Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CyberOPS > Module 25 Network Security Data > Flashcards

Module 25 Network Security Data Flashcards

1
Q

What are some network security monitoring tools?

A

Snort, Sguil

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is an example of a network IDS?

A

Snort

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is alert data?

A

Messages generated by intrusion prevention systems or intrusion detection systems in response to traffic that violates a rule or matches a signature of an exploit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How are alerts generated?

A

Generated by Snort (NIDS), and made readable by Sguil and Squert applications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How is session data recorded?

A

Record of a conversation between two end points.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Within this recorded data, what are the five tuples?

A

Source/Destination IP, Source/Destination port and the IP code for protocol in use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Why are packet captures important?

A

Contains the actual content of conversations, text of email messages, the HTML in web pages and the files that enter or leave the network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How do we collect statistical data?

A

Cisco Cognitive Threat Analysis - finds malicious activity that has bypassed security controls by identifying traffic patterns.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are some types of host logs

A

HIDS - event viewer - application logs, system logs, setup logs, security logs and command-line logs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a system log?

A

These include events regarding the operation of drivers, processes and hardware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a setup log?

A

Installation of software, including windows updates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a security log?

A

These record events related to security, logon attempts and operations related to file or object management and access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are application logs?

A

These contain events logged by various applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are command-line logs?

A

Attackers who have gained access, execute commands from the CLI rather than GUI.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are some type of host logs? Event types

A

Error, Warning, Information, Success Audit, Failure Audit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a warning log?

A

Not necessarily significant but may indicate a future problem.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is an error log

A

Event that indicates a significant problem such as loss of data or functionality.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is an information log

A

Describes successful operation of an app, driver or service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How many distinct parts of a syslog message

A

3 - priority, header and msg

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Describe the priority part of the syslog message

A

Two elements - Severity and Facility. Severity is a value (0-7), facility consists of sources that generated the message

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the Syslog severity values?

A

0 - 7 (Emergency, Alert, Critical, Error, Warning, Notice, Informational and Debug

22
Q

What is an emergency?

A

System is unusable

23
Q

What is alert

A

Action must be taken immediately

24
Q

What is critical?

A

critical conditions that should be corrected immediately and indicates failure in a system

25
Q

What is error?

A

A failure that is not urgent

26
Q

What is a warning?

A

An error that does not presently exist, but an error will occur in the future if IT IS NOT ADDRESSED

27
Q

What is notice?

A

An event that is not an error, but it is unusual

28
Q

What is informational

A

messages issued regarding normal operations

29
Q

What is debug

A

Message of interest

30
Q

How about server logs?

A

Server logs are an essential source of data for networking security monitoring.

31
Q

What are two important file logs?

A

Apache webserver and Microsoft Internet Information Server (IIS)

32
Q

All of these logs, server, network, etc - should be dumping into where? What type of central holding dump

A

SIEM - Security Information and Event Management. Provides real time reporting and long-term analysis of security events.

33
Q

What are the main points SIEM hits on - providing a view of the enterprise network using the following functiosn

A

Log collection, normalization, correlation, aggregation, report and compliance

34
Q

What is log collection

A

Events recorded from sources through the org

35
Q

What is normalizaiton

A

This maps log messages from diff systems into a common data model enabling the org to connect and analyze related vents

36
Q

What is correlation

A

Links logs from disparate systems or applicaitons

37
Q

What is aggregation

A

This reduces the volume of event data by consolidating duplicate records

38
Q

What is reporting

A

Presents the correlated, aggregated event data in real-time monitoring and long-time summaries.

39
Q

What is a popular SIEM

A

Splunk

40
Q

What is a popular packet analyzer?

A

Tcpdump

41
Q

What does NetFlow do?

A

Provides an important set of services for IP applications, including network traffic accounting, usage-based network billing, network planning, security, DoS monitoring capabilities and network monitoring

42
Q

What other things does netflow do

A

It provides information about network users, applications, peak usage times and traffic routing. Records info about packet flow including metadata

43
Q

What is AVC?

A

Cisco Application Visibility and Control system combines multiple technologies to recognize, analyze and control over 1000 applications.

44
Q

What would be a type of AVC or application recognition?

A

NBAR2 (L3-L7)

45
Q

What would be a metrics collection tool - bandwidth, usage, latency, etc/

A

Netflow

46
Q

How about, collecting data and reporting on application performance?

A

Cisco Prime

47
Q

How about. what control application can we use to maximize network performance?

A

QoS

48
Q

What is the diff between port monitoring and application monitoring/

A

Port looks at port number, applications look at applications DUH. Data and ports vs data and apps.

49
Q

What is the difference between cisco facility, severity and Mnemonic when it comes to a log

A

Cisco Facility would be like ASA or SYS, severity is like 5 or 4 or 3, etc. Mnemonic is config - text changed in the configuration

50
Q

What does Cisco Umbrella do?

A

Offers a hosted DNS service that extends the capability of DNS to include security enhancements

51
Q
A

CyberOPS (20 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions