200-201 cheat sheet

Exam at a glance

Domain weightings

How much of the exam each domain covers. Spend your study time in proportion — the heavier the domain, the more questions you'll see.

Key terms

CIA Triad

The CIA triad is confidentiality, integrity, and availability — the three goals that security controls exist to protect. CBROPS uses it as the foundation for reasoning about threats and defenses.

Defense in Depth

Defense in Depth layers multiple independent controls so the failure of one does not expose the asset. CBROPS covers it as a core principle behind security architecture and monitoring.

SIEM

A Security Information and Event Management (SIEM) system aggregates and correlates logs from across the environment to detect and investigate threats. CBROPS covers SIEM alongside SOAR and log management in security monitoring.

SOAR

Security Orchestration, Automation, and Response (SOAR) automates incident-response workflows and playbooks to speed detection and containment. CBROPS contrasts SOAR with SIEM in the monitoring toolset.

CVSS

The Common Vulnerability Scoring System (CVSS) rates vulnerability severity using metrics like attack vector, complexity, and scope. CBROPS covers interpreting CVSS terms to prioritize risk.

5-tuple

The 5-tuple is the set of source IP, destination IP, source port, destination port, and protocol that uniquely identifies a network conversation. CBROPS uses the 5-tuple approach to isolate a compromised host in logs.

Threat Intelligence

Threat Intelligence is curated information about adversaries, indicators, and techniques used to inform detection and response. CBROPS covers it alongside threat hunting and malware analysis as security concepts.

Threat Hunting

Threat Hunting is the proactive search for undetected threats in an environment using hypotheses and data analysis. CBROPS lists it among the security terms an analyst must understand.

Runbook Automation

Runbook Automation (RBA) executes predefined operational and response procedures automatically to reduce manual effort and errors. CBROPS references RBA within security operations concepts.

Deep Packet Inspection

Deep Packet Inspection (DPI) examines packet payloads, not just headers, to identify applications and threats. CBROPS compares DPI with stateful firewalls and packet filtering in intrusion analysis.

NetFlow

NetFlow records metadata about network conversations — addresses, ports, bytes, and timing — for visibility and analysis. CBROPS uses NetFlow data as a source technology for security monitoring.

PCAP

A PCAP (packet capture) is a stored record of raw network traffic that analysts examine with tools like Wireshark. CBROPS covers extracting files and identifying intrusion elements from a PCAP.

Chain of Custody

Chain of Custody is the documented, unbroken record of who handled evidence and when, preserving its integrity for investigations. CBROPS covers it as part of forensics and incident-response procedures.

Disk Image

A Disk Image is a bit-for-bit copy of storage used in forensic analysis so the original evidence is preserved. CBROPS covers comparing tampered and untampered disk images in host-based analysis.

Incident Response

Incident Response is the structured process of detecting, containing, eradicating, and recovering from security incidents, guided by frameworks like NIST. CBROPS covers IR concepts and procedures in the policies domain.