Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Network+ > Lesson 19: Applying Network Hardening Techniques > Flashcards

Lesson 19: Applying Network Hardening Techniques Flashcards

1
Q

Define enumeration

A

The process of extracting user names, machine names, network resources, shares and services from a system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are two types of enumeration attacks?

A
  1. Footprinting
  2. Fingerprinting
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Define footprinting enumeration

A

Bad actor discovery tactic detecting topology and infrastructure to find indicators of compromise.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Define fingerprinting enumeration

A

Bad actor discovery tactic detecting software, network protocols, operating systems, or hardware devices on the network to find indicators of compromise.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the basic definition of a spoofing attack?

A

Attack technique where the threat actor disguises their identity or impersonates another user or resource.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are different types of spoofing attacks?

A
  1. Phishing/Pharming
  2. Packet/protocol spoofing (ARP/DNS/IP/MAC)
  3. Man-in-the-Middle (MitM); On-path attack
  4. Rouge DHCP
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Define a denial of service (DoS) attack

A

Deliberate attempt to make a website/application or network unavailable to users, by flooding it with network traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the typical effects of a denial of service (DoS) attack?

A

1 . Resource exhaustion (CPU/RAM/etc.)
2. exploit vulnerabilities in application software/hardware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How can a denial of service (DoS) attack be manipulated?

A

A blinding attack using DoS to divert attention and resources from the real target

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the new term for a Man-in-the-Middle (MitM) attack?

A

On-path attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Define an on-path (Man-in-the-middle) attack

A

Attacker relays and possibly alters the communications between two parties.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Define the process of MAC/IP spoofing

A

Altering the MAC/IP address of their device to mimic that of a legitimate device present on the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the role of IP spoofing in a denial of service (DoS) attack?

A

To mask the origin of the attack and make it harder for the target system to block packets from the attacking system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Define ARP spoofing

A

Bad actor sends fake ARP packets that link an attacker’s MAC address with an IP of a computer already on the LAN.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Define ARP poisoning

A

After a successful ARP spoofing, a hacker changes the company’s ARP table, so it contains falsified MAC maps.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a potential cause of an ARP poisoning attack directed at a default gateway?

A

All traffic destined for remote networks will be sent to the attacker.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Define a rouge DHCP server and its function

A

Attacker sets their machine as the subnets default gateway or DNS server to intercept traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Define DNS poisoning and its purpose

A

Attack where a threat actor injects false resource records into a client or server cache to redirect a domain name to an IP address of the attacker’s choosing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Define VLAN hopping

A

Exploiting a misconfiguration to direct traffic to a different VLAN without authorization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How is VLAN hopping performed?

A

Attacker crafts a frame with two VLAN tag headers. The first trunk switch to inspect the frame strips the first header, and the frame gets forwarded to the target VLAN.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is another way to perform VLAN tagging

A

Attaching a device that spoofs the operation of a switch to the network and negotiating the creation of a trunk port. As a trunk port, the attacker’s device will receive all inter-VLAN traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is one way VLAN tagging be mitigated?

A

Ensuring that the native VLAN uses a different ID compared to any user accessible VLAN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is another way VLAN tagging can be mitigated?

A

Ensuring that trunk ports are pre-determined in the switch configuration and that access ports are not allowed to auto-configure as trunk ports.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Define a rouge access point

A

One that has been installed on the network without authorization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Define an evil twin

A

A rogue AP masquerading as a legitimate AP deceiving users into believing that it is a legitimate network access point.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is the purpose/function of an evil twin AP?

A

To harvest authentication information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is a method to prevent a rouge AP?

A

Using EAP-TLS security authentication server and clients perform mutual authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What network/security appliances can detect rouge APs?

A

Wireless intrusion detection system (WIDS) or wireless intrusion prevention system (WIPS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Define a deauthentication attack

A

Type of denial-of-service attack that targets communication between a client and AP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

How can deauthentication attacks be mitigated?

A

The wireless infrastructure supports Management Frame Protection - AP and clients must both support the MFP protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Define a distributed DoS (DDoS) attack

A

Involves the use of infected Internet-connected computers and devices to disrupt the normal flow of traffic to a server or service by overwhelming the target with traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Define a SYN flood attack

A

Type pf DDoS attack that exploits the 3-way handshake by flooding the target with SYN connection request packets with fake IPs causing the server to temporarily maintain a new open port connection for a certain length of time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Define a botnet

A

Group of hosts or devices that have been infected by a control program called a bot that enables attackers to exploit the hosts to mount attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

How is a botnet created?

A

A threat actor will first compromise one or two machines to use as handlers; handlers are used to compromise a number of zombie hosts with DoS tools create the botnet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Once a botnet is created, what is the network between the bots and the handler defined as?

A

command and control (C-and-C or C2) network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is the basic definition of malware?

A

Software that serves a malicious purpose, typically installed without the user’s consent/knowledge.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What are different types of malware?

A
  1. Viruses/worms
  2. Trojans
  3. Potentially unwanted programs (PUPs)/Potentially unwanted applications (PUAs)
  4. Ransomeware
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Define a trojan malware

A

Malware concealed within an installer package for software that appears to be legitimate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Define a Potentially unwanted programs (PUPs)/Potentially unwanted applications (PUAs)

A

Software installed alongside a package selected by the user or perhaps bundled with a new computer system.

40
Q

Define a payload in the context of malware

A

An action performed by the malware other than simply replicating or persisting on a host

41
Q

What are some of the different payloads delivered by malware?

A

Spyware, rootkit, remote access Trojan (RAT) or backdoor, and ransomware

42
Q

Define ransomware and its purpose

A

Malware that tries to extort money from the victim by encrypting the victim’s files and demanding payment.

43
Q

Define a dictionary password attack

A

Compares encrypted password hash values against a predetermined list of possible password values.

44
Q

Define a brute force password attack

A

An attacker uses an application to exhaustively try every possible alphanumeric combination to crack encrypted passwords.

45
Q

How can passwords be intercepted on a network?

A

If a protocol uses cleartext credentials, sniffing the network for the weak protocol can produce unencrypted passwords.

46
Q

Define social engineering and its purpose

A

Use deception and trickery to convince unsuspecting users to provide sensitive data or to violate security guidelines.

47
Q

Define a phishing attack

A

A combination of social engineering and spoofing in which the attacker sends email from a supposedly reputable source, to try to obtain sensitive information or install malicious software.

48
Q

Define shoulder surfing

A

Social engineering tactic to obtain someone’s password or PIN by observing a person as they type it in.

49
Q

Define tailgating

A

Social engineering technique to gain access to a building by following someone who is unaware of their presence.

50
Q

Define piggybacking

A

Social engineering tactic when the attacker convinces an employee to allow them to enter into a secure area.

51
Q

Define device hardening

A

Process of making a host or app configuration secure by reducing its attack surface, through running only necessary services, installing monitoring software to protect against malware and intrusions, and establishing a patching schedule.

52
Q

List the common hardening policies/tactics

A
  1. Change default passwords
  2. Enforce password complexity/length
  3. Role-based access
  4. Uninstall unneeded services
  5. Disable unsecure/unneeded protocols
53
Q

What is the suggested password length?

A

8 characters for user passwords, 14 characters for service accounts.

54
Q

Define MAC filtering and its purpose

A

Applying an access control list to a switch or access point so that only clients with approved MAC addresses can connect to it.

55
Q

What switch configuration helps prevent ARP poisioning?

A

Dynamic ARP inspection (DAI)

56
Q

What switch configuration helps prevent spoofing of the switch’s MAC as well as rouge DHCP servers?

A

DHCP Snooping

57
Q

How does DHCP snooping funciton?

A

Inspects DHCP traffic to only trust DHCP offers from trusted ports and blocks untrusted DHCP offers from unauthorized sources.

58
Q

As Dynamic ARP Inspection (DAI) and DHCP Snooping are to IPv4, what is their equivalent in IPv6?

A

Neighbor Discovery (ND) Inspection and Router Advertisement (RA) Guard.

59
Q

Define Port-Based Network Access Control (PNAC)

A

The switch performs some sort of authentication of the attached device before activating the port.

60
Q

How does Port-Based Network Access Control (PNAC) perform authentication?

A

The device requesting access is the supplicant, the switch, referred to as the authenticator, enables the Extensible Authentication Protocol over LAN (EAPoL) protocol only and waits for the device to supply authentication data, the authenticator passes this data to an authenticating server

61
Q

Once access it granted when Port-Based Network Access Control (PNAC) is enabled, how does the switch allow network access?

A

Configure the port to use the appropriate VLAN and enable it for ordinary network traffic

62
Q

If access is denied when Port-Based Network Access Control (PNAC) is enabled, how does the switch configured network access?

A

Unauthenticated hosts may be denied any type of access or be placed in a guest VLAN with only limited access to the rest of the network.

63
Q

Define a virtual LAN (VLAN) and its purpose

A

A VLAN isolates Layer 2 broadcast traffic to switch ports that are configured with the same VLAN ID; Deployed to enforce segmentation policies by mapping each VLAN ID to a subnet forcing a router of L3 switch to forward traffic between VLANs.

64
Q

Define a private VLAN (PVLAN) and its purpose

A

Method of isolating hosts to prevent hosts within the same VLAN from communicating directly.

65
Q

How is a primary VLAN referred to as when configuring a private VLAN (PVLAN)?

A

The “host” VLAN is referred to as the primary VLAN.

66
Q

What are the 3 different port configurations when configuring the primary of a private VLAN (PVLAN)?

A
  1. Promiscuous port
  2. Isolated port
  3. Community port
67
Q

What is the function/purpose of a promiscuous port?

A

Can communicate with all ports in all domains within the PVLAN. This is normally the port through which routed and/or DHCP traffic is sent.

68
Q

What is the function/purpose of a isolated port?

A

Can communicate with the promiscuous port only. This creates a subdomain of a single host only. The PVLAN can contain multiple isolated ports, but each is in its own subdomain.

69
Q

What is the function/purpose of a community port?

A

Can communicate with the promiscuous port and with other ports in the same community. This creates a subdomain that can contain multiple hosts.

70
Q

Define a default VLAN

A

Default VLAN ID (1) for all unconfigured switch ports, and unless configured, all switch ports belong to the default VLAN

71
Q

What is best practice for the default VLAN?

A

Avoid sending user data traffic over the default VLAN. It should remain unused or used only for inter-switch protocol traffic, where necessary.

72
Q

Define a native VLAN

A

VLAN ID used for any untagged frames received on a trunk port.

73
Q

Define the purpose of a native VLAN

A

When a switch receives an untagged frame over a trunk, it assigns the frame to the native VLAN.

74
Q

What is best practice for the native VLAN?

A

The same ID should be used on both ends of the trunk and the ID should not be left as the default VLAN ID (1).

75
Q

How are the rules process in an access control list (ACL)?

A

From top to bottom; If traffic matches a rule that allows the packet, then it will be processed based on the action configured in the rule; if traffic reaches the bottom, it should be blocked.

76
Q

What is best practice for the structure of a firewall’s ACL?

A
  1. The most specific rules are placed at the top
  2. The final default rule is typically to block any traffic that has not matched a rule (implicit/explicit deny)
77
Q

Define the purpose of an implicit deny

A

Firewall ACL rule configured by default to block any traffic not matched by previous rules.

78
Q

Define an explicate deny

A

Firewall ACL rule configured manually to block any traffic not matched by previous rules.

79
Q

Define a (5-)tuple

A

a 5-tuple is a collection of 5 values that identify a TCP/IP connection

80
Q

How are ACL rules structured?

A

Rule can execute a configured action (deny/allow/drop) based on parameters/5-tuples

81
Q

What are the parameters in a 5-tuple?

A
  1. Protocol
  2. Source IP
  3. Source Protocol
  4. Destination address
  5. Destination port
  6. etc if necessary
82
Q

What is the Linux command line utility for configuring the kernel firewall?

A

iptables

83
Q

How does iptables process traffic?

A

Operates with firewall chains, which are different types of traffic passing through the system.

84
Q

What are the main firewall chains in iptables?

A
  1. Input; incoming connections
  2. Output; outgoing connections
  3. Forward; routing/filtering
85
Q

What is the iptables commands to allow one IP address from a specific subnet to connect and block all others from the same subnet.

A

iptables -A INPUT -s x.x.x.1 -j ACCEPT
iptables -A INPUT -s x.x.x.x/24 -j DROP

86
Q

Define a route processor (RP) attack

A

Type of denial of service (DoS) attack when bad actor floods a gateway with high priority traffic to strain the routers main processor

87
Q

What is a method of mitigating a route processor (RP) attack?

A

control plane policing policy uses ACLs to allow or deny control traffic from certain sources and apply rate-limiting if a source threatens to overwhelm the route processor.

88
Q

Define pre-shared keys

A

Group authentication protocol allowing clients to connect to a network using a shared password/passphrase which is used to generate a pre-shared key

89
Q

What is the suggested length for a pre-shared key?

A

14 characters

90
Q

Define Extensible Authentication Protocol (EAP)

A

Authentication framework for securely passing authentication information between the supplicant (client) and the authentication server.

91
Q

How can devices be authenticated using Extensible Authentication Protocol (EAP)

A

A digital certificate issued to the authentication server is implemented the router protocol and installed on the device.

92
Q

Define a captive portal and its purpose

A

Landing page configured on guest network to authenticate guests after meeting set requirements from the landing page.

93
Q

Define geofencing

A

Security control to ensure that the station is within a valid geographic area to access the network.

94
Q

When performing a wireless site survey, what would be the indication of an evil twin rouge access point?

A

The presence of an unusually strong transmitter (30 dBm+).

95
Q

Define wireless client isolation and its purpose

A

AP configuration preventing wireless clients in the same broadcast domain from communicating by dropping peer-to-peer traffic and only allowing clients to communicate via the gateway.

Network+ (19 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions