Cheat sheets / Class "know this" list (colored by domain)
Class "know this" list (colored by domain)
Every item your instructor starred or said to memorize, on one page, colored by exam domain, with the correct answer next to it.
Legend — one color per exam domain (used on every sheet)
| 1.0 General Security Concepts (12%) | Controls, CIA/AAA, Zero Trust, change management, cryptography |
| 2.0 Threats, Vulnerabilities & Mitigations (22%) | Actors, vectors, vulnerabilities, attacks & indicators, mitigations |
| 3.0 Security Architecture (18%) | Architecture models, infrastructure, data protection, resilience |
| 4.0 Security Operations (28%) | Hardening, assets, vuln mgmt, monitoring, IAM, automation, IR, investigations |
| 5.0 Program Management & Oversight (20%) | Governance, risk, third parties, compliance, audits, awareness |
| Cross-cutting | Mnemonics, OSI, ports |
★ Everything you starred in your notebook
| ★ Item | The answer to know | Where |
|---|---|---|
| 3 2 B R A I D S | 3DES, Twofish, Blowfish, RC4/5/6, AES, IDEA, DES, Serpent = symmetric | 1.4 |
| D E E R Q | Diffie-Hellman, ECC, ElGamal, RSA, Quantum (+PKI/PGP/GPG) = asymmetric | 1.4 |
| RC4 / stream vs. block | RC4 = stream (one bit at a time; WEP/TKIP); AES etc. = block | 1.4 |
| SHA-2 · SHA-1 · MD5 | SHA-2 use; SHA-1 and MD5 broken (collisions) | 1.4 |
| Transport encryption | VPN, TLS/SSL, IPsec = data in transit | 1.4 |
| Key escrow vs. recovery agent | Escrow = external holds private key; recovery agent = internal | 1.4 / 5.1 |
| Zero-day | Vendor does not have a patch | 2.3 |
| Directory traversal | %2E%2E%2F = ../ | 2.3 |
| Cyber Kill Chain | Recon → Weaponize → Deliver → Exploit → Install → C2 → Actions | 2.4 / 4.8 |
| ARP poisoning / on-path | MAC of gateway swapped; man/adversary-in-the-middle; DAI protects; arp -a | 2.4 |
| Rogue AP · Evil twin · Bluejacking | Unauthorized AP · look-alike SSID stealing creds · unsolicited Bluetooth messages (snarfing = theft) | 2.4 |
| Port security · DHCP snooping · Loop protection | Only allowed MACs on a port · block rogue DHCP/starvation · STP stops loops | 2.5 / 3.2 |
| WAF | Web application firewall — SQLi/XSS at layer 7 | 3.2 |
| Transport vs. tunnel mode | Payload only (AH and/or ESP) vs. whole packet (ESP, site-to-site) | 3.2 |
| North–south vs. east–west | Internet ↔ data center vs. inside the data center | 3.2 |
| "Know this picture" | OT ⊃ ICS ⊃ SCADA (PLC, DCS inside) | 3.1 |
| Cloud compromise affects others | Multitenancy — "fire in one apartment" | 3.1 |
| FDE vs. full-device encryption | Laptops/disks vs. mobile phones | 3.3 |
| ★ Tabletop exercise | Talk-through DR test — "plan ahead of time"; ladder: checklist → tabletop → simulation → parallel → full interruption | 3.4 |
| ★ Incremental vs. differential backup | Incremental = since last backup of any kind (fast backup, slow restore — "mail pickup"); differential = since last full ("start Monday, add the days") | 3.4 |
| WPA3 | SAE / Dragonfly handshake; AES-GCMP enterprise; WPA2 = AES-CCMP ("remember") | 4.1 |
| Vuln assessment vs. pentest · CVSS | Passive/identify vs. active/exploit · 0–10 criticality score | 4.3 |
| Honeynet · $ENV · SID | Network of honeypots · environment vars/hidden folders · -500 admin, -501 guest | 4.4 |
| Email: double extension · SPF/DKIM/DMARC · NS record | Block .pdf.exe · authorize senders/sign/policy (TXT records) · NS = name server | 4.5 |
| DNS 53 · NTP 123 · LDAP 389/636 · DHCP relay 67/68 | Ports; NTP sync needed for Kerberos; relay crosses subnets | 4.5 |
| GPO order | Local → Site → Domain → OU → child OU (last wins) | 4.5 |
| Kerberos = SSO · EAP · RADIUS · TACACS+ | Tickets/KDC/NTP · extensible framework for 802.1X/wireless · UDP 1812 full AAA · TCP 49 encrypts everything (Cisco) | 4.6 |
| ★ Command outputs (Day 5) | Know what nslookup, arp -a, nbtstat, netstat -ano, route print, ping, ipconfig look like — see the Command outputs sheet | 4.9 |
| ★ Syslog 7 = debug | 0 emergency (most severe) … 7 debug (least); SIEM correlates/alerts, syslog just collects | 4.9 |
| ★ dd + write blocker | dd = bit-for-bit forensic image; write blocker keeps the source read-only; hash it (chain of custody) | 4.8 |
| Regulatory compliance | SOX (financial), HIPAA (health), GLBA (finance privacy), GDPR (EU — sovereignty, right to be forgotten, controller/processor), PCI DSS (cards) | 5.1 / 5.4 |
| "Study": AV · EF · SLE · ARO | SLE = AV × EF; ALE = SLE × ARO | 5.2 |
| SLA · MSA · BPA · NDA | Service levels (99.999%) · umbrella contract · partnership · confidentiality | 5.3 |
Orders and sequences
| Thing | Order |
|---|---|
| Cyber Kill Chain | Reconnaissance → Weaponization → Delivery → Exploitation → Installation → Command & Control → Actions on Objectives (search → create → send → exploit → install → communicate → act) |
| Incident response (CompTIA) | Preparation → Detection → Analysis → Containment → Eradication → Recovery → Lessons learned |
| Incident response (NIST, 4 phases) | Preparation → Detection & Analysis → Containment/Eradication/Recovery → Post-incident activity |
| Pen test (class) | Planning → Discovery → Attack → Reporting |
| Group Policy processing | Local → Site → Domain → OU → child OU (last applied wins) |
| AGDLP | Accounts → Global groups → Domain Local groups → Permissions |
| Order of volatility | CPU/registers → RAM → network/process state → disk → backups → printouts |
| Secure baseline | Establish → Deploy → Maintain |
| Syslog severity | 0 Emergency · 1 Alert · 2 Critical · 3 Error · 4 Warning · 5 Notice · 6 Informational · 7 Debug |
| Information life cycle | Creation/acquisition → Use/storage → Retention/archival → Wiping/disposal |
| Defense in depth (class) | Data → Application → Host → Internal network → Perimeter (DMZ) → Physical → Users/organization |
| DR test ladder | Checklist → Tabletop → Simulation → Parallel → Full interruption |
| OSI | Physical, Data link, Network, Transport, Session, Presentation, Application (All People Seem To Need Data Processing, top-down) — encryption at Presentation, ports at Transport, IPsec at Network |
Nested / paired concepts
| Item | Answer |
|---|---|
| Implicit deny vs. implicit allow | Secure default vs. everything allowed |
| Key escrow vs. recovery agent | External holds private key vs. internal |
| Tailgating vs. piggybacking | Authorized person doesn't know vs. knowingly lets them in |
| Rogue AP vs. evil twin | Any unauthorized AP vs. look-alike SSID stealing creds |
| Bluejacking / bluesnarfing / bluesmacking | Send messages / steal data / DoS |
| OT ⊃ ICS ⊃ SCADA (PLC, DCS inside) | "Know this picture" |
| Forward vs. reverse proxy | Client egress vs. in front of your servers |
| Active/active vs. active/passive | All serving vs. standby |
| Stateless vs. stateful firewall | One packet, one way vs. tracks both directions |
| Fail-open vs. fail-closed | Availability vs. security |
| North-south vs. east-west | Internet ↔ data center vs. inside the data center |
| In-band vs. out-of-band | Same channel vs. separate management path (console cable) |
| Full vs. split tunnel | Everything via VPN vs. only corporate traffic |
| Transport vs. tunnel mode (IPsec) | Payload only (AH and/or ESP) vs. whole packet (ESP, site-to-site) |
| AH vs. ESP | Integrity vs. confidentiality |
| Type 1 vs. Type 2 hypervisor | Bare metal vs. on a host OS |
| MTTF vs. MTBF vs. MTTR | Light bulb (replace) vs. repairable uptime vs. repair time |
| RTO vs. RPO | Time to restore vs. data-loss window |
| Scaling up vs. out | Bigger machine (vertical) vs. more machines (horizontal); elasticity = automatic |
| Blackout / brownout / spike | Total loss / sustained low voltage / brief high voltage |
| Anonymization vs. pseudonymization | Irreversible vs. reversible with key |
| FDE vs. full-device encryption | Laptops/disks vs. mobile |
| EFS vs. BitLocker | Files vs. whole drive |
| False positive vs. false negative | Benign flagged as bad vs. bad missed as benign (worse) |
| Vulnerability assessment vs. pen test | Passive/identify vs. active/exploit |
| SID -500 vs. -501 | Administrator vs. Guest |
| DAC / MAC / RBAC / rule-based / ABAC | Owner / labels+admin / roles / firewall-style rules / attributes (time, location) |
| FRR (Type I) vs. FAR (Type II) vs. CER | Reject legit vs. accept impostor (worse) vs. crossover |
| RADIUS vs. TACACS+ | UDP 1812, password only encrypted, full AAA vs. TCP 49, whole body encrypted, Cisco |
| SAML vs. OAuth vs. OpenID Connect | Web SSO assertions vs. delegated authorization vs. authentication on OAuth |
| Automation vs. orchestration | Task without human interaction vs. product that coordinates other tools (SOAR) |
| Agent vs. agentless monitoring | Puppet (software on each host) vs. Ansible (central component) |
| SPAN vs. TAP vs. NPB | Port mirror (software) vs. passive hardware copy vs. broker feeding many tools |
| Rolling / blue-green / canary | Few at a time / two environments + flip / small sample first |
| Script extensions | .sh shell · .ps1 PowerShell · .py Python · .rb Ruby · .js JavaScript · .vbs VBScript |
| Known / partially known / unknown environment | White box / gray box / black box ⚠ (class notes had unknown = white — wrong) |
| Red / Blue / White / Purple | Attack / Defend / Referee / Both together |
| Passive vs. active recon | Public sources vs. touching the target ("making the phone calls") |
| Quantitative vs. qualitative | Money vs. survey/High-Med-Low |
| Risk appetite vs. tolerance | Overall willingness vs. acceptable deviation |
| Controller vs. processor | Decides why/how vs. does it on their behalf |
Formulas and numbers
| Item | Value |
|---|---|
| SLE = AV × EF, ALE = SLE × ARO | Compute SLE first |
| Class A / B / C first octet | 0–127 / 128–191 / 192–223 (private: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) |
| /8, /16, /24 masks | 255.0.0.0 / 255.255.0.0 / 255.255.255.0 — /24 gives 254 usable (256 − network − broadcast) |
| MAC address | 48 bits; first 24 = OUI (vendor) |
| SLA example | 99.999% ("five nines" ≈ 5 min/yr downtime) |
| Warm site | Hours to days (cold = days to weeks) |
| Kerberos clock skew | ≤ 5 minutes (NTP 123 must be synced) |
| WPA3 enterprise cipher | AES-GCMP (192-bit); WPA2 = AES-CCMP; WPA/TKIP = RC4; WEP = broken RC4 |
| LM hash | 14 chars max, two 7-char uppercase halves |
| Directory traversal encoding | %2E%2E%2F = ../ |
| Xmas scan flags | FIN, URG, PSH ("FUP"); half-open scan = nmap -sS |
Ports the class called out
| Service | Port | Verdict |
|---|---|---|
| SSH / SCP / SFTP | 22 | ✔ secure |
| Telnet | 23 | ✖ insecure → SSH |
| SMTP / SMTPS / submission | 25 / 465 / 587 | 25 relay only; 465/587 ✔ |
| TACACS+ | 49 TCP | internal |
| DNS | 53 TCP+UDP | normally open |
| DHCP (relay agent crosses subnets) | 67/68 UDP | normally open (LAN) |
| TFTP | 69 | ✖ insecure |
| Kerberos | 88 | internal |
| POP3 / POP3S | 110 / 995 | 110 ✖ → 995 ✔ |
| NTP | 123 | normally open |
| IMAP / IMAPS | 143 / 993 | 143 ✖ → 993 ✔ |
| SNMP | 161/162 | internal, v3 only |
| LDAP / LDAPS | 389 / 636 | 389 ✖ → 636 ✔ |
| HTTPS | 443 | ✔ secure, normally open |
| SMB | 445 | internal only |
| IKE (IPsec) | 500 UDP | ✔ secure |
| RADIUS | 1812 / 1813 | internal |
| NFS | 2049 | internal only |
| RDP | 3389 | never internet-facing |
Full colored table with verdicts: Cheat sheets → Ports & protocols.
Memory strings
| 3 2 B R A I D S | 3DES · Twofish · Blowfish · RC · AES · IDEA · DES · Serpent (symmetric) |
| D E E R Q | Diffie-Hellman · ECC · ElGamal · RSA · Quantum (asymmetric; PKI/PGP/GPG built on them) |
| All People Seem To Need Data Processing | OSI 7→1 · Please Do Not Throw Sausage Pizza Away = OSI 1→7 |
| LSDOU · AGDLP · P-D-A-C-E-R-L | Group Policy order · AD permissions · incident response |
| FUP | Xmas scan flags (FIN, URG, PSH) |
| CIA / AAA | Confidentiality-Integrity-Availability / Authentication-Authorization-Accounting |
Class one-liners worth quoting
| "Risk → chance of harm to an asset. Threat → anything that can cause harm. Vulnerability → weakness. Breach → somebody got in." |
| "Zero day → vendor does not have a patch." |
| "Compensating control → same or better." |
| "Shadow IT → hardware/software not approved by IT." · "APT → group of hackers, long period of time." · "Pharming → phishing, but DNS." · "Salami attack → a penny at a time." |
| "NAC → checklist to let the user get connected." · "Micro-segmentation → each device has a firewall." · "Half-open scan → nmap -sS; scanning without permission can be illegal." |
| "Zero trust → verify everything before use." |
| "Multitenancy → a fire in one apartment affects everyone." · "Rapid elasticity → contract and grow based on needs; resource pooling → a buffet." · "MTTF → light bulb: replace, not repair." · "Incremental backup → like the mail carrier picking up your mail that day." |
| "Kerberos → you get a ticket; NTP must be synced." · "TACACS+ → if it mentions encryption, Cisco, TCP 49." · "PAM → holds people accountable." · "NTFS → always take the most restrictive." · "Sheep-dip computer → has all the scanners installed." |
| "Automation → completes a task without human interaction; orchestration → a product that works well with others." · "Guard rails → policies, procedures and technical controls that reduce the likelihood or impact of something going wrong." · "Agent → think Puppet; agentless → think Ansible." · "IPS → active IDS; IDS → just detects; honeytoken → a false account." |
| "Homomorphic → doesn't have to decrypt first." |
| "Reports → use plain language." |