Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP Domain 1 > CISSP Domain 4 > Flashcards

CISSP Domain 4 Flashcards

1
Q

Communication and Network Security

A 
OSI and TCP/IP Models
Protocol types and security issues
LAN, WAN, MAN, Intranet, and extranet technologies
Cable types and data transmission types
Network devices and services
Communications security management
Telecommunications devices and technologies
Wireless technologies
Network Encryption
Threats and attacks
Software defined routing
Content distribution networks
Multilayer protocols
Convergent network technologies
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Telecommunications

A

the electromagnetic transmission of data among systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

OSI Reference Model

A

ISO standard 7498 provides important guidelines used by vendors, engineers, developers, and others.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Encapsulation

A

Message moves down one stack and up another through the OSI model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Application Layer 7

A

works closest to the user and provides file transmissions, message exchanges, terminal sessions, and much more.
Does not include applications
passes instructions and data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Application Layer protocols

A 
SMTP
HRRP
DNS
IRC
LDP
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Presentation Layer 6

A

puts information in a format

common means of representing data in a structure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Presentation layer works as a

A

Translator.
Not concerned with the meaning of data,
but syntax and format

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Presentation Layer formats

A

TIFF
GIF
JPEG
Compression

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Presentation Layer handles

A

data compression and encryption

Only layer without protocols

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Session Layer 5

A

Responsible for establishing a connection between two applications, maintaining it during the data transfer, and controlling the release of the connections.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Session Layer phases

A

Establish connection
data transfer
connection release

restart and connection if necessary
maintenance of the session.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Session Layer Protocols

A

Password Authentication Protocol (PAP)
Point to Point Tunneling Protocol (PPTP)
Network Basic Output System (NetBIOS)
Remote Procedure Call (RPC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Session Layer modes

A

Simplex
Half Duplex
Full Duplex

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

difference between Session and Transport layers

A

Session is between 2 applications

Transport is between 2 computers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Security issue with RPC

A

lack of authentication or weak authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Session Layer protocols are

A

the least used in a network environment

Should be disabled

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

ATM

A

Asynchronous Transfer Mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

OSI Layers vs TCP/IP Layers

A

Application Application
Presentation
Session
___________________________________
Transport Host to Host
___________________________________
Network Internet
___________________________________
Data Link Network Access
Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Network Attacks can be

A

used as a channel for an attack
or
be the target of attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Transport Layer 4

A

When 2 computers communicate

Handshaking process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Transport Layer provides

A 
reliable data transfer
error detection
correction
recovery
flow control
Optimization
end to end data transport services
establishes logical connection between two computers
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Transport Layer Protocols

A

TCP Transport Control Protocol
UDP User Datagram Protocol
IPX

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

TCP vs UDP

A

connection vs best effort

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Network Layer 3

A

inserts address and routing to packet’s header

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Network Layer Protocols

A

IP Internet Protocol
ICMP Internet Control Message Protocol
RIP Routing Information Protocol
OSPF Open Shortest Path First
IGMP Internet Group Management Protocol
BGP Border Gateway Protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Data Link Layer 2

A 
formats in order to transmit over 
Token ring
ATM
Ethernet
ATM
FDDI
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Data Link sub layers

A

Logical Link Control LLC

Media Access Control MAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Data Link LLC is defined in ISO

A

802-2

Flow control and Error checking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Ethernet is defined in ISO

A

802.3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Data Link MAC knows if the network is

A

Ethernet, Token Ring, or ATM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Token Ring is ISO is

A

802.5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Wireless LAN ISO is

A

802.11

Not to be confused with 802.1 for authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Data Link Protocols

A 
Point to Point Protocol  (PPP)
ATM
Layer 2 Tunneling Protocol  (L2TP)
FDDI
Ethernet
Token Ring
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

IEE 802 Layers

A

LLC

MAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Network Cards bridge the

A

Data Link and Physical Layers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Data Link Layer unit of data

A

Frame

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Physical Layer 1

A

converts bits into voltage for transmission

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Physical Layer controls

A

Synchronization
Data rates
Line Noise
Transmission Techniques

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Presentation Layer Standards

A

American Standard Code for Information Interchange (ASCII)
Extended Binary Coded Decimal Interchange Mode (EBCDOC)
Tagged Image File Format (TIFF)
Joint Photographic Experts Group (JPEG)
Motion Picture Experts Group (MPEG)
Musical Instrument Digital Interface (MIDI)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Bridges and Switches understand only up to the

A

Data Link Layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Repeaters only understand traffic at the

A

Physical Layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Layer 3 device works at the

A

Network Layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Distributed Network Protocol 3

A

Designed for use in SCADA systems
Not a general purpose protocol
No routing functionality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

SCADA systems

A

Hierarchical architecture
Sensors connected to Remote Terminal Units (RTUs)
RTUs aggregate data and relay to the SCADA master

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Remote Terminal Unit

A

In Distributred Network Protocol 3, SCADA, the RTU relays information to the SCADA

Control instructions and configurations changes are sent from SCADA to RTUs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

SCADA master

A

It the Human Machine Interface (HMI)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Controller Area Network Bus

A

Run most automobiles worldwide

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

TCP/IP: Model

A

IP is a network layer protocol and provides routing services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Main protocols of Transport Protocol

A

TCP and UDP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Socket

A

Is the combination of protocol (TCP or UDP), port, and IP address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Well Known Ports

A

0-1023

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Registered Ports

A

1024-49151

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Dynamic Ports

A

49152-65535 available to be used by any application on an “as needed” basis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

TCP Handshake

A

1 Syn
2 Syn//ACK
3. ACK

TCP must setup connection before any data is sent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

SYN flood

A

SYN packets sent with never an ACK.

Floods system with SYN packets

Denial of Service attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Syn Flood defenses

A

SYN caches

delays allocation of a socket until handshakes are complete.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Segment vs Datagram

A

TCP is segment

UDP is Datagram

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

IP 4 vs IP 6 bits

A

IP4 is 32 bit

IP6 is 128 bit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

IP 4 Class Ranges

A

A is 0.0.0.0 to 127.255.255.255
First byte is network remaining for hosts

B is 128.0.0.0 to 191.255.255.255
First 2 bytes are network and the remaining are hosts

C is 192.0.0.0 to 223.255.255.255
First 3 are network and the last one is hosts

D is 224.0.0.0 to 239.255.255.255
Used for multicast addresses

E 240.0.0.0 to 255.255.255
Reserved for research

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

CIDR

A

Classless Interdomain Routing

Provides flexibility to increase of decrease class sized

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

TTL

A

Time to Live

Keeps packets from traversing a network forever

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

TOS

A

Type of Service

Prioritizes different packets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

IP 6

A

Has IPSEC built in
allows scoped addresses
Does not require NAT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Teredo

A

Intersite Tunneling Mechanism using UDP encapsulation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

ISATAP

A

Intrasite tunneling mechanism

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

Danger of Teredo

A

Attackers can use open ports for unintended traffic in and out of the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

802.1AR

A

MAC security standard (MACSec)

Provides a unique ID for a device

EAP-TLS digital certificate

Only communication over network is device authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

MACsec

A

provides hop by hop protection at layer 2

Only authenticated and trusted devices on the network can communicate with each other.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

EAP-TLS authentication framework

A

Each device compliant with 802.1AR comes with a built in device identifier (iDevID)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

802.1AE

A

Provides data encryption, integrity, and origin authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

802.1AF

A

Key agreement

carries out key agreement functions for the session keys used for data encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

RADIUS

A

Remote Authentication Dial In Service

Authenticates devices by digital certificates using 802.1AR EAP-TLS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

TPM

A

Trusted Platform Module

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

Converged Protocols

A

VOIP
FCoE
MPLS
ISCSI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

FCoE

A

Fiber Channel over Ethernet

allows fiberchannel frames to ride on Ethernet

Mostly used in SAN storage

Not common

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

MPLS

A

Multiprotocol Label Switching

Frequently used to create Layer 2 VPNs

Called a layer 2.5 protocol
Data Link 2 and Network 3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

Internet Small Computer System Interface

A

ISCSI

Encapsulates SCSI data to TCP segments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

IP Convergence

A

addresses specific type of converged protocols

Transitions services from disparate media and protocols to IP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

Baseband

A

One channel transmission

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

Broadband

A

Uses several channels

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

Analog vs Digital

A

Analog signals are measured in amplitude and frequency

Digital signals represent binary digits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

ASTM

A

Asynchronous Transfer Mode

Data Link layer framed with start and stop indicators

Transfer data in a stream

Synchronous employs timing mechanisms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

Asynchronous Communication Characteristics

A 
No timing component
Surrounds each bit with processing bits
Parity bit used for error control
Each byte requires three bits of instruction
  start  stop  parity
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

Synchronous Communication Characteristics

A

Timing component for data transmission synchronization
Robust error checking, commonly through
Cyclic Redundancy Checking (CRC)
Used for high speed, high volume transmissions
Minimal overhead compared to asynchronous communication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

Coaxial Cable

A

copper core that is surrounded by a shielding layer and grounding wire.

more resistant to electromagnetic interference (EMI)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

Attenuation

A

loss of signal strength as it travels

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

Cross Talk

A

signals of one wire spill over to the signals of another wire

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

Bus topology types

A

Linear

Tree

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

Star Topology

A

all nodes connect to a central device

Ethernet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

Mesh Topology

A

multiple connection routes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

MTU

A

Maximum Transmission Unit

How much data a frame can carry

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

Token Passing

A

24 bit control frame used to control which computers communicate.

Token is passed from computer to computer.
Only the computer with the token can put frames on the wire.

used by token ring and FDDI technologies

Do not have problems with collisions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

CSMA

A

Used by ethernet
Carrier Sense Multiple Access with Collision Detection
Fasterthan token passing
Wireless uses
CSMA/Collision Avoidance
Each computer signals its intent to transmit data before it actually does so.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

Signal collisions between 2 machines are detected by

A

increased voltage on the line

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

A collision domain is

A

a group of computers contending or competing for the same shared communication medium

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

Broadcast domains

A

are sets of computing nodes that all receive a layer 2 broadcast frame

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

Internetwork

A

When 2 distinct LANs are connected by a router

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

WAN

A

When 2 LANs are connected by a data link layer technology such as frame relay or ATM, they are a WAN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

Ethernet is defined by

A

Contention based technology using a shared medium
Uses broadcast and collision domains
Uses CSMA CD or CA
Supports full duplex communication
Can use twisted pair, coaxal, or fiber optic cabling
Defined by standard IEEE 802.3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

FDDI

A

developed by ANSI
usually used as a backbone using fiber optic cabling
provides fault tolerance by offering a second counter rotating ring
primary ring sends data clockwise
secondary ring transmits data counterclockwise and invoked only if the primary goes down
Each node is connected to both rings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

FDDI 2

A

provides fixed bandwidth that can be allocated for specific applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

Copper Distributed Data Interface

A

CDDI can work over UTP cabling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

IEEE 802.3 802.4 802.5

A

Ethernet is 802.3
FDDI is 802.4
Token ring is 802.5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

IGMP

A

Internet Group Management Protocol
used to report multiport group membership to routers
When a user access multicast traffic, they become a member of a multi cast group.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

Frame

A

Data that is not fully encapsulated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

ARP

A

Address Resolution Protocol
When data link layer receives a frame, the network layer has already assigned a destination IP
ARP broadcasts a frame requesting the MAC address for the destination IP.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

ARP table cache poisoning

A

Goal is to receive packets intended for another computer

This is a masquerading attack

109
Q

DHCP Discover

A

Client broadcast on the network to discover the DHCP server

110
Q

DHCP Offer

A

Server’s response to DHCP discover seeking an IP address

111
Q

DHCP Request

A

Client responds to confirm its acceptance of an IP address

112
Q

DORA process

A 
DHCP
Discover
Offer
Request
Acknowledgement
113
Q

DHCP snooping

A

method to shield networks from unauthenticated DHCP clients

Switches can direct clients to legitimate DHCP servers

Ensures DHCP servers can assign IP Addresses only to selected systems, identified by their MAC addresses

114
Q

RARP

A

for diskless workstations to obtain IP addresses

115
Q

BootP

A

Bootstrap Protocol for diskless workstations to obtain IP addresses

BootP is an enhancement to RARP

116
Q

ICMP

A

Internet Control Message Protocol

IP's messenger boy
delivers status messages
reports errors
replies to certain requests
reports routing information
PING
117
Q

PING

A

Ping is an ICMP utility to test connectivity to another system

Echo replies

118
Q

ICMP attacks

A

data can be inserted to ICMP packets

119
Q

ICMP tunneling

A

sets up covert channel to send data illegitimately

120
Q

Simple Network Management Protocol

A

used to view network status, traffic flows, and hosts

121
Q

2 components of SNMP

A

managers and agents

Manager is server that polls devices

Community string is a password

122
Q

Community String

A

a password for SNMP

Community strings are sent in clear text in SNMP v1 and v2

123
Q

SNMP ports

A

161 and 162

Should be closed to untrusted networks

Version 3 of SNMP has encrypted passwords

124
Q

DNSSEC

A

implements PKI and digital signatures which allows DNS servers to validate the origin of a message to ensure it is not spoofed and potentially malicious

125
Q

DNS Splitting

A

DNS in DMZ handles external hostname to IP addresses.

Internal DNS handles internal hostname to IP addresses

126
Q

Domain grabbing and cyber squatting

A

stolen domain registration

127
Q

SASL

A

Simple Authentication and Security Layer

protocol independent framework for performing authentication

128
Q

Email Relaying

A

mail servers in DMZs may not be locked down enough

This enables spammers to spoof email via loosely configured relays

129
Q

Phishing

A

social engineering

130
Q

SPF

A

Sender Policy Framework

131
Q

Spear Phishing Attack

A

zeroes in on certain people

132
Q

Whaling attack

A

zero in on a big fish

133
Q

Private IP Address ranges

A
  1. 0.0.0 to 10.255.255.255 Class A
  2. 16.0.0 to 172.31.255.255 Class B
  3. 168.0.0 to 192.168.255.255 Class C
134
Q

3 types of NAT

A

Static Mapping a pool of public IP addresses configured. Private addresses are statically mapped to specific public addresses

Dynamic Mapping Pool of IP addresses works as first come first serve

Port Address Translation Only one public IP address for all systems

135
Q

Distance Vector Routing

A

routing decisions based on distance (or number of hops) and a vector (direction)

Looks only at the number of hops

RIP is a distance vector routing protocol

136
Q

Link State Routing

A

sees more than just number of hops

OSPF is a Link State Routing Protocol

137
Q

Routing Information Protocol

A

RIP

outlines how routers exchange routing table data. calculates the shortest difference.

Considered legacy

138
Q

Open Shortest Path First

A

OSPF
link state
allows for a hierarchical routing network
OSPF has replaced RIP

139
Q

Interior Gateway Routing Protocol

A

IGRP distance vector routing protocol

proprietary to CISCO

140
Q

Enhanced Interior Gateway Protocol

A

EIGRP
Cisco proprietary
faster routing than IGRP

141
Q

Spanning Tree Algorithm STA

A

adds intelligence to bridges
Ensures frames do not circle networks forever.
provides redundant paths
assigns priority valuies

142
Q

Source Routing

A

tell the bridges where to send the packets

143
Q

PBX

A

Public Branch Exchange

private telephone switch

144
Q

Phreaker

A

Phone Hacker

Uses default passwords to enter PBX switches

145
Q

Types of firewalls

A 
Packet Filtering
Stateful
Proxy
Dynamic Packet Filtering
Kernel Proxy
146
Q

Three firewall arcitectures

A

Screened Host

Multihome

Screened Subnet

147
Q

Packet Filtering Firewalls

A

based on network level protocol values
configured with ACLs
dictate type of traffic

148
Q

First generation firewalls

A

Packet filtering

Only have capability of reviewing protocol header at network and transport layers

149
Q

Ingress filtering

A

Inbound traffic filtering

150
Q

egress filteringq

A

outbound traffic filtering

151
Q

Stateless inspection

A

Packet filtering

device does not understand the content packets are working within

152
Q

Firewall used at the edge of a network

A

Packet filtering

gets the obvious junk

153
Q

Weaknesses of packet filtering

A

Cannot prevent attacks that employ application specific vulnerabilities or functions
have limited logging functionality
do not support advanced user authentication
cannot detect spoofed addresses
not able to detect packet fragmentation attacks

154
Q

Advantages of packet filtering

A

scalable
not application dependent
high performance
commonly used as first line of defense

155
Q

Stateful firewalls

A

remembers and keeps track of packets until connection is closed

Keeps state of connection

156
Q

Stateful Inspection Firewall Characteristics

A

Maintains a state table that tracks each communication session
Provides a high degree of security and does not introduce the performance hit that application proxy firewalls introduce
Is scalable and transparent to users
Provides data for tracking connectionless protocols such as UDP and ICMP
Stores and updates the state and context of data within the packets

157
Q

Proxy firewalls

A

Middleman
intercepts and inspects messages before delivering them
Stands between a trusted and untrusted network.
Breaks the communication channel

158
Q

Circuit level proxy

A

creates a connection between two communicating systems.
Works at the session layer of the OSI model
cannot look into contents of a packet
Considered application dependent
Traffic appears to have come from the proxy

159
Q

Application Level Proxy

A

inspect the packet up through the application layer
Understands the packet as a whole
can make access decisions based on content
Understands services and protocols
can distinguish commands
Has one proxy per protocol

160
Q

Characteristics of application level firewalls

A

extensive logging capabilities

capable of authenticating users directly

161
Q

Disadvantages of using application level proxy firewalls

A

not generally well suited to high bandwidth or real time applications
tend to be limited in terms of support for new network applications and protocols
They create performance issues because of the per-packet processing requirements.

162
Q

SOCKS

A

a circuit level proxy gateway

provides secure channel between 2 computers

163
Q

Dynamic Packet Filtering Firewalls

A

Creates an ACL that allows and external entity to communicate with an internal system via a high numbered port

Without this, you would punch holes in your firewalls for ports above 1023

164
Q

Kernel Proxy Firewalls

A

faster than application level proxy firewalls

Connection between internal and external is broken

165
Q

Fifth generation Firewall

A

Kernel Proxy Firewall

166
Q

Next Generation Firewalls

A

Incorporates a signature based IPS engine

Connects to external data sources such as Active Directory

167
Q

Firewall type and OSI layer

A 
Packet Filtering  Network Layer
Stateful               Network Layer
Application Level
Proxy                    Application Layer
Circuit Level 
Proxy                    Session Layer
Dynamic packet filtering  Network Layer
Kernel Proxy         Application Layer
Next Generation   Multiple Layers
168
Q

Bastion Host

A

highly exposed device most likely to be targeted by attackers
Can be on the public side of a DMZ or directly connected to an untrusted network
Should have all unnecessary services and accounts disabled and administrative tools removed

169
Q

Dual Homed Firewall

A

device that has 2 interfaces
One connected to one network and one connected to another network
Should have packet forwarding and routing turned off

170
Q

Screened Host

A

firewall that communicates directly with perimeter router and internal network

171
Q

Screened subnet

A

2 firewalls create a DMZ

172
Q

Masquerading or spoofing

A

attacker modifies a packet header to have the source address of a host inside the network to be attacked.

No reason for a packet with an internal address to come in from the outside.

173
Q

Fragmentation Attacks

A

IP Fragmentation

Teardrop attack

Overlapping fragment attack

174
Q

IP Fragmentation attack

A

Flaws within IP are exploited.

Causes DoS attacks

175
Q

Teardrop Attack

A

Malformed fragments are created by the attacker

When reassembled, cause system instability

176
Q

Overlapping Fragment attack

A

overwrites a previously approved fragment and executes an attack on the victim system.

177
Q

Source routing

A

the packet defines the network path. bypasses the router.

Source routing is often disabled

178
Q

Honeypot

A

intended to be exploited by attackers

Usually sits in the screened subnet or DMZ

179
Q

Tarpits

A

slow down attacker

180
Q

Unified Threat Management

A

provide multiple functionalities in a single network appliance

Considered all in one devices

181
Q

Issues with UTM products

A

Single point of failure for traffic
Single point of compromise
Performance issues

182
Q

Content Distribution Networks

A

multiple servers distributed across a large region optimized for users closest to it.

More resistant to Denial of Service attacks

183
Q

Software Defined Networking

A

dynamically route traffic to services and platforms

184
Q

Drivers in SDN

A

Cloud Computing

Big Data

Mobile computing

185
Q

Control Planes

A

Where the internetwork routing decision are made

Part of the router that runs the routing protocol like OSPF.

Responsible for discovering the topology of the network and maintaining routing tables

186
Q

Forwarding plane

A

where traffic forwarding decisions are made
Follows the directions of the control plane
Control plane is the strategic, methodical planner of traffic routing.
Forwarding plane is the tactical, fast executioner of those plans

187
Q

Control Plane vs Forwarding Plane

A

Control plane is central

Forwarding is in each device

188
Q

Approaches to SDN

A

Open
API
Overlay

189
Q

Intranet vs extranet

A

strictly internal vs internal with external links

Extranets are often used in business to business communication

190
Q

Value Added Networks

A

Use EDI for internal communications and with other companies

commonly used with supplier companies to provide inventory for like Target, Walmart

191
Q

EDI

A

Electronic Data Interchange

Provides structure and organization for electronic documents, orders, invoices, purchase orders, and data flow

192
Q

Metropolitan Area Networks

A

usually a backbone that connects LANs to eachother and LAN to WAN, the internet, and telecommunication networks

193
Q

SONET

A

Synchronous Optical Networks

Majority of Metropolitan Area networks are SONET or FDDI

194
Q

SONET is a standard for

A

telecommunications transmissions over fiber optic cables

SONET is self healing. If a break in a line occurs, it can use a backup redundant ring

195
Q

VPLS

A

Virtual LAN Service is a multipoint, Layer 2, VPN that connects 2 or more customer devices using ethernet bridging techniques

VPLS emulates a LAN over a managed IP/MPLS network

196
Q

Wide Area Networks

A

When a computer on one network needs to communicate with a network on the other side of the country or in a different country altogether, WAN technologies kick in

197
Q

Asynchronous Transfer Mode (ATM)

A

Telecommunication packets that travel on SONET

High speed network technology used in WAN implementations by carriers, ISPs, and telephone companies

198
Q

Telecom History

A 
Copper lines carry purely analog signals
T1 lines carry up to 24 conversations
T3 lines carry up to 28 T1 lines
Fiber Optics over SONET networks
ATM over SONET
199
Q

Dedicated link

A

also called a leased line or point to point link

Link is not shared with any other entities

200
Q

STDM

A

Statistical time division Multiplexing

Transmits several types of data simultaneously across a single transmission line such as T1 or T3

201
Q

CSU/DSU

A

Required when digital equipment will be used to communicate with telecommunication lines

Converts data from routers, switches, and multiplexers to be transmitted over service provider digital lines

202
Q

Two main types of switching

A

Circuit switching and packet switching

203
Q

Circuit Switching

A

Sets up a virtual connection that acts like a dedicated link between 2 systems

204
Q

Packet switching

A

is not dedicated

flow may use various routes

205
Q

Circuit switching characteristics

A

Connection oriented virtual links
Traffic travels in a predictable and consistent manner
Fixed delays
Usually caries voice oriented data

206
Q

Packet switching characteristics

A

packets can use many dynamic path
traffic is usually bursty in nature
variable delays
usually carries data oriented data

207
Q

Frame relay

A

a WAN technology that operates at the data link layer

uses packet switching technology to let multiple companies and networks share the same WAN medium

Is considered legacy

208
Q

Permanent Virtual Circuit PVC

A

like a private line with agreed upon availability

has guaranteed bandwidth

209
Q

Switched Virtual Circuits SVCs

A

similar to dial up connections

Variable bandwidth

210
Q

Quality of Service

A

distinguishes between different classes of messages and assigns priority levels

211
Q

QOS has 3 levels

A

Variable bit Rate VBR

Unspecified bit rate UBR

Available Bit Rate ABR

212
Q

Synchronous Data Link Control

A

used in networks that use dedicated leased lines with permanent physical connections

213
Q

HDLC

A

a framing protocol that is used mainly for device to device communication

214
Q

Point to Point Protocol PPP

A

a data link protocol that carries out framing and encapsulation for point to point connections

encapsulation of multiprotocol packets

Often used in telecom

215
Q

PPP authenticattion

A

PAP Password Authentication Protocol
CHAP Challenge Handshake Authentication Protocol
EAP Extensible Authentication Protocol

216
Q

Password Authentication Protocol PAP

A

Insecure as it sends passwords in cleartext

If must be used, use it over an encrypted connection

217
Q

Link Control Protocol LCP

A

establishes, configures, and maintains connections

Used to carry out encapsulation format options
handles variable limits on packet sizes, detects loopback sizes

218
Q

Data Link Protocols

A

control how devices talk to eachother

219
Q

HSSI

A

High Speed Serial Interface

used to connect multiplexers and routers to high speed communication services such as ATM and frame relay

220
Q

SIP

A

Session Initiation Protocol
sets up and breaks down call sessions
Application Layer Protocol that can work over TCP or UDP

A signaling protocol widely used for VOIP communication sessions

221
Q

Components needed for VOIP

A

an ip telephony device
a call processing manager
voicemail system
gateway

222
Q

SPIT

A

Spam over Internet Telephony

223
Q

ISDN

A

Integrated Service Digital Network

224
Q

PPTP

A

Point to Point Tunneling Protocol
Used to secure PPP connections
Encapsulates PPP

225
Q

PPTP authentication

A

PAP
CHAP
MS-CHAP
EAP TLS

226
Q

MPPE

A

Microsoft Point to Point Encryption

227
Q

PPTP limitations

A

Restricted to IP
cannot support multiple connections
can be used for system to system communication but not gateway to gateway
PPTP relies on PPP functionality for a majority of its security functions
Never became an industry standard

228
Q

Layer 2 Tunneling Protocol

A

combines features of PPTP and Cisco’s Layer 2 Forwarding (L2F)
L2TP tunnels PPP traffic over various network types
(IP, ATM, X25)
not just restricted to IP
Integrates with IPSec to provide confidentiality, integrity, and potentially another layer of authentication

229
Q

IP:Sec

A

A suite of protocols developed to protect IP traffic
bolts onto IP 4
PPTP and L2TP work at the data link layer.
IPSec works at the network layer

230
Q

Protocols that make up IPSEC

A

Authentication Header (AH)
Encapsulating Security Payload (ESP)
Internet Security Association and Key Management Protocol (ISAKMP)

231
Q

Can be used separately or together in IPSec

A

AH and ESP

232
Q

HAIIPE

A

High Assurance Internet Protocol Encryptor
is a Type 1 encryption device based on IP
secure gateway that allows 2 enclaves to exchange date over an untrusted network
works at the Network layer
has largely replaces link layer encryption

233
Q

Transport Layer Security VPN

A

Works at the session layer
used mainly to protect HTTP traffic
already embedded in most web browsers

234
Q

IPSEC can be configured

A

to provide transport adjacency

more than one security protocol (ESP and AH) is used in a VPN tunnel

235
Q

Iterated runneling

A

an IPSEC tunnel tunneled through another IPSec tunnel

236
Q

Common types of VPN tunnel

A

TLS portal VPN

TLS tunnel VPN

237
Q

TLS portal VPN

A

single standard TLS connection to a website
called a portal because a single location provides access to other resources
remote user accesses TLS/VPN gateway using a browser, is authenticated, and presented with a webpage for services

238
Q

TLS Tunnel VPN

A

Individual uses a web browser to securely access multiple network services including applications and services that are not web based

239
Q

PPTP summary

A

Works in a client server model
Extends and protects PPP connections
Works at the data link layer
Transmits over IP networks only

240
Q

Layer 2 Tunneling Protocol Summary

A 
Hybrid of L2F and PPTP
Extends and protects PPP connections
Works at the data link layer
Transmits over multiple types of networks, not just IP
Combined wiht IPSec for security
241
Q

IPSec Summary

A

Handles multiple VPN connections at the same time
Provides secure authentication and encryption
Supports only IP Networks
Focuses on LAN to LAN communication rather than user to user communication
Works at the network layer, and provides security on top of IP

242
Q

Transport layer Security TLS Summary

A

Works at the session layer and protects mainly web and email traffic
Granular access control and configuration available
Easy deployment since TLS is already embedded in web browsers
Can only protect a small number of protocol types
Not an infrastructure level VPN solution

243
Q

Password Authentication Protocol

AP)

A

used by remove users to authenticate over PPP connections
Provides identification and authentication
Credentials are sen to the authentication server after a connection has been established via PPP
Authentication server has a database to authenticate users
PAP security is the least secure because credentials are sent in cleartext

244
Q

Challenge Handshake Authentication Protocol (CHAP)

A

addresses vulnerabilities found in PAP
uses a challenge/response instead of having the user send password over the wire
Server sends a one time challenge (NONCE)
Challenge is encrypted

245
Q

MS CHAP

A

Microsoft version of CHAP provides mutual authentication functionality
Has 2 versions that are incompatible
Not vulnerable to P
man in the middle attacks because it continues the challenge/response activity

246
Q

Extensible Authentication Protocol

A

supported by PPP provides a framework to enable many types of authentication techniques.
Can use one time passwords, token cards, biometrics, Kerberos, digital certificates

247
Q

Wireless FHSS vs DSSS

A

FHSS uses only a portion of the total bandwidth available.

DSSS uses all available bandwidth

248
Q

Ad Hoc wireless LAN

A

No APs
called infrastructure WLAN used to extend an existing wired network
acts as a wireless hub stream symmetric cipher

249
Q

WEP deficiencies

A

use of static encryption keys
ineffective use of initialization vectors
Lack of packet integrity assurance

250
Q

Protocol used by WEP

A

RC4

251
Q

Temporal Key Integrity Protocol TKIP

A

backward compatible with WLAN devices
TKIP generates new dynamic keys
Made to increase security of WE{ or replace it without the need for hardware upgrade

252
Q

Tools to crack WEPs

A

AirSnort

WEPCrack

253
Q

Lightweight Extensible Authentication Protocol

A

CISCO proprietary

254
Q

EAP TLS

A

used by Microsoft and others

Authenticates by digital certificates

255
Q

Protective EAP

A

is server side only EAP

256
Q

MIME

A

Multipurpose Internet Mail Extensions

specifies how multimedia and email binary attachments are to be transferred

257
Q

S MIME

A

Secure MIME is a standard for encrypting and digitally signing email and providing secure transmission

258
Q

Pretty Good Privacy

A

PGP
Phil Zimmerman freeware email security program
First widespread public key encryption program
is a complete cryptosystem that protects email and files
Can use RSA public key encryption for key management and IDEA symmetric cipher for bulk encryption of data
Uses MD5 hashing algorithm,
authentication by using public key certificates

259
Q

Web of trust

A

Used by PGP instead of Certificate Authorities (CA)

260
Q

HTTP Secure

A

HTTP running over Secure Sockets Layer (SSL)or TLS.

261
Q

Secure Sockets Layer

A

uses public key encryption and provides data encryption, server authentication, message integrity, and optional client authentication
SSL developed by Netscape and not open community pits security protocol

262
Q

POODLE

A

Padding Oracle On Downgraded Legacy Encryption attach in 2014 was death for SSL Forces SSL to downgrade its security for the sake of interoperabiity

263
Q

Secure Shell SSH

A

functions as a type of tunneling mechanism
provides terminal like access to remote computers. SSH is a program and protocol that can be used to log into another computer over a network

264
Q

Denial of Service

A

compromises the availability of a system

results in a service or resource degraded or made unavailable to legitimate users

265
Q

Malformed Packets

A

Ping of death
ICMP echo attack
early networks did not enforce the maximum length of a ICMP packet which is 65536 bytes. Operating systems could not handle packets larger

266
Q

Flooding

A

overwhelm the target computer with packets.

267
Q

SYN flooding

A

exploits the three way handshake that TCP users

268
Q

Distributed Denial of Service

A

High volume DOS
uses an army of hijacked or zombie computers
Best defense is a content based distribution network

269
Q

Sniffing

A

Is the attack of confidentiality of your data

Requires NICs to be in promiscuous mode

CISSP Domain 1 (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions