Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Firewalls > Firewall [midtem] > Flashcards

Firewall [midtem] Flashcards

1
Q

controls traffic entering/exiting network interfaces
scans only 1 packet at a time
scans (protocol,src/dest IP address & TCP/UDP port)
low security - no scans above Layer 3 OSI (network)
high performance and scalebility
router at internet edge to filter out noise for firewalls

A

STATIC PACKET FILTERING

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

series of packets in/out of network
tracks state & characteristics of network connections connections tracked via state table
extra security (NAT & VPN)
new packets are compared to the state table
better security (scans Layer 3 and UP)
high performance, transparency & extensibility
state table can automatically adjust firewall
dynamic

A

STATEFUL PACKET INSPECTION (SPI)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

network gateway between networks or security zones
does the same as SPI & SPF firewalls + more!
operates on Layer 7 with application awareness
filter based off apps, protocols and users (LDAP & AD)
very expensive $$$$
resource heavy (depending on security ft enabled)
single gateway device + security controls = Unified Threat Management (UTM)

A

Next Generation Firewall (NGFW) (third-gen)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

firewall feature that is based on patterns or signatures…

A

Intrusion Detection System (IDS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

can reset or block connections based on patterns and signatures that perform malicious activities

A

Intrusion Prevention System (IPS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

inspects files travelling over the firewall for virus signatures, can detect and block malware BEFORE downloaded

A

Inline Antivirus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

detects and blocks specific data structures from being exported

A

Data Loss Prevention (DLP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

block based on predetermined web site categorization (porn)

A

Web Proxy | Web Content Filtering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

gateway placed before SMTP server for extra filtering

A

Email Filtering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q
  • protects web applications
    • inspects HTTP traffic going to and from web apps
    • prevents attacks i.e: buffer overflows, cross site scripting (XSS) *token hi-jacking and SQL injection (SQLi) *injection attacks should not exist if setup correctly!
    • sometimes a reverse proxy
    • a proxy will sit between webserver and internet
A

Web Application Firewall (WAF)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q
  • scans traffic flowing North South
    • does not protect network from attacks originating from within network!
    • analogous with trust but verify
A

Perimeter-Centric Approach

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q
  • removes assumption of trust and inspects all possible traffic
    • made up of user and application identification
    • content scanning to move trust boundary as close to resource as possible
    • scans traffic in all directions North, South, East & West
    • never trust!, always verify!
    • protects internal network from lateral attacks
A

Zero Trust Security Model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

connection-oriented
Connections start with 3-way handshake
connections end with session being terminated

A

Transmission Control Protocol (TCP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q
  • client sends server SYN packet to synchronize sequence numbers
    • server responds with synchronization acknowledge, or SYN/ACK
    • client sends acknowledge (ACK), and TCP connection is established
    • data is now interchangeable between server & client
    • SYN/ACK flags are contained IN the TCP header
A

TCP 3-Way Handshake

SYN—->
ACK

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

client sends FIN-ACK packet
server responds FIN-ACK
client responds final ACK packet

A

TCP Connection Termination

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q
  • are large port numbers(#) for clients source port(s)
    • chosen at random!
    • 49152-65535 recommended port range via IANA
A

Ephemeral Source Port

17
Q 
LISTEN (linux) 
LISTENING (windows) 
------------------------------------
ESTABLISHED 
--------------------------------------
TIME-WAIT
A

TCP Connection States

18
Q

Domain
Private
Public

A

Windows Firewall profiles

19
Q

you can use __________________ to detect profile and enable rules based on profile….

A

Application Programming Interface (API)

20
Q

if you want to secure devices even more when on public network you can use ___________

A

Group Policy Object (GPO)

21
Q

• packet filtering framework on Linux kernel with;

	i. Stateless packet filtering 
	ii. Stateful packet filtering 
	iii. Network Address Translation (NAT) 
	iv. Port Address Translation (PAT)
A

Netfilter

22
Q

code that handles intercepted function calls events or messages passed between the software components

A

Hook

23
Q

standard firewall in Linux

configure view tables of packet filter rules

A

IPtables

+ nftables (modern varient)

24
Q

i. packet protocol type
ii. source address
iii. destination address
iv. source port
v. destination port
vi. network interface being used
vii. relation to previous packets

A

IPtable definable Rules

25
Q

ACCEPT, DROP, RETURN

A

TARGET functions

26
Q

IPtables and rules are organized into….

A

CHAINS

27
Q

Packets are checked against chains how….

A

Sequentially

28
Q

3 default chains….

A

INPUT, OUTPUT, FORWARD

29
Q

RFC 1918

A
  1. 0.0.0-10.255.255.255
  2. 16.0.0-172.31.255.255
  3. 168.0.0-192.168.255.255
30
Q

modifies network address in IP Headers of packets

A

NAT

31
Q

DHCP Request Process

A

Discover port:67 (client)
Offer port:68 (server)
Request (client)
Acknowledge (server)

32
Q

maintain distinct rule-set for each traffic flow (ingress and egress)
security zones common practice for enterprise solutions

A

Firewall Inspection

33
Q

Block ALL incoming traffic by default….

A

sudo iptables -p INPUT DROP

34
Q

Open port 22 to be reached ONLY by 172.16.200.100

A

sudo iptables -I INPUT 2 TCP –dport 22 -s172.16.200.100 -j ACCEPT

35
Q

Which command removes a config file for SSH?

A

sudo rm -f /etc/ssh/sshd_not_to_be_run

36
Q

Which command will allow packets of existing outbound connections to be allowed back in WITHOUT being dropped?

A

sudo iptables -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT

37
Q

IPtables uses a set of _____ which have _____ that contain set of built-in or user defined _____

A

tables - chains - rules

Firewalls (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions