Anki Flashcard Deck (133 Cards)

1. EC-Council
2. ·You are here

Updated 11 Sep 2026 . 26 min read . Hafidz . v2025-10-01 . CEH

CEH v13 Flashcard Deck - 126 Anki Cards

Domain-weighted deck. Each card has Front / Back / Domain / Tags. Card types: ≈50% definition, ≈30% comparison, ≈10% port-number, ≈5% Nmap flag, ≈5% ATT&CK tactic.

---

Card #1

Front: What is an APT? Back: Advanced Persistent Threat - state-funded, multi-year dwell, custom tooling, zero-days, supply-chain reach. Examples: APT28, APT29, Lazarus, Equation. Domain: 1 | Tags: actor, definition, exam-must

Card #2

Front: Ransomware + double extortion → which threat actor class is most likely? Back: Organized cybercrime / RaaS affiliate. High attack volume, profit motive, public leak site. Domain: 1 | Tags: actor, ransomware, exam-must

Card #3

Front: Lockheed Martin Cyber Kill Chain - how many phases and what are they in order? Back: 7 phases: Reconnaissance → Weaponization → Delivery → Exploitation → Installation → Command and Control (C2) → Actions on Objectives. Domain: 1 | Tags: kill-chain, definition, exam-must

Card #4

Front: MITRE ATT&CK Enterprise - how many tactics and the first three in order? Back: 14 tactics. First three: Reconnaissance → Resource Development → Initial Access. Domain: 1 | Tags: mitre, tactics, exam-must

Card #5

Front: Diamond Model - what are the four vertices of every intrusion event? Back: Adversary × Capability × Infrastructure × Victim (plus Sociopolitical and Technology meta-features). Domain: 1 | Tags: diamond-model, definition, exam-must

Card #6

Front: Fileless malware vs file-based malware - key difference for detection? Back: Fileless lives in memory/registry, abuses LOLBins (PowerShell, WMI), bypasses signature AV. Detection must be behavioral (Sysmon, sandbox), not hash-based. Domain: 1 | Tags: malware, comparison, lolbins

Card #7

Front: Ransomware-as-a-Service (RaaS) vs traditional ransomware - key operational difference? Back: RaaS splits dev/operator/affiliate roles. Affiliates pay a cut to use the locker + leak site (LockBit, ALPHV/BlackCat). Traditional = single actor full chain. Domain: 1 | Tags: ransomware, comparison, raas

Card #8

Front: Which MITRE ATT&CK Enterprise tactic covers SUNBURST’s trojanized Orion update delivery? Back: Initial Access - specifically technique T1195.002 (Compromise Software Supply Chain). Domain: 1 | Tags: mitre, tactic, supply-chain, sunburst

Card #9

Front: Kill Chain vs MITRE ATT&CK - when does each apply? Back: Kill Chain = left-of-breach, time-sequenced, intrusion-centric. ATT&CK = post-compromise, behavior catalog (TTPs). Diamond Model = relationship graph for pivoting. Domain: 1 | Tags: comparison, kill-chain, mitre

Card #10

Front: Stuxnet combined which three malware categories? Back: Worm (self-propagating over network) + Virus (file-infector) + Rootkit (hid driver via NTFS ADS + IRP hooks). Domain: 1 | Tags: malware, stuxnet, comparison

Card #11

Front: What is Zero Trust in one sentence? Back: “Never trust, always verify.” Every request authenticated, authorized, and logged regardless of network location. Defined in NIST SP 800-207. Domain: 2 | Tags: zero-trust, definition, exam-must

Card #12

Front: Defense in depth - what is it? Back: Layered controls (perimeter, network, host, app, data) so a single failure is not catastrophic. People + process + technology. Domain: 2 | Tags: defense, definition, exam-must

Card #13

Front: SIEM vs SOAR - what is each, and which comes first? Back: SIEM = centralize logs, correlate, alert (detection). SOAR = playbook-driven response automation (acts on SIEM alerts). Implement SIEM before SOAR. Domain: 2 | Tags: siem, soar, comparison, exam-must

Card #14

Front: NGAV vs EDR vs XDR - relationship? Back: NGAV ⊂ EDR ⊂ XDR. NGAV = ML/behavioral AV (preventive). EDR = continuous telemetry + response (NIST 800-137). XDR = EDR plus email/identity/cloud/network correlation. Domain: 2 | Tags: endpoint, comparison, exam-must

Card #15

Front: NIDS vs HIDS - where do they sit and what do they miss? Back: NIDS = network span/tap (catches lateral movement, scans). HIDS = endpoint (catches local LOTL, file integrity). NIDS misses encrypted pre-decrypt payloads; HIDS misses cross-host correlation. Complementary. Domain: 2 | Tags: ids, ips, comparison

Card #16

Front: Signature-based vs Anomaly-based detection - trade-off? Back: Signature = pattern-match IOCs, low FP, blind to zero-day. Anomaly = statistical baseline + deviation, catches zero-day, higher FP. FP/FN inversely related. Domain: 2 | Tags: detection, comparison

Card #17

Front: STIX vs TAXII - what is each? Back: STIX = OASIS standard for cyber threat intelligence objects (JSON, 18 Domain Objects). TAXII = HTTPS RESTful transport for STIX (Collections pull + Channels pub/sub). Domain: 2 | Tags: stix, taxii, comparison

Card #18

Front: What is a honeypot and why is its data high-signal? Back: Decoy system with no production value. Any interaction is by definition suspicious → produces high-fidelity IOCs. A network of honeypots = honeynet. Domain: 2 | Tags: honeypot, definition

Card #19

Front: WAF vs NGFW - what does each inspect and at which layer? Back: WAF = Layer 7, HTTP/SQL/XML payloads against OWASP Top 10. NGFW = stateful + DPI + IPS + app awareness + identity (stateful L4 + L7). Domain: 2 | Tags: firewall, waf, comparison

Card #20

Front: What is NAC and what standard governs it? Back: Network Access Control - posture-checks devices before granting LAN access. IEEE 802.1X (EAP over LAN/RADIUS). Domain: 2 | Tags: nac, definition

Card #21

Front: What is the patch management loop in order? Back: Identify → Assess → Prioritize → Remediate → Verify → Report. Priority driven by CISA KEV + NVD CVSS. Domain: 2 | Tags: patch, definition

Card #22

Front: IOC vs IOA - atomic vs behavioral indicator? Back: IOC (Indicator of Compromise) = atomic artifact - IP, domain, hash, mutex, registry key. IOA (Indicator of Attack) = behavioral TTP - e.g., LSASS read by procdump. Domain: 2 | Tags: ioc, ioa, comparison

Card #23

Front: Passive vs Active reconnaissance - key difference? Back: Passive = no packets touch target (search engines, WHOIS, Shodan, CT logs). Active = direct query to target (DNS queries, traceroute, light scan). Active crosses the line into scanning for some authors. Domain: 3.A | Tags: recon, comparison, exam-must

Card #24

Front: What is OSINT? Back: Open-Source Intelligence - collection from publicly available sources (search engines, social media, breach corpora, CT logs, WHOIS) without touching target infrastructure. Domain: 3.A | Tags: osint, definition, exam-must

Card #25

Front: theHarvester - what does it collect? Back: Aggregates emails, subdomains, hosts, names from Bing, crtsh, Shodan, VirusTotal, Hunter. Example: theHarvester -d example.com -b bing,crtsh -l 500. Domain: 3.A | Tags: osint, tool

Card #26

Front: Maltego - what does it do in a recon workflow? Back: GUI link-analysis tool. Turns a single domain into a graph of subdomains, MX, emails, breach hits, ASN ownership - supports pivoting on new entities. Domain: 3.A | Tags: osint, tool

Card #27

Front: Nmap -sS - what scan type and key property? Back: TCP SYN scan (half-open). Default if root. Fast, stealthy - never completes the 3-way handshake. Domain: 3.A | Tags: nmap, flag, exam-must

Card #28

Front: Nmap -sT - when do you use this? Back: TCP connect() scan. Completes 3-way handshake. Use when you lack raw sockets (non-root) or when raw packets are blocked. Domain: 3.A | Tags: nmap, flag

Card #29

Front: Nmap -sN - what scan and what RFC loophole does it exploit? Back: NULL scan - no flags set. Exploits RFC 793: closed ports reply RST, open ports give no response. Works only on Unix; Windows replies RST regardless. Domain: 3.A | Tags: nmap, flag, exam-must

Card #30

Front: Nmap -sF - what scan, and what does it have in common with -sN? Back: FIN scan - only FIN flag set. Same RFC 793 logic as NULL: closed → RST, open → no response. Unix-only. Domain: 3.A | Tags: nmap, flag

Card #31

Front: Nmap -sX - what scan, and why is it called “XMAS”? Back: XMAS scan - FIN + PSH + URG flags set (“packet lit up like a Christmas tree”). Same RFC 793 logic as NULL/FIN. Domain: 3.A | Tags: nmap, flag

Card #32

Front: Nmap -sA - what scan and what does it actually map? Back: ACK scan - cannot determine open/closed; only filtered vs unfiltered. Used to map firewall rulesets (stateful vs stateless). Domain: 3.A | Tags: nmap, flag

Card #33

Front: Nmap -sI zombie[:port] - what scan and the key advantage? Back: Idle / zombie scan - uses a third-party host’s IP-ID side-channel. Target never sees your IP. True attribution blindness. Domain: 3.A | Tags: nmap, flag

Card #34

Front: Nmap -sU - what scan and why are results often open|filtered? Back: UDP scan. UDP has no SYN/ACK - open ports give no response, indistinguishable from filtered. Combine with -sV to disambiguate. Slow. Domain: 3.A | Tags: nmap, flag

Card #35

Front: Nmap -Pn - what does this flag do? Back: Skip host discovery - treat all hosts as up. Useful when ICMP is blocked but the host still answers on TCP/UDP. Domain: 3.A | Tags: nmap, flag

Card #36

Front: Nmap -D RND:10 - what is this and what problem does it solve? Back: Decoy scan - mixes your real probe with 10 random spoofed-source decoys. The target’s IDS sees multiple attackers, hiding your real IP. Domain: 3.A | Tags: nmap, stealth

Card #37

Front: DNS zone transfer command and tool for testing misconfigured NS? Back: dig axfr @ns1.example.com example.com. If it succeeds, anyone can dump the full zone. Tool: dnsenum --enum, fierce -dns example.com. Domain: 3.A | Tags: dns, recon

Card #38

Front: SNMP enumeration - default community strings and OID for sysName? Back: Default community strings: public (read) and private (read-write) - catastrophic if present. sysName OID: 1.3.6.1.2.1.1.5.0. Domain: 3.A | Tags: snmp, enumeration

Card #39

Front: Hydra vs Hashcat - online vs offline cracking? Back: Hydra = online brute against live services (SSH/FTP/HTTP/RDP/SMB), network-bound, triggers lockouts. Hashcat = offline hash cracking on GPU, 300+ modes (-m). Use John for unknown/file formats. Domain: 3.B | Tags: passwords, comparison, exam-must

Card #40

Front: Default port for SSH? Back: 22/TCP. Domain: 3.B | Tags: port, exam-must

Card #41

Front: Default port for FTP and FTPS (control)? Back: 21/TCP (FTP control). 20/TCP for FTP data (active mode). FTPS implicit = 990. Domain: 3.B | Tags: port

Card #42

Front: Default port for Telnet? Back: 23/TCP. Mirai brute-forces 23 and 2323. Domain: 3.B | Tags: port

Card #43

Front: Default port for HTTP? Back: 80/TCP. Domain: 3.B | Tags: port, exam-must

Card #44

Front: Default port for HTTPS? Back: 443/TCP. Domain: 3.B | Tags: port, exam-must

Card #45

Front: Default port for SMB? Back: 445/TCP (direct SMB). Legacy NetBIOS: 137-139/TCP+UDP. Domain: 3.B | Tags: port, exam-must

Card #46

Front: Default port for RDP? Back: 3389/TCP. Domain: 3.B | Tags: port

Card #47

Front: Default port for LDAP and LDAPS? Back: 389/TCP+UDP (LDAP). 636/TCP (LDAPS). Domain: 3.B | Tags: port

Card #48

Front: Default port for Microsoft SQL Server? Back: 1433/TCP. Domain: 3.B | Tags: port

Card #49

Front: Default port for MySQL? Back: 3306/TCP. Domain: 3.B | Tags: port

Card #50

Front: Default port for PostgreSQL? Back: 5432/TCP. Domain: 3.B | Tags: port

Card #51

Front: Default port for DNS? Back: 53/TCP+UDP. Domain: 3.B | Tags: port

Card #52

Front: Default port for Kerberos? Back: 88/TCP+UDP. Domain: 3.B | Tags: port

Card #53

Front: Default port for Kafka? Back: 9092/TCP. Domain: 3.B | Tags: port

Card #54

Front: Default port for SNMP? Back: 161/UDP (queries), 162/UDP (traps). Domain: 3.B | Tags: port

Card #55

Front: ARP poisoning - primary tool and the one switch control that defeats it? Back: Tools: Ettercap (-M arp:remote), BetterCAP (arp.spoof on), arpspoof (dsniff). Defense: Dynamic ARP Inspection (DAI) + DHCP snooping on managed switches. Domain: 3.B | Tags: arp, mitm, exam-must

Card #56

Front: SYN flood vs UDP flood - state-exhaustion vs volumetric? Back: SYN flood = L4 state-exhaustion (never complete handshake, fills conntable). Defense: SYN cookies (tcp_syncookies=1). UDP flood = L3/L4 volumetric, random ports → ICMP unreachable exhausts host. Domain: 3.B | Tags: ddos, comparison, exam-must

Card #57

Front: Mirai attack vector and the 62-entry dictionary it used? Back: Stateless SYN scan TCP/23 + TCP/2323 → brute-force Telnet with default credentials (root:xc3511, root:vizxv, admin:admin, root:root). Built ~600K-device botnet; 1.1 Tbps on Dyn (Oct 2016). Domain: 3.B | Tags: mirai, iot, botnet, exam-must

Card #58

Front: Slowloris - what layer, what technique, primary defense? Back: L7 low-and-slow. Opens connection, drip-feeds headers, never finishes → exhausts app threads. Defense: reverse proxy (nginx), short timeouts, max connections/IP. Domain: 3.B | Tags: ddos, slowloris, l7

Card #59

Front: Smurf attack - mechanism and one-line fix? Back: ICMP echo to broadcast address with spoofed victim source → every host replies to victim. Fix: disable directed broadcast, enforce BCP38 source-address validation. Domain: 3.B | Tags: ddos, smurf, amplification

Card #60

Front: KRACK - what does it attack and what does it achieve? Back: Attacks WPA2 4-way handshake - forces nonce reset by replaying message 3. Against AES-CCMP = packet decryption; against TKIP/GCMP = full forgery. Android 6.0+ installs all-zero key. Domain: 3.B | Tags: wireless, krack, wpa2

Card #61

Front: Bluejacking vs Bluesnarfing - difference? Back: Bluejacking = send OBEX/vCard to device (spam/phish lure, no data theft). Bluesnarfing = steal contacts/calendar/IMEI via OBEX PULL of telecom/pb.vcf etc. Domain: 3.B | Tags: bluetooth, comparison

Card #62

Front: BlueBorne (2017) - what was it and what was its impact? Back: 8 CVEs across L2CAP/SDP/BNEP/LEAP affecting Linux/Android/Windows/iOS. Wormable RCE with no user interaction. Pre-2017 devices vulnerable. Domain: 3.B | Tags: bluetooth, blueborne, rce

Card #63

Front: OWASP Top 10:2021 A01 - what is it? Back: Broken Access Control - IDOR, vertical/horizontal privilege escalation, force browsing. Defect = missing authorization checks. Domain: 3.C | Tags: owasp, definition, exam-must

Card #64

Front: OWASP Top 10:2021 A02 - what is it? Back: Cryptographic Failures - plaintext storage, weak hash, no TLS, predictable tokens. Defect = crypto misuse. Domain: 3.C | Tags: owasp, definition, exam-must

Card #65

Front: OWASP Top 10:2021 A03 - what is it and list the sub-families? Back: Injection - SQLi, NoSQLi, LDAP, OS command, template, XSS. Defect = untrusted input passed to interpreter. Domain: 3.C | Tags: owasp, injection, exam-must

Card #66

Front: OWASP Top 10:2021 A07 - what is it? Back: Identification and Authentication Failures - credential stuffing, weak passwords, no MFA, session fixation. Defense: phishing-resistant MFA (WebAuthn, passkeys). Domain: 3.C | Tags: owasp, authn

Card #67

Front: OWASP Top 10:2021 A10 - what is it and the canonical breach? Back: Server-Side Request Forgery (SSRF) - server fetches attacker-supplied URL. Canonical breach: Capital One 2019 (SSRF → IMDSv1 → IAM role → 106M records). Domain: 3.C | Tags: owasp, ssrf, capital-one, exam-must

Card #68

Front: UNION-based SQLi vs Boolean-blind SQLi - how does each exfiltrate? Back: UNION = append UNION SELECT … to original query, dump rows in response. Boolean-blind = ask true/false questions (AND 1=1 vs AND 1=2) and infer one bit at a time from page diff. Domain: 3.C | Tags: sqli, comparison, exam-must

Card #69

Front: Reflected XSS vs Stored XSS - payload location and persistence? Back: Reflected = payload in the request, reflected in the response (phish link). Stored = payload persisted in DB, served to every victim. DOM-based = client-side JS only. Domain: 3.C | Tags: xss, comparison, exam-must

Card #70

Front: CSRF - what defense prevents it? Back: SameSite=Strict cookie + per-request anti-CSRF token + Origin/Referer header check. The server must reject requests without a valid token. Domain: 3.C | Tags: csrf, defense

Card #71

Front: Best mitigation header for XSS? Back: Content-Security-Policy (CSP) - restricts script sources. Pair with input validation + context-aware output encoding. No single control is sufficient. Domain: 3.C | Tags: xss, csp, defense

Card #72

Front: Defense against SQLi - single best control? Back: Parameterized queries (prepared statements) - separates code from data. Escaping/filtering is weaker and bypassable. Domain: 3.C | Tags: sqli, defense, exam-must

Card #73

Front: WEP vs WPA3 - which crypto and which is offline-dictionary-resistant? Back: WEP = RC4 + 24-bit IV reuse (broken with ~40k packets via PTW). WPA3 = SAE (Simultaneous Authentication of Equals / Dragonfly), resists offline dictionary. Dragonblood (2019) showed timing/cache side-channel in WPA3. Domain: 3.C | Tags: wireless, comparison, exam-must

Card #74

Front: Evil twin - what is it and how do victims connect? Back: Same-SSID rogue AP. Victim devices auto-associate to the strongest signal, often the attacker’s AP. Used for captive-portal phishing (hostapd-wpe, wifiphisher, fluxion). Domain: 3.C | Tags: wireless, evil-twin

Card #75

Front: Stuxnet (2010) - what did it target and what was the result? Back: Target: Siemens S7-300/400 PLCs at Iran’s Natanz uranium enrichment facility. Result: ~1,000 centrifuges destroyed. Used 4 zero-days, signed driver theft (Realtek + JMicron), WinCC P2P propagation. Domain: 3.C | Tags: ics, stuxnet, exam-must

Card #76

Front: Purdue Model - levels 0-5 in order? Back: L0 sensors/actuators → L1 PLCs/RTUs → L2 HMI/SCADA → L3 IT/OT DMZ → L4 enterprise → L5 internet/cloud. L3 DMZ is the most defended boundary. Domain: 3.C | Tags: ot, purdue, definition

Card #77

Front: Modbus - what’s the security posture and who designed it? Back: Modbus (1979, Modicon/Schneider) - no authentication, no integrity, no encryption by design. Anyone who can speak Modbus to a PLC can usually read/write any register. Domain: 3.C | Tags: ot, modbus, definition

Card #78

Front: TRITON/TRISIS (2017) - what did it target? Back: Triconex Safety Instrumented System (SIS) at a Saudi petrochemical plant. Could have blocked the safety shutdown - designed to cause physical damage, not data theft. Domain: 3.C | Tags: ics, triton, trisis

Card #79

Front: Capital One 2019 breach - what was the kill chain in order? Back: SSRF in WAF → pointed at http://169.254.169.254/latest/meta-data/iam/security-credentials/ISRM-WAF-Role → IMDSv1 returned STS creds → over-provisioned IAM listed 700+ S3 buckets → ~106M records exfiltrated. AWS shipped IMDSv2 in response. Domain: 3.C | Tags: cloud, capital-one, ssrf, imdsv1, exam-must

Card #80

Front: IMDSv2 - what is it and why is it the fix for SSRF → cred theft? Back: Instance Metadata Service v2 - requires a PUT to obtain a session token, then includes it on GET. Rejects tokens for PUT-with-X-Forwarded-For. Defeats SSRF that only issues GETs. Domain: 3.C | Tags: cloud, imdsv2, defense

Card #81

Front: Shared responsibility - IaaS vs PaaS - who owns the OS? Back: IaaS (EC2) = customer owns OS, runtime, app, data, IAM. Provider owns hardware, hypervisor, network. PaaS (RDS, Beanstalk) = provider owns OS + runtime + middleware; customer owns app + data + IAM. Domain: 3.C | Tags: cloud, comparison

Card #82

Front: Tesla 2018 cloud breach - root cause? Back: Unauthenticated Kubernetes admin console exposed on the internet + AWS credentials stored in pod environment variables → attacker deployed Stratum Monero cryptominer. No customer data loss but canonical “console + env vars = cloud compromise.” Domain: 3.C | Tags: cloud, tesla, kubernetes

Card #83

Front: Codecov 2021 - what kind of attack and what did it exfiltrate? Back: Build-tool supply chain. Attacker’s GCS key from a Docker image intermediate layer modified the Bash Uploader to curl -d "$(env)" to attacker - exfiltrated every CI env var from >29,000 customer builds over 3 months. Domain: 3.C | Tags: supply-chain, codecov

Card #84

Front: Prowler - what does it scan? Back: Open-source AWS compliance scanner, 600+ checks, 44 frameworks (CIS, NIST, PCI). Multi-cloud variant (Prowler Cloud → Azure/GCP). AWS-first; for AWS post-foothold use Pacu. Domain: 3.C | Tags: cloud, tool

Card #85

Front: AES-128 vs AES-256 - same algorithm, which to choose? Back: Both AES (SPN, 128-bit block). AES-128 = 10 rounds. AES-256 = 14 rounds, post-quantum hedge. NIST 112-bit target until 2030 → 128-bit; both meet it. Choose 256 for top-secret/FDE. Domain: 3.C | Tags: crypto, comparison

Card #86

Front: DES vs AES - current status? Back: DES = 56-bit key, broken (< 1999). AES = 128-bit block, ≥128-bit key, current standard. 3DES deprecated 2023 (Sweet32). Use AES; for legacy interop, AES-256 only. Domain: 3.C | Tags: crypto, comparison, exam-must

Card #87

Front: RSA - minimum key length recommended today? Back: ≥ 2048 bits (≈ 112-bit security). NIST target for 128-bit security = 3072 bits or ECC P-256. Plan post-quantum migration (harvest-now-decrypt-later). Domain: 3.C | Tags: crypto, rsa, definition

Card #88

Front: MD5 vs SHA-256 - current status? Back: MD5 = 128-bit, broken (collisions trivial). SHA-256 = 256-bit (SHA-2 family), current standard for hashing, code signing, Bitcoin. SHA-1 also broken (SHAttered 2017). Domain: 3.C | Tags: crypto, hash, comparison

Card #89

Front: Birthday attack - what does it exploit and at what complexity? Back: Exploits the birthday paradox to find hash collisions in ~2^(n/2) operations. For n=128 (MD5) → 2^64 ≈ trivial. Use SHA-256 (n=256 → 2^128 collision resistance). Domain: 3.C | Tags: crypto, birthday, definition

Card #90

Front: POODLE (CVE-2014-3566) - what does it attack? Back: SSLv3 CBC padding not authenticated → byte-by-byte cookie decryption. Defense: disable SSLv3, use TLS 1.2+. Related: TLS_FALLBACK_SCSV prevents downgrade. Domain: 3.C | Tags: crypto, poodle, tls

Card #91

Front: Heartbleed (CVE-2014-0160) - what does it do? Back: OpenSSL buffer over-read in TLS heartbeat extension → leaks server private keys, session cookies, memory contents. Patched OpenSSL 1.0.1g; mass re-keying required. Domain: 3.C | Tags: crypto, heartbleed, openssl

Card #92

Front: Argon2id vs bcrypt - which is the modern recommendation? Back: Argon2id = memory-hard, configurable, modern choice (preferred). bcrypt = adaptive, slow by design (cost factor), still acceptable. Both defeat GPU parallelism. Never MD5/SHA-* alone. Domain: 3.C | Tags: crypto, password, comparison, exam-must

Card #93

Front: NTLM hash - algorithm? Back: MD4(UTF-16LE(password)) - no salt, fast to compute. Vulnerable to pass-the-hash and rainbow tables. Modern Windows uses Kerberos; NTLM still common internally. Domain: 3.C | Tags: crypto, ntlm, definition

Card #94

Front: MITRE T1550.002 - what technique? Back: Pass the Hash (PtH) - reuse captured NTLM hash to authenticate without knowing the plaintext. Defeated by disabling NTLM, forcing Kerberos + smart card. Domain: 3.C | Tags: mitre, tactic, credential-access, exam-must

Card #95

Front: MITRE T1548.001 - what technique? Back: Setuid and Setgid abuse - Linux/macOS privesc via SUID/SGID binaries. Find with find / -perm -4000 -type f. Mitigation: remove unnecessary SUID bits, noexec /tmp. Domain: 3.C | Tags: mitre, tactic, privilege-escalation

Card #96

Front: MITRE T1564.004 - what technique? Back: NTFS Alternate Data Streams (ADS) - hide file in stream on a host file (file.txt:hidden.exe). Used by Rustock.A. Mitigation: streams-aware AV; PowerShell Get-Item -Stream *. Domain: 3.C | Tags: mitre, tactic, defense-evasion

Card #97

Front: MITRE T1070.006 - what technique and how do defenders detect it? Back: Timestomp - rewrite $STANDARD_INFORMATION (SI) timestamp. Defender: compare SI to $FILE_NAME (FN) attribute - FN cannot be set from user mode, so a delta = smoking gun. Domain: 3.C | Tags: mitre, tactic, indicator

Card #98

Front: MITRE T1195.002 - what technique? Back: Compromise Software Supply Chain - inject malicious code into a legitimate update (SolarWinds/SUNBURST Orion DLL, xz-utils liblzma). Defense: SBOM, signed builds, Sigstore, reproducible builds. Domain: 3.C | Tags: mitre, tactic, supply-chain

Card #99

Front: BitLocker - what does it encrypt and what binds the key? Back: Windows full-disk encryption, AES-128/256 in XTS mode. Key bound to TPM (release key only if PCR measurements match). FDE only protects data at rest when powered off. Domain: 3.C | Tags: crypto, fde, bitlocker

Card #100

Front: OCSP vs CRL - certificate revocation? Back: CRL = periodically downloaded Certificate Revocation List (outdated, replaced by OCSP). OCSP = real-time per-cert query (privacy concerns → OCSP stapling is the modern fix). Domain: 3.C | Tags: crypto, pki, comparison

Card #101

Front: Padding oracle attack - what does it exploit? Back: CBC padding error messages leak whether padding was valid → byte-by-byte decryption. Defense: AEAD (AES-GCM, ChaCha20-Poly1305), constant-time decryption, no error-side-channel. Domain: 3.C | Tags: crypto, padding-oracle

Card #102

Front: Diffie-Hellman - purpose and recommended group size? Back: Key agreement (not encryption) - both sides derive a shared secret without sending it. Use DH-2048+ or ECDH P-256+. Logjam (2015) breaks 512-bit export-grade DH via MITM. Domain: 3.C | Tags: crypto, dh, definition

Card #103

Front: Black-box vs White-box vs Gray-box pen test - knowledge level? Back: Black = only public info (external adversary sim). White = full source + creds (audit, SDLC). Gray = partial knowledge (one user cred) - industry default. Domain: 4 | Tags: pentest, comparison, exam-must

Card #104

Front: Rules of Engagement (ROE) - what must it contain in writing? Back: Scope, test window & man-hours, tester source IPs/phones, emergency contacts, DoS/SE permissions, SOW change-control, data-handling, limited liability, kill-switch. Domain: 4 | Tags: roe, definition

Card #105

Front: Permission to Test (PTT) - why is it the most important document? Back: Written authorisation from the legal owner of every in-scope system, naming IPs/domains/time window. Without it, the test is a criminal act under CMA/CFAA/UK CMA. Verbal = no defence. Domain: 4 | Tags: legal, ptt, exam-must

Card #106

Front: STRIDE vs DREAD - what does each do? Back: STRIDE = threat category mnemonic (Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation of Privilege) - finds what can go wrong. DREAD = 1-10 scoring (Damage, Reproducibility, Exploitability, Affected, Discoverable) - ranks threats. Domain: 4 | Tags: threat-modeling, comparison

Card #107

Front: CVSS score range and Critical band? Back: 0.0-10.0. Critical = 9.0-10.0, High = 7.0-8.9, Medium = 4.0-6.9, Low = 0.1-3.9, None = 0.0. v4.0 has Base/Threat/Environmental/Supplemental metric groups. Domain: 4 | Tags: cvss, definition, exam-must

Card #108

Front: Penetration test vs Red Team - goal difference? Back: Pen-test = find and exploit vulns, scope-bounded, time-boxed. Red team = emulate a real adversary, goal-based, weeks-months, tests detection and response (blue-team gaps). Domain: 4 | Tags: pentest, red-team, comparison, exam-must

Card #109

Front: PCI DSS 4.0.1 Req 11.4 - what is the pen-test obligation? Back: External + internal pen-test annually + after significant change; segmentation pen-test annually (merchants) or 6-monthly (service providers); mandatory retest after fix; methodology from approved list (NIST 800-115, OWASP, PTES, OSSTMM). ASV scan ≠ pen test. Domain: 4 | Tags: compliance, pci, exam-must

Card #110

Front: CFAA - US statute number and the two operative phrases? Back: 18 U.S.C. §1030. Two operative phrases: “without authorization” and “exceeds authorized access”. No pen-test exemption; authorisation is the only defence. Van Buren v. US (2021) narrowed “exceeds” to areas the user is not entitled to enter. Domain: 4 | Tags: legal, cfaa, exam-must

Card #111

Front: GDPR - breach notification timeline? Back: 72 hours to the supervisory authority after becoming aware of a breach (Art. 33). Data subjects “without undue delay” if high risk (Art. 34). Article 32 obliges “regular testing” of security measures. Domain: 4 | Tags: legal, gdpr

Card #112

Front: NIST SP 800-115 - what is it? Back: Technical Guide to Information Security Testing & Assessment - the de facto US pen-test methodology. Phases: Planning, Discovery, Attack, Reporting. Closes on written authorisation before any technical work. Domain: 4 | Tags: methodology, nist, definition

Card #113

Front: Singapore CMCA Section 3(1) - what does it criminalise and the max penalty? Back: Knowingly causing a computer to perform any function to secure access without authority. Max: S$5,000 fine, 2 years imprisonment, or both. Section 12 criminalises attempts and preparatory acts - an unsuccessful test is still an offence. Domain: 4 | Tags: singapore, cmca, legal, exam-must

Card #114

Front: Singapore PDPA - breach notification timeline and max penalty? Back: 3 calendar days to PDPC for a notifiable breach (Part 6A). Max penalty: S$1 million or 10% of annual Singapore turnover, whichever is higher. Part 4 = Protection Obligation. Domain: 4 | Tags: singapore, pdpa, legal, exam-must

Card #115

Front: Singapore Cybersecurity Act 2018 (amended, in force 31 Oct 2025) - what does it do? Back: Regulates CII (Critical Information Infrastructure) operators across 11 sectors; licences two service types - penetration testing and managed SOC monitoring. CSA-licensed pen-testers required from 16 Mar 2026 (Cyber Trust mark Tier 3 Promoter). Domain: 4 | Tags: singapore, csa, legal

Card #116

Front: Singapore PDPA - when is a Data Protection Officer (DPO) mandatory? Back: Required for organisations processing personal data of > 5,000 individuals (in any rolling 12-month period). DPO enforces Protection/Notification/Access obligations and is the PDPC contact. Domain: 4 | Tags: singapore, pdpa, dpo

Card #117

Front: Singapore MAS TRM - what is it? Back: Technology Risk Management Guidelines - issued by the Monetary Authority of Singapore for banks, insurers, payment services. Covers cyber hygiene, access control, incident reporting, third-party risk, annual vulnerability assessment and independent penetration testing. Domain: 4 | Tags: singapore, mas, financial

Card #118

Front: Singapore CMCA - what is the single defence to any unauthorised access charge? Back: Written authorisation from the legal owner of every in-scope system. Verbal, implied, or after-the-fact authorisation is not a defence. Plus separate PDPA consent if personal data is touched, and CSA-licence verification from Mar 2026. Domain: 4 | Tags: singapore, cmca, authorisation

Card #119

Front: Singapore SkillsFuture SSG - what subsidy applies to CEH training? Back: Up to 70% subsidy for Singapore citizens/PRs on EC-Council-approved CEH training (subject to eligibility and T&Cs). Remaining cost can be paid via SkillsFuture credits. Domain: 4 | Tags: singapore, funding

Card #120

Front: Singapore - what is the EC-Council CEH retake rule for SG candidates? Back: 1 free retake if you bought the training bundle; otherwise $500 retake voucher (Pearson VUE / RPS / ECC). 14-day cool-down after the 2nd attempt. Domain: 4 | Tags: singapore, exam, logistics

Card #121

Front: Prompt injection - what is it? Back: Attacker-supplied text in an LLM prompt that overrides system instructions or exfiltrates context/data. Two forms: direct (in the prompt) and indirect (in retrieved content, e.g., a malicious web page). OWASP LLM Top 1. Domain: AI-v13 | Tags: ai-v13, llm, prompt-injection, exam-must

Card #122

Front: FraudGPT - what is it? Back: Underground GenAI cybercrime tool (advertised on dark-web markets since July 2023) - uncensored LLM fine-tuned for phishing emails, malware code generation, and scam scripts. No affiliation with legitimate AI vendors. Domain: AI-v13 | Tags: ai-v13, fraudgpt, malware

Card #123

Front: WormGPT - what is it and how does it differ from FraudGPT? Back: Uncensored LLM marketed to blackhats (2023) - built on GPT-J/LLaMA derivatives, removes safety filters. Used for BEC phishing, vulnerability research, exploit drafting. Similar class to FraudGPT; both bypass ChatGPT guardrails. Domain: AI-v13 | Tags: ai-v13, wormgpt, bec

Card #124

Front: AI-assisted reconnaissance - three concrete use cases for an attacker? Back: (1) Automated OSINT summarisation across pastebins/leaks; (2) AI-crafted spear-phish pretexts from social media; (3) Polymorphic malware payloads that mutate per delivery to bypass signature AV. Domain: AI-v13 | Tags: ai-v13, recon, polymorphism

Card #125

Front: Deepfake vishing - what is it and which real incident involved it? Back: AI-generated voice/video impersonation for vishing (voice phishing) and authorization fraud. Real cases: 2024 UK engineering firm Arup lost ~$25M to a deepfake CFO video call; multiple CFO/CEO impersonations reported globally 2023-2025. Domain: AI-v13 | Tags: ai-v13, deepfake, vishing

Card #126

Front: OWASP Top 10:2025 - two new categories to know for CEH v13? Back: A10 Mishandling of Exceptional Conditions (error/state handling defects exploited for info disclosure or DoS). A03 Software Supply Chain Failures (expanding 2021’s A06 Vulnerable Components - covers xz-utils, Codecov, SolarWinds class). SSRF folded into A01 as outbound authorization. Domain: AI-v13 | Tags: owasp, ai-v13, supply-chain

Card #127

Front: AI/ML polymorphic malware - why does it evade signature AV? Back: Generative model rewrites the binary/payload per delivery while preserving functionality (server-side per-recipient). No stable hash, no stable string. Defense: behavioural EDR, sandbox detonation, ML-based static analysis. Domain: AI-v13 | Tags: ai-v13, malware, edr

Card #128

Front: LLM hallucination as a security risk - three concrete cases? Back: (1) LLM cites non-existent CVE → blue team chases ghosts; (2) LLM generates insecure code that passes review (“looks right”); (3) LLM assistant leaks training data including secrets. All hit CEH-grade incidents 2023-2025. Domain: AI-v13 | Tags: ai-v13, llm, hallucination

Card #129

Front: CEH v13 - what AI/ML exam additions should you expect? Back: AI-assisted recon & social engineering, deepfake vishing, AI-generated malware/polymorphism, prompt injection against security copilots, supply-chain compromise of ML model artifacts (Pickle/TorchScript trojans), and LLM hallucination risk in blue-team tooling. Domain: AI-v13 | Tags: ai-v13, exam-must

Card #130

Front: Model artifact supply chain - what is the Pickle/torch.load risk? Back: Python Pickle deserialisation runs arbitrary code on pickle.load(); PyTorch’s torch.load() uses pickle under the hood. A trojaned model file from an unverified source = RCE. Defense: safetensors, signed model artifacts (Sigstore/MODELZOO), no untrusted weights_only=False. Domain: AI-v13 | Tags: ai-v13, supply-chain, ml

Card #131

Front: AI-driven credential stuffing - what makes it effective vs traditional? Back: LLM guesses context-aware passwords from user OSINT (pet names, birthdays, employer, lingo) at scale. Bypasses breached-password blocklists that only catch known leaks. Defense: passkeys/WebAuthn, password managers, rate-limit + CAPTCHA on auth. Domain: AI-v13 | Tags: ai-v13, credentials, passkey

Card #132

Front: RAG (Retrieval-Augmented Generation) poisoning - what is the attack? Back: Attacker injects malicious documents into the LLM’s knowledge base (vector DB, web index, shared drive) so the model retrieves attacker-controlled context on future queries. Indirect prompt injection via retrieved content. Domain: AI-v13 | Tags: ai-v13, rag, prompt-injection

Card #133

Front: Singapore - what is the licensing regime for pen-testers under the Cybersecurity (Amendment) Act 2024? Back: From 16 March 2026, providers of penetration testing and managed SOC monitoring services must hold a CSA-issued licence. Baseline requirement: active Cyber Trust mark at Tier 3 (Promoter) level. Foreign providers must partner with a locally licensed entity. Domain: 4 | Tags: singapore, csa, licensing, exam-must

Linked from

• CEH (Certified Ethical Hacker) - Complete Research & Study Kit