Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ > 3.3 Implement secure network design > Flashcards

3.3 Implement secure network design Flashcards

1
Q

Load balancing: what is load balancing ?

A

A way to distribute the load that is incomming across multiple devices. Thereby, making the resource available to more user than having a single server in place.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Load balancing: what is one of the advantage of load balancer ?

A

Fault tolerance: if a server fail, the others ones can be use.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Load balancing: how load balancer work ?

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Load balancing: can load balancer perform encyption ?

A

Yes, using SSL offload

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Load balancing: how to configure a load balancer ?

A
  • Round-robin
  • Weighted round-robin
  • Dynamic round-robin
  • Active/active load balancing
  • Active/passive load balancing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Load balancing: what is round robin way to configure load balancer?

A

The traffic is distributed turn by turn: each server is selected in turn
Ex: user1 get server1, user2 get server2 …

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Load balancing: what is weighted round-robin way to configure load balancer?

A

The traffic is prioritize on one server over another.
Ex: one of the server will receive half of the available load and the other server would make up the rest of that load

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Load balancing: what is dynamic round-robin way to configure load balancer?

A

Monitor the server load and distribute to the server with the lowest use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Load balancing: what is active/active load balancing way to configure load balancer?

A

All of the server are active simutaneously

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Load balancing: what is “affinity” for load balancer?

A

Certains application may need to communicate through a load balancer will always be distributed to the same server.
This is done by tracked through IP address or sessions IDs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Network segmentation: what is network segmentation ?

A

Network segmentation is a network security technique that divides a network into smaller, distinct sub-networks that enable network teams to compartmentalize the sub-networks and deliver unique security controls and services to each sub-network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Network segmentation: why network can be segmented ?

A

For performance (application with banwidth), security and compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Network segmentation: what are the different types of network segmentation ?

A
  • Physical
  • Logical
  • Virtual
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Network segmentation: what is network physical segmentation?

A

Devices are physically separate. Also refered as “air gap” as the 2 devices are not physically connected and need to be connected if they want to communicate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Network segmentation: what is the disadvantage of network physical segmentation?

A

Each device needs to be configured, updated and interface managed separately

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Network segmentation: what is network logical segmentation?

A

Devices are logically separated using VLAN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Network segmentation: what is a screened subnet (DMZ)?

A

It refers to a network architecture where a single firewall is used with three network interfaces. It provides additional protection from outside cyber attacks by adding a perimeter network to isolate or separate the internal network from the public-facing internet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Network segmentation: what is a extranet?

A

An extranet is a private network similar to an intranet, but typically open to external parties, such as business partners, suppliers, key customers, etc. The main purpose of an extranet is to allow users to exchange data and applications, and share information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Network segmentation: what is an intranet?

A

A private network contained within an enterprise that is used to securely share company information and computing resources among employees

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Network segmentation: what is zero trust principle?

A

Zero Trust is a security framework requiring all users, whether in or outside the organization’s network, to be authenticated, authorized, and continuously validated for security configuration and posture before being granted or keeping access to applications and data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

VPN: what is a VPN?

A

Establish a protected network connection when using public networks. VPNs encrypt your internet traffic and disguise your online identity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

VPN: what is a VPN concentrator ?

A

VPN concentrators are used to connect many remote networks and clients to a central corporate network. They are used to protect the communications between remote branches or remote clients – such as workstations, tablets, phones and IoT devices – to corporate networks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

VPN: what is SSL VPN ?

A

VPN that uses common SSL/TLS protocol to communicate (port 443)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

VPN: is a VPN always secure ?

A

No. VPNs expose entire networks to threats like distributed denial-of-service (DDoS), sniffing and spoofing attacks. Once an attacker or malware has breached a network through a compromised user device connected to it, it can bring down an entire network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

VPN: what is IPsec ?

A

An IPsec VPN is a VPN that uses the IPsec protocol suite to establish and maintain the privacy of communication between devices, apps or networks over the public internet. IPsec VPN uses a technique called “tunneling” to encrypt the data that is being sent between the device and the VPN server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Port security: what are the different types of ports that exist ?

A

There are two classes of ports – physical and virtual. Physical switch interfaces is an example of a physical port while a TCP/IP port is an example of a virtual port. Virtual ports outnumber physical ports.
The logical (or virtual) port is the software port the link is made to from the other side of the internet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Port security: what is the goal of physical port security ?

A

Control and protect the network by limiting overall traffic, watch for unusual or uwanted traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Port security: what are the different ways to bring physical port security ?

A
  • Broadcasts
  • Loop prevention
  • Port fast
  • DHCP snooping
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Port security: what is broadcasts ?

A

Sends information to everyone at once so that every device examine the broadcast. However this is limited to the broadcast domain (ex: vlan)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Port security: what is loop ?

A

A loop occurs when 2 switches are connected to each other and send traffic bacl & forth forever. Leading to network down

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Port security: what is 802.1D standard ?

A

A loop protection standard to prevent loops in switched network using a spanning tree protocol (STP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Port security: what is STP ?

A

Spanning Tree Protocol is a network protocol that builds a loop-free logical topology for Ethernet networks.

33
Q

Port security: what is port fast?

A

The PortFast feature is introduced to avoid network connectivity issues. These issues are caused by delays in STP enabled ports moving from blocking-state to forwarding-state after transitioning from the listening and learning states.

34
Q

Port security: what is DHCP snooping?

A

The DHCP snooping feature determines whether traffic sources are trusted or untrusted.

35
Q

Port security: what is MAC filtering?

A

It allows the administrator of this device to either allow or disallow traffic based on the MAC address communicate on the network

36
Q

Port security: what is the disadvantage of MAC filtering?

A

There is no security mechanism at layer 2 that can obscure or encrypt MAC addresses. So anyone can connect and listen to the network to collect a list of MAC address allowed on the network. Then simply change their MAC address to match one of the MAC addresse that’s allowed

37
Q

Secure networking: what is DNSSEC ?

A

Domain Name System Security Extensions validate DNS responses: origin authentication and data integrity.

38
Q

Secure networking: how DNSSEC validates the responses ?

A

It is done thanks to public key cryptography: DNS records are signed with a trusted 3rd party then signed DNS recors are published in DNS

39
Q

Secure networking: why DNS security is important ?

A

Using DNS security can stop end users ftom visiting dangerous sites.
For ex by using a sinkhole address

40
Q

Secure networking: what is DNS sinkhole ?

A

DNS Sinkholing is a mechanism aimed at protecting users by intercepting DNS request attempting to connect to known malicious or unwanted domains and returning a false, or rather controlled IP address.
Dummy explaination: a query to a known malicious address can be identified by the DNS and it will take action for you not to visit it

41
Q

Secure networking: what is QoS ?

A

Quality of Service is the process of controlling traffic flow: you prioritize traffic performance for certains devices, applications etc.
For ex; VoIP has priority over web-browsing in a call center. You can also priotitize bandwidth, traffic rate, VLAN etc

42
Q

Secure networking: what is IPv6?

A

It helps identify and local endpoint systems on a computer network and route online traffic while addressing the problem of IPv4 address depletion (diminution) due to prolonged internet use worldwide

43
Q

Secure networking: why IPv6 is more secure than IPv4 ?

A

More difficult to IP/port scan (but not impossible).
Some attacks disappear like APR which is removed in IPv6 so there will be no APR spoofing

44
Q

Secure networking: what is port mirror ?

A

It is used on a network switch to send a copy of network packets seen on one switch port (or an entire VLAN) to a network monitoring connection on another switch port. This is used for network monitoring by IDS system for ex.

45
Q

Secure networking: what is FIM?

A

File Integrity Monitoring: monitor important OS and application files and identify when changes occurs: if those files are modify, the admin will get an alert

46
Q

Firewalls: what is a firewall?

A

Control the flow of network traffic

47
Q

Firewalls: why is a firewall important ?

A

Control of inappropriate content (not safe for work, parental control etc)

48
Q

Firewalls: what are the differents type of firewall ?

A
  • Stateless firewall
  • Stateful firewall
  • NGFW
  • WAF
49
Q

Firewalls: what is a network-based firewall?

A

Layer3 device. A network firewall is hardware or software that restricts and permits the flow of traffic between networks. Network firewalls help prevent cyberattacks by enforcing policies that block unauthorized traffic from accessing a secure network.

50
Q

Firewalls: what is a stateless firewall ?

A

Firewall that doesn’t store information about the current state of a network connection. Instead, it evaluates each packet individually and attempts to determine whether it is authorized or unauthorized based on the data that it contains.

Ex: For each communication, you need to create 2 rules one from the user to the server, an one from the server to the user

51
Q

Firewalls: what can be the security issue with stateless firewall?

A

For ex, in a client-server communication. If an attacker take advantage of the server and wants to communicate with a user, the firewall won’t stop it (because it just follow the rule set)

52
Q

Firewalls: are stateless firewall used a lot ?

A

No. Old generation of firewall.

53
Q

Firewalls: what is a stateful firewall ?

A

Stateful firewall is a network-based firewall that individually tracks sessions of network connections traversing it.

54
Q

Firewalls: what is a stateless vs stateful firewall ?

A
  • Stateless Firewall works by treating each packet as an isolated unit,
  • Stateful firewalls work by maintaining context about active sessions and use “state information” to speed packet processing
55
Q

Firewalls: are stateful firewall more secure than stateless ?

A

Yes. Because if an attacker infect a server, he will not be able to send packets to a user because the rule will not match

56
Q

Firewalls: what is UTM ?

A

Unified Threat Management also called web security gateway is a all-in one device: it provides URL filter, content inspection, malware inspection, SPAM filter, firewall, IDS/IPS functionnality…
This is the ancient NGFW

57
Q

Firewalls: what is NGFW ?

A

Application layer device.
A next-generation firewall (NGFW) is a network security device that provides capabilities beyond a traditional, stateful firewall. While a traditional firewall typically provides stateful inspection of incoming and outgoing network traffic, a next-generation firewall includes additional features like application awareness and control, integrated intrusion prevention, and cloud-delivered threat intelligence.

58
Q

Firewalls: what are the different name for NGFW ?

A
  • Application layer gateway
  • Stateful multiplayer inspection
    -Deep packet inspection
59
Q

Firewalls: what features can be provided in a NGFW ?

A
  • Blocking threats at network edge
  • Geolocation
  • Reverse proxy / web gateway
  • IDS/IPS
  • URL / content filtering
60
Q

Firewalls: what is a WAF ?

A

Web application firewall (WAF) is a firewall for HTTP/HTTPS communication. Instead of allow/deny traffic based on the IP/port, it does it based on the input to that particular application.

Ex: it will recognize a SQL injection

61
Q

Firewalls: what is a ACLs ?

A

Access control lists: allow/deny traffic based on tuples (= grouping of information such as source, destination IP, port nb, time of day etc)

62
Q

Firewalls: how to managed firewall rules ?

A
  • Analyzing rule anomalies that affect the performance of the firewall.
  • Reordering existing rules to improve rule performance.
  • Identifying and removing unused rules.
  • Analyzing the impact of a new rule on the existing rule set before making it live in the firewall.
63
Q

NAC: how to control the access to a network ?

A
  • Control at the edge: firewall, setting up rules
  • Access control: control the access to the network based on a nb of != criteria (user, group, location, application)
64
Q

NAC: what is a posture assessment ?

A

A device health check is perform before connecting to the network: antivirus install? updated ? trusted device? mobile device? disk encrypted ?

This assessment needs to be perform no matter the type of device: windows, linux, macOS

65
Q

NAC: why posture assessment is important ?

A

Because you cannot trust everyone’s computer, espacially when the staff work with their own device (Bring Your Own Device)

66
Q

NAC: how to perform posture assessment ?

A
  • Use persistent agents: software install on the laptop permanently and software run when connecting to the network.
  • Use dissolvable agents: no software is permanently install, the software run only when the device try to connect to the network and perform the posture assessment
  • Agentless NAC: integrated with AD, checks are made during login and logoff
67
Q

NAC: what happens when a posture assessment fails ?

A

The device is not allow to access the network because the security requirements are not met. And often, it is put in a quarantine network and the admin is notify

68
Q

Proxy servers: what is a proxy server ?

A

A proxy server acts as a gateway between you and the internet. It’s an intermediary server separating end users from the websites they browse.

69
Q

Proxy servers: how proxy server works ?

A

Receives the user request and sends the request on their behalf (the proxy)

70
Q

Proxy servers: what is a NAT ?

A

Network Address Translation is a way to map multiple private addresses inside a local network to a public IP address before transferring the information onto the internet.

71
Q

Proxy servers: what is proxy vs. NAT ?

A

NAT works at the network layer while proxy at the application layer. NAT is transparent to various applications, whereas proxy must resort to the IP address of the proxy server specified in application programs. For example, to access a web page by using NAT, no configuration is required in the browser.

72
Q

Proxy servers: what is a forward proxy ?

A

Internal user => Proxy => web server

73
Q

Proxy servers: what is a reverse proxy ?

A

User from the internet => proxy => web server

The request come from the internet user to the web server. The proxy will examine the requests and make sure none of the request are malicious

74
Q

Proxy servers: what is a forward vs reverse proxy ?

A

A traditional forward proxy server allows multiple clients to route traffic to an external network. For instance, a business may have a proxy that routes and filters employee traffic to the public Internet. A reverse proxy, on the other hand, routes traffic on behalf of multiple servers.

75
Q

Intrusion prevention: what are the different intrusion system and what are they using for ?

A

IDS/IPS are used to detection intrusion on a system, host, network

76
Q

Intrusion prevention: how an IPS/IDS know what is malicious ?

A
  • By looking at the signature (siganture-based)
  • Anomaly-based: analyse the network to identify what is abnormal
  • Behavior-based: observe and report unusual behavior (eg. SQL injection etc)
  • Heuristics: use AI to identify
77
Q

Other network security: what is a jump server?

A

A jump server is a hardened and monitored device that provides an access to a protected network. Often use with SSH, VPN, RDP that will go trhough the jump server

78
Q

Other network security: what is a HSM?

A

Hardware Security Module: high-end cryptographic hardware

79
Q

Other network security: what is a sensors and collector?

A

Aggregate info from network devices:
- Sensors: built-in sensor or separate devices integrated into switches, router etc. It gather data on the firewall logs, auth logs, DB log etc and send it to the collector
- Collectors: console that display the data gathered by the sensor and display it in a screen

Security+ (35 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions