Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

KM - Personal CISSP > Domain 4 -- Communication and Network Security > Flashcards

Domain 4 -- Communication and Network Security Flashcards

1
Q

What does the OSI Application Layer do?

A

The Application Layer does not provide Actual applications, but rather the protocols that support that applications.

The app layer works closest to the user and provides:

  • file transmissions
  • message exchanges
  • Terminal sessions
  • much more
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What layer in the OSI Model is the Application Layer and what does it provide?

A

The application layer is layer 7 and it provides:

  • File Transmissions
  • Message Exchanges
  • Terminal sessions
  • And more
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What does the OSI Presentation Layer do?

A

The presentation layer (Layer 6) receives information from the application layer and puts it in a format that any process operating at the same layer on a destination computer following the OSI model can understand.

It provides a common means of representing data in a structure that can be properly processed by the end system. (Think Tiff and JPEG)

Presentation layer also handles compression and encryption issues

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which layer is the Session Layer and what does it do?

A
  • The Session Layer is Layer 5
  • It is responsible for establishing communication between the two systems
  • Think Telephone conversation
  • Example protocols that work at this layer:
    • Password Authentication Protocol (PAP)
    • Point to Point Tunneling Protocol (PPTP)
    • Network Basic Input output System (NetBIOS)
    • Remote Procedure Call (RPC)
  • Session layer has 3 modes
    • Simplex
    • Half duplex
    • Full duplex
  • Session layer protocols provide interprocess communication channels
  • Session level protocols are the least used and only required within a network. Thus, firewall rules should shut them down.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What’s the difference between what happens at the Session Layer and what happens at the Transport Layer?

A
  • The Session Layer protocols control Application to Application communication
  • The Transport Layer protocols control computer to computer communication
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What layer is the Transport Layer and what does it do?

A
  • The transport layer is Layer 4
  • When connection oriented protocols are used between two systems, they must go through a handshaking process and exchange parameters. This handshaking process happens at Layer 4
  • The transport layer protocols are for systems, not applications
  • The transport layer recieves data from many different applications and assembles the data into a stream to be properly transmitted over the network.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What layer in the OSI model is the Network Layer and what does it do?

A
  • The Network layer is layer 3
  • The main responsibilities of it are to:
    • insert information into the packet’s header so it can be properly addressed and routed
    • And then to actually route the packets to their proper destination
  • Protocols at the network layer need to determine the best path for a packet to take to get to the destination
  • Routing protocols build and maintain their routing tables
  • Example Network Layer protocols:
    • IP
    • Internet Control Message Protocol
    • Routing Information Protocol (RIP)
    • Open Shortest Path First (OSPF)
    • Border Gateway Protocol (BGP)
    • Internet Group Management Protocol (IGMP)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What Layer of the OSI Model is the Data Link Layer and what does it do?

A
  • The Data Link Layer is Layer 2
  • It translates the packet into the LAN or WAN technology binary format for proper line transmission.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the two sub-layers in the data link layer?

A
  1. The Logical Link Control layer (LLC)
    • The Network layer above communicates with the LLC layer. It does not know whether the underlying network is Ethernet, or ATM or ___________.
    • It takes care of flow control and error checking
  2. Media Access Control
    • The Media Access Control layer communicates with the physical layer
    • It knows what the underlying network type is (Ethernet, etc.) and so addes the appropriate header/trailer records

Note –

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What do the 802.XX specifications refer to? And where do they belong in the OSI stack?

A

The IEEE MAC spefications are:

  • 802.3 - Ethernet
  • 802.5 - Token Ring
  • 802.11 - Wireless LAN
    • Others

These protocols are at the MAC sublayer of the data link layer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Give examples of protocols that work at the data link layer

A
  • Point to Point Protocol (PPP)
  • ATM
  • Layer 2 Tunneling protocol (L2TP)
  • FDDI
  • Ethernet
  • Token Ring
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

When the data link layer applies the last header and trailer to the data message, what is this called?

A

It is called framing.

The unit of data is called a frame.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the purpose of the physical layer? Which layer is it?

A

This layer controls synchronization, data rates, linie noise and transmission techniques.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Name the 7 layers of the OSI model in order from top to bottom.

A

All People Seem To Need Data Processing

  • Application
  • Presentation
  • Session
  • Transport
  • Network
  • Data Link
  • Physical
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Name Six Protocols That operate at the Application Layer

A
  1. File Transfer (FTP)
  2. Trivial File Transfer Protocol (TFPT)
  3. Simple Network Management Protocol (SNMP)
  4. Simple Mail Transfer Protocol (SMTP)
  5. Telnet
  6. Hypetext Transfer Protocol (HTTP)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Name the Presentation Layer Services

A
  • Note that the Presentation Layer only has services, not protocols
  • ASCII
  • EBCDIC
  • TIFF (Tagges Image File Format)
  • Joint Photographic Experts Group (JPEG)
  • MPEG
  • MIDI
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Name the Session Layer Protocols

A

It’s all about establishing connections between apps, dialog control, negotiation and tear down.

  • NetBIOS
  • Password Authentication Protocol (PAP)
  • Point to Point Tunneling Protocol (PPTP)
  • RPC (Remote procedure call)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Name the main purpose of the Transport Layer protocol and name some key protocols that operate at this layer

A

Transport layer protocols handle end-to-end transmission and segmentation of a data stream.

  • TCP
  • UDP
  • SPX (Sequenced Packet Exchange)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Name the key purpose of Network Layer Protocols and give examples

A

The responsibilities of the network layer protocols include internetworking, addressing and routing.

  • IP
  • Internet Control Message protocol (ICMP)
  • IGMP (Internet Group Management Protocol)
  • Routing Information Protocol (RIP)
  • Open Shortest Path First (OSPF)
  • Internet Packet Exchange (IPX)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the purpose of protocols at the data link layer and give examples of.

A

These protocols convert data into LAN or WAN frames for transmission and define how a computer accesses a network. It’s divided into the Logical Link Control and MAC sublayers

  • ARP
  • RARP (Reverse ARP)
  • PPP (Point to Point Protocol)
  • Serial Line Internet Protocol (SLIP)
  • Ethernet (IEEE 802.3)
  • Token Ring (IEEE 802.5
  • Wireless Ethernet (IEEE 802.3)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What does the physical layer do? Give examples of the interfaces that operate at this layer

A

Network interface cards and drivers convert signals and control the phscial aspects of data transmission, including optcal, electrical and mechanical requirements.

  • RS422
  • 10Base-T, 10-Base2, 10Base5, 100Base-TX, 100Base FX, 100Base-T, 1000Base-T, 1000Base-SX
  • ISDN
  • DLS
  • SONET (Synchronous Optical Networking)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Which OSI layers can a computer process data on?

A

computers can access data at all of the 7 layers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What layer does a router operate at?

A

A router operates at the Network Layer (L3)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Name two types of devices that only understand up to the Data Link Layer1

A

Bridges and Switches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Name a devices that operates on the Physical (L1) layer

A

A repeater

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is a multilayer protocol?

A

Protocols that don’t fit neatly into the OSI Model?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is the DNP3 Protocol?

A
  • DNP3 stands for Distribruted Network Protocol 3
  • It is an example of a 3 Layer protocol
  • It is used in SCADA systems, particularly those in the power sector
  • It does not support routing
  • Does not include encryption or authentication (deverlopers thought it was only going to be a system of devices connected to each other (not the outside world)
  • SCADA systems were eventually connected to the Internet
  • No Intrusion Detection / Intrusion Detection
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is the Controller Area Network Bus?

A
  • It stands for Controller Area Network
  • It’s a multilayer protocol
  • Runs on most automobiles worldwide
  • Allows controllers and other embedded controllers to communicate via a shared buss
  • Originally, the designers didn’t think security would be needed
  • As cars started to get WiFi, new attack vectors emerged
  • Jeep was hacked
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What are the main components of TCP/IP

A
  • IP is a connectionless network layer protocol that provides datagram routing services
  • IP’s main task is to support internetwork addressing and packet routing
  • There are two main protocols that function at the transport layer:
    • TCP – reliable, connection-oriented protocol
    • UDP – unreliable, connectionless protocol
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

If the Internet Protocol (IP) were to be compared to mailing a letter in the postal system, what would the three main components be?

A
  • Data = Letter
  • IP = Addressed Envelope
  • Network = Postal System
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What are the main characteristics of TCP?

A
  • TCP is connection oriented, because a connection must first be established via handshaking
  • By contrast, UDP is connectionless
  • Both are transport protocols
  • TCP and UDP both use ports to communicate with upper OSI layers
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What are the three components of a socket?

A

The combination of the following make up a socket:

  • Protocol (TCP or UDP)
  • Port
  • IP address
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What are well-known ports and give examples

A
  • Well-known ports are 0 - 1023 (Can only be used by privileged/root users)
  • SMTP - 25
  • FTP - 21, 20
  • HTTP - 80
  • Telnet - 23
  • SNMP = 161, 162
    *
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What are the port ranges for

  • Well Known Ports
  • Registered Ports
  • Dynamic ports
A
  • Well Known ports: 0 - 1023
  • Registered ports: 1024 - 49151
  • Dynamic ports (49152 - 65535)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What are the three steps in the TCP handshake?

A
  1. SYN —>
  2. SYN/ACK <———
  3. ACK ——->
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Give the names of units of transmission for the TCP/IP networking model

A
  • Application Layer - Data
  • Transport Layer - Segments
  • Internetwork Layer - Packets
  • Data Link Layer - Frames
  • Physical layer - Bits
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

How many bits are used for IPv4 addressing?

How many bits are used for IPv6 addressing?

A
  • IPv4 uses 32 bits for addressing
  • IPv6 uses 128 bits for addressing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is subnetting?

A

Subnetting allows larger IP ranges to be divided into smaller, logical, and more tangible network segments.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is classful or classical IP addresses

A

This is used for traditional IP subnet masks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What is CIDR and what does it do?

A
  • CIDR stands for Classless Interdomain Routing
  • Since Class B adddress ranges are usually too large and Class C are usually too small, CIDR provides the flexibility to increase or decrease the split between network address ranges and host address ranges
  • CIDR is also referred to as supernetting
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What are some of the key operational characteristics of the Internet Protocol (IP)?

A
  • TTL (Time to Live) value to prevent packets from being retransmitted forever
  • ToS (Type of Service) capability to enable prioritization
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

List 6 key benefits of IPV6 vs. IPV4

A
  1. Address size increased from 32 bits to 128 bits
  2. Scope field introduced for multicast addresses / anycast address
  3. Some IPV4 header fields have been dropped or made optional
  4. Changes in IP header options are encoded for more efficient forwarding
  5. Packet labeling for particular flows (e.g. QoS or real-time)
  6. Extensions to support authentication, data integrity and (optional) data confidentiality
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Compare and Contrast MACsec with VPN?

A
  • IEEE 802.1AE is the MACSec standard. It provides data confidentiality, data integrity and data origin authentication
  • MACSec works with Ethernet LANs.
  • VPN provides protection at higher levels in the stack
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What does IEEE 802.1AR provide?

A

It provides a DEV-ID – a unique per device identifier, that can’t be easily spoofed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Give 3 examples of Converged Protocols

A
  1. Fibre Channel over Ethernet (FCoE)
  2. Multiprotocol Label Switching (MPLS)
  3. Internet Small Computer System interface (iSCSI)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What is an example of IP Convergence?

A

IP Convergence is the transition of services from disparate transport media and protocols to IP.

Example: VoIP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What are the 3 broad types of transmission media?

A
  1. Electrical wires
  2. Optical fibers
  3. Free space
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What’s the difference between bandwidth and Data Throughput?

What units are they measured in?

A
  • Bandwidth is the number of electrical pulses that can be transmitted over a link in 1 second
  • Throughput is the actual amount of data that can be carried over the connection

Data throughput can be higher than bandwith as a result of compression mechanisms

Both Bandwidth and Throughput are measured in bits/sec

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Compare and Contrast Asynchronous and Synchronous Communications

A

Asynchronous

  • No timing component
  • Surrounds each byte with processing bits
  • Parity bit used for error control
  • Each byte requires three bits of instruction (start, stop, parity)

Synchronous

  • Timing component for data transmission synchronization
  • Robust error checking via CRC
  • Used for high speed, high volume transmissions
  • Minimal Overhead
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Give examples of Broadband technologies

A

Broadband

  • CATV coaxial cable
  • DSL
  • WiFi
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Which is more secure, Fiber or Copper cabling? Why?

A

Fiber is more secure because it does not radiate signals and is therefore not susceptible to eavesdropping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What are the components of fiber optic communication?

A

Light sources

  • LED’s
  • Diode lasters

Cable

  • Single mode - used for transmission over long distances, less susceptible to attenuation than multi-mode
  • Multimode - Can carry more data because multiple frequencies are used. Better for short distances. More susceptible to attenuation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

List three Cabling problems

A
  1. Noise
  2. Attenuation
  3. Cross Talk
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What does spread spectrum mean with respect to wireless communications

A

Spread spectrum means using more than one frequency at a time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What is frequency hopping spread spectrum?

A

First piece of data goes on one frequency

Next piece of data goes on a different frequency.

The idea is to help avoid collisions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What is Direct Sequence Spread Spectum (DSSS)?

A

It is a wireless communication approach that uses sub-bits

Sub bits are called chips.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Compare and Contrast FHSS and DSSS

A
  • FHSS moves data by changing frequencies
  • DSSS takes a different approach by applying sub-bits to a message and uses all of the availale frequencies at the same time
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Where is Orthogonal Frequency Division Multiplexing (OFDM) used?

A

OFDM is used for:

  • digital television
  • audio broadcasting
  • DSL broadband Internet access
  • Wireless networks
  • 4G Mobile communication
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What is a Wireless AP and what does it do?

A

AP stands for wireless Access Point. It’s the device through which computers can access a WLAN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What are the three types of WLAN’s and briefly describe them

A
  1. An infrastructure WLAN is when more than one AP is used to extend an existing wired network
  2. An ad hoc WLAN has no AP’s. Each wireless device communicates directly with the others (peer to peer)
  3. Standard (km) where wireless devices go through an AP to get to the network
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

With respect to Wireless LAN’s, what is a channel?

A

A channel is a certain frequency range within a given frequency band.

AP’s are configured to communicate over a specific channel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

What does SSID stand for and how is it used?

A

SSID stands for Service Set ID. Any hosts that wish to participate in a particular WLAN must be configured with the appropriate SSID.

A WLAN can be segmented into multiple SSID’s for the same reasons as using multiple wired network segments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

What is a Basic Service Set (BSS)?

A

When wireless devices work in infrastructure mode, the AP and wireless clients form a group called a Basic Service Set (BSS).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Compare and contrast Open System Authentication (OSA) and Shared Key Authentication (SKA) of the 802.11 Wireless LAN standard

A
  • OSA does not require the wireless device to prove it has a specific cryptographic key to allow for authentication purposes.
    • Usually, just the SSID is needed
    • All transactions are in cleartext
  • With SKA (WEP), the AP sends a random value to the wireless device. The device encrypts it with its cryptographic key and returns it
  • The AP decrypts it and if it matches the original random number, the device is authenticated
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

What are the three core deficiencies of WEP?

A
  1. The use of static encryption keys on all devices
  2. Ineffective use of Initialization vectors
    • Usually the same IV used over and over
  3. Lack of packet integrity assurance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

What does WEP stand for?

A

WEP stands for Wired Equivalency Privacy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

What is 802.11i about and how did it improve upon WEP?

A
  • 802.11i was introduced to address the security issues with WEP
  • It provides for Wifi Protected Access II (WPA2)
  • Before there was WPA2, there was WPA and it introduced:
    • Temporal Key Integrity Protocol (TKIP)
    • TKIP generates a new key for every frame that is transmitted
    • TKIP addresses WEP deficiencies related to static keys and inadequate use of IV’s.
  • WPA2 improves upon WPA by providing AES with CBC-MAC (Counter Mode, Cipher Block Chaining Message Authentication Code protocol)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

Is 802.1X a wireless protocol?

A

No, it is an access control protocol that can be implemented on both wired and wireless networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

What’s the high level difference between the type of authentication provided by WEP and that provided by 802.1X?

A
  • WEP provides system authentication
  • 802.1X provides user authentication
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

What does EAP stand for and what is its main benefit with respect to wirelss security?

A

EAP stands for Extensible Authentication Protocol

It means the device has to authenticate to the Authenticator and the Authenticator has to authenticate to the device.

It prevents against a rogue AP attack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

What are the three main entities of 802.1X technology?

A
  1. Supplicant (Wireless Device)
  2. Authenticator (AP)
  3. Authentication Server (usually a RADIUS server
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

What authentication mechanisms are available via plug-ins with EAP?

A
  • Passwords
  • Tokens
  • one-time passwords
  • Certificates
  • smart cards
  • kerberos
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

At what layer of the OSI model does the 802.11 standard take place?

A

Data Link Layer.

The authentication protocols themselves operate at a higher level. So, there are many ways to use EAP.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

What encryption algorithm are WEP and TKIP based on?

A

The RC4 algorithm – which is not a great fit.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

What’s another name for WPA2?

A

Robust Security Network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

What’s the Transfer rate, Frequency Range of the original 802.11 standard?

A
  • 1-2MB
  • 2.4GHz
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

What’s the Transfer rate, Frequency Range of the 802.11b standard?

A
  • 11Mbps
  • 2.4GHz
  • DSSS
  • Backward compatible with 802.11
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

What’s the Transfer rate, Frequency Range of the 802.11a standard?

A
  • 54Mbps
  • 5GHz (works in US, but not all other contries have allocated this band for wireless
  • OFDM
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

What’s the contriubution of the 802.11e standard?

A
  • Provided QoS support for multimedia traffic
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

What’s the contriubution of the 802.11f standard?

A
  • 802.11f deals with conveying authentication informatino between AP’s so users can roam seamlessly
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

What’s the contriubution of the 802.11g standard?

A
  • 802.11g provides up to 54Mbps
  • still works in 2.4GHz spectrum
    *
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

Which wireless frequencies have a wider range, 2.4 GHz or 5.0 GHz?

A

2.4 GHz

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q
  • What’s the contriubution of the 802.11h standard?
A
  • It builds upon the 802.11a standard to meet European rules so 5.0 GHz devices can be used in Europe
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

What’s the contriubution of the 802.11j standard?

A

Its focus is interoperability where different countries have their own rules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

What’s the contriubution of the 802.11n standard?

A

802.11n operates at 5.0GHz and can support throughput up to 100Mbps

  • Uses MIMO (Multiple Input / Multiple Output)
  • MIMO uses two input antennae and two output antennae
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

What’s the contriubution of the 802.11ac standard?

A
  • It improves upon 802.11n
  • 5GHz band
  • Throughput up to 1.3GHz
  • Support beamforming
    • shaping of radio signals to improve performance in specific directions
  • Better for high data rates at longer ranges than predecessor tech
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

What is the 802.16 Standard?

A

It’s the Metropolitan Area Network Standard.

A commercial implementation is WiMAX

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

What is the 802.15.4 standard for?

A
  • 802.15.4 is a WPAN standard (Wireless Personal Area Network)
  • 2.4GHz band
  • ITO
  • Wireless keyboards
  • etc.
  • Zigbee is a popular protocol based on 802.15.4
    • ZigBee links operate at 250kbps
    • 128 bit symmetrical key encryption
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

What’s the difference between Bluejacking and Bluesnarfing?

A
  • Bluejacking is where someone sends an unsolicited message to a bluetooth device
    • Often sends a business card
    • The countermeasure is to put bluetooth device in non-discoverable mode
  • Bluesnarfing is the unauthorized access from a wireless device through a bluetooth connection
    • user can access calendar, contact list, emails and text and can copy pictures and private videos
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

What are best practices for securing a WLAN - Part 1?

A
  • Change default SSID
  • Implement WPA2
  • Use separate VLAN for each class of user
  • To support visitors, make sure they are on an untrusted network outside trusted perimeter
  • Deploy a Wireless Intrusion Detection System (WIDS)
  • Physically put the AP in the center of the building
  • Logically, put the AP in the DMZ with a firewall between the DMZ and internal network
  • Implement VPN for wireless devices to use
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

What are the best practices for securing WLAN’s - Part 2

A
  • Configure MAC to only allow known MAC addresses to use it.
  • Carry out penetration tests on the WLAN
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

What are the two main microwave wireless transmissions?

A
  1. Satellite (Ground to Orbiter to Ground)
  2. Terrestrial (Ground to Ground)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

What are the four main types of mobile wireless technology?

A
  1. Frequency Division Multiple Access (FDMA)
  2. Time Division Multiple Access (TDMA)
  3. Code Division Multiple Access (CDMA)
  4. Orthogonal Frequency Division Multiple Access (OFDMA)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

What are the main characteristics of Frequency Division Multiple Access (FDMA)?

A
  • Earliest (1G)
  • Frequency range divided into channels
  • One channel per subscriber / exclusive control of the channel
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

What are the key characteristics of Time Division Multiple Access?

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

What are the key characteristics of Code Division Multiple Access (CDMA)

A
  • CDMA assigns a unique code to each voice call or data transmission
  • Calls are spread across the entire frequency band
  • Every user can simultaneously use every channel
  • A cell can simultaneously interact with multiple other cells
  • This is the main technology in cellular today
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

What are the main characteristics of Orthogonal Frequency Division Multiple Access (OFDMA)?

A
  • OFDMA is a combination of FDMA and TDMA
  • Each channel is divided into a set of closely spaced orthogolan frequencies with narrow bandwidths (subchannels)
  • Each of the different subchannels can transmit and receive simultaneously in a MIMO (Multiple Input Multiple Output) mode
  • 4G requires OFDMA
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

What are the main characteristics of 1G mobile technology?

A
  • analog transmission of voice-only data over circuit switched networks
  • 19.2Kbps
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

What are the main characteristics of 2G mobile technology?

A
  • Digitally encoded voice and data
  • All of the following fall under the 2G umbrella:
    • TDMA
    • CDMA
    • GSM
    • PCS
  • Supports data encryption, fax transmissions and SMS
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

What are the main characteristics of 3G mobile technology?

A

3G incorporates:

  • FDMA
  • TDMA,
  • CDMA
  • Packet switching (not circuit switching)
  • Global roaming
  • Internet services
  • multimedia
  • Reduced latency / faster speed
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

What are the main characteristics of 3.5G mobile technology?

A
  • Higher data rates
  • OFDMA technology
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

What are the main characteristics of 4G mobile technology?

A
  • Based on all-IP packet-switched network
  • Data exchange at 100Mbps to 1Gbps
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

At what layer of the OSI model do the various networking topologies reside (ring, bus, star, mesh)?

A

Layer 2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

Name two technologies that use Token Passing?

A

Token Ring

FDDI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

What is CSMA/CD and name a popular technology that uses it.

A
  • CSMA/CD stands for Carrier Sense Multiple Access / Collision Detect
  • Assume you can transmist and detect collisions if they occur
  • Ethernet
106
Q

What is CSMA/CA and name a popular technology that uses it.

A

CSMA/CA stands for Carrier Sense Multiple Access / Collision Avoidance

  • Basic premise is that each computer signals its intent to transmit before actually doing so
107
Q

Which are faster, technolgies that rely on token passing, or on Carrier Sensing?

A

Carrier Sensing

108
Q

What’s the difference between a Broadcast Domain and a Collision Domain?

A
  • Broadcast domains are sets of computing nodes that all receive a layer 2 broadcast frame
    • Normally nodes interconnected by switches, hubs, bridges, but with no routers between them
  • Collision Domains are sets of computing nodes that may produce collisions when they transmit data
    • Normally connected by hubs, repeaters or Wireless Access points
109
Q

What are the four steps to set up a DHCP connection?

A
  1. DHCP Discover
  2. DHCP Offer
  3. DHCP Request
  4. DHCP Ack
110
Q

What is the most common ICMP command?

A

ping

111
Q

What is a type of ICMP attack and how does it work?

A
  • ICMP Tunneling
  • Attackers know that routers and firewalls allow ICMP traffic
  • An attacker installs software on a server
  • Using client software, the attacker is able to open up a shell
  • It’s an older approach, but still effective
112
Q

ICMP is the basis for which common troubleshooting tool?

A

Traceroute

113
Q

What are the two key things to keep in mind regarding SNMP Versions and security?

A
  • Only SNMP Version 3 supports encryption and is considered secure
114
Q

Name 7 of the key Top Level Domains

A
  1. .COM
  2. .EDU
  3. .MIL
  4. .INT - International Treaty Org
  5. GOV - Government
  6. ORG - Organizational
  7. NET - Networks
115
Q

What is a basic way that DNS can be attacked?

A
  • A user on Server A needs to go to a site
  • Server A doesn’t have the IP address so it asks for one
  • An attacker intercepts the request and sends server A bogus IP address for the site
  • Now, not only the initial user, but subseqeunt users will be redirected to the wrong IP address because Server A caches the result it received from the attacker.
  • The fundamental problem is that there is no way to authenticate the Server that served the DNS request
116
Q

What is an important way of mitigating against DNS threats?

A

Use DNSSEC, which implements

  • PKI and
  • Digital signatures
  • This allows DNS to validate the origin of a message to ensure that it is not spoofed and potentially malicious
117
Q

Has DNSSEC been widely rolled out? If not, why not?

A

In order to really make it work, it would be required that all DNS Servers on the Internet would have to participate in PKI.

Figuring out a way to implement Internet wide PKI has been difficult.

But we are getting there slowly but surely.

118
Q

What is DNS Splitting and what problem does it solve?

A
  • Split DNS means putting a DNS Server in the DMZ for external DNS requests
    • Which doesn’t contain records re internal servers
  • And also using an internal DNS Server
    • Which only contains records for internal servers
119
Q

What is a way that attackers attack the /etc/hosts file?

What countermeasures can be taken?

A
  • Attackers can map the host name for antivirus update site to 127.0.0.1.

The most effective technique for preventing HOSTS intrusions is to set it as read-only and implement a host-based IDS that watches for critical file modification attempts

120
Q

What is a cyber squatter?

A
  • A cyber squater is a person who registers prominent or established names, hoping to sell at a profit.
121
Q

What is domain grabbing

A

Domain grabbing means that a person keeps track of when a URL will expire and tries to grab it from its current owner if they are not closely tracking the expiration date.

122
Q

What 3 things does SMTP do?

A

SMTP – Simple Main Transfer Protocol

  1. In email clients SMTP works as an email transfer agent (send to server)
  2. SMTP is also a message transfer protocol between email servers
  3. SMTP is also a message exchange addressing standard (Person@somewhere.com)
    • Many times a message must traverse many email servers to get from source to destination
123
Q

What is IMAP and how does it work?

A
  • IMAP stands for Internet Message Access Protocol
  • Whereas POP will download all of the users messages from the mailbox,
  • Note that POP is commonly used for Internet based email and IMAP is commonly used for corporate accounts
  • IMAP is “Store and Foreward” technology. A user can download messages to his own account, but that’s up to the user.
124
Q

What kind of security does POP3 use?

A

It uses Simple Authentication and Security Layer (SASL).

Other protocols, including POP, can also use SASL

125
Q

What is email relaying and how do attackers/spammers take advantage of it?

A
  • Most companies put a mail server in the DMZ and another mail server internally
  • Mail servers use a relay agent to send a message from one mail server to another
  • Mail should only be accepted for mail intended for use by the company.
  • Mail should only be sent to trustworthy email servers
  • What the attackers do is to find a “wide open” email server that will receive mail from it and send mail from it. The mail will appear to come from the legitimate site
126
Q

what can be done to guard against email threats?

A
  • Filtering of both incoming and outgoing email messages
127
Q

What is email spoofing and what can be done about it?

A
  • Email spoofing is forging an email to make it appear to come from a legitimate source.
  • SMTP-Auth (Authentication) it allows clients to authenticate to the mail server before an email is sent
  • Log all connections to mail servers
  • SPF (Sender Policy Framework) is an email validation system where the SPF admins specify which hosts are allowed to send email from a given domain.
  • Domain Keys Identified Mail standard allows email servers to digitally sign messages and uses the domains certificate
128
Q

What is DMARC with respect to email security

A
  • DMARC stands for Domain-based Message Authentication, Reporting and Conformance
  • specifies how domains communicate to the rest of the world
  • It also codifies mechanisms by which receiving servers provide feedback to the sends on the results of their validation of individual messages.
129
Q

What is phishing?

A

Phishing is a social engineering attack that is commonly carried out through mliciously crafted email messages.

Goal is to get user to click on malicious link or for the user to send confidentioal information

130
Q

What is the main function of Network Address Translation (NAT)?

A

NAT enables a company to use private IP addresses and still be able to communicate transparently with computers over the Internet.

Private address ranges:

  • 10.0.0.0-10.255.255.255 Class A Networks
  • 172.16.0.0. - 172.31.255.255 Class B Networks
  • 192.168.0.0 - 192.168.255.255 Class C Networks
131
Q

What are the 3 types of NAT implementations

A
  1. Static Mapping – used for servers
  2. Dynamic mapping – NAT maintains a pool of address and dynamically assigns them to users as they need to communicate outside the network.
  3. Port Address Translation – A company has a single IP to the internet and all users on the internal network use the same address, but are dynamically assigned different ports
132
Q

What is an Autonomous System (AS)

A

An Autonomous System (AS) are individual networks independently controlled by different organizations and service providers.

AS’s are made up of routers, which use the Interior Gateway Protocol (IGP) within its own boundary.

The Internet is a network made up of AS’s and routing protocols

133
Q

What’s the difference between static and dynamic routing protocols?

A
  • Static protocols are fixed and require an administrator to manually configure the routing table
  • Dynamic protocols detect that a router is down and send a message to other nearby routers. As a result, the routing tables are automatically kept up to date without manual intervention.
134
Q

What is route flapping?

A

Route flapping is when there are constant changes in the availability of routes

135
Q

What is a black hole?

A

If a router does not receive an update that a link has gone down and continues to forward packets to that route, it’s called a black hole.

136
Q

Name the two main types of routing protocols and compare and contrast them.

A
  1. Distance-vector routing protocols make routing decisions based on the number of hops. Example - Routing Interface (RIP) protocol
  2. Link state routing protocols – build a topology database that includes packet size, link speed, network load, reliability. Example – Open Shortest Path First (OSPF).

Link state protocols are more accurate

137
Q

Name 6 common Interior Routing Protocols and give a brief description of each.

A
  1. Routing Information Protocol – Distance Vector. Slow. Considered legacy
  2. Open Shortest Path First – Link state. Requires more CPU and resources. No passwords, or cleartext passwords or hashed passwords
  3. Interior Gateway Routing Protocol (IGRP) - Distance vector. Proprietary Cisco protocol. Weights can be assigned to different metrics
  4. Enhanced Interior Gateway Routing Protocol (EIRGP) – Advanced Distance vector. Proprietary Cisco
  5. Virtual Router Redundancy Protocol (VRRP) – Two physical routers are mapped to one virtual router for high availability
  6. Intermediate System to Intermediate System (IS-IS). Link state protocol, where each router can independenty build its own router topology. It uses ISO addresses, rather than IP addresses. Did not have to be redesigned for IPV6.
138
Q

What are Exterior Gateway Protocols? Give two examples.

A

Exterior Gateway protocols are used to interconnect two AS’s.

  • Exterior Gateway Protocol (EGW) is now a legacy protocol, but the term is still used generically.
  • Border Gateway Protocol (BGP) is the main one in use today.
    • Uses a combination of link state and distance vector algorithms
    • Configurations collectively are called Routing Policy
139
Q

What are the common types of attacks against routers?

A
  • Misdirecting traffic via spoofed ICMP messages.
  • An attacker can masquerade as another router and submit bogus routing table information to the victim router
  • These attacks are mainly successful when routing protocol authentication is not enabled
  • DoS attacks
    • flooding a router port
    • buffer overflows
    • Syn floods
  • Countermeasures mainly authentication and encryption of routing data using shared keys or IPSec
140
Q

What is a Wormhole attack?

A

A wormhole attack consist of capturing a packet at one location and tunneling it to another location on the network

  • Two attackers required
  • Attacker A captures an auth token being sent to auth server and gives it to Attacker B
  • Attacker B takes this token and uses it to gain unauthorized access to a resource.
  • Easier to do on wireless networks
  • The countermeasure is a leash - either geographical (token can only be used within a certain distance) or temporal (where the token will expire after a certain time)
141
Q

A hub is a multiport ____________.

A

repeater

142
Q

What kind of address does a repeater work with?

A

A repeater doesn’t work with addresses at all. It simply amplifies whatever signal it receives

143
Q

What is a Bridge used for? What kinds of addresses does it work with?

A

A bridge is used to connect two LAN segments.

It works with MAC addresses

144
Q

What are the main functions of a bridge?

A
  • Segments a large network into smaller, more controllable pieces
  • Uses filtering based on MAC addresses
  • Joins different types of network links while retaining the same broadcast domain
  • Isolates collision domains within the same broadcast domain
  • Can take place locally within a LAN or remotely to connect two distant LANs
  • Can translate between protocol types (e.g. Ethernet and Token Ring)
145
Q

What’s the difference if you connect two LAN’s with a bridge vs. a router?

A
  • If you use a bridge
    • LAN’s are extended because same broadcast domain
  • If you use a router
    • Separate broadcast domain
    • Two LAN’s connected by a router results in an internetwork
    • Internet is an example of an internetwork
146
Q

Should external devices and border routers accept packets with source routing information?

A

No.

  • YOU (the network admin) want to control how traffic traverses your network
  • You can’t let packets to have this much control
  • Attackers can use source routing in their attacks
147
Q

What layers of the OSI stack do repeaters, bridges and routers work on?

A
  • Repeaters work on the Physical (L1) layer
  • Bridges work on the the Data Link (L2) layer
  • Routers work on the Network (L3) layer
148
Q

What is the role of Access Control Lists (ACL’s) in routers?

A

ACL’s indicate:

  • What packets are allowed in an what packets are denied
  • Access decisions are basesd on source and destination IP addresses, protocol type and ports
  • Example – an administrator can block FTP traffic
149
Q

What happens when a router receives a packet?

A
  1. Router receives packet and checks its own routing data
  2. Router retrieves the destination IP from the packet
  3. Router looks at its routing table to see which port matches the requested destination IP address
  4. If Router does not have information about how to route it, it sends an ICMP error message to the sending computer
  5. If router has a route, it decrements the TTL value, checks the MTU size for the desitination network. If necessary it will fragment the datagram
  6. The router changes header information in the packet so it can go to the next correct router
  7. The router sends the packet to its output queue for the necessary interface.
150
Q

A switch combines the functionality of a ___________ and a ___________.

A

Repeater

Bridge

151
Q

What is a technique that attackers use on switched networks?

A
  • Attackers can poison cache memory on switches to divert traffic to their desired location
152
Q

What’s the difference between Layer 2, 3 and 4 switches?

A
  • The basic distinction is the header information the device looks at to make forwarding or routing decisions
    • L2 - Data Link (MAC address)
    • L3 - Network (IP address)
    • L4 - Transport OSI
  • L3 and L4 networks can append tags
  • All switches between the first switch and the destination switch only look at the tag to make forwarding or routing decision
  • At the last switch, the tag is removed and packet sent to destination
  • Routing based on tags is quicker than analyzing the full header
153
Q

The use of tags for routing/forwarding decisions is known as M________, P________ L_________ S__________.

A

Multi-Protocol Labeled Switching - MPLS

different tags can have different QoS requirements and can be prioritized

154
Q

How do switches make it more difficult for intruders to sniff and monitor network traffic?

A

With switches, no broadcast and collision information is continually traveling throughout the network.

155
Q

When only repeaters, switches and routers are used, network resources must be grouped according to their _____________.

A

Physical location

156
Q

What is the main functionality that VLAN’s provide?

A

With VLAN’s, administrators can group resources logically based on the users/company’s needs, rather than physical location.

157
Q

What is the IEEE standard for VLAN tagging?

A

IEEE 802.1Q

158
Q

Name three types of VLAN attacks

A
  1. VLAN hopping attacks. An attacker makes a device act like a switch
  2. Switch spoofing attack
  3. Double tagging attack
159
Q

What does a Gateway do?

A
  • In general, a gateway connects two different environments
    • Many times acts as a translator
    • Sometimes restricts their interactions
  • Example is an email gateway
  • Example is Network Access Server (NAS)
160
Q

What is a phreaker?

A

A phone hacker

161
Q

What does a firewall do?

A

A firewall restricts access from one network to another

162
Q

What is a Demilitarized Zone (DMZ)?

A

A DMZ is a network segment located between the protected and unprotected networks

163
Q

What kinds of devices are typically put in a DMZ?

A

DMZ’s typically have:

  • web servers
  • mail servers
  • DNS Servers
  • IDS sensors that listen for malicious and suspicious behavior
164
Q

What are the main characteristics of Packet Filtering firewalls?

A
  • First generation firewalls
  • Makes access decisions based on network-level protocol header values
  • Is configured with ACL’s that dictate the type of traffic allowed into and out of specific networks
  • Also called stateless inspection
  • Decisions made completely according to an individual packet
  • Only examine packet’s header, not the data it contains
165
Q

What are the official names for input filtering and output filtering?

A

Input filtering = Ingress filtering

Output filtering = Egress filtering

166
Q

What are the weaknesses of packet filtering firewalls?

A
  • Do not prevent attacks that employ application-specific vulnerabilities or functions
  • Limited logging functionality
  • Most do not support advanced user authentication schemes
  • Many cannot detect a spoofed address
  • They may not be able to detect packet fragmentation attacks
167
Q

What are the advantages of packet filtering firewalls?

A
  • they are scalable
  • not application dependent
  • high performance
  • commonly used as a first line of defense at the network edge
168
Q

What are the main characteristics of a stateful firewall?

A
  • Like a nosey neighbor
  • maintains a state table
  • It knows how protocols are supposed to work and if things are taking place outside of the standard protocols, it will flag it and not allow the traffic to pass through
  • Once the initial inspection is done, it will be deemed safe and after that it will base decisions on the header only.
  • Works well with TCP because it is connection-oriented
  • Provides data for tracking connectionless protocols such as UDP and ICMP
  • Stores and updates the state and context of the data within the packets
169
Q

What are the weaknesses of stateful-inspection firewalls?

A
  • They have been the victims of many types of DoS attacks
    • Flood state table with bogus information
170
Q

What are the main characteristics of a proxy firewall?

A
  • A proxy firewall is a middle man
  • It breaks the connection; thus, there is no direct connection between source and destination
  • It stops and restarts the communication session on behalf of the sending system
  • When it works at the application layer, it is called an application-level proxy
  • It can work at the lower layers of the stack and when it does it is called a circuit-level proxy (works at the Session Layer).
  • Traffic that flows through a circuit level proxy appears to come from the firewall
171
Q

What are the main characteristics of an application-level proxy

A
  • They make decisions based on various services and protocols
  • They can distinguish between FTP GE T and FTP PUT
  • Each app-level proxy must have portions of it dedicated to different protocols. It knows the nuances of the various protocols and knows how to make sure that they are not passing suspicious traffic
172
Q

Advantages of Application level Proxy Firewalls

A
  • Extensive logging capabilities because they can see the entire packet
  • They can authenticate a user directly (rather than just system level authentication)
  • They can address spoofing attacks and other sophisticated attacks
173
Q

What are the disadvantages of using application-level firewalls?

A
  • Not well suited to high bandwidth and real-time applications
  • Tend to be limited in supporting new network applications and protocols
  • Create performance problems due to per packet processing requirements
174
Q

What are the main characteristics of Dynamic Packet Filtering Firewalls?

A
  • When internal systems must communicate with untrusted networks, it must select a port number of greater than 1023 for itself
  • A dynamic packet filtering firewall then creates an ACL that allows the external entity to communicate with the internal system (say, port number 11,111)
  • For connection oriented protocols (TCP), as soon as the connection is terminated, the ACL will be removed
  • For connectionless protocols (UDP), the connection times out and is then removed from the list
  • Without Dynamic packet filtering firewalls, it would be necessary to open up all ports gretaer than 1023.
175
Q

What are the main characteristics of Kernel proxy firewalls?

A
  • When a packet arrives at a kernel proxy firewall, a new virtual network stack is created, which is made up of only the protocol proxies necessary to examine this specific packet properly.
  • Thus everything is examined
  • Faster than application level proxies because the inspection takes place in the kernel and does not need to be passed up to a higher software layer in the OS.
  • Still a proxy-based system because the connection is broken
  • It can perform NAT (just like all other proxy based firewalls).
176
Q

What are the main characteristics of a Next Generation Firewall (NGFW)?

A
  • Does everything all the other firewalls do, plus:
  • Incorporates a signature-based IPS engine
  • Once a new attack is detected on one firewall, it will make other firewalls from same vendor aware of it.
  • Biggest negative is that they are very pricey
177
Q

What is a bastion host?

A
  • A bastion host is a highly exposed device that is most likely to be targeted by attackers.
  • Any system on the public side of a DMZ is considered a bastion host
  • Any system directly connected to an untrusted network is a bastion host
  • Should have all unnecessary services disabled
  • Should have all unnecessary acounts removed
  • Unused apps and utilities should be removed
178
Q

What is a dual-homed firewall and a multi-homed firewall?

A
  • A dual-homed firewall has 2 NICs
  • A multi-homed firewall has more than two NICs.
    • enables setting up multiple DMZ’s
179
Q

What is a screened host?

A

A screened host is a firewall that communicates directly with a perimeter router and the internal nework.

180
Q

What is a screened subnet and why is it better than a screened host?

A

A screened subnet architecture adds another layer of security to the screened host architecture.

It adds a second firewall.

More layers of defense. Defense in depth.

See diagram

181
Q

Name the key “Shoulds” of Firewalls

A
  • Deny all packets not explicitly allowed
  • If a packet comes from an internal network address, it should be denied because there’s no reason that an internal packet should be coming through the firewall
  • No packet should be allowed to leave the network that does not have a valid internal address.
    • This is how DDoS attacks work. Sending address is spoofed
  • Firewalls should reassemble fragmented packets before sending them to their destination. Attackers like to use fragments so firewall doesn’t have the complete picture
182
Q

Name three types of Firewall fragmentation attacks

A
  1. IP Fragmentation – Fragmentation and Reassembly flaws within IP are exploited, which causes DoS
  2. Teardrop attack - Malformed fragments are created by the attacker and once they are reassembled, they could cause the victim system to become unstable
  3. Overlapping fragment attack – Used to subvert packet filters that do not reassemble packet fragments before inspection. A malicious fragment overwrites a previously approved fragment and executes an attack on the victim’s system
183
Q

List 4 common firewall rules.

A
  1. Silent Rule – drops noisy traffic without logging it. Reduces log sizes by not responding to packets that are deemed unimportant
  2. Stealth rule – disallows access to firewall software from unauthorized systems
  3. Cleanup rule – Last rule in rule base, drops and logs any traffic that does not meet any of the preceeding rules
  4. Negate rule – used instead of broad “any rules. Provides tighter permission rights by specifying what system can be accessed and how
184
Q

What are the cautions with respect to firewalls?

A
  • Usually a distributed approach is necessary. Usually a single firewall won’t do the job
  • Firewalls can present a potential bottleneck to the flow of traffic and a single point of failure threat
  • Some firwalls do not provide protection from malware and can be fooled by the more sophisticated attack types.
  • Firewalls do not protect against sniffers or rogue wireless access points and provide little protection against insider attacks.
185
Q

What does a proxy server do?

A

Proxy servers act as an intermediary between the clients that want access to certain services and the servers that provide those services

You do not want internal systems to directly connect to external servers without control.

Example – all internal web browsers could be configured to send web requests to web proxy server, which make the request on the user’s behalf.

186
Q

What’s the differrence between a:

  • Forwarding proxy
  • Open Proxy
  • Reverse Proxy
A
  • Forwarding proxy - allows the client to specify the server it wants to communicate with
  • Open Proxy - A forwarding proxy that is open for anyone to use
    • An anonymous open proxy allows users to conceal their IP address while browsing websites
  • Reverse Proxy – appears to the client as the original server. Client adds a request to what it thinks is the original server, but the reverse makes the request and sends a response to user
187
Q

Name one upside and one downside of proxy servers

A
  • Upside – increased privacy for ordinary users
  • Downside – attackers use proxy servers to conceal their identities
188
Q

What’s the idea behind unified threat management and what are some of the downsides associated with it?

A

Unified Threat Management is about having a single appliance that is responsible for many security functions, including firewall, VPN, antimalware, etc.

Downsides:

  • Single point of failure for traffic (assuming no redundancy)
  • Single point of compromise
  • Performance issues - choke point
    *
189
Q

What is Content Distribution Network and why do they exist?

A

A content Distribution Network consists of multiple servers distributed across a large region in order to provide content for users closest to it.

It avoids all users across the country/globe having to go long distance to get to their content

190
Q

What is a security benefit of using Content Distribution Networks?

A

Because content servers are distributed, the organization is less vulnerable to a DoS attack. Even if they succeed in taking down one server, they won’t succeed in taking down a different one.

Companies now intentionally use CDN’s as a security mechanism.

191
Q

What is Software Defined Networking (SDN) and how is it different from traditional networking?

A
  • Software Defined networking relies on distributed software to quickly provision new network devides to deal with dynamic changes
  • Traditional networking relies on distributed devices to coordinate with one another
  • Traditional networking relies on manual configuration
  • SDN has centralized configuration and management. It reacts/adapts to new traffic and is able to proactively spin up new devices to respond to them
  • SDN abstracts the control and forwarding planes
192
Q

What are networking control planes and forwarding planes?

How are these different between traditional networking and software defined networking?

A
  • The control plane:
    • Is where internetwork routing decisions are made (e.g. OSPF)
    • Discovers topology of neighboring networks
  • Forwarding plane:
    • Is where traffic forwarding decisions are made
      • Packet from Eth0 must go to Eth3
  • In traditional networking, each networking device has its own control plane and its own forwarding plane implemented in a proprietary OS
  • In SDN, the control plane is implemented in a central node that is responsible for managing all devices in the network
193
Q

Name the three approaches to Software Defined Networking

A
  1. Open – Championed by the Open Networking Foundation (ONF) is the most common
    • Relies on open source building blocks
    • Controller communicates with switches using OpenFlow
  2. API – Championed by Cisco
    • Uses OpenFlow plus a rich API on the switches to allow greater control of traffic
  3. Overlays – The SDN is simply an overlay (abstraction layer) over the underlying physical network.
194
Q

What is an endpoint?

A

An endpoint is any computing device that communicates through a network and whose principal function is not to mediate communications for other devices on that network.

195
Q

What’s the difference between a honeypot, a honeynet and a tarpit?

A
  • Honeypot – networking device that is intended to be exploited by attackers to gain info re the attackers
  • Honeynet – when two or more honeypots are used together
  • Tarpits – similar to honeypots, but their goal is to allow a connection that appears to be good at first, but then slows down or times out so that automated data gathering by the attackers will not be successful.
196
Q

What is Network Access Control?

A

IT’s a set of policies and controls that are used to control access to our networks

197
Q

What is an extranet?

A

An extranet extends outside the bounds of the company’s network to enable two or more companies to share common information and resources.

198
Q

Give an example of a Value Added Network (VAN)

A

Walmart subscribes to a Value Added Network.

  • When inventory gets low, Walmart sends a request to its VAN
  • That way, Walmart doesn’t need to keep track of thousands of suppliers
  • The VAN keeps track of the suppliers that Walmart wants to use and places the order on Walmart’s behalf
199
Q

The majority of today’s MAN’s are made from _______?

A

SONET rings

200
Q

Which set of protocols tend to be connection oriented, which tend to be connectionless?

LAN or WAN

A

LAN protocols tend to be connectionless

WAN protocols tend to be connection oriented – more likely to have errors, thus it makes sense to maintain a connection

201
Q

What’s the hierarchy of telecommunications history?

A
  • Copper lines carrying analog signals
  • T1 lines carrying up to 24 conversations
  • T3 lines carrying up to 28 T1 lines
  • Fiber Optics and the SONET network
  • ATM over SONET
202
Q

What are T-Carriers?

A

T-carriers are dedicated lines that carry voice and data over trunk lines

T1 & T3

203
Q

What is an E-Carrier?

A

An E-Carrier is like a T-Carrier, except for Europe

204
Q

What is an Optical Carrier?

A

Hi speed fiber-optic connections are measured in optical carrier transmission rates.

205
Q

What are CSU/DSU’s and why are they needed?

A
  • CSU - Channel Service Unit
  • DSU – Data Service Unit

A CSU/DSU is needed because signals and frames can vary between a LAN and a WAN

206
Q

What’s the difference between circuit switching and packet switching?

A
  • Circuit switching sets up a virtual connection that acts like a dedicated link between two systems
    • ISDN and telephone calls are examples of circuit switching
    • The two devices set up a communication channel
    • Channel stays in place till connection is torn down
  • Packet switching –
    • There is no dedicated virtual link
    • Packets can flow through different devices
    • X.25 and Frame Relay are examples
    • Frame Check Sequence (FCS) numbers enable putting them back together again in order at the destination
207
Q

What are the key points regarding Frame Relay?

A
  • Frame Relay is obsolete tech
  • It operates at the data link layer
  • The idea is that instead of having to have dedicated lines, multiple companies could share the same line
  • Any to any service shared by many users
  • Commited Information Rate (CIR) gives a certain amount of guaranteed bandwidth
208
Q

What are the two types of Virtual Circuits with respect to Frame Relay and X.25 LAN technology?

A
  1. Permanent Virtual Circuits (PVC’s) – Virtual circuits always available
  2. Switched Virtual Circuits - Virtual circuits not permanent and must be created and then are torn down.
209
Q

Name a few facts about X.25.

A
  • Older than Frame Relay, but similar
  • Data encapsulated into HDLC frames
  • Old technology that included lots of error checking that wouldn’t be included today
  • It is very fat, compared to today’s technology
210
Q

What are the key facts about ATM – Asynchronous Transfer Mode?

A
  • Instead of using variable sized packets, it uses fixed sized cells (53-bytes).
  • Connection oriented
  • Sets up virtual circuits
  • Supports QoS
  • Used for Voice and Video
211
Q

Name 4 types of QoS that can be specified with ATM.

A
  1. Constant Bit Rate (CBR) - Connection oriented
  2. Variable Bit Rate (VBR) - Connection oriented
  3. Unspecified Bit Rate (UBR) - Connectionless
  4. Available Bit Rate (ABR) - Connection oriented that allows bit rate to be adjusted
212
Q

What is SDLC?

A

Synchronous Data Link Control – IBM SNA networks.

Used for leased line connections

213
Q

What is HDLC?

A
  • HDLC stands for High-level Data Link Control
  • Bit oriented link layer protocol and is used for serial device to device WAN Communication
  • HDLC is a framing protocol that is used mainly for device to device communication, such as two routers communicating over a WAN link.
214
Q

What is Point to Point Protocol?

A
  • It’s similar to HDLC in that it is a data link protocol that carries out framing and encapsulation for p2p connections
  • Includes:
    • Link Control Protocol (LCP)
    • Network Control protocols (NCP)
    • Password Authentication Protocol (PAP)
      • Sends passwords in cleartext - only use on encrypted links
    • Challenge Handshake Authentication Protocol (CHAP)
    • Extensible Authentication Protocol (EAP)
215
Q

What is HSSI?

A
  • HSSI stands for High Speed Serial Interface
  • used to connect multiplexers and routers to high speed communications services such as ATM and Frame Relay
216
Q

What are multiservice access technologies?

A

Multiservice Access technologies combine several types of communication categories (data, voice and video) over one transmission line

217
Q

What is the SIP protocol?

At what layer of the OSI model does it live?

On what protocols is it dependent?

A
  • SIP stands for Session Initiation Protocol (used in VOIP)
  • It is a signaling protocol
  • SIP is an application layer protocol
  • It can work over TCP or UDP
218
Q

What are H.323 Gateways?

A
  • H.323 is a set of recommendations from the ITU-T
  • Also a standard that deals with:
    • video
    • real-time audio
    • data packet-based transmissions where multiple users are involved
219
Q

What are the two main components of SIP?

A
  • User Agent Client (UAC)
    • creates the SIP requests for initiating a communication session
    • generally messaging tools and softphone applications used to place VOIP calls
  • User Agent Server
    • SIP Server
    • Responsible for handling all routing and signalling involved in VOIP calls
  • SIP relies on a 3-way handshake
220
Q

What can be done about security issues related to VoIP?

A
  • Keep patches up to date
    • call manager server
    • voicemail system
    • gateway server
  • Identify rogue telephony devices
  • install and maintain:
    • Stateful firewalls
    • VPN for sensitive data
    • Intrusion detection
  • Disable unnecessary ports on all networking components involved in VoIP
  • Employ real-time monitoring that looks for attacks, tunneling and abusive call patterns through IDS/IPS
221
Q

What does ISDN stand for and what are some of the key things to know about it?

A
  • ISDN stands for Integrated Services Digital Network
  • Provided by telephone companies, ISP’s
  • It is NOT Always On
  • Enables data, voice and other types of traffic over a medium that had previously been used only for voice transmission
  • Same wires as analog dial-up, but everything happens digitally
222
Q

What is the main standard that cable companies adhere to for their data service?

A
  • DOCSIS – Data Over Cable Service Interface Specifications
223
Q

What is a VPN?

A

A VPN is a secure, private connection through an untrusted network

  • It requires a tunnel
  • It assumes encryption
224
Q

What are the key protocols that make VPN’s work?

A
  • Point to Point Tunneling Protocol (PPTP)
    • Uses Generic Routing Encapsulation and TCP to encapsulate PPP packets and extend a PPP connection through an IP network
    • Cannot support multiple connections over one VPN tunnel
    • It can only be used for system to system communication
  • L2TP (different option)
    • Combines PPTP and Cisco’s Layer 2 Forwarding Protocol
    • Inherits PPP authentication
    • Integrates with IPSec
  • Note:
    • PPP provides user auth via PAP, CHAP, EAP-TLS
    • IPSec provides system auth
225
Q

Are PPP, PPTP, L2TP and IPSec needed for every VPN that goes through the internet?

A

No, only when P2P connections are involved.

When two gateway routers are connected over the internet and provide VPN functionality, they only have to use IPSec

226
Q

What is Internet Protocol Security (IPSec)?

A

IPSec is a suite of protocols developed for IP traffic.

  • It works at the Network layer of the OSI model and includes:
    • Authentication Header- provides data integrity, data origin auth and protection from replay attacks
    • Encapsulating Security Payload – provides confidentiality, data origin auth and data integrity
    • Internet Security Association and Key Management Protocol (ISAKMP)
      • Provides a framework for security association creation and key exchange
    • Internet Key Exchange (IKE) - provides authenticated keying material for use with ISAKMP
227
Q

What is Transport Layer Security VPN?

A
  • TLS works at the session layer of the network stack
  • Mainly used to protect HTTP traffic
228
Q

Compare and Contrast the four main tunneling protocols

A
  • PPTP
    • client/server
    • works at data link layer
    • transmits over IP networks only
  • L2 Tunneling Protocol (L2TP)
    • Extends and protects PPP connections
    • works at data link layer
    • transmits over multiple network types, not only IP
    • Can be combined with IPSec for security
  • IPSec
    • Handles multiple VPN connections at a time
    • Provides secure auth and encryption
    • Supports only IP networks
    • Focuses on LAN to LAN communication, rather than user to user communication
  • TLS (Transport Layer Security)
    • Works at the session layer
    • Mostly used for web and email traffic
    • Granular access control and configuration are available
    • Easy deployment since already embedded in web browsers
    • Can only protect a small number of protocol types, thus it is not an infrastructure level VPN solution
229
Q

Give a rundown of the main authentication protocols

A
  • PAP = Password Authentication Protocol. Not secure because credentials sent in cleartext
  • Challenge Handshake Authentication Protocol (CHAP). Microsoft’s version is MS-CHAP. Uses a Nonce
  • Extensible Authentication Protocol (EAP). It extends auth possibiliities of PAP and CHAP to other methods (one-time passwords, token cards, biometrics, Kerberos, digital certs and future mechanisms
    *
230
Q

Compare and Contrast Link Encryption with E2E encryption

A
  • Link encryption encrypts all the data along a specific communication path
    • Not only is user info encrypted, but headesr, trailers, addresses, everything is encrypted
    • The only thing not encrypted is the data link control messaging info
    • Provides protection against packet sniffers and eavesdroppers
    • Decryption/Encryption are required at every hop
  • With E2E encryption, the headers, addresses, routing info and trailers are NOT encrypted – which enable hackers to sniff and eavesdrop
    • It’s called E2E because it’s encrypted for the length of its journey, not just a specific link
231
Q

Describe at which layer encryption takes place for:

  • E2E encryption
  • TLS encryption
  • PPTP encryption
  • Link encryption
A
  • E2E encryption - within applications
  • TLS encryption - at the session layer
  • PPTP encryption - at the data link layer
  • Link encryption - at the data link and physical layers
232
Q

What are the advantages and disadvantages of E2E Encryption?

A
  • Advantages
    • More flexible – user chooses what gets encrypted
    • Higher granularity of function because each app can do it differently
    • Each hop device doesn’t have to encrypt/decrypt
  • Disadvantages
    • Headers, addresses and routing info are not encrypted and therefore not protected
233
Q

What are the advantages and disadvantages of Link Encryption?

A
  • Advantages
    • All data is encrypted, including headers, etc.
    • Users don’t need to do anything to inintiate it. It just happens
  • Disadvantages
    • Key distribution and management are more difficult because each hop device must receive a key and when keys change they must be updated
    • packets are decrypted at each hop, thus there are more points of vulnerability
234
Q

What are the main characteristics of MIME and what does it stand for?

A

MIME stands for Multipurpose Internet Mail Extensions (MIME)

  • Technical spec re how multimedia data and email binary attachments are to be handled
  • So if you receive a .jpeg file, your system will know how to open it

S/MIME - Extends MIME by allowing for encryption of email attachments

235
Q

What are some of the highlights of PGP (Pretty Good Privacy)?

A
  • The Ring of Trust, rather than Certificate Authorities
  • Public Domain
  • DeFacto standard
236
Q

What are the highlights of SSL

A

Secure Socket Layer

  • Uses Public Key Encryption
  • Provides:
    • Data encryption
    • Server authentication
    • message integrity
    • optional client authentication
  • Operates beneath the app layer and above the network layer
  • For the purposes of the exam – SSL works at the transport layer
  • No longer considered secure
237
Q

What are the highlights of TLS (Transport Layer Security)?

A
  • SSL is proprietary (Netscape) and TLS is the public version of it.
  • Usually used for encrypting data in transit
238
Q

What is SSH?

A

SSH stands for Secure Shell

  • Tunneling mechanism that provides terminal-like access to remote computers
  • It’s a program and a protocol
  • Can also be used for secure channels and port redirection
  • Uses session keys to establish a secure channel
239
Q

How do you remember the 7 layers of the OSI model (7-1)

A

All People Seem To Need Data Processing

240
Q

How do you remember the 7 layers of the OSI model (1-7)

A

Please Do Not Throw Sausage Pizza Away

241
Q

What are three private IP address ranges and how many addresses does each contain?

A
  • 10.0.0.0 -> 10.255.255.255 Class A Total addresses: 16,777,216
  • 172.16.0.0 -> 172.31.255.255 Class B Total addresses: 1,048,576
  • 192.168.0.0 -> 192.168.255.25 Class C Total addresses: 65,536
242
Q

What is a PVC?

A

A PVC is a Private Virtual Circuit

243
Q

What important factor differentiates Frame Relay from X.25?

A
  • Frame Relay supports multiple PVC’s over a single WAN carrier connection (X.25 does not)
  • Frame Relay also supports a Committed Information Rate (CIR)
  • Frame Relay requires a DTE/DCE at each connection point
244
Q

What is LEAP and is it a good idea to use it?

A

No. LEAP is Lightweight Extensible Authentication Protocol, which is a Cisco proprietary protocol designed to handle problems with TKIP. Unfortunately, LEAP has significant security issues as well and should not be used. Any modern hardware should support WPA2 and technologies like PEAP or EAP-TLS.

245
Q

What are the four modes of 802.11g?

A
  • Infrastructure Mode- connects endpoints to a central network, not directly to each other
  • Wired Extension Mode - uses a wireless access point to link wireless clients to a wired network
  • Ad hoc mode - directly connects two clients.
  • Stand-alone mode - connects clients using a wireless access point but not to wired resources like a central network.
246
Q

What does the RST flag mean in a TCP header?

A

RST means “Reset.” The TCP session will be disconnected.

247
Q

What are all the various 802.11 generations including:

  • the frequency at which they run
  • the stream data rate
  • Indoor range
  • Outdoor range
A

See image

248
Q

What is CHAP and what are its key features?

A

CHAP is the Challenge-Handshake Authentication Protocol, or CHAP, is used by PPP servers to authenticate remote clients. It encrypts both the username and password and performs periodic reauthentication while connected using techniques to prevent replay attacks.

249
Q

What does RADIUS stand for and what is it used for?

A

RADIUS stands for Remote Dial In User Service.

The Remote Access Dial In User Service (RADIUS) protocol was originally designed to support dial-up modem connections but is still commonly used for VPN-based authentication.

250
Q

In the context of firewall design, what does the number of tiers refer to?

A

The number of tiers refers to the number of protected zones

251
Q

What are the 4 Protection Rings?

A

See diagram

252
Q

What are the first 4 steps of the DHCP Flow between Client and Server?

A
  1. DHCPDISCOVER
  2. DHCPREQUEST
  3. DHCPOFFER
  4. DHCPACK
253
Q

Must memorize all of the different kinds of firewalls

A
254
Q

What is a Smurf attack?

A

A Smurf attack sends ICMP Echo Requests to the network broadcast address, using a forged source address, usually the victim’s IP address. Since this attack sends to the broadcast address, all hosts on the segment will receive the broadcast. They will then all reply to the source address, which in this case is the victim.

255
Q

What happens during each step of the TCP handshake?

SYN

SYN/ACK

ACK

A

SYN

SYN/ACK - confirms sequenc numbers and windowing for both hosts

ACK

256
Q

Dispersion is a condition that affects which cabling type?

A

Fiber Optics

257
Q

The ______________ is an IETF-defined signaling protocol, widely used for controlling multimedia communication sessions such as voice and video calls over Internet Protocol (IP).

A

Session Initiation Protocol (SIP)

258
Q

What are the basic services performed by a central authenticating system?

A

Accountability

Authentication

Authorization

259
Q

Which of the following statements about network sniffing is true?

A

It typically requires system-level privilege on the host doing the sniffing, and some manipulation of the switch to gain access to all of the frames.

260
Q

Which of the following best describes Ethernet transmissions over a LAN?

A

Traffic is bursty in nature and broadcasts data to all hosts on the subnet.

261
Q

X.25 works at the ________ and ________ layers.

A

Network and data link

262
Q
A

KM - Personal CISSP (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions