Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

tdk-cissp > Domain 4 - Communication and Network Security > Flashcards

Domain 4 - Communication and Network Security Flashcards

1
Q

<strong>OSI Model</strong>

A

International Organization for Standardization (ISO) developed the Open Systems Interconnection (OSI) Reference Model for protocols in the early 1980s.

Specifically, ISO 7498 defines the OSI Reference Model (more commonly called the OSI model).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Encapsulation

A

Encapsulation is the addition of a header, and possibly a footer, to the data received by each layer from the layer above before it’s handed off to the layer below.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Physical Layer

A

The Physical layer (layer 1) accepts the frame from the Data Link layer and converts the frame into bits for transmission over the physical connection medium.

The Physical layer is also responsible for receiving bits from the physical connection medium and converting them into a frame to be used by the Data Link layer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Data Link Layer

A

The Data Link layer (layer 2) is responsible for formatting the packet from the Network layer into the proper format for transmission.

The proper format is determined by the hardware and the technology of the network.

SLIP, PPP, ARP, RARP, L2F, L2TP, PPTP, ISDN are examples

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Network Layer

A

The Network layer (layer 3) is responsible for adding routing and addressing information to the data.

The Network layer accepts the segment from the Transport layer and adds information to it to create a packet.

The packet includes the source and destination IP
addresses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Distance Vector Protocols

A

Distance vector routing protocols maintain a list of destination networks along with metrics of direction and distance as measured in hops.

RIP, IGRP,BGP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Link State Routing Protocols

A

Link state routing protocols maintain a topography map of all connected networks and use this map to determine the shortest path to the destination.

OSPF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Transport Layer

A

The Transport layer (layer 4) is responsible for managing the integrity of a connection and controlling the session. It accepts a PDU from the Session layer and converts it into a segment.

The Transport layer controls how devices on the network are addressed or referenced, establishes communication connections between nodes (also known as devices), and defines the rules of a session.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Session Layer

A

The Session layer (layer 5) is responsible for establishing, maintaining, and terminating communication sessions between two computers. It manages dialogue discipline or dialogue control (simplex, half-duplex, full-duplex), establishes checkpoints for grouping and recovery, and retransmits PDUs that have failed or been lost since the last verified
checkpoint.

NFS, SQL, RPC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Presentation Layer

A

The Presentation layer (layer 6) is responsible for transforming data received from the Application layer into a format that any system following the OSI model can understand.

It imposes common or standardized structure and formatting rules onto the data

Repsonsible for Encyprtion and Compression

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Application Layer

A

The Application layer (layer 7) is responsible for interfacing user applications, network services, or the operating system with the protocol stack. It allows applications to communicate with the protocol stack.

The Application layer determines whether a remotecommunication partner is available and accessible. It also ensures that sufficient resources are available to support the requested communications.

EDI, NNTP, S-RPC, SET

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Port Numbers

A

The IANA recommends that ports 49152 to 65535 be used as dynamic and/or private ports.

  1. Berkeley Software Distribution (BSD) uses ports 1024 through 4999.
  2. Many Linux kernels use 32768 to 61000.
  3. Microsoft, up to and including Windows Server 2003, uses the range 1025 to 5000.
  4. Windows 7, and Windows Server 2008 use the IANA range.
  5. FreeBSD, since version 4.6, has used the IANA suggested port range.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

TCP 3-Way Handshake

A
  1. The client sends a SYN (synchronize) flagged packet to the server.
  2. The server responds with a SYN/ACK (synchronize and acknowledge) flagged packet back to the client.
  3. The client responds with an ACK (acknowledge) flagged packet back to the server.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

UDP

A

Best Effort

header is 8 bytes long

4 sections (SP,DP,ML,CS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

IP Classes

A

Class A 1-126

Class B 128-191

Class C 192-223

Class D 224-239

Class E 240-255

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

ICMP

A

Internet Control Message Protocol (ICMP) is used to determine the health of a network or a specific link. ICMP is utilized by ping, traceroute, pathping, and other network management tools.

First, the IP header protocol field value for ICMP is 1 (0x01).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Ping of Death

A

Ping of death sends a malformed ping larger than 65,535 bytes (larger than the maximum IPv4 packet size) to a computer to attempt to crash it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Smurf Attack

A

Smurf attacks generate enormous amounts of traffic on a target network by spoofing broadcast pings, and ping floods are a basic denial of service
(DoS) attack relying on consuming all of the bandwidth that a target has available.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

IGMP

A

IGMP Internet Group Management Protocol (IGMP) allows systems to support multicasting. IGMP is used by IP hosts to register their dynamic multicast group membership.

It is also used by connected routers to discover these groups.

The IP header protocol field value for IGMP is 2 (0x02).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Telnet

A

Port 23

No transfer of files

Execuate commands

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

FTP

A

Port 20, 21

Anonymous or Specific Auth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

TFTP

A

UDP port 69

No Auth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

SMTP

A

Port 25

Email messages from client to server and other servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

POP3

A

Post Office Protocol 3

Port 110

Pull email down

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

IMAP

A

Internet Message Access Protocol

Port 143

Delete emails directly without downloading them to client

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

DHCP

A

UDP Ports 67 and 68

67 for server point-to-point

68 for client request broadcasts

27
Q

LPD

A

Line Print Daemon

Port 515

Spool and Send Print Jobs

28
Q

NFS

A

Port 2049

This is a network service used to
support file sharing between dissimilar systems.

29
Q

SNMP

A

UDP Ports 161 and 162

Port 162 for Trap messages

This is a network service used to collect network health and status
information by polling monitoring devices from a central monitoring station.

30
Q

VLAN Hopping

A

VLAN hopping is performed by creating a double-encapsulated
IEEE 802.1Q VLAN tag:

[Ethernet [ VLAN1 [ VLAN2 [ IP [ TCP [ HTTP] ] ] ] ] ]

With this double encapsulation, the first encountered switch will strip away the first VLAN tag, and then the next switch will be fooled by the interior VLAN tag and move the traffic into the other VLAN.

31
Q

Multi Layer Protocol Benefits

A
  1. A wide range of protocols can be used at higher layers.
  2. Encryption can be incorporated at various layers.
  3. Flexibility and resiliency in complex network structures is supported.
32
Q

Multi Layer Protocol Drawbacks

A
  1. Covert channels are allowed.
  2. Filters can be bypassed.
  3. Logically imposed network segment boundaries can be overstepped.
33
Q

DNP3

A

DNP3 (Distributed Network Protocol) is primarily used in the electric and water utility and management industries.

It is used to support communications between data acquisition systems and the system control equipment.

This includes substation computers, RTUs (remote terminal units), IEDs and SCADA master stations.

34
Q

FCoE

A

Fibre Channel is a form of network datastorage solution (storage area network [SAN]) or network-attached storage [NAS]) that allows for high-speed file transfers at upward of 16 Gbps.

35
Q

MPLS

A

MPLS (Multiprotocol Label Switching) is a high-throughput high-performance network technology that directs data across a network based on short path labels rather than longer network addresses

36
Q

iSCSI

A

Internet Small Computer System Interface (iSCSI) is a networking storage standard based on IP. This technology can be used to enable location-independent file storage, transmission, and retrieval over
LAN, WAN, or public Internet connections

37
Q

VOIP

A

Voice over IP (VoIP) is a tunneling mechanism used to transport
voice and/or data over a TCP/IP network.

VoIP has the potential to replace or supplant PSTN because it’s often less expensive and offers a wider variety of options and features.

VoIP can be used as a direct telephone replacement on computer networks as well as mobile devices

38
Q

SDN

A

SDN aims at separating the infrastructure layer (i.e., hardware and hardware-based settings) from the control layer (i.e., network services of data transmission management).

Furthermore, this also removes the traditional networking concepts of IP addressing, subnets, routing, and so on from needing to be programmed into or be deciphered by hosted applications.

39
Q

Data Emanation

A

Data emanation is the transmission of data across electromagnetic signals. Almost all activities within a computer or across a network are performed using some form of data emanation.

However, this term is often used to focus on emanations that are unwanted or on data that is at risk due to the emanations.

40
Q

Securing Wireless Access Points

A
  1. ) Adhoc Mode - means that any two wireless networking devices, including two wireless network interface cards (NICs), can communicate without a centralized control authority.
  2. ) Infrastructure Mode - means that a wireless access point is required, wireless NICs on systems can’t interact directly.
41
Q

Standalone mode

A

Occurs when there is a wireless access point connecting wireless clients to each other but not to any wired resources. The wireless access point serves as a wireless hub exclusively.

42
Q

Wired Extension mode

A

Occurs when the wireless access point acts as a connection point to link the wireless clients to the wired network

43
Q

Site Survey

A

A site survey is the process of investigating the presence, strength, and reach of wireless access points deployed in an environment.

44
Q

Beacon Frame

A

The SSID is broadcast by the WAP via a special transmission called a beacon frame. This allows any wireless NIC within range to see the wireless network and make connecting as simple as possible.

45
Q

WEP

A

Wired Equivalent Privacy is defined by the IEEE 802.11 standard. It was designed to provide the same level of security and encryption on wireless networks as is found on wired or cabled networks.

WEP provides protection from packet sniffing and eavesdropping against wireless transmissions.

WEP encryption employs Rivest Cipher 4 (RC4), a symmetric stream cipher

46
Q

WPA

A

WPA (Wi-Fi Protected Access) was designed as the replacement for WEP; it was a temporary fix until the new 802.11i amendment was completed.

Wi-Fi Protected Access is based on the LEAP and TKIP cryptosystems and often employs a secret passphrase for authentication. Unfortunately, the use of a single static passphrase is the downfall of WPA

47
Q

WPA2

A

It is a new encryption scheme known as the Counter Mode Cipher Block Chaining Message Authentication Code Protocol (CCMP), which is based on the AES encryption scheme.

WPA2 implements concepts similar to IPSec.

48
Q

802.1X/EAP

A

802.1X/EAP is a standard port-based network access control that ensures clients cannot communicate with a resource until proper authentication has taken place. It is a frame work.

Through the use of 802.1X, other techniques and solutions such as RADIUS, TACACS, certificates, smart cards, token devices, and biometrics can be integrated into wireless networks providing techniques for both mutual and multi-factor authentication.

49
Q

PEAP

A

PEAP (Protected Extensible Authentication Protocol) encapsulates EAP methods within a TLS tunnel that provides authentication and potentially encryption.

Since EAP was originally designed for use over physically isolated channels and hence assumed secured pathways, EAP is usually not encrypted. So, PEAP can provide encryption for EAP methods.

50
Q

LEAP

A

LEAP (Lightweight Extensible Authentication Protocol) is a Cisco proprietary alternative to TKIP for WPA. This was developed to address deficiencies in TKIP before the 802.11i/WPA2 system was ratified as a standard.

Can be broken with Asleap. EAP-TLS is the recommended alternative. Strong password for LEAP

51
Q

MAC Filter

A

A MAC filter is a list of authorized wireless client interface MAC addresses that is used by a wireless access point to block access to all non-authorized devices.

52
Q

CCMP

A

CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol) was created to replace WEP and TKIP/WPA. CCMP uses AES with a 128-bit key.

CCMP is the preferred standard security protocol of 802.11 wireless networking indicated by 802.11i. To date, no attacks have yet been
successful against the AES/CCMP encryption.

53
Q

Optimal Antenna Placement

A
  1. Use a central location.
  2. Avoid solid physical obstructions.
  3. Avoid reflective or other flat metal surfaces.
  4. Avoid electrical equipment.
54
Q

Network Access Control

A

Network Access Control (NAC) is a concept of controlling access to an environment through strict adherence to and implementation of security policy. The goals of NAC are as follows:

  1. Prevent/reduce zero-day attacks
  2. Enforce security policy throughout the network
  3. Use identities to perform access control
55
Q

Static packet Filtering Firewalls

A

filters traffic by examining data from a message header. Usually, the rules are concerned with source, destination, and port addresses.

Using static filtering, a firewall is unable to provide user authentication or to tell whether a packet originated from inside or outside the private network, and it is easily fooled with spoofed packets.

First Gen, Screening or Common Routers

56
Q

Application-Level Gateway Firewalls

A

Also called a proxy firewall. A proxy is a mechanism that copies packets from one network into another; the copy process also changes the source and destination addresses to protect the identity of the internal or private network.

This type of firewall negatively affects network performance because each packet must be examined and processed as it passes through the firewall.

2ndGen firewalls, and operate at the L7 of the OSI model.

57
Q

Circuit-Level Gateway Firewalls

A

Circuit-level gateway firewalls are used to establish communication sessions between trusted partners. They operate at the Session layer
(layer 5) of the OSI model.

SOCKS (from Socket Secure, as in TCP/IP ports) is a common implementation of a circuit-level gateway firewall

58
Q

Stateful Inspection Firewalls

A

Also known as dynamic packet filtering firewalls, these evaluate the state or the context of network traffic. By examining source and destination addresses, application usage, source of origin, and relationship between current packets and the previous packets of the same session, stateful inspection firewalls are able to grant or deny a broader range of access.

They are known as 3rd generation firewalls, and they operate at the
Network and Transport layers (layers 3 and 4) of the OSI model.

59
Q

BASTION Host

A

A bastion host or a screened host is just a firewall system logically positioned between a private network and an untrusted network.

It is responsible for filtering traffic coming into the private network as well as for protecting the identity of the internal client.

60
Q

FW Deployment Architectures

A

There are three commonly recognized firewall deployment architectures: 1.) Single Tier - places the private network behind a firewall, which is then connected through a router to the Internet.

  1. ) Two tier - Two-tier I and Two-tier II.
  2. ) Three tier - Three-tier I and Three tier II.
61
Q

Endpoint Security

A

Endpoint security is the concept that each individual device must maintain local security whether or not its network or telecommunications channels also provide or offer security.

Sometimes this is expressed as “the end device is responsible for its own security.”

62
Q

Plenum cable

A

Is a type of cabling sheathed with a special material that does not
release toxic fumes when burned, as does traditional PVC coated wiring. Often plenum-grade cable must be used to comply with building codes, especially if the building has enclosed spaces that could trap gases.

63
Q

Modems

A

A traditional land-line modem (modulator-demodulator) is a communications device that covers or modulates between an analog carrier signal and digital information in order to support computer communications of public switched telephone network (PSTN) lines.

64
Q
A

tdk-cissp (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions