Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Get Certified Get Ahead - Sec+ Flashcards > Chapter 4 > Flashcards

Chapter 4 Flashcards

1
Q

What do IDSs do?

A

IDSs monitor a network and send alerts when they detect suspicious events

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What do IPSs do?

A

IPSs react to attacks in progress and prevent them from reaching systems and networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Acronym

HIDS

A

Host-based Intrusion Detection System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Definition

What is HIDS

A

It is additional software installed on a system that
* monitors the individual host
* can detect potential attacks
* analyzes critical operating system files

HIDS can monitor all traffic on a single host system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Acronym

NIDS

A

Network-based Intrusion Detection System

monitors and assesses threats on the network from traffic sent in plaint

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What do NIDS sensors do?

A

Gather information and report to a central monitoring network appliance hosting a NIDS console

sensors AKA collectors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What can a NIDS NOT do?

A
  • Detect anomalies that don’t change network traffic
  • Decrypt encrypted traffic
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is port mirroring?

AKA port spanning

A

configuring a switch to send all the traffic it receives to a single port

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Where should you place a sensor if you want to see all attacks on your network?

A

On the internet side

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Where should you place a sensor if you only want to see attacks that get through on your network?

A

On the internal network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Where are NIDS sensors installed?

A

Network devices: switches, routers, or firewalls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the two primary detection methods

A
  1. Signature based
  2. heuristic/behavioral-based/anomaly based
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How do signature based IDSs detect attacks?

A

They use a database of known vulnerabilities or known attack patterns

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How do Trend based IDSs detect attacks?

A
  • Identifies the network’s normal behavior and creates a baseline
  • when abnormal activity is detected, it gives an alert

Good at detecting zero day exploits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are zero day exploits

A

vulnerabilities that are unknown to the vendor. There is no patch for the vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

IDS aggregator

A

Stores log entries from dissimilar systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Acronym

NOC

A

Network Operations Center

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

IDS False Positive

A

An alert or alarm on an event that is non threatening or harmless

opposite of true positive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

IDS False negative

A

A real attack that is undetected by the system

Opposite of true negative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What does a high incidence of false positives cause?

A

Increasr of the administrator’s workload

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Differences between IPS and IDS

A
  • IPS can detect, react to, and prevent attacks while IDS an only detect and react
  • IPS is in-line with the traffic - traffic goes through the IPS while IDS is out of band. Monitors the network but traffic doesnt go through it
  • IPS is referred to as Active, IDS is referref to as Passive
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Acronym

RAT

A

Remote Access Trojan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Acronym

APT

A

Advanced Persistent Threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Honeypot

A

A server that looks like an easy target so attackers spends their time in the honeypot instead of on the real network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Honeynet

A

A group of honeypots within a separate network but accessible from an organization’s primary network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Honeyfile

A

A file designed to attract the attention of an attacker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Honeytoken

A

Fake data or credentials planted within a system to detect unauthorized access attempts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Acronym

WLAN

A

Wireless Local Area Networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What does a wireless access point(AP) do?

A

Connects wireless clients to a wired network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What are APs with routing capabilites marketed as?

A

Wireless routers

All wireless routers are APs but not all APs are wireless routers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Acronym

WAN

A

Wide Area Network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Acronyms

NAT and PAT

A
  1. Networks Address Translation
  2. Port Address Translation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Acronym

DHCP

A

Dynamic Host Configuration Protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q
A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Acronym and Definition

SSID

A

Service Set Identifier

The name of the wireless network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is MAC Filtering

A

Restricting access to a network based on the MAC address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is MAC address cloning

A

Changing the MAC address address on a device to match the MAC address of another device, typically the WAN port on an internet-facing router

spoofing a MAC address is easy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is a site survey?

A

examining a wireless environment to identify issues like areas with noise or potential security issues

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What do Wi-Fi analyzers do?

A

Identify and analyze activity on channels within the same wireless spectrum

A site survey tool

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What is a heat map

A

It gives a color coded representation of wireless signals

A site survey tool

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Wireless footprinting

A

Gives a detailes diagram of wireless APs, hotspots, and dead spots within an organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Acronym

WEP

A

Wired Equivalent Privacy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Acronym

WPA

A

Wi-Fi Protected Access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Which wireless cryptographic protocols should not be used and why?

A
  • WEP and WPA
  • These protocols are weak and deprecated
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Acronym

WPA2

A
  • Wi-Fi Protected Access 2
  • Uses AES and Counter-mode/CBC-MAC
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Acronym

AES

A

Advanced Encryption Standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Acronym

CCMP

A

Counter-mode/CBC-MAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What modes can WPA2 operate in?

A
  1. Open
  2. PSK
  3. Enterprise Mode
49
Q

What is open mode

A
  • Doesn’t use any security
  • Data is transferred in cleartext
  • Turns off all the security featues of WPA2

WPA2

50
Q

What is PSK mode

A

Allows users to access the wireless network anonymously with a PSK or passphrase

WPA2

51
Q

What is enterprise mode

A
  • Forces users to authenticate with unique credentials before granting access to the wireless network
  • uses an 802.1X server (implemented as a RADIUS server) to add authentication

WPA2: think of eduroam

52
Q

Acronym

WPA3

A

Wi-Fi Protected Access 3

53
Q

What modes can WPA3 operate in?

A
  1. Enhanced open mode
  2. SAE mode
  3. Enterprise mode
54
Q

What is Enhanced open mode

A
  • replaces the unencrypted open mode of WPA2
  • Allows you to easily run a secure guest network
55
Q

Acronym

SAE mode

A

Simultaneos Authentication of Equals mode

56
Q

What is SAE mode

A
  • replaces WPA2’s PSK mode p
  • uses a passphrase
57
Q

True or false: WPA2 and WPA3 have the same enterprise mode

A

True

58
Q

What is the purpose of authentication protocols in wireless networks?

A

to verify the identity of devices attempting to connect to a wireless network.

59
Q

Acronym

EAP

A

Extensible Authentication Protocol

60
Q

What is the function of the EAP in wireless security?

A
  • provides a method for two systems to create a secure encryption key (PKA).
  • Systems then use the PTK to encrypt data transmitted between devices
61
Q

Acronym

PMK

A

Pairwise Master Key

62
Q

Acronym

PTK

A

Pairwise Transient key

63
Q

Acronym and Definition

PEAP

A
  • Protected EAP
  • Provides an extra layer of protection for EAP by requiring a certificate on the server
64
Q

Acronym

LEAP

A

Lightweight Extensible Authentication Protocol

65
Q

What makes LEAP an insecure authentication protocol?

A

It has known vulnerabilities that make is susceptible to attacks

66
Q

Acronym

EAP-FAST

A

EAP- Flexible Authentication via Secure Tunneling

67
Q

How does EAP-FAST improve upon LEAP’s security?

A

uses PACs to authenticate users within a secure tunnel.

68
Q

Acronym

PAC

A
  • Protected Access Credentials
  • Pre shared keys
69
Q

EAP-TLS is considered a highly secure protocol. What are its key features?

A
  • requires both the client device and the network server to have digital certificates.
  • implementing this can be more complex due to the need for certificate management

Mutual Authentication

70
Q

Acronym

EAP-TTLS

A

EAP- Tunneled TLS

71
Q

How do EAP-TTLS and PEAP balance security and ease of use?

A
  • These protocols create a secure tunnel using TLS, However, only the server is required to have a digital certificate
  • Simplifies configurtation for client devices but also maintains security
72
Q

What is IEEE 802.1X?

A
  • A port based authentication protocol
  • Requires devices to authenticate when they connect to a specfic wireless AP or a specific physical port

Only authorized clients can connect

73
Q

What is a captive portal

A

a technical solution that forces clients using web browsers to complete a specific process before it allows them access to the network

74
Q

What is a dissassociation attack?

A

an attack that removes a wireless client from a wireless network, forcing them to re-authenticate

hotels could use this to kick people off hotspots so they are forced to pay for hotel wifi

75
Q

Acronym

WPS

A
  • Wi-fi protected setup
  • Allows users to configure wireless devices by entering an 8 digit pin

Susceptible to brute force attacks

76
Q

What is a rogue AP?

A
  • An AP placed within a network without official authorization
  • Used to capture and exfiltrate data
77
Q

What is data exfiltration?

A

the unauthorized transfer of data from an organization to a location controlled by an attacker

78
Q

What is an evil twin?

A

A rogue AP with the same SSID as a legitimate AP, sending wireless traffic through the rogue AP instead

79
Q

What is a jamming attack

A
  • an attack where noise or another radio signal is transmitted on the same frequency used by a wireless network.
  • usually prevents all users from connecting to a wireless network
80
Q

What is an IV attack?

A
  • Initialization vector attack
  • An acctack that attempts to discover the pre shared key after discovering the IV
81
Q

Acronym and definition

NFC

A
  • Near field communication
  • A group of standards that allows mobile devices to communicate with other devices when they are close to each other
82
Q

How does an NFC attack work?

A

The attacker uses an NFC reader to capture data from another NFC device

83
Q

Acronym

RFID

A

Radio Frequency Identification

84
Q

What are the common RFID attacks?

A
  • Sniffing or eavesdropping
  • RFID cloning
  • DOS
85
Q

Acronym

PAN

A

Personal Area Network

86
Q

What is bluejacking?

A

Sending unsolicited messages to nearby bluetooth devices

87
Q

What is bluesnarfing?

A

Unauthorized access or theft of information from a bluetooth device

88
Q

What is bluebugging?

A

Similar to bluesnarfing but in addition to gaining full access to the phone, the attacker installs a backdoor.

89
Q

What prevents the pairing of bluetooth devices?

A

Faraday cages

90
Q

What is a wireless replay attack?

A

An attacker captures data sent between two entities, modifies it, and then attempts to impersonate one of the parties by replaying the data

91
Q

Which protocols are resistant to replay attacks?

A

WPA2 and WPA3

92
Q

What is war driving?

A
  • The practice of looking for vulnerable wireless networks while walking or driving around
  • Used by administrators as part of a wireless audit

also war flying: doing the same thing but in a plane

93
Q

What is a VPN concentrator?

A
  • A dedicated device used for VPNs
  • typically placed in a screened subnet
94
Q

Tunnel mode

A
  • Encrypts the entire IP packet, including both the payload and the packet headers.
  • Commonly used by VPNs
95
Q

Transport mode

A

only encyrpts the payload and is commonly used in priivate networks but not with VPNs

96
Q

ESP

A

Encapsulating Security Payload

97
Q

How does IPsec use authentication to enhance security?

A

IPsec incorporates an Authentication Header (AH), which allows the devices participating in an IPsec conversation to verify each other’s identities before exchanging any data. This authentication process helps prevent spoofing attacks, where a malicious actor might try to impersonate a legitimate device on the network.

98
Q

Acronym and definition

IKE

A
  • Internet Key Exchange
  • Creates Security associations (SA) for the VPN and uses thess to set up a secure channel between the client and the VPN server
99
Q

What is a split tunnel?

A

allows only specific traffic to be routed through the encrypted VPN tunnel. This means that other traffic, such as internet browsing, bypasses the tunnel and goes directly to the internet through the user’s Internet Service Provider (ISP).

100
Q

Full tunnel

A

routes all network traffic from the user’s device through the encrypted VPN tunnel. This means that all data sent and received, including internet browsing, is protected by the VPN

101
Q

What does IPsec use for VPN traffic?

A
  • It uses tunnel mode and can be identified with protocol ID 50 for ESP.
  • Uses IKE over port 500
102
Q

Site-to-Site VPN

A

Two VPN servers that act as gateways for two networks separated geographically

can be on demand VPNS or always on VPNs

103
Q

Benefit of site-to-site VPN model

A

it connects both networks without requiring additional steps on the part of the user

104
Q

Host-to-gateway model

Traditional remote acces VPN

A

The end user makes the direct connection to the VPN server

105
Q

WH

Always-on VPN

A

establishes and maintains a secure tunnel automatically whenever the user’s device connects to the internet.

106
Q

Acronym and Definition

L2TP

A
  • Layer 2 Tunneling Protocol
  • Data is encrypted with another protocol such as IPsec and then passed to L2TP for transport over the VPN
107
Q

HTML5 VPN

A

Allows users to connect to the VPN using their web browser

108
Q

Acronym

PBX

A

Private Branch Exchange

109
Q

Acronym and definition

NAC

A
  • Network Access Control
  • Provides continous secutrity monitoring by inspecting computers and preventing them from accessing the network if they don’t pass the inspection

can redirect unhealthy clients to a remediation network

110
Q

What are the common health conditions checked by a NAC

A
  • the client’s firewall is enabled
  • the client’s OS is up to date and has all current patches and fixes
  • the client’s antivirus software is up to date and has all updated signature definitions
111
Q

What is a permanent NAC agent?

A

an agent that is installed on the client and stays on the client

112
Q

What is a dissolvable NAC agent?

A

An agent that is downloaded and runs on the client when the client logs on remotely and is deleted after the session ends

113
Q

What is an agentless NAC system?

A

A NAC system scans a client remotely without installing code on the client, either permanently or temporarily

114
Q

Acronym

PAP

A
  • Password Authentication Protocol
  • Used with PPP to authenticate clients
  • Uses a passwork

Weakness: sends information in cleartext

115
Q

Acronym

PPP

A

Point to Point Protocol

116
Q

Acronym

CHAP

A
  • Challenge Handshake Authentication Protocol
  • also uses PPP and authenticates remote users but is more secure than PAP
  • Its goal is to allow the client to pass credentials over a public network without allowing attackers to intercept the data and later use it in the attack

Doesn’t send in cleartext

117
Q

Acronym

RADIUS

A
  • Remote Authentication Dial In User Service
  • It is a centralized authentication service
118
Q

What do signature based IDS and IPS do?

A

Use signatures to detect known attacks or vulnerabilities

Get Certified Get Ahead - Sec+ Flashcards (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions