Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ SYO-501 > Chapter 4 > Flashcards

Chapter 4 Flashcards

Securing Your Network

1
Q

IDS

A

Intrusion detection systems monitor a network and send alerts when they detect suspicious events on a system or network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

IPS

A

Intrusion prevention systems react to attacks in progress and prevent them from reaching systems and networks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

HIDS

A

Host-based intrusion detection system

Software installed on a system to detect attacks

It protects local resources on the host

A host-based intrusion prevention system (HIPS) is an extension of HIDS

It is software installed on a system to detect and block attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

NIDS

A

Network based intrusion detection system

A device that detects attacks and raises alerts

A NIDS is installed on network device, such as routers or firewalls, and monitors network traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Port Mirror

A

A monitoring port on a switch

All traffic going through the switch is also sent to the port mirror

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Taps

A

Monitoring ports on a network device

IDSs use taps to capture traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Signature-based

A

A type of monitoring used on intrusion detection and intrusion prevention systems

It detects attacks based on known attack patterns documented as attack signatures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Heuristic/behavioral-based

A

A type of monitoring on intrusion detection and intrusion prevention systems

It detects attacks by comparing traffic against a baseline

It is also known as anomaly detection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

NOC

A

Filler

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

False Negative

A

A security icident that isn’t detected or reported

As An example, A NIDS false negative occurs if an attack is active on the network but the NIDS does not raise an alert

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

NIPS

A

Network-based intrusion prevention system

A device that detects and stops attacks in progress

A NIPS is placed inline (In-Band) with traffic so that it can actively monitor data streams

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Inline

A

A configuration that forces traffic to pass through a device

A NIPS is place inline, allowing it to prevent malicious traffic from entering a network

Sometimes called in-band, as opposed to out-of-band

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Out-of-Band

A

A configuration that allows a device to collect traffic without the traffic passing through it

sometimes called passive, opposed to inline

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

ACLs

A

Access control lists are lists of rules used by routers and stateless firewalls

These devices use the ACL to control traffic based on networks, subnets, IP addresses, ports, and some protocols

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

SCADA

A

Supervisory control and data acquisition

A system used to control an ICS such as a power plant or water treatment facility

Ideally, a SCADA is within an isolated network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

RATs

A

Remote access Trojans are malware that allows an attacker to tak control of a system from a remote location

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

DMZ

A

Demilitarized zone is a buffer zone between the internet and an internal network

Internet clients can access the services hosted on servers in the DMZ, but the DMZ provides a layer of protection for the internal network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

SSL/TLS Accelerators

A

Devices used to handle TLS traffic

Servers can off-load TLS traffic to improve performance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

SSL Deccryptors

A

Devices used to create separate SSL (or TLS) sessions

They allow other security devices to examine encrypted traffic sent to and from the Internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

SDN

A

A Software Defined Network is a method of using software and virtualization technologies to replace hardware routers

SDNs separate the data and control planes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Honeypot

A

A server designed to attract an attacker

It typically has weakened security encouraging attackers to investigate it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Honeynet

A

A group of honeypots in a network

Honeynets are often configured in virtual networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

IEEE 802.1x

A

An authentication protocol used in VPNs and wired and wireless networks

VPNs often implement it as a RADIUS server

Wired networks use it for port-based authentication

Wireless networks use it in Enterprise modee

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

IEEE 802.1x

A

An authentication protocol used in VPNs and wired and wireless networks

VPNs often implement it as a RADIUS server

Wired networks use it for port-based authentication

Wireless networks use it in Enterprise mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

WLAN

A

Filler

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

AP

A

An Access Point is a device that connects wireless clients to wireless networks

Sometimes called Wireless Access Point (WAP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

SSID

A

Service Set Identifier is the name of a wireless network

SSIDs can be set to broadcast so users can easily see it

Disabling SSID broadcast hides it from casual users

28
Q

MAC Filtering

A

A form of network access control to allow or block access based on the MAC address

It is configured on switches for port security or on APs for wireless security

29
Q

Antenna Types

A

Filler

30
Q

Network Architecture Zones

A

Filler

31
Q

WPA

A

Wi-Fi Protected Access is a legacy wireless security protocol

it has been superseded by WPA2

32
Q

WPA2

A

Wi-Fi Protected Access II is a wireless security protocol

It supports CCMP for encryption, which is based on AES

It can use Open mode, a pre-shared key, or Enterprise mode

33
Q

TKIP

A

Temporal Key Integrity Protocol is a legacy wireless security protocol

CCMP is the recommended replacement

34
Q

AES

A

Advanced Encryption Standard is a strong symmetric block cipher that encrypts data in 128-bit blocks

AES can use key sizes of 128 bits, 192 bits, or 256 bits

35
Q

PSK

A

Pre-shared key is a wireless mode that uses a pre-shared key (similar to a password or passphrase) for security

Compare with Enterprise and Open modes

36
Q

Enterprise

A

A wireless mode that uses an 802.1x server for security

It forces users to authenticate with a username and password

Compare with Open and PSK modes

37
Q

Authentication Protocols

A

Filler

38
Q

Disassociation Attck

A

An attack that removes wireless clients from a wireless network

39
Q

WPS

A

Wi-Fi Protected Setup is a method that allows users to easily configure a wireless network, often by using only a PIN

WPS brute force attacks can discover the PIN

40
Q

WPS Attack

A

An attack against an AP

A WPS attack discovers the eight-digit WPS PIN and uses it to discover the AP passphrase

41
Q

Rouge AP

A

An unauthorized AP

It can be placed by an attacker or an employee who hasn’t obtained permission to do so

42
Q

Evil Twin

A

A type of rouge AP

An evil twin has the same SSID as a legitimate AP

43
Q

Jamming

A

A DoS attack against wireless networks

It transmits noise on the same frequency used by a wireless network

44
Q

IV Attack

A

An Initialization Vector attack is a wireless attack that attempts to discover the IV

Legacy wireless security protocols are susceptible to IV attacks

45
Q

NFC Attack

A

An attack against mobile devices that use near field communication (NFC)

NFC is a group of standards that allow mobile devices to communicate with nearby mobile devices

46
Q

Bluejacking

A

An attack against Bluetooth device

It is the practices of sending unsolicited messages to nearby Bluetooth devices

47
Q

Bluesnarfing

A

An attack against Bluetooth devices

Attackers gain unauthorized access to Bluetooth devices and can access all the data on the device

48
Q

Replay Attack

A

An attack where the data is captured and replayed

Attackers typically modify data before replaying it

49
Q

RFID

A

Filler

50
Q

RFID Attack

A

Attacks against radio-frequency identification (RFID) systems

Some common RFID attacks are eavesdropping, replay, and DoS

51
Q

VPN

A

Virtual Private Networks are a method that provides access to a private network over a public network such as the internet

VPN concentrators are dedicated devices used to provide VPN access to large groups of users

52
Q

NICs

A

Filler

53
Q

Remote Access VPN

A

Filler

54
Q

IPsec

A

Internet Protocol Security is a suite of protocols used to encrypt data-in-transit that can operate in both tunnel mode and transport mode

It uses Tunnel mode for VPN traffic and Transport mode in private networks

55
Q

Authentication (AH)

A

Authentication Header is an option within IPsec to provide authentication and integrity

56
Q

Encryption (ESP)

A

Encapsulating Security Payload is an option within IPsec to provide confidentiality, integrity, and authentication

57
Q

TLS

A

Transport Layer Security is the replacement for SSL

TLS is used to encrypt data-in-transit

Like SSL, it uses certificates issued by CAs

58
Q

SSTP

A

Filler

59
Q

TLS Tunneling

A

Filler

60
Q

Split Tunnel

A

An encrypted connection used with VPNs

A split tunnel only encrypts traffic going to private UP addresses used in the private network

61
Q

Full Tunnel

A

An encrypted connection used with VPNs

When a user is connected to a VPN, all traffic from the user is encrypted

62
Q

UTM

A

Unified threat management is a group of security controls combined in a single solution

UTM appliances can inspect data streams for malicious content and block it

63
Q

NAC

A

Network access control is a system that inspects clients to ensure they are healthy

Agents inspect clients and agents can be permanent or dissolvable (also known as agentless)

64
Q

Site-to-Site VPNs

A

Filler

65
Q

Always-On VPN

A

Filler

66
Q

Identity and Access Services

A

Filler

Security+ SYO-501 (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions