14.1 Deductive Logic & Syllogisms

The Cyber Test (CT), formerly the Information and Communications Technology Literacy (ICTL) assessment, includes a logic-and-reasoning heritage that rewards structured thinking as much as technical recall. Cyber operations constantly require you to decide what must follow from stated rules, logs, and policies. Syllogisms and related deductive forms train that habit: given clear premises, what conclusion is forced?

This section is aptitude practice, not a claim that any one published CT blueprint publishes a fixed percentage of syllogism items. Treat it as transferable reasoning skill that supports both the logic slice of prep (~8% in this guide's study map) and day-to-day cyber triage.

Deduction vs. Induction

Deduction moves from general rules to a specific conclusion that must be true if the premises are true and the argument form is valid. Example: All routers forward packets; device R is a router; therefore R forwards packets.

Induction generalizes from samples. Example: The last five phishing emails used urgent language; therefore the next phishing email will use urgent language. That conclusion may be likely, but it is not guaranteed.

On timed aptitude items, the trap is treating a plausible story as a valid deduction. Always ask: If I accept only what the premises state, is the conclusion forced?

Categorical Statements (Standard Form)

Most syllogism drills use four categorical forms:

Distributed means the statement says something about the entire class. Validity rules care about this: you cannot conclude something about all of a class if a premise only mentioned some of it.

Worked translation

Everyday wording hides the form:

• "Every firewall drops unmatched inbound SYN packets" → All firewalls (in this policy set) are devices that drop unmatched inbound SYN packets.
• "No analyst without clearance may open the vault" → No uncleared analysts are vault-authorized persons.
• "A few endpoints still run the legacy agent" → Some endpoints are legacy-agent hosts.

Translate first; argue second.

The Classic Syllogism Shape

A categorical syllogism has two premises and one conclusion, and three terms total: major, minor, and middle.

Valid example (Barbara form):

1. All packet filters are network controls.
2. All ACLs are packet filters.
3. Therefore, all ACLs are network controls.

Sketch: ACL ⊂ packet filter ⊂ network control. The conclusion is forced.

Invalid example (undistributed middle):

1. All IDS sensors are monitoring tools.
2. All SIEM collectors are monitoring tools.
3. Therefore, all SIEM collectors are IDS sensors.

Both premises place their subjects inside "monitoring tools," but neither premise forces SIEM collectors into the IDS subset. Two classes can share a broader category without overlapping each other. This is the undistributed middle: the middle term ("monitoring tools") never appears as a fully distributed link between the other two classes in a way that forces the conclusion.

Valid vs. Invalid: More Worked Puzzles

Puzzle A — valid "No…All…Therefore No…"

Premises:

1. No unclassified systems are TS vault hosts.
2. All guest Wi-Fi clients are unclassified systems.
3. Therefore, no guest Wi-Fi clients are TS vault hosts.

Reasoning: Guest clients sit entirely inside unclassified systems; unclassified systems share nothing with TS vault hosts; therefore guest clients share nothing with TS vault hosts. Valid.

Puzzle B — invalid illicit major

Premises:

1. All zero-day exploits are high-priority incidents.
2. No phishing emails are zero-day exploits.
3. Therefore, no phishing emails are high-priority incidents.

The conclusion says something about all high-priority incidents relative to phishing, but the first premise never distributed "high-priority incidents" ("All zero-days are high-priority" does not mean "All high-priority are zero-days"). Phishing can still be high-priority for other reasons. Invalid.

Puzzle C — some statements

Premises:

1. Some SOC tickets are false positives.
2. All false positives are closed without escalation.
3. Therefore, some SOC tickets are closed without escalation.

The overlapping "some" region of SOC tickets that are false positives must also lie in the "closed without escalation" set. Valid.

Change the conclusion to "All SOC tickets are closed without escalation" and it becomes invalid — "some" never upgrades to "all."

Conditional Logic Companion Forms

Cyber Test-style reasoning also uses if-then chains that look like syllogisms in disguise.

Let P → Q mean "If P, then Q."

Worked conditional set

Rule: If a host fails posture check, then it is quarantined.

• Host A fails posture check → Host A is quarantined. (Valid — modus ponens)
• Host B is not quarantined → Host B did not fail posture check. (Valid — modus tollens / contrapositive)
• Host C is quarantined → Host C failed posture check. (Invalid — affirming the consequent; quarantine may occur for other reasons)
• Host D did not fail posture check → Host D is not quarantined. (Invalid — denying the antecedent)

The contrapositive of P → Q is not-Q → not-P. It is logically equivalent to the original rule. The converse Q → P and the inverse not-P → not-Q are not equivalent.

Exam Method Under Time Pressure

1. Rewrite premises in standard form (All/No/Some…).
2. Circle the three terms; confirm the middle term actually links them.
3. Ask whether the conclusion is forced or only possible.
4. For if-then items, name the pattern (ponens, tollens, or a fallacy) before picking an answer.
5. Ignore real-world cyber knowledge that is not in the premises — aptitude items punish "helpful" outside facts.

Quick Venn Habit

For two-circle checks: draw subject and predicate circles. Shade "No" exclusions, outline "All" inclusions, and mark an X for "Some." If the conclusion's claim is already required by the diagram, accept it; if the diagram still allows a counterexample, reject it.

Practice until the invalid patterns feel automatic. In cyber work, the same discipline prevents leaping from "alert fired" to "attacker confirmed" without a valid chain of evidence.