Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

0-CWO > 5 - Network Configuration > Flashcards

5 - Network Configuration Flashcards

1
Q

Network Analyst

A
  • Monitor, analyze, detect, and respond to events/incidents within infrastructure devices and netflow
  • ID security risk and develop mitigation plans
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Network Baseline

A

Defines what normal network conditions and traffic looks like

Can be used to test for abnormal conditions, rapidly deploy new networks, and ensure network is working as designed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Cyber Threat Intelligence (CTI)

A
  • Knowledge about adversaries and their motivations, intentions, and methods
  • Enables orgs to deploy measures to detect, mitigate, and possibly prevent attacks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Network Artifacts
– Definition
– Examples

A
  • Piece of network traffic data that may be relevant to an investigation
  • Helps develop network/host signatures
  • Examples:
    – Logs
    – Files/directories
    – Registry Keys
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Network Triage

A
  • Sorting network violations into groups based on:
    – Response to Outages
    – Level of Compromise (CAT levels)
    – Leverages Artifacts
    – Mission Critical Systems
  • Helps analyst/unit prioritize important systems
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Sandbox

A
  • Controlled environment used to test suspicious/malicious software without endangering entire network
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

IDS
– Definition
– Examples

A

Intrusion Detection System

  • Passively monitors network or systems for malicious activity/violations.
    May send alerts for detections but does NOT prevent them.
  • Does not affect existing systems/infrastructure
  • Examples:
    – Snort
    – Suricata
    – Wireshark
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

IPS
– Definition
– Examples

A

Intrusion Prevention System

  • Detects and blocks possible network intrusion.
    – Placed in-line with network traffic
  • Examples:
    – Snort
    – Suricata
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

SIEM

A

Security Info & Event Management

  • Group of technologies which aggregates relevant data from multiple sources to provide birds-eye view of a network and help identify deviations from the norm.
  • Examples:
    – ELK
    – Splunk
    – AlienVault
    – SolarWinds
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Network Source Data Types
– 3 Types

A
  • Full Packet Capture
  • NetFlow & Related Flow-Based Collections
  • Log Files
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Full-Packet Capture
– Definition
– File formats
– Benefits
– Drawbacks

A
  • File containing all original packet data as seen at collection point
  • Extension Formats:
    – *.pcap
    – *.pcapng
    – *.cap
    – *.dmp
  • Benefits
    – Holy Grail of network data collection
    – Facilitates deep analysis long after communication occurred
    – Variety of tools available to examine pcap files with different approaches
  • Drawbacks
    – Files can become extremely large
    – Limited availability due to legal constraints
    – Limited usefulness due to encryption
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

NetFlow
– Definition
– Benefits
– Drawbacks

A
  • Summary of network communication as seen at collection point
  • No content, just summary and metadata
  • Useful for quick triage
  • Benefits
    – Requires less storage
    – Faster analysis process
    – Fewer privacy concerns
    – Analysis process applies equally to all protocols
  • Drawbacks
    – Low level analysis may not be possible w/o content
    – Many collection platforms require training/licenses
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Log Files
– Definition
– Benefits
– Drawbacks

A
  • Application or platform-centric files describing activities handled or observed by the log creator
  • Benefits
    – Widely available
    – Processes often in place to analyze them
    – May be aggregated for centralized analysis
  • Drawbacks
    – Varying levels of detail and formats
    – Often requires additional data to corroborate findings
    – If not aggregated, can be time consuming to find and analyze
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Port Mirror (switch)
– Definition
– Benefits
– Drawbacks

A
  • “Software tap” that duplicates packets from one switch port to another
    – Sometimes called a SPAN (Switch Port Analyzer) port
  • Benefits
    – Simple to set up (quick config change, no downtime)
    – Switch presence maximizes flexibility of platform placement
  • Drawbacks
    – Only half-duplex, so may experience data loss with high-traffic networks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Router Netflow Export
– Definition
– Benefits
– Drawbacks

A
  • Export router netflow data for external analysis
  • Benefits
    – Only requires simple config change (little to no downtime)
    – NetFlow is already collected, only needs to be exported
  • Drawbacks
    – Generally does not provide ability to perform full-packet capture
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Layer 7 Devices (Network data collection)
– Definition
– Examples
– Benefits
– Drawbacks

A
  • Any platform with control of or purview over a network link
    – May provide any of the 3 types of Network Data, depending on the device
  • Examples:
    – Web proxies
    – Load balancers
    – DHCP & DNS Servers
  • Benefits
    – May offer many perspectives on the same incident
  • Drawbacks
    – Logs may come in varying formats and levels of detail
    – May require intensive parsing & analysis
    – Platforms often scattered across enterprise
    – Requires solid aggregation plan/platform
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Tap
– Definition
– Benefits
– Drawbacks

A
  • Hardware device which duplicates data streams and may send them to a capture/observation platform
  • “Aggregating” tap merges both directions of traffic
  • “Regenerating” tap duplicates data streams and sends to multiple physical ports
  • Benefits
    – Specifically designed for network traffic capture
    – Engineered for performance and reliability
    – Most taps fail open during power loss
  • Drawbacks
    – Expensive
    – Downtime during installation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Network-Based Processing Workflows
– List 6

A
  • Establish Baselines
  • Ingest and Distill
  • Reduce and Filter
  • Analyze and Explore
  • Extract Indicators and Objects
  • Scope and Scale
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Establish Baselines
– Goal
– Details

A
  • Establish normal pattern of behaviour to help ID abnormal patterns.
  • Established before, during, and after a mission
  • Determines cycles based on time and date
  • Determine typical cycles of traffic
    – Top-talking hosts
    – Ports/protocols
    – GET vs POST ratios
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Ingest and Distill
– Goal
– Details

A
  • Prepare for analysis and derive data that will more easily facilitate the rest of the analytic workflow
  • Log source Data
  • Distill pcap files to other data types
  • Split data into time-based chunks
  • Load data into analytic platforms
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Reduce & Filter
– Goal
– Details

A
  • Reduce volume of input data
  • Use known indicators and data points to reduce data volume
    – IP addresses
    – Ports/protocols
    – Time frames
    – Volume calculations
    – Domain names
    – Hostnames
  • Build filters to reduce visible data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Analyze and Explore
– Goal
– Details

A
  • ID traffic/artifacts that support investigative goals/hypotheses
  • Analyze reduced data for suspicious traffic
    – Content
    – Context
    – Anomalies
    – Consistencies
  • Look for protocol anomalies
  • Compare to baseline to ID deviations
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Extract Indicators & Objects
– Goal
– Details

A
  • Find artifacts that help ID malicious activity
  • Look for:
    – field values
    – byte sequences
    – files
    – other objects
  • Maintain artifact collection
  • Includes obs about network traffic itself or nature of communications
  • Extract artifacts
  • Protect/share data IAW policies and security constraints
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Scope & Scale
– Goal
– Details

A
  • Search more broadly within source data for behaviour that matches known indicators
  • Scale up search w/ large-scale platforms/tools
  • ID additional suspicious endpoints
  • Pass indicators to security ops
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Wireshark

A

Deep, protocol-aware packet exploration and analysis tool

Can extract over 140,000 data fields

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

TCPDump

A

Log or parse network traffic, similar to wireshark

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Bro NSM

A

Creates log files to document observed network traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Snort/Suricata

A

Performs real-time traffic analysis and packet logging on IP networks

May work as an IDS or an IPS

Can detect variety of attacks/probes using sigantures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

NetworkMiner

A

Protocol-aware object extraction tool that writes files to a disk

May trigger host defenses when writing files to disk

Network data fields can be exported to CSV

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Cisco Hierarchical Network Design
– 3 Layers

A

Access (lowest)
Distribution (middle)
Core (Highest)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Core Layer (Cisco Hierarchical Network Design)

A
  • Aggregates distribution switches in large LANs
  • Provides high forwarding rates
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Distribution Layer (Cisco Hierarchical Network Design)

A
  • Aggregation point for access switches
  • Does not connect directly to end-user devices
  • Provides redundancy and interconnectivity
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Access Layer (Cisco Hierarchical Network Design)

A
  • Connection point for end user devices
  • Does not typically connect to other access switches
  • Controls access to intranet resources
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

OS used by switches

A

Internetwork Operationg System (IOS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

3 Ways to access switch CLI

A
  • Console - physical port
  • Telnet - IP network
  • SSH - IP network
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Four types of switch memory

A
  • ROM
  • Flash
  • NVRAM
  • RAM
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Location of startup-config

A

NVRAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Location of Running-config

A

RAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

VLAN
- Advantages
- equals…

A
  • Advantages
    – Segmentation
    – Flexibility
    – Security
  • Equals…
    – Broadcast Domain
    – Subnet
    – Logical Network
    – LAN
  • By nature, they inhibit communication between VLANs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

802.1Q
– What is it
– Tagging method
– # VLANs supported
– Spanning Tree
– Multi-vendor support
– Native VLAN

A
  • VLAN Trunking protocol
  • Handles frame tagging (inserts 4 bytes into OG frame, modifies FCS)
  • Supports 4096 VLANs (4094 in practice)
  • Mono Spanning Tree
  • IEEE Open Standard
  • Uses native VLAN
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

ISL
– What is it
– Tagging method
– # VLANs supported
– Spanning Tree
– Multi-vendor support
– Native VLAN

A
  • Inter-switch link; alternative to 802.1Q
  • Adds 26 byte header and 4 byte trailer to tag VLANs
  • Supports 1000 VLANs
  • Uses Per VLAN Spanning Tree
  • Cisco Proprietary
  • Does not use native VLAN
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

DTP

A
  • Dynamic Trunk Protocol
  • Handles negotiation of trunk links
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Trunk Modes

A
  • Trunk - Permanent trunk mode
  • Access - Permanent non-trunk mode
  • Dynamic Desirable - Port actively tries to convert link to trunk link
    – Becomes a trunk if neighbor is set to trunk, desirable, or auto
  • Dynamic Auto - Port is willing to convert to trunk link
    – Becomes trunk if neighbor port is set to desirable
  • NoNegotiate - Permanent trunk mode, prevents port from generating DTP frames
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

EtherChannel

A
  • Allows parallel links (up to 8 ports) to function as one single link
  • Increases bandwidth
  • Reduces convergence and provides redundancy
45
Q

VTP
– Features
– Modes (do they configure, vlan range, do they forward, do they sync)
– Items required to forward updates

A
  • Features
    – Advertises VLAN config info (trunk ports only)
    – Maintains VLAN config throughout domain
  • Modes
    – Server - Configure VLANs 1-1005; Originates, forwards, and syncs updates
    – Client - Supports but does not configure VLANs 1-1005; forwards and syncs updates
    – Transparent - Configures VLANs 1-4094; forwards updates
  • Matching VTP Domain name and password
46
Q

Difference between VTP v1, v2, and v3

A
  • Only v3 can be in “Off” mode
  • v1 does not support Token Ring or Unrecognized TLVs
  • v2 and v3 do not check VTP version before forwarding updates in transparent mode
  • v1 does not support consistency checks
  • v3 supports extended VLAN range
  • v3 supports private VLANs
  • v3 supports database propagation
  • v3 encrypts password
47
Q

VTP operation
– General operation info
– Requirements to function
– VLAN config storage

A
  • General:
    – Advertisements sent as multicast frames every 5 min, or if there is a change
    – servers/clients sync to latest revision num
  • Function Requirements:
    – Links set up with ISL or 802.1Q
    – VTP domain name and password (if set) match
  • Config Storage
    – vlan.dat in flash memory
48
Q

Spanning Tree Protocol
– Purpose
– Features/Enhancements

A
  • Prevents loops and provides path redundancy
  • Prevents broadcast storms
  • Stabilizes MAC table
  • Eliminates multiple frame transmission
  • Portfast
    – Minimizes wait time
  • BPDU Guard
    – Enabled by default
    – Prevents switch operation on specified port (access mode or unused/disabled ports)
    – Port goes into err-disabled mode when BPDUs detected
  • Root Guard
    – Enables BPDUs on specified port
    – Ignores superior BPDU messages (prevents rogue switch taking over as root bridge)
49
Q

BPDU (Spanning Tree Protocol)
– What is it
– Types
– Contains
– Default Priority

A
  • Bridge Protocol Data Unit
  • 3 Types
    – Config BPDU
    – Topology Change Notification (TCN)
    – Topology Change Acknowledgement (TCA)
  • Contains Bridge ID
    – Unique ID
    – Bridge Priority (2 bytes) and Bridge MAC (6 Bytes)
    – Default priority is 32768
    – Root bridge has lowest priority num
    – If priority is the same, lowest MAC wins
50
Q

Spanning Tree Protocol States
– 5 states

A
  • Blocking
  • Listening (15 sec)
    – Topology change detected
    – Does not forward frames
    – Inactive MACs removed from CAM table
  • Learning (15 sec)
    – Does not forward frames
    – Switch adds new MACs to CAM table
  • Forwarding
  • Disabled (off)
51
Q

Spanning Tree Protocol Versions

A
  • IEEE 802.1D
    – 1 instance for all VLANs
    – Slow (up to 50 sec) convergence
  • Per VLAN ST (PVST)
    – 1 instance per VLAN
    – Supports ISL; PVST+ supports 802.1Q
    – Cisco Proprietary
  • IEEE 802.1w (Rapid STP)
    – Faster (<10 sec) convergence
    – 1 instance for all VLANs
  • Per VLAN RST
    – 1 RSTP Instance per VLAN
  • IEEE 802.1s
    – Multiple Spanning Tree Protocol
    – Inspired by CISCO’s MISTP
    – Multiple VLANs mapped to single instance of ST
52
Q

Spanning Tree protocol
– How it works

A
  • Elect root bridge (one per network)
    – All interfaces forwarding
    – All ports are designated ports
  • Elect root port (one per device) for non-root bridge
    – Lowest cost back to root bridge
  • Elect designated port for each network segment
    – Lowest cost back to root bridge
  • Cost determined by bandwidth
  • STP recalculates after MAXAGE timer expires
53
Q

Rapid Spanning Tree Protocol
– State Differences
– MaxAge Difference
– Convergence Info
– Additional Port Definitions

A
  • Only has Discarding, Learning, and Forwarding states
  • MaxAge is 6 sec vs 20 in STP
  • Listening state removed, learning state time reduced
  • Convergence < 10 sec
    – All switches generate/send Hello BPDUs
    – States no longer based on timers
    – Portfast now referred to as Edge Ports
  • Designates an Alternate Port
    – Primary alternate for a root port
  • Designates a Backup Port
    – Backup for an Alternate Port
54
Q

Sub-interface

A
  • Router equivalent of SVI
  • Single interface may be divided into multiple sub interfaces to carry traffic for multiple VLANs
55
Q

Inter-VLAN routing

A
  • Must define a default gateway
56
Q

DHCP Relay

A
  • IP Helper-address
  • Client server application to forward broadcast requests
    – Converts broadcast into unicast to DHCP server
  • Allows DHCP requests to leave the LAN subnet (VLAN)
57
Q

Router on a stick

A
  • Single router w/ one interface
  • Performs ISL/802.1Q trunking paired w/ sub interfaces to route VLAN traffic
58
Q

SVI (Switch Virtual Interface)

A
  • Layer 3 presence of a VLAN
  • Virtual port, only existing in switch software
  • Allows inter-VLAN routing
  • Layer 2 VLAN must exist for this to function
59
Q

HSRP (Hot Standby Routing Protocol)

A
  • Designed to support failover of IP traffic
  • Multiple routers (standby/HSRP group) appear as a single virtual router for hosts on the LAN
    – One router at a time is selected as the active router. Only the active router forwards packets
    – Active router is the one with highest HSRP priority
    – A backup for the active router is selected as the standby router
  • Preempt enables a router to resume the active role
  • Hold timer should be at least 3 times hello timer
60
Q

Port security

A
  • Limits MAC address on switch ports
    – NOT used on dynamic ports
  • Can either be static (manually specified MACs) or dynamic (limit # of hosts per port)
  • Static MACs saved to running-config
  • Dynamic MACs not saved in running-config
    – Enabling Sticky allows dynamic MACs to be stored in running-config, essentially making them static
61
Q

Switchport Security Violations
- 3 types

A
  • Protected
    – Known MACs may continue sending traffic
    – No notification
  • Restricted
    – Known MACs may continue sending traffic
    – Notification (SNMP) sent and violation counter incremented
  • Shutdown
    – Default mode
    – Notification sent
    – Interface switched to err-disabled state
62
Q

SSH

A
  • Uses up to 2048-bit ciphers and RSA encryption
63
Q

AAA
– What is it
– Radius vs TACACS+

A
  • Authentication, Authorization, and Accounting
  • Radius
    – UDP
    – Encrypts only PW
    – Open source, less granular authorization control
  • TACACS+
    – TCP port 49
    – Encrypts full payload of each packet
    – Cisco proprietary, very granular authorization control
64
Q

Routed Port

A
  • Switch port using the no switchport command
  • Acts like a port on a normal router
65
Q

Routing Requirements

A
  • Know destination address
  • ID sources to learn from
  • Discover possible routes
  • Select best route
  • Maintain/verify routing info
66
Q

Types of routing

A
  • Static
    – Static route
    – Static default route
  • Dynamic
    – OSPF
    – EIGRP
67
Q

Static Routing

A
  • Manually configured
  • Simplest form on small networks but complicated and not feasible in large
  • Classful and Classless
  • Hub and Spoke design
  • Must configure routes for both directions
  • Static Default route uses gateway of last resort
    – Any traffic that doesn’t match another defined route gets sent to gateway of last resort
68
Q

Dynamic Routing
– General Info
– Advantages
– Disadvantages

A
  • Routing information exchanged between routers
  • Can load balance between multiple paths with equal/unequal costs
  • Advantages
    – Suitable for any topology using multiple routers
    – Independent of network size
    – Automatically adapts to reroute traffic (if possible)
  • Disadvantages
    – Can be complex to set up
    – Less secure due to broadcast and multicast updates
    – Route depends on current topology
    – Requires additional resources (CPU, memory, bandwidth)
69
Q

Routing protocol Classifications
– classified based on purpose (2), operation (3), or behaviour (2)

A
  • Purpose
    – Interior Gateway Protocol (IGP) - Routing within an autonomous system (AS) (intra-AS routing)
    – Exterior Gateway Protocol (EGP) - Routing between Autonomous systems (AS) (inter-AS routing)
  • Operations
    – Distance Vector - Routes advertised by providing distance and vector
    – Link-state - Each node in network constructs a connectivity map, then independently calculates the best paths. Good for large hierarchical networks needing fast convergence
    – Path-vector - Essentially distance vector protocol that analyzes the path itself to guarantee loop-free path
  • Behaviour
    – Classful (legacy) - Do not send subnet mask info in routing updates. Create problems in discontiguous networks
    – Classless - Include subnet mask info in routing updates. Support VLSM and CIDR
70
Q

IPv4 Routing Protocols
- 7 protocols

A
  • RIPv1: IGP, Distance Vector, Classful
  • IGRP: IGP, Distance Vector, Classful, Cisco-developed
  • RIPv2: IGP, Distance Vector, Classless
  • EIGRP: IGP, Distance Vector, Classless, Cisco-developed (can also be classful)
  • OSPF: IGP, Link-state, Classless
  • IS-IS: IGP, Link-state, Classless
  • BGP: EGP, Path-vector, Classless
71
Q

Autonomous System

A

Collection of routers under a common administration such as company or organization

72
Q

Discontiguous Network

A

Network in which subnets from the same classful major network address are separated by a different classful network address

73
Q

Administrative Distance

A
  • Used by routers to select the best path when multiple routes exist from different routing protocols
  • Defines reliability of a protocol
  • Some default values:
    – Connected interface - 0
    – Static route - 1
    – EIGRP summary route - 5
    – BGP - 20
    – Internal EIGRP - 90
    – OSPF - 110
    – Unknown - 255
74
Q

Distance Vector Routing Protocols

A
  • Routing updates shared between neighbors
  • Router is aware of networks on its own interfaces and those that can be reached through neighbors
  • Some protocols send periodic updates
    – RIP sends updates to 255.255.255.255 (v1) or multicast 224.0.0.9 (v2) every 30 seconds
75
Q

Routing Information Protocol (RIP)
– Metric info
– Timers

A
  • Distance Metric: Hop Count
    – Max allowed is 15
    – 16 is infinity metric (host unreachable)
  • Susceptible to loops and the “count to infinity” problem
  • Timers, since last update
    – 240 sec Flush
    – 180 Sec Invalid
    – 180 sec Hold down (starts after invalid timer ends)
76
Q

Split Horizon

A
  • Method of preventing routing loops
  • Routing info for a given packet is never sent back in the direction from which it was received
77
Q

OSPF
– algorithm
– states (8)
– method of sharing routes

A
  • Utilizes shortest path first (SPF) algorithm
  • States:
    – Down
    – Init
    – 2-way
    – DR Election
    – ExStart
    – Exchange
    – Loading
    – Full
  • Propagates LSAs rather than routing table updates
  • LSAs flooded to all OSPF routers in the area
78
Q

EIGRP
– details
– metric
– path determination

A
  • Rapid convergence
  • Reduced bandwidth
  • Uses “5 Ks” to calculate Metric (distance)
    – K1: Bandwidth
    – K2: Load
    – K3: Delay
    – K4/K5: Reliability
  • Feasibility condition (feasible/calculated distance > reported/advertised distance) is used to detect paths with loops
  • Successor is route with lowest metric that meets feasibility condition
  • Feasible successor is a secondary route that also meets feasibility condition
  • Use auto-summary to summarize subnets into classful addresses
79
Q

Access Control List
– Types (3)
– Number Ranges
– Details

A

Types

  • Standard
    – Checks source address
    – Permits/denies all protocols
    – Number range 1-99, 1300-1999
  • Extended
    – Checks both source and destination
    – Permits/denies specific protocols
    – Can also specify conditions for specific ports
    – Number Range 100-199, 2000-2699
  • Named
    – Can be standard or extended, just uses name instead of number to identify
  • Uses wildcard mask for filtering subnets
  • Most restrictive statements should go at top of ACL
80
Q

Domino Effect

A
  • If a network layer is compromised, all network layers above it are also compromised
    – Ex: if data link layer is compromised, the network, transport, and application layers are also compromised
81
Q

CAM Overflow
– What is it
– Mitigation

A
  • Attacker floods CAM table with thousands of MAC addresses, causing it to fill up. When this happens, the switch starts to flood any traffic from new hosts out all ports
  • Essentially turns a switch into a hub
  • May be mitigated with port security or MAC address monitoring
82
Q

ARP Spoofing
– what is it
– mitigation

A
  • Attacker pretends to be default gateway and sends out a gratuitous ARP, so all users send traffic through the attacker instead of the real default gateway
  • Only works within one VLAN
  • May be mitigated with:
    – Static ARP table on critical stations
    – ARP ACL
    – Private VLANs
83
Q

VLAN Hopping

A

Can occur in two ways:

  • Switch Spoofing - Attacker configures device to work as trunk port. Switch will then trunk all available VLANs to that device
    – Mitigated by switching port to access mode, or setting nonegotiate
  • Double tagging - Second 802.1q tag is added in front of the first
    – Only works with native VLANs
84
Q

IPSEC
– what’s it used for
– what does it provide

A
  • Security protocol used with VPNs
  • Operates at layer 3
  • Provides:
    – Confidentiality
    – Integrity
    – Authentication
    – Anti-replay
85
Q

IPSEC Stages

A
  • Interesting Traffic initiates IPSEC process
  • IKE Phase 1
    – IKE Authenticates Peers
    – Negotiates security association (SA) policy
    – Perform authenticated Diffie-Hellman exchange
    – Establishes secure channel
    – Two modes, Main and Aggressive
  • IKE Phase 2
    – Negotiates IPSEC SA parameters
    – SAs periodically renegotiated for security
    – Performs DH exchange if perfect forward secrecy is desired
    – Security protocol is selected (Authentication Header or Encapsulation Security Payload)
  • Data Transfer - Data transferred between IPSEC peers
  • IPSEC Tunnel Termination - IPSEC SAs terminate through deletion or timeout
86
Q

IP Payload Compression Protocol (IPComp)

A

Reduces amount of data sent in IPSEC

87
Q

IPSEC “Interesting Traffic”

A
  • Determined as part of security policy
  • Access lists used to determine interesting traffic in Cisco routers and PIX firewalls
88
Q

Items shared in IPSEC IKE Phase 1

A
  • Encryption algorithms (DES, 3DES, AES)
  • Authentication Algorithms (MD5, SHA)
  • Diffie-Hellman Group
  • Preshared key or RSA/DSA certs
89
Q

Authentication Header (AH) Protocol

A
  • Allows verification of authenticity and integrity of content as well as origin of packet
    – Only does source authentication and content integrity
90
Q

Encapsulating Security Payload (ESP)

A
  • Encrypts entire IP packet allows for authenticating its content
  • Ensures privacy (encryption), source authentication, and content integrity (authentication)
91
Q

IPSEC Modes
- two modes

A
  • Tunnel - Encrypts both payload and header and appends new header
  • Transport - Encrypts only payload and leaves header unencrypted
92
Q

NAT IP Address names

A
  • Inside Local - Local network, private IP
  • Inside Global - Local Network, public IP
  • Outside Global - Other network, public IP
  • Outside Local - Other network, private IP
93
Q

NAT Types

A
  • Static NAT
    – One to One mapping of private IP to public IP
    – Useful when device needs to be accessible from the internet
  • Dynamic NAT
    – Mapping of private IP address to a public IP from a group of public IPs (NAT pool)
  • PAT (overloaded NAT)
    – Map multiple private IP addresses to single public IP (most common today)
94
Q

Major Wireless Topologies

A
  • WPAN (personal area network)
    – 802.15.1 (bluetooth)
    – 20-30 ft
  • WLAN
    – 802.11 (wifi)
    – up to 300 ft
  • WMAN (metropolitan area network)
    – 802.16 (wi-max)
    – up to 30 miles
  • WWAN (wide area network)
    – Mobile networks (CDMA/LET)
    – Worldwide coverage
95
Q

WLAN components

A
  • Access Point
    – RF Transceiver
    – Processor/software
    – Antennas
  • User device w/ NIC
  • Router
  • Repeater (optional)
96
Q

WLAN operating modes
– 2 modes

A
  • Infrastructure Mode
    – Clients communicate through access point
  • Ad hoc mode
    – Clients communicate directly with one another (peer to peer)
97
Q

Infrastructure Access Point Modes
– 4 modes

A
  • Root
    – Default mode
    – Each AP wired into LAN
  • Bridge
    – AP connects two or more physically separate network segments
    – Multi-point or point to point
    – Only one root bridge, all non-root bridges must pass traffic through root
  • Repeater
    – Re-broadcasts data to extend range of network
  • Scanner
    – Scans nearby wireless signals
    – Used for wireless IDS, Troubleshooting, and wi-fi setup
98
Q

802.11 Network Architecture
– 3 Types

A
  • Basic Service Set (BSS)
    – One AP, one or more clients
    – Most common
    – Uses BSSID – 48 bits, MAC of BSS AP
    – Network advertised with SSID
  • Extended Service Set (ESS)
    – Connects two or more BSS together
    – Uses common SSID to allow roaming between APs (ESSID)
  • Independent Basic Service Set (IBSS)
    – Ad hoc or peer-to-peer mode
    – No AP, only clients
    – Not an infrastructure mode
    – Only one client may transmit at a time, and all must be on same frequency
99
Q

Wireless Residential Devices

A
  • AP and router (one device)
  • Cable modem/DSL (may be included in AP)
  • Easy to configure
  • Commonly referred to as SOHO devices
100
Q

Beacon Frame

A

Information sent by WAPs containing SSID, data rates, etc)

101
Q

Probes (802.11 term)

A
  • Client looking for SSID
  • Directed probe requests will always trigger a response including properly configured SSID, making disabling SSID broadcast very weak security
102
Q

Hidden Node Problem

A

If two nodes A and B are physically blocked from one another’s radiation patterns, and both start transmitting to node C simultaneously, their signals will collide and they will be unable to detect the collision and the transmitted signals will become corrupted

103
Q

MAC filtering (Wireless security)

A

Can easily be bypassed with MAC spoofing

104
Q

WEP

A
  • Wired Equivalent Privacy
  • Encrypts all data in the frame including headers
  • Very weak
  • Uses RC4 encryption
  • Does not protect against forgery or replay attacks
105
Q

WPA1

A
  • Replaced WEP
  • Utilizes TKIP (Temporal Key Integrity Protocol)
    – Based on RC4
    – Each packet has unique encryption key
    – Includes Message Integrity Check and Rekeying mEchanism
    – Considered obsolete
106
Q

WPA2

A
  • Replaced WPA1
  • Uses Cipher Block Chaining Message Authentication Code Mode Protocol (CCMP)
    – Uses AES encryption
  • Supports TKIP for backwards compatibility
  • 802.11i
  • Two types
    – Personal - Pre shared key, SOHO use
    – Enterprise - Authentication server, for enterprise use; 802.1X standard
107
Q

WAP3

A
  • Released Jan 2018
  • Individual devices will not share encryption key w/ other devices
  • Up to 192 bit encryption if needed
  • Setup mode for IOT and no screen devices
  • Must be connected to de-authenticate
108
Q

SSL VPN

A
  • Does not require installation and config of client software (unlike IPSEC VPN)
  • User connects to SSL VPN via web browser
  • SSL VPN server is encrypted with SSL or TLS
109
Q

Collapsed Core network model

A

First two layers of Cisco Hierarchy (Access and distribution)

Used for smaller networks not requiring the core to be a separate level

0-CWO (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions