3.1 Given a scenario, implement a secure protocol

Question 1

Summarize DOMAIN NAME SYSTEM SECURITY(DNSSEC)

PORT 53

Answer 1

DNSSEC takes advantage of DNS’s tree-like structure to digitally sign every zone file for (eventually) every domain in the DNS hierarchy. DNSSEC implements additional resource record types to DNS.

Question 2

Summarize SSH

Answer 2

The Secure Shell (SSH) protocol was invented as a direct replacement for Telnet and other non-secure remote terminal programs. Plus, in a bit of foresight that over time has proven to be utterly amazing, SSH was designed to run in a tunneling mode, enabling any other application to run within an encrypted SSH tunnel.

Question 3

Summarize SECURE/MULTIPURPOSE INTERNET MAIL EXTENTIONS (S/MIME)

Answer 3

S/MIME was developed from MIME, but took the concept a step further, as S/MIME enables individual e-mail clients to attach personal certificates and digital signatures to e-mail messages just like any other MIME attachment. Using these attachments, S/MIME enables users to encrypt e-mail messages to each other.

Question 4

Summarize SECURE REAL-TIME TRANSPORT (SRTP)

PORT 5004

Answer 4

Secure Real-time Transport Protocol (SRTP), an extension to RTP that uses the same port as RTP (by default UDP 5004, although this is easily and often changed).

Question 5

Summarize LIGHTWEIGHT DIRECTORY ACCESS OVER SSL(LDAPS)

389 LDAP
636 LDAPS

Answer 5

The CompTIA Security+ objectives mention LDAP over SSL (LDAPS) as one of the secure protocols. While this is technically true, LDAPS was deprecated right along with LDAPv2 way back in 2003. LDAPv3 uses extensions that make use of secure protocols such as TLS to provide security today.

Question 6

Summarize FILE TRANSFER PROTOCOL, SECURE (FTPS)

PORT 990

Answer 6

File Transfer Protocol, Secure (FTPS) is a secure version of FTP that can be used over a Secure Sockets Layer (SSL) or Transport Layer Security (TLS) secure session connection. Adding SSL or TLS enables users to perform FTP file transfers securely, using built-in encryption and authentication mechanisms (usually involving public and private keys). Unlike other applications that use SSL or TLS, FTPS uses TCP port 990.

Question 7

Summarize SIMPLE NETWORK MANAGEMENT PROTOCOL, VERSION 3(SNMPv3)

PORTS 161/162

Answer 7

is the basis for many network management tools. SNMP uses SNMP agents, installed by default on most network devices, that respond to queries (gets) from SNMP manager programs. Agents can also be configured to send traps, asynchronous communication from agents to managers. SNMPv3 is identical to SNMPv2 but adds robust and flexible encryption.

Question 8

Summarize HYPERTEXT TRANSFER PROTOCOL OVER SSL/TLS(HTTPS)

80 HTTP
443 HTTPS

Answer 8

Hypertext Transfer Protocol over SSL/TLS (HTTPS) sends normal HTTP traffic over an encrypted SSL or TLS connection. SSL and TLS can be used to send almost any protocol, though, providing security services for that traffic. A typical use-case scenario for substituting HTTPS for HTTP is when a client wants a Web store that can handle secure monetary transactions. HTTPS is essential for e-commerce. Another use-case scenario is with subscription services, such as Microsoft Office 365. All the big software as a service (SaaS) providers use HTTPS by default to secure authentication. HTTP uses TCP port 80, and HTTPS uses TCP port 443, the port used by SSL and TLS.

Question 9

Summarize IPSEC

Answer 9

Internet Protocol Security (IPsec) is a security protocol that works at the Network layer of the OSI model. IPsec was developed to provide security services (authentication and encryption) for IP traffic, since IP does not have any built-in native security protections. Three major protocols make up IPsec: AH, ESP, and ISAKMP.

Question 10

Summarize AUTHENTICATION HEADER(AH)

Answer 10

The Authentication Header (AH) protocol provides authentication and integrity services for IP traffic. AH can be used on the entire IP packet, including the header and data payload.

Question 11

Summarize ENCAPSULATED SECURITY PAYLOADS(ESP)

Answer 11

The Encapsulating Security Payload (ESP) protocol takes care of encryption services. ESP can provide protection for the entire IP packet, depending the IPsec mode used, transport or tunnel.

Question 12

Summarize TRANSPORT MODE

Answer 12

Between hosts on a network, the header information isn’t usually required to be encrypted, so ESP doesn’t have to be used. This is called IPsec’s transport mode. In transport mode, header information is not encrypted so that hosts and network devices can read it. The data, on the other hand, can be encrypted to protect it, even within a LAN.

Question 13

Summarize TUNNEL MODE

Answer 13

IPsec tunnel mode is used when IP traffic is encapsulated and sent outside of a LAN, across WAN links to other networks. This is what happens in VPN implementations that use IPsec. In tunnel mode, since the IP packet is encapsulated in a tunneling protocol (such as L2TP), all the information in the packet, including headers and data payload, can be encrypted. So, ESP is typically used only in tunnel mode.

Question 14

Summarize POST OFFICE PROTOCOL(POP)

TCP PORT 110

Answer 14

The Post Office Protocol version 3 (POP3) is an e-mail client protocol used to receive e-mail through client applications. Client applications that use POP3 access the user’s mailbox and download all the e-mail in the inbox, and then delete the mail from the server.

Question 15

Summarize INTERNET MESSAGE ACCESS PROTOCOL(IMAP)

TCP PORT 143

Answer 15

The Internet Message Access Protocol version 4 (IMAP4) is also a client e-mail protocol. IMAP4, which uses TCP port 143 by default, can connect to an organizational or Web-based e-mail server and download client e-mail messages. It differs from POP3 in that you can have multiple connections to the server from multiple user clients, and e-mail isn’t automatically deleted from the server. Like POP3, IMAP4 is also a non-secure protocol.

Question 16

Summarize use cases for VOICE AND VIDEO

Answer 16

The massive growth of video and audio across the Internet and the need to secure them creates a number of use cases where existing voice and video solutions using RTP need to switch to SRTP. While the exact switching method varies from solution to solution, in many cases little more than a patch and a few updates are all that’s needed to make non-secure voice and video well secured.

Question 17

Summarize use cases for TIME SYNCHRONIZATION

Answer 17

One of the non-secure protocols without a secure counterpoint is the Network Time Protocol (NTP). NTP doesn’t appear in the CompTIA Security+ exam objectives directly, but it certainly does indirectly. A use-case scenario where NTP is relevant is in time synchronization.

Question 18

Summarize use cases for EMAIL AND WEB

Answer 18

Whether you use a Web client or a more traditional client, e-mail is an important Internet application. E-mail uses specific protocols, and you must understand how they work (and of course know the port numbers).

SMTP 25
POP 110
IMAP 143

Question 19

Summarize use cases for FILE TRANSFER

Answer 19

Modern systems require much more security, so a typical use case scenario involving file transfer means substituting FTP for one of its more secure relatives. These protocols are FTPS and SFTP.

Question 20

Summarize use cases for DIRECTORY SERVICES

Answer 20

You might see an exam question that posits a use-case scenario about directory services that would substitute Secure LDAP or LDAPS for LDAP; choose that answer if it seems obvious. In reality today, current versions of LDAP provide secure extensions.

Question 21

Summarize use cases for REMOTE ACCESS

Answer 21

USE SSH.

The Secure Shell (SSH) protocol was invented as a direct replacement for Telnet and other non-secure remote terminal programs. Plus, in a bit of foresight that over time has proven to be utterly amazing, SSH was designed to run in a tunneling mode, enabling any other application to run within an encrypted SSH tunnel.

Question 22

Summarize use cases for DOMAIN NAME RESOLUTION

Answer 22

To prevent cache poisoning and implement secure network designs for DNS, the typical use-case scenario is to switch to Domain Name System Security Extensions (DNSSEC) for domain name resolution (resolving domain names to IP addresses).

Question 23

Summarize use cases for ROUTING AND SWITCHING

Answer 23

The modern use-case scenario for securely monitoring routing and switching is to use SNMPv3.

Question 24

Summarize use cases for NETWORK ADDRESS ALLOCATION

Answer 24

Cisco implements a feature in IOS called DHCP Secured IP Address Assignment. This combats DHCP spoofing attacks and its best use case is in network address allocation attack scenarios.

Question 25

Summarize use cases for SUBSCRIPTION SERVICES

Answer 25

Another use-case scenario is with subscription services, such as Microsoft Office 365. All the big software as a service (SaaS) providers use HTTPS by default to secure authentication. HTTP uses TCP port 80, and HTTPS uses TCP port 443, the port used by SSL and TLS.