Search & Discovery 2.0
Search the complete Bare Metal Cyber knowledge system with identifier-aware ranking, framework filters, topic discovery, and direct paths into books, podcasts, and Academy learning.
Search results
A threat actor is an individual, group, organization, or government entity responsible for conducting or supporting malicious activity against a target. Certification exams may ask candidates to identify threat actors by their resources, capabilities, access, and motivation. Financially motivated criminals may steal payment information or deploy ransomware, while nation-state operators may pursue intelligence…
A watering-hole attack targets a website or online service that is regularly visited by a specific organization, profession, industry, or community. Certification exams may ask candidates to recognize that the attacker compromises a trusted location rather than contacting each intended victim directly. After modifying the site, the attacker may deliver malicious scripts, redirect visitors, collect credentials, or…
A zero-day vulnerability is a previously unknown or uncorrected weakness for which defenders have had little or no time to deploy a vendor-provided fix before exploitation becomes possible. Certification exams may test the difference between the vulnerability, a zero-day exploit, and an active attack using that exploit. Because signatures and patches may not yet exist, organizations must rely on layered defenses…
Account deprovisioning is the process of disabling, removing, or modifying access when a person leaves an organization, changes roles, completes a contract, or no longer requires specific privileges. Certification exams often test whether candidates understand that disabling a primary directory account may not eliminate every form of access. A departing user may still have active cloud sessions, application…
Alert fatigue develops when analysts or users receive so many repetitive, low-quality, or poorly prioritized notifications that important warnings become difficult to recognize and investigate. Certification exams may describe a security operations team ignoring alerts after repeated false positives and ask candidates to identify the operational problem. Common causes include overly broad detection rules, duplicate…
An access review is a formal examination of user, administrator, service, and application permissions to determine whether each account still requires its assigned access. Certification exams may describe excessive or outdated privileges and ask which governance activity should identify and correct them. Reviewers should compare permissions with current job duties, employment status, business ownership, segregation…
An attack surface consists of every point where an unauthorized person could attempt to enter a system, manipulate its operation, or extract information. Certification questions may describe a growing environment and ask which action most effectively reduces its attack surface. Accounts, endpoints, applications, open ports, cloud services, programming interfaces, remote-access tools, vendors, and employees can all…
An attack vector is the route, method, or mechanism an attacker uses to gain access to a system, deliver malicious content, or influence a user. Exam scenarios often require candidates to identify the vector before selecting the most effective preventive control. Common attack vectors include phishing messages, stolen credentials, malicious websites, infected removable media, vulnerable internet-facing services…
An exploit is a technique, command sequence, or piece of software designed to take advantage of a vulnerability and produce an unintended result. Certification exams often distinguish the exploit from the underlying weakness and from the payload delivered afterward. For example, a coding error may be the vulnerability, specially crafted input may be the exploit, and ransomware may be the resulting payload. Not…
An immutable backup is a protected copy of data that cannot be modified or deleted during a defined retention period, even by accounts that normally possess administrative privileges. Certification exams may connect immutability with ransomware recovery, insider threats, retention controls, and protection against compromised backup administrators. Attackers frequently attempt to erase or encrypt recovery data…
An indicator of compromise is an observable clue suggesting that malicious activity may have occurred within a system or environment. Certification exams may present a suspicious file hash, unfamiliar domain, unexpected account, altered configuration, unusual process, or unauthorized network connection and ask candidates to classify it as an indicator requiring investigation. An indicator is not automatic proof of…
Broken access control occurs when an application fails to enforce what an authenticated or unauthenticated user is permitted to view, change, create, or delete. Certification exams may present a user who changes a record identifier, enters a hidden web address, or modifies a request and then gains access to another person’s data. Hiding a button or menu option does not protect the underlying function because…
Chain of custody is the documented record of how evidence was collected, identified, transferred, stored, examined, and protected from the moment it was acquired. Certification exams may ask why investigators record who handled an item, when possession changed, where it was stored, and what actions were performed. This documentation helps demonstrate that evidence presented during legal, disciplinary, or…
Code signing uses a digital signature to help recipients verify the identity associated with a software publisher and determine whether the signed code changed afterward. Certification exams may ask candidates to connect code signing with authenticity, integrity, certificates, hashing, and public-key cryptography. The publisher calculates a hash of the software and signs that value with a private key, while the…
Command and control is the communication mechanism an attacker uses to send instructions to a compromised system and receive status information, stolen data, or the results of executed commands. Certification exams may refer to this activity as C2 and ask candidates to identify unusual outbound traffic, repeated beaconing, or connections to suspicious infrastructure. Attackers may attempt to conceal…
Credential stuffing is an attack that uses stolen username-and-password combinations from one service to attempt access to accounts on other services. Certification exams frequently connect this technique with password reuse because the attack succeeds when a person uses the same credentials across multiple websites or applications. Attackers may automate thousands of login attempts and then exploit successful…
Cross-site request forgery occurs when an attacker causes a logged-in user’s browser to submit an unwanted request to a trusted application. Certification exams may describe a victim visiting a malicious page while already authenticated to another service and ask candidates to identify why the second application accepts the request. Because the browser automatically includes session cookies, the application may…
Cross-site scripting, or XSS, occurs when an application allows malicious script content to execute in another user’s browser within the context of a trusted website. Certification exams may ask candidates to distinguish stored, reflected, and document-based forms of XSS or identify the appropriate defensive control. A stored attack saves malicious content in a database or page, while a reflected attack returns…
Data exfiltration is the unauthorized transfer of information from an organization’s systems to a location controlled by an attacker or another unapproved party. Certification exams may describe unusual outbound traffic, large archive files, unauthorized cloud uploads, removable-media activity, or sensitive documents sent through personal email. Exfiltration may occur in one large transfer or through small…
Dependency confusion occurs when a software build or package-management system retrieves an attacker-controlled public package instead of the organization’s intended internal dependency. Certification exams may describe identical package names in private and public repositories and ask candidates to identify the software supply-chain risk. An attacker may publish a package with the expected internal name and a…
Egress filtering controls traffic that leaves a network, system, application, or security boundary. Certification exams may describe unauthorized outbound connections, command-and-control communication, or data transfers and ask which control can restrict them. Organizations can permit only approved destinations, protocols, ports, applications, or user groups while blocking unexpected activity. For example…
Fileless malware performs much of its malicious activity in memory or through trusted system tools instead of depending on a conventional executable file stored permanently on disk. Certification exams may test why signature-based file scanning alone can miss this activity and why the term fileless does not mean that no files, scripts, or artifacts are ever involved. An attacker may use a malicious document, script…
Input validation checks whether data supplied to an application matches the expected format, type, length, range, and permitted values before the application processes it. Certification exams may present malformed or unexpected user input and ask which secure-development practice can reduce the resulting risk. Applications should treat information from forms, files, cookies, application programming interfaces…
Lateral movement is the process an attacker uses to move from an initially compromised account, device, or system to other resources within the same environment. Certification exams may present a scenario in which one workstation is breached and ask which activity indicates that the attacker is attempting to reach more valuable targets. Common techniques include using stolen credentials, remote administration…
