Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 4: Communication and Network Security 14% > Flashcards

Domain 4: Communication and Network Security 14% Flashcards

1
Q

Baseband

A

networks have on channel, and can only send one signal at a time. Ethernet is baseband.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Broadband

A

networks have multiple channels and can send and receive multiple signals at a time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Extranet

A

is a connection between private Intranets, often connecting business partners Intranets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Circuit switching

A

Expensive, but always available, used less often. A dedicated comm channel through the network, guarantees the full bandwidth.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Packet switching

A

cheap, but no capacity guarantee, very widely used today.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

QOS (Quality of Service)

A

gives specific traffic priority over other traffic. Most commonly VOIP, or other UDP traffic needing close to real time comm.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

GAN (Global area network)

A

A global area network, is a network used for supporting mobiles users across a number of wireless LANs, satellite coverage areas, the transition from one to the next can be seamless

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

OSI (Open Systems Interconnect)

A

7 layers. 1. Physical, 2. Data Link, 3. Network, 4 Transport, 5. Session, 6. Presentation, 7. Application
7-1 All people seem to need data processing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

PDU (Protocol Data Units)

A

Data-567, Segments-4, Packets-3, Frames-2, Bits-1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Layer 2: Data Link Layer

A

Transports btw 2 nodes connected to same network. LLC - Logical Link Control-error detection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

MAC address (BIA)

A

a unique identifier on the network card. Can be spoofed very easily. Threats - MAC Spoofing, MAC Flooding.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

ARP (Address Resolution Protocol)

A

Layer 2/3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

CSMA/CD (Collision Detection)

A

Ethernet - minimized with switches vs hubs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

CSMA/CA (collison Avoidence)

A

Wireless

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Token passing

A

Similar to the talking stick, not really used anymore

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Layer 3: Network Layer

A

Expands to many different nodes (IP) - The Internet is IP based. Isolates traffic into broadcast domains. Threats = Ping of Death, Ping Floods, Smurf - spoof source and directed broadcast, IP modifications, DHCP attacks
Only IMAP is layer 7 all other I protocols are Layer 3.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Layer 4: Transport Layer

A

SSL/TLS Layer 4 to 7

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

UDP (User Datagram Protocol)

A

Connectionless protocol, unrealiable, VOIP, Live video, gaming, “real time” Timing is more important than delivery confirmation Attack: Fraggle attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

TCP (Transmission Control Protocol)

A

Reliable, connection oriented, guaranteed delivery, 3 way handskake, slower/more overhead, data reassembled. Attacks: SYN floods - half open TCP sessions, client sends 1,000’s of SYN requests, but never the ACK

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

3-Way handshake

A

SYN, SYN/ACK, ACK

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

TCP Flags (9 bits 1-bit flags)(Control bits)

A

SYN= synch sequen numbers ACK= indicates that the Acknowledgment field is significant. RST= Rest the connection. FIN= Last package from sender

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Layer 5: Session Layer

A

Establishes connection between 2 applications: Setup > Maintenance>Tear down

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Layer 6: Presentation Layer

A

Only layer with no protocols. Formatting, compressing, encryption (file level)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Layer 7: Application Layer

A

Presents data to user (applications/websites. HTTPS, FTP, SNMP, IMAP, POP, AD integration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

The higher up the layers

A

the slower it is, speed traded for intelligence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Threats to level 5-7

A

virus, worms, trojans, buffer overflow, app or OS vulner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

TCP/IP Model (Internet protocol suite)

A

A conceptual model that provides end-to-end data comm. It has four layers which are used to sort all related protocols according to the scope of networking involved.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

TCP/IP link layer

A

equals OSI Layers 1/2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

TCP/IP Internetwork layer

A

equals OSI Layer 3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

TCP/IP Transport layer

A

equals OSI Layer 4, TCP/UDP. port number

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

TCP/IP Application layer

A

equals OSI Layers 5-7

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

48bit MAC’s in IPv6

A

modified into 64-bit MAC’s by adding FF:FE to the device identifier

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

IPv4

A

1st deployed for production in the ARPANet in 1984, ARPANet later became the Internet. IP was developed in 1970’s for secure closed networks DARPA. Security was not built in, but was bolted on later. It is a connectionless protocol for use on packet-switched networks. It operates on a best effort delivery model, it does not guarantee delivery, it also does not assure proper sequencing or avoidance of duplicate delivery. We have added protocols (TCP) on top of IP to ensure those.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

IPv6

A

moving here mainly because we are running out of IPv4 address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

A Socket

A

1 set of IP and Port. UDP only uses 1 socket (connectionless), TCP uses 2 in a pair

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Socket Pairs (TCP)

A

2 sets of IP and Port (Source and Destination)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

IANA (Internet Assigned Numbers Authority)

A

governs the IP’s address allocation. Is a department of ICANN (Internet Corporation for Assigned Names and Numbers)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Unicast

A

1-1 traffic (Client to Server) we can capture all unicast traffic on a network by using promiscuous mode on a NIC (Network IDS’/IPS’)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Multicast

A

one to many (predefined)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Broadcast

A

one to all (on a LAN Network) The traffic is sent to everyone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Limited L3 Broadcast:

A

Use the 255.255.255.255 broadcast IP address, router do not pass

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Limited L2 Broadcast:

A

Uses FF:FF:FF:FF:FF:FF broadcast MAC address, routers do not pass.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Directed broadcast:

A

Sent to anyone logically connected to the same network, regardless if it is physically behind the same router or not.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

IPv4 Private Addresses

A

RFC 1918 - Not routable on the Internet

  1. 0.0.0 10.255.255.255
  2. 16.0.0 172.31.255.255
  3. 168.0.0 192.168.255.255
  4. 0.0.0/8 Loopback IP’s
  5. 254.0.0/16 Link-Local
  6. 255.255.255 Broadcast
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

NAT (Network Address Translation)

A

Static NAT Translates 1-1, not practical.

Pool NAT Also still 1-1, but a pool was available to all clients not assigned to specific clients

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

PAT (Port Address Translation)

A

It uses IP and Port number. Also called One-to-Many or NAT Overload since it translates One public IP to Many private IP’s. This is what is used today.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Classful IP Networks

A

were used early on the Internet for public address networks were very large. It was very inefficient use of IP Addresses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

CIDR (Classless Inter-Domain Routing, also called slash notation)

A

it breaks our addresses into smaller logical segments, thus saving addresses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

IP Headers contain

A 
Version: IP v4
IHL: Length of the IP header
QoS (Quality of Service)
Id, Flags, Offset: used for IP fragmentation
TTL (Time to live): to prevent routing loops.
Protocol: Protocol number for TCP/UDP
Source/Destination IP Addresses
Optional: Options and padding
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

MTU (Maximum Transmission Unit)

A

normally 1500 bytes in Ethernet usage. If packet exceeds that size a router along the path may fragment into smaller packets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

IPv6

A

is 128bit in hexadecimal numbers (uses 0-9 and a-f). IPSec is built in, not bolted on like with IPv4.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

IPv6 MAC Address

A

It is a EUI-48 address we add “ffee” to convert for EUI-64. This is added to the middle of the EUI-48 address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

IPv6 Header contains

A 
Version: IP v6 (4bits)
Traffic Class/Priority (8bits)
Flow label/QoS management (20bits)
Payload length in bytes (16bits)
Next Header (8bits)
Time to live (TTL)/Hop Limit
Source IP add
Destination IP address
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

ARP

A

translates IP address into MAC addresses. OSI 2/3 layer. Is simple and trusting protocol, anyone can respond to an ARP request.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

ARP (cache) Poisoning

A

an attacker sends fake responses to ARP requests, often done repeatedly for critical AP entries (default gateway)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

RARP (Reverse ARP)

A

is used by diskless workstations to get IP’s.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

ICMP (Internet Control Message Protocol)

A

used to help IP, often used for troubleshooting. If we do not get a ping response it does not mean that it is down. Firewalls and routers can block ICMP replies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Traceroute

A

Uses ICMP to trace a network route. Sends message with TTL until it reaches the destination. Max 30 hops.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Telnet

A

remote access over a network. Uses TCP port 23 everything is transmitted in plaintext so it is easy to sniff

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

SSH (Secure Shell)

A

Designed to replace or add security to unsecure protocols Telnet, FTP, HTTP. CIA and NSA can decrypt SSH and SSL traffic/data. No longer secure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

FTP (File Transfer Protocol)

A

Transfer files to and from servers. No confidentiality or Integrity checks. Should not be used. Uses TCP port 21 for sending command/ control collection. Uses TCP port 20 for sending the data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

SFTP (SSH/Secure File Transfer Protocol)

A

Uses SSH to add security to FTP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

FTPS (FTP Secure)

A

Uses TLS and SSL to add security to FTP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

TFTP(Trivial FTP)

A

uses UDP port 69. No authentication or directory structure, files are written and read from one directory /tftpboot. Used for “Bootstrapping” - Downloading an OS over the network for diskless workstations. Used for saving router configuration.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

DNS (Domain Name System)

A

Translates server names into IP Address, uses TCP/UDP port 53. Uses UDP for most requests and natively has no authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

Authoritative name servers

A

The authority for a given name space

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

Recursive name server

A

Tries to resolve names it does not already know

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

Cache name server

A

Keeps previously resolved names in a temporary cache

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

DNS Poisoning

A

is similar to ARP poisoning, an attacker sends a fake address/name combo to another DNS server when asked and the server keeps it in its DNS record until it expires

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

DNSSEC (DNS Security Extensions)

A

Provides Authentication and Integrity using PKI Encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

SNMP (Simple Network Management Protocol)

A

Mostly used to monitor devices on our network (routers, switches, servers, HVAC, UPS) An SNMP client agent is enabled or installed on the client. SNMPv1/v2 send data in cleartext and should be avoided.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

SNMPv3

A

uses encryption to provide CIA. This should be the standard across any organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

HTTP (Hypertext Transfer Protocol)

A

Uses TCP port 80 (8008, 8080) unencrypted website data sent across the Internet

74
Q

HTTPS (HTTP Secure)

A

Uses TCP Port 443 (8443), encrypted data sent over the Internet

75
Q

HTML (Hypertext Markup Language)

A

The actual language webpages are written in.

76
Q

BOOTP (Bootstrap Protocol)

A

Used for diskless workstations, used to determine OS (downloaded with tftp) and IP address

77
Q

DHCP (Dynamic Host Config Protocol)

A

The common protocol we use to assign IP’s. DHCP process: Discovery, Offer, Request, Acknowledge

78
Q

Both BOOTP and DHCP

A

use UDP Port 67 for the BOOTP/DHCP Server and UDP 68 for the Client.

79
Q

EMI

A

Magnetism that can disrupt data availability and integrity.

80
Q

Crosstalk

A

is the signal crossing from one cable to another, this can be an confidentiality issue

81
Q

Attenuation

A

is the signal getting weaker the farther it travels.

82
Q

Cable UTP (Unshielded Twisted Pair)

A

Pairs of twisted pairs of cable.

83
Q

Cable STP (Shielded Twisted Pair)

A

Has extra metal mesh shielding around each pair of cables, making them less susceptible to EMI, but also making the cables thicket and more expensive.

84
Q

Coax (Coaxial) Cables

A

for cable TV and ISP

85
Q

Fiber Optic Cables

A

uses light to carry data. Distance has no attenuation like copper. Not susceptible to EMI.

86
Q

Single-Mode fiber

A

a single strand of fiber carries a single mode of light, used for long distance cables (Often used in IP-bakbones)

87
Q

Multi-mode fiber

A

uses multiple modes (light colors) to carry multiple data streams simultaneously, this is done with WDM (Wavelength Division Multiplexing)

88
Q

Cable/speed

A 
1Kbps (10^3)
1Mbps (10^6
1Gbps (10^9)
1Tbps (10^12)
1Pbps (10^15)
89
Q

CSMA (Carrier Sense Multiple Access)

A

Clients on a network check to see if the shared line is in use, if not they will not send their data.

90
Q

CSMA/CD (CSMA/Collision Detection)

A

Used for systems that can send and receive at the same time like Ethernet. If the line is clear the client sends and then waits a random amount of time while monitoring the network. They send a Jam signal to tell the other nodes to stop sending. Each switch port is its own collision domain.

91
Q

CSMA CA (CSMA/Collision Avoidance)

A

Used for systems that can either send or receive like wireless. On wireless clients are not aware that there is other wireless clients, only the Access Points is aware of other clients. If a lot of congestion the client can send a RTS (Request to Send), and if the AP replies with a CTS (Clear to Send), similar to a token, the client will transmit. The AP only issues a CTS to one node at a time.

92
Q

Star Topology

A

All nodes are connected to a central device. This is what we normally use for the ethernet, or nodes are connected to a switch.

93
Q

Partial Mesh

A

nodes are directly connected to all other nodes.

94
Q

Full Mesh

A

All nodes are directly connected to all other nodes. Often used in High Availability enviroments, with cluster servers for keepalives.

95
Q

WAN copper connections where attentuation is high for DSL

A

T1 (US): Dedicated 1,544 Mbps circuit. Often also called DS1
T3 (US): 28 bundled T1 lines, dedicated 44,736 circuit
E1 (EU): Dedicated 2,048 circuit
E3 (EU): 16 bundled E1 lines, dedicated 34,368 Mbps circuit.

96
Q

MPLS (Multiprotocol label switching

A

Often used to connect geographical distant locations of an org. w/MPLS VPN connections. Seems like one continuous seamless network. Directs data from one node to the next based on short path labels and not IP address. The labels id. virtual links/paths between distant nodes and not the endpoint. Encapsulates packets for other protocols/tech (T1/E1, ATM, Frame Relay, DSL). Can create end-to-end circuits across any type of transport medium, using any protocol. Operates in OSI “2.5”

97
Q

SDLC (Synchronus Data Link Control)

A

A synchronous L2 WAN protocol that uses polling (token passing) to transmit data. Uses NRM transmission only.

98
Q

HDLS (High-Level Data Link Control)

A

The successor to SDLC. Adds error correction and flow control, and two additional modes (ARM/ABM)

99
Q

SDLC NRM (Normal Response Mode)

A

Secondary nodes transmit when given permission by the primary only.

100
Q

HDLC ARM (Asynchronous Response Mode)

A

Secondary nodes my initiate communication with the primary node.

101
Q

HDLC ABM (Asynchronous Balanced Mode)

A

Most commonly used mode. When nodes act as primary or secondary, initiating transmission without receiving permission.

102
Q

DNP3 (Distributed Network Protocol)

A

A set of light weight comm protocols used btw components in process automation systems. Mainly used in utilitiessuch as elec/wtr companies. Used by SCADA for comm btw a Master Station (Cntrl Cntr) and Remote Terminal Units and Intelligent Electronic Devices.

103
Q

SAN (Storage Area Network)

A

protocols provide a cost-effective way to use existing network infra tech and protoc to connect servers to storage. A SAN allows block-level file access across a network, it acts liek an attached hard drive.

104
Q

FCoE (Fiber Channel over Ethernet)

A

Uses Ethernet, not TCP/IP, and because of that it is not routable.

105
Q

FCIP (Fiber Channel over IP)

A

Encapsulates fiber channel frames via TCP/IP

106
Q

VSAN (Virtual storage area network)

A

A collection of ports from a set of connected fiber channel switches, that form a virtual fabric.

107
Q

iSCSI (Internet Small Comp Sys Interface)

A

Leverages existing networking infrastructure and protocols to interface with storage. Uses higher layers TCP/IP for comm and can be routed. Can be used for storage across a WAN. Uses LUNS to provide addressing storage across the network.

108
Q

VoIP (Voice over IP)

A

A group of technologies for the delivery of voice comm and multimedia sessions over IP networks. The digital info is packetized, and transmitted using UDP IP packets over a packet-switched network. Audio/Video encoded with codecs. VoIP is used for VoIP phones, smartphoes, PC’s calls/texts can be sent over 3/4G or Wi-Fi. Needs real time error free connections.

109
Q

VoIP protocols

A

SIP (Session Initiation Protocol), H.323. If you see a transport protocol or control protocol its a safe bet its VoIP protocol.

110
Q

SDN (Software-defined networking)

A

Allows network administrators via software to initialize, cntrl, chg, mng network behavior dynamically.

111
Q

WLAN (Wireless LAN)

A

Are based on IEEE 802.11 standards. Usually referred to WiFi

112
Q

Rogue access points

A

An unauthorized access point that has been added to our network without our knowledge.

113
Q

Wi-Fi Jamming/Interference

A

Jamming is DOS attack. Interference can be addressed by changing channels or frequencies.

114
Q

Evil twin

A

rogue access point used to gain access to the network information that is being put through a network. Can compromise confidentiality and integrity.

115
Q

802.11 versions, frequency, range

A
  1. 11-1997: 2.4 GHz, 1,2 Mbits/s, 20m
  2. 11a: 3.7 GHz, 6,9,12,18,24,36,48,54 Mbits/s, 35m
  3. 11b: 2.4 GHz, 1,2,5.5,11 Mbits/s, 35m
  4. 11g: 2.4 GHz, 6,9,12,18,24,36,48,54 Mbits/s, 35m
  5. 11n: 2.4/5 GHz, Up to 150 Mbits/s, 70m
  6. 11ac: 5 GHz, Up to 866.7 Mbits/s, 35m
116
Q

802.11 Managed/Client mode:

A

Commonly used. Clients connect to an access point in managed mode, once connected, clients communicate with the access point only.

117
Q

802.11 Master/infrastructure mode:

A

The mode used by wireless access points.

118
Q

802.11 Ad-hoc mode

A

WNIC can interface with all other wireless nodes directly as long as they are on the same channel and SSID. A comp connected to the Internetvia a wired NIC my advertise an ad-hoc WLAN to allow Internet sharing.

119
Q

802.11 Monitor mode/ RFMON

A

WNIC can capture all traffic without having to be associated with the AP or Ad-hoc network first.

120
Q

SSID (Service Set ID)

A

name of the wireless AP you see when you connect.

121
Q

WEP (Wired Equivalent Privacy)

A

No longer secure, should not be used.

122
Q

WPA (WiFi Protected Access)

A

Vulnerable so should not be used unless WPA2 is not feasible. Uses RC4 and TKIP neither of which are secure.

123
Q

WPA2 also called RSN (Robust Security Network)

A

Current standard, the most secure form of WPA2 is WPA2-PSK using AES. Was found to have a vulnerability, but with a patch it is good to go.

124
Q

Bluetooth

A

wireless data exchanging over short distances using 2.4 GHz from fixed and mobiles devices, and building personal area networks (PANs). Class 1: 100m, 2: 10 m, 3: under 10m. Bluetooh implements confidentiality, authentication and key derivation with custom algorithms based on teh SAFER+block cipher. Bluetooth key generation is generally based on a Bluettoh PIN, which must be entered on one or both devices.

125
Q

Bluetooth attacks:

A

Bluejacking: Sending unsolicited messages over Bluetooh, most often harmless but annoying.
Bluesnarking: Unauthorized access of info from a Bluetooth device phones, desktop, laptops
Bluebugging: The attacker gain total access and cntrl of your device, it can happen when your device is left in discoverable mode. Only happens on old devices with old OS.

126
Q

Layer 1 devices

A

Repeaters, Hubs

127
Q

Layer 2 devices

A

Bridges are 2 port switches used to separate collision domains.
Switches are bridges with more than 2 ports. Each port is it’s own collision domain.

128
Q

MAC Sticky #

A

command to only allow that # of MAC to use the port.

129
Q

VLAN pruning for trunk ports

A

enable this command on ports between switches.

130
Q

VLAN is a broadcast domain that is partitioned and isolated at layer 2.

A

VLAN Trunks ports connecting two switches to span VLAN’s across them.

131
Q

Layer 3 Routers

A

Forward traffic based on source and destination IP’s and ports.

132
Q

Static route

A

a preconfigured route, always, send traffic there for a certain subnet.

133
Q

Default gateway

A

sends all non-local traffic to an ISP for instance

134
Q

Dynamic route

A

is learned from another routing via a routing protocol (OSPF, EIGRP, BGP, IS-IS)

135
Q

Metric

A

is used to determine the best route to a destination. Hop count

136
Q

Router Control Plane

A

the routing table that lists which route should be used to forwared a data packet, and through which physical interface connection

137
Q

Forwarding plane

A

The router forwards data packets between incoming and outgoing interface connections. It routes them to the correct network type using information that the packet header contains.

138
Q

All IGP (Interior Gateway Protocols)

A

rely on covergence to function right.

139
Q

Exterior Gateway Routing Protocol, BGP

A

typcially never converges because the Internet is too big for the changes to be communicated fast enough.

140
Q

Distance vector routing protocols

A

only focus on how far the dest is in Hops

141
Q

RIP (Routing Inf Protocol)

A

Uses UDP 520 for its transport protocol. HOP is the only metric it uses. No longer really used.

142
Q

Link-stating routing protocol

A

Each node independetnly runs an algorithm over the map to determine the shortest path from itself to every other node in the network.

143
Q

OSPF (Open Shortest Path First)

A

Used within a single routing domain, which is logically divided into areas. Converges on a new loop-free routing tables within seconds. Does not use UDP/TCP, but encapsulates the data directly in IP packets with protocol # 89.

144
Q

BGP (Border Gateway Protocol)

A

What the Internet uses. BGP routes between AS (Autonomous Systems) which are networks with multiple Internet connections. Considered a path vector routing protocol. Makes rouring decisions based on paths, network, policies, or rule-sets.

145
Q

1st gen: Packet filtering firewalls, OSI Layer 1-3

A

Packet filters act by inspecting the “packets” which are transferred between clients. Any packet that matches one of the Permits, is allowed to pass. If a packet does not match the packet filter set of filtering rules, the packet filter will drop the packet or reject it and send error responses to the source.

146
Q

2nd gen: Stateful filtering firewalls, OSI 1-4

A

Records all cxn passing through and determines whether a packet is the start of a new connection, a part of an existing cxn, or not a part of any cxn. Static rules are still used, these rules can now contain cxn state as one of their criteria. DOS attacks try to fill the cxn state memory by bombarding it with thousands of fake cxns.

147
Q

3rd gen: Application layer firewall, OSI Layer 7

A

These firewalls can understand certain applications and protocols. They see the entire packer, the packet isn’t decrypted until layer 6, any other firewall can only inspect the packet, but not the payload.

148
Q

Network firewall

A

filter traffic btw 2 or more networks, either software appliances running on general purpose hardware, or hardware-based firewall

149
Q

Proxy server

A

can act as a firewall by responding to input packets in the manner of an app, while blocking other packets. A proxy server is a gateway from one network to another for a specific application.

150
Q

Host-based firewalls

A

provide a layer of software security on one host that controls network traffic in and out of that single machine.

151
Q

Bastion host

A

is a special purpose hardened host desinged and configured to withstand attacks. Normally hosts a single app, all other services are removed or limited to reduce the threat to the host. It is placed either on the outside of the firewall or in the DMZ.

152
Q

Dual-homed host

A

host w/ two NICs, one connected to a trusted network, and the other connected to an untrusted network (Internet). It doesn’t route. No longer used, mostly used pre modern firewalls.

153
Q

Modem (Modulator/Demodulator)

A

still used today

154
Q

ADSL modem (asymmetric digital subscriber line)

A

TP telephone cable can carry signals with higher frequencies than the cable’s normal frequency rating. The signal drops the longer the cable (attenuation)

155
Q

Cable modems

A

use infrastructure originally inteded to carry television signals and therefore designed from teh outset to carry higher frequencies.

156
Q

DTE (Data terminal equipment)

A

An end devicde often a desktop or server. Not really used any longer.

157
Q

DCE

A

is often a modem, it sits between the data terminal equipment (DTE) and a data transmission circuit. Not really used any longer.

158
Q

PAP (Password Authentication Protocol)

A

Sends credentials in clear text. No longer used.

159
Q

802.1x defines the encapsulation of the EAP (Extensible Authentication Protocol)

A

802.1x auth involves 3 parites: a supplicant (client), an authenticator (network device, eg switch/AP), Authentication server (AS, RADIUS)

160
Q

EAP is widely used, in 802.11 (WiFi) the WPA and WPA2 stndrs

A

it was adopted with 100+ EAP Types as the official authentication mechanisms

161
Q

PEAP (Protected EAP)

A

A protocol that encaps EAP within a encrypted and authenticated TLS (Transport Layer Security) tunnel

162
Q

EAP-MD5

A

Very weak form of EAP. It offers server authn only not mutual authn. Vulnerable to man in the middle/pwd attck

163
Q

LEAP (Lightweight Extensible Authentication Protocol)

A

Cisco distr the protocol through the CCX as part of getting 802.1x and dynamic WEP adoption into the industry in the absence of a standard. No native support for LEAP in Win OS

164
Q

EAP-TLS (EAP-Transport Layer Security)

A

Uses PKI, requiring both server/client certs. Establishes secure TLS tunnel for authn. Secure,e expensive and complex

165
Q

EAP-TTLS (EAP Tunneled Transport Layer Security)

A

Simpler than EAP-TLS by dropping the client-side cert req, allowing other authn methods for client-side authentication.

166
Q

PANA (Protocol for Carrying Authentication for Network Access)

A

Allows a device to authenticate itself with a network to be granted access. EAP will be used for authn protocol, key dist, key agreement, key derivation protocols.

167
Q

SLIP (Serial Line Internet Protocol)

A

An encap of IP designed to work over serial ports and modem cxns. On PCs it has been replaced by PPP. On microcontrollers, SLIP is still the preferred way of encapsulating IP packets because of the very small overhead.

168
Q

PPP (Point to Point Protocol)

A

Used over many types of Physical networks including serial cable, phone line, turnk line, cell. PPP is also used over Internet access connections. ISPs have used PPP for customer dial-up access to the Internet.

169
Q

VPN (Virtual Private Network)

A

Extends a private network across a public network, and users can send and recieve data across shared or public networks as if they were on the private network. Created by est a virt point to point cxn through the use of dedicated cxns, virtual tunneling proto, traffic encryption. Get around geo-restrictions and censorship

170
Q

PPTP (Point to Point Tunneling Protocol)

A

Obsolete method for implementing VPN. Not used no built in encryp or authn

171
Q

L2TP (Layer 2 Tunneling Protocol)

A

Tunneling protocol used to support VPNs or as part of the delivery of services by ISPs. No built in encryp or confid, it relies on an encryp proto that it passes within the tunnel to provide priv.

172
Q

IPSec SA (Security Association)

A

Simplex one-way comm, can be used to negotiate ESP or AH parameters. If 2 sys use ESP to comm they need 2 total SA and ESP 4 total.

173
Q

IPSec ISAKMP (Internet Security and Key Management Proto)

A

manages the SA creation process.

174
Q

IPSec Tunnel mode

A

encrypts and authn the entire package (inc hdrs)

175
Q

IPSec Transport mode

A

only encryp and authn the payload, used for systems that speak ITSEC.

176
Q

IPSec IKE (Internet Key Exchange)

A

negotiates the algorithm selection proc to pick the highest and fastest level of security.

177
Q

VNC (Virtua Network Computing)

A

Non proprietary and can run on most OS’ for RDP, Helpdesk access.

178
Q

RDP (Remote Desktop Protocol)

A

MS proprietary proto server listens on TCP/UDP 3389.

179
Q

VDI Thin Clients

A

Diskless workstation Thin Client Apps use web browser.

180
Q

VDI Zero Clients

A

slimmer and more cost-effective than thin clients. Require no config and nothing is stored on them.

181
Q

WAP (Wireless App Proto)

A

used in early 2000’s when mobile devices could not handle full broswer w/HTML. WAP uses microbrowser instead and WML instead of XML.

182
Q

CDN (Content Dist Network)

A

Are geographically dispered network of proxy srvrs and data centers.

CISSP (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions