits to a /24 yields /26 (255.255.255.192), producing 4 subnets of 62 usable hosts each. Use 2^n = required subnets to size the borrow.

NAT translates private internal IPs to a public IP for internet egress, letting many devices share one public address. It is not encryption (TLS does that), not IP assignment (DHCP does that), and not name resolution (DNS does that).

TCP is connection-oriented and reliable: three-way handshake, acknowledgments, retransmission. UDP is connectionless with no guarantees. Use TCP when every byte must arrive (web, email); use UDP when latency matters more than perfection (streaming, VoIP).

Client sends SYN, server replies SYN-ACK, client sends ACK. Only after these three messages is the connection established and data transfer begins. The order SYN then SYN-ACK then ACK is fixed.

80 = HTTP, 443 = HTTPS, 22 = SSH, 21 = FTP control, 25 = SMTP. Knowing these by heart lets you identify the likely protocol from a port number or firewall rule without working it out each time.

301 means the resource moved permanently; clients and search engines should update links. 302 means a temporary redirect; do not update stored links. Both send the user to a new URL, but only 301 signals long-term relocation.

Layer 3 handles logical addressing (IP) and routing between different networks. Routers operate here, making forwarding decisions by IP address. Layer 2 (Data Link) only moves frames within one segment using MAC addresses.

The presentation layer formats, encrypts, decrypts, and compresses data between the application and the network format. Although modern protocols often fold encryption into the application layer, the OSI model formally assigns encryption to Layer 6.

In a star, every device links to a central hub or switch. If that central device fails, all communication stops; the hub is a single point of failure. A single port failing affects only that port's device; the whole device failing takes down everyone.

Every device connects directly to every other device, so any single link failure can be rerouted through an alternate path. This is the most redundant topology but the most expensive to wire and maintain, so it is reserved for critical backbones.

DNS translates human-readable domain names into IP addresses that computers use. Without DNS, browsers cannot load websites by name even if the network is otherwise healthy. IM clients that connect by IP may still work, which is a useful diagnostic clue.

An A record maps a domain to an IPv4 address. An AAAA ('quad-A') record maps a domain to an IPv6 address. The two record types serve the same purpose for different address families; most modern domains carry both.

An attacker injects fraudulent records into a resolver's cache so that queries for legitimate domains return the attacker's IP. Users are silently redirected to malicious sites. It is a data-corruption attack, not a flood (that is DNS DDoS) and not physical damage.

The CPU executes instructions and performs calculations, the 'brain.' RAM holds the active data the CPU works on but does not execute instructions. Confusing CPU (executes) with RAM (stores) misroutes every performance question.

BIOS or UEFI initializes and tests hardware at power-on (POST), then loads the OS boot loader. It does not run applications, provide internet, or manage files; those are operating-system jobs. It hands off to the OS once the boot loader starts.

SSDs use NAND flash with no moving parts, so reads and writes are near-instant. HDDs spin magnetic platters and physically move a head, adding mechanical latency. SSDs also use less power; the speed gap is structural, not a matter of capacity.

A GPU performs thousands of parallel calculations, which is why it renders graphics and accelerates AI workloads. In security, the same parallelism makes GPUs effective at password cracking, a reason password length and hashing still matter.

The kernel manages memory, schedules the CPU, runs device drivers, and exposes system calls to applications. It is the bridge between software and hardware. The GUI, network stack, and file system all sit on top of the kernel, not inside it.

Linux is the dominant server OS: open-source, customizable, and free. It powers most web servers, cloud infrastructure, and DoD systems. Windows Server has share but is proprietary; macOS and ChromeOS are desktop-oriented, not server OSes.

Permissions control who can read, write, or execute a file, enforced for owner, group, and others. This is the OS-level mechanism for least privilege. Permissions do not affect speed, organization, or compression, only access.

A VM is a software emulation of a computer running its own OS on a host through a hypervisor. VMs allow multiple isolated environments on one physical machine, widely used in DoD for testing and security isolation. It is software, not added RAM or a different disk.

13 / 2 = 6 remainder 1; 6 / 2 = 3 remainder 0; 3 / 2 = 1 remainder 1; 1 / 2 = 0 remainder 1. Reading remainders bottom-to-top gives 1101. Verify: 1x8 + 1x4 + 0x2 + 1x1 = 13. The divide-by-2 method works for any decimal-to-binary conversion.

255 is FF in hexadecimal. Each hex digit is 4 bits; F = 15, so FF = 15x16 + 15 = 255. This is the maximum value of one byte (8 bits all set), which is why 255 appears so often as a network mask and config limit.

A bit is one binary digit (0 or 1), the smallest unit. A byte is 8 bits, representing 256 distinct values (2^8). A nibble is 4 bits (half a byte). Mixing up bits and bytes is a common source of wrong bandwidth and storage calculations.

When RAM fills, the OS pages inactive data to a swap file on disk. Disks are far slower than RAM, so heavy swapping (thrashing) causes noticeable slowdowns even on an SSD. Adding more RAM reduces swap use; adding storage does not.

Symmetric uses one shared key for both encryption and decryption (e.g., AES); fast but requires secure key exchange. Asymmetric uses a public/private pair (e.g., RSA); slower but solves the key-distribution problem. Most real systems combine both.

AES is symmetric and is the U.S. government standard for protecting classified information, AES-256 for TOP SECRET material. RSA, Diffie-Hellman, and ECC are asymmetric, not drop-in replacements for AES bulk encryption.

The padlock means the connection to the site is encrypted with TLS (HTTPS); data in transit is protected from eavesdropping. It says nothing about whether the site itself is safe, malware-free, or truthful. Encryption is not trust.

Multi-factor authentication combines different factor TYPES: something you know (password), something you have (token, CAC), something you are (biometric). Two passwords are still single-factor because both are 'know.' Mixing types is the point.

The CAC is 'something you have,' a physical smart card with certificates and digital signatures. Paired with a PIN ('something you know') it provides two-factor authentication. The card itself is the possession factor; the PIN is separate.

Grant only the minimum access needed to perform the job, no more. If an over-permissioned account is compromised, the blast radius is proportionally larger. It is a core DoD cybersecurity requirement and the rationale behind RBAC and MAC.

MAC uses security labels and clearance levels (Top Secret, Secret); central authority, no user discretion, standard in military classified environments. RBAC grants access by organizational role. DAC lets the data owner set permissions. Each trades flexibility for control differently.

A Trojan disguises itself as legitimate software and requires user action to install; it does not self-replicate. A worm self-replicates across networks without user interaction. Both steal data or create backdoors, but their spreading mechanism differs.

A Denial-of-Service attack floods a server to make it unavailable; it attacks the Availability pillar of the CIA triad. Phishing attacks Confidentiality; tampering attacks Integrity. Mapping an attack to the triad clarifies which control is missing.

A zero-day is exploited before the vendor knows about it or can release a patch; the vendor has had zero days to fix it. The danger is the absence of any available defense at exploitation time, not the skill level required or the calendar date.

In 'www.army.mil.secure-login.com' the actual registered domain is 'secure-login.com'; 'army.mil' is just a subdomain the attacker created. Read right-to-left from the TLD to find the real domain. Legitimate .mil domains end in .mil, not in .com.