4.0 Network Security Flashcards
You need to deploy 802.1x authentication that supports client-side digital certificates for authentication with access points. Which technology should you deploy?
A)EAP-TLS
B)Cisco LEAP
C)EAP-PEAP
D)WEP
Extensible Authentication Protocol with Transport Layer Security (EAP-TLS) authentication supports client-side digital certificates for authentication with access points. You can configure Cisco Aironet wireless clients with digital certificates for authentication with EAP-TLS authentication. The Cisco EAP-TLS authentication type can be configured on wireless clients that run Windows. If the wireless clients are working with other operating systems, a third-party software package must be installed to support EAP-TLS authentication. The EAP-TLS authentication type operates with a dynamic session-based WEP key. The dynamic session-based WEP key encrypts data with the key that is generated from the RADIUS authentication server or the client adapter. EAP-TLS uses Public Key Infrastructure (PKI) for encryption of data over the RF channel. You integrate the EAP-TLS authentication type with the use of Lightweight Directory Access Protocol (LDAP) for server-based authentication.
For the Network+ exam, you also need to understand Extensible Authentication Protocol − Flexible Authentication via Secure Tunneling (EAP-FAST) and Protected Extensible Authentication Protocol (PEAP). PEAP will form an encrypted TLS tunnel using a certificate on the server. After the tunnel has been formed, PEAP will authenticate the client using EAP within the outer tunnel. EAP-FAST is Cisco’s alternative to PEAP.
Why does Cisco recommend to use Wireless Client Isolation to improve security?
In addition to this feature, Cisco has also created and recommends the use of Wireless Client Isolation to improve wireless security. Wireless Client Isolation is a feature that prevents wireless clients from communicating with each other. This feature is useful when configuring a guest network or when utilizing a Bring Your Own Device (BYOD) policy, as it will increase security to limit potential threats from the various connected devices.
Does EAP-PEAP work with wireless authentication?
EAP-PEAP authentication does not work with wireless access points. EAP-PEAP works with RADIUS servers.
CISCO LEAP Authentications works with?
Cisco LEAP authentication does not work with client-side digital certificates. Both sides of the communication using Cisco LEAP share a per-session, per-user encryption key, not a digital certificate.
What typically enables a social engineering attack to occur? (Choose 2)
A) the deletion of key files
B) believable language
C) encryption
D) gullibility
Gullibility, believable language, and the good intentions of users typically enable a social engineering attack to occur. An example of a social engineering attack is an e-mail hoax, which is an e-mail message that indicates the possibility of virus infection. An e-mail hoax contains a message that uses believable language to trick users into believing the hoax. In the text of an e-mail hoax, users are typically instructed to forward the message to as many others as possible, which is how an e-mail hoax replicates. Sometimes, an e-mail hoax will direct users to delete key system files, an action that can seriously damage an operating system installation. Another bomb caused by an e-mail hoax is increased use of bandwidth, which results when users on a network forward a hoax to other users.
Social engineering attacks do not typically use encryption.
Which hacker attack can be perpetrated by hijacking a communications session between a Web browser and a Web server?
A) brute force
B) SYN attack
C) MITM
D) Ping of Death
A man-in-the-middle (MITM), or an On-Path, attack can be perpetrated by hijacking a communications session between a Web browser and a Web server. When a Web browser submits information to a Web server through a form, a hacker might be able to gain sensitive information, such as credit card numbers.
What is a brute force Attack?
A brute force attack occurs when a hacker tries every possible combination to break a code such as an encryption key or a password. A brute force attack can be used to break into a system that is secured with discretionary access lists (DACs). If a hacker identifies a valid user name and password on a DAC network, then the hacker can log in by using those credentials and can be assigned access to resources based on DAC settings.
What is a ping of death?
A Ping of Death is a denial-of-service (DoS) attack that occurs when a hacker sends multiple Internet Control Message Protocol (ICMP) messages to a network to attempt to overwhelm servers.
A SYN attack occurs when?
A SYN attack occurs when a hacker exploits the Transmission Control Protocol (TCP) triple handshake.
Which aspect of the CIA triad is best described as ensuring that data is accurate and reliable?
A) Authentication
B) Availability
C) Confidentiality
D) Integrity
Integrity is best described as ensuring that data is accurate and reliable whenever authorized parties are viewing it. Ensuring integrity guarantees that data has not been altered in any way by a malicious actor.
Describe what C is in the CIA triad model?
Confidentiality guarantees that only authorized persons can view select data. Maintaining confidentiality is critical because it ensures that proprietary information or corporate secrets are not being exposed to any unauthorized parties.
Describe what A is in the CIA triad model?
Availability ensures resources are usable when a user needs them. Maintaining availability refers to having services, applications, or technologies functioning when users need them.
Authentication is not part of the CIA triad. Authentication is the process of verifying a user’s stated identity.
Which attack involves impersonating the identity of another host to gain access to privileged resources that are typically restricted?
A) teardrop
B) spamming
C) spoofing
D) SYN flood
In a spoofing attack, which is also referred to as a masquerading attack, a person or program is able to masquerade successfully as another person or program. Spoofing refers to modifying the source IP address field in an IP datagram to imitate the IP address of a packet originating from an authorized source. This results in the target computer communicating with the attacker’s computer and providing access to restricted resources. Basically, the Internet traffic is misdirected because the DNS server is resolving the domain name to an incorrect IP address. A man-in-the-middle attack is an example of a spoofing as well as a session hijacking attack. Other types of spoofing attacks, apart from IP spoofing, are e-mail spoofing and Web spoofing. Spoofing attacks have to do with the misdirection of domain name resolution and Internet traffic.
What is a teardrop attack?
In a teardrop attack, the attacker uses a series of IP fragmented packets, causing the system to either freeze or crash while the packets are being reassembled by the victim host. A teardrop attack is primarily based on the fragmentation implementation of IP. To reassemble the fragments in the original packet at the destination, the host checks the incoming packets to ensure that they belong to the same original packet. The packets are malformed. Therefore, the process of reassembling the packets causes the system to either freeze or crash.
What is a SYN Flood attack?
In a SYN flood attack, the attacker floods the target with spoofed IP packets and causes it to either freeze or crash. The Transmission Control Protocol (TCP) uses the synchronize (SYN) and acknowledgment (ACK) packets to establish communication between two host computers. The exchange of the SYN, SYN-ACK, and ACK packets between two host computers is referred to as handshaking. The attackers flood the target computers with a series of SYN packets to which the target host computer replies. The target host computer then allocates resources to establish a connection. Because the IP address is spoofed, the target host computer never receives a valid response in the form of ACK packets from the attacking computer. When the target computer receives many such SYN packets, it runs out of resources to establish a connection with the legitimate users and becomes unreachable for processing of valid requests.
What is an Spamming attack?
A spamming attack involves flooding an e-mail server or specific e-mail addresses repeatedly with identical unwanted e-mails. Spamming is the process of using an electronic communications medium, such as e-mail, to send unsolicited messages to users in bulk. Packet filtering routers typically do not prove helpful in such attacks because the packet filtering routers do not examine the data portion of the packet. E-mail filter programs are now being embedded either in the e-mail client or in the server. E-mail filters can be configured to prevent spamming to a great extent.
You are giving a presentation about Internet browsing safety at a senior living center. The residents want to create social media accounts to keep in contact with the grandkids. Which user security concern should you emphasize?
A) Disabling unnecessary services
B) Hashing files
C) Avoiding common passwords
D) Disabling unused ports
Avoiding common passwords is critical to establishing basic security. Users should refrain from using dictionary words, names, numbers-only passwords, and keyboard patterns like qwerty. In a recent NIST study, the most secure passwords are comprised of three to four random 10+ character words, such as “ElephantInternationalConstitutionConvention.”
How can you secure a switch?
Disabling unused ports is an excellent way to secure a switch, not a user account. You should only enable designated active ports needed for network connections. As an example, if you have a 24-port switch, but only 18 of those are needed for connected hosts, you should set the status of the other six ports to “disabled.”
How can you determine a file has not been altered?
File hashing is an excellent security measure to detect whether or not a file has been intercepted and altered, but it will not secure a user account. An algorithm is used to create a unique value (hash) based on the file’s contents. The recipient of the file uses the same algorithm to generate a hash. If the two hash values match, the file has not been altered. Examples of hash algorithms include MD5, SHA1, and CRC32.
What does disabling unnecessary services do?
Disabling unnecessary services helps reduce the number of potential exploits available to an attacker. By default, Windows starts what are typically unnecessary services during bootup. As an example, you should disable FTP publishing if you do not need FTP service. You can see which services are running by going to Start > Run > Services.msc. However, disabling unnecessary services secures a client computer, not a user account.
Your company’s IT department needs to provide field engineers with remote GUI-based access to their in-office desktop PCs over the Internet. Engineers could use Windows, Linux, iOS, and Android on their remote devices with a mix of MacOS and Windows on the in-office desktops. Which of the following remote access tools offers the best no-cost option?
A) Telnet
B) VNC
C) RDC
D) ARD
E) SSH
Virtual Network Computing (VNC) is correct for many reasons. First, several VNC products are widely and freely available for Windows, OS X (MacOS), Linux, Android, iOS, and Chrome. Second, many VNC products are easy to set up and use, interoperate among multiple versions, and work well through corporate and personal firewalls. Of the items listed it is the best no-cost option.
Apple Remote Desktop is not the best option. It works best for Apple environments, such as OS X and iOS, but it does work on Windows and other platforms as well. However, ARD costs $80 per host license.
Microsoft RDC is it compatible with Linux OS?
Microsoft’s Remote Desktop Connection (RDC) is not the best option. It does not work on Linux, but runs in app form on OS X and iOS. It works as a client on all modern Windows versions back to Vista, but as a host only on Pro versions or higher (Enterprise, and Education).
Which protocol is NOT capable of preventing a man-in-the-middle attack?
A) HTTPS
B) IPSec
C) SSH
D) rsh
The remote shell (rsh) protocol is used to log on to remote computers and can be easily exploited by a man-in-the middle (MITM) attack because it neither provides encryption nor authentication of data. In a MITM attack, an intruder captures the traffic of an established connection to intercept the messages being exchanged between the sender and the receiver. The rsh protocol does not provide security because the traffic flows in clear text and not ciphertext. You can defend against a MITM attack by using strong encryption.
SSH functions?
Secure shell (SSH) provides security by authenticating before the exchange of secret keys. SSH is also known as encrypted telnet because it provides encryption of traffic exchanged between the sender and the receiver. Because encryption is used, SSH can prevent MITM attacks better than rsh can.
To improve your ability to monitor and manage your network devices, your network requirements call for purchasing devices that support out-of-band (OOB) management. Which of the following types of interfaces or devices is most likely to satisfy this requirement, as you select switches, routers, firewalls, and servers for purchase?
A) Serial port
B) Parallel port
C) Separate network interface
D) WAN port
E) RJ-45 port
A serial port easily and regularly plays host to a modem, which provides a dial-up link that network admins can use to access the device to which it is attached. The whole idea of OOB is to use a separate communications link outside the scope and reach of the regular network. An out-of-band link provides a way to access a device even when the network is down or when the device needs to be powered up after a power fault or interruption. Console servers may also use special-purpose network console ports to obtain administrative access and control over such devices.
What is a physical barrier that acts as the first line of defense against an intruder?
A) a fence
B) a lock
C) a turnstile
D) an access control vestibule
Fencing acts as the first line of defense against casual trespassers and potential intruders, but fencing should be complemented with other physical security controls, such as guards and dogs, to maintain the security of the facility. A fence height of 6 to 7 feet is considered ideal for preventing intruders from climbing over the fence. In addition to being a barrier to trespassers, the fence can also control crowds. A fence height of 3 to 4 feet acts as a protection against casual trespassers. For critical areas, the fence should be at least 8 feet high with three strands of barbed wire.
What is the difference between an exploit and a vulnerability?
A) An exploit is a threat, and a vulnerability is a flaw.
B) The two terms are interchangeable
C) An exploit is a flaw, and a vulnerability takes advantage of that flaw
D) A vulnerability is a flaw, and an exploit takes advantage of that flaw
When comparing exploits vs. vulnerabilities, a vulnerability is a flaw or weakness, and an exploit takes advantage of that flaw. As examples, a vulnerability could be a section of code in an application that fails to validate user input against a range of acceptable values. The exploit would be the active use of that failure to validate to introduce malicious data, such as an SQL injection attack.
A threat is the likelihood that an event is going to occur.
The terms exploit and vulnerability are not interchangeable.
You company want to allow remote users to access their Windows network remotely if their network is not connected to the Internet. Which of the following should you implement?
A) DHCP
B) RAS
C) PPTP
D) SSL
Remote Access Service (RAS) is a service provided by Windows that allows remote access to the network via a dial-up connection. In order to obtain a remote connection, two services need to be in place: RAS and dial-up networking (DUN). The server that will establish the remote connection needs to have RAS so that it can link to the remote computer. The remote computer needs to have DUN so that it can connect to the remote server.
You are deploying a virtual private network (VPN) for remote users. You want to meet the following goals:
The VPN gateway should require the use of Internet Protocol Security (IPSec).
All remote users must use IPSec to connect to the VPN gateway.
No internal hosts should use IPSec.
Which IPSec mode should you use?
A) gateway-to-gateway
B) This configuration is not possible.
C) host-to-host
D) host-to-gateway
You should deploy host-to-gateway IPSec mode. In this configuration, the VPN gateway requires the use of IPSec for all remote clients. The remote clients use IPSec to connect to the VPN gateway. Any communication between the VPN gateway and the internet hosts on behalf of the remote clients does not use IPSec. Only the traffic over the Internet uses IPSec. In host-to-host IPSec mode, each host must deploy IPSec. This mode would require that any internal hosts that communicate with the VPN clients would need to deploy IPSec.
In gateway-to-gateway IPSec mode, the gateways at each end of the connection provide IPSec functionality. The individual hosts do not. For this reason, the VPN is transparent to the users. This deployment best works when a branch office or partner company needs access to your network.
In PKI, what is the entity that signs a certificate?
A) a principal
B) a subject
C) a verifier
D) an issuer
In Public Key Infrastructure (PKI), an issuer is the entity that signs a certificate. Signing a certificate verifies that the name and key in the certificate are valid. PKI is a system designed to securely distribute public keys. A PKI typically consists of the following components: certificates, a key repository, a method for revoking certificates, and a method to evaluate a certificate chain, which security professionals can use to follow the possession of keys. Chain of custody might be used in proving legal cases against hackers. Most organizations implement PKI using a PKI Web service so that a third party is responsible for issuing and managing certificates.
What is the Principle of PKI?
A principal is any entity that possesses a public key. A verifier is an entity that verifies a public key chain. A subject is an entity that seeks to have a certificate validated.
While a PKI can be a Web service, other Web services that organizations use include HTTP sites, FTP sites, and social networking sites. All organizations should consider the security and performance ramifications of the use of any of these Web services on the organization’s network.
What is CRL?
A certificate revocation list (CRL) contains a list of serial numbers for digital certificates that have not expired, but that a certification authority (CA) has specified to be invalid. Typically, the serial number of a digital certificate is placed in a CRL because the digital certificate has been compromised in some way. A CA, sometimes referred to as a certificate authority, is an entity that issues and validates digital certificates. To create a digital certificate, a user provides a CA with contact information and a public and private key pair. The CA verifies the provided information, and creates a digital document with the user’s contact information and key pair. The CA then encrypts the digital document with its private key to create a digital certificate. Finally, users can use the CA’s public key to determine whether a digital certificate is valid.
What is the private key of the root certificate authority?
The private key of the root certification authority (CA) must be secured to ensure that the certificates that have been validated in a public key infrastructure (PKI) are protected. If the private key of the root CA has been compromised, then a new root certificate must be created and the PKI must be rebuilt. If the private key of a user’s certificate has been compromised, then a new certificate should be created for that user and the user’s compromised certificate should be revoked. The compromise of a user’s certificate will not jeopardize other certificates in a PKI. A public key, as its name implies, is public, and does not need to be kept secret.
What is the cross certification is primarily used for?
Cross certification is primarily used to establish trust between different PKIs and build an overall PKI hierarchy. Cross certification allows users to validate each other’s certificate when they are certified under different certification hierarchies. The primary purpose of cross certification is to build a trust relationship between different certification hierarchies when users who belong to different hierarchies are required to communicate, and might require authentication for legitimate connections. The process implies the establishment of a trust relationship between two certification authorities (CAs) through the signing of another CA’s public key in a certificate referred to as a cross certificate.
What is unified serviced and network controller?
For the Network+ exam, you need to understand two other services: unified voice services and network controllers. Unified voice services are any services in which network (data) and voice services are implemented over the same media. The most popular example of this is Voice over IP (VoIP). Network controllers allow network administrators to manage multiple devices from a central device. For example, Cisco’s Wireless LAN Controller (WLC) model 5760 allows centralized management and control of multiple wireless access points (WAPs).
Which of the following would be used to help defend against a man-in-the-middle attack?
A) DHCP snooping
B) Root guard
C) Flood guard
D) BPDU guard
DHCP snooping prevents an unauthorized DHCP server from issuing IP addresses to clients. The unauthorized or rogue DHCP server is often used in man-in-the-middle attacks. A trusted server is identified on a specific switch port by configuring the DHCP Snooping Trust State. This allows DHCP traffic to flow through the port. A DHCP server attached to a port that does not have a properly configured trust state will have its traffic blocked.
Current Web communications can also be secured against eavesdropping, hijacking, and man-in-the-middle (MitM) attacks through mutual certificate authentication via Transport Layer Security (TLS). The encryption negotiated by TLS between a Web client and Web server provides protection against eavesdropping and hijacking, and the mutual authentication using certificates that provides protection against MitM attacks.
What does BPDU prevents?
Bridge Protocol Data Unit (BPDU) guard works with Spanning Tree Protocol (STP) and PortFast. When a switch receives a BPDU, the BPDU guard disables the port on which PortFast has been configured. It prevents looping, not man-in-the-middle attacks.
What does Flood guard do?
Flood guard establishes the maximum number of MAC addresses that can be seen by an interface. The switch monitors the traffic on the interface. If the network gets flooded with MAC addresses, the flood monitor can intervene by disabling ports and filtering out traffic. Denial of Service (DoS) attacks may use traffic flooding to deny valid users the ability to interact with resources at an acceptable level, pace, or throughput. It prevents DoS flooding attacks, not man-in-the-middle attacks.
You have expanded the number of nodes on your network and have added a second 24-port switch. The new switch is in place and has sufficient port capacity for another six nodes in the future. What should you do to increase the security of the switch?
A) Upgrade firmware
B) Disable unused ports
C) Use secure protocols
D) Install patches and updates
Disabling unused ports is an excellent way to secure a switch. You should only enable designated active ports needed for network connections. As an example, if you have a 24-port switch, but only 18 of those are needed for connected hosts, you should set the status of the other six ports to “disabled.”
Why do we always want upgrade firmware?
Upgrading firmware is one way to ensure that the network component is performing properly, or to the current standard. Firmware differs from a driver. A driver allows the hardware communicate with an operating system, such as Windows 10, Linux, or OSX. Firmware is the software that allows the hardware device to operate. A simplified example of one aspect of firmware would be the line of instruction on the NIC that causes the green light to blink when network traffic is present.
Installing patches and updates to the network hardware will ensure that the firmware is up to date and that any remedies to known security issues will be corrected.
Why do we use secure protocols?
Using secure protocols is paramount to network security. In SOHO networks, routers (as an example) are shipped with insecure protocols, such as WEP, enabled. While WEP is the easiest for consumer or novice to use while getting the network up and running, it is inherently insecure and should be disabled in favor of a more secure protocol such as WPA2.
What can be used by a hacker to implement a social engineering attack on a network?
A) a multimeter
B) a packet sniffer
C) a remote control package
D) a telephone
A telephone can be used by a hacker to implement a social engineering attack in which the hacker attempts to gain critical network information through social interaction with company employees. For example, a hacker might call a user on a network and ask for a user name and password. If the user is not properly trained, then the user might provide his or her user name and password to the hacker.
Dumpster diving is another social engineering method that is carried out by stealing information from a company’s trash disposal. To prevent dumpster diving, destroy all paper and other media that are not required.
Which one of these requires a user complete an action, such as digitally signing an AUP, prior to accessing the network?
A) MAC filter
B) Port security
C) Captive portal
D) Access control list
Captive portals are web pages, typically used in public networks, where users must complete some action before they are granted access to the network. Captive portals are commonly seen in coffee shops, hotels, and airports, and the user often has to accept an acceptable use policy (AUP) before they can connect to the internet.
Port security allows a network administrator to only allow a specific MAC address (or group of MAC addresses) on a switch port. MAC filtering theoretically does the same thing as port filtering, but port filtering works on switches, whereas MAC filtering works on routers.
MAC filtering is accomplished by granting (or denying) network access to a list of MAC addresses. The list of MAC addresses for which you are either granting or denying access to is stored in an access control list (ACL).
ACLs compare the entity that is requesting access to a network resource against a list of valid entities. Access is granted or denied based on the access configured for that entity. Simply put, ACLs identify which users have access to a given object, such as a drive, a file, or a directory.
You work for a medium-sized company. You would like to provide secure, remote access between the company’s three Internet-connected sites and their Windows client, servers, and domain controllers. Which option would provide adequate security and cost the least overall?
A) Create a VPN, and run RDP over the VPN.
B) Purchase WAN links between each pair of sites, and run a commercial VPN over IPSec.
C) Use a freeware VNC to run TeamViewer over the Internet.
D) Use IPSec to secure RDP over the Internet with connection security rules and associations.
You should use Internet Protocol Security (IPSec) to secure Remote Desktop Protocol (RDP) over the Internet with connection security rules and associations because it uses only Microsoft-supplied protocols and services. This is the only option that provides an additional layer of encryption and security beyond what is included in RDP or Windows Remote Desktop Connections. The connection security rules and associations work with IPSec to establish how to broker a legitimate RDP connection and to manage proofs of identity and authentication between communicating parties.
Purchasing WAN links between each pair of sites and running a commercial virtual private network (VPN) over IPSec offers strong security. However, doing so would require purchasing dedicated WAN links when Internet costs are lower or already covered through the company’s existing Internet access. This solution also incurs additional costs for a commercial VPN in which to run remote access.
Creating a VPN, and running RDP over the VPN eliminates the cost of WAN links, but incurs the costs for a commercial VPN. Thus, it is not as cheap as the RDP option.
Using a freeware virtual network computing (VNC) to run TeamViewer over the Internet is not a cheaper option because TeamViewer would incur costs to run. In addition, a VNC is not needed as Windows computers include RDP. VNC is an option to use if other operating systems are included.
RDP does not offer complete security by itself. It also fails to provide authentication to verify the identity of RD session hosts. At a minimum, TLS should be employed to strengthen RDP.
Which of the following attacks directs user traffic to a malicious web site without any outside communication from an attacker?
A)ARP poisoning
B)Ransomware
C)Phishing
D)DNS poisoning
DNS poisoning, also known as DNS cache poisoning, can direct user traffic to a malicious web site. The attack is accomplished by inserting a bogus record in the DNS server cache, redirecting traffic from the “good” web site to the malicious web site.
What is ARP Poisoning?
Address Resolution Protocol (ARP) poisoning, also known as ARP spoofing, occurs when an attacker sends counterfeit messages on the network, resulting in the replacement of a legitimate user’s MAC address with the attacker’s MAC address. Once that happens, the attacker will begin receiving traffic destined for the legitimate user.
You need to define which protocols are allowed to traverse the router, whether the traffic is inbound or outbound, Which of the following should you use?
A) Software-defined networking
B) Distributed switching
C) Packet switching
D) Access control lists
An access control list (ACL) allows you to define which types of traffic are allowed into or out of the network on a protocol-by-protocol basis. ACLs can also be configured based on port number, MAC address, IP address, and other criteria.
Distributed switching allows a host to select from a pool of switches.
Packet switch vs Circuit Switch
It is critical that you know the difference between packet-switched and circuit-switched networks. Packet-switched networks break the traffic into small parcels. Depending on the layer at which they reside, those parcels are called packets. Each packet contains, among other things, the destination address. The receiving router uses that destination address to forward the packet to the next router.
Circuit-switched networks require that a connection be established between the sender and the receiver. Once a connection is made (meaning that a circuit is formed), the data is routed from the sender to the receiver.
SDNs what is the function of this?
Software-defined networks (SDNs) allow a network administrator to direct and prioritize traffic, and connections, over virtual switches, from a centralized console. SDNs can control the access to switches and routers but do not have anything to do with allowing traffic to traverse a switch or router.
You have a strong wireless password policy, but users (including management) are complaining about it. Consequently, enforcement is difficult. You need a protocol solution that does not require digital certificates. Which of these choices would help you secure your network?
A) Geofencing
B) EAP-FAST
C) PEAP
D) EAP-TLS
Extensible Authentication Protocol − Flexible Authentication via Secure Tunneling (EAP-FAST) was developed by Cisco to assist with enforcing strong password policies, and it does not require digital certificates. EAP-FAST is a faster version of Protected EAP (PEAP). EAP-FAST uses protected access credentials (PACs) stored on the supplicant device, somewhat like cookies. With the credentials already stored on the supplicant, authentication can occur more rapidly. Extensible Authentication Protocol (EAP) made the use of certificates, biometrics, and smart cards possible.
Wireless Security Protocol: PEAP?
PEAP first creates a tunnel between the supplicant (client) and the server, and then proceeds with the rest of the steps in the EAP process. PEAP requires certificates.
EAP-TLS?
Extensible Authentication Protocol − Transport Layer Security (EAP-TLS) uses public key infrastructure (PKI) certificates to authenticate the supplicant (client) and the server.
Geofencing ia type of security that….
Geofencing allows an administrator to geographically define the boundaries of wireless access. It is particularly useful if the organization does not want individuals outside the building to have wireless access. Global Positioning System (GPS) or Radio Frequency Identification (RFID) data from the client device is used to request access to the authentication server. If the client device is within the defined boundaries, it will be granted access. Geofencing does not really provide a way to secure your network; it just limits the network’s boundaries.
Which of these mitigation techniques applies the principle of defense in depth to help mitigate the attacks to which the device is susceptible?
A) Signature management
B) Privileged user account
C) Device hardening
D) Flood guard
Device hardening is the application of defense in depth principles to help mitigate the attacks to which the device is susceptible. For a switch, device hardening could include shutting off unused ports. Another example could be blocking traffic on port 23 to prevent traffic on an unused port. Other enhanced security activities, such as password policies and establishing file permissions, are also examples of device hardening. Device hardening provides controls at all layers of the OSI model to provide the defense in depth.
Defense in depth is a multi-layered approach to security that establishes a robust defensive strategy against attackers. This strategy prevents a single attack from being sufficient to breach an environment, forcing attackers to use complex, multi-pronged, daisy-chain attacks that are more likely to fail or be detected during the attempt.
What is signature management?
Signature management is the monitoring of digital signatures to ensure that file tampering has not occurred. This would only protect against data integrity attacks, not against any other kinds of attacks
Which type of network would be set up in an office for computers and mobile devices that do NOT comply with the company’s NAC policies?
A) wireless network
B) guest network
C) VPN
D) quarantine network
A quarantine network would be set up in an office for computer and mobile devices that do NOT comply with the network access control (NAC) policies. A NAC server would hold the policies that would control access to the network. If computers or mobile devices did not have the appropriate security controls configured, they would be placed on the quarantine network to isolate them. This would ensure that they would have limited access to the company network until the appropriate security measures were taken.
A guest network would be set up in an office so that customers could access the Internet but not internal resources, such as printers and servers. A wireless network is configured so that users can wirelessly connect to the LAN. A virtual private network (VPN) is configured to allow personnel to securely access local resources via the Internet through a security VPN tunnel. A benefit from setting up a guest network is the ability to access isolated corporate resources.
What are the concepts of NAC?
For the Network+ exam, you need to understand the following NAC concepts:
802.1x − 802.1X is a protocol that authenticates a user before allowing any of the host’s data traffic to be sent to the network. 802.1x authentication can work with the NAC server. While 802.1x is used for authentication, the NAC server will check to see if the appropriate security controls are in place on the authenticating devices based on the NAC policies that are configured.
Posture assessment − This is the process whereby a client is checked against a set of requirements in a NAC policy. If a client meets the requirements, it is given full network access. If a client does not meet the requirements, it is placed on the quarantine network and given limited network access.
Persistent vs non-persistent agents − An agent running on a client computer is a persistent agent if it runs all the time. It is a non-persistent agent if it is run only during an attempt by the client computer to connect to the network via the NAC server.
Edge vs access control − Edge control verifies that users or devices have the appropriate permissions to access resources. NAC verifies that users or devices not only have the appropriate permissions to access resources but also that the users or devices have the appropriate security controls in place to ensure that the NAC client will not cause the network to be breached.
Which mitigation technique provides less restricted access to a system?
A) Privileged user account
B) File integrity monitoring
C) DMZ
D) Role separation
A privileged user account is an account that has less restrictive access to a system. Examples of privileged user accounts include domain administrators, local administrators, and application accounts. Users with privileged accounts can include systems admins, management personnel, network administrators, and database administrators, among others.
What does File integrity monitoring help with?
File integrity monitoring helps to identify unauthorized changes to files. The monitoring process looks at such events as if or when a file was changed, who made the change, the nature of the change, and what can be done to restore the file to the pre-change state. File integrity monitoring does not provide access to systems, only to files.
What does role separation involve?
Role separation involves dividing server duties amongst two or more servers to reduce an attack profile. For example, if a server running the Active Directory, DNS, and DHCP roles went down, all those services would be unavailable. If, on the other hand, Server A hosted Active Directory, Server B hosted DNS, and Server C hosted DHCP, an attack that brought Server B down would not affect the other services. Role separation does not affect the levels of access granted to a system.
What is a DMZ?
A demilitarized zone (DMZ) provides mitigation by placing two firewalls in the network. Critical servers such as email servers and web servers are placed between the two firewalls. A DMZ imposes more restrictions to access, not fewer restrictions.
A demilitarized zone (DMZ) is an isolated subnet on a corporate network that contains resources that are commonly accessed by public users, such as Internet users. The DMZ is created to isolate those resources to ensure that other resources that should remain private are not compromised. A DMZ is usually implemented with the use of firewalls.
You have recently moved several servers that contain confidential information onto a DMZ. What is the most likely valid reason for doing this?
A) encryption of all confidential transaction
B) isolation of all confidential transactions
C) bandwidth improvement for all confidential information transactions
D) compliance with federal and state regulations
The most likely valid reason for moving servers that contain confidential information onto a demilitarized zone (DMZ) is compliance with federal and state regulations.
Placing the servers that contain confidential information onto a DMZ will not isolate all confidential transactions because all users on the other subnets will still need to access the confidential information.
Placing the servers that contain confidential information onto a DMZ will not encrypt all the confidential transactions. This would require that you employ data encryption while data is at rest and as it is transmitted.
Placing servers that contain confidential information onto a DMZ will not improve bandwidth for all confidential information transactions. As a matter of fact, because the servers will be isolated on a separate network, transactions with those assets may actually cause performance to degrade. Any transactions would need to cross the firewall into the DMZ, thereby slowing does the transaction speed.
