Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cybersecurity Bootcamp Study Aid > 8.3 Following Data Through Layers 2, 3, and 4 > Flashcards

8.3 Following Data Through Layers 2, 3, and 4 Flashcards

1
Q

Both hackers and security pros will use the method of __________ to gather data from a specific network in order to gain access to that network.

A

Both hackers and security pros will use the method of footprinting to gather data from a specific network in order to gain access to that network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Footprinting can yield what information:

A

Physical addresses of devices within a network.

The IPs and ports that are being used or are accessible.

Network and network security devices being used.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Data is routed via switches to a physical machine address, known as a ____________________

A

Data is routed via switches to a physical machine address, known as a Media Access Control (MAC) address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

A sequence of numbers such as 00:0c:29:0f:71:a3 that identifies the destination computer’s unique hardware number.
is called what?

A

Media Access Control (MAC) address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A sequence of numbers such as 00:0c:29:0f:71:a3 that identifies the destination computer’s unique hardware number.
is called what?

A

Media Access Control (MAC) address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

To ensure data gets from LAN to machine, the ____________ maps the ___________ to an ____________ within the LAN.

A

The Address Resolution Protocol (ARP) maps the MAC address to an IP address within the LAN.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Entries added to the ARP cache are called ___________, meaning they can be changed with future ARP replies.

A

Entries added to the ARP cache are called dynamic ARP entries, meaning they can be changed with future ARP replies.

Dynamic ARP entries will only stay in the ARP cache for a limited period of time known as the ARP cache timeout.

When the ARP cache timeout expires, the record is removed from the ARP cache and any future requests for the host require a new ARP request.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

ARC Spoofing

True or False

The hacker can send a spoof ARP message to the LAN, directing all traffic intended for the good host to the hacker’s MAC address.

A

True

After the attacker sends the spoof ARP message, all traffic originally destined for the good host is intercepted by the hacker’s device with the malicious MAC address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

True or False

Wireshark can detect and alert multiple MAC addresses associated with a single IP address, but it will not take any action on its own.

A

True

Instead, to counter ARP spoofing, a network administrator can create static ARP entries.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Static ARP Entries

True or False

Static ARP entries create permanent IP-to-MAC-address mappings in the ARP cache.

A

True

Unlike the dynamic ARP entries, these cannot be changed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

When footprinting, it’s important to check if an external host is _____________.

A

When footprinting, it’s important to check if an external host is operating and accepting connections.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What does ping stand for and what is it?

A

ping (Packet Inter-Network Groper) is a utility used to determine if a host is operating and accepting requests.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

When we ping a host, it sends an _____________ echo request to a specific IP address and waits on a reply.

A

When we ping a host, it sends an Internet Control Message Protocol (ICMP) echo request to a specific IP address and waits on a reply.

ICMP is a protocol that network devices use to send error messages and operational information about whether a requested service or host can be reached.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What switch do use with ping to limit the results?

A

-c

Ex.

ping -c pepsi.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What does this command do?

fping -s -g 107.191.96.26 107.191.96.32

A

Using fping will ping a range of IPs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is traceroute?

A

Traceroute is a network diagnostic tool used to track in real-time the pathway taken by a packet on an IP network from source to destination, reporting the IP addresses of all the routers it pinged in between. Traceroute also records the time taken for each hop the packet makes during its route to the destination.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

True or False

When data travels from a source to a destination, it typically follows a straight path.

A

When data travels from a source to a destination, it typically doesn’t follow a straight path.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Redirection of data transmissions are called ________.

A

Redirection of data transmissions are called hops.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

True or False

Optimal routing paths are determined based on the “shortest path,” which is influenced by network topology.

A

True

20
Q

Network administrators can use a command-line tool like _________ to troubleshoot networking communication issues between two devices and determine where the issues are in the hops.

A

Network administrators can use a command-line tool like traceroute to troubleshoot networking communication issues between two devices and determine where the issues are in the hops.

21
Q

True or False

traceroute shows the route taken between two systems across a network.

A

True

22
Q

In addition to troubleshooting connectivity issues, traceroute can be used to:

A

Display how systems are connected, or map the network.

Generate baseline profiles of the network.

Diagnose poor network performance issues.

23
Q

ICMP and Time to Live (TTL)

Like ping, _________ also utilizes the ICMP protocol. It also shows the time taken to travel across each of these hops, from source to destination.

A

traceroute

24
Q

The ICMP header contains a field called __________

A

The ICMP header contains a field called Time to Live (TTL)

TTL is an indicator of how long a data packet can exist in a network. TTL is utilized as a decrementing hop counter. Every router that forwards the packet decrements
(reduces) the TTL value by one.

25
Q

If the starting TTL value of a data packet is five, and the data travels across two routers, the TTL will drop to ______.

A

Three

When the TTL count reaches zero, it sends a “time exceeded” error message back to the source address.

This prevents data from being stuck in an infinite loop if it’s unable to be delivered to the destination.

26
Q

What the difference in syntax between Windows and Mac

A

Mac = traceroute

Windows = tracert

27
Q

What is the most widely used protocals?

A

TCP (Transmission Control Protocol) is one of the most widely used protocols for data transmission.

28
Q

TCO is a ______________ protocol, meaning the server must acknowledge it has received the request from the client.

A

It is a “connection-oriented” protocol, meaning the server must acknowledge it has received the request from the client.

29
Q

True or False

With TCP, if the recipient doesn’t acknowledge the request, the sender assumes the request has not been received and will attempt to resend.

A

True

30
Q

In TCP, the connection-oriented acknowledgment is known as the __________.

A

In TCP, the connection-oriented acknowledgment is known as the TCP Handshake.

31
Q

True or False

TCP is used with familiar protocols such as HTTP, HTTPS, FTP, SSH, and SMTP.

A

True

TCP also ensures that all data is transmitted without errors, in the correct order.

32
Q

What is a TCP three-way handshake?

A

The TCP three-way handshake is the process that lets both sides know data has been transmitted completely.

33
Q

What is the Three-Way Handshake: Step by Step?

A
  1. SYN (synchronize): From client to server. Client sends a SYN data packet to the server to determine if it is ready to open a connection.
  2. SYN/ACK (synchronize/acknowledge): From server to client. The server acknowledges or confirms receipt of the SYN packet.
  3. ACK (acknowledge): From client to server. Client confirms receipt of the SYN/ACK packet.
  4. Once the handshake is successfully completed, the data transmission can begin.
34
Q

Four-Way-Termination: Step by Step

A
  1. FIN (finish): From client to server. The client sends a FIN data packet to the server to close the connection.
  2. ACK: From server to client. The server acknowledges receipt of the FIN packet.
  3. FIN: From server to client. After the server terminates the connection, it sends a FIN packet.
  4. ACK: From client to server. The client acknowledges it has received the server’s FIN packet. The TCP termination process is complete.
35
Q

What are the TCP downsides?

A

Retransmissions (when the server resends packets because the client does not acknowledge receipt) and the ordering of packets can cause delays during data transmissions.

In cases when every single packet of data does not need to be transmitted, TCP is not used. For example, streaming live video.

36
Q

What situations where it’s not necessary for all data to reach the destination?

A

Sreaming

In cases when every single packet of data does not need to be transmitted, TCP is not used. For example, streaming live video.

37
Q

For situations when it’s not necessary for all data to reach the destination, there is the User Datagram Protocol (UDP)

A

UDP is better for reducing latency versus transmitting all data.

UDP is a connectionless protocol—it doesn’t require a handshake to
transmit data.

UDP simply sends off the packets. Its attitude is: “If all the packets are received, great. If not, that’s okay too.”

38
Q

True or False

The order of the setup for three-way hanshake is SYN-ACK, ACK, SYN

A

Setup: SYN, SYN-ACK, ACK

39
Q

What’s the termination setp for a three-way handshake?

A

Termination: FIN, ACK, FIN, ACK

40
Q

We can check for open ports on a network by sending a SYN request to every port on that network. If we receive a SYN/ACK response, we know the port is __________.

A

We can check for open ports on a network by sending a SYN request to every port on that network. If we receive a SYN/ACK response, we know the port is open.

41
Q

True or False

The purpose of the SYN Scan is to determine the states of the ports on a network.

A

True

42
Q

What are the threee main port states?

A

Open, closed and filtered

Open means the port is accepting connections.

Closed means it is not accepting connections.

Filtered means it may be open, but a firewall or another
network device is likely blocking it.

43
Q

After doing a SYN scan, a total of 5 packets tells you what?

A

The port is open

44
Q

After doing a SYN scan, a total of 2 packets tells you what?

A

Closed

45
Q

After doing a SYN scan, seeing 1 packet tells you what?

A

Filtered

Cybersecurity Bootcamp Study Aid (55 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions