Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Comptia Network+ > Chapter 9 Network Security Implementation > Flashcards

Chapter 9 Network Security Implementation Flashcards

1
Q

a framework for controlling access to computing resources. The remote networking protocols RADIUS, TACACS, TACACS+, and Diameter all have their own implementations

A

Authentication, Authorization, and Accounting (AAA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

the method of uniquely validating a particular entity or individual’s credentials

A

Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Authentication Factors:

A
  • Something you know, such as a password
  • Something you have, such as a token or access card
  • Something you are, including physical characteristics, such as fingerprints or a retina pattern.
  • Somewhere you are or are not
  • Something you do, for example a keystroke logger that measures how hard you press the keys while typing, or how long the keys remain pressed.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

any authentication scheme that requires validation of at least two of the possible authentication factors.

A

Multifactor Authentication (MFA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

is an authentication scheme that requires validation of two authentication factors.

A

Two-factor authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

is a mechanism where a single user authentication provides access to all the devices or applications where the user has permission. The user need not enter multiple passwords each time he wants to access a device.

A

Single sign-on (SSO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

a directory service protocol that defines how a client can access information, perform operations, and share directory data on a directory server.

A

Lightweight Directory Access Protocol (LDAP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

an electronic document that associates credentials with a public key. The certificate validates the certificate holder’s identity and is also a way to distribute the holder’s public key.

A

Certificates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

is a popular open-source authentication protocol that is based on a time-sensitive ticket granting system. To use an SSO method in which the user enters access credentials that are then passed to the authentication server, which contains an access list and permitted access credentials.

A

Kerberos

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Kerberos authentication process:

A
  1. A user logs on to the domain.
  2. The user requests a Ticket Granting Ticket (TGT) from the Ticket Granting Service (TGS) on the authenticating server.
  3. The authenticating server responds with a time-stamped TGT.
  4. The user presents the TGT back to the authenticating server and requests a service ticket to access a specific resource.
  5. The authenticating server responds with a service ticket.
  6. The user presents the service ticket to the resource.
  7. The resource authenticates the user and allows access.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

is a protocol that enables a server to provide standardized, centralized authentication for remote users. only encrypts passwords

A

Remote Authentication Dial-In User Service (RADIUS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

are authentication protocols that prived centralized authentication and authorization services for remote users. includes process-wide encryption for authenticating, whereas RADIUS encrypts only passwords. uses TCP instead of UDP and supports multiple protocols

A

Terminal Access Controller Access Control System (TACACS) and (TACACS+)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

the backbone of Microsoft’s Remote Desktop system. Its capabilities include data encryption, remote audio and printing, access to local files, and redirection of the host’s disk drives and peripheral ports. Listens on port 3389

A

Remote Desktop Protocol (RDP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

is a platform-independent desktop sharing system. client and server software is available for almost any operating system

A

Virtual Network Computing (VNC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

is a general term for the collected protocols, policies, and hardware that govern access on network interconnections. Scans devices for conformance and allows or quarantines updates to meet policy standards

A

Network Access Control (NAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

is a standard for securing networks by implementing Extensible Authentication Protocol (EAP) as the authentication protocol over either a wired or wireless Ethernet LAN

A

IEEE 802.1x

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

IEEE 802.1x characteristics include:

A

Employs an authentication service, such as RADIUS, to secure clients.
It is an IEEE standard used to provide a Port-based Network Access Control (PNAC), using the 802.11 protocols.
802.1x uses EAP to provide user authentication against a directory service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

a set of data (user names, passwords, time and date, IP addresses, media access control (MAC) addresses, and so on) that is used to control access to a resource such as a device, file, or network.

A

Access Control List (ACL)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Type of Firewall
the simplest implementation of a firewall and work at the Network Layer (Layer 3) of the OSI model. Are usually part of a router.

A

Packet Filters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Type of Firewall

work at the Session Layer (Layer 5) of the OSI model by monitoring the condition, or state, of the connection.

A

Stateful Inspection Firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Type of Firewall
work at the Application Layer (Layer 7) of the OSI model and require incoming and outgoing packets to have a proxy to access services. Also known as Application-level gateways.

A

Proxy Firewalls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

combine the functions of a packet filter, a stateful inspections firewall, and a proxy firewall. They operate on all three OSI layers, Network, Session and Application, simultaneously.

A

Hybrid Firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

is a network security solution that is used to monitor and manage a wide variety of security-related applications and infrastructure components through a single management console. can be network appliances or a cloud service

A

Unified Threat Management (UTM)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

are protocols that do not expose data and/or credentials in cleartext, so they are less likely to allow for the credentials or data to be viewed and captured by someone else

A

Secure Protocols

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Used for managing devices on IP networks. Version 3 added cryptographic security to secure data and user credentials

A

Simple Network Management Protocol version3 (SNMPv3)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Protocols that Aren’t Secure:

A 
FTP
Telent
POP3
IMAP
SNMP V1 and V2
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Guidelines for Securing Ports and Services

A
  • Determine which ports are currently open
  • Determine which of the open ports are required to be open
  • Close any ports that are not required to be open
  • Determine which services are currently running
  • Determine which of the running services are required
  • Disable any services which are not required
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

is an analysis technique that determines the coverage area of a wireless network, identifies any sources of interference, and establishes other characteristics of the coverage area.

A

Site Survey

29
Q

Wireless Network Security Considerations:

A
  • The administrator should specify an SSID manually
  • Another method of securing a wireless connection is by disabling the broadcast of the SSID of the wireless device.
  • Do not use WPS (WiFi Protected Setup). If any devices on your network have WPS, disable it. When purchasing devices, try to obtain devices that do not include WPS.
30
Q

encrypts wireless communications. has many well-known security flaws.

A

Wired Equivalent Privacy (WEP)

31
Q

encrypts wireless communications, making them less vulnerable to unauthorized access. It offers better security than WEP. Temporal Key Integrity Protocol (TKIP) is what provides the encryption for the WPA protocol.

A

Wi-Fi Protected Access (WPA)

32
Q

This is the one that should be used. The use of CCMP-AES is an improvement in encryption over TKIP-RC4 because instead of just checking the integrity of the key, AES is an encryption algorithm.

A

WPA2

33
Q

is an Extensible Authentication Protocol (EAP) protocol that extends TLS by providing authentication that is as strong as TLS, but it does not require that each user be issued a certificate.

A

Transport Layer Security (TLS)Tunneled Transport Layer Security (TTLS)

34
Q

Wireless Authentication Methods:
is often used in conjunction with 802.1x. The wireless client is allowed to make an unauthenticated association with the AP, but until the user logs on, the client cannot connect to the network

A

Open System

35
Q

Wireless Authentication Methods:
is used for WPA-Personal and WPA2-Personal. The key needs to be shared by the communicating parties before it can be used. PSKs are more often found in the use on home wireless networks. The EAP authentication method authenticates a user and not the station. This is an enterprise implementation that is done with a RADIUS server.

A

Shared-key

36
Q

is a protocol that enables systems to use hardware-based identifiers, such as fingerprint scanners or smart card readers, for authentication.

A

Extensible Authentication Protocol (EAP)

37
Q

was designed to replace the Lightweight EAP (LEAP). It addresses LEAP vulnerabilities through the use of TLS tunneling using a Protected Access Credential (PAC)

A

EAP-FAST- (Flexible Authentication via Secure Tunneling)

38
Q

is a widely supported feature in wireless routers and cards provides robust security.

A

EAP-TLS- (Transport Layer Security)

39
Q

similar to EAP-TLS, was proposed as an open standard by a coalition made up of Cisco Systems, Microsoft, and RSA Security.

A

PEAP (Protected Extensible Authentication Protocol)

40
Q

A public-access or guest network often presents a web page users must view and acknowledge before they are granted network access

A

Captive Portals

41
Q

is a method of defining virtual geographical boundaries using GPS or RFID. When a mobile device with GPS or RFID capabilities enabled crosses into or out of the geofenced area, an event can be triggered.

A

Geofencing

42
Q

This is an unauthorized wireless access point on a corporate or private network. They are not detected easily and can allow private network access to many unauthorized users with the proper devices

A

Rogue Access Point

43
Q

a rogue access point on a network that appear to be legitimate. Although an evil twin can be installed both on corporate or private networks, typically they are found in public Wi-Fi hotspots where users do not connect transparently and automatically as they do in a corporate network, but rather select available networks from a list.

A

Evil Twin

44
Q

The act of searching for instances of wireless networks by using wireless tracking devices such as tablets, mobile phones, or laptops

A

War Driving

45
Q

The act of using symbols to mark off a sidewalk or wall to indicate that there is an open wireless network that may be offering Internet access. It can also be an online list of open networks.

A

War Chalking

46
Q

is an unpredictable random number used to make sure that when the same message is encrypted twice, the ciphertext is always different. It is fairly easy, using automated tools and a replay attack, to extract enough IV data to crack the WEP key in just a few minutes.

A

Initialization Vector (IV attack)

47
Q

This is a method used by attackers to send out unwanted Bluetooth signals from tablets, mobile phones, and laptops to other Bluetooth-enabled devices. With the advanced technology available today, attackers can send out unsolicited messages along with images and video.

A

Bluejacking

48
Q

This is a method in which attackers gain access to unauthorized information on a wireless device by using a Bluetooth connection within the 30-foot Bluetooth transmission limit. Exploitation of private information including email messages, contact information, calendar entries, images, videos, and any data stored on the device

A

Bluesnarfing

49
Q

A collection of previously issued patches and hotfixes, usually meant to be applied to one component of a device, such as the web browser or a particular service

A

Rollup

50
Q

A patch management program might include the following:

A
  • An individual responsible for subscribing to and reviewing vendor and security patches and updating newsletters
  • A review and triage of the updates into urgent, important, and non-critical categories
  • An offline patch-test environment where urgent and important patches can be installed and tested for functionality and impact.
51
Q

When done electronically it is called flashing. Provides support for new hardware. Fixes bugs that prevent the operating system from installing or running properly.

A

Firmware Upgrades

52
Q

Key-based encryption types:

A
  • Shared-key or symmetric- encryption systems, the same key is used both to encode and to decode the message. The secret key must be communicated securely between the two parties involved in the communication.
  • Key-pair or asymmetric- encryption systems, each party has two keys: a public key, which anyone can obtain, and a private key known only to the individual. Anyone can use the public key to encrypt data, only the holder of the associated private key can decrypt it.
53
Q

a server that issues certificates and the associated public/private key pairs

A

Certificate Authority (CA)

54
Q

File Integrity Management Measures:

a security setting that determines the level of access a user or group account has to a particular resource.

A

Permission

55
Q

File Integrity Management Measures:

Certificates and Encryption

A

-

56
Q

File Integrity Management Measures:
a process or function that transforms plaintext into ciphertext that cannot be directly decrypted. The result of the hashing process is called a hash, hash value, or message digest.

A

File Hashing

57
Q

File Integrity Management Measures:
is a file-encryption tool available on Windows devices that have partitions formatted with the NT File System. Encrypts file data by using digital certificates.

A

Encrypting File System (EFS)

58
Q

File Integrity Management Measures:
Hardware-based, used on devices known as self-encrypting drives (SED), ensures that storage devices are encrypted at the hardware level in order to avoid relying on software solutions. This encryption is invisible to the user and is not susceptible to attacks targeting encryption provided by applications or operating systems.

A

Whole drive encryption

59
Q

also known as separation of duties, is implemented as a policy that states that no one person should have too much power or responsibility

A

Role Separation

60
Q

On Cisco switches you can use this to prevent protected ports from forwarding traffic to any other protected port on the switch. Using various commands you can configure Spanning Tree, Flood Guard and MAC address filtering

A

Switch Port Protection

61
Q

VLAN Hopping Prevention Methods:

A
  • Switch Spoofing- Turn off trunking on all ports unless trunking is specifically required on a certain port.
  • Double Tagging- Make sure that user ports and native VLAN trunk ports are different.
62
Q

a small section of a private network that is located between two firewalls and made available for public access. Enables external clients to access data on a private systems, such as web servers, without compromising the security of the internal network as a whole.

A

Demilitarized Zone (DMZ)

63
Q

Segmentation for Network Elements:

A

SCADA/ICS: SCADA and ICS networks are in this segment. They may be impractical to upgrade and thus will not have the latest security.
Honeynet: Only devices that are used as honeypots are in this segment. A honeypot is a device that is set to detect, deflect, or counteract attempts at unauthorized use of the device or network. A honeynet is a special type of honeypot, a specific network segment populated with, and only with honeypots

64
Q

in order to keep internal addresses private, this is used to conceal internal IP addresses from external networks. A router is configured with a single public IP address on its external interface and an internal address on its internal interface. When static, an internal IP address is mapped to a single specific public IP address. In dynamic, a single internal address is mapped to the first available public IP address in an address pool.

A

Network Address Translation (NAT)

65
Q

is a subset of dynamic NAT functionality that maps one or more private IP addresses to one public IP address by using multiple ports. Also known as overloading.

A

Port Address Translation (PAT)

66
Q

an attack authorized by the owner of a computing device or a network, with the purpose of finding security weaknesses that could be exploited by a real attacker

A

Penetration Testing

67
Q

software or hardware, or a combination of both, that scans, audits, and monitors the security infrastructure for signs of attacks in progress and automates the intrusion detection process.

A

Intrusion Detection System (IDS)

68
Q

an inline security device that monitors suspicious network and/or device traffic and reacts in real time to block it.

A

Intrusion Protection System (IPS)

Comptia Network+ (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions