Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

ForeScout for Jay > AA - General Review FSA Topics > Flashcards

AA - General Review FSA Topics Flashcards

Policy, sub rules. bit of NAC, Groups, Conditions

1
Q

Centralized Deployment

A

Single site architecture - remote sites managed via centralized appliances - Deployed as Layer 3>> No span traffic to remote site Issues: Bandwidth concerns - number of managed switches at remote sites - Microsoft vulnerability compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Hybrid Deployment

A

Sites with appliances and sites without appliances Crucial or strategic sites have appliances - Smaller less critical sites, no appliance> but bandwidth concerns

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Distributed Deployment

A
  • Overall best solution
  • Multiple Site appliances
  • One to one mapping of site to appliance
  • Enhanced IPS and HTTP redirect actions
  • utilizes layer 2 (this layer can do threat protection)
  • Less bandwidth
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Location of Appliances

A

SPAN = Better visibility!

  • Place where most valuable traffic can be monitored:

>Internet Access Points (IAP) - Required for consistent HTTP notifications

> Auth and DHCP Traffic - used to clarify unmanageable/unknown endpoints based on activity

> core switches/datacenterd/sesitive zones

  • Traffic that should not be monitored

> BAckup Networks (if segregated)

> Encrypted traffic (tunnels)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Channel Configuration

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

High Availability - Single Switch

A

You need visibility into both switches !!!!!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

High Availability - Redundant Switch Connectivity

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Quiz - FSA Refresh

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Initial Discovery

A
  • Packet Engine parses and analyzes mirrored data

> Builds a real-time contextual database - host profile

> MAC address/IP address

> Default discovery policy (Options>Discovery) defines the rules that instruct the appliance on properties to collect even before policy is enables

  • Also uses NMAP, DNS and DHCP for additional host properties
  • Policies then use the hostp profile information to

> determine device type - what is it

> Whose is it? - Is it a corporate device or guest? BYOD?

> Is it safe to be on the internal network

> control access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Policy Irresolvable

A

Irresolvable: Means host does not meet conditions. Question cannot answer.

Irresolvable: This is our bitbucket for devices that we could not identify clearly. So we can take time workin through them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Policy Folders

A
  1. See
  2. 1 Discover
  3. 2 Classify
  4. 3 Asses
  5. 0 Control
  6. 0 Orchestrate
  7. 0 Informational
  8. 0 Policy Rollout Testing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Policy Flow - Groups

A

Ignored IPs: Devices will be still discovered but thei are not going through a policy evalauation

Passive- Learning: Not actively scanning nmap or credentialed scan

Tenable Scanner:In CounterACT you have to do Threat Protection Exemption!!! It’s the first thing that we did as the first thing in the FSCA class. >> Add it to Legitimate Scan. Counteract creates kind or a reactive honeypot. This is why it creates the ghost devices for Maybe the way switches are queried or admission events for go

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Discover Policy

  • Questions
  • Conditions
A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Classify Policy

A

This is where we can look at network devices and printers. What community strings are they using.

Or we break down mobile devices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Assessment Policy

A

Think about the logic process. If you already have an answer from the first rule do not ask the question again.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Control Policy

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Quiz 2 - FSA Review

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Quiz 3 - FSA REview

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

NAC - Connection LIfecycle and Access Control Enforcement

A

ForeSCout NAC:

Instead of (just) 802.1x ForeScout uses: MAR – MAC … Repository. Is more dynamic in nature

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

NAC Pre-Connect Connection LifeCycle Flow

A

Both the Pre and Post Connect Paradigms are valid approaches to network access control.

> Depending on which is chosen, the specific policy configuration will vary

> Restrictive Control actions will be taken at different point in the policy set

The NAC paradigm should be decided upon prior to policy creation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Post-Connect Connection Lifecycle Flow

A

Both the Pre and Post Connect Paradigms are valid approaches to network access control.

> Depending on which is chosen, the specific policy configuration will vary

> Restrictive Control actions will be taken at different point in the policy set

The NAC paradigm should be decided upon prior to policy creation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

802.1x : One Flavor or Pre-Connect

A

Instead of RADIUS server in 802.1x Forescout uses Active Directory for Authentication, done by user directory plugin. Thus you do not need to set up a new RADIUS server

23
Q

NAC Paradigm Implications

A

Both the Pre and Post connect paradigms are valid approaches to network access control

> Depending on which is chosen the specific policy configuration will vary

> Restrictive Control actions will be take at different points in the policy set

! The NAC paradigm should be decided upon prior to policy creation.

24
Q

What is a Policy?

A

For a single problem, question or situation, a policy is:

  1. A set of rules built to evaluate a group of endpoints (identified by the scope and / or main rule)
  2. to determine which of multiple possible configuration scenarios (identified by subrules) of the situation each endpoint matches,
  3. and to take various actions upon those endpoints
25
Q

Policy example

A

!! We can only check the state of encryption if the device is managed. Of course if we cannot login to the device we cannot see whether it is there or not.

Irresolvable: We need this additional sub policy because we want to capture all

Recheck: every x hours and new admission event (something about the state of the host has changed e.g. authentication event, dhcp request, reboot, etc) . An admission event is a good reason to recheck.

26
Q

Sub Rules Best Pracices (1)

A
27
Q

Sub Rules Best Pracices (2)

A
28
Q

Sub Rules Best Pracices (3)

A
29
Q

Conditions - Windows

A

Last Login Event

30
Q

Meeting Condition Criteria

A

Conditions may include several criteria, i.e., several sets of Boolean endpoint properties. Each condition provides an option to specify which criteria must be met in order for the endpoint to match the policy. You may decide that a match is acceptable:

  • If all criteria are true.
  • If one criterion is true.
  • If all criteria are false.
  • If one criterion is false.
31
Q

Property Expression Types

A

You may want to detect certain properties on endpoints, but may not be certain of the precise property values, for example, the exact spelling of a vendor or precise version information. To help you deal with these situations, several property expression options are available.

  • Contains
  • Starts or Ends with
  • Greater than
  • Matches
  • Matches expression
  • In List (See Defining and Managing Lists)
  • Any Value
32
Q

Properties and Scripts

A

The following properties use scripts:

  • Windows Expected Script Result
  • Device Interfaces
  • Number of IP Addresses
  • External Devices
  • Windows File MD5 Signature
  • Windows Is Behind NAT
  • Microsoft Vulnerabilities
  • Scripts are not required if the endpoint is managed by SecureConnector.
33
Q

Quiz - Subrules

A
34
Q

Groups - General_1

A
35
Q

Groups - General_2

A
36
Q

Groups - General_3

A
37
Q

Type of Groups

A

ProSErv Groups

Manual Groups

38
Q

Policy Recheck Timers and Admission Events

A
39
Q

List of all possible Admission Events

A
40
Q

Policy Recheck Timers and Admission Events - Best Practices

A
41
Q

ProServ Group Structure Expanded - Classify Groups

A
42
Q

Manual Groups

A
43
Q

Triggers for Policy Re-Evaluaiton

A
44
Q

Windows Conditions - Best Practice

A
45
Q

Control Policies

A
46
Q

Discover Policies

A
47
Q

Quiz - Group Policy

A
48
Q

Quiz - Policy

A
49
Q

NAC Time Settings

A
50
Q

Virtual Firewall settings

A

Default allow rules in the virtual firewall say something like allow secure connector and any authentication servers, or anything that is part of the forescout functionaliy/communication

51
Q

NAC - Redirect Exceptions

A
52
Q

Configure HTTP Redirect Exception

A
  1. Configure: Options>NAC> HTTP Redirect
  2. Apply Exception in “Exceptions” tab: Action> Notify >Http Redirectio to URL> Ecceptions
53
Q

Threat protection whitelisting / Legitimate Scan

A

Configure in: Options> Threat Protection> Legitimate Scan

Note: Check is set by default for “Enable Auto learn Email servers

54
Q

Quiz - Threat Protection

A

ForeScout for Jay (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions