14.1 Deductive Logic & Syllogisms

U.S. Air Force Cyber Test CSAT/ICTL

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts 1.2 Cyber AFSCs & Qualification Pipeline 1.3 How to Use This Guide & Study Plan

2 Number Systems & Encoding

2.1 Binary & Decimal Conversion 2.2 Hexadecimal & ASCII 2.3 Bitwise Operations & Two's Complement

3 Computing Architecture

3.1 Memory Hierarchy 3.2 CPU, Components & Data Path 3.3 Core Data Structures

4 Boolean Logic & Storage

4.1 Boolean Algebra & Logic Gates 4.2 Encoding, Files & Storage Concepts

5 Networking Models

5.1 OSI Model 5.2 TCP/IP Model & Encapsulation 5.3 Topologies & Transmission Media

6 Addressing & Subnetting

6.1 IPv4 Addressing 6.2 Subnetting & CIDR 6.3 IPv6 Fundamentals

7 Protocols & Network Services

7.1 TCP, UDP & Well-Known Ports 7.2 DNS & DHCP 7.3 Routing & Switching Basics

8 Cybersecurity Foundations

8.1 CIA Triad & Security Goals 8.2 Threats, Vulnerabilities & Malware 8.3 Social Engineering & Human Factors

9 Defensive Controls

9.1 Access Control & Authentication 9.2 Firewalls, IDS & IPS 9.3 SIEM & Defense in Depth

10 Programming Fundamentals

10.1 Variables, Types & Operators 10.2 Control Flow 10.3 Functions & Recursion

11 Languages & Debugging

11.1 Python Essentials for the Cyber Test 11.2 C++ Basics & Debugging Concepts

12 Operating Systems

12.1 Linux Fundamentals & Commands 12.2 Windows Fundamentals 12.3 Processes, Permissions & File Systems

13 Cryptography

13.1 Symmetric Encryption (AES) 13.2 Asymmetric Crypto & PKI 13.3 Hashing, MACs & Integrity

14 ICTL-Style Logic Reasoning

14.1 Deductive Logic & Syllogisms 14.2 Sequences & Pattern Recognition 14.3 Arrangement & Conditional Puzzles

15 Test Strategy & Mixed Review

15.1 Pacing, Elimination & AF Testing Day 15.2 Mixed Domain Review & Next Steps

14.1 Deductive Logic & Syllogisms

Key Takeaways Explain This Topic AI

Deduction guarantees the conclusion if the premises are true and the form is valid; induction only makes the conclusion probable

Standard categorical forms: All A are B, No A are B, Some A are B, Some A are not B — track which terms are distributed

Common invalid traps: undistributed middle, illicit major/minor, affirming the consequent, and denying the antecedent

Translate everyday wording into standard form before testing validity; never let familiar subject matter replace form checks

Use a quick Venn or term-circle sketch under time pressure to spot when a conclusion is forced versus merely possible

Last updated: July 2026

The Cyber Test (CT), formerly the Information and Communications Technology Literacy (ICTL) assessment, includes a logic-and-reasoning heritage that rewards structured thinking as much as technical recall. Cyber operations constantly require you to decide what must follow from stated rules, logs, and policies. Syllogisms and related deductive forms train that habit: given clear premises, what conclusion is forced?

This section is aptitude practice, not a claim that any one published CT blueprint publishes a fixed percentage of syllogism items. Treat it as transferable reasoning skill that supports both the logic slice of prep (~8% in this guide's study map) and day-to-day cyber triage.

Deduction vs. Induction

Deduction moves from general rules to a specific conclusion that must be true if the premises are true and the argument form is valid. Example: All routers forward packets; device R is a router; therefore R forwards packets.

Induction generalizes from samples. Example: The last five phishing emails used urgent language; therefore the next phishing email will use urgent language. That conclusion may be likely, but it is not guaranteed.

On timed aptitude items, the trap is treating a plausible story as a valid deduction. Always ask: If I accept only what the premises state, is the conclusion forced?

Categorical Statements (Standard Form)

Most syllogism drills use four categorical forms:

Form Meaning Subject distributed? Predicate distributed?

All A are B Every A is inside B Yes No
No A are B A and B share no members Yes Yes
Some A are B At least one A is a B No No
Some A are not B At least one A is outside B No Yes

Distributed means the statement says something about the entire class. Validity rules care about this: you cannot conclude something about all of a class if a premise only mentioned some of it.

Worked translation

Everyday wording hides the form:

"Every firewall drops unmatched inbound SYN packets" → All firewalls (in this policy set) are devices that drop unmatched inbound SYN packets.

"No analyst without clearance may open the vault" → No uncleared analysts are vault-authorized persons.

"A few endpoints still run the legacy agent" → Some endpoints are legacy-agent hosts.

Translate first; argue second.

The Classic Syllogism Shape

A categorical syllogism has two premises and one conclusion, and three terms total: major, minor, and middle.

Valid example (Barbara form):

All packet filters are network controls.

All ACLs are packet filters.

Therefore, all ACLs are network controls.

Sketch: ACL ⊂ packet filter ⊂ network control. The conclusion is forced.

Invalid example (undistributed middle):

All IDS sensors are monitoring tools.

All SIEM collectors are monitoring tools.

Therefore, all SIEM collectors are IDS sensors.

Both premises place their subjects inside "monitoring tools," but neither premise forces SIEM collectors into the IDS subset. Two classes can share a broader category without overlapping each other. This is the undistributed middle : the middle term ("monitoring tools") never appears as a fully distributed link between the other two classes in a way that forces the conclusion.

Valid vs. Invalid: More Worked Puzzles
Puzzle A — valid "No…All…Therefore No…"

Premises:

No unclassified systems are TS vault hosts.

All guest Wi-Fi clients are unclassified systems.

Therefore, no guest Wi-Fi clients are TS vault hosts.

Reasoning: Guest clients sit entirely inside unclassified systems; unclassified systems share nothing with TS vault hosts; therefore guest clients share nothing with TS vault hosts. Valid.

Puzzle B — invalid illicit major

Premises:

All zero-day exploits are high-priority incidents.

No phishing emails are zero-day exploits.

Therefore, no phishing emails are high-priority incidents.

The conclusion says something about all high-priority incidents relative to phishing, but the first premise never distributed "high-priority incidents" ("All zero-days are high-priority" does not mean "All high-priority are zero-days"). Phishing can still be high-priority for other reasons. Invalid.

Puzzle C — some statements

Premises:

Some SOC tickets are false positives.

All false positives are closed without escalation.

Therefore, some SOC tickets are closed without escalation.

The overlapping "some" region of SOC tickets that are false positives must also lie in the "closed without escalation" set. Valid.

Change the conclusion to "All SOC tickets are closed without escalation" and it becomes invalid — "some" never upgrades to "all."

Conditional Logic Companion Forms

Cyber Test-style reasoning also uses if-then chains that look like syllogisms in disguise.

Let P → Q mean "If P, then Q."

Pattern Form Valid?

Modus ponens P → Q; P; therefore Q Yes
Modus tollens P → Q; not Q; therefore not P Yes
Affirming the consequent P → Q; Q; therefore P No
Denying the antecedent P → Q; not P; therefore not Q No
Worked conditional set

Rule: If a host fails posture check, then it is quarantined.

Host A fails posture check → Host A is quarantined. ( Valid — modus ponens)
Host B is not quarantined → Host B did not fail posture check. ( Valid — modus tollens / contrapositive)

Host C is quarantined → Host C failed posture check. ( Invalid — affirming the consequent; quarantine may occur for other reasons)

Host D did not fail posture check → Host D is not quarantined. ( Invalid — denying the antecedent)

The contrapositive of P → Q is not-Q → not-P. It is logically equivalent to the original rule. The converse Q → P and the inverse not-P → not-Q are not equivalent.

Exam Method Under Time Pressure

Rewrite premises in standard form (All/No/Some…).

Circle the three terms; confirm the middle term actually links them.

Ask whether the conclusion is forced or only possible.

For if-then items, name the pattern (ponens, tollens, or a fallacy) before picking an answer.

Ignore real-world cyber knowledge that is not in the premises — aptitude items punish "helpful" outside facts.

Quick Venn Habit

For two-circle checks: draw subject and predicate circles. Shade "No" exclusions, outline "All" inclusions, and mark an X for "Some." If the conclusion's claim is already required by the diagram, accept it; if the diagram still allows a counterexample, reject it.

Practice until the invalid patterns feel automatic. In cyber work, the same discipline prevents leaping from "alert fired" to "attacker confirmed" without a valid chain of evidence.