Exam Flashcards
1
Q
Class A IP
A
10.0.0.0 - 10.255.255.255
24 bits
2
Q
Class B IP
A
172.16.0.0 - 172.31.255.255
20 bits
2
Q
Class C IP
A
192.168.0.0 - 192.168.255.255
16 bits
2
Q
802.11a
A
5 GHz
54 Mbit/s
2
Q
802.11b
A
2.4 GHz
11 Mbit/s
better range than A, more frequency conflict
3
Q
802.11g
A
2.4 Ghz
- 54 Mbit/s
-backwards compatible with b
- frequency conflicts
3
Q
802.11n
A
- 5 GHz / 2.4
- 600 Mbit/s
-MIMO
4
Q
802.11ac
A
5 GHz
- up to 160 MHz
- increased channel bonding
faster data transfer
- MU-MIMO
- 6.9 Gbit/s
5
Q
802.11ax
A
wifi 5
- 5 GHz / 2.4 GHz
- 1201 megabits/s
- MU-MIMO
orthogonal frequency division
9.6 Gbit/s
6
Q
PRTG
A
a lightweight standalone tool which will allow the administrator to easily scan for IPs
7
Q
A server administrator is analyzing a normal Transmission Control Protocol (TCP) Teardown connection to their servers. How many FIN-WAIT states does the client go through during this process?
A
two
8
Q
Sender Policy Framework (SPF)
A
TXT-based record that lists IP addresses or names of servers that can send email from a particular domain and combats sending of span
9
Q
SRV (service record)
A
contains service name and port for a particular application
- locates VoIP or media servers
10
Q
MX record
A
identifies email server for the domain
- must have associated A or AAAA record, not point to CNAME
11
Q
What does ICANN manage?
A
generic top level domains, DNS
12
Q
recursive lookup
A
server queries other name servers until it finds requested record or times out
13
Q
iterative lookup
A
name server responds to query with either requested record or the address of a name server at lower level in hierarchy that is authoritative for the namespace
14
Q
one DHCP server for multiple subnets
A
- DHCP relay: forwarding DHCP traffics between subnets
- UDP forwarding: more general application of DHCP relay
15
Q
IMAP port
A
143
16
Q
SMTP
A
port 25
17
Q
SMTPS
A
587
18
Q
POP3 port
A
110
19
Q
POP3 SSL
A
995
20
Q
IMAP SSL
A
port 993
21
active FTP
client sends PORT command specifying chosen port and server opens data connection between that port and TCP port 20 on server
22
RTCP
session on each RTP stream that monitors the quality of the connection and provides reports that the network stacks can use to tune QoS parameters
23
SIP
- session initiation protocol
- end user devices such as IP-enabled handsets or client and server web conference software
24
Microsoft SQL server port
TCP 1433
- allows clients to connect to database server over network and allow replication traffic to move between database servers
25
WSD/Airprint
allows for secure connections to a print device and allows it to advertise service capabilities over the network, provides plug-and-play installation for Windows and iOS devices, and uses bidirectional status messaging.
26
SSL/TLS port
443
27
Telnet
port 23
28
SSH port
port 22
29
SYSLOG port
UDP 514
30
SNTP
- simple network time protocol
- UDP 123
- host that supports SNTP cannot act as time source for other hosts
31
Syslog alert, code 2
critical level
32
behavioral threat research
narrative commentary describing examples of attacks and the tactics, techniques, and procedures (TTPs) gathered through primary research sources.
33
reputational threat intelligence
consists of lists of IP addresses and domains associated with malicious behavior and signatures of known file-based malware
34
TACACS+
TCP 49
35
process assessment
involves identifying critical systems and assets that support mission essential functions
36
Bastion servers
hosts in perimeter and not fully trusted
- proxy and web
37
CPE
- customer premises equipment
- equipment owned, managed, and supported by the customer as it falls beyond the demarcation point.
38
CWDM
- coarse wavelength division multiplexing
- supports up to 16 wavelengths and typically deploys four or eight bidirectional channels over a single fiber strand.
39
WDM
- wavelength division multiplexing
- a means of using a strand to transmit or receive more than one channel at a time.
40
BiDi
- bidirectional
- support, transmit, and receive signals over the same strand of fiber. This uses WDM to transmit the transmit (Tx) and receive (Rx) signals over slightly shifted wavelengths.
41
DWDM
- dense wavelength division multiplexing
- provisions a greater number of channels (20, 40, 80, or 160). This means that there is much less spacing between each channel and requires more precise and expensive lasers.
42
cable crimper
creates a patch cord that fixes a plug to a cable. The tools are specific to the type of connector and cable, although some have modular dies supporting a range of RJ-type plugs. Many crimpers also come with cable stripping capabilities.
43
block tool
terminates a group of connectors in one action.
44
punchdown tool
terminates a fixed cable and fixes conductors into an IDC. There are different IDC formats (66, 110, BIX, and Krone) that require different blades.
45
APC
Angled Physical Contacts (APCs) make for an even tighter connection and better return loss performance. APCs cannot mix with PC faces or UPCs
46
UPC
the cable and connector are polished to a higher standard than with PC.
- ultra physical contact
47
PC (physical contact)
faces of the connector and fiber tip are polished so that they curve slightly and fit together better, reducing return loss
48
Demarcs
special types of equipment rooms marking the point at which external cabling (located outside the plant) joins to the internal cabling (located on the premises).
49
cladding
reflects signals back into the waveguide as efficiently as possible so that the light signal travels along the waveguide by multiple internal reflections.
50
stackable switches
switches can connect together and operate as a group. The sysadmin can manage the switch stack as a single unit.
51
NIC teaming/port aggregation
combines two or more separate cabled links into a single logical channel
52
IGRP
- interior gateway routing
- older routing protocol, which is classful. Classful routing protocols do not carry subnet masks.
53
RIPv2 (routing internet protocol)
dynamic routing protocol that supports classless addressing, required for both subnetting and supernetting. The Internet has shifted towards a hierarchical routing structure by reengineering classful schemes.
54
EIGRP
- enhanced interior gateway routing protocol
- dynamic routing protocol that supports classless addressing, required for both subnetting and supernetting. Routers at the top of the hierarchy need to store only the high-level network prefixes.
55
OSPF
- open shortest path first
- dynamic routing protocol that supports classless addressing, required for both subnetting and supernetting.
56
BGP (border gateway protocol)
a path vector type that is part of the Exterior Gateway Protocol (EGP) class and runs over Transmission Control Protocol (TCP) port 179.
57
SMB port
TCP 139
58
What is the lowest ANSI/TIA/EIA copper Ethernet cabling category available in the form of shielded/foiled twisted pair (S/FTP), and is often recommended for use in healthcare settings?
Cat 6a
59
Cat 6
support 10GBASE-T standard speeds at a distance of up to 180 ft. (55 m).
60
Cat 5e
supports a maximum speed of 1 Gbps at a maximum distance of up to 328 ft (100 m)
- 1000BASE-T
61
Cat 7
support 10GBASE-T standard speeds at a distance of up to 328 ft (100 m).
62
Cat 8
support speeds up to 40 Gbps up to 100 ft (30 m)
- 40GBASE-T
63
Straight tip (ST)
early bayonet-style connector with a twist-and-push locking mechanism. ST was primarily used for multimode networks, however, it is no longer routinely utilized in Ethernet deployments.
64
MTRJ
a small-form-factor duplex connector with a snap-in design that is used in multimode networks.
65
Local Connector (LC)
small-form-factor connector with a push/pull tabbed design. The LC form factor is commonly used for Gigabit Ethernet and 10/40 GbE.
66
Subscriber Connector (SC)
a push/pull connector that allows for easy insertion and removal. It may be utilized in either single-mode or multimode mode. It is frequently used in Gigabit Ethernet
67
WPA3
the Simultaneous Authentication of Equals (SAE) protocol replaces the 4-way handshake, which has been found to be vulnerable to various attacks.
68
WEP
old protocol that is no longer safe to use, though it does not use the SAE protocol. WEP uses an outdated RC4 stream cipher to encrypt traffic.
69
WPA
designed to fix critical vulnerabilities in the earlier wired equivalent privacy (WEP) standard.
70
WPA2
pre-shared key (PSK) authentication uses a passphrase to generate the key that is used to encrypt communications. It is also referred to as group authentication because a group of users share the same secret.
71
latency
the time it takes for a transmission to reach the recipient, measured in milliseconds (ms)
72
jitter
a variation in the delay. Jitter manifests itself as an inconsistent rate of packet delivery.
73
implicit TLS protocol
SMTPS
- establishes the secure connection before any SMTP commands (HELO, for instance) are exchanged. This is also referred to as implicit TLS and only represents encryption at the level of the transport layer.
74
STARTTLS
command that upgrades an existing unsecure connection to TLS. This is also referred to as explicit TLS or opportunistic TLS and only represents encryption at the level of the transport layer.
75
ipV6 interface ID
last 64 digits
76
TCP SYN (-sS) scan
- appropriate for half-open scan
- technique is faster as the scanning host sends a SYN packet to request a connection but does not complete the handshake. This method is typically used for stealthier scans, as it is less likely to be logged.
77
TCP connect (-sT) scan
- complete three-way handshakes
- more visible in logs, not half-open
78
active TAP
a powered device that performs signal regeneration and can capture all packets.
79
passive TAP
an unpowered device that physically copies the signal from the cabling to a monitor port. The monitor port will receive every frame, however, signal regeneration is not performed.
80
Switched Port Analyzer (SPAN)
also known as port mirroring or port monitoring, allows the capture of network data as it flows through a network switch. Corrupt frames are dropped.
81
The control plane
The network makes decisions about how traffic should be prioritized and where it should be switched, which, in turn, keeps the network itself operational.
82
The management plane
comprises traffic that allows remote administration and monitoring of network appliances, such as SSH, SNMP, NetFlow, and syslog. Management traffic is typically directed to the appliance's loopback address.
83
Recovery Point Objective (RPO)
the amount of data loss that a system can sustain, measured in time units.
84
Maximum Tolerable Downtime (MTD)
states the requirement for a business function. Downtime is calculated from the sum of scheduled service intervals (Agreed Service Time) plus unplanned outages over the period.
85
RTO (recovery time objective)
the period following a disaster that an individual IT system may remain offline
86
reverse proxy server
provides for protocol-specific inbound traffic. Reverse proxies can publish applications from the corporate network to the Internet in this way.
87
forwarding proxy server
provides for protocol-specific outbound traffic. A multipurpose forward proxy is one configured with filters for multiple protocol types, such as HTTP, FTP, and SMTP.
88
nontransparent proxy server
the client must be configured with the proxy server address and port number to use it.
89
transparent proxy server
- AKA forced/intercepting
- intercepts client traffic without the client having to be reconfigured. A transparent proxy must be implemented on a switch or router or other inline network appliance
90
spanning tree protocol (STP)
allows bridges or switches to organize themselves into a hierarchy. Each switch determines the shortest path to the root bridge by exchanging information with other switches. STP information is packaged as bridge protocol data unit (BPDU) multicast frames
91
Neighbor Discovery (ND)
performs some of the functions on an IPv6 network that ARP and ICMP perform under IPv4, such as address autoconfiguration, redirection, prefix discovery, and local address resolution.
92
ARP protocol
task of resolving an IP address to a hardware address.
93
trunk port
carries all the VLAN-to-VLAN traffic that must be routed
94
stub resolver
- acts as an intermediary between the application requiring DNS resolution and a recursive DNS resolver.
- function of a resolver is to perform recursive queries in response to requests from client systems
95
recursive DNS name servers
rely on authoritative DNS nameservers to tell them where to find certain domains.
96
root name server
a name server that manages the root zone of the Internet's Domain Name System. It directly responds to queries for root zone records and returns a list of authoritative name servers for the relevant top-level domain for all other requests.
97
split tunnel VPN
client accesses the Internet directly using its "native" IP configuration and DNS servers
98
full tunnel VPN
Internet access is mediated by the corporate network, which will alter the client's IP address and DNS servers and may use a proxy.
99
access/edge layer
allows end-user devices, such as computers, printers, and smartphones to connect to the network.
100
distribution/aggregation layer
offers fault-tolerant linkages between distinct access blocks and either the core or other distribution blocks.
101
core layer
provides a highly available network backbone. Routers or layer 3 switches in the core layer form a complete mesh topology with distribution layer switches
102
Common Address Redundancy Protocol (CARP)
enables multiple hosts to share an IP address on the same network segment so that they can act as a default gateway.
103
Virtual Router Redundancy Protocol (VRRP)
allows the automatic assignment of IP routers to act as a default gateway on a single subnet.
104
Hot Standby Router Protocol (HSRP)
allows multiple physical routers to serve as a single default gateway for a subnet, but it is a proprietary protocol developed by Cisco.
105
At what layer of the OSI model are all hosts identified by a specific MAC address?
Data link layer
106
bridge
connects different networks and treats them as if they were one network
107
Data Link layer
transfers data between nodes on the same logical segment
- ARP tables located here
- bridges
108
ethernet header
encapsulates onto a packet at the data link layer
109
IP header
provides logical addressing and packet forwarding between different networks
- wraps TCP segment at network layer
110
mGRE (multipoint generic routing encapsulation)
version of GRE protocol that supports point-to-multipoint links, such as hub and spoke dynamic VPN
111
Multiprotocol label switching (MPLS)
operates as overlay network to configure point-to-point or point-to-multipoint links between nodes
112
NFV (network function virtualization)
provisions virtual network appliances such as switches, routers, and firewalls
113
logical bus topology
nodes receive the data transmitted all at the same time, regardless of physical wiring layout of the network
114
ad hoc topology
wireless adapter allows connections to and from other devices, AKA IBSS
115
physical network topology
describes placement of nodes and how they are connected by the network media
116
logical network topology
describes flow of data through the network regardless of its physical layout
117
leased line
dedicated T1 or DS1 digital signal circuit
118
twinaxial
or data center 10 GbE (unofficially referred to as 10GBASE-CR) and 40 GbE (40GBASE-CR4) interconnections of up to about 5 meters for passive cable types and 10 meters for active cable types
119
SQLnet port
TCP 1521
120
MySQL port
TCP 3306
121
Trap command
used when agent informs monitor of a notable event, such as port failure
122
Get command
used for software to query the agent for a single object identifier
123
Yagi antenna
unidirectional signal for point-to-point wireless bridge connections
- common for outdoor use and long distances
124
static dish antenna
parabolic or dome shaped antenna that is unidirectional
- expensive
125
torus antenna
donut shaped
- similar to round wireless routers businesses mount in office ceiling
- not good for outdoors
126
parabolic grid antenna
- dome with rectangular feature with grid-like openings
- expensive up-front and maintenance
127
independent basic service set (IBSS)
ad hoc topology where the wireless adapter allows connections to and from other wireless devices
128
SNMP trap
agent that informs the SNMP monitor of a notable event
- sysadmin can set threshold for triggering traps for each value
129
giant
frame that is larger than the max permissible size (1518 bytes)
130
runt
frame smaller than minimum size (64 bytes for ethernet)
- collision usually causes them
131
baseline
snapshot of a known good configuration and how a device operates at that known good configuration
132
link state
measures whether an interface is working or not
- configure link state of a given port on a switch or router to turn it on or off
133
NetFlow
packet analyzer that can measure network traffic statistics
134
bandwidth
total capacity to process network traffic
135
Memorandum of understanding (MOU)
prelim or exploratory agreement to express an intent to work together
136
floor plan
detailed diagram of wiring and port locations
137
rack diagram
records position of each appliance in the rack
138
wiring diagram
shows detailed info about termination of twisted pairs in RJ-45 or RJ-48C jack or IDC
139
site survey
critical planning tool to ensure WLAN delivers acceptable data rates to supported number of devices in physical locations
140
IDFs
intermediate distribution frames
- provide termination for access layer switches that serve a given area
- essential for distributing network connections from the MDF to specific locations or devices within a facility, ensuring comprehensive network access and efficiency in communication flow
141
MDF
- main distribution frame
- location for distribution/core level internal switching
- serves as location for termination of external WAN circuits
142
mean time between failures
- total operational time divided by number of failures
- KPI measuring expected lifetime of a product
143
Mean time to repair (MTTR)
mean time it takes to correct fault to point of restoration and recovery of network services
- KPI
144
Maximum tolerable downtime (MTD)
states requirement for a business function, used to measure level of high availability
145
cold site
- takes longer to setup
- may be an empty building with a lease agreement in place to install whatever equipment the company requires when necessary
146
hot site
can failover almost immediately
- site is already within organization's ownership and is ready to deploy
147
warm site
requirement that latest data set will need to be loaded
148
Cluster
group of servers, each known as node, that provides redundancy and fault tolerance for critical applications
149
IEEE 802.1X standard
defines a PNAC mechanism, which means that the switch/router performs some sort of authentication of the attached device before activating the port
150
PNAC
- port based network access control
- switch/router performs type of authentication of attached device before activating port
151
TACACS+
authenticates admin access to routers and switches
- TCP port 49
152
RADIUS
used in VPN implementation, manages remote and wireless authentication infrastructures
153
on-path attack
form of eavesdropping where attacker makes an independent connection between two victims and steals information to use fraudulently
154
deauthentication attack
sends a stream of spoofed de-auth frames to cause a client to deauthenticate from the AP
155
DNS poisoning
compromises name resolution, redirects users to fraudulent sites
156
ARP poisoning
attacker redirects IP address to MAC address of a computer that is not the intended recipient
157
war driving
practice of using wifi sniffer to detect WLANs and then either using unsecured ones or trying to break into them with WEP and WPA cracking tools
158
DRDoS attack
- distributed reflection denial of service
- adversary spoofs the victim's IP address and attempts to open connections with servers which direct responses to the victim server, rapidly consuming bandwidth
159
amplification attack
attacker implements an amplification factor and dramatically increases the bandwidth sent to a victim during DDoS attack
160
logic bomb
malicious program or script set to run under particular circumstances
161
pharming
means of redirecting users from legitimate website to malicious one
- corrupts the way the computer performs internet name resolution
162
crypto-malware
ransomware that encrypts data files and user is unable to access files without obtaining the private encryption key
163
extensible authentication protocol
access point that can implement a similar port-security mechanism to switches
- allows for device authentication using digital certificates
164
SNMP version 3
supports encryption of data logs as they travel over the network to a target system like an analytics server
165
private VLAN
applies an additional layer of segmentation by restricting the ability of hosts within a VLAN to communicate directly with one another
166
control plane policing
policy that is designed to mitigate the risk from route processor vulnerabilities
167
DHCP snooping
causes switch to inspect DHCP traffic arriving on access ports to ensure host is not trying to spoof its MAC address
- can be. used to prevent rogue DHCP servers from operating on the network
168
out of band management
allows access to the network when the network is down
- can be used to remotely reboot devices
169
AUX port
designed to connect an analog modem and provide remote access over a dial-up link
170
management port
configuring virtual network interface and IP address on the device to use for management functions and connecting to it via one of the normal ethernet ports
171
transport mode
used to secure communication between hosts on a private network
172
tunnel mode
used for communication between VPN gateways across an unsecured network
173
full tunnel
allows internet access that is mediated by the corporate network that will alter client's IP address and DNS servers may use proxy
174
IPSec
used to secure IPv4/6 communications on local networks and as remote access protocol
175
encapsulating security payload (ESP)
provides confidentiality, IA, used to encrypt packet rather than simply calculating a hash
- attaches three fields to the packet, header, trailer, and integrity check
176
Authentication header protocol
performs a cryptographic hash on the whole packet, including IP header
177
cable certifier
used to verify that a cable meets its specifications such as bandwidth and frequency
178
punchdown tool
assist in inserting wires into patch panels or punch down blocks
179
loopback plug
connector used for diagnosing transmission problems on parallel and serial ports
180
short
happens when two conductors join, usually because insulating wire is damaged or poorly wired connector
181
fusion splicer
joins two fiber optic cables together by performing a precise alignment between the two strands and then permanently joining them
182
cable crimper
creates a patch cord and fixes a plug to a cable
- RJ-45 connector to an ethernet cable
183
optical time-domain reflectometer
locates breaks in fiber by sending light pulses down the cable and timing how long it takes for any reflections to bounce back from the break
184
multimeter
testing electrical circuits
185
cable tester
reports detailed info on cable's physical and electrical properties, including crosstalk, attenuation, noise, and resistance
186
optical spectrum analyzer (OSA)
ensure each channel has sufficient power
187
command that displays NetFlow accounting statistics
show ip cache flow
188
command that displays status and stats for NetFlow accounting data export
show ip flow-export
189
command that gives network performance utility that can generate TCP and UDP traffic to test bandwidth, latency, and packet loss
command that displays NetFlow IP entries
190
packet sniffer
interrogate frames received by a network adapter using a special driver
- read packets on a port and save the information to a file on disk
191
packet/protocol analyzer
software used in conjunction with packet sniffer
- used later to examine data gathered from packet sniffer
192
tcpdump command-line
common packet analyzer used to display contents of .pcap files
193
Nmap
highly adaptable, open-source network/port scanner used to scan hosts/ports to locate services and detect vulnerabilities
194
OUTPUT chain
firewall ruleset for outgoing connections
195
INPUT chain
firewall ruleset for incoming connections
196
FORWARD chain
firewall ruleset for connections passing through server
197
PREROUTING chain
handled packets that have just arrived and determines via priority how to handle the packets depending on whether it is used for local processing or forwarding
- processed first before other chains
198
Netcat
utility tool that uses TCP/UDP connections to read and write in a network
- used for both attacking and security
199
IPAM service
- internet protocol address management
- scans DHCP and DNS servers and logs IP address usage to database
- can be used to remotely manage and reconfigure DHCP and DNS server
200
iptables command
used to edit rules enforced by Linux kernel firewall
201
polarization
refers to the orientation of the wave propagating from the antenna to maximize signal strength
202
CATV
cable access TV
203
HFC
hybrid fiber coax
- combine with fiber optic core network with coax links to CPE
204
top-of-rack switch model
switch models designed to provide high-speed connectivity to a rack of server appliances
205
IGP
- interior gateway protocol
- identifies routes WITHIN an AS
206
EGP
- exterior gateway protocol
- identifies routes BETWEEN autonomous systems
207
what are coaxial cable terminated using?
F type connectors
208
basic service set
AP mediates communications between client devices and can also provide a bridge to a cabled network segment
209
North-South
traffic that enters or leaves the data center from a system physically residing outside the datacenter
- North = exiting
- South = entering
210
East-West Traffic
data flow within a datacenter. For example, if we are using a spine and leaf architecture, any data flow between the various servers in the datacenter, even if it goes between different leaves, would be considered east-west traffic
