Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security + Messer > 3.3 - Secure Network Designs > Flashcards

3.3 - Secure Network Designs Flashcards

1
Q

What is Load Balancing?

A

Efficiently distributing incoming network traffic across a group of backend servers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What can a load balancer be used for?

A

1) Configurable load (manage across servers)
2) TCP offload (protocol overhead)
3) SSL offload (encryption/ decryption)
4) Caching
5) Prioritization (QoS)
6) Content switching (application-centric balancing)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

List a few ways to configure a load balancer.

A

1) Round-robin
- Each server is selected in turn
2) Weighted round-robin
- Prioritize the server use
3) Dynamic round-robin
- Monitor the server load and distribute to the
server with the lowest use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is active/active load balancing?

A

The workload is distributed across all nodes in order to prevent any single node from getting overloaded.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is affinity in load balancing?

A

Each user only talks to one server. This can be tracked through IP addresses or session IDs. Each user is “stuck” to one server.

AKA
Source affinity/ sticky session/ session persistence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is active/passive load balancing?

A

Some servers are active while others are on standby. If an active server fails, the passive server takes its place.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are some forms of network segmentation?

A

1) Physical segmentation
2) Logical segmentation with VLANs
3) Screened subnet (Logical)
4) Intranet/ Extranet
5)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How would one physically segment a network?

A

The devices are physically separate, so they cannot communicate with each other.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How would one logically segment a network?

A

Virtual Local Area Network (VLANs)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How would one segment a network with a screened subnet?

A

AKA DMZ

Firewalls separate a section of the network that interfaces with the internet, so people coming in can only access the resources within the DMZ.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is an Extranet?

A

A private network for business partners. It usually requires additional authentication and only allows access to authorized users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is an Intranet?

A

A private network that this only accessible internally. It has internal servers, and it is only for employees.

NO external access. Only internal or VPN.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is East-west traffic?

A

Traffic that flows within a data center. It is traffic between devices in the same data center. It has relatively fast response times.

Internal traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is North-south traffic?

A

Ingress/ egress to an outside device. External traffic

It has a different security posture than east-west traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is zero trust?

A

A holistic approach to network security that covers every device, process, and person.

Nothing is trusted. There is multifactor authentication, encryption, system permissions, additional firewalls, monitoring and analytics, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a VPN (Virtual Private Network)?

A

Encrypted (private) data traversing a public network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is a VPN concentrator?

A

An encryption/decryption access device that is often integrated into a firewall.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is a SSL VPN (Secure Sockets Layer VPN?

A

A VPN that uses SSL/TLS protocol (HTTPS port 443).

Can be run on a light VPN client or from a browser. There is no requirement for digital certificates or shared passwords (like IPSec).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is a HTML5 VPN?

A

A VPN that uses HTML 5. It creates a VPN tunnel without a separate VPN application. It includes comprehensive API support.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the difference between a full tunnel VPN and a split tunnel VPN?

A

Full tunnel:
All of the data is going across the encrypted tunnel. The user cannot break out of the tunnel to send information to another device directly.

Split tunnel:
Some information goes through the tunnel, but information can be sent to another device outside the tunnel.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is a site-to-site VPN?

A

A connection between multiple networks.

This could be a corporate network where multiple offices work in conjunction with each other or a branch office network with a central office and multiple branch locations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is L2TP (Layer 2 Tunneling Protocol)?

A

A protocol often used in site-to-site VPNs that allows sites to connect over a layer 3 network as if they were connected at layer 2. It is commonly implemented with IPsec.

L2TP would be used for the tunnel and IPsec for the encryption (aka L2TP over IPsec or L2TP/IPsec).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is IPSec (Internet Protocol Security)?

A

It is security for OSI Layer 3. It provides confidentiality and integrity (anti-replay).

There are two major IPSec protocols:
Authentication Header (AH)
Encapsulation Security Payload (ESP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are the two major modes of IPSec? Explain them.

A

There are two major modes:
Transport mode: IPsec header and IPsec trailers
around the data (IP header is still on the outside)
Tunnel mode: New IP header on the outside with the
old IP header and data surrounded by an IPsec
header and trailer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What are the two major IPSec protocols?

A

There are two major IPSec protocols:
Authentication Header (AH)
Encapsulation Security Payload (ESP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

How does an authentication header in IPsec work?

A

A hash of the packet and an authentication header is created.

The hash is used for data integrity. It guarantees the data origin and prevents replay attacks.

AH does not provide encryption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

How does ESP (Encapsulation Security Payload) in IPSec work?

A

It encrypts and authenticates the tunneled data, adding a header, trailer, and an integrity check value.

It can be combined with AH for integrity and authentication of the outer header.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What are broadcast packets?

A

Packets that send information to everyone at once within a broadcast domain.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

How can broadcast packets cause issues?

A

They can bombard a network with traffic.

30
Q

What can create broadcast traffic?

A

Routing updates, ARP requests, malicious software, or a bad NIC

31
Q

What can be used to control broadcasts?

A

Networking switches

32
Q

What is Spanning Tree Protocol?

A

Predominantly used to prevent layer 2 loops and broadcast storms and is also used for network redundancy. It was developed around the time where recovery from an outage that took upwards of a minute or more was acceptable.

It blocks ports that would create a loop. If a device goes down, it can go into convergence mode to detect what devices are available.

33
Q

What is a BPDU guard?

A

It shuts down ports configured with STP portfast upon receipt of a BPDU (Bridge Protocol Data Unit) to prevent the creation of a loop. BPDUs are given off by switches.

34
Q

How might a switch protect against DHCP snooping?

A

It marks unofficial DHCP servers as untrusted, and it filters invalid IP and DHCP information.

35
Q

What is MAC filtering?

A

Access through physical hardware addresses are limited to approved addresses to prevent spoofed MAC addresses from getting through.

36
Q

How can a sinkhole address be used to reroute end users from dangerous sites? What are some other ways to use DNS for security?

A

A sinkhole address is an address that, using the DNS server, is rerouted from a known malicious site.

A query can be run to identify which machines have accessed malicious addresses.

You can use content filtering to prevent DNS queries to unwanted or suspicious sites.

37
Q

What are some examples of out-of-band management?

A

Serial/ USB
Modems
Console router/ comm server
- out-of- band access for multiple devices
- connect to the console router then choose where
you want to go

38
Q

What is QoS (Quality of Service)?

A

The prioritization of some network traffic over other network traffic.

39
Q

What are some characteristics of IPv6?

A

1) More IP address space
- More difficult to IP/ port scan
2) NAT is not needed
3) No ARP

40
Q

What is a network tap?

A

A device that is put in between two links to capture traffic.

41
Q

What is a port mirror?

A

A software-based tap.

42
Q

What is a cybersecurity monitoring service?

A

Constant cybersecurity monitoring that can identify threats, maintain compliance, and respond to events. They work at a Security Operations Center (SoC).

43
Q

What is FIM (File Integrity Monitoring)?

A

You can continually monitor important OS and application files.

Windows - SFC
Linus - Tripwire
Many host-based IPS-options

44
Q

How does a network-based firewall work?

A

It allows you to:
1) Filter traffic by port number or application
2) Encrypt traffic
3) Network Address Translation (NAT)
4) Authenticate dynamic routing communication

45
Q

How does a stateless firewall work?

A

It doesn’t keep track of traffic flows; instead, it examines each packet individually regardless of previous communications (i.e. doesn’t know to expect a reply from a web server that a query was sent to).

It has to follow a rule base to determine what to allow and to not allow. Rules determine what traffic can leave and what traffic can enter.

46
Q

How does a stateful firewall work?

A

It remembers the “state” of the session. Everything within a valid flow is allowed.

The only rule is on what traffic can leave. It cross-references the rule table (ACL) with the session table (what sessions are active).

47
Q

What is a UTM (Unified Threat Management)/ web security gateway?

A

Multiple security features or services combined into a single device within your network. It can provide:
1) URL filter / Content inspection
2) Malware inspection
3) Spam filter
4) CSU/DSU
5) Router, Switch
6) Firewall
7) IDS/IPS
8) Bandwidth shaper
9) VPN endpoint

48
Q

What is a Next-generation firewall (NGFW)?

A

A firewall that works on the Application layer, so it examines all the data in every packet. Every packet must be analyzed and categorized before a security decision is determined.

It can include:
1) Network-based Firewalls
2) Intrusion Prevention Systems
3) Content filtering

AKA
1) Application layer gateway
2) Stateful multilayer inspection
3) Deep packet inspection

49
Q

What is a Web application firewall (WAF)?

A

A firewall that is on a web server. It applies rules to HTTP/HTTPS conversations. It can allow or deny based on expected (tries to block unexpected) input.

Can help to prevent SQL injections.

A major focus of the Payment Card Industry and Data Security Standard (PCI DSS).

50
Q

What are ACLs ( Access Control Lists)?

A

A set of rules on a firewall to allow or disallow traffic based on tuples, or values that identify a specific connection or network session (Source IP, Destination IP, port number, time of day, application, etc.).

This traffic can be ingress or egress.

51
Q

In terms of functionality, what is the difference between an open-source firewall and a proprietary firewall?

A

Open-source firewalls provide traditional firewall functionality. Whereas, proprietary firewalls include application control and high-speed hardware.

51
Q

How does a firewall determine what rules have priority?

A

They take a top-to-bottom approach, in which specific rules are usually at the top. Top rules go before bottom.

Most have an implicit deny at the bottom of the list of rules. This denies traffic if there are no rules found for it.

52
Q

Which is more secure: Hardware firewall or software firewall?

A

Typically hardware.

53
Q

How can you make sure that devices that connect to your network are safe?

A

Posture Assessment
- Trusted device?
- Anti-virus? Updated?
- Corporate software?

54
Q

What is the difference between a persistent agent, agentless NAC, and a dissolvable agent in health checks/posture assessments?

A

Persistent: permanent

Dissolvable: no installation and terminates after it is
no longer needed

Agentless NAC: Integrated with AD
Checks are made during login and logoff

55
Q

What is a proxy server?

A

A server that sits between the users and the external network. It receives the user requests and sends the request on their behalf.

It is useful for caching information, access control, URL filtering, and content scanning.

If an application needs to know how to use the proxy, it is explicit. Some are invisible, or transparent.

56
Q

What is an application proxy?

A

A proxy that is used for applications. It can know one or more applications.

Can do NAT, FTP, HTTP, HTTPS, etc.

57
Q

What is a forward proxy?

A

AKA internal proxy

It is commonly used to protect and control user access to the internet.

58
Q

What is a reverse proxy?

A

It controls inbound traffic from the internet to your internal service.

59
Q

What is an open proxy?

A

A third-party, uncontrolled proxy. It can be a significant security concern. It is often used to circumvent existing security controls.

60
Q

What is the difference between an Intrusion Detection System (IDS) and an Intrusion Prevention System (IPS)?

A

An IDS only alerts when there is a threat.

An IPS stops a threat before it gets into the network.

61
Q

What is Passive Monitoring in terms of IPS/IDS?

A

When an IPS/IDS examines a copy of the traffic. There is no way for it to block traffic when it is in passive monitoring mode.

62
Q

What is an out-of-band response in terms of IPS/IDS?

A

When an IPS/IDS identifies malicious traffic and sends TCP RST (reset) frames. This is an after-the-fact response.

63
Q

What is inline monitoring in terms of IPS/IDS?

A

When an IPS is between the switch and the internet. All traffic has to pass through the IDS/IPS.

64
Q

What is an in-band response in terms of IPS/IDS?

A

When an IPS/IDS is inline, it can drop malicious packets before they can proceed on the network.

65
Q

What ways can an IPS identify malicious software?

A

1) Signature-based
- Look for a perfect match
2) Anomaly-based
- Build a baseline of what’s “normal”
3) Behavior-based
- Observe and report
4) Heuristics
- Use AI to identify

66
Q

What is a jump server?

A

Allows internal devices to be access via a private device. SSH/ Tunnel/ VPN is ran to the jump server then jump over to whatever resource you need to access (RDP, SSH, etc.). It is usually highly secured.

A jump server breach can cause a significant breach.

67
Q

What is a Hardware Security Module (HSM)?

A

High-end cryptographic hardware. It can store keys or offload the CPU overhead from other devices that encryption causes (Cryptographic accelerators).

68
Q

What can you use sensors and collectors for?

A

Gather information from networking devices.

Sensors
IPS, Firewall, authentication logs, web server access logs, database transaction logs, email logs

Collectors
SIEM consoles, proprietary consoles (IPS, firewall)

69
Q
A

Security + Messer (24 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions