Network Hardening Flashcards

1
Q

Patch Management

A

Planning, testing, implementing, & auditing of software patches
(Security, increases uptime, ensures compliance, improves features)

Planning - Track available patches to determine how to test/deploy

Testing - Test patches prior to deployment (use a test network/lab)

Implementing - Disable Windows Update from running automatically before deployment

Auditing - Scans the network to determine if patch was installed (also firmware management)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Least Functionality

A

Process of configuring a device/server/workstation to only provide essential services required by user

Cisco devices = AutoSecure CLI command

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Port Security

A

Prevents unauthorized access to a switchport by identifying/limiting the MAC addresses of hosts that are allowed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Port Security: Dynamic Learning

A

Defines a max number of MACs for a port & blocks new devices not on learned list

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Private VLAN (Port Isolation)

A

A technique where a VLAN contains switchports that are restricted to a single uplink
(Primary, secondary isolated, secondary community)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Primary VLAN

A

Forwards frames downstream to all of the secondary VLANs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Isolated VLAN

A

Includes switchports that can reach the primary VLAN but not other secondary VLANs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Community VLAN

A

Includes switchports that can communicate with each other & the primary VLAN but not other secondary VLANs

Default VLAN = VLAN1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Community VLAN: P-Port

A

Promiscuous Port:
Can communicate with anything connected to the primary/secondary VLANs

Host ports, isolated ports, community ports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Community VLAN: I-Port

A

Isolated Port:
Can communicate upwards to a P-Port, cannot talk with other I-Ports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Community VLAN: C-Port

A

Community Port:
Can communicate with P-Ports & other C-Ports on the same community VLAN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Native VLAN

A

VLAN where untagged traffic is put once it is received on a trunk port

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

DAI

A

Dynamic ARP Inspection:
Validates the ARP packets in your network
Ensures only valid ARP requests/responses are relayed across network device
Invalid ARP packets = dropped

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

DHCP Snooping

A

Provides security by inspecting DHCP traffic, filtering untrusted DHCP messages, & building/maintaining a DHCP snooping binding table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Untrusted Interface

A

Any interface that is configured to receive messages from outside the network/firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Trusted Interface

A

Any interface configured to receive messages only from within the network

Configure switches/VLANs to allow DHCP snooping

17
Q

RA-Guard

A

IPv6 Router Advertisement Guard:
Mitigates attack vectors based on forged ICMPv6 router advertisements

(Layer 2) - To specify which interfaces are not allowed to have RAs

18
Q

CPP

A

Control Plane Policing:
Configures a QoS filter that manages the traffic flow of control plane packets to protect the control plane of Cisco IOS routers/switches

Data plane, management plane, control plane, service plane

19
Q

ACL: Explicit Deny

A

Blocks matching traffic

20
Q

ACL: Implicit Deny

A

Blocks traffic to anything not explicitly specified

21
Q

ACL: Role-Based Access

A

Defines the privileges & responsibilities of administrative users who control firewalls & their ACLs

22
Q

Wireless Client Isolation

A

Prevents wireless clients from communicating with one another
WAPs begin to operate like a switch using private VLANs

23
Q

Guest Network Isolation

A

Keeps guests away from your internal network communications