AR's Notes Flashcards
1
Q
peer-to-peer network
A
decentralized network architecture where each device in the network can act as both client and server, allowing direct sharing of resources, data, and services among all connected devices without need for a central server
2
Q
client-server network
A
multiple client devices connect to central server to access shared resources, services, and applications
3
Q
network backbone
A
main infrastructure that interconnects various segments of a computer network, providing central pathway for data exchange
- composed of high-speed, high-capacity links and core routers or switches
4
Q
mesh topology
A
each host connected to every other host, creating network with no central connecting point
- high availability and redundancy
5
Q
core layer
A
backbone of network, handling high-speed packet switching
- responsible for fast and reliable routing of data
6
Q
distribution layer
A
- acts as intermediary between core and access layers, managing routing, filtering, and WAN access
- aggregates data received from access layer switches before transmitted to core layer
7
Q
access layer
A
network’s point of entry for devices and end users, connecting them to network
- includes switches and APs
8
Q
spine and leaf architecture
A
two layer network topology that is highly scalable and minimizes latency by ensuring every leaf switch is separated by no more than 2 switches from any other leaf switch
9
Q
collapsed core architecture
A
merges core and distribution layers into single layer
- ideal for small to medium networks
10
Q
north-south traffic
A
flow of network traffic between data center and outside world, involving client-to-server communication
11
Q
east-west traffic
A
traffic flow within the data center, including server-to-server, and server-to-storage
12
Q
multicast
A
- data sent from one or more sources to multiple destination simultaneously
- efficient for apps where same data needs to be delivered to multiple recipients
13
Q
anycast
A
data sent to nearest or best destination as determined by routing protocols
- commonly used in DNS and CDN
14
Q
broadcast
A
message sent from one sender to all potential receivers within network segment
- not supported in IPv6
15
Q
OSI Layer 1
A
- physical
- converts bits into electrical signal over copper cables or pulses of light for fiber optics
- hubs, cables, connectors, modems
16
Q
OSI layer 2
A
- data link
- provides communication within same network via MAC addresses
- transmits frames, converts info into bits
- switches and bridges, APs
17
Q
OSI layer 3
A
- Network
- provides communication between different networks via IP addresses
- routers
18
Q
OSI Layer 4
A
- transport
- handles end-to-end communication either via TCP or UDP
19
Q
OSI layer 5
A
- session
- provides dialog control by allowing multiple persistent connections
- duplexes
- NFS (network file system), SQL, NetBIOS, RPC
20
Q
OSI layer 6
A
- Presentation
- gets data ready for application layer by converting, encoding, translating. encrypting, etc.
21
Q
OSI layer 7
A
- application
- generates data to be transmitted, processes data that is received
22
Q
SMTP
A
- simple mail transfer protocol
- port 25
- application layer
- sending messages from email client to email server/ between servers
23
Q
SNMP
A
- simple network management protocol
- port 161
- application layer
- managing devices on IP networks, V3 is best
24
Q
HTTP
A
- port 80
- application layer
- stateless protocol, each command executed independently
25
FTP
- file transfer protocol
- port 20/21
- application layer
- transfer of computer files between client and server
- does not encrypt traffic
26
Telnet
- port 23
- application layer
- virtual terminal connections, insecure
27
TFTP
- trivial file transfer protocol
- port 69
- application layer
- no authentication file transfer, used in controlled environments because simple and lacks security
28
POP3
- port 110
- application layer
- retrieves emails from remote server
- used for infrequent access or offline operation
29
IMAP
- port 143
- application layer
- email retrieval and storage
- messages can be kept on server and synced across multiple devices
30
What layer does SSL/TLS operate on?
Transport layer
31
Network layer protocols
IP, ICMP, RIP, OSPF, BGP, IGMP, IPX, IPSec, NAT
32
MAC layer
sublayer of datalink that manages protocol access
- responsible for addressing and channel access control mechanisms
33
logical link control layer
upper sublayer of data link layer that provides flow control and error control
34
Data link layer protocols
ARP, PPP, L2TP, ethernet, FDDI, asynchronous transfer mode
35
Layer 1 protocols
EIA/TIA-232, HSSI, ISDN, DSL, 10BASE....
36
router
- network layer
- directs data packets between different networks based on IP addresses
- uses routing tables, provides network security
37
switch
- data link layer (2)
- forwards data based on MAC address
- creates separate collision domains for each port
- used to connect devices within same network or VLAN
38
load balancer
distributes incoming network traffic across multiple servers
- operates at various layers of OSI
39
CDN
(content delivery network)
globally distributed network of proxy servers
- cache content
40
Class A IP
1.0.0.0 = 126.255.255.255
41
Class B IP
128.0.0.0 - 191.255.255.255
42
Class C IP
192.0.0.0 - 223.255.255.255
43
APIPA
169.254.0.0 - 169.254.255.255
- self assigned by host when DHCP request fails
44
loopback address
127.0.0.0 - 127.255.255.255
- used for testing network interface
45
subnetting
allows for more efficient use of organization's allocated IP address space by enabling creation of logically segmented networks
46
SFTP
- port 22
- extension of SSH to provide secure method for file transfer
- application layer
47
SSH
- port 22
- cryptographic, provides secure channel over unsecured network
- encrypts all traffic
48
DNS
- port 53
- naming system, translates domain names to IP addresses
49
DHCP
- port 67/68
- 67 for server and 68 for client
50
HTTPS/TLS
- port 443
- provides secure web browsing
51
SMTP TLS
- port 587
- secure email transmission with encrypted data
52
POP3 over SSL
- port 995
- secure retrieval of email from remote server
53
IMAP over SSL
- port 993
- secure IMAP
54
NTP
- network time protocol
- port 123
- synchronizes clocks of computers over network
- high precision time correction
55
LDAP
- port 389
- accessing and maintaining distributed directory information services over IP network
- storing user credentials and groups
56
LDAP over SSL (LDAPS)
- port 636
- secured LDAP
57
SMB
- server message block
- port 445
- used for network file sharing, for windows and IP-based comm.
58
Syslog
- port 514
- message logging to track and record system messages
59
SQL server
- port 1433
60
RDP
- port 3389
- microsoft protocol that enables remote connections to other computers
- graphical interface
61
SIP
- session initiation protocol
-port 5060
- signaling protocol for sessions
- fundamental to VoIP, enabling establishment of call sessions and multimedia distribution
- app layer
62
ICMP
- internet control message protocol
- manage and troubleshoot network issues, error reporting, providing feedback
63
GRE
- generic routing encapsulation
- tunneling protocol by Cisco that creates virtual point-to-point link
- commonly used for VPNs
64
IPSec
- transport mode and tunnel mode
- securing internet communications and establishing VPNs
65
802.3 standards
ethernet
66
copper cable speeds
up to 40 Gb
67
fiber cable speeds
above 100 Gb
68
copper cable distances
up to 1100 meters
69
fiber cable distance
up to 40 km
70
coaxial cables
used for broadband internet, supporting high speed data transmission
- television and satellite
- RG-6
71
BNC connector
- secure locking connector
- used in old bus and ring networks
72
F connector
twisting hand screw commonly found on cable modems
73
single mode fiber
- long distance communication
- minimizes attenuation and dispersion over distances
- used in telecomm. and cable TV networks
74
MMF
- larger diameter fibers that allow multiple modes of light to propagate simultaneously
- within building or campus networks
- popular for LANs
75
ST connector
- fiber optic
- used in SMF installations
76
SC connector
- fiber optic
- square
- snaps-in
- used in SMF and MMF
77
LC connector
- fiber optic
- little
- snaps in
- small form factor
- SMF and MMF
78
Twinaxial
used for high-speed, short-distance coper 10 Gb or 40 Gb ethernet
- shielded
79
Twisted pair cable
- 8 wires, 4 pairs
- most used in homes and offices
- least expensive
80
RJ11 connector
- twisted pair
- 4 pin
- dial-up modems and analog phones
81
RJ45 connector
- twisted pair
- 8 pin
- desktops, laptops, servers
82
Twisted pair categories
cat standards
83
Cat 5
- 100 Mbps
- 100 meters
- older networks
84
Cat 5e
- 1000 Mbps/1Gbps
- 100 m distance
85
Cat 6
- 10Gbps/55 meters
- 1 Gbps/100 meters
86
Cat 6a
- 10Gbps
- 100 m
- thicker wires
87
Cat 7
10 Gbps, 100 m
88
Cat 8
- 25 - 40 Gbps
- 30 m
89
crossover cables
used to connect like devices
90
straight-through cables
used to connect unlike devices
ex: router to switch
91
SFP (small form-factor pluggable)
optical module transceiver used for data and telecomm.
- up to 4.25 Gbps
- + is up to 10 Gbps
92
QSFP - quad
connector used for fiber optic or electrical copper connections
- speeds up to 28 Gbps
93
VXLAN
- network virtualization tech
- extends Layer 2 segments, enabling creation of large number of virtualized LANs
94
SASE (security access service edge)
emerging frameworks combining network security functions with WAN capabilities
- integrates services and functions directly into network fabric
95
SSE (security service edge)
centralized various security services provided in cloud
96
IPv6 addressing
- 128 bit addresses
- improves routing efficiency, enhances security
97
tunneling
- IPv6 method used to transmit packets over existing IPv4 infrastructure
- allows coexistence of both protocols
- encapsulates IPv6 packets within IPv4 packets
98
dual stack
network where devices run both IPv4 and IPv6 simultaneously
99
NAT64
network address translation that facilitates communication between IPv4 and IPv6 devices
100
routing
process of selecting paths in a network along which to send network traffic
101
interior gateway protocols
route LAN in one location to LAN in another
102
exterior gateway protocols
route one customer's WAN link to another customer's WAN link
103
distance-vector
hops-based routing protocol that forwards packets using path with fewest number of hops
104
link-state
bandwidth-based routing protocol that forwards packet using path with highest bandwidth
105
RIP (routing information protocol)
uses hop count as metric, with max of 15 hops
- v1 is classful, v2 is classless
- good for small to medium networks
- older
106
OSPF
- link state routing protocol
- fast convergence and supports large networks
- suitable for large, complex networks
- load balancing and fault tolerance
107
EIGRP
- distance vector and link state combined
- supports VLSM and CIDR, provides loop-free paths and load balancing
- suitable for medium to large networks with Cisco
108
BGP
- essential for inter-domain routing on the internet
- crucial for ISPs and large enterprises
109
prefix length
number of contiguous bits of network mask set to 1
110
port tagging/802.1Q
inserting VLAN identifier into ethernet frames to distinguish between different VLANs on a trunk link
- multiple VLANS can share a single physical connection
111
native VLAN
default VLAN on trunk port that carries untagged traffic
112
spanning tree protocol
helps prevent network loops in ethernet topology by creating spanning tree that logically blocks redundant paths
- routes effectively
113
port aggregation
combines multiple network ports into single group, increasing bandwidth and providing redundancy for higher data throughput and reliability
- consolidates multiple links between switches or switches/servers
114
port mirroring/spanning
allows redistribution of traffic from one port to another
115
jumbo frames
- larger than 1500 bytes and up to 9000 bytes
- can reduce overhead and improve performance in high-throughput networks
116
2.4GHz
- long range because better wall penetration
- slower data rates
- higher rate of interference
117
5 GHz
provides faster data rates at short distances
- less interference
118
802.11h
enhances 802.11 by adding support for dynamic frequency selection and transmit power control
119
802.11a
- 5GHz
- 54 Mbps
- wifi 1
120
802.11b
- 2.4 GHz
- 11 Mbps
- wifi 2
121
802.11g
- 2.4 GHz
- 54 Mbps
- wifi 3
122
802.11n
- 2.4, 5 GHz
- 600 Mbps
- wifi 4
123
802.11ac
2.4, 5 GHz
- 3.5 Gbps
- wifi 5
124
802.11ax
2.4, 5 GHz
- 9.6 Gbps
- wifi 6
125
BSS (basic service set)
group of wireless devices operating with same AP
126
BSSID
serves as MAC address for a wireless AP
- essential when multiple APs deployed
127
omni-directional antennas
- transmits signal in all directions
- most common
- shorter range
128
yagi antenna
- directional
- focus wireless signal up to a mile
129
parabolic antenna
- directional
- focus wireless signal up to 8 miles
130
Ad hoc network
decentralized and do not rely on pre-existing infrastructure
131
infrastructure networks
rely on fixed routers, most common network type
132
WPA2
- PSK via CCMP
- encrypts with AES
133
WPA3
- SAE via GCMP
- encrypts with AES
134
enterprise authentication
uses more secure approach by employing RADIUS server to manage user's authentication individually
- stronger security
135
MDF
primary hub of network's cabling system
- centrally located
136
IDF
serves as secondary hub, positioned to reduce distance data must travel between MDF and end users
- located on each floor or section
137
PDU
designed to distribute electric power to various components within network or data center
138
NFV
- network functions virtualization
- decoupling network functions from hardware devices
- flexible deployment and management
139
NAT gateway
allows instances in private subnet to connect to internet
140
SLAAC
- stateless address auto-configuration
- IPv6 feature that allows device to automatically configure own IP address without DHCP
141
recursive DNS
DNS server takes on responsibility of retrieving data from other DNS servers on behalf of client
142
forward zone
resolve domain name to IP address
- records like A, AAAA, MX
143
reverse zone
handles mapping of IP addresses back to domain names
- used in reverse DNS lookups
144
DNSSEC
- DNS security extensions
- enhances DNS security by providing authentication of DNS data, verifying integrity and ensuring it has not been tampered with
- used digital signatures
145
DNS over HTTPS (DoH)
encrypts DNS queries
- routes queries through HTTPs protocol
146
CNAME
maps alias name to true domain name
147
PTR
maps IP address to domain name
- opposite of A or AAAA record
148
IPAM
- IP address management
- organizing, tracking, managing IP address space within network
- helps prevent IP conflicts
149
SNMP traps
unsolicited messages sent from SNMP-enabled device to management station, notifying it of significant events or conditions
150
syslog collector
tool used for gathering log data generated by devices within a network
151
RPO
max acceptable amount of data loss measured in time before disaster occurs
152
RTO - time objective
targeted duration of time within which business process must be restored to avoid unacceptable consequences
153
MTBF
calculated average time between failures of a system
154
MTTR
average time required to repair a failed component
155
cold sites
- most affordable
- no equipment, connections, or data
- takes days to weeks to recover
156
warm sites
- contains some equipment and connections, but out of date configurations and data sets
- hours to days to recover
157
hot sites
- most expensive but fastest recovery
- contains all equipment, connections, recent configurations
158
site-to-site VPN
connects entire networks to each other
159
client-to-site VPN
- remote access VPN
- allows individual clients to connect to corporate network securely over the internet
160
clientless VPN
allows users to securely access network resources through web browser without installing dedicated VPN client software
161
split tunnel VPN
only network traffic from corporate site passes through VPN tunnel, while other traffic accesses internet directly
- reduces load on VPN gateway but exposes security risks
162
full tunnel VPN
all of client's internet traffic is routed through VPN to corporate network
- increases security but leads to higher bandwidth usage and slower performance
163
integrity methods
- checksums and cryptographic hash functions
- digital signatures
- access controls
164
risk
probability of a threat exploiting a vulnerability
165
IAM
- identity and access management
- framework of business processes, policies, and technologies that facilitate management of electronic or digital identities
- controls user access
166
Mandatory access control (MAC)
- security models where access rights regulated by central authority based on different levels of security clearance
- common in government and military, permissions set/enforced by systems admin
167
discretionary access control (DAC)
- resource owners decides on access levels; flexible
- risks of users granting excessive access
168
role based access control
assigns permissions based on user's role within organization
169
rule-based access control
based on set of rules defined by systems admin
170
attribute-based access control
uses policies that evaluate attributes of users, environment, resources
- provides fine-grained control
171
SAML (security assertion markup language)
- between an identity provider and service provider
- used for SSO, enterprise-level especially
172
OAuth
open standard for access delegation, used to access user's data without exposing user credentials
173
honeynet
network of honeypots
174
honeyfile
decoy files that appear legit and contain attractive data
175
honeytoken
broader term that refers to any decoy data or token inserted into a system
176
network segmentation
dividing network into smaller segments or subnets to improve security and performance
177
ICS (industrial control system)
systems used in industrial production
178
PKI (public key infrastructure)
framework used to create, manage, distribute, use, store, and revoke digital certificates and manage public-key encryption
179
logic bomb
code inserted into software that will set off a malicious function when specified conditions are met
180
UDP floods
attacker overwhelms random ports on targeted host with IP packets containing UDP datagrams
- slows down/crashes system
181
SYN floods
type of DoS attack that targets TCP connection sequence 3-way handshake
182
reflected DDoS
attackers forces third-party servers to direct traffic to victim
- ex: IP spoofing
183
VLAN hopping
network attack that exploits vulnerabilities to send packets from one VLAN to another, bypassing Layer 2 security measures
184
MAC flooding
attacker overwhelms network switch with fake MAC. address, leading to switch acting like a hub and broadcasting all incoming traffic to all ports
185
ARP spoofing
attacker sends falsified ARP messages over LAN resulting in linking of attacker's MAC address with IP address of a legit computer
186
ARP poisoning
sending malicious ARP messages to local network, allowing attacker to intercept, modify, or block data
187
DNS tunneling
encoding data of other programs or protocols in DNS queries and responses
188
session hijacking
done by stealing session tokens, allowing impersonation of the victim and unauthorized access to systems or information
189
SSL stripping
attacker downgrades secure HTTPS connection to unencrypted HTTP connection
190
endpoint protection
installing security software on individual devices (endpoints) like antivirus, anti-malware, firewalls, IDS.
191
host-based firewall
controls network traffic to and from a single host, managing what traffic is allowed based on predefined security rules
192
802.1X
IEEE standard for port-based network access control
- used to authenticate devices
193
how does 802.1X work?
1. device attempt to connect
2. authenticator blocks all traffic except 802.1X traffic
3. supplicant/client device sends credentials to authenticator
4. authenticator forwards to authentication server
5. server approves credentials and instructs authenticator to allow access
194
EAP (extensible authentication protocol)
supports multiple authentication mechanisms
- used in PPP, RADIUS, 802.1X
195
packet filtering firewalls
- basic
- inspects packets and permits/denies based on source/destination IP, ports, protocols
196
stateful inspection firewall
- track state of active connections and make decisions based on context of the traffic
197
NGFW (next gen firewalls)
- more advances, integrates functionalities like deep packet inspection, IPS, app awareness
198
screened subnet/DMZ
subnetwork that contains/exposes organization's external-facing services to an untrusted network, usually the internet
199
7 steps of troubleshooting
1. identify problem
2. establish theory
3. test theory
4. establish plan of action
5. implement solution/escalate
6. verify full system functionality
7. document findings
200
identify problelm
- gather information
- question users
- see if anything changed
- duplicate problem
201
establish theory of probable cause
- question the obvious
- consider multiple approaches
- top-bottom or bottom-top OSI
- divide and conquer
202
crosstalk
signal transmitted on one cable or channel interferes with signal on another cable or channel
- using incorrect or low quality cable can increase the risk of crosstalk
203
CRC errors (cyclic redundancy check)
mismatch in the data checksum, indicating data corruption during transmission
204
runts
packs smaller than minimum allowed sign, usually less than 64 bytes
205
root bridge
central reference point in an STP-enabled network
206
incorrect VLAN assignment issues
network segmentation issues where devices on different VLANs unable to communicate as intended
- security vulnerabilities
207
incorrect subnet mask issues
- leads to improper network segmentation, causing devices to fail in communicating with each other
208
bottlenecking
particular part of network limits overall performance, creating a point of congestion
- insufficient bandwidth or overloaded network devices
209
latency
time it takes for data to travel from source to destination
210
jitter
variability in packet arrival times, affecting quality of real-time communications
211
protocol analyzer/packet capture
captures data packets traveling over network, allows for detailed analysis of network traffic
212
ping
sends ICMP echo requests to target host to test connectivity and measure round-trip time for messages sent to target device
213
traceroute/tracert (windows)
traces path packets take from source to destination, showing each hop along the route
214
NSlookup
- windows
- queries DNS servers to find IP address associated with hostname or to get DNS information about a domain (dig)
215
dig
- linux
- get DNS information about a domain
216
Tcpdump
- linux
- command-line packet filter
217
netstat
displays network connections, routing tables, and other network interface stats
218
ipconfig/ifconfig
displays or configures network configuration of a device
- ipconfig = windows
- ifconfig = older Linux
- ip = modern Linux
219
arp
displays or modifies IP-to-MAC address translation tables used by arp
220
nmap
network scanning tool that discovers devices and services on a network by sending packets and analyzing responses
221
LLDP
- link layer discovery protocol
- network discovery protocol used to discover and share information between network devices, used to identify network topology, troubleshoot connectivity issues
222
speed tester
tool used to measure performance of network connection by testing upload/download speeds
223
toner
tool used to trace and identify individual wires or cables within a bundle
224
cable tester
verifies integrity and performance of network cables; tests for continuity, signal strength, and wiring faults such as shorts, opens, cross connections
- essential for validating new cable installations and diagnosing existing cable issues
225
network tap
hardware device that provides way to access data flowing across network cable
- creates copy of data packets
226
visual fault locator
tool used to identify faults in fiber optic cables
227
show mac-address-table
displays MAC address table of network switch
228
command that displays routing table of router or layer 3 switch
show route
229
command that provides detailed information about status and configuration of network interfaces
show interface
230
command that displays current configuration of network device
show config
231
command that displays ARP table
show arp
232
command that displays information about VLAN configurations on a switch
show vlan
233
command that provides information about the power status and consumption of PoE devices
show power
234
reverse proxy
provides for protocol-specific inbound traffic. Reverse proxies can publish applications from the corporate network to the Internet in this way.
235
