Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP > Domain 3 – Telecom and Network Security > Flashcards

Domain 3 – Telecom and Network Security Flashcards

1
Q

DSL

A

Digital Subscriber Line

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

ISDN

A

Integrated Services Digital Network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

PAP

A

Password Authentication Protocol – clear text

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

CHAP

A

Challenge Handshake Authentication Protocol – protects password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Remote User Management

A
  • Justification of remote access
  • Support Issues
  • Hardware and software distribution
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Intrusion Detection…

A
  • Notification

* Remediation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

CIRT

A 
Computer Incident Response Team
CIRT Performs
•	Analysis of event
•	Response to incident
•	Escalation path procedures
•	Resolution – post implementation follow up
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Network Based IDS

A

Commonly reside on a discrete network segment and monitor the traffic on that network segment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Host Based IDS

A

Use small programs, which reside on a host computer. Detect inappropriate activity only on the host computer, not the network segment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Knowledge Based IDS

A 
Signature based
Pros:
Low false alarms	
Alarms Standardized	
Cons:
Resource Intensive
New or unique attacks not found
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Behavioral Based IDS

A 
Statistical Anomaly
Pros	:
Dynamically adapts	
Not as operating system specific	
Cons:
High False Alarm rates
User activity may not be static enough to implement
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

CIRT – (CERT)

A 
Computer Incident Response Team
Responsibilities:
•	Manage the company’s response to events that pose a risk
•	Coordinating information
•	Mitigating risk, minimize interruptions
•	Assembling technical response teams
•	Management of logs
•	Management of resolution
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Network Availability

A
  • RAID – Redundant Array of Inexpensive Disks
  • Back Up Concepts
  • Manage single points of failure
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

RAID

A

Redundant Array of Inexpensive Disks
• Fault tolerance against server crashes
• Secondary – improve system performance
• Striping – Caching and distributing on multiple disks
• RAID employs the technique of striping, which involves partitioning each drive’s storage space into units ranging from a sector (512 bytes) up to several megabytes. The stripes of all the disks are interleaved and addressed in order.
• Hardware and software implementation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

FRDS+

A
  • Protect from disk failure – can reconstruct disks by automatically hot swapping while server is running
  • Includes environmental
  • FRDS+ adds hazard warnings
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

RAID Advisory Board

A

• Three types – Failure Resistant Disk Systems (FRDS) - the only current standard, Failure Tolerant Disk Systems, and Disaster Tolerant Disk Systems.
• FRDS: provides the ability to reconstruct the contents of a failed disk onto a replacement disk.
• Enables the continuous monitoring of these parts and the alerting of their failure
FRDS+

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

RAID 0 (STRIPPING)

A
  • Creates one large disk by using multiple disks – striping
  • No redundancy
  • No fault tolerance (1 fail = all fail)
  • Read/Write performance is increased
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

RAID 1 (MIRRORING)

A
  • Mirroring
  • Duplicates data on other disks (usually one to one ratio)
  • Expensive (doubles cost of storage)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

RAID 2 (HAMMING CODE PARITY)

A
  • Multiple disks
  • Parity information created using a hamming code
  • Can be used in 39 disk array 32 Data and 7 recovery
  • Not used, replaced by more flexible levels
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

RAID 3 (BYTE LEVEL PARITY) RAID 4 (BLOCK LEVEL PARITY)

A
  • RAID 3 – Byte level
  • RAID 4 – Block level
  • Stripe across multiple drives
  • Parity information on a parity drive
  • Provides redundancy
  • Can affect performance with single parity drive
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

RAID 5 (INTERLEAVE PARITY)

A
  • Most popular
  • Stripes data and parity information across all drives
  • Uses interleave parity
  • Reads and writes performed concurrently
  • Usually 3-5 drives. If one drive fails, can reconstruct the failed drive by using the information from the other 2.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

RAID 7 (SINGLE VIRTUAL DISK)

A
  • Functions as a single virtual disk
  • Usually software over Level 5 hardware
  • Enables the drive array to continue to operate if any disk or any path to any disk fails.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

RAID Summary

A 
0 – Striping
1 – Mirroring
2 – Hamming code parity
3 – Byte level parity
4 – Block level parity
5 – Interleave parity
7 – Single Virtual Disk
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Redundant Servers

A
  • Primary Server mirrors to secondary server
  • Fail-over or rollover to secondary in the event of a failure
  • Server fault tolerance can be warm or hot
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Server Cluster

A
  • Group of independent servers managed as a single system
  • Load Balancing
  • Improves performance
  • “Server Farm”
  • Microsoft Cluster Server
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Full Back Up

A

every file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Incremental Backup

A
  • Only files that have been changed or added recently
  • Only files with their archive bit set are backed up.
  • This method is fast and uses less tape space but has some inherent vulnerabilities, one being that all incremental backups need to be available and restored from the date of the last full backup to the desired date should a restore be needed.
  • Restore = last full backup plus each incremental
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Differential Backup

A
  • Only files that have changed since the last backup
  • All files to the full backup (additive)
  • Restore = full backup plus the last differential
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Types of Tape Backup

A
  • DAT – Digital Audio Tape
  • QIC – Quarter Inch Cartridge – Small and slow
  • 8mm Tape – Superceded by DLT
  • DLT – Digital Linear Tape – 4mm tape – large and fast
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Other media

A

CD – permanent backups, longer shelf life than tape
ZIP – JAZZ – Common
Tape Array – 32 to 63 Tape Array using RAID technology
HSM – Hierarchical. Provides a continuous on-line backup by using optical or tape ‘jukeboxes’, similar to WORMs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Common Backup Problems

A
  • Slow transfer of data to backup
  • Retrieval time to restore
  • Off hour processing and monitoring
  • Server disk space expands over time
  • Loss of data between last back up
  • Physical security of tapes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Single Points of Failure Cabling Failures

Coaxial:

A

many workstations or servers attached to the same segment of cable, which creates a single point of failure if it is broken (similar to cable TV cabling). Exceeding cable length is a source of failure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Single Points of Failure Cabling Failures

Twisted Pair: (CAT3 and CAT 5)

A

The difference between the two has to do with the tightness the copper wires are wound. Tightness determines its resistance to interference. CAT3 is older. Cable length is a common failure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Single Points of Failure Cabling Failures

Fiber Optic

A

Immune to EMI. Longer usable length (upto 2kms). Drawback is costs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Technology Failures

Ethernet

A
  • Most Popular

* Extremely resistance to failure, especially in a star-wired config.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Technology Failures

Token Ring

A
  • Since token is passed by every station on the ring

* NIC set at wrong speed or in error state can bring the network down

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Technology Failures

FDDI – Fiber Distributed Data Interface

A
  • Dual rings fault tolerance (if first ring fails, the secondary ring begins working)
  • Sometimes uses second ring for improved performance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Technology Failures

Leased Lines

A

T1 and ISDN – go with multiple vendors to reduce failures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Technology Failures

Frame Relay

A
  • Public switched WAN
  • Highly Fault Tolerant
  • Bad segment diverts packets
  • Can use multiple vendors for high availability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Other Single Points of Failure

A
  • Can be any device where all traffic goes through a single device - Router, firewall, hub, switch
  • Power failure – surges, spikes – install UPS
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Note: Trivial File Transfer Protocol (TFTP)

A

is good tool for router configuration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Classes of Network Abuse

Class A

A

unauthorized access through circumvention of security access controls. Masquerading, logon abuse (primarily internal attacks)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Classes of Network Abuse

Class B

A

non-business use of systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Classes of Network Abuse

Class C

A

Eavesdropping
• Active: Tampering with a transmission to create a covert signaling channel or probing the network
• Passive: Covertly monitoring or listening to transmissions that is unauthorized.
• Covert Channel: using a hidden unauthorized communication
• Tapping: refers to the physical interception of a transmission medium (like splicing of cable).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Classes of Network Abuse

Class D

A

Denial of Service Saturation of network services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Classes of Network Abuse

Class E

A

Network Intrusion – penetration (externally)
• Spoofing – A spoofing attack involves nothing more than forging one’s source address. It is the act of using one machine to impersonate another.
• Piggy Backing – attack using another users connection
• Back Door – attack via dial up or external connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Classes of Network Abuse

Class F

A

Probing
• Gives an intruder a road map of the network for DoS attack
• Gives a list of available services
• Traffic analysis via ‘sniffers’ which scans the host for available services
o Like a telephone wiretap allows the FBI to listen in on other people’s conversations, a “sniffing” program lets someone listen in on computer conversations.
• Tools: Telnet (manual), vulnerability scanners (automatic).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Common DoS Attacks

A
  • Filling hard drive space with email attachments
  • Sending a message that resets a targets host subnet mask causing routing disruption
  • Using up all of the target’s resources to accept network connections
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Buffer Overflow Attack

A
  • When a process receives much more data than expected.
  • Since buffers are created to contain a finite amount of data, the extra information - which has to go somewhere - can overflow into adjacent buffers, corrupting or overwriting the valid data held in them.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

PING

A

Packet Internet Groper – uses ICMP – Internet Control Message Protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

PING of Death

A

Intruder sends a PING that consists of an illegally modified and very large IP datagram, thus overfilling the system buffers and causing the system to reboot or hang.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

SYN Attack

A
  • Attacks the buffer space during a Transmission Control Protocol (TCP)
  • Attacker floods the target system’s ‘in-process’ queue with connection requests causing the system to time-out.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Teardrop Attack

A
  • Modifying the length of the fragmentation fields in the IP Packet
  • When a machine receives this attack, it is unable to handle the data and can exhibit behavior ranging from a lost Internet connection to the infamous blue screen of death. Becomes confuse and crashes.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Smurf Attack

A

• (Source Site) Sends spoofed network request to large network (bounce site) all machines respond to the (target site). IP broadcast addressing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Fraggle Attack

A

• The “smurf” attack’s cousin is called “fraggle”, which uses UDP echo packets in the same fashion as the ICMP echo packet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Session Hijacking Attacks :

IP Spoofing

A

IP spoofing is used to convince a system that it is communicating with a known entity that gives an intruder access. IP spoofing involves altering the packet at the TCP level. The attacker sends a packet with an IP source address of a known, trusted source. E-mail spoofing is the forgery of an e-mail header so that the message appears to have originated from someone or somewhere other than the actual source.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Session Hijacking Attacks

TCP Sequence number

A

tricks the target in believing that it’s connected to a trusted host and then hijacks the session by predicting the target’s choice of an initial TCP Sequence number. Then it’s used to launch various other attacks on other hosts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Salami Attack

A

A series of minor computer crimes that are part of a larger crime.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Rainbow Series

A
  • Redbook – TNI - Trusted Network Interpretation
  • Time and technological changes lessen the relevancy of the TNI to contemporary networking.
  • Deals with technical issues outside the scope of the Orange Book wrt to networks
  • Redbook interprets the Orange Book
  • Orange Book – Trusted Computer Security Evaluation Criteria
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

TNI Evaluation Classes

A 
D – Minimal protection
C – Discretionary protection
C1 – Discretionary Security Protection
C2 – Controlled Access protection
B – Mandatory
B1 – Labeled Security
B2 – Structured
B3- Security Domains
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Protocols

A

is a standard set of rules that determines how computers communicate with each other across networks despite their differences (PC, UNIC, Mac..)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Layered architecture

A

shows how communication should take place
• Clarify the general functions of a communication process
• To break down complex networking processes into more manageable sublayers
• Using industry-standard interfaces enables interoperability
• To change the features of one layer without changing all of the code in every layer
• Easier troubleshooting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Layer 7

A

Application Security: Confidentiality, authentication, data integrity, non-repudiation
Technology: gateways
Protocols: FTP, SMB, TELNET, TFTP, SMTP, HTTP, NNTP, CDP, GOPHER, SNMP, NDS, AFP, SAP, NCP, SET n Responsible for all application-to-application communications. User information maintained at this layer is user data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Layer 6

A

Presentation Security: confidentiality, authentication, encryption
Technology: gateway
Protocols: ASCII, EBCDIC, POSTSCRIPT, JPEG, MPEG, GIF n Responsible for the formatting of the data so that it is suitable for presentation. Responsible for character conversion (ASCII/EBCDIC), Encryption/Decryption, Compression, and Virtual Terminal Emulation. User information maintained at this layer is called messages.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Layer 5

A

Session Security: None
Technology: gateways
Protocols: Remote Procedure Calls (RPC) and SQL, RADIUS, DNS, ASP n Responsible for the setup of the links, maintaining of the link, and the link tear-down between applications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

Layer 4

A

Transport Security: Confidentiality, authentication, integrity
Technology: gateways
Protocols: TCP, UDP, SSL, SSH-2, SPX, NetBios, ATP n Responsible for the guaranteed delivery of user information. It is also responsible for error detection, correction, and flow control. User information at this layer is called datagrams.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

Layer 3

A

Network Security: confidentiality, authentication, data integrity
Technology: virtual circuits (ATM), routers
Protocols: IP, IPX, ICMP, OSPF, IGRP, EIGRP, RIP, BOOTP, DHCP, ISIS, ZIP, DDP, X.25 n Responsible for the routing of user data from one node to another through the network including the path selection. Logical addresses are used at this layer. User information maintained at this layer is called packets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

Layer 2

A

Data Link Security: confidentiality,
Technology: bridges, switch
Protocols: L2F, PPTP, L2TP, PPP, SLIP, ARP, RARP, SLARP, IARP, SNAP, BAP, CHAP, LCP, LZS, MLP, Frame Relay, Annex A, Annex D, HDLC, BPDU, LAPD, ISL, MAC, Ethernet, Token Ring, FDDI n Responsible for the physical addressing of the network via MAC addresses. Ther are two sublevels to the Data-Link layer. MAC and LLC. The Data-Link layer has error detection, frame ordering, and flow control. User information maintained at this layer is called frames.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

Layer 1

A

Physical Security: confidentiality
Technology: ISDN, Hubs, Repeaters, Cables
Protocols: 10BaseT, 100BaseT, 1000BaseT, 10Base2, 10Base5, OC-3, OC-12, DS1, DS3, E1, E3, ATM, BRI, PRI, X.23 n Responsible for the physical transmission of the binary digits through the physical medium. This layer includes things such as the physical cables, interfaces, and data rate specifications. User information maintained at this layer is called bits (the 1s and 0s).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

Data encapsulation

A

is the process in which information from one packet is wrapped around or attached to the data of another packet. In OSI model each layer encapsulates the layer immediately above it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

OSI Layers

A
  • Process down the stack and up the stack

* Each layer communicates with corresponding layer through the stack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

OSI Security - 6 Security Services.

A 
A security service is a collection of security mechanisms, files, and procedures that help protect the network.
•	Logging and monitoring
•	Authentication
•	Access control
•	Data confidentiality
•	Data integrity
•	Non-repudiation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

OSI Security - 8 Security Mechanisms.

A 
A security mechanism is a control that is implemented in order to provide the 6 basic security services.
•	Encipherment
•	Digital signature
•	Access Control
•	Data Integrity
•	Authentication
•	Traffic Padding
•	Routing Control
•	Notarization
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

TCP

A

Transmission Control Protocol
• Connection Oriented
• Sequenced Packets
• Acknowledgment is sent back for received packets
• If no acknowledgement then packet is resent
• Packets are re-sequenced
• Manageable data flow is maintained

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

UDP

A 
User Datagram Protocol
•	Best effort
•	Doesn’t care about sequence order
•	Connectionless
•	Less overhead and faster than TCP
76
Q

IP – Internet Protocol

A
  • All hosts on a network have an IP address
  • Each data packet is assigned the IP address of the sender and receiver

It provides an ‘unreliable datagram service’. Provides:
• No guarantees that the packet will be delivered
• No guarantee that the packet will be delivered only once
• No guarantee that it will be delivered in the order which it was sent

77
Q

ARP – Address Resolution Protocol

A
  • Use the IP Address to get the MAC Address
  • MAC address is 48 bit
  • IP address is 32 bit
  • Only broadcast to network first time, otherwise stores IP and MAC info in table
78
Q

RARP – Reverse Address Resolution Protocol

A
  • Use the MAC Address to get the IP Address

* RARP Server tells diskless machines IP Address

79
Q

ICMP – Internet Control Message Protocol

A
  • Management Protocol and messaging service provider for IP.
  • Sends messages between network devices regarding the health of the network.
  • Ping is ICMP packet
  • Ping checks if a host is up and operational
80
Q

Telnet

A

Terminal Emulation (No File Transfer)

81
Q

NFS

A

Network File Sharing

82
Q

SMTP

A

Simple Mail Transfer Protocol
Internet Protocol
Simple Mail Transfer Protocol is an Internet standard for electronic mail transmission. First defined by RFC 821 in 1982

83
Q

LDP

A

Line Printer Daemon – with LPR enables print spooling

84
Q

SNMP

A

Simple Network Management Protocol
• Provides for the collection of network information by polling the devices on the network from a management station.
• Sends SNMP traps (notification) to MIBS Management Information Bases

85
Q

MIBS

A

Management Information Bases

Sends SNMP traps (notification) to MIBS Management Information Bases

86
Q

Bootstrap (BootP) protocol

A

Diskless boot up. BootP server hears the request and looks up the client’s MAC address in its BootP file. It’s an internet layer protocol.

87
Q

SET – Secure Electronic Transaction

A

• Originated by Visa and MasterCard
• Being overtaken by SSL
At the Application Layer (OSI Model)

88
Q

SHTTP - Secure HTTP

A

• Early standard for encrypting HTTP documents
• Also being overtaken by SSL
At the Transport Layer (OSI Model)

89
Q

SSL

A

Secure Socket Layer
• Contains SSL record protocol and SSL Handshake Protocol
• Uses symmetric encryption and public key for authentication
• MAC – Message Authentication Code for Integrity
At the Transport Layer (OSI Model)

90
Q

SKIP

A

Simple Key Management for Internet Protocol

Similar to SSL – no prior communication required

91
Q

Packet Filtering Firewall - First Generation

A
  • Screening Router
  • Operates at Network and Transport level
  • Examines Source and Destination IP Address
  • Can deny based on ACLs
  • Can specify Port
92
Q

Application Level Firewall - Second Generation

A
  • Proxy Server
  • Copies each packet from one network to the other
  • Masks the origin of the data
  • Operates at layer 7 (Application Layer)
  • Reduces Network performance since it has do analyze each packet and decide what to do with it.
  • Also Called Application Layer Gateway
93
Q

Stateful Inspection Firewalls – Third Generation

A
  • Packets Analyzed at all OSI layers
  • Queued at the network level
  • Faster than Application level Gateway
94
Q

Dynamic Packet Filtering Firewalls – Fourth Generation

A
  • Allows modification of security rules
  • Mostly used for UDP
  • Remembers all of the UDP packets that have crossed the network’s perimeter, and it decides whether to enable packets to pass through the firewall.
95
Q

Kernel Proxy – Fifth Generation

A
  • Runs in NT Kernel

* Uses dynamic and custom TCP/IP-based stacks to inspect the network packets and to enforce security policies.

96
Q

Packet Filtering Routers:

A
  • Sits between trusted and untrusted networks
  • Uses ACLs
  • ACLs can be manually intensive to maintain
  • Lacks strong user authentication
  • ACLs can degrade performance
  • Minimal Auditing
97
Q

Screened Host Firewall

A
  • Employs packet filtering and Bastion Host
  • Provides network layer (packet filtering) and
  • application layer (proxy) services
  • Penetration requires getting by external router
  • (packet filtering) and Bastion Host (proxy).
98
Q

Dual Homed Host Firewall

A
  • Contains two NICs
  • One connected to the local “trusted” network
  • One connected to the external “untrusted” network
  • Blocks or filters traffic between the two.
  • IP forwarding is disabled
99
Q

Screened Subnet Firewall

A
  • One of the most secure
  • Two packet filtering routers and a Bastion Host
  • Provides network layer (packet filtering) and
  • application layer (proxy) services
  • Provides DMZ
  • Complex configuration
100
Q

SOCKS Server

A
  • Circuit level proxy server
  • Requires SOCKS client on all machines
  • Used to manage outbound Internet access
  • IT Overhead intensive
101
Q

NAT

A

Network Address Translation

102
Q

3 Private IP Address Ranges.

A

Global Nonroutable Addresses
10.0.0.0 to 10.255.255.255
172.16.0.0 to 172.31.255.255
192.168.0.0 to 192.168.255.255
• Class A addresses are for large networks with many devices. 1-127
• Class B addresses are for medium-sized networks. 128-191
• Class C addresses are for small networks (fewer than 256 devices). 192-223
• Class D addresses are multicast addresses.

103
Q

Virtual Private Networks

A

• Secure connection between two nodes using secret encapsulation method.
• Secure Encrypted Tunnel – encapsulated tunnel (encryption may or may not be used)
Tunnel can be created by the following three methods:
• Installing software or agents on client or network gateway.
• Implementing user or node authentication systems.
• Implementing key and certificate exchange systems.

104
Q

PPTP – Point-to-Point Tunneling Protocol

VPN Protocol Standards

A
  • Works at the Data Link Layer
  • Single point to point connection from client to server
  • Common with asynchronous connections with NT and Win 95
105
Q

L2TP - Layer 2 Tunneling Protocol

A

VPN Protocol Standards
• Combination of PPTP and earlier Layer 2 Forwarding Protocol (L2F)
• Multiple protocols can be encapsulated within the L2TP
• Single point to point connection from client to server
• Common with Dial up VPNs

106
Q

IPSec

VPN Protocol Standards

A
  • Operates at the network layer
  • Allows multiple and simultaneous tunnels
  • Encrypt and authenticate IP data
  • Focuses more on Network to Network Connectivity
107
Q

VPN Devices

IPSec Compatible

A

Installed on a networks perimeter and encrypt traffic between the two
Because IPSec only work with IP
Operate at Network Layer
Two Modes:
• Tunnel Mode – entire packet is encrypted and encases in IPSec packet
• Transport Mode – Only datagram is encrypted leaving IP address visible.
Datagram: A self-contained, independent entity of data carrying sufficient information to be routed from the source to the destination.

108
Q

VPN Devices

Non-IPSec Compatible

A

• Common non-IPSec compatible include SOCKS, PPTP and SSH
• SOCKS is not traditional VPN protocol but is robust and operates at Application Layer.
PTP implemented in Win95 and NT
• Multiprotocol and uses PAP and CHAP user authentication.
• Compresses Data
• End-to-End encryption
Secure Shell SSH-2
• Not strictly VPN but can be used as one with Terminal Session

109
Q

Firewall Based VPNs

A
  • Frequently available with Third Generation (Stateful Inspection) Firewalls
  • Operate at the Application layer
  • Performance degradation is often a problem
110
Q

Data Network Types:

A
  • Local Area Network (LAN)
  • Wide Area Network (WAN)
  • Internet, Intranet, and Extranet
111
Q

Local Area Networks – LAN

A

• Discrete network for limited geographical area like a building or a single floor
• Two most popular LANs are:
CAN - Campus Area Network – connects multiple buildings with each other over switched backbone
MAN – Metropolitan Area Network – LAN over a city wide metropolitan area.
• Both CAN and MAN can have a connection to WAN

112
Q

Wide Area Networks - WAN

A
  • Network of sub networks that interconnect LANs over large geographic areas.
  • WAN is basically everything outside of LAN
113
Q

Internet

A
  • The Internet is a WAN originally funded by the DOD

* Uses TCP/IP

114
Q

Intranet

A
  • Internet like logical network that uses a companies internal physical network structure
  • More security and control than Internet
  • Uses Internet tools like browsers.
115
Q

Extranet

A
  • Extranet can be accessed by users outside of the company, (i.e. vendors and partners) but not the general public.
  • Includes some type of authentication or encryption
116
Q

Asynchronous vs. Synchronous Communications

A
  • Asynchronous is basis of modems and dial up remote access. Must operate at same speed.
  • Start and stop bits mark the beginning and the end of each transfer.
  • Synchronous is very high speed, governed by electronic clock timing signals.
117
Q

LAN Cabling Types:

Twisted Pair Cable

A
  • Relatively slow speed
  • Two insulated wires can be shielded (STP) or unshielded (UTP)
  • UTP is a four-pair medium comes in several categories
  • UTP can be easily tapped by eavesdroppers than the other cable types.
  • Category based on how tightly wound the wires are, tighter the wind the higher the rating and resistance to interference.
  • Cat 1 UTP– was used for telephone lines not good for data.
  • Cat 2 UTP – up to 4 MBps
  • Cat 3 UTP – Used for 10BaseT networks up to 10 MBps
  • Cat 4 UTP – Used in Token Ring Networks up to 16 MBps
  • Cat 5 UTP - Current UTP standard for new installations up to 100 MBps
  • Cat 6 UTP – up to 155 MBps
  • Cat 7 UTP – up to 1 GBps
118
Q

LAN Cabling Types:

Coaxial Cable

A
  • Hollow outer conductor surrounds inner wire conductor. Currently two types in LANs
  • 50-ohm Cable for digital signaling
  • 75-ohm Cable for analog signaling and high speed digital signaling
  • Coax is more expensive but is more resistant to Electromagnetic Interference (EMI).
  • Used rarely except in Broadband communications
  • Comes in two types:
  • Thinnet – (RG58)
  • Thicknet – (RG8 or RG11)
  • Two common types of coaxial transmission methods:
  • Baseband – The cable carries a single channel
  • Broadband – cable carries several channels such as data, voice, audio, and video
119
Q

LAN Cabling Types:

Fiber Optic Cable

A
  • Conducts modulated light transmission
  • Light waves are faster and travel greater distances
  • Difficult to tap
  • Resistant to EMI
  • Usually connects backbones in larger networks
  • Can be used to connect workstations to the network.
  • Expensive to install and to terminate.
120
Q

LAN Transmission Protocols:

A
  • Rules for communication between computers on a LAN

* Formatting of the data frame, the timing and sequencing of packet delivery, and resolution of error states.

121
Q

Carrier Sense Multiple Access (CSMA)

LAN Transmission Protocols:

A
  • Foundation of Ethernet Protocol.
  • Workstation continuously monitors the line waiting until it thinks it is free.
  • If the workstation doesn’t receive an acknowledgement from the destination to which it sent the packet, it assumes a collision has occurred and it resends the packet.
  • Persistent Carrier Sense - Unless receives acknowledgement it will resend.
  • Nonpersistent Carrier Sense – waits random amount of time and resends.
122
Q

CSMA/CA

LAN Transmission Protocols:

A

Carrier Sense Multiple Access Collision Avoidance – Workstations connected to two coax cables, one to send and one to receive data.

123
Q

CSMA/CD

LAN Transmission Protocols:

A

Carrier Sense Multiple Access Collision Detection – Ethernet
If the host detects another signal while transmitting it will send a jam signal causing all nodes to stop sending data. Nodes wait to resend. Designed to avoid collisions.

124
Q

Polling

LAN Transmission Protocols:

A

a primary workstation polls another at a predetermined time to determine if it has data to transmit. Primary must give permission to others to transmit.

125
Q

Token passing

LAN Transmission Protocols:

A
  • Token Ring and FDDI and ARCnet
  • Cannot transmit without the token
  • Each station can hold token for maximum predetermined amount of time
126
Q

LAN Transmission Methods

A

refer to the way packets are sent on the network
• Unicast – from single source to single destination
• Multicast - source copied and sent to multiple destinations
• Broadcast - source copied and sent to all nodes on the network

127
Q

LAN Topologies Five common topologies:

A

defines the manner in which the network devices are organized to facilitate communications.

128
Q

LAN Topologies Five common topologies:

Bus

A
  • All transmissions travel full length of the cable and received by all other stations.
  • Single point of failure in the cable.
  • If one of the links between any of the computers is broken, the network is down.
  • Primarily Ethernet.
  • These networks were originally designed to work with more sporadic traffic.
129
Q

LAN Topologies Five common topologies:

Ring

A
  • Unidirectional transmission links form closed loop.
  • Token Ring and FDDI.
  • Similar to the Star topology, however there’s a device called a Multistation Access Unit (MAU).
  • MAU works the same as a hub, but with Token Ring networks instead of Ethernet networks.
  • These networks were originally designed to serve large, bandwidth-consuming applications.
130
Q

Star

LAN Topologies Five common topologies:

A
  • Nodes connected to a central LAN or a junction box called a hub or a concentrator at the center of the network.
  • Ads: reliability
  • Ring and Bus often use Star as physical connection.
131
Q

Tree

LAN Topologies Five common topologies:

A

branches can have multiple nodes.

132
Q

Mesh

LAN Topologies Five common topologies:

A

all nodes connected to every other node.

133
Q

Ethernet – 802.3

LAN Media Access Methods (Physical and Data Link Layers): control the use of a network.

A

• Ethernet – uses CSMA/CD – Designed for sporadic traffic
• Ethernet defines a bus topology with three different cabling standards
Thinnet – 10Base2 – coax with segments up to 185 meters.
Thicknet – 10BaseS – coax with segments up to 500 meters.
UTP – Unshielded Twisted Pair – all devices connected to a hub or switch 10BaseT 10 Mbps, 100BaseT 100 Mbps and 1000BaseT 1 GBps

134
Q

ARCnet – 802.5

LAN Media Access Methods (Physical and Data Link Layers): control the use of a network.

A
  • Early LAN technologies

* Uses token passing in a Star topology on coax cable.

135
Q

Token Ring

LAN Media Access Methods (Physical and Data Link Layers): control the use of a network.

A
  • Second to Ethernet
  • All end stations connected to a Multistation Access Unit (MSAU)
  • One station is designated as the Active Monitor
  • If a transmitting station fails, the Active monitor will remove the token and generate a new one.
136
Q

Fiber Distributed Data Interface – FDDI

LAN Media Access Methods (Physical and Data Link Layers): control the use of a network.

A
  • Dual token ring LAN at 100 MBps on Fiber
  • Dual counter rotating rings only one active at a time
  • Operates over long distances with minimal interference
  • Predictable delays, deterministic
  • Permits several tokens to be present at a time
  • Expensive and requires expertise
  • Copper Distributed Data Interface (CDDI) – can be used with UTP cable but subject to interference and length issues associated with Copper.
137
Q

Repeaters

LAN Devices

A

amplify signal, no added intelligence, no filtering – Physical Layer (1)

138
Q

Hubs

LAN Devices

A

used to connect multiple LAN devices, no added intelligence – Physical Layer (1)

139
Q

Bridges –

LAN Devices

A

Amplify signal, add some intelligence. A bridge forwards the data to all other network segments if the Media Access Control (MAC) or hardware address of the destination computer is not on the local network segment. Automatically forwards all broadcast traffic. Does not use IP address because IP is contained in the Network Layer (3) – Data Link Layer (2)

140
Q

Switches

LAN Devices

A

Will only send data to the port where the destination MAC address is, not to all ports. Primarily operate at the Data Link Layer (2), although extremely fast layer 3 devices combining switching and routing are being used.

141
Q

Routers

LAN Devices

A

router opens packet and looks at either the MAC or IP address only forwards to the network that it is destined. Operates at Network Layer (3)

142
Q

Gateways

LAN Devices

A

primarily software, can be multi-protocol, can examine entire packet.

143
Q

Asynchronous Transfer Mode (ATM) Switches

LAN Devices

A

Used in WANs and CANs. Use cell relay technology.

144
Q

LAN Extenders

LAN Devices

A

remote access multi layer switch connected to host router, filters based on MAC address or Network Layer protocol, not capable of firewalling.

145
Q

Private Circuit Technologies

WAN Technologies

A

Evolved before packet switching networks. Dedicated analog or digital point-to-point connection. Serial Line Internet Protocol (SLIP), Point-to Point protocol (PPP), ISDN, xDSL.
• Dedicated Line – indefinitely and continuously reserve for transmissions.
• Leased Line – Type of dedicated line leased from carrier.

146
Q

Private Circuit Technologies

WAN Technologies

A

Types and Speeds of Leased Lines:
• Digital Signal Level 0 – DS-0 – single channel at 64KBps on a T1
• Digital Signal Level 1 – DS-1 – 1.544 MBps in US on a T1 and 2.108 MBps in Europe on a E1
• Digital Signal Level 3 – DS-3 – 44.736 MBps on a T3

  • T1 – Transmits DS-1 data at 1.544 MBps on telephone switching network
  • T3 – Transmits DS-3 data at 44.736 MBps on telephone switching network
  • E1 – predominately used in Europe carries data at 2.108 MBps
  • E3 - predominately used in Europe carries data at 34.368 MBps
147
Q

SLIP - Serial Line Internet Protocol

WAN Technologies

A

developed in 1984 to support TCP/IP over low speed serial interfaces. Using Windows NT RAS, NT computers can use TCP/IP and SLIP to communicate to remote hosts.

148
Q

PPP - Point-to Point protocol

WAN Technologies

A

over dial up and dedicated links, includes login, password, and error correction. Operates at the Data Link Layer (2) and uses CHAP and PAP.

149
Q

ISDN

WAN Technologies

A

Integrated Services Digital Network - integration of digital telephony and data transport. Digitization of the telephone network, allowing voice, data, etc. Overtaken by DSL.

150
Q

xDSL

WAN Technologies

A

Digital Subscriber Line – uses existing twisted pair telephone lines.
n ADSL – Asymmetric Digital Subscriber Line more bandwidth downstream from 1.5 to 9 MBps with upstream 16 to 640 KBps. ADSL works at 18,000 feet lengths, theoretical and 14,400 practical over single copper twisted pair.
n SDSL - Single-line (Symmetric) Digital Subscriber Line provides from 144 KBps up to 1.544 MBps both down and up, depending on distance, over single copper twisted pair, works at 10,000 feet lengths.
n HDSL – High-Rate Digital Subscriber Line - 1.544 MBps both down and up over two copper twisted pair. Provides T1 speeds. Can do 2.048 MBps on three copper twisted pair.
n VDSL – Very-high Rate Digital Subscriber Line – 13-52 MBps down and 1.5 MB to 2.3
MBps upstream over single copper twisted pair operating range 1,000 – 4,500 feet

151
Q

Circuit Switched
Circuit Switched vs. Packet Switched
WAN Technologies

A
  • Defined as a switching system in which a physical circuit path must exist for the duration of the transmission
  • Physical permanent connections from one point to another
  • Older technology than Packet Switching
  • Phone companies use this a lot
152
Q

Packet Switched
Circuit Switched vs. Packet Switched
WAN Technologies

A
  • Create virtual circuits used as needed and reduce cost.
  • Defined as a switching system where nodes share bandwidth by sending small packets.
  • Each packet sent to the next destination by the router.
  • Packets reassembled based on original sequence
153
Q

Packet Switching Technologies

A

X.25, Link Access Procedure Balance (LABP), Frame Relay, Switched Multimegabit Data Service (SMDS), Asynchronous Transfer Mode (ATM), Voice over IP (VoIP)

154
Q

X.25

Packet Switching Technologies

A
  • First packet switching network
  • Supports Switched Virtual Circuits (SVCs) and Permanent Virtual Circuits (PVCs)
  • Designed to operate effectively regardless of the type of systems connected to
  • Currently much more predominant overseas than in the US
155
Q

Link Access Procedure Balance (LAPB)

Packet Switching Technologies

A
  • Designed for use with X.25
  • Defines frame types
  • Can retransmit, exchange and detect out of sequence frames or missing frames.
156
Q

Frame Relay

Packet Switching Technologies

A
  • High performance WAN protocol
  • Operates at Physical and Data Link Layers (1 and 2)
  • Originally designed for ISDN
  • Replaces X.25 and LAPB
  • Simple and fast, no error correcting
  • Supports Switched Virtual Circuits (SVCs) and Permanent Virtual Circuits (PVCs)
  • Not available everywhere
157
Q

Switched Multimegabit Data Service (SMDS)

Packet Switching Technologies

A
  • High Speed over public switched networks

* Connectionless bandwidth on demand

158
Q

Asynchronous Transfer Mode (ATM)

Packet Switching Technologies

A
  • High bandwidth, low delay
  • Uses switching and multiplexing
  • Uses 53 byte fixed size cells instead of frames
  • Can allocate bandwidth on demand
  • Taking place of FDDI in Campus Backbone
159
Q

Voice Over IP

Packet Switching Technologies

A
  • Combines media types (voice, video, data, audio) into one IP packet
  • Provides benefits in cost, performance and interoperability
  • Very new but far reaching potential
160
Q

Synchronous Data Link Control (SDLC)

Other Important WAN Protocols

A
  • Uses polling access method for mainframes
  • Based on dedicated leased line
  • Evolved into HDLC and LAPB
  • Operates at Data Link Layer (2)
161
Q

High-Level Data Link Control (HDLC)

Other Important WAN Protocols

A
  • Derived from SDLC
  • Specifies data encapsulation method on synchronous serial links
  • Operates at Data Link Layer (2)
162
Q

High Speed Serial Interface

Other Important WAN Protocols

A
  • Defines the electrical and physical interfaces to be used by DTE/DCE
  • Operates and the Physical Layer (1)
163
Q

Routers

WAN Devices

A

router opens packet and looks at either the MAC or IP address only forwards to the network that it is destined. Operates at Network Layer (3)

164
Q

Multiplexors

WAN Devices

A

MUX enables more than one signal to be sent out over one physical circuit

165
Q

WAN Switches

WAN Devices

A

multi-port network devices operate at the Data Link Layer (2). Typically switch Frame Relay, X.25 and SMDS

166
Q

Access Servers

WAN Devices

A

provides dial in and dial out access connections to a network. Typically asynchronous.

167
Q

Modems

WAN Devices

A

interprets digital and analog signals, transmits over voice grade telephone lines.

168
Q

Channel Service Unit (CSU)/Data Service Unit (DSU)

A

used to terminate the physical interface on a DTE device such as a terminal.

169
Q

Remote Access Technologies

A

Provide remote user (employee, vendor, partner) access into the network while maintaining C.I.A. (Confidentiality, Integrity, Availability)

170
Q

Benefits of Remote Access:

Remote Access Technologies

A
  • Providing employees flexible work styles, Telecommuting
  • Building efficient ties with vendors, partners, suppliers and employees.
  • Reducing costs by replacing dedicated network lines
171
Q

Asynchronous Dial up Access

Remote Access Technologies

A
  • How most people access Internet

* Use existing public switched phone network to access ISP

172
Q

ISDN - Integrated Services Digital Network

Remote Access Technologies

A
  • Carries voice, data over telephone networks
  • Two Interface Types
  • BRI – Basic Rate Interface composed of two B channels and one D Channel
  • PRI – Primary Rate Interface composed of a single 64 KBps D channel plus 23(T1) or 30 (E1) channels
173
Q

xDSL

Remote Access Technologies

A

Digital Subscriber Line

• Uses existing twisted pair telephone lines.

174
Q

Cable Modems

Remote Access Technologies

A
  • High speed access from the cable company
  • Users share the Coax connection
  • Throughput varies depending on number of users
  • Considered insecure because local segment is not filtered or firewalled (Says Who?)
175
Q

Wireless Technology

Remote Access Technologies

A
  • Fastest Growing area of connectivity
  • Encryption is being developed
  • 802.11a – 5 Ghz wireless - very soon
  • 802.11b – 2.4 Ghz currently most popular up to 11 MBps
  • 802.11g – 2.4 Ghz but faster than 802.11b
  • WEP – Wired Equivalency Protocol – up to 128-bit WEP
  • WAP - Wireless Access Point
  • SSID – Service Set Identifier – Network Name
  • Use encryption, VPN, treat as external connection, directional antenna
176
Q

Restricted Address

Secure Remote Access Methods:

A
  • Filtering by source IP address

* Node authentication not user authentication

177
Q

Caller ID

Secure Remote Access Methods:

A
  • Caller ID checks incoming number against approved list
  • Very commonly used, hard to defeat
  • Hard to administer for traveling users
178
Q

Call Back

Secure Remote Access Methods:

A
  • Caller supplies password or identifier and hangs up
  • System dials back number listed for the user
  • Hard to administer for traveling users
179
Q

Remote Identification and Authentication

Secure Remote Access Methods:

A
  • Verify who is remotely communication.
  • Identification - Who
  • Authentication – Verify and Trust
180
Q

Password Authentication Protocol (PAP)

Remote Node Security Protocols:

A
  • Remote security protocol. Provides Identification and Authentication.
  • Uses static replayable password for authentication (now considered weak)
  • Does not encrypt the User ID or Password
181
Q

Challenge Handshake Protocol (CHAP)

Remote Node Security Protocols:

A
  • Next evolution of PAP uses stronger authentication
  • Nonreplayable Challenge/Response
  • Verifies Identity of the node
  • Often used to enable network-to-network communication
  • Commonly used by remote access servers and xDSL, ISDN, and cable modems
182
Q

Remote Access Authentication Systems:

A
  • TACACS – Terminal Access Controller Access Control System (TCP)
  • TACACS+ – includes the use of two factor authentication
  • RADIUS – Remote Access Dial-In User Service (UDP)
183
Q

TACACS – Terminal Access Controller Access Control System

Remote Access Authentication Systems:

A
  • Provides remote authentication and related services
  • User password administered in a central database rather than in individual routers
  • TACACS enabled network device prompts for user name and static password
  • TACACS enabled network device queries TACACA server to verify password
  • Does not support prompting for password change or use of dynamic tokens
184
Q

TACACS+ Terminal Access Controller Access Control System Plus
Remote Access Authentication Systems:

A
  • Proprietary CISCO enhancement
  • Two factor Authentication
  • User can change password
  • Ability to use secure tokens
  • Better Audit Trails
185
Q

RADIUS – Remote Access Dial-In User Service

Remote Access Authentication Systems:

A

• Offers similar benefits to TACACS+
• Often used as a stepping stone to TACACS+
• Radius Server contains dynamic password and network service access information (Network ACLS)
• Radius is a fully open protocol, can be customized for almost any security system
• Can be used with Kerberos and provides CHAP remote node authentication
Except does not work with:
• Apple Talk Remote Access Resolution Protocol
• NetBios Frame Protocol Control Protocol
• Netware Asynchronous Services Interface
• X.25 PAD Connection

Does not provide two-way authentication and is not used for router-to-router authentication.

CISSP (14 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions