CSX Cheat Sheet 2026

The 30 highest-yield CSX facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. What should be regularly tested to ensure operational resilience after an incident? → Disaster recovery plan
2. What is a 'preservation letter' (or evidence preservation request) used for in cybercrime investigations? → Requiring a provider to retain specific data while legal process is obtained
3. Which technique allows an attacker to passively monitor Wi-Fi traffic on a network they are not associated with by placing a wireless adapter in monitor mode? → Packet capture via promiscuous mode on wireless
4. Which term refers to limiting user access to only what is necessary for their job? → Least privilege
5. What does the Fourth Amendment protect against in CSX operations? → Unreasonable searches and seizures by requiring probable cause or warrants
6. Which endpoint protection feature uses behavioral analysis to detect malware that has never been seen before? → Heuristic/behavioral analysis
7. Which port number is associated with HTTPS traffic by default? → 443
8. During a full-interruption test of a disaster recovery plan, what happens to the primary systems? → They are shut down and all operations shift to the recovery site
9. What does CPTED stand for in CSX security planning? → Crime Prevention Through Environmental Design
10. During incident recovery, a 'chain of custody' log is MOST important for: → Preserving evidence integrity for potential legal proceedings
11. What is the 'plain view' doctrine and how does it apply to digital forensic searches? → Evidence in plain sight during a lawful search can be seized without an additional warrant
12. Which of the following is an example of a 'closed question' in an investigative interview? → Did you click on the link in the email?
13. An organization needs to ensure users accessing a VPN from personal devices meet minimum security posture requirements. Which technology BEST enforces this? → Network Access Control (NAC)
14. What is the correct order when documenting a crime scene under the 'order of volatility' principle? → CPU registers → RAM → Network state → Disk
15. Which of the following BEST supports long-term sustainability of security operations after an incident? → Integrating lessons learned into updated policies, training, and controls
16. A forensic analyst needs to document that a disk image is an exact copy of the original. Which method is most appropriate? → Comparing SHA-256 hashes of the original and the image
17. What does the Fourth Amendment protect against in CSX operations? → Unreasonable searches and seizures by requiring probable cause or warrants
18. Which metric indicates how quickly systems must be restored after a disruption? → Recovery Time Objective
19. Why is asset classification important in threat assessment? → It identifies critical systems to secure first
20. Which type of audience requires the most technical detail in a cybersecurity report? → Security operations team
21. What does CPTED stand for in CSX security planning? → Crime Prevention Through Environmental Design
22. What is 'spoliation of evidence' in the context of a cybercrime investigation? → Intentional or negligent destruction of evidence relevant to litigation
23. What does analyzing the $I30 index attribute in NTFS reveal to a forensic investigator? → Directory contents including potentially deleted file entries
24. Which attack technique involves an adversary intercepting communications between two parties without either party being aware? → Man-in-the-Middle (MitM) attack
25. What is a 'false positive' in the context of SOC alert management? → An alert triggered by legitimate activity that is mistakenly identified as malicious
26. Which hashing algorithm is currently recommended by NIST for producing a 256-bit digest? → SHA-256
27. Which metrics are most commonly used to measure SOC effectiveness in detecting and resolving incidents? → Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR)
28. An investigator recovers a file from unallocated disk space. What process was used to find this file? → File carving
29. In a recovery scenario, 'failback' refers to: → Returning operations to the primary site after it has been restored
30. What is a major benefit of system redundancy in recovery planning? → Ensures high availability