lesson 1

Question 1

what does a firewall do?

Answer 1

-ensures that all communication between a business’ network and the internet conforms to its’ security policy

Question 2

reference for security controls best practices

Answer 2

-iso 27002

Question 3

principle of least privilege

Answer 3

-giving as little access as possible to users, applications, and systems

Question 4

firewall best practices

Answer 4

• principle of least privilege
• regular risk assessments
• change management
• rule cleanup
• troubleshooting cleanup
• logging
• alerting
• patches, updates, and vulnerabilities
• secure remote management
• defer to company policy

Question 5

change management best practices

Answer 5

• changes are evaluated by stakeholders
• test before implementing
• have a backout plan
• document changes

Question 6

static packet filtering

Answer 6

-traditional firewall which controls traffic entering or exiting network interfaces

Question 7

static packet filtering implementations

Answer 7

• single host

- at a network gateway

Question 8

static packet filtering evaluates what header information?

Answer 8

• protocol
• source ip
• destination ip
• source tcp/udp port
• destination tcp/udp port

Question 9

static packet filtering pros and cons

Answer 9

• high performance

- low security as it cannot operate above the network layer (3)

Question 10

stateful packet inspection summary

Answer 10

• introduced by check point in 1994
• looks at a series of packets traveling in or out of a network by tracking the state and characteristics of network connections

Question 11

stateful packet inspection breakdown

Answer 11

• packets belonging to active connections are automatically allowed out of the network
• can use connection and protocol information to provide security above the networking layer (3)
• connections are tracked in a state table

Question 12

stateful packet inspection pros and cons

Answer 12

• better security

- requires more resources

Question 13

next generation firewall

Answer 13

• third generation of firewalls
• usually act as a network gateway
• can operate at the application layer (7)

Question 14

unified threat management (utm)

Answer 14

-the concept of having a single gateway device with a multitude of security controls

Question 15

utm features

Answer 15

• intrusion detection system (ids)
• intrusion prevention system (ips)
• inline antivirus
• data loss prevention (dlp)
• web proxy/web content filtering
• email filtering

Question 16

web application firewall (waf)

Answer 16

• used to protect web applications
• inspect http traffic
• can be considered a reverse proxy
• prevents: buffer overflows, cross site scripting (xss), sql injection (sqli)

Question 17

zero trust model

Answer 17

• removes the assumption of trust
• local traffic is monitored and secured the same as external traffic
• protects against lateral attacks