Ch 10, 16, 19 QA Flashcards
What is a Content Filer?
It restricts web use to authorized site only.
i.e. schools or company
How does a proxy server work?
On a store-and-forward model that deconstructs each packs, analyzes, removes suspicious content, rebuilds, forwards it on
i.e. A system has broken down a packet containing malicious content, and erases the suspicious content, before rebuilding the packet.
Filter traffic between user & internet. Added protection like a firewall/filter. Its a server with its own IP address like a computer but its like a gate between your house & the world
How to configure a packet filtering firewall?
Specify a group of rules (ACL) defining the type of data in the pack and take action when the packet matches the rule.
i.e. A system admin builds rules based on source IP addresses allowing access to an intranet
Stateless (no info kept, can cause load balancer issues)
What is an application firewall?
Inspects packets & analyzes HTTP headers & code.
Try to id if code matches a pattern in its threat database
Stateful (tracks info, allow established & related traffic if a new connection accepted)
What is an appliance firewall?
Monitors all traffic passing into and out of a network segment, stand-alone hardware firewall
How does a transparent proxy server work?
aka forced or inline
it intercepts client traffic without reconfiguring the proxy server address
A server that intercepts the connection between an end-user or device and the internet. It is called “transparent” because it does so without modifying requests and responses
What does a network admin do with a non-transparent proxy server?
Configure the client with a proxy server address & port number to use it
What is a caching server?
Does not require client-side configuration (transparent proxy server) Client is unaware of the server which redirects client requests without modification.
Saves web pages & requests for offline access
A network administrator wants to use a proxy server to prevent external hosts from connecting directly with application servers. Which proxy server implementation will best fit this need?
Reverse Proxy Server
Deployed on the network edge, it protects server from direct contact with client requests from the public network (internet)
A system administrator wants to install a mechanism to conceal the internal IP addresses of hosts on a private network. What tool can the administrator use to accomplish this security function?
A NAT gateway translates between a local and public network by substituting private IPs for a public IP and forwarding the requests to the public Internet, thereby concealing private addressing schemes.
What does a Virtual firewall do?
Virtual firewalls often enact east-west security and zero-trust microsegmentation design paradigms. Virtual firewalls can inspect traffic as it passes from host-to-host or between virtual networks, rather than routing that traffic up to a firewall appliance and back.
How are firewall ACL’s configured?
On the principle of least access/least privilege
What is a function and two problems with a NIDS?
Network-based Intrusion Detection System
ID & Log hosts and application the admin can analyze
High chance of false positives & false negatives
Does not block traffic during an attack
When implementing a NIDS, which sensor deployment is ideal if concern is for overloads and resiliency in case of a power loss?
Passive TAP (test access point) - monitor port receives every frame (corrupt or not) and load does not effect copying
What is important to use when deploying an active TAP?
A model with a backup power, because an active TAP will fail during power loss
What does an aggregation TAP do?
It rebuilds the upstream & downstream channels into a single channel, but will drop frames under a heavy load
Are SPAN/mirror port sensors reliable?
Not completely, a switched port analyzer aka mirror may drop frames when under a heavy load or frames with errors will not be mirrored.
What is a mirror port?
Setup one port to copy (mirror) packets
A switch sends those copies to another port to be analyzed
What to consider when using a signature-based intrusion detection system?
The signatures & rules need to be updated regularly to protect against threat types
Which system produces false positives & may block legitimate activity?
NBAD - Network behavior & anomaly detection engines use heuristics to create a baseline.
(creates false positives & negatives until it reaches “normal”)
Behavioral-based detection engines recognize baseline traffic/events generating an incident when anything deviates
What system can detect zero-day attacks?
Behavioral-based detection software identifies zero-day, insider threats, and other malicious activity that has a signature which deviates from the baseline
Which of the following solutions best addresses data availability concerns that may arise with the use of application-aware next-generation firewalls (NGFW) and unified threat management (UTM) solutions?
SWG - secure web gateway
NGFW & UTM provide high confidentiality and integrity but lower throughput reduces availability.
Use SWG as a content filter so security solutions for server traffic are treated differently from user traffic.
What does an IPS do?
Intrusion Prevention Systems are positioned like firewalls at borders between network zones, providing an active response to network threats.
What does a TAP do?
Active or Passive Test Access Points are a hardware devices inserted into a cable to copy frames for analysis
Which product can help fine-tune a firewall and appliance setting?
NIDS (network-based intrusion detection system)
Analyzing NIDS logs lets an administrator tune firewall rulesets, remove or block suspect hosts and processes from the network or deploys additional security controls to mitigate identified threats.
What does a UTM do?
Unified threat management products centralize security controls, so it may not perform as well as a device with a single dedicated security function
How does an IPS differ from an IDS?
An IDS is passive, but an instruction prevention system can provide an active response to any network threat it matches
Name two types of SIEM log collection?
Agent-based (install agent on host to filter data that goes to the SIEM server for analysis & storage)
Listener/Collection - parse and normalize each log/monitoring source after configuring hosts to push updates to SIEM using syslog or SNMP
What is log aggregation?
Normalizing data from different sources to its consistent & searchable but does not refer to a type of log collection
What is packet capture?
Data captures from network sensors/sniffers plus netflow sources that provides both summary statistics about bandwidth and protocol usage and the opportunity for detailed frame analysis
