Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Work > chap 5 - communication & network security > Flashcards

chap 5 - communication & network security Flashcards

1
Q

define OSI 7-Layer model

A
  1. application –> data
  2. presentation –> data
  3. session –> Data
  4. transport –> Segments for end-to-end connection
  5. network –> Packets using the IP address
  6. data link -> frames using MAC address
  7. physical –> bites through cables
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

translate OSI to TCP/IP layers

A
  1. application + presentation + session –> application layer (Telnet/FTP/SMTP/DNS/RIP/SNMP)
  2. transport –> host to host transport (TCP/UDP)
  3. Network + data link –> internet layer (ARP/IP/IGMP/ICMP)
  4. data link + physical –> network interface layer (ethernet/token ring/ frame)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

what are the step in cybersecurity kill chain

A
  1. reconnaissance
  2. weaponization
  3. delivery
  4. exploitation
  5. installation
  6. command & control
  7. actions on objectives
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

what are the different type of network topologies (physical layer)

A
  1. Bus -> central LAN cable to which all nodes connect advantage: adding is easy / node failure don’t affect network
    disadvantage: if central LAN failure then entire network drop
  2. Tree -> hierarchy of objects
    advantage: adding is easy / node failure don’t affect network
    disadvantage: if central LAN failure then entire network drop
  3. Ring -> closed-loop with central point transmitted
    advantage: use token - time stamp / used as LAN or network backbone
    disadvantage: single point of failure (e.g., fiber distributed data interface (FDDI) use dual rings for failure)
  4. Mesh -> mesh network connecting all nodes
    advantage: high level of redundancy
    disadvantage: expensive
  5. star -> all nodes connected to a hub, switch or router (used in modern LAN)
    advantage: fewer cable than mesh / easy to deploy
    disadvantage: central connection is single point of failure
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

what is the role of a “carrier sense multiple access with collision detection (CSMA/CD)”

A

protocol allows devices to transmit data with minimum overhead, resulting in bandwidth efficiency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

types of optical fiber cable

A
  1. single-mode: small diameter -> up to 100KM
  2. Multimode: large diameter -> up to 2KM
  3. plastic optical fiber (POF) -> up to 100m
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

what is a “modem”

A

“modulate” - “demodulate” devices used to modulate digital signals to analog wave and vis-versa

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

what are the types of digital subscriber lines (DSL)

A
  • asymmetric DSL -> ADSL: downstream higher than upstream
  • Rate-adaptive DSL -> RADSL: upstream based on quality line
  • symmetric DSL -> SDSL: downstream & upstream are same
  • Very high bite rate DSL -> VDSL high transmission (52mbps)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

what is the role of a dynamic host configuration protocol (DHCP)

A

DHCP’s role is to assign IP address to devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

what OSI layer uses MAC address to redirect communications

A

Data link layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

what is Address Resolution Protocol (ARP)

A

used at the MAC layer to provide direct communication between 2 devices within the same LAN segment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

what is a Point-to-point protocol (PPP) (PPPoE -> over Ethernet)

A

mechanism for establishing a layer 2 (data link) connection between 2 systems, e.g. internet service provider (ISP) and customer device

provides a standard method for transporting multiprotocol datagrams over point-to-point link

PPPoE: creates a virtual point to point connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

what is a Fibre channel over ethernet (FCoE)

A

provides a single layer 2 (data link) environment to manage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

what is a contention-based protocol?

A

devices on network are competing for bandwidth, contention-based protocols are meant to avoid inference / collision:

  1. CSMA/CD: device on LAN that listen for a carrier before transmitting data
  2. Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA): better for wireless environment -> avoid collisions by first checking the media is clear for transmission
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

what is a layer 2 “bridge”

A

device that filter traffic between segments based on MAC addresses. additionally they amplify signals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

what is a switch

A

layer 2 switch establishes on collision domain per port, enabling more efficient transmissions with CSMA/CD logic within ethernet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

what is a Virtual Local Area Network (VLAN)

A

VLANs allow admin to use switches to create software-based LAN segments, which can segregate or consolidate traffic across multiple switch ports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

key threats to layer 2 (data link)

A
  • MAC address spoofing
  • MAC flooding -> DoS attack
  • VLAN hopping -> 802.1Q attack
  • Broadcast storms -> DoS attack
  • Reconnaissance probes using MAC sniffing -> capture frames
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

key layer 2 (data link) counter measures to threats

A
  • Proper NIC configuration
  • Service monitoring (ARP/ DHCP)
  • proper VLAN configuration
  • proper switch port configuration
  • Layer 2 IDS/IPS
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

what does layer 3 (network) uses to redirect communications

A

IP address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

what are the 2 main goals of layer 3 (network)

A
  1. managing the logical addressing for networks
  2. forwarding packets to the correct logical network
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

what are the forms of transmission in layer 3 (network)

A
  1. Unicast -> 1-to-1 communication
  2. Broadcast -> one to many communication
  3. Multicast -> 1 host to a discrete group of host
  4. Anycast -> 1-to-1 transmission but uses services from group
  5. Geocast -> same as broadcast but restrictes destination of IP address geographically (think Netflix stream)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

what are network layer protocols

A
  • IPv4 provides a 32-bit address space
  • IPv6 provides a 128-bit address space

Note: IPv4 and IPv6 use 2 different headers, therefore network cannot operate on both simultaneously

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

what are the 5 key network protocols and octet range

A
  • class A -> 1-126 (subnet mask 255.0.0.0)
  • class B -> 128-191 (subnet mask 255.255.0.0)
  • class C -> 192-223 (subnet mask 255.255.255.0)
  • class D -> 224-239 (subnet mask 255.255.255.255) -> for multi casting
  • class E -> reserved for development & testing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

what are the advantage of IPv6

A
  • longer address field
  • improved security
  • improved QoS
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

what are routers most used for today

A

connect LAN to WAN

most basic security at layer 3 on router incl Access Control List (ACL) that approve/deny source and destination address. these routers are also called “boundary routers”, positioned on the DMZ

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

what are the 2 key meanings of Access Control List

A

routing: it is a table within a route’s memory that stores permitted

identity mgmt & access control: they are data structure that are usually keyed or indexed by user IDs and related those IDs to authorization information of various kind

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

what is the difference between routing protocol & routed protocol

A

Routing protocol: used by routers to communicate and coordinate with each other -> e.g., ICMP / IGMP

Routed protocols: define HOW data can be routed over a network. IPv4 and IPv6 are routed protocols

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

what protocol was created to increase WAN traffic efficiency (routing)

A

routing tables calculation for each packet use a lot of router computational resources creating latency.

“Multiprotocol label switching” (MPLS) is a WAN protocol design to increase WAN efficiency.

it operates on layer 2 (data link) and layer 3 (network)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

what are the primary components of an MPLS network

A
  1. MPLS edge node
  2. label switching router (LSR)
  3. label switch path
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

what are the key advantages of MPLS

A
  • traffic engineering
  • multi-service network
  • network resiliency
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

what are the key threats to layer 3 (network)

A
  • routing (RIP) attack
  • ICMP attack
  • Ping flooding
  • SMURF using
  • IP address spoofing
  • packet sniffing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

what are the key countermeasures to protect layer 3 (network)

A
  • SICMP
  • properly config routers
  • packet filtering and inspection -> NGFW
  • router ACLs more effectively
  • properly config VLAN
  • layer 2 IDS/IPS
  • zero trust architecture
  • micro-segmenting LANs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

what does layer 4 (transport) do

A

it delivers end-to-end services through segments transmitted in a stream of data and controls stream of data to relieve congestion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

what are the 2 types of transport protocols (TCP/IP)

A

TCP - transmission control protocol - connection-oriented protocol -> provides packet sequencing

UDP - connectionless protocol -> does NOT support retransmission of packet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

what are layer 4 protocols by group

A
  • transport -> TCP UDP
  • Names & directory services -> DNS / LDAP
  • Network operational support & mgmt -> NTP / DHCP
  • web page oriented -> HTTP / HTTPS
  • email -> POP / IMAP SMTP
  • admin & miscellaneous -> FTP / SSH / Telnet
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

how does TCP establish connection

A

using a three-way handshake

1a. SYNchronize
1b.SYN-ACKnowledge

2a. ACK
2b. Data ACK (using the connection…)

3a. FINish
3b. ACK + FINish
3c. ACK

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

what are the categories of TCP & UDP ports

A
  • well-known ports -> 0-1023
  • registered ports -> 1024-49151
  • dynamic or private ports -> 49152-65535
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

primary use of 20/21

A

file transfer protocol -> FTP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

primary use of 22

A

secure shell -> SSH

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

primary use of 23

A

Telnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

primary use of 25 or 587

A

SMTP

43
Q

primary use of 37

A

TIME

44
Q

primary use of 53

A

domain name services ->DNS

45
Q

primary use of 69

A

Trivial file transfer protocol -> TFTP

46
Q

primary use of 80

A

HTTP

47
Q

primary use of 161

A

simple network mgmt protocol -> SNMP

48
Q

primary use of 162

A

SNMP trap

49
Q

primary use of 179

A

border gateway protocol

50
Q

primary use of 443

A

HTTPS

51
Q

traditional firewall vs. NextGen firewall

A

tradition:
- firewall / ports / IP address
- IDS / IPS
- web proxy
- antivirus gateway
- VPN

NextGen firewall
- IAM / Attributes
- anti-bot
- FaaS
- firewall / ports / IP address
- IDS / IPS
- web proxy
- antivirus gateway
- VPN

52
Q

what are the main threat to layer 4 (transport)

A
  • routing protocol attack
  • ICMP attack - eg., ping flooding
  • network time protocol desynch
  • fraggle - UDP broadcast flood
  • TCP sequence prediction
  • IP address spoofing
  • packet sniffing
  • port scanning
53
Q

what are the countermeasures for layer 4 (transport)

A
  • TCP intercept & filtering
  • DoS prevention services
  • allowed & blocked list for IP address, URL, URI
  • properly config TLS
  • secure protocol for file transfer
  • fingerprint scrubbing
54
Q

what is the main goal of layer 5 (session layer)

A

provide logical persistent connection between peer hosts

responsible for creating, maintaining and tearing down the session

55
Q

what are layer 5 (session) authentication protocols

A
  • password authentication protocol (PAP)
  • Challenge-handshake authentication protocol (CHAP)
  • Extensible authentication protocol (EAP)
  • protected extensible authentication protocol (PEAP)
56
Q

what are the main threats to layer 5 (session)

A
  • session hijack / MITM
  • ARP / DNS / poisoning local hosts files
  • secure shell (SSH) downgrade
  • man-in-the-browser (MITB)
57
Q

what are the main countermeasures to protect layer 5 (session)

A
  • replace weak password authentication protocol
  • ID mgmt & access control
  • PKI implementation
  • properly config DNS
  • active monitoring
  • IDS / IPS / SIEM alarms
58
Q

what is the main goal of layer 6 (presentation)

A

consolidate the design of protocols and services

59
Q

what are the main threats to layer 6 (presentation)

A
  • data breach
  • compromise integrity
  • SMBs attack
  • SSL attack
60
Q

what are the main countermeasures to protect layer 6 (presentation)

A
  • strong authentication & protection based apps
  • monitor apps traffic
  • secure application protection (WAF)
  • zero trust architecture
61
Q

what is the main goal of the layer 7 (application)

A

used by end-user to accomplish daily task and application usage

62
Q

what are layer 7 (application) main type of protocol

A
  • HTTP
  • HTTPS - using TLS to create session
  • DHCP
  • DNS
  • SNMP -> simple network mgmt protocol
  • LDAP -> lightweight directory access protocol
63
Q

what is Dynamic host configuration protocol (DHCP)

A

client/server application designed to assign IP addresses from a pool of pre-allotted addresses on a DHCP server

64
Q

what are the common attributes for an LDAP entry level

A
  • distinguished name (DN)
  • relative distinguished name (RDN)
  • common name (CN)
  • domain component (DC)
    -organizational unit (OU)
65
Q

what is the goal of SNMP (simple network mgmt protocol)

A

designed to manage network infrastructure

66
Q

what are the main threat to layer 7 (application)

A
  • SQL injection
  • encryption downgrade attempt
  • rogue DHCP service / DNS poisoning / LDAP injection
  • SNMP abuse
  • HTTP flood -> DoS
  • cross-site script attack
67
Q

what are the main countermeasures to protect layer 7 (application)

A
  • monitoring
  • block suspect bots
  • strong access control (MFA)
  • deep inspection of app traffic
  • secured apps protection (WAF / ADP)
  • zero trust architecture
  • strengthen end user skills
68
Q

what are the main Internet Protocol (IP) issues

A
  • authenticity
  • confidentiality
  • scripting
  • social engineering
  • spam over instant message
  • legacy remote access
69
Q

what is the advantage of Internet protocol secure (IPSec)

A
  • authentication header (AH)
  • encapsulating security payload (ESP) : Header / payload / trailer / authentication
70
Q

what are some use case for NAC deployment

A
  • medical device
  • IoT devices
  • incident response
  • BYOD
  • guest user and contractors
  • cloud
  • compliance
  • mobile device
71
Q

what is a port address translation (PAT)

A

extension to NAT, translate all addresses to one externally routable IP address

72
Q

what are the main security implications of remote computing

A
  • people issue
  • networking & communication vulnerabilities
  • attention from threat actors
  • implementation issues
73
Q

what is a circuit switched network?

A

uses a dedicated circuit between endpoints. neither endpoints starts communicating until the circuit is completely established

74
Q

what is a network function virtualization and advantage

A

NFV’s objective is to decouple functions, such as firewall mgmt, intrusion detection, NAT or name service resolution, away from specific hardware implementation into software service

75
Q

what are best practice in 3rd party mgmt

A
  • policies for establishing, onboarding, monitoring, managing and offboarding 3rd party
  • inventory of 3rd party relationship and evaluation against policies to identify risk
  • apply monitoring & auditing practices
76
Q

what is a DNS

A

convert IP addresses and domain names

77
Q

what is ARP

A

convert between MAC address and IP address

78
Q

what is NAT

A

convert between public IP and private IP addresses

79
Q

how does IPsec provide secure channel (VPN)

A

IPsec uses authentication headers (AH) to provide authentication, integrity and non-repudiation, and Encapsulating Security Payload (ESP) to provide confidentiality

80
Q

Sue’s employer has asked her to use an IPsec VPN to connect to its network. When Sue connects, what does the IPsec VPN allow her to do? Sue’s employer has asked her to use an IPsec VPN to connect to its network. When Sue connects, what does the IPsec VPN allow her to do?

A

Create a private encrypted network carried via a public network and act like she is on her employer’s internal network

81
Q

Sonia recently removed an encrypted hard drive from a laptop and moved it to a new device because of a hardware failure. She is having difficulty accessing encrypted content on the drive despite the fact that she knows the user’s password. What hardware security feature is likely causing this problem?

A

TCB

The Trusted Platform Module (TPM) is a hardware security technique that stores an encryption key on a chip on the motherboard and prevents someone from accessing

82
Q

Gordon is concerned about the possibility that hackers may be able to use the Van Eck radiation phenomenon to remotely read the contents of computer monitors in his facility. What technology would protect against this type of attack?

A

TEMPEST

The TEMPEST program creates technology that is not susceptible to Van Eck phreaking attacks because it reduces or suppresses natural electromagnetic emanations.

83
Q

What important factor listed below differentiates Frame Relay from X.25?

A

Frame Relay supports multiple PVCs over a single WAN carrier connection.

84
Q

During a security assessment of a wireless network, Jim discovers that LEAP is in use on a network using WPA. What recommendation should Jim make?

A

Use an alternate protocol like PEAP or EAP-TLS and implement WPA2 if supported.

LEAP, the Lightweight Extensible Authentication Protocol. is a Cisco proprietary protocol designed to handle problems with TKIP. Unfortunately, LEAP has significant security issues as well and should not be used. Any modern hardware should support WPA2 and technologies like PEAP or EAP-TLS. Using WEP, the predecessor to WPA and WPA2, would be a major step back in security for any network.

85
Q

Ben has connected his laptop to his tablet PC using an 802.11g connection. What wireless network mode has he used to connect these devices?

A

Ad hoc mode

86
Q

What common applications are associated with each of the following TCP ports: 23, 25, 143, and 515?

A

Telnet, SMTP, IMAP, and LPD

87
Q

Which authentication protocol commonly used for PPP links encrypts both the username and password and uses a challenge/response dialog that cannot be replayed and periodically reauthenticates remote systems throughout its use in a session?

A

CHAP

The Challenge-Handshake Authentication Protocol, or CHAP, is used by PPP servers to authenticate remote clients. It encrypts both the username and password and performs periodic reauthentication while connected using techniques to prevent replay attacks.

88
Q

If the VPN grants remote users the same access to network and system resources as local workstations have, what security issue should Chris raise?

A

VPN users should only connect from managed PCs.

89
Q

Susan is deploying a routing protocol that maintains a list of destination networks with metrics that include the distance in hops to them and the direction traffic should be sent to them. What type of protocol is she using?

A

A distance-vector protocol

90
Q

What network tool can be used to protect the identity of clients while providing Internet access by accepting client requests, altering the source addresses of the requests, mapping requests to clients, and sending the modified requests out to their destination?

A

A proxy

A proxy is a form of gateway that provide clients with a filtering, caching, or other service that protects their information from remote systems.

91
Q

Which email security solution provides two major usage modes: (1) signed messages that provide integrity, sender authentication, and nonrepudiation; and (2) an enveloped message mode that provides integrity, sender authentication, and confidentiality?

A

S/MIME

S/MIME supports both signed messages and a secure envelope method. While the functionality of S/MIME can be replicated with other tools, the secure envelope is an S/MIME-specific concept.

92
Q

What type of key does WEP use to encrypt wireless communications?

A

A predefined shared static key

WEP has a very weak security model that relies on a single, predefined, shared static key. This means that modern attacks can break WEP encryption in less than a minute.

93
Q

The Address Resolution Protocol (ARP) and the Reverse Address Resolution Protocol (RARP) operate at what layer of the OSI model?

A

Layer 2

ARP and RARP operate at the Data Link layer,

94
Q

Which of the following is a converged protocol that allows storage mounts over TCP, and which is frequently used as a lower-cost alternative to Fibre Channel?

A

iSCSI

iSCSI is a converged protocol that allows location-independent file services over traditional network technologies.

95
Q

In her role as an information security professional, Susan has been asked to identify areas where her organization’s wireless network may be accessible even though it isn’t intended to be. What should Susan do to determine where her organization’s wireless network is accessible?

A

A site survey

96
Q

SMTP, HTTP, and SNMP all occur at what layer of the OSI model?

A

Layer 7

Application-specific protocols are handled at layer 7, the Application layer of the OSI model.

97
Q

Lauren uses the ping utility to check whether a remote system is up as part of a penetration testing exercise. If she wants to filter ping out by protocol, what protocol should she filter out from her packet sniffer’s logs?

A

ICMP

Ping uses ICMP, the Internet Control Message Protocol, to determine whether a system responds and how many hops there are between the originating system and the remote system

98
Q

Lauren wants to provide port-based authentication on her network to ensure that clients must authenticate before using the network. What technology is an appropriate solution for this requirement?

A

802.1x

802.1x provides port-based authentication and can be used with technologies like EAP, the Extensible Authentication Protocol.

99
Q

There are four common VPN protocols. Which group of four below contains all of the common VPN protocols?

A

PPTP, L2F, L2TP, IPsec

100
Q

What network technology is best described as a token-passing network that uses a pair of rings with traffic flowing in opposite directions?

A

FDDI

FDDI, or Fiber Distributed Data Interface, is a token-passing network that uses a pair of rings with traffic flowing in opposite directions

101
Q

If your organization needs to allow attachments in email to support critical business processes, what are the two best options for helping to avoid security problems caused by attachments?

A

Train your users and use anti-malware tools.

102
Q

Chris has been asked to choose between implementing PEAP and LEAP for wireless authentication. What should he choose, and why?

A

PEAP, because it can provide a TLS tunnel that encapsulates EAP methods, protecting the entire session

103
Q

Which type of firewall can be described as “a device that filters traffic based on its source, destination and the port it is sent from or is going to”?

A

A static packet filtering firewall

104
Q

Data streams occur at what three layers of the OSI model?

A

Application, Presentation, and Session

Work (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions