Misc. Flashcards

1
Q

What is the newest IEEE WiFi standard and what frequency bands does it operate on?

A

WIFI-7 aka 802.11be = the latest WiFi standard with speeds up to 46Gbps, 320MHz channel width (double WIFI-6).

It operates on the 2.4/5/6GHZ frequency bands.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is band steering?

A

Band steering = WAP feature to optimise device connections/speeds = Directing clients connected to a WAP (Wireless Access Point) to the best frequency e.g. 2.4GHz if the 5GHz band is busy or has weak signal.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the point of the 802.11h WiFi standard?

A

802.11h is a regulated wifi standard that forces WiFi capable devices/routers to have certain features:
-DFS = Dynamic Frequency Selection - the ability to detect and avoid frequency conflicts
-TPC = Transmit Power Control -regulates the power level of WiFi transmissions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a direct wireless connection between two devices, without using a WAP (WirelessAccessPoint) called?

A

IBSS (Independent Basic Service Set) or Ad hoc - connection.

Ad hoc = network configuration where devices are directly connected to each other for a particular purpose. Peer 2 Peer (P2P) connection/no AP’s or routers. E.g. bluetooth to connect to an IoT device.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the BSSID? What two things is it comprised of?

A

BSSID is the unique identifier for a network device used to tell devices with the same SSID (given name) apart by other devices on the network.

BSSID is made up of the device MAC address combined with the SSID.

SSID + MAC address = BSSID

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is an ESSID?

A

ESSID - Extensible SSID = allows seamless roaming between multiple configured WAP’s on the same network.

As soon as you get in range of a new better signal WAP the BSSID (MAC address+SSID) is gathered and connected to.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are active and passive devices in terms of providing network redundancy?

A

Active device is the one in use whereas the passive one is the one on standby to take over should the active device fail (failover) thereby providing network redundancy and minimising any down time.

Configuration and real-time session information like the routing table is constantly synchronised between these two devices so the failover can happen at anytime.

Can have an active-active setup but requires more setup (and higher setup costs). I.e. two active firewalls where only outbound traffic goes through one firewall and inbound traffic uses the other exclusively. This still provides redundancy and balances the network load.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is IPAM - Internet Protocol Address Management?

A

IPAM is a software/suite of tools to centralise the management of IP addresses within your network. E.g. manage DHCP reservations or link users to IP addresses and keep track of how many IP addresses in the range are available, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What’s an SLA?

A

Service Level Agreement (SLA) - is an agreed upon minimum level of service between a client and a provider. E.g. it may stipulate a 99.5% minimum infrastructure uptime or less than 2 hours unscheduled downtime per week, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What’s a site survey?

A

An assessment to evaluate Access Point locations, wireless landscape (heat map, WiFi map), any dead zones, temperatures, humidity etc. Basically all site conditions related to IT. This can then be used to optimise service by using frequencies that aren’t in use, plan where to put MDF and IDF.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a golden or baseline configuration?

A

Predefined/working/ideal/stable setup for a system.
You can roll back to or compare against this golden configuration if a problem arises with your production configuration.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What does NetFlow protocol do?

A

NetFlow gathers detailed statistics regarding data flow over the network/monitors network traffic for performance, troubleshooting and security monitoring. This collected data is then sent from all physical taps/switch port analysers to a NetFlow Collector which then stores the summary of data statistics and creates graphs etc as needed.

SolarWinds is a NetFlow analysis tool to process and visualise such NetFlow device data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is SIEM?

A

A way of collecting syslog data from various network devices to manage security and error logging from a centralised SIEM - Security Information Event Management (e.g. Splunk).

SIEM allows for real time alerts, long term storage of events/logs, analysis over time for network events.

SIEM can be configured to only capture certain messages/data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is Availability Monitoring?

A

Availability monitoring = tracking whether a device is reachable or not/up or down. Can set alarm to trigger if an interface becomes unreachable. Can be tracked over time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is an RTO?

A

RTO - Recovery Time Objective = a measure of how long (time) it takes after an outage/disaster to get back to a normal operating service level.

RTO = how long to get back up and running again.

(Lower the better).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is an RPO?

A

RPO - Recovery Point Objective = a measure of how much data is lost between an outage and the previous backup/recovery point.

RPO can help determine how frequently backups should occur.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is MTTR in disaster recovery?

A

MTTR = Mean Time To Repair = the actual average time taken from an issue/outage occurring and being fully functional again.

e.g. how long to replace a broken router (shorter the better)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is MTBF in disaster recovery?

A

MTBF - Mean Time Between Failures = the average length of time systems/infrastructure are fully operational before unplanned outage/failure occurs.

(longer time the better)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Site resiliency?

A

Site resiliency = ability to move operations/services to an alternative/backup/resiliency site location in the event of a site disaster/outage.

Cold site = empty building site, everything needs to be brought with you in the event of a disaster (takes a long time to get up and running again, but is cheap to have).

Hot site = exact replica of your primary site/duplicate all hardware and data from the primary site. (Can be up and running very quickly if the primary site fails, much more costly to keep running, maintaining than a Cold Site).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are Cold/Warm/Hot sites in terms of Disaster Recovery?

A

Cold site = empty building site, everything needs to be brought with you in the event of a disaster (takes a long time to get up and running again, but is cheap to have).

Warm site = somewhere between hot and cold sites, it has just enough hardware to get going again. Software must be sent/brought over from the primary site or from a backup location.

Hot site = exact replica of your primary site/duplicate all hardware and data from the primary site. (Can be up and running very quickly if the primary site fails, much more costly to keep running, maintaining than a Cold Site).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are tabletop exercises in relation to disaster recovery?

A

Tabletop exercises are where each department verbally walks through the steps they would take to recover from a hypothetical disaster/outage.

This is a good no-risk way to practice disaster recovery and identify potential problems that may arise in such an event.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is a Validation Test?

A

Validation Tests = real-world simulation of a disaster/outage and actually doing the steps to recover from it (generally in a virtualised clone of the infrastructure). E.g. implementing backups, meeting RPO and RTO targets, recovery plan.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is the file used in Local name resolution (not DNS)?

A

Hosts File is used in local name resolution - it is a list of domains linked to IP addresses/hostname. If a domain cannot be found in the hosts file list then DNS is used/queried to resolve/convert the Domain name to an IP address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the difference between a Forward Lookup and a Reverse DNS Lookup?

A

A forward lookup is where you input the FQDN and the DNS server returns the IP address.

Whereas, a Reverse DNS lookup is where you input the IP address and the DNS returns the FQDN.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is an Authoritative DNS Server?

A

Authoritative DNS Server = the zone authority that holds the original/official records for a Domain e.g. the A records, MX (Mail eXchange) records, etc. It is responsible for providing the most reliable and up-to-date information about the requested Domain.

26
Q

What is the potential problem with a Non-Authoritative DNS Server?

A

Non-Authoritative DNS Servers hold copies/caches of records received directly or indirectly from the authoritative DNS server. This means that they may not have been updated recently so could be wrong! The length of time these caches are kept for/deemed valid on a non-authoritative server is defined by the TTL in seconds.

27
Q

What is DNSSEC?

A

DNSSEC - Domain Name Server Security Extensions = is a configurable way of digitally signing DNS server responses to prove they come from a trusted source and that they haven’t been tampered with.

However, the responses are still transmitted in-the-clear so if the DNS traffic is captured people can still see what sites etc you are using.

28
Q

What is DoT and what is the default port it uses?

A

DoT - DNS over TLS = is a way of encrypting DNS traffic with TLS/SSL (commonly used to encrypt web traffic).

DoT uses port tcp/853 by default.

29
Q

What is DoH and what port does it use?

A

DNS over HTTPS (DoH) = is another way of encrypting DNS queries by encapsulating them in HTTPS (tcp/443) packets.

30
Q

What is a DNS Pointer Record (PTR)?

A

Pointer Record - is a DNS record type that is the reverse of an A or AAAA record i.e. it allows reverse lookups. It is stored in a reverse map zone file.

It stores FQDN’s that are sent back to clients assuming they do a DNS reverse lookup with the corresponding IP address.

I.e. if you search by IP address instead of human-readable FQDN then a Pointer Record (PTR) is searched to find the corresponding FQDN.

31
Q

What are NS/Name Server Records?

A

Name Server (NS) Records list the name servers for a domain. E.g. they point to the name of the DNS server where a domain is stored.

NS Records tell the system where to go to find the DNS records for a queried/searched domain.

32
Q

What is VNC the equivalent to on a non-Windows OS?

A

VNC (Virtual Network Computing) is equivalent to RDP (Windows only) for providing remote access to a desktop that’s not using Windows.

33
Q

What is API integration?

A

The process of connecting two+ apps or systems via their APIs (Application Programming Interfaces). This lets them share data/services between them in real-time.

34
Q

What is a Jump Box/Jump Server?

A

A jump box/server is a gateway server between a client and other servers/the network. Adding this middle server increases security as there is only a single point of entry to the network and therefore a reduced attack surface.

The jump box MUST be security hardened, require 2FA, enforce security updates etc as once someone is authed on the jump box/server they can then access the entire network!

35
Q

What is in-band management?

A

In-band management/IP access = managing devices and systems using the same network (IP) that they use for their primary operations.

36
Q

What is out-of-band management?

A

Out-of-band (OOB) management = managing devices and systems using a DIFFERENT network that they use for their primary operations, e.g. using a physical connection to the device, usb/serial connection, separate modem. (NOT THE IP THAT THE DEVICE IS ON).

37
Q

What is compliance?

A

Compliance = adhering to the laws, policies and regulations. Not being compliant may result in fines, imprisonment and being fired.

38
Q

What is data localisation?

A

Data Localisation = the practice of storing data from one region/country within that region/country as dictated by GDPR (General Data Protection Regulation - EU data protection regulation).

Data collected in Vegas stays in Vegas.

39
Q

What’s PCI DSS?

A

PCI DSS - Payment Card Industry Data Security Standard = a standard for protecting credit card information that’s digitally stored.

Companies that deal with credit cards are regularly audited (searched/inspected) to make sure they are in compliance with the PCI DSS.

6 control objectives:
-protect data
-maintain vulnerability management
-monitor and test networks
-maintain information security policy

40
Q

What two halves of a 48 bit MAC address are there?

A

OUI:NIC-serial

The first half is the OUI - Organisationally Unique Identifier - aka the manufacturers unique number.

The second half of a MAC address is the NIC specific serial number.

41
Q

What is MAC flooding?

A

An attack that flushes a switches cached MAC address table with tonnes of packets all from different source MAC addresses. This forces the default switch behaviour which is to forward a received packet with no matching cached MAC address to ALL switch interfaces. Aka makes it work like a hub which means the attacker can then receive all packets sent to that hub for their malicious gains.

The switch’s port security settings block flooding by limiting the number of addresses learned per port.

42
Q

What’s the updated/future version of the nslookup utility command?

A

dig - this more in depth version of the soon to be deprecated nslookup - shows where an IP address/domain is stored. The name server (ns) that it’s on - authoritative (authentic information/most reliable) or non-authoritative - a name server that has the info from the authoritative server for efficiency, however it may not be fully reliable if the info hasn’t been updated recently.

43
Q

What does the tcpdump command line tool do?

A

tcpdump = limited quick real-time packet capture and analysis. (Like a quick Wireshark command line equivalent).

Can save tcpdump as a .pcap file that can be viewed and analysed in depth by Wireshark.

44
Q

What does netstat -a show?

A

netstat (network statistics) -a shows all active connections/active listening open ports and what IP address they are communicating with.

45
Q

What is Operational Technology (OT)?

A

Operational Technology (OT) is the hardware and software that control industrial equipment and infrastructure such as the power grid, factory equipment.

SCADA and DCS (Distributed Control Systems) are examples of Operational Technology (OT).

46
Q

What is Insertion Loss?

A

Insertion Loss = the loss/degradation of signal strength and or power when a device is inserted into a network. Measured in decibels (dB) and shows the weakening of signal as it goes through the component (e.g. due to resistance of the cable/wire).

47
Q

Near End CrossTalk (NEXT) vs Far End CrossTalk (FEXT)?

A

Near End CrossTalk (NEXT) is the interference measured at the transmitting end of a cable/device.

Far End CrossTalk (FEXT) is the interference measured at the furthest point from the transmitting device.

To troubleshoot crosstalk (XT) check your wires (twisted copper pairs) are tightly twisted and make sure the RJ45 connector is crimped properly onto the wires.

CAT6A ethernet cable has cable spacers to physically separate the wires to reduce crosstalk (XT).

48
Q

What are the three tiers of the three-tier hierarchical network model? 3

A

Three-Tier Hierarchical network Model is split into 3 layers:
Core Layer - core routers - connects different site locations etc, backbone of the network
Distribution Layer - VLAN’s, firewalls, access, aggregates data from access layer switches
Access Layer - the layer the end users actually connect to. Point of entry for end users.

It is only used for large networks.

49
Q

What is a collapsed core network architecture? 2

A

Collapsed Core network Architecture consists of two layers: Core Layer and an Access layer. It is designed for small networks and businesses.

The Distribution Layer from the three-tier hierarchical model is collapsed/merged into the core layer.

Easier to manage than a three tier. E.g. a spine and leaf design is an example of a collapsed core network architecture.

50
Q

What is the difference between Unicast and Multicast communication?

A

Unicast = one-to-one (uni) communication via an IP address.

Multicast = one-to-many (multi) via a multicast group address. E.g. streaming a video to multiple PC’s at once.

51
Q

What IP version does Anycast work with?

A

Anycast ONLY works with IPv6 and is where data is sent to the nearest/most optimal destination (that all share the same address) as determined by routing protocols. E.g. to optimise CDN (Content Delivery Network) to get your content to you faster and DNS.

52
Q

What is Anycast communication?

A

Anycast = one to ANY (one) of the closest devices with the same address (CDN etc server selection of the nearest host server to the client for optimal download speeds).

53
Q

What is the purpose of a Voice VLAN?

A

Voice VLAN - is designed to prioritise and separate voice traffic (VoIP) from other network traffic to ensure QoS - reduce latency, jitter and packet loss for VoIP traffic.

54
Q

What is a DHCP exclusion range?

A

DHCP exclusion range is a preconfigured range of IP’s NOT to be used for dynamic address assignment. i.e. NOT to be used for DHCP (maybe you want to use that range for CCTV cameras or whatever else on your network). Prevents IP conflicts.

55
Q

What information DOESN’T SLAAC provide that DHCP server does?

A

SLAAC doesn’t provide DNS server information by default - so need to configure DHCPv6 for it.

56
Q

What is RPO?

A

Recovery Point Objective (RPO) - maximum acceptable amount of DATA LOSS measured in TIME before a disaster occurs. So backups must be taken BEFORE the RPO time/data limit. So if RPO is one hour (says you can lose up to an hours worth of data) then data should be backed up in intervals of less than one hour.

RPO = maximum age of files that must be recovered from backup should a disaster occur without significant losses.

RPO = max data loss

57
Q

What is a Recovery Time Objective (RTO)?

A

RTO - Recovery Time Objective = a time target (time window) in which a business must be restored to normal operational level after a disaster to avoid unacceptable consequences/losses.

RTO = maximum acceptable time limit to recover operations to normal operations after a disaster.

RTO = tolerable maximum downtime.

58
Q

What is RTO vs RPO?

A

RTO = tolerable downtime
RPO = tolerable data loss (measured in time)

59
Q

What is Mean Time Between Failure (MTBF)?

A

MTBF - Mean Time Between Failure = measure of reliability of a device/system, average time between failures of a system/component during its operational lifespan.

MTBF - how often it breaks over it’s lifespan/reliability

60
Q

What is MTTR Mean Time To Repair a measure of?

A

MTTR = how long, on average, it takes to repair a component (e.g. how long to replace an SSD).