Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Exam Prep > Appendix D > Flashcards

Appendix D Flashcards

1
Q

What port is utilised by Telnet

A

TCP/23

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the main security concerns regarding Telnet

A

Doesn’t encrypt communications and / or passwords. Can sniff passwords with packet analyser.

Telnet has no authentication mechanisms to verify two communicating hosts.

No MitM protection. Multiple vulnerabilities relating to telnet daemons.

Vulnerable to brute force attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the main security concerns of HTTP & HTTPS based management systems

A

Credentials can be transmitted insecurely over clear text protocols.

Can sniff passwords with packet analyser.

Web-based vulnerabilities: SQLi, XSS, Authentication Bypass.

Vulnerable to brute-force attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the main security concerns of using SSH

A

Outdated versions of SSH are vulnerable to a range of issues.

SSH supported with CBC may allow attackers to recovery up to 32bits of plaintext from a block.

SSH servers can support weak hashing algorithms: MD5 or 96-bit MAC algorithms.

Vulnerable to brute-force attacks. Can support no authentication types.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is SNMP

A

Simple Network Management Protocol.

Devices that typically support SNMP include routers, switches, servers, workstations, printers etc. SNMP is used mostly in network management systems to monitor network-attached devices for conditions that warrant administrative attention.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What layer does SNMP operate on

A

Application (7)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What ports does SNMP utilise

A

UDP 161 & 162

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the main security concerns of SNMP

A

Is a connectionless protocol, is vulnerable to IP Spoofing attacks. Authentication of clients is performed only by “community strings” instead of password. SNMP v1 and 2c “Community strings” are sent in clear text, susceptible to packet sniffing.

Vulnerable to brute-force attacks against community / authentication / encryption strings as they do not implement a challenge response handshake. SNMP default community strings public and private.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is TFTP

A

Trivial File Transfer Protocol is a simple, lock-step, file transfer protocol which allows a client to get or put a file onto a remote host.

One of its primary uses is in the early stages of nodes booting from a Local Area Network. TFTP has been used for this application because it is very simple to implement.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What port is used by TFTP

A

UDP/69

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the three modes of transfer used by TFTP

A

Netascii Octet Mail

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the primary security concerns for TFTP

A

No authentication. Communications are sent in clear text format. Extract sensitive files if the filename and path is known / guessed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is Cisco Reverse Telnet

A

A Telnet client which has the ability to Telnet to one device remotely, then “reverse” out of the device’s port to control a device connected to that port. Can be used to access serially connected devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What port does Cisco Reverse Telnet operate on

A

TCP 2000 + 1, 3, 4 (line number / port number)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the main vulnerabilities associated with Cisco Reverse Telnet

A

Doesn’t encrypt communications and / or passwords.

Can sniff passwords with packet analyser. Telnet has no authentication mechanisms to verify two communicating hosts.

No MitM protection.

Multiple vulnerabilities relating to telnet daemons.

Vulnerable to brute-force attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is NTP

A

Network Time Protocol - Used for synching time on servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What port does NTP operate on

A

UDP/123

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the main security concerns regarding NTP

A

Suscepticle to MitM attacks unless packets are signed for authentication.

Overhead can cause DoS scenario.

DDOS attacks can occur by sending commands to NTP server with spoofed return address.

Enumerate system information such as hostname, CPU, OS and Daemon.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the three main tools used for network traffic ananlysis

A

Wireshark, Cain & Abel and Ettercap

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is ARP

A

Address Resolution Protocol, converts network layer (3) addresses into link layer (2) addresses (MAC to IP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the main security concerns regarding ARP

A

ARP Spoofing / Cache Poisoning

1) Attacker spoofs own MAC address to impersonate legitimate user.
2) Attacker broadcasts spoofed ARP messages onto network.
3) Recipient updates legitimate user details on ARP Cache with attackers details.
4) Traffic is intercepted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

ARP spoofing opens up what attack possibilities

A

DoS - Can drop packets. MitM - Traffic can be modified before forwarding it to destination. MAC Flooding - Flood switch with ARP message until it becomes a HUB.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What measures can be taken to prevent ARP spoofing

A

Static ARP Entries ARP Spoofing Detection Software. OS Security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What does DHCP stand for

A

Dynamic Host Control Protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What ports are used by DHCP

A

UDP 67 to the server UDP 68 to the client

26
Q

What are the main security concerns regarding DHCP

A 
DHCP Spoofing (MitM)
1 - Attacker responds to DHCP request message faster than DHCP server.
2 - Attacker advertises as default gateway and DNS server.
3 - MitM attacker by intercepting traffic through impersonation.
DHCP Exhaustion (DoS)
1 - Attacker requests all IP Address from DHCP pool.
2 - Legitimate users can no longer obtain an IP Address.
27
Q

What does CDP stand for

A

Cisco Discovery Protocol.

28
Q

What are the main security concerns for CDP

A

1 - Information Disclosure
2 - CDP Cache Overflow - DoS when device receives too many CDP packets.
3 - CDP Cache Pollution - DoS when device becomes unusable due to fake information.
4 - Power Exhaustion - Switch reservers power and denies power to other devices.

29
Q

What is HSRP

A

Cisco : Hot Standby Router Protocol

30
Q

What port does HSRP use

A

UDP/1985

31
Q

What are the main security concerns regarding HSRP

A

1 - DoS - Attacker sends HSRP packet with 255 priority to become Active router. Legitimate routers become Standby.

2 - MitM - If attacker is Active router, outbound traffic is intercepted.

3 - Information Disclosure - HSRP broadcasts all router IP Addresses.

32
Q

What is VRRP

A

Virtual Routing Redundancy Protocol

33
Q

What is VTP

A

Cisco : VLAN Trunking Protocol

34
Q

What are the main security concerns regarding VTP

A

1 - No / Weak authentication
2 - Old version of VTP
3 - VTP enabled on all ports.
Can lead to:
+ - DoS - Can disable or delete a VLAN from one device on all VTP servers.
+ - DoS - Can create VLANs on all VTP servers, causing outdates and increased in multicast / broadcast traffic.

35
Q

What is STP

A

Spanning Tree Protocol

36
Q

How does STP determine priority

A

Root bridge is determined by lowest Bridge ID.
Bridge ID contains Priority + MAC= (32768.0200.0000.1111)
Priority default = 32768

37
Q

What is BPDU

A

Bridge Protocol Data Unit

38
Q

What are the main security concerns regarding STP

A

1 - Authentication-less
2 - MitM - Attackers can flood BPDUs with same priority as root bridge with a lower MAC address, to win root bridge election.

39
Q

What is TACACS+

A

Cisco : Terminal Access Controller Access-Control System +

40
Q

What port does TACACS+ use

A

TCP/49

41
Q

TACACS+ supports an AAA architecture, what does this mean

A

Authentication = Validating identify of user
Authorisation = Granting access to user or device.
Accounting Services = Tracking user connectivity.

42
Q

What are the main vulnerabilities associated with TACACS+

A

1 - Lack of integrity checking in Accounting.
2 - Replay attacks can duplicate records in Accounting.
3 - Reply packets could be decrypted.
4 - Lack of padding - Lengths of user passwords can be determined.
5 - Packet body length DoS / Overflow.

43
Q

What is the SIP protocol

A

The Session Initiation Protocol (SIP) is a communications protocol for signaling and controlling multimedia communication sessions in applications of Internet telephony for voice and video calls, in private IP telephone systems, as well as in instant messaging over Internet Protocol (IP) networks. Commonly phoned on phone systems

44
Q

What ports are used by SIP

A

Ports 5060 and 5061, both on TCP and UDP

45
Q

What layer of the OSI model does SIP operate on

A

Layer 5 (Session Layer)

46
Q

What are 5 architecture elements of SIP

A

User location, where the endpoint of a session can be identified and found, so that a session can be established

User availability, where the participant that’s being called has the opportunity and ability to indicate whether he or she wishes to engage in the communication

User capabilities, where the media that will be used in the communication is established, and the parameters of that media are agreed upon

Session setup, where the parameters of the session are negotiated and established

Session management, where the parameters of the session are modified, data is transferred, services are invoked, and the session is terminated

47
Q

What are the 14 SIP requests

A 
INVITE = Establishes a session.
ACK = Confirms an INVITE request.
BYE = Ends a session.
CANCEL = Cancels establishing of a session.
REGISTER = Communicates user location (host name, IP).
OPTIONS = Communicates information about the capabilities of the calling and receiving SIP phones.
PRACK = Provisional Acknowledgement.
SUBSCRIBE = Subscribes for Notification from the notifier.
NOTIFY = Notifies the subscriber of a new event.
PUBLISH = Publishes an event to the Server.
INFO = Sends mid session information.
REFER = Asks the recipient to issue call transfer.
MESSAGE = Transports Instant Messages.
UPDATE = Modifies the state of a session.
48
Q

What are the SIP responses

A 
1xx = Informational responses, such as 180 (ringing).
2xx = Success responses.
3xx = Redirection responses.
4XX = Request failures.
5xx = Server errors.
6xx = Global failures.
49
Q

What is RTP

A

The Real-Time Transport Protocol (RTP) is an Internet protocol standard that specifies a way for programs to manage the real-time transmission of multimedia data over either unicast or multicast network services. … RTP is commonly used in Internet telephony applications.

50
Q

What is SCCP

A

The Signalling Connection Control Part (SCCP) is a network layer protocol that provides extended routing, flow control, segmentation, connection-orientation, and error correction facilities in Signaling System 7 telecommunications networks. SCCP relies on the services of MTP for basic routing and error detection.

51
Q

What is SDP

A

The Session Description Protocol (SDP) is a format for describing streaming media communications parameters.

52
Q

How do 802.11 networks compare

A

WLAN - Wireless Local Area Network
Standard of Wireless Networking: IEEE 802.11 (Institute of Electrical and Electronic Engineers).
802.11 is a data link layer protocol
802.11 are all half duplex.

53
Q

How do the security features of 802.11 networks compare

A

Four Common 802.11 Variations:

802.11A
1 - 54 Mbits speed (megabits per second)
2 - 5 GHz frequency (Hertz)
3 - 150 feet distance.

802.11B
1 - 11 Mbits speed
2 - 2.4 GHz frequency (interference)
3 - 300 feet distance

802.11G
1 - 54 Mbits speed
2 - 2.4 GHz frequency (interference)
3 - 300 feet distance

802.11N (Popular)
1 - 54-600 Mbits speed
2 - 2.4 and 5 GHz frequency
3 - 230 feet.

54
Q

What is WEP

A

Wireless Equivalency Privacy
Implemented in 802.11 standard.
+ Rivest Cipher 4 (RC4 Cipher) for confidentiality.
+ Cyclic Redundancy Check (CRC-32) for integrity.

55
Q

What is TKIP

A

Temporal Key Integrity Protocol
Used by WPA.
+ Rivest Cipher 4 (RC4) for confidentiality.
+ 64bit Message Integrity Check (MIC) for integrity.

56
Q

What is WPA

A

WPA
WiFi Protected Access
Implemented in 802.11i standard.
+ Temporal Key Integrity Protocol (TKIP) for confidentiality.
+ Michael message integrity algorithm for integrity.

57
Q

What is WPA2

A 
WPA2
WiFi Protected Access II
Implemented in 802.i-2004 standard. Or Robust Security Network (RSN).
\+ CCMP for confidentiality.
\+ CBC-MAC for integrity.
58
Q

What is EAP

A

Extensible Authentication Protocol
+ Cisco authentication framework providing functions and negotiations of different EAP methods.

  • EAP-TLS
    Extensible Authentication Protocol over Transport Layer Security (EAP-TLS)
    + EAP-TLS based on SSLv3.
    + EAP-TLS uses client-side certificates.
59
Q

What is LEAP

A

LEAP (Lightweight Extensible Authentication Protocol) is a Cisco-proprietary version of EAP, the authentication protocol used in wireless networks and Point-to-Point connections. LEAP is designed to provide more secure authentication for 802.11 WLANs (wireless local area networks) that support 802.1X port access control.

60
Q

What is PEAP

A

Protected Extensible Authentication Protocol (PEAP)
+ PEAP is based on EAP-TLS
+ PEAP is designed to allow hybrid authentication.

Client Authentication:
1 - Username and password.

Exam Prep (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions