Ch 9, 11, 12, 13 Flashcards
A recent security evaluation concluded that your company’s network design is too consolidated.
Hosts with wildly different functions and purposes are grouped together on the same logical area of the network. In the past, this has enabled attackers to easily compromise large swaths of network hosts. What technique(s) do you suggest will improve the security of the network’s design, and why?
In general, you should start implementing some form of network segmentation to put hosts with the same security requirements within segregated zones. For example, the workstations in each business department can be grouped in their own subnets to prevent a compromise of one subnet from spreading to another. Likewise, with VLANs, you can more easily manage the logical segmentation of the network without disrupting the physical infrastructure (i.e., devices and cabling)
You are discussing a redesign of network architecture with a client, and they want to know what the
difference between an extranet and Internet is. How can you explain it?
The Internet is an external zone where none of the hosts accessing your services can be assumed trusted
or authenticated. An extranet is a zone allowing controlled access to semi-trusted hosts, implying some sort of authentication. The hosts are semi-trusted because they are not under the administrative control of the organization (as they are owned by suppliers, customers, business partners, contractors, and so on).
Why is subnetting useful in secure network design?
Subnet traffic is routed, allowing it to be filtered by devices such as a firewall. An attacker must be able to gather more information about the configuration of the network and overcome more barriers to launch successful attacks.
How can an enterprise DMZ be implemented?
By using two firewalls (external and internal) around a screened subnet, or by using a triple-homed firewall (one with three network interfaces).
What type of network requires the design to account for east-west traffic?
This is typical of a data center or server farm, where a single external request causes multiple cascading requests between servers within the data center. This is a problem for a perimeter security model, as funneling this traffic up to a firewall and then back to a server creates a performance bottleneck.
Why might an ARP poisoning tool be of use to a threat actor performing network reconnaissance?
The attacker could trick computers into sending traffic through the attacker’s computer (performing a MitM/onpath attack) and, therefore, examine traffic that would not normally be accessible to him (on a switched network).
How could you prevent a malicious attacker from engineering a switching loop from a host connected to a standard switch port?
Enable the appropriate guards (portfast and BPDU Guard) on access ports.
What port security feature mitigates ARP poisoning?
Dynamic ARP inspection—though this relies upon DHCP snooping being enabled.
What is a dissolvable agent?
Some network access control (NAC) solutions perform host health checks via a local agent, running on the host. A dissolvable agent is one that is executed in the host’s memory and CPU but not installed to a local disk.
True or false? Band selection has a critical impact on all aspects of the security of a wireless network?
False—band selection can affect availability and performance but does not have an impact in terms of either confidentiality or integrity.
The network manager is recommending the use of “thin” access points (aka antennas) to implement the wireless network. What additional appliance or software is required and what security advantages should this have?
You need a wireless controller to configure and manage the access points. This makes each access point more tamper-proof as there is no local administration interface. Configuration errors should also be easier to identify
What is a pre-shared key?
This is a type of group authentication used when the infrastructure for authenticating securely (via RADIUS, for instance) is not available. The system depends on the strength of the passphrase used for the key
Is the WPS (aka WPA) a suitable authentication method for enterprise networks?
No, an enterprise network will use RADIUS authentication. WPS (aka WPA) uses PSK and there are weaknesses in the protocol.
You want to deploy a wireless network where only clients with domain-issued digital certificates can
join the network. What type of authentication mechanism is suitable?
EAP-TLS is the best choice because it requires that both server and client be installed with valid certificates.
Why are many network DoS attacks distributed?
Most attacks depend on overwhelming the victim. This typically requires a large number of hosts, or bots.
What is an amplification attack?
Where the attacker spoofs the victim’s IP in requests to several reflecting servers (often DNS or NTP servers).
The attacker crafts the request so that the reflecting servers respond to the victim’s IP with a large message,
overwhelming the victim’s bandwidth.
What is meant by scheduling in the context of load balancing?
The algorithm and metrics that determine which node a load balancer picks to handle a request.
What mechanism provides the most reliable means of associating a client with a particular server
node when using load balancing?
Persistence is a layer 7 mechanism that works by injecting a session cookie. This is generally more reliable than the layer 4 source IP affinity mechanism.
True or false? A virtual IP is a means by which two appliances can be put in a fault tolerant
configuration to respond to requests for the same IP address?
True
What field provides traffic marking for a QoS system at layer 3?
Layer 3 refers to the DiffServ field in the IP header.
What vulnerabilities does a rogue DHCP server expose users to?
Denial of service (providing an invalid address configuration) and spoofing (providing a malicious address configuration—one that points to a malicious DNS, for instance).
Why is it vital to ensure the security of an organization’s DNS service?
DNS resolves domain names. If it were to be corrupted, users could be directed to spoofed websites. Disrupting DNS can also perform denial of service.
True or false? The contents of the HOSTS file are irrelevant as long as a DNS service is properly configured.
False (probably)—the contents of the HOSTS file are written to the DNS cache on startup. It is possible to edit the registry to prioritize DNS over HOSTS, though.
What is DNS server cache poisoning?
Corrupting the records of a DNS server to point traffic destined for a legitimate domain to a malicious IP address.
What are the advantages of SASL over LDAPS?
The Simple Authentication and Security Layer (SASL) allows a choice of authentication providers and encryption (sealing)/integrity (signing) mechanisms. By contrast, LDAPS uses Transport Layer Security (TLS) to encrypt traffic, but users still authenticate via simple binding. Also, SASL is the standards-based means of configuring LDAP security (& provides integrity)
What steps should you take to secure an SNMPv2 service?
Configure strong community names and use access control lists to restrict management operations to known hosts.
