CCNA Cybersecurity (Cisco, exam 200-201) — knowledge map
The 31 core concepts of CCNA Cybersecurity (Cisco, exam 200-201) and how they connect. Click a node in the map above to explore related terms and prerequisites; the list below indexes every concept with its definition and links to its prerequisites and related concepts.
Concepts (31)
Threat and vulnerability
A threat is a potential cause of harm to information assets—such as unauthorized access, disaster, or human error—while a vulnerability is a weakness on the asset side that a threat can exploit, such as misconfiguration, unpatched software, or weak management. Risk is understood as the combination of the two: the possibility that a threat exploits a vulnerability to cause damage. Eliminating vulnerabilities makes risk less likely to materialize even when threats exist.
Exploit
The specific means or code that actually leverages a vulnerability to cause an unintended effect, such as unauthorized access, privilege takeover, or a denial of service. Where a vulnerability is the weakness, an exploit is the means of actually attacking it.
Related: Threat and vulnerability
Risk
The likelihood that a threat will exploit a vulnerability and actually cause harm. It is generally framed as probability times impact; a vulnerability alone does not create risk, only its combination with a threat capable of exploiting it.
Prerequisites: Exploit
Related: Threat and vulnerability
CVSS (severity)
Common Vulnerability Scoring System—a standard scoring vulnerability severity. For prioritization, combine with EPSS (exploit probability), reachability, and asset criticality.
Prerequisites: Exploit、Threat and vulnerability
DevSecOps
The practice of building security verification into the earliest stages of development rather than bolting it on after release (shift left). Automated vulnerability scanning and code review are embedded in the CI/CD pipeline so defects are found and fixed while they are still cheap to fix.
Prerequisites: Threat and vulnerability
MDM (mobile device management) and patch management
MDM (mobile device management) centrally applies security policy — enforced encryption, remote wipe, app restrictions — to the smartphones and tablets an organization issues or authorizes. Patch management is the ongoing operational practice of testing and rolling out OS and software fixes on a planned schedule to shorten the window during which a known vulnerability can be exploited. Both are foundational security management activities alongside hardening and asset management.
Prerequisites: Asset management、Threat and vulnerability
NetFlow
A technology by which routers and switches export the traffic they see as flow-level statistics keyed by the 5-tuple — byte and packet counts, start and end times, and so on. Because it does not store full packets, it is lightweight and well suited to understanding large-scale traffic patterns and detecting anomalies (a leading example of transaction data).
Related: Types of monitoring data (full packet capture, session, transaction, metadata, alert)、5-tuple
Asset management
Accurately tracking and managing the hardware and software an organization owns, typically via an inventory. Without knowing what you own, patching and vulnerability response inevitably have gaps, so this is a foundational activity underpinning security measures.
Prerequisites: Threat and vulnerability
Vulnerability management
The ongoing process of continually identifying and assessing the vulnerabilities present in an organization's systems, then prioritizing and remediating or mitigating them by severity. It cycles through scanning to identify issues, scoring them (e.g., with CVSS), applying patches or hardening, and reverifying.
Prerequisites: Threat and vulnerability、CVSS (severity)
Threat modeling
A method to systematically analyze "where/how a system could be attacked" at design time. Surfaces threats to business-critical apps and bakes mitigations into the design (part of shift-left DevSecOps).
Prerequisites: DevSecOps、Threat and vulnerability
Threat protection and threat intelligence
Capabilities for detecting, analyzing, and responding to attacks. Microsoft Defender XDR unifies signals across domains to deliver extended detection and response (XDR).
Prerequisites: Threat and vulnerability
5-tuple
The combination of source IP address, destination IP address, source port, destination port, and protocol. This five-value tuple uniquely identifies a single communication flow, making it the basic starting point for pinpointing a compromised host or conversation from logs or NetFlow records.
Related: NetFlow
False positive, false negative, true positive, and true negative
Four outcomes for grading an alert. A true positive (TP) is a real threat correctly flagged. A true negative (TN) is the correct absence of an alert when there is no threat. A false positive (FP) is an alert raised when there is no threat — too many of these cause analyst fatigue (alert fatigue). A false negative (FN) is a real threat that the alert missed entirely — the most dangerous kind of mistake.
Prerequisites: Threat and vulnerability
Malware analysis (reverse engineering)
The work of uncovering what a malware sample does, what it communicates with, and how far it has spread, by combining dynamic analysis (running the sample in a safe environment and observing its behavior) with static analysis via disassembly/decompilation (reverse engineering) of the code itself. SOC analysts extract IoCs from the results and feed them into detection rules.
Types of monitoring data (full packet capture, session, transaction, metadata, alert)
Full packet capture stores everything including the payload — detailed but heavy. Session data (flow data such as NetFlow) records a flow-level summary (who talked to whom, when, how much, and on which ports). Transaction data is a record of application-layer exchanges themselves, such as HTTP requests or DNS queries. Metadata is attribute information about a communication rather than the communication itself. Alert data is the notification an IDS/IPS or similar tool generates as a detection result. Knowing which type to consult for a given purpose is the point.
Related: NetFlow
PSI and intellectual property (IP)
Classifications of data that must be protected on a network. The exam lists PII (personal data), PHI (health data), PSI, and IP (intellectual property). PSI is a category for highly sensitive information; its acronym expansion is not standardized across materials (variously given as personal security information or payment-related information). When payment card data is involved, the precise term is the cardholder data (CHD — the PAN card number, expiry, etc.) that PCI DSS governs. IP (intellectual property) is intangible assets an organization holds rights to — patents, trademarks, trade secrets, and proprietary technical information. All carry major impact if exposed, and so are subject to classification, access control, and encryption.
Prerequisites: Sensitive data protection (PII / masking)
SOC metrics (time to detect, contain, and respond)
The core metrics used to gauge SOC effectiveness: time to detect (from when a threat occurs to when it is caught), time to contain (from detection to containment), and time to respond (from detection to completed response), among others. Shortening these is a primary goal of improving SOC operations.
Prerequisites: Threat and vulnerability
Threat actor
A classification of who is behind an attack: low-skill thrill-seeking script kiddies, hacktivists pursuing a political message, financially motivated organized crime groups, nation-state actors running APT campaigns with state backing, and insiders who abuse legitimate access. Their capability and motive shape how defenders prioritize the risk.
Prerequisites: Threat and vulnerability
Diamond Model
A forensic analysis model for examining a single intrusion event in terms of four vertices — adversary, capability, infrastructure, and victim — and the relationships among them. Where the cyber kill chain tracks a chronological sequence of stages, the Diamond Model instead focuses on the relationships among the elements of one attack event.
Prerequisites: Cyber kill chain
Sensitive data protection (PII / masking)
Protecting sensitive data such as PII (personally identifiable information) and PHI: discover/classify with Macie, then protect via encryption, access control, and minimization. Masking/tokenization hides values, and handling varies by data classification; also prevent sensitive data leaking into logs.
Cyber kill chain
A model that organizes the stages of a targeted attack as reconnaissance, weaponization, delivery, exploitation, installation, command-and-control, and actions on objectives. It is used to consider effective defenses at each stage and analyze where the attack chain can be broken.
Command injection
An attack technique that gets an unintended OS command executed on the server through a web application's input field. It arises from implementations that pass input straight into part of a shell command, and is prevented by validating input and replacing shell invocations with APIs that avoid the shell entirely. Like the related SQL injection and cross-site scripting (XSS), insufficient input sanitization is the root cause.
Prerequisites: SQL injection、Cross-site scripting (XSS)
Discretionary Access Control (DAC)
An access-control model in which the owner of a resource decides at their own discretion who gets what access. It is flexible but vulnerable to a careless or mistaken grant by the owner, in contrast to mandatory access control (MAC), where the system centrally enforces the decision.
Related: Mandatory Access Control (MAC)
SQL injection
An attack technique that injects malicious SQL fragments into a web application's input fields to manipulate or view a database in unintended ways. It is prevented by using bind variables (placeholders) and validating input values.
Cross-site scripting (XSS)
An attack technique that injects malicious script into a vulnerable website so it executes in a visitor's browser, potentially leading to cookie theft or a spoofed display. Escaping (sanitizing) output is the basic countermeasure.
Sandbox (malware analysis)
A mechanism that safely runs an unknown executable — such as an email attachment — inside a virtual environment (sandbox) isolated from production, to check for suspicious behavior before it can cause harm. Its value is that even malware that slips past pattern-matching detection can be observed in a harmless environment before execution; however, sandbox-evading malware that detects it is running inside a sandbox and disguises its activity is an emerging challenge.
Prerequisites: Malware analysis (reverse engineering)
NIST SP 800-61 and NIST SP 800-86
NIST SP 800-61 defines the incident-response lifecycle: preparation, detection and analysis, containment/eradication/recovery, and post-incident activity. NIST SP 800-86 defines forensic evidence-collection procedures — such as collecting the most volatile data first — along with how to preserve integrity and store evidence. The two complement each other: in the field, SP 800-86's evidence-handling standards are applied within SP 800-61's response workflow.
Prerequisites: Volatile data
Volatile data
Data that disappears when power is lost or time passes — CPU registers, cache, running processes, network connection state, and the contents of memory. In a forensic investigation, this fleeting data must be collected before durable data on disk, following the order of volatility.
Windows Defender and host-based firewalls
Windows Defender (now renamed Microsoft Defender Antivirus) is the malware-protection and threat-detection software built into Windows by default. A host-based firewall is a firewall installed on an individual device (host) rather than at the network perimeter, allowing or denying traffic for that device alone (e.g., Windows Firewall).
Prerequisites: Threat and vulnerability
Mandatory Access Control (MAC)
An access-control method in which the system centrally enforces access decisions based on security labels assigned to information and users. Even the owner of the information cannot loosen permissions against policy. It contrasts with discretionary access control (DAC), which leaves decisions to the owner.
Related: Discretionary Access Control (DAC)
Principle of least privilege and RBAC
The principle of least privilege grants users only the minimum access needed for their duties; RBAC (role-based access control) implements it by assigning permissions to job roles rather than to individuals. This makes it easier to review access on transfer or departure and limits the risk of over-provisioned privileges.
Prerequisites: Risk