πŸ“š Cyber Fundamentals

University-level cybersecurity knowledge with exam-style questions and detailed explanations

🌐 Network Security

OSI Model & TCP/IP β€” The 7-layer OSI model (Physical, Data Link, Network, Transport, Session, Presentation, Application) provides a framework for understanding how data traverses a network. TCP/IP condenses this into 4 layers. Security controls can be applied at each layer.
Firewalls & IDS/IPS β€” Firewalls filter traffic based on rules (stateless) or connection state (stateful). IDS (Intrusion Detection Systems) monitor and alert; IPS (Intrusion Prevention Systems) actively block malicious traffic. Next-gen firewalls combine both with deep packet inspection.
Network Segmentation & VLANs β€” Dividing networks into segments limits lateral movement. VLANs logically separate traffic at Layer 2. DMZs isolate public-facing services. Zero Trust assumes no implicit trust between segments.
VPN & Tunneling Protocols β€” VPNs create encrypted tunnels over public networks. IPSec operates at Layer 3 (tunnel/transport mode), SSL/TLS VPNs at Layer 4+. WireGuard is a modern, lightweight alternative. Split tunneling vs. full tunneling affects security posture.
DNS Security β€” DNS is often exploited via cache poisoning, DNS tunneling for data exfiltration, and domain hijacking. DNSSEC adds authentication. DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) encrypt queries to prevent eavesdropping.
⚠️ Important: Network security is the first line of defense. Understanding packet capture (Wireshark) and network forensics is essential for any security professional.

πŸ“ Exam Questions

Q1: A security analyst notices that an internal host is making thousands of DNS TXT record queries to an unusual domain. Which attack is MOST likely occurring?

Q2: Which firewall type maintains a state table tracking active connections and can distinguish between new and established traffic?

πŸ” Cryptography

Symmetric vs. Asymmetric Encryption β€” Symmetric (AES, 3DES, ChaCha20) uses one shared key for encryption and decryption β€” fast but key distribution is a challenge. Asymmetric (RSA, ECC, Diffie-Hellman) uses key pairs β€” solves distribution but is slower. Most systems use hybrid approaches.
Hashing & Integrity β€” Hash functions (SHA-256, SHA-3, BLAKE2) produce fixed-length digests. Properties: deterministic, collision-resistant, pre-image resistant, avalanche effect. Used for password storage (with salts), file integrity verification, and digital signatures.
Digital Signatures & PKI β€” Digital signatures use private keys to sign and public keys to verify. PKI establishes trust through Certificate Authorities (CAs). X.509 certificates bind identities to public keys. Certificate chains, CRLs, and OCSP handle revocation.
Key Exchange Protocols β€” Diffie-Hellman enables secure key exchange over insecure channels. ECDHE (Elliptic Curve DH Ephemeral) provides forward secrecy β€” past sessions can't be decrypted even if long-term keys are compromised. Used in TLS 1.3.
Post-Quantum Cryptography β€” Quantum computers threaten RSA and ECC via Shor's algorithm. NIST standardized CRYSTALS-Kyber (key encapsulation) and CRYSTALS-Dilithium (signatures). Organizations should begin crypto-agility planning now.
⚠️ Important: Never roll your own cryptography. Use established libraries (OpenSSL, libsodium, BoringSSL). Key management is often the weakest link β€” protect keys with HSMs when possible.

πŸ“ Exam Questions

Q1: An organization needs to ensure that even if their long-term TLS private key is compromised, previously captured encrypted traffic cannot be decrypted. Which property must the key exchange provide?

Q2: A developer stores user passwords using SHA-256 without a salt. What is the PRIMARY vulnerability of this approach?

🦠 Malware Analysis

Malware Types β€” Viruses attach to files and replicate. Worms self-propagate across networks. Trojans disguise as legitimate software. Ransomware encrypts files for payment. Rootkits hide at OS/firmware level. Fileless malware lives in memory and uses LOLBins (Living-off-the-Land Binaries).
Static Analysis β€” Examining malware without executing it: file hashing (MD5/SHA-256), strings extraction, PE header analysis, import table inspection, YARA rule matching, disassembly (IDA Pro, Ghidra). Helps identify capabilities, C2 addresses, and packing/obfuscation.
Dynamic Analysis β€” Running malware in sandboxes (Cuckoo, ANY.RUN, Joe Sandbox) to observe behavior: file system changes, registry modifications, network connections, API calls, process creation. Use Process Monitor, Wireshark for real-time monitoring.
Indicators of Compromise (IOCs) β€” Observable artifacts: file hashes, IP addresses, domains, URLs, registry keys, mutex names, email addresses. Shared via STIX/TAXII frameworks. The Pyramid of Pain ranks IOCs by attacker difficulty to change.
Anti-Analysis Techniques β€” Malware detects VMs (CPUID checks, MAC addresses), uses code packing (UPX, Themida), employs anti-debugging (IsDebuggerPresent, timing checks), and implements encryption/encoding to evade detection.
⚠️ Important: Always analyze malware in isolated environments (VMs with snapshots, air-gapped networks). Never execute malware on production systems. Use REMnux and FlareVM as dedicated analysis platforms.

πŸ“ Exam Questions

Q1: A malware analyst discovers that a suspicious executable checks for the registry key "HKLM\SOFTWARE\VMware, Inc.\VMware Tools" before executing its payload. What anti-analysis technique is being used?

Q2: According to the Pyramid of Pain, which IOC type causes the MOST difficulty for an attacker to change?

πŸ”‘ Identity & Access Management

Authentication Factors β€” Something you know (passwords, PINs), something you have (tokens, smart cards, phones), something you are (biometrics). MFA combines 2+ different factors. Risk-based authentication adapts requirements based on context (location, device, behavior).
Access Control Models β€” DAC (Discretionary): owners set permissions. MAC (Mandatory): system-enforced labels/clearances. RBAC (Role-Based): permissions tied to roles. ABAC (Attribute-Based): policies evaluate attributes (user, resource, environment). Zero Trust: "never trust, always verify".
OAuth 2.0 & OpenID Connect β€” OAuth 2.0 is an authorization framework (delegation, not authentication). OIDC adds authentication via ID tokens (JWT). Authorization Code flow (with PKCE) is recommended for web apps. Implicit flow is deprecated due to token exposure in URLs.
Privileged Access Management (PAM) β€” Privileged accounts are top targets. PAM solutions: just-in-time access, session recording, credential vaulting, automatic password rotation. Principle of least privilege: grant minimum access needed for job functions.
Single Sign-On (SSO) & Federation β€” SSO allows one authentication for multiple services. SAML 2.0 uses XML assertions for enterprise federation. OIDC is the modern alternative. Federation connects identity providers across organizational boundaries. Reduces password fatigue but creates a single point of failure.
⚠️ Important: 80% of breaches involve stolen or weak credentials (Verizon DBIR). Implement MFA everywhere, use passwordless authentication (FIDO2/WebAuthn) where possible, and enforce least privilege.

πŸ“ Exam Questions

Q1: An employee uses a fingerprint scan and a smart card to access a secure facility. How many authentication factors are being used?

Q2: In a Zero Trust architecture, which statement BEST describes the core principle?

🚨 Incident Response

IR Lifecycle (NIST SP 800-61) β€” Four phases: 1) Preparation (policies, tools, training), 2) Detection & Analysis (monitoring, triage, classification), 3) Containment, Eradication & Recovery (isolate, remove, restore), 4) Post-Incident Activity (lessons learned, documentation).
Detection & Triage β€” SIEM systems (Splunk, Elastic, QRadar) correlate logs for anomaly detection. SOC analysts use the MITRE ATT&CK framework to map observed behaviors to known techniques. Alert triage prioritizes true positives and measures by severity and impact.
Containment Strategies β€” Short-term: isolate affected systems (network quarantine, disable accounts). Long-term: patch vulnerabilities, reset credentials, harden configurations. Evidence preservation is critical β€” image disks before wiping, maintain chain of custody.
Digital Forensics β€” Acquire evidence: disk imaging (dd, FTK Imager), memory dumps (WinPMEM). Analyze: timeline analysis, artifact recovery, log correlation. Tools: Autopsy, EnCase, Volatility. Order of volatility: registers β†’ cache β†’ RAM β†’ disk β†’ logs β†’ network.
MITRE ATT&CK Framework β€” Knowledge base of adversary tactics (14 categories: Reconnaissance through Impact) and techniques. Used for threat-informed defense, detection engineering, red team planning, and gap analysis. Sub-techniques provide granular detail.
⚠️ Important: Time is critical during incidents. Having pre-built runbooks, communication templates, and an incident response plan dramatically reduces response time. Practice with tabletop exercises regularly.

πŸ“ Exam Questions

Q1: During an active ransomware incident, a security analyst's FIRST priority should be to:

Q2: When collecting digital evidence from a running system, which should be collected FIRST based on order of volatility?

🌍 Web Application Security

OWASP Top 10 β€” The essential web vulnerability list: A01-Broken Access Control, A02-Cryptographic Failures, A03-Injection, A04-Insecure Design, A05-Security Misconfiguration, A06-Vulnerable Components, A07-Authentication Failures, A08-Data Integrity Failures, A09-Logging Failures, A10-SSRF.
SQL Injection β€” Attacker injects SQL code through user input to manipulate database queries. Types: classic (error-based), blind (boolean/time-based), union-based. Prevention: parameterized queries/prepared statements, input validation, stored procedures, WAF rules, least privilege DB accounts.
Cross-Site Scripting (XSS) β€” Reflected XSS: malicious script in URL parameters. Stored XSS: script persisted in database. DOM-based: client-side manipulation. Prevention: output encoding (context-dependent), Content Security Policy (CSP) headers, input sanitization, HTTPOnly cookies.
CSRF & SSRF β€” CSRF tricks authenticated users into performing unwanted actions (via forged requests). Prevention: anti-CSRF tokens, SameSite cookies, custom headers. SSRF forces server to make requests to unintended locations (internal services, cloud metadata). Prevention: allowlists, no user-controlled URLs.
Security Headers & HTTPS β€” Essential headers: Content-Security-Policy, X-Frame-Options, Strict-Transport-Security (HSTS), X-Content-Type-Options. TLS 1.3 is the current standard β€” disables weak ciphers, mandates forward secrecy, reduces handshake to 1-RTT (0-RTT with resumption).
⚠️ Important: Web apps are the #1 attack vector. Always assume all user input is malicious. Defense in depth: WAF + secure coding + CSP + monitoring + regular pen testing.

πŸ“ Exam Questions

Q1: A web application directly concatenates user input into SQL queries: SELECT * FROM users WHERE id = '" + userInput + "'. What is the MOST effective remediation?

Q2: Which HTTP header instructs the browser to ONLY connect to a website via HTTPS for a specified duration?