Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Info Sec > Chapter 10 > Flashcards

Chapter 10 Flashcards

1
Q

Two ways to protect malware (and their advantages and disadvantages):

A

1) signature-based

Advantage: Accuracy is really high.

Disadvantage: You will miss new attacks, they can easily pass checking.

2) anomaly-based

compares against baseline traffic on network

Advantage: Accomodates new types of attacks

Disadvantage: “operation i usually see is different”
May generate false positive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Where to focus for Network Security (4 points)?

A
  • Protecting networks
  • Protecting network traffic
  • Mobile device security
  • Network security tools
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

A well-configured and patched network is the _______ of any security program

A

foundation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is Network segmentation?

A

• Divide a network into multiple smaller independent networks, called a subnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How can we control the flow of traffic between subnets?

A

o Allowing or disallowing traffic

o Blocking the traffic entirely

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

We can control traffic flow within the subnet for _______ purposes

A

troubleshooting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

True or False: Traffic monitoring is easier in subnets

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Why do we funnel Network Traffic through choke points?

A

to inspect, filter, and control the traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are Choke points?

A

o Routers that move traffic from one subnet to another

o Firewalls or proxies that control traffic moving within, into, or out of our networks or portions of our networks

o Application proxies that filter the traffic for particular applications such as Web or e-mail traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Choke points come with some risk because if they ____ the network is _______

A

fail

compromised

“Choke points come with some risk because if they fail the network is compromised”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Redundancy helps to…

A

mitigate risk to our networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Technical issues or attacks may impact network _______ devices; hence, network operations.

A

infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Good network design considers planned ________ for devices failing, connectivity loss etc.

A

redundancy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Give an example of planning for redundancy:

A

In the even of a DDoS attack to a border device:

oRedundancy will allow us switch to a different connection to the Internet, or toute traffic through a different device until we solve current issue

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a firewall?

A

A mechanism for maintaining control over the traffic that flows into and out of our network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Where should we place firewalls, typically?

A
  • Typically on the border between our internal network and the Internet
  • Can also be placed within our network for access control
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What should we filter with firewalls?

A

Based on a variety of factors and largely depends on the complexity of the firewall

• Example: we may allow Web and e-mail traffic to pass, but block everything else

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is Packet Filtering?

A
  • Inspecting contents of each packet individually to make a decision
  • Based on the source and destination IP addresses, the port number, and the protocol being used
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

_____ _______ is one of the oldest and simplest of firewall technologies

A

Packet Filtering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Which firewall has the disadvantage that “it is possible to slip attacks through this type of firewall as packets are inspected individually”

A

Packet Filtering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the function of a Stateful Firewall?

A

Same working principle as in packet filtering, but a Stateful Firewall keeps track of the traffic at a granular level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

A stateful firewall is able to watch the traffic over a ____ _______.

A

given connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

The connection state, as monitored by a stateful firewall, is maintained in a ____ ____.

A

state table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

A given connection is defined by:

A

the source and destination IP addresses, the ports being used, and the already existing network traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

True or False? A stateful firewall allows traffic that is part of a new or already established connection.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Difference between stateful firewall and packet inspection?

A

Stateful firewall assesses an entire connection while packet inspection is about inspecting individual packets

Best security policy is to put these two together

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Most stateful firewalls can also function as a _____ ______ firewall, often combining the two forms of filtering.

A

packet filtering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

A stateful firewall that also has a packet filtering component can do the following (2 objectives):

A
  • Can identify and track the traffic related to a particular user initiated connection to a Web site
  • Knows when the connection has been closed and further traffic should not legitimately be present
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Example of a scanning tool?

A

Nmap

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

True or False: Packet filtering and stateful firewalls only inspect the structure of packets without inspecting the content.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

______ adds extra layer of intelligence to firewalls through packet-content inspection.

A

Deep Packet Inspection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Deep Packet Inspection can block a large number of attacks at the price of ____.

A

delay

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Deep Packet Inspection introduces ______ issue as content of our packets are inspected.

A

privacy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Proxy servers are…

A

A specialized variant of a firewall that can serve as a choke point

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Proxy servers offer these functionalities (2):

A
  • Offer security and performance by filtering unwanted traffic
  • Allow us to log the traffic that goes through them for later inspection
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What are some applications of proxy servers (3)?

A

Applications:

•Spam, Web traffic, and malware filtering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

True of False: Nmap is a very useful tool for both OS and network

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is a Demilitarized Zone (DMZ) as it pertains to network security?

A

A combination of a network design feature and a protective device such as a firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What are DMZs used for?

A

Used to offer security for mail servers, proxy servers, software as a service application, and Web servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Draw a diagram of a DMZ

A

https://i.imgur.com/oiFFYDN.png

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What does IDS stand for in network security?

A

Intrusion Detection Systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is penetration testing?

A

Actively trying to break the system and analyze its level of security that way

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What does an Intrusion Detection System do?

A

monitors networks, hosts, or applications to which it is connected for unauthorized activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What are 3 types of IDS?

A
  • Host-based intrusion detection systems (HIDSes)
  • Application protocol-based intrusion detection systems (APIDSes)
  • Network-based intrusion detection systems (NIDSes)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What does NIDSes stand for?

A

Network-based intrusion detection systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What does APIDSes stand for?

A

Application protocol-based intrusion detection systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What does HIDSes stand for?

A

Host-based intrusion detection systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Placement of ______ important to efficiently monitor ongoing network traffic without overwhelming the _____.

A

NIDSes

Placement of NIDSes important to efficiently monitor ongoing network traffic without overwhelming the NIDSes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Draw a diagram of an IDS:

A

https://i.imgur.com/ureBoKc.png

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

NIDSes may miss _____ _____ _____.

A

packet crafting attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What are packet crafting attacks?

A
  • specifically designed packets of traffic that carry attacks or malicious code
  • designed to avoid detection by IDSes, firewalls, and other similar devices
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Common defense in-depth security program combine _____ and _____.

A

firewalls and IDSs

53
Q

What is the difference between Signature-based detection and Anomaly-based detection in an IDS? (diagram)

A

https://i.imgur.com/gIHZNre.png

54
Q

True of false: Signature-based detection does not work similar to most antivirus systems.

A

False: Signature-based detection does works similar to most antivirus systems.

55
Q

Signature-based detection maintains a database of _____ that signal a particular type of attack

It compares incoming traffic to those signatures.

A

signatures

56
Q

Signature-based detection is usually precise if the signature _______ is up-to-date

A

database

57
Q

True of False: Attackers may test crafted packets on the same IDS tools that we use to avoid our security measures

A

True

58
Q

Anomaly-based detection uses a ______ of normal traffic and activity on the network

A

baseline

59
Q

________-based detection measures the present state of traffic against this baseline

A

Anomaly

60
Q

True or False: Anomaly-based detection is useful to detect new attacks or attacks that have been deliberately assembled to avoid IDSes.

A

True

61
Q

What is a disadvantage of anomaly-based detection?

A

It has a high rate of false positives compared to the signature-based IDSes (if the traffic on the network changes from the baseline, anomaly-based detection may consider that as an attack)

62
Q

True or False: we can combine both detection anomaly-based and signature-based methods.

A

True

63
Q

When data travel across networks it can be exposed to _____ people. (If we use applications or protocols that do not encrypt what they are sending over the network)

A

unwanted

64
Q

A ______ network is more prone to attack.

A

Wireless

An open wireless network for public access does not offer any encryption.

65
Q

How can we ensure protection over wireless networks?

A

Deploy VPNs

66
Q

Virtual private networks allow us to…

A

send sensitive traffic over unsecure networks

67
Q

True or False: VPNs can create a secure connection to the private network of an organization

A

True

68
Q

Draw a diagram of a VPN:

A

https://i.imgur.com/RpH3CpA.png

69
Q

A VPN connection is called a ______.

A

tunnel (An encrypted connection between two end points)

70
Q

In one end of the connection there is a VPN _____ application and the other end hosts a VPN ______.

A

client

concentrator

In one end of the connection there is a VPN client application and the other end hosts a VPN concentrator.

71
Q

The client uses a software to authenticate to the VPN ______.

A

concentrator

72
Q

What are the advantages of VPN?

A
  • Allow us access the internal resources of our organization
  • Protect traffic that is sent over untrusted connections
  • Allowing us to protect the contents of traffic

o from logging by our ISPs or being sniffed by others on the same network, to obscure our geographical location and bypass location oriented blocking

•Useful in peer-to-peer (P2P) file-sharing services

o VPNs can allow both the traffic and the actual IP addresses to remain hidden

73
Q

What is a Rogue access point (RAP)?

A

placing an access point on our wireless network without authorization

74
Q

True or False: If a RAP is set up with poor or no security, it will allow anyone within range of the access point access our network.

A

True

75
Q

How can we Avoid Rogue access points (RAPs)?

A

Carefully document the legitimate devices that are part of our wireless network infrastructure and regularly scan for additional devices using wireless scanning tool

76
Q

How can we protect traffic passing through the legitimate devices in our network?

A

Data encryption

77
Q

The most common encryption for 802.11 devices

are (3):

A

o Wired Equivalent Privacy (WEP)
o Wi-Fi Protected Access (WPA), and
o Wi-Fi Protected Access version 2 (WPA2)

78
Q

____ is the most current encryption and offers the strongest inherent security.

A

WPA2

79
Q

File Transfer Protocol (FTP) is for ______ ____.

A

transferring file

80
Q

_____ is for interacting with remote machines.

A

Telnet

81
Q

Post Office Protocol (POP) for _____ ___.

A

retrieving e-mail

82
Q

True or False: We must use Secure Shell (SSH) instead of Telnet.

A

True

83
Q

We must use _______________ instead of FTP, which is also SSH based.

A

Secure File Transfer Protocol (SFTP)

84
Q

SSH supports many types of traffic over it such as (3 items):

A

o It can be used for file transfers and terminal access
o when connecting to a remote desktop
o communicating over a VPN

85
Q

The encryption used by SSH is ____, a public key encryption algorithm

A

RSA

86
Q

What is RSA?

A

a public key encryption algorithm

87
Q

What is a mobile device?

A

Any device that can access external systems or be acceded while not behind the organizations’ security infrastructure
o Smartphones, tablets, smartwatches, USB, laptops, etc

88
Q

What are Applications of a mobile device?

A

Send and receive e-mail, surf the web, manipulate documents, play videos, listen to music, play games, etc.

89
Q

What are some characteristics of a mobile device?

A

o Powerful hardware resources and capabilities
o Connected to a network of some variety at all times
o They move in and out of environments with regularity
o Store and transmit data without notice
o May or may not be compliant with basic security measures

90
Q

What do we want to manage for mobile devices?

A

oPatching and software upgrades
oForce changing of passwords at some interval
oRegulate and track installed software
oAdjust settings to a standard dictated by our policies

91
Q

An MDM solution mostly utilize an agent on the mobile device to enforce a certain configuration. These agents…

A

o Regulate access to enterprise resources, such as e-mail, calendaring, or network resources
o Can discontinue access by the client

92
Q

Many MDM solutions enable the device to be remotely ____ or disabled.

A

wiped

93
Q

In order to reduce load on administrative resources and enable a greater uniformity across devices…

A

we can try to manage both mobile and nonmobile devices using the same tools and techniques

94
Q

BYOD (Bring Your Own Device)

An organization’s strategy and policies regarding the use of personal versus corporate devices either:

A

oAllow only corporate-owned devices to interact with enterprise resources
oAllow only personal devices
oAny combination in between

95
Q

Allow only Corporate-owned Devices

Enables more uniform and secure base of mobile devices for the organization to manage

Management and policies:

A

o We may disallow the use of personal e-mail and file-sharing applications
o Disable the capability of installing new applications that are not business related
o We can also force users to install updates and security patches, and change their password regularly

96
Q

Disadvantages of Allowing only Personal Devices:

A

•not easy to deploy a uniform and secure MDM

We can have a minimal control over personal devices
o For example, connecting them to a centralized mail server, such as Microsoft Exchange

•Good choice for a very small organization with minimal resources to administer a complex mobile infrastructure

97
Q

To enable a balance between cost and risk management

A

Allow Personal and Corporate-owned Devices

98
Q

We deploy penetration testing in a regular basis to…

A

o To catch up with the environmental changes

o To accommodate new attacks

99
Q

We can test security tools using a Security Live CD distributions that come with all of the tools preconfigured

Give an example.

A

For example: Kali

100
Q

To detect unauthorized devices like Rogue APs, some software we can use are (3 examples):

A

Kismet:
oRuns on Linux and can be found on the Kali distribution
oCommonly used to detect wireless APs

•NetStumbler:
oSimilar to Kismet; runs on Windows

•coWPAttyand Aircrack-NG
o To break through the different varieties of encryption
o Cracking WEP, WPA, and WPA2

101
Q

What are port scanners?

A

tools for discovering the networks and systems that are in our environment

102
Q

Two main categories of scanners:

A

o port scanners

o vulnerability scanners

103
Q

What is Network mapper (Nmap)?

A

o a port scanner
o can also search for hosts on a network
o Identify the operating systems those hosts are running
o detect the versions of the services running on open ports

104
Q

What are packet sniffers?

A

Tools that sniff network traffic

105
Q

What is Tcpdump?

A

o A command-line tool that allows us to monitor the activities of the network to which we are attached
o Can filter traffic
o Usually runs only on UNIX-like operating systems
o A version has been ported to Windows, called WinDum

106
Q

What is Wireshark?

A

o Capable of intercepting traffic from a wide variety of wired and wireless sources
o It includes a large number of filtering, sorting, and analysis tools
o Can also import data from other applications like Tcpdump
o Agreat tool for troubleshooting traffic on the networ

107
Q

_____ is a specialized wireless networks sniffer

A

Kismet

108
Q

_______ ______ ______ from Fluke Networks is a hardware packet sniffer

A

OptiViewPortable Network Analyzer

usually very expensive and well beyond the budget of the average network or security professional

109
Q

What is a honeypot?

A

A honeypot can detect, monitor, and sometimes tamper with the activities of an attacker

110
Q

Honeypots are configured to deliberately display ______ to attract an attacker

A

vulnerabilities

111
Q

Examples of honeypots (3):

A

o An intentionally vulnerable service
o An outdated and unpatched operating system
o A network share named “top secret UFO documents”

112
Q

We deploy honeypots to…

A

o To provide an early warning system for a corporation
o As a method of researching what methods attackers are using
o As an intentional target to monitor the activities of malware in the wild

113
Q

______ are collections of honeypots with varying configurations and vulnerabilities

A

Honeynets

114
Q

Honeynets generally come with some centralized instrumentation for ______ all the honeypots on the network

A

monitoring

115
Q

True or False: Honeynets can be particularly useful for large-scale monitoring of malware activity

A

True

116
Q

The firewall tool Hping3 can:

A

• Can construct specially crafted Internet Control Message Protocol (ICMP) packets for firewall testing

• We can also script the activities of Hping3 to test the responses of firewalls and IDSes
o To get an idea of the rules on which they are operating

• It can perform port scanning

117
Q

Network-focused business (eBay and Amazon) must…

A

o Must have rigid security measures in place

o Must continuously evaluate them in order to find weaknesses

118
Q

Secure network design involves:

A
  • Segmentation, Choke points, and Redundancy

- Implement security devices such as firewalls and IDSes to protect us both inside and outside our networks

119
Q

We protect our traffic by…

A

o We use VPNs to secure our connections over untrusted networks
o We can use security measures specific to wireless networks
o We can make use of secure protocols as a general security measure

120
Q

We use security tools:

A

o Kismet or NetStumbler in wireless networks
o Wiresharkor Tcpdumpto network trafficoNmapto scan network devices
o hping3 to test firewalls

121
Q

We place honeypots:

A

o To attract and study attackers and their tools and to alert us to their presence

122
Q

The _____ of an IDS is import for efficient network monitoring

a. Features
b. Processing power
c. Placement
d. Memory

A

c.Placement

123
Q

An unauthorized Access Point in a wireless network is called a:

a. Sniffer
b. Rogue
c. Booster
d. None of the above

A

b.Rogue

124
Q

The most common protocol for wireless devices is

a. 802.16
b. 802.15
c. 802.11
d. 802.20

A

c.802.11

125
Q

Secure Shell (SSH) uses ______ encryption algorithm

a. DES
b. DES3
c. RSA
d. RSA3

A

c.RSA

126
Q

Nmap stands for

a. Nice map
b. Niche map
c. Network map
d. Network mapper

A

d.Network mapper

127
Q

What are the drawbacks of Network-based Intrusion Detection Systems?

A

Answer: NIDSes may miss to detect packet crafting attacks. They may suffer from false positive. They may not process encrypted packets.

128
Q

Compare and contrast signature-based and anomaly-based IDS detection methods?

A

Answer: Signature-based IDSes maintain a database of the signatures that might signal a particular type of attack and compare incoming traffic to those signatures. The problem is in case of a new type of attack it may fail to detect that attack. Anomaly-based IDSes typically work by taking a baseline of the normal traffic and activity taking place on the network. They can measure the present state of traffic on the network against
this baseline to detect attack. They are better to detect new attacks.

129
Q

What are the advantages of using VPNs?

A

Answer: VPNs offer a secure connection between two end points over an untrusted network. Also, they protect the content of traffic. VPNs are useful in peer-to-peer file sharing/

Info Sec (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions