Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ (SY0-701) > Lesson 5: Secure Enterprise Network Architecture > Flashcards

Lesson 5: Secure Enterprise Network Architecture Flashcards

1
Q

Define ‘Network infrastructure’

A

Appliances, and addressing/forwarding protocols that support basic connectivity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Define ‘Network applications’

A

Services that run on the infrastructure to support business activities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Define ‘Data assets’

A

Information that is created, stored, and transferred as a result of business activity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Define a ‘workflow’

A

Series of tasks that a business needs to perform.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Define a ‘Email mailbox server’

A

Stores data assets and must only be accessed by authorized clients; Must be fully available and fault tolerant.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Define a ‘Mail transfer server’

A

Connects with untrusted Internet hosts to transfer mail; Any email leaving or entering the network must be subject to policy-based controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Define an ‘on-premises network’

A

A private network facility that is owned and operated by an organization for use by its employees only; Enterprise local area network (LAN)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What network topology model describes a typical on-premises network?

A

Star topology.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the security concern with a star topology?

A

“Flat” in terms of security; Any host can communicate freely with any other host in the same segment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Define ‘logical segmentation’

A

Network topology enforced by switch, router, and firewall configuration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Define ‘attack surface’

A

All the points at which a threat actor could gain access to hosts and services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the attack surface of layer 1 and layer 2 of the OSI model?

A

Unauthorized connections to physical ports or wireless networks to communicate within the broadcast domain.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the attack surface of layer 3 of the OSI model?

A

Unauthorized hosts; Authenticating all connections

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the attack surface of layer 4 and layer 7 of the OSI model?

A

Unauthorized connections to TCP/UDP ports to communicate with application layer protocols and services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Define ‘port security’

A

Preventing a device attached to a switch port from communicating on the network unless it matches a policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Define ‘MAC Filtering’

A

Applying an access control list to a switch or access point so that only clients with approved MAC addresses can connect to it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is a more secure type of port security compared to MAC filtering?

A

802.1X Port-based Network Access Control (PNAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is required for Port-based Network Access Control (PNAC) to function?

A

A switch authenticating a host against a radius server or certificate when it connects to one of its ports.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What two protocols allow 802.1X Port-based Network Access Control (PNAC) to function?

A
  1. Extensible Authentication Protocol (EAP)
  2. Remote Authentication Dial-In User Service (RADIUS)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Define ‘Extensible Authentication Protocol (EAP)’

A

Framework for negotiating authentication methods that enable systems to use hardware-based identifiers or digital certificates.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Define ‘Remote Authentication Dial-In User Service (RADIUS)’

A

AAA protocol used to manage remote and wireless authentication infrastructures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Define ‘selection of effective controls’

A

The process of choosing the type and placement of security controls to ensure the goals of the CIA triad and compliance with any framework requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is the goal of ‘selection of effective controls’?

A

To enforce segmentation, apply access controls, and monitor traffic for policy violations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Define ‘Defense in depth’

A

Security strategy that positions the layers of diverse security control categories and functions as opposed to relying on perimeter controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What are the 3 types of controls in a defense in depth strategy?

A
  1. Preventive controls
  2. Detective controls
  3. Corrective controls
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

How is defense in depth achieved?

A

Security-critical zones are protected by diverse preventive, detective, and corrective controls at each level of the OSI model.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is a critical component of defense in depth?

A

Device palcement.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Define ‘Device placement’

A

Positioning security controls to protect security zones and individual hosts to implement a defense in depth.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Define a ‘Preventive control’

A

Often placed at the perimeter of a network segment or zone; Firewall, Load balancers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Define a ‘Detective controls’

A

Placed within the perimeter; Monitors traffic within a network or subnet; Provides alerting of malicious traffic that has evaded perimeter controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Define a ‘Corrective control’

A

Installed on hosts as a layer of endpoint protection in addition to the network infrastructure controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Define a ‘passive security control’

A

Does not require any sort of client or agent configuration or host data transfer to operate; Analyzes intercepted network traffic instead of sending probes to a target.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Define an ‘active security control’

A

Requires hosts to be explicitly configured to use the control; Detective and preventive security controls that use an agent or network configuration to monitor hosts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Define an ‘inline’ device

A

Placement and configuration of a network security control so that it becomes part of the cable path.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Define the function of a ‘SPAN (switched port analyzer)/mirror port’

A

Copying ingress and/or egress communications from one or more switch ports to another port to monitor communications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Define the function of a ‘Test access point (TAP)’

A

A hardware device with ports for incoming and outgoing network cabling inserted into a cable run to copy frames to a mirror port for analysis.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What are the two states of failures a security device could enter?

A
  1. Fail-open
  2. Fail-closed
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Define a ‘Fail-open’ state of failure

A

A security control configuration that ensures continued access to resources in the event of failure; Prioritizes availability over confidentiality and integrity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is the risk of entering a fail-open state of failure?

A

A threat actor could engineer a failure state to defeat the control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Define a ‘Fail-closed’ state of failure

A

A security control configuration that blocks access to a resource in the event of failure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What is the risk of entering a fail-closed state of failure?

A

System downtime

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Define a ‘Packet Fileting Firewall’

A

A Layer 3 device; Compares packet headers against ACLs to determine which network traffic to accept.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What information from a packet header is used to define rules in an ACL?

A

IP, Protocol, and Port.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What actions can be defined in an ACL rule?

A

Accpet/permit, drop/deny, reject/block

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What is the outcome of a drop/deny?

A

Silently discards the packet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What is the outcome of a reject/block?

A

Blocks the packet but responds to the sender with an ICMP message, such as “port unreachable”.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What are the two types of ACLs?

A
  1. Inbound ACL
  2. Outbound ACL
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Define an ‘appliance firewall’

A

A standalone hardware device that performs only the function of a firewall (filter/monitor inbound and outbound traffic)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What are the 3 ways to deploy an appliance firewall?

A
  1. Routed (Layer 3)
  2. Bridged (Layer 2)
  3. Inline (Layer 1)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Define a ‘routed (layer 3)’ firewall

A

Performs forwarding between subnets; Each interface connects to a different subnet representing a different security zone; Interfaces configured with an IP and MAC address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Define a ‘bridged (layer 2)’ firewall

A

Inspects traffic passing between two nodes, such as a router and a switch; bridges the Ethernet interfaces between the two nodes and each interfaces is configured with a MAC but no IP.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Define a ‘Inline (layer 1)’ firewall

A

Firewall acts as a cable segment and has no MAC or IP address; Traffic received on one interface is either blocked or forwarded over the other interface.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Define a ‘transparent firewall’

A

Standalone firewall deployed in front or in-between nodes without having to reconfigure subnets and reassign IP addresses on other devices; Bridged and Inline firewalls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Define a ‘router firewall’

A

A hardware device that has the primary function of a router, but also has firewall functionality embedded into the router firmware.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Why is a packet filtering firewall stateless?

A

Does not persevere information about network sessions/connections.

56
Q

Define a ‘stateful inspection firewall’

A

Tracks information about the session established between two hosts; analyze packets down to the application layer rather than filtering packets only by header information.

57
Q

How does a stateful inspection firewall process packets?

A

Firewall confirms whether it belongs to an existing connection; If not, it applies ordinary packet filtering rules to determine whether to allow it.

58
Q

What two layers of the OSI model does a stateful inspection firewall operate at?

A

layer 4 and layer 7

59
Q

Define a ‘layer 4 firewall’

A

A stateful inspection firewall that can monitor TCP/UDP sessions.

60
Q

What mechanism does a layer 4 firewall inspect when determining if packet belongs to an existing connection?

A

Examines the TCP three-way handshake to distinguish new from established connections.

61
Q

How does a layer 4 firewall leverage the 3 way handshake to process a packet?

A

A legitimate TCP connection should follow a SYN > SYN/ACK > ACK sequence with corresponding sequence number; Deviations from this can be dropped as malicious flooding or session hijacking attempts.

62
Q

Define a ‘layer 7 firewall’

A

A stateful inspection firewall that can filter traffic based on specific application protocol headers and payload, such as web or email data.

63
Q

Define a ‘proxy server’

A

Mediates the communications between a client and another server; Can filter/forward communicates and improve performance with caching.

64
Q

Define a ‘caching engine’

A

Feature of many proxy servers that enables the servers to retain a copy of frequently requested web pages.

65
Q

Define a ‘forward proxy server’

A

Outbound protocol specific proxy connections.

66
Q

Besides Forward/Reverse proxy, what are the two proxy server implementations?

A
  1. Non-transparent proxy
  2. Transparent proxy
67
Q

Define a ‘non-transparent proxy server’

A

A server that redirects requests and responses for clients configured with the proxy address and port.

68
Q

Define a ‘Transparent proxy server’

A

Implemented as a router or as an inline network appliance to intercept client traffic.

69
Q

Define a ‘reverse proxy server’

A

Proxy server that protects servers from direct contact with client requests; Deployed on the network edge and configured to listen for protocol-specific inbound traffic.

70
Q

Define an ‘intrusion detection system (IDS)’

A

Performs real-time analysis of either network traffic or system and application logs.

71
Q

What mechanism does an intrusion detection system (IDS) use to function?

A

A sensor/packet sniffer (SPAN/TAP)

72
Q

Define ‘Snort’

A

Open source Network intrusion detection system (NIDS).

73
Q

How does an intrusion detection system (IDS) detect malicious traffic?

A

When traffic matches a detection signature, the IDS raises an alert or generates a log entry but does not block the source host.

74
Q

Define an ‘intrusion prevention system (IPS)’

A

Security appliance or software that can detect malicious traffic and can actively block attacks.

75
Q

How does an intrusion prevention system (IPS) detect malicious traffic?

A

Scans traffic to match detection signatures.

76
Q

What are the 3 actions an intrusion prevention system (IPS) can take after matching a signature?

A
  1. Block the source
  2. Reset the connection
  3. Redirect traffic to a honeypot/honeynet for additional analysis
77
Q

What are the two ways of deploying an intrusion prevention system (IPS)?

A
  1. Inline appliance with an integrated firewall and routing/forwarding capability
  2. Passive sensors that can reconfigure a router/firewall as a mitigating action
78
Q

What are 4 features of a ‘next-generation firewall (NGFW)’?

A
  1. Layer 7 filtering
  2. User directory based filtering to prevent insider threat
  3. Integrated IPS
  4. Integration with cloud networking
79
Q

Define ‘Unified threat management (UTM)’

A

All-in-one security appliances and agents that combine the functions of a firewall, malware scanner, intrusion detection, vulnerability scanner, data-loss prevention, content filtering, and so on.

80
Q

What is a downfall to implementing Unified threat management (UTM)?

A

Creates single point of failure; Latency issues due to consolidated overhead; Overall performance issues.

81
Q

Define a ‘Load balancer’

A

A type of switch, router, or software that distributes client requests between different resources.

82
Q

What are the benefits of a load balancer?

A

Mitigation against denial of service attacks; Provide fault tolerance.

83
Q

What are the two main types of load balaners?

A
  1. Layer 4 load balancer
  2. Layer 7 load balancer
84
Q

Define a ‘layer 4 load balancer’

A

Makes forwarding decisions based on IP address and TCP/UDP port values, working at the transport layer of the OSI model.

85
Q

Define a ‘layer 7 load balancer’ (content switch)

A

Makes forwarding decisions based on application-level data; Uniform resource locator (URL) web address or data types like video or audio streaming.

86
Q

Define the ‘scheduling’ function implemented by load balancers

A

Algorithm and metrics that determine which node is selected for processing each incoming request from the load balancer.

87
Q

What is the most common/simplest form of the scheduling function in a load balancer?

A

Round-robin

88
Q

Define ‘Round robin’ scheduling

A

Picking the next node based on a defined metric.

89
Q

How is a heart beat mechanism used in determine scheduling in a load balancer?

A

To verify whether each node is available and under load or not.

90
Q

How does a client keep a persistent connection with a node configured behind a layer 4 load balancer?

A

Source IP Session affinity

91
Q

Define ‘Source IP/Session Affinity’

A

Layer 4 load balancer scheduling approach.

92
Q

What is the function of ‘Source IP (Session) Affinity?

A

To route traffic to nodes that have previously established connections with the client in question.

93
Q

How does a layer 7 load balancer keep a client connected to a session with a node?

A

Persistence configuration

94
Q

Define ‘persistence’ configuration in a layer 7 load balancer

A

Sticky Sessions; Enables a client to maintain a connection with a load-balanced server over the duration of the session.

95
Q

How does the persistence configuration in a layer 7 load balancer keep a client connected to a session?

A

By setting a cookie on the node or injected by the load balancer.

96
Q

Define a ‘web application firewall (WAF)’

A

Firewall designed specifically to protect software running on web servers and their back-end databases from code injection and DoS attacks.

97
Q

How does a web application firewall (WAF) detect/protect?

A

Uses application-aware processing rules to filter traffic and perform application-specific intrusion detection; Programmed with signatures of known attacks and use pattern matching to block requests containing suspect code.

98
Q

How can a web application firewall (WAF) be deployed/implemented?

A

Deployed as an appliance protecting the zone that the web server is placed in or as plug-in software for a web server platform.

99
Q

Define ‘Remote access architecture’

A

Infrastructure, protocols, and software that allow a host to join a local network from a physically remote location.

100
Q

What is the most common modern remote access mechanism/technology?

A

virtual private network (VPN)

101
Q

Define a ‘virtual private network (VPN)’

A

A secure tunnel created between two endpoints connected via an unsecure transport network.

102
Q

Define a ‘Secure Tunnel’

A

Mechanism encapsulating data from one protocol for safe transfer over another network such as the Internet.

103
Q

What is the least secure VPN protocol/solution?

A

Point-to-Point Tunneling Protocol (PPTP).

104
Q

Define a ‘transport layer security (TLS) VPN’

A

Client connects to the remote access server using digital certificates.

105
Q

Describe TLS’ function when configured with aVPN

A

TLS creates an encrypted tunnel for the user to submit authentication credentials.

106
Q

What layer(s) of the OSI model does TLS function?

A

Layer 4 & Layer 7; Transport layer and Application layer.

107
Q

Define ‘Internet Protocol Security (IPsec)’

A

Layer 3 protocol suite used to secure data through authentication and encryption as the data travels across a network,

108
Q

What are the two core Internet Protocol Security (IPsec) protocols?

A
  1. Authentication Header (AH)
  2. Encapsulating Security Payload (ESP)
109
Q

Define the purpose of the IPsec ‘Authentication Header (AH)’ protocol

A

Authenticates the sender of transmitted data; Provides integrity and protection against replay attacks.

110
Q

How does the IPSec Authentication Header (AH) protocol function?

A

Calculates a cryptographic hash of the whole packet, plus a shared secret key, and adds this value in the header as an Integrity Check Value (ICV).

111
Q

Define ‘Encapsulating Security Payload (ESP)’ IPsec protocol

A

Encrypts the header and payload of a data packet as well as authenticating the sender.

112
Q

What two modes can IPsec be used in?

A
  1. Transport mode
  2. Tunnel mode
113
Q

Define IPsec transport mode

A

Used to secure communications between hosts on a private network.

114
Q

What is the outcome of configuring IPsec Encapsulating Security Payload (ESP) in transport mode?

A

The IP header for each packet is not encrypted, just the payload data.

115
Q

What is the outcome of configuring IPsec Authentication Header (AH) in transport mode?

A

Provides integrity for the IP header.

116
Q

Define IPsec ‘Tunnel mode’

A

Used for site to site VPN connections.

117
Q

What is the outcome of configuring IPsec Encapsulating Security Payload (ESP) in tunnel mode?

A

The whole IP packet (header and payload) is encrypted and encapsulated as a datagram with a new IP header.

118
Q

What is the outcome of configuring IPsec Authentication Header (AH) in tunnel mode?

A

AH has no use case in tunnel mode, as confidentiality is usually required.

119
Q

What is required for a host/router to use IPsec?

A

Must be assigned an IPsec policy to set the authentication mechanism, IPsec protocol (AH/ESP), and the mode (Transport/Tunnel).

120
Q

What type of encryption key does IPsec’s encryption and hashing depend on?

A

A shared secret.

121
Q

Define the ‘Internet Key Exchange (IKE) protocol’

A

Framework for creating a security association (SA) between hosts using IPSec.

122
Q

Define the function of a ‘security association (SA)’

A

Authenticates peers in an association; Selects cryptographic ciphers mutually supported by peers , and performs key exchange between peers.

123
Q

What is the purpose of a ‘security association (SA)’

A

Establishes that two hosts trust one another (authenticate) and agree on secure protocols and cipher suites to use to exchange data.

124
Q

Define the first phase of Internet Key Exchange (IKE) protocol negotiations between two hosts

A

Authenticates the two peers and performs key agreement using the Diffie-Hellman algorithm to create a secure channel.

125
Q

What two methods of authenticating hosts in the first phase of an Internet Key Exchange (IKE) protocol negotiation?

A
  1. Digital Certificates
  2. Pre-shared key (group authentication)
126
Q

Define the second phase of Internet Key Exchange (IKE) protocol negotiations between two hosts

A

Peers in the Security Association (SA) establish ciphers and key sizes and IPSec protocol (AH and/or ESP) to be used in the IPSec session.

127
Q

How many versions of IKE are there?

A

Two versions

128
Q

Define the first version of Internet Key Exchange (IKE) protocol

A

Designed for site-to-site and host-to-host topologies and requires a supporting protocol to implement remote access VPNs.

129
Q

Define the second version of Internet Key Exchange (IKE) protocol

A

For use as a stand-alone remote access client-to-site VPN solution.

130
Q

What are improvements to IKEv2 in comparison IKEv1

A

Supports EAP, allows NAT transversal to configure a tunnel allowed by a home router/firewall.

131
Q

Define HTML5 VPN

A

Using features of HTML5 to implement remote desktop/VPN connections via browser software (clientless).

132
Q

Define ‘in-band’ remote management

A

Remote management link shares traffic with other communications on the production network.

133
Q

Define ‘out-of-band’ remote management

A

The management interface of a network appliance is accessed using a separate network from the usual data network.

134
Q

What are examples of in-band remote management protocols?

A

RDP, SSH, TLS/IPSec

135
Q

What are examples of out-of-band remote management?

A

A serial console or modem port on a router.

136
Q

Define a ‘Jump server’

A

A hardened server that provides access to other hosts.

Security+ (SY0-701) (22 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions