Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

cc > 4 Network Security > Flashcards

4 Network Security Flashcards

1
Q

2 basic network connection options

A

1 Wired
2 Wireless

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Ethernet cable =

A

RJ-45 connector (8 pin connector - 8 wires)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Telephone connectors =

A

RJ-11(6 pins)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Wi-Fi networks create -

A

wireless LANs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Internet Protocol main responsibilities (2)

A

1 providing an addressing scheme (IP addresses) that uniquely identify computers on a network
2 delivering information in chunks known as packets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

3 TCP flags

A

1 SYN
2 ACK
3 FIN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

The order of TCP flags

A

1 SYN
2 SYN/ACK
3 ACK

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

OSI Layer 7

A

7 Application
- determines how users interact with data
- web browsers, other client applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

OSI Layer 6

A

6 Presentation
- translates characters/bits
- encryption/decryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

OSI Layer 5

A

5 Session
- opening/maintaining/closing sessions between devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

OSI Layer 4

A

4 Transport
- (TCP/UDP)
- creates connections between systems and transports data in a reliable manner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

OSI Layer 3

A

3 Network
- IP
- expands networks to many different nodes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

OSI Layer 2

A

2 Data Link
- (MACs)
- transfers data between 2 nodes connected to the same physical network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

OSI Layer 1

A

1 Physical
- responsible for sending bits over the network using cables, radio waves, fiber optics, etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

7 OSI layers

A

7 Application
6 Presentation
5 Session
4 Transport
3 Network
2 Data Link
1 Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

4 TCP layers

A

4 Application Layer (session, presentation, and application)
3 Transport Layer (same)
2 Internet layer (network)
1 Network interface (physical and data link)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

IPv4 —- bit

A

32 bit, dotted quad, each number represented using 8 binary bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

NAT

A

(router/firewall) translates private IP addresses to public before sending packets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

2 parts of an IP address

A

1 Network Portion (identifies the network that the device is connected to)
2 Host Portion (uniquely identifies the device on that network)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Subnetting is

A

The process of dividing a network into smaller networks
- network interfaces on devices within a subnet can communicate directly
- routers facilitate communication between different subnets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

IPv6 —- bit

A

128 bit
- consist of eight groups of 4 hexadecimal numbers
- each number has 16 possible symbols (0-F)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Network ports are represented using a ____ with _____ possible values

A

16 bit binary number, 65,536 (0 - 65,535)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Well known ports (range)

A

0 -1023,
- ensures everyone on the internet will know how to find common services on a system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Registered ports (range)

A

1024 - 49151
- application vendors may register their applications to use these ports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Dynamic ports (range)

A

49152 - 65535
- applications may use these on a temporary basis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

21

A

FTP control (the FTP uses port 21 to transfer data between systems)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

22

A

SSH (the secure shell protocol uses port 22 for encrypted administrative connections)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

25

A

SMTP (exchange email between servers)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

53

A

used by DNS
Domain Name Server - translates human-readable domain names into machine-readable IP address equivalents.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

443

A

HTTPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

110

A

POP (allows clients to retrieve email on port 110)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Network communications using the NetBIOS protocol for Windows (ports)

A

137, 138, 139

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

IMAP (port)

A

143

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

RDP (Remote Desktop Protocol) (port)

A

3389 - similar purpose to SSH

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

3 types of networks that use some form of authentication to limit access:

A

1 Pre-shared keys (encryption)
2 Enterprise Authentication (uses individual usernames and passwords)
3 Captive Portals (provide authentication on unencrypted wireless networks)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Encryption function

A
  • takes radio waves (an insecure communications technology) and makes it secure
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

WEP -

A

Encryption protocol
(Wired Equivalent Privacy)
- insecure (don’t use)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

WPA -

A

(WiFi Protected Access)
- 1st version (2003)
- used TKIP (Temporal Key Integrity Protocol)
- no longer secure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

WPA 2

A

(2004) (WiFi Protected Access v2)
- uses CCMP (Counter Mode Cipher Block Chaining Message Authentication Code Protocol)
- an encryption protocol based on the AES (Advanced Encryption Standard)
- some potential issues, but is widely used and still considered secure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

WPA 3

A

(2020)
- supports CCMP but adds SAE (new)
- SAE (Simultaneous Authentication of Equals)
- SAE = a secure key exchange protocol based on the Diffie-Hellman technique

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Ping uses

A

ICMP (Internet Control Message Protocol)
- sends an ICMP echo request packet “hello, are you there?”
- remote system sends back ICMP echo reply “yes, I’m here”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Ping troubleshooting steps (4)

A

1 Ping the remote system
2 Ping another system on the internet
3 Ping a system on your local network
3 Try the same process from a different computer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

creates customized ping requests (customized packets)

A

HPing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Traceroute

A
  • determines the network path (how packets travel) between two systems (hosts)
  • each line shows 1 hop on the network path
  • lines with * show hops (systems) that are not answering ICMP echo requests
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q
  • Windows command combining ping and tracert (traceroute) functionality
A

Pathping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

3 types of malware

A

(Viruses, worms, trojans)
- malicious software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

2 components of malware

A

1 propagation mechanism
2 payload

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Virus spreads

A

based on some type of user action

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Worm spreads

A

on its own by exploiting system vulnerabilities, without user interaction
- then uses the infected system as a base to infect other systems on the LAN or internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Trojan

A
  • pretend to be legitimate software
  • program runs as expected
  • but also carries malicious hidden payload
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Botnet =

A
  • a network of infected computers used for malicious purposes
  • attackers steal computing power, storage, or network connectivity
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

All eavesdropping attacks require

A

some compromise of the communication path between a client and server (after the attacker gains either physical or logical access to a network)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Man-in-the-middle attack

A
  • tricks the sending system during the initial communication
  • attacker may reconfigure a network device
  • or use DNS or ARP poisoning
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Eavesdropping methods:

A
  • Network device or cable tapping
  • DNS or ARP poisoning
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Replay attack

A
  • captures encrypted authentication token/info and creates a separate authenticated connection
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Replay attacks are defeated by

A
  • using session tokens (limited time span) or timestamps (packets must be sent within a similar time window
57
Q

SSL Stripping (a variation on eavesdropping attacks)

A
  • exploits a vulnerability and tricks the users browser into sending unencrypted communications
  • stripping the SSL or TLS protection off of the communication
58
Q

Implementation attacks

A
  • exploit a cryptographic system’s design or implementation flaws
59
Q

Fault Injection

A
  • the attacker attempts to compromise the integrity of a device by causing some type of external fault (high-voltage spike, high or low temperature, etc)
  • the fault may cause a malfunction and cause the system to fail to encrypt data properly
60
Q

IDS

A

IDS
- monitors and detects
- alerts administrators to suspicious activity

61
Q

IDPS

A
  • can alert or block depending on the policy (can take immediate corrective action)
  • 2 types of errors - false positives and false negatives
62
Q

2 different technologies to identify suspicious traffic

A

1 Signature-based (Rule-based)
- vulnerable to 0-day attacks
2 Heuristic Detection (Anomaly Detection, Behavior-based Detection)
- can detect 0-day attacks but has high false positive rates

63
Q

IPS deployment models (2)

A

1 in-band (inline)
- single point of failure (vulnerability)
2 out-of-band (passive)
- can react by blocking future traffic, but can’t stop the initial attack because it only learns about it after it has been sent

64
Q

Anti-malware Software (‘antivirus software) - uses 2 different mechanisms

A

1 Signature detection
2 Heuristic/behavior detection
- uses EDR solutions (Endpoint Detection and Response)

65
Q

Vulnerability Scanning Tools (3 major categories)

A

1 Port Scanners
- probe for open network ports
- NMAP (Network Mapper)
2 Vulnerability Scanners
- probe ports for known vulnerabilities
- Nessus
3 Application Scanners
- probe deep into web applications and tests for security flaws

66
Q

Data center air temperature

A
  • use the expanded environmental envelope (64.4 - 80.6 F)
67
Q

Data center humidity

A
  • maintain dew point between 41.9 and 50 F
68
Q

Fire Triangle

A

heat, oxygen, fuel

69
Q

Security Zones

A
  • firewalls segment networks into security zones to protect systems of differing security levels
70
Q

Border Firewalls (typical model)

A
  • have 3 network interfaces because they connect 3 different security zones together
    1 untrusted network (internet)
    2 trusted network (intranet)
    3 DMZ
71
Q

Zero Trust

A

(replacing implicit trust)
- systems do not gain any trust based solely on their network location

72
Q

Extranet

A
  • intranet segments extended to business partners
  • example using a VPN to access the ERP system (Enterprise Resource Planning)
73
Q

2 Honeynet

A
  • decoy network designed to attract attackers
74
Q

3 Ad Hoc Networks

A
  • temporary network that may bypass security controls
  • may be planned
  • may be careless (employee sets up wireless access point for better signal)
75
Q

East-West Traffic
- network traffic between systems located in the data center
-may be regulated by a firewall if it crosses security zones

A
  • network traffic between systems located in the data center
    -may be regulated by a firewall if it crosses security zones
76
Q

North-South Traffic

A
  • network traffic between systems in the data center and systems on the internet
77
Q

Switches

A
  • each switch port is connected to one end of a network cable,
  • wireless access points (contain radios) are also connected via cables to switches
  • switches are limited to creating local networks
  • operate at OSI layer 2 (data link) where they work with MAC addresses only
78
Q

Routers

A
  • connect networks together using IP addresses (OSI layer 3 network)
  • make decisions about the best paths for traffic to follow
  • stateless inspection
79
Q

VLANs

A
  • logically group LANs based on similar function
  • use trunks to allow switches in different locations to carry the same VLANs
  • OSI layer 2 (does not use routers or firewalls)
80
Q

Micro Segmentation

A

Creates very small VLANs, often temporary

81
Q

Stateless firewalls

A
  • evaluate each packet separately when it arrives at the firewall
  • inefficient
  • older
82
Q

Stateful Inspection

A
  • allows the two systems (client/server) to communicate back and forth without reevaluating the request each time a new packet appears for the duration of the connection
  • newer
83
Q

Firewall Rules (5)

A

1 source system address
2 destination system address
3 destination port
4 protocol
5 action (allow or deny) the firewall should take when encountering traffic matching the rule

84
Q

Implicit Deny Rule

A
  • any traffic that isn’t explicitly permitted by a rule should automatically be denied
85
Q

Next Generation Firewalls (NGFW)

A
  • incorporate contextual information into their decision-making process
  • identity of the user, time of day, etc.
86
Q

NAT Gateway

A
  • translates between the public IPs used on the internet and the private IPs used on local networks
87
Q

Web Application Firewalls

A
  • application aware (understand how the HTTP protocol works)
88
Q

Firewall Deployment Options (2)

A

Network hardware vs. host-based software firewalls

89
Q

Network firewalls

A

-physical devices that sit on a network

90
Q

Host-based

A
  • applications or OS components that reside on a server
91
Q

Network Firewall Deployment Mechanisms (2)

A

1 Dedicated Hardware
- ship with firewall firmware built in
2 Virtual appliances
- loaded directly into a virtualization platform

92
Q

VPNs and VPN Concentrators
- provide 2 important security functions

A

1 site-to-site VPNs allow secure interconnection of remote networks (branch offices, etc)
2 provide remote access for mobile workers

93
Q

VPN mechanism

A
  • uses encryption to create a virtual tunnel between two systems over the internet
  • requires an endpoint on the remote network that accepts VPN connections
94
Q

VPN Concentrators

A
  • for high volume, are very efficient- high bandwidth
  • VPN traffic requires resource-intensive encryption
95
Q

IPSec

A
  • VPN protocol
  • usually used for static site-to-site VPNs
  • works at layer 3 (Network)
  • supports Layer 2 (Data Link) Tunneling Protocol (L2TP)
96
Q

SSL/TLS VPNs

A
  • works at the application layer over TCP port 443
97
Q

HTML5 VPNs

A
  • work entirely within the web browser
  • uses the web server in a proxying role
98
Q

Different tunneling approaches for remote access (3)

A

1 Full Tunnel VPN
- all traffic leaving the connected device is routed through the VPN tunnel, regardless of its final destination
- includes extraneous traffic
2 Split Tunnel VPN
- only traffic destined for the corporate network is sent through the VPN tunnel.
- extraneous traffic is routed directly over the internet
3 Always On VPN
- all corporate mobile devices are configured to automatically connect to the VPN whenever they are powered on
- takes control away from the end user

99
Q

Network Access Control (NAC)

A
  • intercepts network traffic and verifies that the system and user are authorized before allowing communication with other systems
  • uses authentication protocol 802.1x
100
Q

802.1x transaction (involves 3 systems)

A

1 connecting device
- runs a piece of software called a supplicant (performs NAC tasks)
- uses EAP (Extensible Authentication Protocol)

2 Authenticator (Switch or Wireless controller)
- receives credentials from user

3 Authentication Server
- sends back either a radius accept or radius reject message
- also decides where to place a user on the network

101
Q

NAC Roles (3)

A

1 user and device authentication
2 performs role-based access
3 performs posture checking (health checking)

102
Q

Quarantine VLAN

A
  • for devices that fail
  • limited internet access for updating posture
103
Q

NAC approaches (2)

A

1 In-Band approach
- NAC device is directly involved in decision making and enforcement
2 Out-of-band
- NAC device makes the decision but other network components (Switch, wireless access point, etc) enforce the decision

104
Q

Smart Device =

A

the device is computer controlled and network connected

105
Q

Smart Device security issues (3)

A

1 slimmed-down OS - difficult for users to configure and update OS and software
2 a compromised device can be gateway to other devices on the network
3 cloud-based command and control can be a path for attackers that bypass a firewall

106
Q

Application Firewalls

A
  • governs HTTP traffic to and from an application or service using rules and policies
  • IoT devices have web interfaces that are susceptible to traditional web application attacks (SQL injection, buffer overflows, cross-site scripting attacks, etc)
107
Q

Network Security for smart devices - 2 techniques

A

1 Network Segmentation
- like DMZ for smart devices
2 Application Firewalls

108
Q

Security Wrappers

A
  • ‘mini firewall’ for the embedded device
  • device is not directly accessible over the network, but is reached through a ‘wrapper’ system that monitors input and output for security issues and only passes vetted requests
109
Q

Cloud Computing =

A

any case where computing services are delivered to a customer over a network

110
Q

IaaS

A
  • customer purchases server instances (and installs/configures the OS)
  • service provider provides everything up to the OS (bare metal to virtualization)
  • customer is responsible for the OS and up (middleware, runtime)
111
Q

Middleware

A
  • “software glue”
  • lies between the OS and
  • software that different applications use to communicate with each other (bridge between diverse technologies)
112
Q

APIs =

A

Mechanisms that enable two software components to communicate with each other using a set of definitions and protocols (weather app and weather bureau’s software system)

113
Q

Runtime

A
  • instructions that are executed to keep a program running
114
Q

PaaS

A
  • customer purchases app platform to run their own application code without having to worry about server configuration
  • service provider provides OS, middleware and runtime
115
Q

IaaS shared responsibility

A
  • vendor: data center and hardware (+ virtualization)
  • customer: OS, middleware, runtime, applications, data
116
Q

PaaS shared responsibility

A
  • vendor: data center, hardware, OS (and middleware and runtime)
  • customer: application, data (access control - provider is responsible for implementing your access control policies)
117
Q

SaaS shared responsibility

A
  • vendor: data center, hardware, OS, application
  • customer: data (and access control)
118
Q

Cloud Deployment Models (5)

A

1 private cloud
2 public cloud
3 hybrid cloud
4 multi-cloud
- combines resources from two or more public cloud vendors
5 community cloud

119
Q

Managed Service Security Providers (MSSPs)

A
  • provide security services for other organizations as a managed service
120
Q

SECaaS (Security as a Service)

A
  • a sub category of MSSPs
121
Q

Cloud Access Security Brokers (CSAB)

A
  • add a third-party security layer to the interactions users have with cloud services
122
Q

CSABs work in 2 ways:

A

1 network-based CSAB
- broker sits between the users and the cloud service

2 API approach
- broker uses an API to regularly query the cloud service and monitor for security issues

123
Q

Vendor Management Lifecycle (4)

A

1 Vendor Selection
- formal RFP (Request for Proposal)
2 Onboarding
3 Monitoring
4 Offboarding

124
Q

NDAs

A
  • usually the first document signed when two organizations explore a business partnership
  • ensures the firms will keep each other’s information confidential
125
Q

SLR (Service-level Requirements)

A
  • system response time, acceptable down-time, availability, data preservation, etc.
126
Q

SLA (Service Level Agreement)

A
  • document SLRs in the SLA
  • contract that defines the conditions of service and penalties for failure to maintain
  • should include minimum security requirements
127
Q

MOU (Memorandum Of Understanding)

A
  • used when a legal dispute is unlikely but the customer and vendor still wish to document their relationship to avoid future misunderstandings
128
Q

BPAs (Business Partnership Agreements)

A
  • when two organizations agree to do business with each other in a partnership (joint development of a product, etc)
  • defines each partner’s responsibilities and the division of profits
129
Q

ISAs (Interconnection Security Agreements)

A
  • defines the ways the two organizations will interconnect their networks, systems, data, etc
  • provides details on connection security parameters (encryption, transfer protocols, etc)
130
Q

Transport layer responsibilities (2)

A
  • establishes basic data channels that applications use for task-specific data exchange
  • application addressing (port numbers)
131
Q

Simplex

A

One-way communication (one system transmits, the other listens)

132
Q

half-duplex

A

only one system can transmit at a time

133
Q

full-duplex

A

both systems can send/receive at the same time

134
Q

2 MAC address schemes

A

48 bit (24/24)
64 bit (24/40) uses FF:FE for IPv6

135
Q

20

A

FTP data transfer

136
Q

23

A

Telnet - unencrypted text communications

137
Q
A
138
Q
A

cc (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions