Domain 4 Communication and Network Security Flashcards
Which of the following allows communicating partners to prove their identity to each other and establish a secure communication channel, and it is applied as an authentication component of IPSec?
IKE
Which of the following is NOT a best practice when hardening systems or bastion hosts?
The correct answer is: Deploying a NIDS
While deploying a NIDS - Network Intrusion Detection System is a good idea, it isn’t targeted at hardening a single system, but rather an entire network so this would be the correct answer because it is not a standard way of hardening a host.
following answers is BEST described as a SAN standard for connecting data storage facilities to communicate over IP networks?
The correct answer is: iSCSI
By transmitting SCSI commands over IP networks, iSCSI is used to facilitate data transfers over intranets. iSCSI data can be transmitted over the internet, WANs or LANs.
Unlike Fiber Channel that requires specific cabling, iSCSI just connects to your network and uses IP Addresses as the interconnect mechanism.
Which of the following LAN devices only operates at the physical layer of the OSI/ISO model?
The correct answer is: Hub
Repeaters and hubs are devices that only operate at the physical layer of the OSI model.
Repeaters
A repeater provides the simplest type of connectivity, because it only repeats electrical signals between cable segments, which enables it to extend a network. Repeaters work at the physical layer and are add-on devices for extending a network connection over a greater distance. The device amplifies signals because signals attenuate the farther they have to travel.
Repeaters can also work as line conditioners by actually cleaning up the signals. This works much better when amplifying digital signals than when amplifying analog signals, because digital signals are discrete units, which makes extraction of background noise from them much easier for the amplifier. If the device is amplifying analog signals, any accompanying noise often is amplified as well, which may further distort the signal.
A hub is a multi-port repeater. A hub is often referred to as a concentrator because it is the physical communication device that allows several computers and devices to communicate with each other. A hub does not understand or work with IP or MAC addresses. When one system sends a signal to go to another system connected to it, the signal is broadcast to all the ports, and thus to all the systems connected to the concentrator.
Repeater
Image from: http://www.erg.abdn.ac.uk/~gorry/course/images/repeater.gif
Bridges
A bridge is a LAN device used to connect LAN segments. It works at the data link layer and therefore works with MAC addresses. A repeater does not work with addresses; it just forwards all signals it receives. When a frame arrives at a bridge, the bridge determines whether or not the MAC address is on the local network segment. If the MAC address is not on the local network segment, the bridge forwards the frame to the necessary network segment.
Bridge
Image from: http://www.oreillynet.com/network/2001/01/30/graphics/bridge.jpg
Routers
Routers are layer 3, or network layer, devices that are used to connect similar or different networks. (For example, they can connect two Ethernet LANs or an Ethernet LAN to a Token Ring LAN.) A router is a device that has two or more interfaces and a routing table so it knows how to get packets to their destinations. It can filter traffic based on access control lists (ACLs), and it fragments packets when necessary. Because routers have more network-level knowledge, they can perform higher-level functions, such as calculating the shortest and most economical path between the sending and receiving hosts.
Router and Switch
Image from: http://www.computer-networking-success.com/images/router-switch.jpg
Switches
Switches combine the functionality of a repeater and the functionality of a bridge. A switch amplifies the electrical signal, like a repeater, and has the built-in circuitry and intelligence of a bridge. It is a multi-port connection device that provides connections for individual computers or other hubs and switches.
Gateways
Gateway is a general term for software running on a device that connects two different environments and that many times acts as a translator for them or somehow restricts their interactions.
Usually a gateway is needed when one environment speaks a different language, meaning it uses a certain protocol that the other environment does not understand. The gateway can translate Internetwork Packet Exchange (IPX) protocol packets to IP packets, accept mail from one type of mail server and format it so another type of mail server can accept and understand it, or connect and translate different data link technologies such as FDDI to Ethernet.
Which of the following answers would BEST defend against Layer 2 - ARP Poisoning attacks?
802.1X
VMPS - VLAN Membership Protocol Server
Switch port Security
Network Antivirus
- 1X
- 1X - Certificate Security helps control access to physical media by validating systems using digital certificates.
DISCUSSION:
Summary: Layer 2 communications are normally unauthenticated and therefore untrusted unless 802.1x is used.
Discussion: ARP is a completely unauthenticated protocol and presents a clear danger to the operation of a trusted network. It is therefore necessary to strengthen security at this level by adding certificate security to be sure you are connecting to the host you think you are.
ARP/Layer 2 communications are vulnerable to attack and spoofing and using 802.1X to provide certificate security to network communications will greatly enhance security at layer 2.
Mitigation:
There are other ways of locking down layer 2 like switchport security or VMPS (Deprecated) but since MAC addresses can be faked these security measures are not often in use.
Of the following answers which would NOT help defend against Session Hijack Attacks?
Using Telnet based applications
OpenSSH
IPSec
ArpWatch
Using Telnet based applications
Summary: Telnet, like FTP or SNMP are clear text protocols which pass credentials in a way that is easy to sniff. Avoid the use of these protocols and switch to secure alternatives or modern versions like SNMPv3 which supports encryption.
Telnet is an deprecated application that sends data in clear text unless you’re using network encryption protocols like IPSec.
Which of the following server contingency solutions offers the highest availability?
Load balancing/disk replication
Which of the following is not a security goal for remote access?
Automated login for remote users
Which of the following statement INCORRECTLY describes circuit switching technique?
Packet uses many different dynamic paths to get the same destination
Connection oriented virtual links
Fixed delays
Traffic travels in a predictable and constant manner
Packet uses many different dynamic paths to get the same destination.
Message Switching
Message switching is a network switching technique in which data is routed in its entirety from the source node to the destination node, one hope at a time.
Packet Switching
Refers to protocols in which messages are divided into packets before they are sent. Each packet is then transmitted individually and can even follow different routes to its destination. Once all the packets forming a message arrive at the destination, they are recompiled into the original message.
Circuit Switching
Circuit switching is a methodology of implementing a telecommunications network in which two network nodes establish a dedicated communications channel (circuit) through the network before the nodes may communicate.
Virtual circuit
In telecommunications and computer networks, a virtual circuit (VC), synonymous with virtual connection and virtual channel, is a connection oriented communication service that is delivered by means of packet mode communication.
In which layer of the OSI Model are connection-oriented protocols located in the TCP/IP suite of protocols?
Transport layer
PHYSICAL LAYER
The physical layer, the lowest layer of the OSI model, is concerned with the transmission and reception of the unstructured raw bit stream over a physical medium. It describes the electrical/optical, mechanical, and functional interfaces to the physical medium, and carries the signals for all of the higher layers. It provides:
Data encoding: modifies the simple digital signal pattern (1s and 0s) used by the PC to better accommodate the characteristics of the physical medium, and to aid in bit and frame synchronization. It determines:
What signal state represents a binary 1
How the receiving station knows when a "bit-time" starts
How the receiving station delimits a frame
DATA LINK LAYER
The data link layer provides error-free transfer of data frames from one node to another over the physical layer, allowing layers above it to assume virtually error-free transmission over the link. To do this, the data link layer provides:
Link establishment and termination: establishes and terminates the logical link between two nodes. Frame traffic control: tells the transmitting node to "back-off" when no frame buffers are available. Frame sequencing: transmits/receives frames sequentially. Frame acknowledgment: provides/expects frame acknowledgments. Detects and recovers from errors that occur in the physical layer by retransmitting non-acknowledged frames and handling duplicate frame receipt. Frame delimiting: creates and recognizes frame boundaries. Frame error checking: checks received frames for integrity. Media access management: determines when the node "has the right" to use the physical medium.
NETWORK LAYER
The network layer controls the operation of the subnet, deciding which physical path the data should take based on network conditions, priority of service, and other factors. It provides:
Routing: routes frames among networks. Subnet traffic control: routers (network layer intermediate systems) can instruct a sending station to "throttle back" its frame transmission when the router's buffer fills up. Frame fragmentation: if it determines that a downstream router's maximum transmission unit (MTU) size is less than the frame size, a router can fragment a frame for transmission and re-assembly at the destination station. Logical-physical address mapping: translates logical addresses, or names, into physical addresses. Subnet usage accounting: has accounting functions to keep track of frames forwarded by subnet intermediate systems, to produce billing information.
Communications Subnet
The network layer software must build headers so that the network layer software residing in the subnet intermediate systems can recognize them and use them to route data to the destination address.
This layer relieves the upper layers of the need to know anything about the data transmission and intermediate switching technologies used to connect systems. It establishes, maintains and terminates connections across the intervening communications facility (one or several intermediate systems in the communication subnet).
In the network layer and the layers below, peer protocols exist between a node and its immediate neighbor, but the neighbor may be a node through which data is routed, not the destination station. The source and destination stations may be separated by many intermediate systems.
TRANSPORT LAYER
The transport layer ensures that messages are delivered error-free, in sequence, and with no losses or duplications. It relieves the higher layer protocols from any concern with the transfer of data between them and their peers.
The size and complexity of a transport protocol depends on the type of service it can get from the network layer. For a reliable network layer with virtual circuit capability, a minimal transport layer is required. If the network layer is unreliable and/or only supports datagrams, the transport protocol should include extensive error detection and recovery.
The transport layer provides:
Message segmentation: accepts a message from the (session) layer above it, splits the message into smaller units (if not already small enough), and passes the smaller units down to the network layer. The transport layer at the destination station reassembles the message.
Message acknowledgment: provides reliable end-to-end message delivery with acknowledgments.
Message traffic control: tells the transmitting station to “back-off” when no message buffers are available.
Session multiplexing: multiplexes several message streams, or sessions onto one logical link and keeps track of which messages belong to which sessions (see session layer).
Typically, the transport layer can accept relatively large messages, but there are strict message size limits imposed by the network (or lower) layer. Consequently, the transport layer must break up the messages into smaller units, or frames, prepending a header to each frame.
The transport layer header information must then include control information, such as message start and message end flags, to enable the transport layer on the other end to recognize message boundaries. In addition, if the lower layers do not maintain sequence, the transport header must contain sequence information to enable the transport layer on the receiving end to get the pieces back together in the right order before handing the received message up to the layer above.
End-to-end layers
Unlike the lower “subnet” layers whose protocol is between immediately adjacent nodes, the transport layer and the layers above are true “source to destination” or end-to-end layers, and are not concerned with the details of the underlying communications facility. Transport layer software (and software above it) on the source station carries on a conversation with similar software on the destination station by using message headers and control messages.
SESSION LAYER
The session layer allows session establishment between processes running on different stations. It provides:
Session establishment, maintenance and termination: allows two application processes on different machines to establish, use and terminate a connection, called a session.
Session support: performs the functions that allow these processes to communicate over the network, performing security, name recognition, logging, and so on.
PRESENTATION LAYER
The presentation layer formats the data to be presented to the application layer. It can be viewed as the translator for the network. This layer may translate data from a format used by the application layer into a common format at the sending station, then translate the common format to a format known to the application layer at the receiving station.
The presentation layer provides:
Character code translation: for example, ASCII to EBCDIC. Data conversion: bit order, CR-CR/LF, integer-floating point, and so on. Data compression: reduces the number of bits that need to be transmitted on the network. Data encryption: encrypt data for security purposes. For example, password encryption.
APPLICATION LAYER
The application layer serves as the window for users and application processes to access network services. This layer contains a variety of commonly needed functions:
Resource sharing and device redirection
Remote file access
Remote printer access
Inter-process communication
Network management
Directory services
Electronic messaging (such as mail)
Network virtual terminals
Which wireless encryption method uses the same key for both Encryption and Authentication?
WEP - Wired Equivalent Privacy
Which wireless encryption method uses the same key for encryption as it does for authentication of all wireless clients?
WEP
What kind of encryption is realized in the S/MIME-standard?
Public key based, hybrid encryption scheme
Category 5 Unshielded Twisted Pair cabling is a:
four-pair wire medium that is used in a variety of networks.
Which of the following is less likely to be used today in creating a Virtual Private Network? L2TP PPTP IPSec L2F
The correct answer is: L2F
It is a Protocol that supports the creation of secure virtual private dial-up networks over the Internet.
Cisco developed its own VPN protocol called Layer 2 Forwarding (L2F), which is a mutual authentication tunneling mechanism. However, L2F does not offer encryption. L2F was not widely deployed and was soon replaced by L2TP.
As their names suggest, both operate at layer 2. Both can encapsulate any LAN protocol.
Layer 2 Tunneling Protocol (L2TP) was derived by combining elements from both PPTP and L2F. L2TP creates a point-to-point tunnel between communication endpoints. It lacks a built-in encryption scheme, but it typically relies on IPSec as its security mechanism. L2TP also supports TACACS + and RADIUS. IPSec is commonly used as a security mechanism for L2TP.
At one point L2F was merged with PPTP to produce L2TP to be used on networks and not only on dial up links.
IPSec is now considered the best VPN solution for IP environments.
At which layer of ISO/OSI does the fiber optics work?
Physical layer
In which of the following WAN message transmission technique does two network nodes establish a dedicated communications channel through the network before the nodes may communicate?
Circuit switching
Which of the following is a term used to describe a system on which you have done hardening, that resides outside your internal network and is often used to host services like a DNS server or a Web server and is accessible to the open internet? Bastion Host An Intrusion Detection System An Intrusion Prevention System A Honeypot
Bastion Host
This is the correct answer. A bastion host resides outside your internal network and is often used to host services like a DNS server or a Web server and is accessible to the open internet?
At best it should be deployed, stabilized and updated then imaged to a data file so it can be easily restored if attacked and destroyed.
Routers
Layer 3
RIP (Routing Information Protocol)
Distance vector routing that uses hop count as its metric
BGP
Border Gateway Protocol
Routing protocol used on the internet
Path vector routing protocol
Which of the following OSI layers provides routing and related services?
Network Layer
Similar to Secure Shell (SSH-2), Secure Sockets Layer (SSL) uses symmetric encryption for encrypting the bulk of the data being sent over the session and it uses asymmetric or public key cryptography for:
Peer Authentication
Which of the following technologies has been developed to support TCP/IP networking over low-speed serial interfaces?
SLIP
An Internet Protocol (IP) address contains information that aids in:
routing messages
Which two of the following technologies help protect web communications and promote a secure online environment?
TLS and SSL
Which of the following layer of an OSI model transmits and receives the bit stream as electrical, optical or radio signals over an appropriate medium or carrier?
Physical Layer
Which of the following functionality is NOT supported by SSL protocol?
Availability
How many bits is the address space reserved for the source IP address within an IPv6 header?
128
An IPV6 address is 128bits so the source address will have to take up that much space in the header (as will the destination address). The key is to distinguish between the size of an IPV6 address and the fact that the source and destination addresses are part of the packet header.
While no modern operating system is vulnerable to such attack, sending a fragmented PING packet exceeding the maximum size of 65,535 bytes once reassembled was once known as what?
PING of Death
In a session hijack scenario, why is it dangerous that an attacker could respond to clients queries before the legitimate server answered the client query?
The attacker could pretend to be the legitimate service
Which of the following is an IDS that acquires data and defines a “normal” usage profile for the network or host?
Statistical Anomaly-Based ID
Packet Filtering Firewalls can also enable access for:
only authorized application port or service numbers.
Which cable technology refers to the CAT3 and CAT5 categories?
Twisted Pair cables
Which of the following offers security to wireless communications?
Wireless Transport Layer Security (WTLS) is a communication protocol that allows wireless devices to send and receive encrypted information over the Internet. S-WAP is not defined. WSP (Wireless Session Protocol) and WDP (Wireless Datagram Protocol) are part of Wireless Access Protocol (WAP).
Which of the following Common Data Network Services is used to send and receive email internally or externally through an email gateway device?
Mail services.
Communication products and services that ensure network components (devices, protocols, access methods) work together is referred to as:
Network Architecture.
Which of the following is less likely to be used today in creating a Virtual Private Network?
L2F
It is a Protocol that supports the creation of secure virtual private dial-up networks over the Internet.
Cisco developed its own VPN protocol called Layer 2 Forwarding (L2F), which is a mutual authentication tunneling mechanism. However, L2F does not offer encryption. L2F was not widely deployed and was soon replaced by L2TP.
A spoofing attack at layer 2 of the OSI model is also known as what?
MAC Spoofing
Which of the following statements CORRECTLY describes the difference between IPSec and SSH protocols?
IPSec works at the network layer where as SSH works at the application layer of an OSI Model
