Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

SY0-601 > Chapter 3 Cloud and Physical Security > Flashcards

Chapter 3 Cloud and Physical Security Flashcards

1
Q

What are the types of monitoring in network design?

A

Signature-based, network-based, and anomaly-based

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Explain network-based monitoring.

A

Attached to the network in a place where it can monitor all traffic for passive and active responses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Explain signature-based monitoring.

A

Watches for intrusions that match a known identity or signature against a “signature database”. Requires regular updates.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Explain anomaly-based monitoring.

A

Detects unusual activities based on an initial learning period before anomalies can be detected. Is also referred to as behavior-based and heuristic-based detection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Explain behavioral-based monitoring.

A

Monitors behavior that is not allowed and acts accordingly.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is an appliance firewall and another name for it?

A

A “hardware firewall” is designed to be a stand-alone solution that can be plugged into a network and operated with minimal configuration and maintenance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is IPSec?

Hints: What are the security protocols? What are the modes?

A

IPSec uses ESP (Encapsulating Security Payload) and AH (Authentication Header) as security protocols. It can operate in tunnel mode (entire packet is encrypted) or transport mode (only the payload is encrypted). IPSec sets a secure channel using strong encryption and authentication between two network devices, often providing implementation in securing VPN communications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the different WAP’s?

A

Controller-based, thin, and fat (a.k.a. stand-alone).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a controller-based WAP?

A

A wireless access point that allows the management of all WAPs in the network from a centralized location, allowing consistent configuration settings for updates and policies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a fat WAP?

A

Fat wireless access points (stand-alone) can be remotely configured however they must be manually configured. They also don’t allow management of several WAP’s from a single location.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a thin WAP?

A

Thin wireless access points allow configuration from a switch or router

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a PIV?

A

Personal Identity Verification cards are certificate-based smart cards that have a picture, integrated chip, two bar codes, and a magnetic strip. These are issues to non-military federal employees and contractors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a CAC?

A

Common Access Cards are certificated-based smart cards that have a picture, integrated chip, two bar codes, and a magnetic strip. These are issued by the DoD (Department of Defense) to military personnel and contractors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the different types of antennas?

A

Omni, Yagi, Sector, and Dipole.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is an Omni antenna?

A

Multi-directional antenna that radiates radio waves in all directions uniformly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a Yagi antenna?

A

A directional antenna with a high gain and a narrow radiation pattern

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is a Sector antenna?

A

A directional antenna with a circle measured in degrees of arc radiation pattern

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is a Dipole antenna?

A

The most widely used antenna with a radiation pattern shaped like a doughnut.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is a CRL in a PKI, in regards to a CA?

A

A certificate revocation list (CRL) contains a list of serial numbers for digital certificates that have not expired, but that a certification authority (CA) has specified to be invalid.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is a KDC and what is it used for?

A

A Key Distribution Center (KDC) is used in Kerberos network authentication to distribute resource access keys.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is a dual-homed firewall?

A

A firewall with TWO network interfaces for network segregation. One with connection to a public network (the internet) and the other connecting to the private network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is a screened subnet?

A

Another term for a DMZ (demilitarized zone) where two firewalls are used: one firewall is between the public network and the DMZ and another is between the DMZ and the private network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is a proxy server?

A

A proxy server acts as an internet gateway, firewall, and internet caching server for a private network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is an ACL?

A

Access Control Lists (ACLs) limit the users that are allowed connections

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What are static code analyzers?

A

Static code analyzers look for memory allocation commands and ensure they have corresponding deallocation commands.

26
Q

What Amazon service offers block storage volumes?

A

Amazon EBS (Elastic Block Storage)

27
Q

What type of document is used to agree upon vendor obligations?

A

SLA (Service Level Agreements)

28
Q

What is IaaS?

A

Infrastructure as a Service is where customers purchase basic computing resources from a vendor and build their own IT solutions. Can provide compute capacity, data storage, etc.

29
Q

What is SaaS?

A

Software as a Service is where a public cloud provider delivers an entire application to customers. Very little, if any, configuration is needed on the customers end and is commonly accessed through a standard web browsers or an API.

30
Q

What is PaaS?

A

Platform as a Service is where vendors provide a platform to run their own application code without worrying about server configuration.

31
Q

What is XaaS?

A

XaaS is Anything as a Service where the X can stand for whatever type of service is being delivered.

32
Q

What are common examples of SaaS?

A

Office 365, Dropbox, Google Apps, etc.

33
Q

What are other names for PaaS?

A

Platform as a Service is also refereed to as serverless computing and FaaS, or Function as a Service.

34
Q

What is data sovereignty?

A

Data is subject to legal restrictions of any jurisdiction where it is collected, stored, or processed, regardless of where the data came from.

35
Q

What is data sovereignty?

A

Data is subject to legal restrictions of any jurisdiction where it is collected, stored, or processed, regardless of where the data came from.

36
Q

In regards to cloud security controls, what are resource policies?

A

Resource policies place limits on the actions of a user that has direct access to a cloud environment.

37
Q

What is VPC peering?

A

Virtual Private Cloud peering allows the interconnections between different cloud networks

38
Q

What is CASB?

A

Cloud Access Security Brokers provide managed IAM (Identity and Access Management) services and policy enforcement across cloud services

39
Q

What are transit gateways?

A

Transit gateways are used to connect VPCs (Virtual Private Clouds) and on-premises computing environments

40
Q

In regards to cloud security controls, what are security groups?

A

Since CSPs maintain all firewalls and don’t allow customers to modify them, Security groups are used to offer firewall functionality to IaaS customers.

41
Q

In regards to cloud security controls, what is secret management?

A

Secret management tools store encryption keys and other sensitive credentials that allows applications to access them, however they’re not available to the CSP or others in the organization.

42
Q

What are the OSI model layers from bottom to top?

A

Physical, Data Link, Network, Transport, Session, Presentation, Application

43
Q

Explain each OSI model layer?

A

Physical - Wires, radios, and optics
Data Link - Data transfers between two nodes
Network - Internet Protocol (IP)
Transport - TCP and UDP
Session - Exchanges between systems
Presentation - Data translation and encryption
Application - User programs

44
Q

What is ICMP?

A

Internet Control Message Protocol is a protocol that performs a bunch of administrative functions such as ping, traceroute, destination unreachable, redirects, time exceeded, addresses mask requests and replies.

45
Q

What are other names for anomaly detection?

A

Behavior-based detection and heuristic detection

46
Q

What is a In-Band (Inline) IPS deployment?

  • What can this accomplish?
  • What are the issues with this?
A

In a in-band or inline IPS, the IPS device sits directly on the network and captures all the data coming through. This allows the IPS to actively block suspicious traffic from entering, however since the IPS device is a single point of failure, any issue can disrupt all network communications

47
Q

What is a Out-of-Band (passive) IPS deployment?

  • What can this accomplish?
  • What are the issues with this?
A

An out-of-band or passive IPS is connected to a SPAN (Switch Port Analyzer) port and sits outside the flow of network traffic. This allows all the traffic to be scanned by the IPS, but it cannot disrupt the flow of the traffic. This approach can’t stop the initial attack from entering, but it can react by preventing future attacks from happening.

48
Q

Whats the difference between the following analyzers?
-Protocol Analyzer
-Network Analyzer
-

A
49
Q

Explain the restriction types:

  • Rule-based
  • Role-based
  • Time-based
  • Location-based
A

Rule-based: Rules are explicitly expressed for the types of network activity to allow or deny those actions. (AKA firewall rules)
Role-based: Restricts access based on the users identity and role within an organization
Time-based: Grants or denies access to information only during specified hours
Location-based: Grants or denies access to information based on the users location

50
Q

What is NAC?

Cont 1: What protocol does NAC use?

A

NAC (Network Access Control) technology intercepts wired/wireless network traffic and verifies that the system and user are authorized to connect to the network before allowing them to communicate with other systems.
Cont 1: NAC uses the authentication protocol 802.1x to perform the access control tasks.

51
Q

In regards to firewalls, what are shadowed rules?

A

Rules that will never be executed because of its placement in the rule base

52
Q

In regards to firewalls, what are promiscuous rules?

Cont: What are some key causes?

A

Rules that allow too much access, violates principle of least privilege.
Cont: Laziness, lack of understanding, or typos.

53
Q

In regards to firewalls, what are orphaned rules?

A

Rules that allow access to decommissioned systems and services

54
Q

What is VLAN Pruning?

A

Limiting the number of exposed unnecessary VLANs by limiting the number of switches where they’re trunked

55
Q

What is VLAN hopping?

(Cont 1: How can you prevent VLAN Hopping?)

(Cont 2: What is VLAN Trunk Negotiation?)

A

A malicious user switches from an authorized VLAN to an unauthorized VLAN by pretending to be a switch and asking to trunk VLANs to their device.

Cont 1: By using VLAN Trunk Negotiation.
Cont 2: VLAN Trunk Negotiation is denying the use of automatic VLAN trunking, preventing a user from VLAN Hopping

56
Q

What is flood gate technology?

A

A technology used to help network devices limit the effectiveness of SYN and MAC flooding by limiting the number of open connections each source system can have

57
Q

What is flood guard technology?

A

A technology used to help network devices limit the effectiveness of SYN and MAC flooding by limiting the number of open connections each source system can have

58
Q

What is the STP protocol?

A

The Spanning Tree Protocol (STP) prevents routing loops/broadcast storms by implementing loop prevention. STP allows multiple physical connections, but remove logical connections that allow loops.

59
Q

What is BDPU Guard?

A

A Bridge Protocol Data Unit Guard blocks malicious STP update attacks

60
Q

What is SNMP?

Cont: What is the current SNMP version?

A

Simple Network Management Protocol (SNMP) automates routine network monitoring and management tasks.
Cont: SNMPv3

SY0-601 (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions