3.3

Question 1

Load balancing

Answer 1

Distributes load of networks esp for large scale implementations and has faults tolerance in cause one fails

Can configure across multiple servers uses tcp offload (protocol overhead) and ssl offload (encrypt/defrypt) and caching (fast response) prioritization and content switching

Can use round robin form each person sent to consecutive networks

Weighted or dynamic round robin

Check if affinity or likeness is occurs where the same user is distributed to same network using same ip and port numbers

Question 2

Network segmentation

Answer 2

Physically switch a and switch b like an airgap needs a cable or router firewall

Logical Vlans, can separate within one switch,, still needs cable within separate vlans

Can set up with performance, compliance or security in mind

A dmz connects to firewall and connects to screened subnet and not inside of network

Extranet for vendors and partners, has additional authentication process

Intranet only accessible from inside has announcements and company docs

East-west traffic for thousands of connections inside server

North south is incoming and outgoing

Question 3

Vpn

Answer 3

Sending encryption and decryption between network and internet

Uses a concentrator with the client software includes remote access network (access inside from outside) such as ssl tcp/443) or html5 which supports api

Question 4

Ipsec

Answer 4

Internet protocol security for anti reply , hi encryptions and multi vendor implementation

Can use transport mode header is sent and things in middle are encrypted

Can use tunnel mode, tunnel is header and data is encrypted with a new header this is most common

Can use esp( encapsulation security payload) uses sha2 for integrit checks

Question 5

Port security

Answer 5

Physical switches and connections

Can limits traffic and remove unwanted traffic

Challenges are broadcasts that everyone gets on network can use broadcast storm control to limit broadcasts eap malicious

Another challenge is loop protection, connection two switches ro each other but the standard 802.1d can use spanning tree tool that connects to only non blocked port. If some outage occurs it will adapt and change paths u blocking and reblocking until outage is fixed called
Bpdu guard, bridge protocal data unit,

Question 6

Dhcp snooping

Answer 6

Has a dhcp switch with trust abd untrusted tech watching all traffic and blocking untrusted devices

Question 7

Mac filtering

Answer 7

Media access control that disallows traffic for all devices or limits a certain mac address

Question 8

Domain name resolution

Answer 8

Dns has no sec but dnssec is an extension to validate dns responses and check origin authenticity and data integrity

Question 9

Out of band management

Answer 9

Serial port that allow us to connect around network

Question 10

Ipv6

Answer 10

Better security and configuration setting so no need for Nat thus simplifying the process removes arp and arp snooping

Question 11

Taps and port mirrors

Answer 11

Tap Recieves acop of all info it sits in

Question 12

Fim

Answer 12

File integrity monitoring monitors files that dont change like Os

Tripwire linux

Question 13

Stateless vs stateful

Answer 13

Needs multiple rules for stateless

Needs one rule for both directions in stateful

Question 14

Utm vs ngfw

Answer 14

Unified treat managmenet decve

Firewall but also url filter, malware inspection, spam filter, csu/dsu, router/switch, ids/ips functionality, bandwidth shaping, vpn endpoint

Next gen firewalls sees all data packets, evaluates all traffic and sees which apps are in use and doesnt need ip addresses, They are network connected, includes ILS, url filters/categorization of urls

Question 15

Waf

Answer 15

Web app firewall that blocks inputs in webapp

Question 16

Network access control

Answer 16

Control at the edge Managed through firerules

Access control , permissions for trusted registers Users

Question 17

Proxy server

Answer 17

Sits between users, receives and sends user requests, useful for caching and access control, url filtering or context scanning but each device needs to set it up unless its a transparent proxy

Question 18

Nips nids

Answer 18

Network based ids/ips

Intrusions include exploits against os/apps, buffer overflow, cross-site scripting and other vulnerabilities

Ids cant really block where as ips can
Block on real tome as it goes through ids

Can connect with passive monitoring using port mirror or physical tap which study’s copy of data and alerts if needed, cannot block in real time with passive monitoring

Out of band responses can send tcp reset block traffic flow but original packet already went through

Most common is inline monitoring that sits inline with the traffic and can block in real time

Uses signatures and baseline anomoky
Based traffic to see whats normal and abnormal. It can also block behavior based such as sql injection behavior,

Question 19

Other networks

Answer 19

Jump seever access secure network zones, highly secured with ssh tunnel or vpn, but is also a security concern

Many servers = hsm or hardware security module that is a server with specialized for cryptography, offloads cou overhead and includes secure storage