CompTIA Security+: Enterprise Security Capabilities

Question 1

What port is Kerboros

Answer 1

88
network auth protocol that allows for communication over a non-secure network

Question 2

What port is SNMP

Answer 2

161/162

Question 3

What port is DHCP

Answer 3

67/68

Question 4

What port is TACACS+

Answer 4

49

Question 5

What port is FTPS

Answer 5

989/990 Uses TLSS for encryption; can also run on ports 20/21

Question 6

What port is RADIUS

Answer 6

1812/1813

Question 7

What port is Diameter

Answer 7

3868 ; upgrade to RADIUS

Question 8

What is SRTP

Answer 8

5004

Question 9

What does DNSSEC do?

Answer 9

Provides an extra layer of trust on top of DNS by providing authentication; does not provide confidentiality.

Question 10

What helps to facilitate signature validation within DNSSEC?

Answer 10

RRSIG - contains a cryptographic signature
DNSKEY- contains a public signing key
DS- contains the hash of a DNSKey record
NSEC and NSEC3- for explicit denial of existence of a DNS record
CDNSKEY and CDS - for a child requesting updates to DS record(s) in the parent zone

Question 11

What prevents Sender address forgery?

Answer 11

SPF

Question 12

What does SPFv1 do

Answer 12

Protects the envelope sender address, which is used for messages delivery

spfv1 permits domain owners to designate their mail sending policy(e.g. which mail servers they use to send mail from their domain)

Question 13

What is DKIM

Answer 13

DKIM is an email authentication method conducted between the outbound and inbound mail server or Message Transfer Agents.

With DKIM, the outbound mail server appends a digital signature to the mail then the inbound server verifies the signature by looking up the public key and then comparing it with the signature from the specified outgoing mail server.

Question 14

What is DMARC?

Answer 14

DMARC is an email authentication, policy, and reporting protocol. It builds on the widely deployed and previously discussed SPF and DKIM protocols, offering linkage to the sender or “From:” domain name, published policies for recipient handling of authentication failures, reporting from receivers to senders, to enhance and monitor protection of the domain from fraudulent email.

Question 15

What is FIM?

Answer 15

File Integrity Monitoring, or FIM, examines operating system files, configuration files, registries, application software, and Linux system files for changes and for indicators of compromise. Windows FIM provides alerts about suspicious activity such as file and registry key creation or deletion.