Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

2. Technologies and Tools > 2.1 Install and configure network components > Flashcards

2.1 Install and configure network components Flashcards

1
Q

Firewall

A

A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules

Types of implementations:

1) Firewalls that protect a whole network
2) Firewalls that protect a single host.
3) Border firewalls, filter traffic between trusted local network and untrusted external networks.
4) Internal firewalls, such as DMZ config’s can be placed anywhere within the network, either inline or as host firewalls, to filter traffic flows between different security zones.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

ACL

A

(Access Control List) Specifies which subjects (user accounts, host IP addresses) are allowed or denied access and privileges given over the object.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Application-based firewall vs. network-based firewall

A

Application-based firewalls: run as software on any type of computing host.
Network-based: hardware firewall that performs function of firewall only.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Stateful vs. stateless

A

Stateless: a type of firewall that does not preserve information about the connection between two hosts or previous packets. ex. packet-filtering firewall.
Stateful: a type of firewall that stores information about hosts in a dynamically updated stable state .

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Implicit deny

A

A basic principle of security stating that unless something has explicitly been granted access, it should be denied access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

VPN concentrator

A

A VPN-enabled router. Helps manage multiple VPN gateways remotely. It is a server-side feature.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Remote access vs. site-to-site

A

Remote access: clients temporarily connect to a VPN gateway from a local network.
Site-to-site: two or more local networks permanently connected, each of which runs a VPN gateway. ex. branch office connected to headquarters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

IPSec

A

Internet Protocol Security: a set of standards you can use to secure data as it travels across a network or the internet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Tunnel mode

A

1/2 IPSec mode; the IP header for each packet is not encrypted, just the data (payload). This mode would be used to secure communications on a private network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Transport mode

A

2/2 IPSec mode; the whole IP packet (header and payload) is encrypted and a new IP header added. This mode is used for communications across an unsecure network. This is also referred to as a router implementation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

AH

A

Authentication Header; AN IPsec PROTOCOL that provides authentication for the origin of transmitted data as well as integrity and protection against replay attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

ESP

A

Encapsulation Security PAYLOAD; an IPSec protocol that provides authentication AND confidentiality by encrypting the packets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Split tunnel vs full tunnel

A

The two ways of managing a connection between a client and a VPN.
Split tunnel: the client accesses the Internet directly using its “native” IP configuration and DNS servers.
Full tunnel: Internet access is mediated by the corporate network, which will alter the client’s IP address and DNS servers and may use a proxy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

TLS

A

Transport Layer Security VPN; commonly referred to a SSL VPN, is a client-to-server connection that authenticates the client which creates an encrypted tunnel for the user to submit authentication credentials.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Always-on VPN

A

A version of VPN where the computer establishes the VPN whenever the Internet connection over a trusted network is detected.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

NIPS/NIDS

A

Network-based intrusion Prevention system: an inline security device that montors suspicious network and/or system traffic and reacts in real time to block it.

Network intrusion Detection system: a packet sniffer with an analysis engine to identify malicious traffic and a console to allow configuration of the system. Provides passive detection. Identifies and logs hosts and applications, and detects attack signatures, password guessing attempts, port scans, worms, backdoor applications, malformed packets or sessions etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Signature-based

A

Also referred to as pattern-matching, means that the engine/anti-virus is loaded with a database of attack patterns or signatures. If traffic matches a pattern, then the engine generates an incident.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Heuristic/behavioral Detection

A

Also referred to as profile-based detection, means that the engine is trained to recognize baseline “normal” traffic or events. Anything that deviates from this baseline generates an incident. Helps detect ‘zero day’ attacks. The engine generates a statistical model of what the baseline looks like, using heuristics.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Anomaly (logs)

A

Looking for irregularities in the use of protocols.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Inline vs. passive (protection)

A

Inline: protects the whole network, provides active response to any network threats
Passive detection: log intrusion incidents and to display an alert to mgmt. interface/email admin account.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

In-band vs. out-of-band

A

In-band: the sensor uses the same network as the link being monitored
Out-of-band: establishes separate cabling infrastructure or same cabling but separate VLAN.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Rules

A

plug-ins, feeds

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Analytics (logs)

A

The process of reviewing the events and incidents that trigger IDS/IPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Router firewall

A

A router firewall has firewall functionality built into the router firmware.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Anti-spoofing

A

IP spoofing disguises the identity of the attacker’s host machine. Anti-spoofing requires authenticated IPSec tunnels to critical services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Switch

A

Switch ports are used to physically segment or segregate hosts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Layer 2 vs. Layer 3

A

Layer 2 is a broadcast Media Access Control (MAC) level network, while a Layer 3 is a segmented routing over internet protocol (IP) network.

28
Q

Loop prevention

A

Spanning Tree Protocol (STP) prevent layer 2 looping.

29
Q

Flood guard

A

Portfast command, and BPDU Guard settings prevent ports from being flooded.

30
Q

Proxy

A

Router that acts as a relay between client and server in DMZ. Web proxies are often described as web security gateways and their usual function is to prevent viruses or Trojans.

31
Q

Forward and Reverse proxy

A

Forward Proxy: intermediary server/gateway the client puts forward between itself and server
Reverse Proxy: intermediary gateway the server puts between itself and client

32
Q

Transparent Proxy

A

A transparent proxy intercepts client traffic without the client having to be reconfigured. Must be implemented on a switch or router.

33
Q

Load balancer

A

Distributes client request across available server nodes in a farm/pool. Uses Virtual IP, Scheduling, Round Robins and Affinity.

34
Q

Scheduling

A

Code and metrics that determine which node is selected for processing each incoming request.

35
Q

Affinity

A

When a client establishes a session, it becomes stuck to the node that first accepted the request.

36
Q

Round Robin

A

Load balancing scheduling algorithm which simply picks the next node/server

37
Q

Active-passive clustering

A

Use a redundant node to failover. The last node doesn’t support and services until a failover occurs. Then the redundant node assumes the IP address of the failed node.

38
Q

Active-active clustering

A

All nodes are processing concurrently.

39
Q

Virtual IPs

A

Each server node or instance needs its own IP address, but externally a load-balanced service is advertised using Virtual IP (VIP) address.

40
Q

Access point

A

A device that provides a connection between wireless devices and can connect to wired networks. The AP is normally attached to the LAN using standard cabling and transmites and receives network traffic to and from wireless devices.

41
Q

SSID

A

Service Set Identifier is a character string that identifies a particular wireless LAN

42
Q

MAC filtering

A

(Media Access Control filtering) Applying an access control list to a switch or access point so that only clients with approved MAC addresses can connect to it.

43
Q

Signal Strength

A

The amount of power used by the radio in an access point or station.

44
Q

Band selection/width

A

Wi-Fi products work in either the 2.4 GHz or the 5 GHz band or both. Bandwidth is the maximum volume of data that can be transmitted across a network over a period of time.

45
Q

Antenna types and placement

A

Rubber ducky antennas: the plastic coated variants often used as AP’s
Yagi: bar with fins ex. old t.v. antenna
Parabolic: dish
Directional: useful to an eavesdropper

Placement should consider the maximum range (about 30m). Other radio devices may cause interference such as fluorescent lighting, microwave ovens, and heavy machinery.

46
Q

Fat vs. thin (AP’s)

A

An access point whose firmware contains enough processing logic to be able to function autonomously and handle clients without the use of wireless controller is known as a Fat AP.
AP’s that require a wireless controller in order to function are known as Thin AP’s.

47
Q

SIEM

A

(Security Information and Event Management) A solution that provides real-time or near-real-time analysis of security alerts generated by network hardware and applications. Used to review logs.

48
Q

Aggregation (logs)

A

Pools logs from sources including: switches, routers, firewalls, IDS sensors, vulnerability scanners, malware scanners, Data Loss Prevention, and databases.

49
Q

Correlation

A

Link individual events or data points into meaningful indicator of risk.

50
Q

Automated alerting and triggers

A

Allow administrators to identify and troubleshoot serious logs and event anomalies promptly. May take the form of a recorded log or an active notification like an email

51
Q

Time synchronization

A

Configure a standard time zone across all appliances to aid a SIEM’s log records.

52
Q

Event deduplication

A

Reducing redundancy of identical errors.

53
Q

Logs

A

Logs function as an audit trail of action and provide a warning of intrusion attempts. Logs record both authorized and unauthorized usses of resource and privilege.

54
Q

DLP

A

(Data Loss Prevention) products that scan content in structured formats, such as a database with a formal AC model or unstructured formats. They use a dictionary database or algorithm to identify confidential data and restrict the transfer of this data.

55
Q

Cloud-based DLP

A

Extends the protection mechanisms to cloud storage services, using either proxy to mediate access to the cloud service provider’s API to perform scanning and policy enforcement.

56
Q

NAC

A

(Network Access Control) A means of ensuring endpoint security- ensuring that all devices connecting to the network conform to a health policy.

57
Q

Dissolvable vs. permanent

A

Dissolvable: a non-persistent agent is loaded into memory during posture assessment but is not installed on the device.
Permanent: a persistent agent is installed as a software application on the client.

58
Q

Host health checks

A

Part of a posture assessment. Verify compliance with the health policy.

59
Q

Agent vs. agentless

A

Agentless: posture assessment performed when a NAC solution must support a wide range of devices, but less detailed information about the client is available.
Agent: A client software which gathers information about a device such as anti-virus, patch status etc.

60
Q

Mail gateway

A

Provides spam filtering, data loss prevention and encryption.

61
Q

Spam filter

A

Blocking unwanted email.

62
Q

Bridge

A

A device similar to a switch that has one port for incoming traffic and one port for outgoing traffic.

63
Q

SSL/TLS accelerators

A

A hardware device with a specialist chipset - Application Specific Integrated Circuit - dedicated to performing public key encryption. Usually they are implemented as plug-in cards for server equipment or load balancing appliances and therefore can be placed anywhere in the network where SSL/TLS offloading is desired.

64
Q

SSL decryptors

A

A type of proxy used to examine encrypted traffic before it enters or leaves the network. Ensures that traffic complies with data policies and that encryption is not being misused i.i. data exfiltration or to operate a Command & Control (C2) Remote Access Trojan.

65
Q

Media gateway

A

Handles the job of interfacing between to multiple communication applications to create a unified communication application (UC)

66
Q

Hardware security module

A

An appliance for generating and storing cryptographic keys. This sort of solution may be less susceptible to tampering and insider threats than software-based storage.

2. Technologies and Tools (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions