Chp 5 Infrastructure

Question 1

OSI

Answer 1

The Open Systems Interconnection (OSI) model is a conceptual framework used to understand and implement network protocols in seven distinct layers.

Question 2

OSI Physical Layer (Layer 1):

Answer 2

Function: Deals with the physical connection between devices and the transmission and reception of raw bitstreams over a physical medium.
Key Components: Cables, switches, hubs, repeaters, and network interface cards (NICs).

Question 3

OSI Data Link Layer (Layer 2):

Answer 3

Function: Responsible for node-to-node data transfer and error detection and correction. It ensures that data transferred from one node to another is free of errors.
Key Components: Bridges, switches, and protocols like Ethernet and Wi-Fi.

Question 3

OSI Network Layer (Layer 3):

Answer 3

Function: Manages device addressing, tracks the location of devices on the network, and determines the best way to move data between them. It handles packet forwarding, including routing through different routers.
Key Components: Routers and layer 3 switches.
Protocols: IP (Internet Protocol), ICMP (Internet Control Message Protocol).

Question 4

OSI Transport Layer (Layer 4):

Answer 4

Function: Ensures complete data transfer with error recovery, flow control, and data integrity. It manages end-to-end communication and the segmentation and reassembly of data.
Key Components: Gateways and firewalls.
Protocols: TCP (Transmission Control Protocol), UDP (User Datagram Protocol).

Question 5

OSI Application Layer (Layer 7):

Answer 5

Function: Closest to the end-user. It interacts with software applications to implement a communicating component. It provides network services directly to end-user applications.
Key Components: Web browsers, email clients, and other network-based applications.
Protocols: HTTP (Hypertext Transfer Protocol), FTP (File Transfer Protocol), SMTP (Simple Mail Transfer Protocol), DNS (Domain Name System).

Question 6

FQDN

Answer 6

A Fully Qualified Domain Name (FQDN) is the complete domain name for a specific computer or host on the internet.

Question 7

Star Topology

Answer 7

is BAD. is a network configuration where all devices (nodes) are connected to a central hub or switch.
Central Point of Failure: The entire network depends on the central hub or switch. If it fails, the whole network is disrupted.
The network segment is also “flat” in terms of security.

Question 8

logical segmentation

Answer 8

Helps the Layer 3 of OSI by switch, router, and firewall configuration where hosts on one network segment are prevented from or restricted in communicating with hosts on other segments.

Question 9

In IPv6, how are the 128 bits of an IP address divided and used?

A. The last 32 bits are the host’s interface ID, and the first 96 bits contain network information.

B. The last 64 bits are the host’s interface ID, and the first 64 bits contain network information. The first 48 bits are used by ISPs to determine the network’s location on the global Internet, and the remaining 16 bits are used for subnetting by the site administrator.

C. The last 128 bits are the host’s interface ID, and there are no bits for network information.

D. The first 64 bits are the host’s interface ID, and the last 64 bits contain network information. The first 48 bits of the last 64 bits are used by ISPs to determine the network’s location on the global Internet, and the remaining 16 bits are used for subnetting by the site administrator.

Answer 9

B. The last 64 bits are the host’s interface ID, and the first 64 bits contain network information. The first 48 bits are used by ISPs to determine the network’s location on the global Internet, and the remaining 16 bits are used for subnetting by the site administrator.

Question 10

ARP

Answer 10

Address Resolution Protocol (ARP) is a protocol used in IPv4 networks to map IP addresses to MAC (Media Access Control) addresses. ARP is essential for communication between devices on a local network.

Question 11

security zones

Answer 11

An area of the network (or of a connected network) where the security configuration is the same for all hosts within it. In physical security, an area separated by barriers that control entry and exit points.

Question 12

Attack Surface Layer 1/2

Answer 12

—allows unauthorized hosts to connect to wall ports or wireless networks and communicate with hosts within the same broadcast domain.

Question 12

Attack Surface Layer 3

Answer 12

—allows unauthorized hosts to obtain a valid network address, possibly by spoofing, and communicate with hosts in other zones.

Question 13

RADIUS

Answer 13

Remote Authentication Dial-In User Service (RADIUS)
AAA protocol used to manage remote and wireless authentication infrastructures.

Question 14

PNAC

Answer 14

Port-based Network Access Control (PNAC), commonly implemented using the IEEE 802.1X standard, is a method used to control access to a network by requiring devices to authenticate themselves before gaining access to network resources.

Question 15

Attack Surface Layer 4/7

Answer 15

—allows unauthorized hosts to establish connections to TCP or UDP ports and communicate with application layer protocols and services.

Question 15

EAP

Answer 15

Extensible Authentication Protocol (EAP)
Framework for negotiating authentication methods that enable systems to use hardware-based identifiers, such as fingerprint scanners or smart card readers, for authentication and to establish secure tunnels through which to submit credentials.

Question 16

Why are some hosts considered so security-critical that they should not be connected to any type of network, and what is an example of such a host?

A. They have limited processing power, and one example is a basic IoT device.

B. They perform critical security functions that, if compromised, could undermine the entire security infrastructure. One example is the root certification authority in a Public Key Infrastructure (PKI).

C. They are used primarily for testing software, and one example is a developer’s personal computer.

D. They handle large volumes of data and need to be highly available, such as a data warehouse server.

Answer 16

B. They perform critical security functions that, if compromised, could undermine the entire security infrastructure. One example is the root certification authority in a Public Key Infrastructure (PKI).

Question 16

Passive Security Control

Answer 16

A passive security control operates without requiring any configuration on the client side or transferring host data. It monitors and analyzes data silently, without interacting with network hosts directly.
Example:

Network traffic can be mirrored or copied to a sensor and scanned by an analysis engine. This process is entirely passive, as it does not interact with or alter the network traffic in any way.

Question 17

Active Security Control

Answer 17

An active security control requires configuration and interaction with network hosts. It involves setting up credentials, permissions, and possibly installing software agents on the hosts.
Example:

An active control performing network filtering may require hosts to be explicitly configured to use the control, such as installing agent software or configuring network settings to route traffic through a gateway.

Question 18

inline

Answer 18

Placement and configuration of a network security control so that it becomes part of the cable path.
examples:
TAP- Test access point (TAP)—this is an inline device with ports for incoming and outgoing network. Between the firewall and the switch
SPAN (switched port analyzer)/mirror port- NOT RELIABLE

Question 19

Fail-Open

Answer 19

In a fail-open configuration, network or host access is preserved during a failure, ensuring that the system remains available even if a security control fails.
Priority:

Availability is prioritized over confidentiality and integrity.

Question 20

Fail-Closed

Answer 20

In a fail-closed configuration, access is blocked or the system enters its most secure state when a failure occurs, ensuring that confidentiality and integrity are maintained even during a failure.
Priority:

Confidentiality and Integrity are prioritized over availability.

Question 21

layer 7 firewall

Answer 21

A stateful inspection firewall that can filter traffic based on specific application protocol headers and data, such as web or email data.

Layer 7 Firewall: Offers advanced, application-layer filtering ideal for detecting sophisticated attacks and protecting web applications, albeit with higher resource demands and complexity.

Question 21

stateful inspection

Answer 21

A technique used in firewalls to analyze packets down to the application layer rather than filtering packets only by header information, enabling the firewall to enforce tighter and more security.

Question 22

layer 4 firewall

Answer 22

A stateful inspection firewall that can monitor TCP sessions and UDP traffic.
Layer 4 Firewall: Provides efficient, transport-layer filtering suitable for basic traffic management and environments where performance is critical.

Question 23

SOHO

Answer 23

Small Office/Home Office

Question 23

forward proxy

Answer 23

is a server that acts as an intermediary between a client and the internet. It processes requests from clients to access resources from other servers.

Question 24

Non-Transparent Proxy

Answer 24

A non-transparent proxy requires the client to be explicitly configured with the proxy server’s address and port number., such as corporate networks.

Question 25

reverse proxy

Answer 25

A type of proxy server that protects servers from direct contact with client requests. Typically deployed on the network edge and configured to listen for client requests from a public network

Question 25

Transparent Proxy

Answer 25

Suitable for environments where client configuration cannot be enforced, such as public Wi-Fi.

Question 25

UTM

Answer 25

Unified threat management (UTM) All-in-one security appliances and agents that combine the functions of a firewall, malware scanner, intrusion detection, vulnerability scanner, data-loss prevention, content filtering, and so on. NOT SO GOOD BUT OK

Question 26

NGFW

Answer 26

next-generation firewall (NGFW) Advances in firewall technology, from app awareness, user-based filtering, and intrusion prevention to cloud inspection. BEST

Question 26

WAF

Answer 26

web application firewall (WAF) A firewall designed specifically to protect software running on web servers and their back-end databases from code injection and DoS attacks.

Question 26

PPTP

Answer 26

Legacy protocols such as the Point-to-Point Tunneling Protocol (PPTP) PPTP is highly vulnerable to password cracking attacks and considered obsolete.

Question 27

RDP

Answer 27

Remote Desktop Protocol (RDP) can be used to access a physical machine on a one-to-one basis.

Question 27

VNC

Answer 27

Virtual Network Computing (VNC) Remote access tool and protocol. VNC is the basis of macOS screen sharing.

Question 28

HTML5 VPN

Answer 28

Using features of HTML5 to implement remote desktop/VPN connections via browser software (clientless).

Question 29

OOB

Answer 29

out-of-band (OOB) Accessing the administrative interface of a network appliance using a separate network from the usual data network. This could use a separate VLAN or a different kind of link, such as a dial-up modem.

Question 30

A security team in a multinational organization decides to improve the security of their inter-office communications. They agree to use a tunneling protocol that can offer confidentiality, sender authentication, and message integrity. They need a protocol that operates at the network level. Which protocol BEST fulfills the team’s requirements for securing inter-office communications and operates at the network level?

A.Hypertext Transfer Protocol Secure
B.Secure Shell
C.Internet Protocol Security
D.Transport Layer Security

Answer 30

C
Internet Protocol Security (IPSec) provides confidentiality, sender authentication, and message integrity by functioning at the network level.

Question 31

An organization’s flat network segment currently hosts a mailbox server, a client network, and a mail transfer server, all of which need enhanced security. Which redesign option BEST segregates the network according to the OSI model and secure architecture principles to mitigate vulnerabilities?

A.Segregate with VLANs and control inter-VLAN traffic with ACLs.
B.Monitor the mail server with a WAF at the application layer.
C.Strengthen router ACLs and enable IPsec for data-in-transit.
D.Create a DMZ for the mail transfer server and separate others with port security.

Answer 31

A
VLANs with ACLs create secure segments, providing effective internal traffic control without affecting other layers. This approach not only enhances network performance but also significantly improves security by isolating different network segments.

Question 32

The network administrator in an organization is reinforcing the security measures of the company’s enterprise infrastructure, with a key focus on port security. In an environment with dynamic port usage where different applications request ports on an ad-hoc basis, the administrator must consider the most secure method of assigning and managing these ports to mitigate security risks. To secure the enterprise infrastructure optimally, what key measure should the network administrator prioritize in terms of port security?

A.Keeping all ports open to ensure application functionality
B.Implementing a dynamic port allocation and management system
C.Assigning all applications a static port number
D.Blocking all incoming and outgoing connections on all ports

Answer 32

B
Implementing a dynamic port allocation and management system aids in optimizing security by reducing the attack surface, as the system only opens the ports when needed and promptly closes them when not in use.

Question 33

A growing company’s IT department is weighing the pros and cons of different architectural models for its next project. The debate narrows down to cloud architecture versus traditional network architecture. During a team meeting, the head of IT security asks a newly hired network specialist to identify the primary security consideration when comparing cloud architecture to traditional network architecture. Based on the conversation in the IT department, which security consideration is MOST directly associated with cloud architecture compared to traditional network architecture?

A.A need for regular network hardware/firmware updates
B.Shared responsibility model with service providers
C.Encryption of data transmitted over local networks
D.Requirement for secure physical access to network devices

Answer 33

B
In cloud services, the division of security responsibilities between the cloud service provider and the customer creates a shared responsibility model.