Network Security

Question 1

Network Security Fundamentals

Answer 1

▪ Networks are increasingly dependent on interconnecting with other
networks
▪ Risks exist not just on the untrusted Internet, but also inside our own
organization’s networks and must be minimized or eliminated
▪ Understanding the various threats facing our networks is important in
order to best defend the network against the onslaught of cyber-attacks
they are constantly facing

Question 2

Network Security Goals

Answer 2

Commonly called the CIA Triad
● Confidentiality
● Integrity
● Availability

Question 3

Symmetric Encryption (Confidentiality)

Answer 3

▪ Both sender and receiver use the same key
▪ DES (Data Encryption Standard)
● Developed in the mid-1970s
● 56-bit key
● Used by SNMPv3
3DES (Triple DES)
● Uses three 56-bit keys (168-bit total)
● Encrypt, decrypt, encrypt
▪ AES (Advanced Encryption Standard)
● Preferred symmetric encryption standard
● Used by WPA2
● Available in 128-bit, 192-bit, and 256-bit keys
▪ Sender and receiver use the same key to encrypt and decrypt the
messages

Question 4

Asymmetric Encryption (Confidentiality

Answer 4

▪ Uses different keys for sender and receiver
▪ RSA is the most popular implementation
▪ RSA algorithm is commonly used with a public key infrastructure (PKI)
▪ PKI is used to encrypt data between your web browser and a shopping
website
▪ Can be used to securely exchange emails
▪ Sender and receiver use different keys to encrypt and decrypt the
messages

Question 5

Integrity

Answer 5

▪ Ensures data has not been modified in transit
▪ Verifies the source that traffic originates from
▪ Integrity violations
● Defacing a corporate web page
● Altering an e-commerce transaction
● Modifying electronically stored financial records

Question 6

Hashing (Integrity)

Answer 6

▪ Sender runs string of data through algorithm
● Result is a hash or hash digest
▪ Data and its hash are sent to receiver
▪ Receiver runs data received through the same algorithm and obtains a
hash
▪ Two hashes are compared
● If the same, the data was not modified

Question 7

Hashing Algorithms (Integrity)

Answer 7

▪ Message digest 5 (MD5)
● 128-bit hash digest
▪ Secure Hash Algorithm 1 (SHA-1)
● 160-bit hash digest
▪ Secure Hash Algorithm 256 (SHA-256)
● 256-bit hash digest
▪ Challenge-Response Authentication Mechanism Message Digest 5
(CRAMMD5)
● Common variant often used in e-mail systems

Question 8

Availability

Answer 8

▪ Measures accessibility of the data
▪ Increased by designing redundant networks
▪ Compromised by
● Crashing a router or switch by sending improperly formatted data
● Flooding a network with so much traffic that legitimate requests
cannot be processed
o Denial of Service (DoS)
o Distributed Denial of Service

Question 9

Threat

Answer 9

▪ A person or event that has the potential for impacting a valuable
resource in a negative manner

Question 10

Vulnerability

Answer 10

▪ A quality or characteristic within a given
resource or its environment that might
allow the threat to be realized
● Internal Threat
o Any threat that originates
within the organization
itself
● External Threat
o Any threat that could be
people, like a hacker, or it
can be an event or
environmental condition

Answer 11

▪ Undesirable conditions or weaknesses that are in the general area
surrounding the building where a network is run

Question 12

Technical Vulnerabilities

Answer 12

▪ System-specific conditions that create security weaknesses
● Common Vulnerabilities and Exposures (CVE)
o A list of publicly disclosed computer security weaknesses
● Zero-Day Vulnerability
o Any weakness in the system design, implementation,
software code, or a lack of preventive mechanisms in place
▪ CVEs (Known vulnerabilities)
▪ Zero-Day (Brand new vulnerability)

Question 13

Risk Management

Answer 13

The identification, evaluation, and prioritization of risks to minimize, monitor,
and control the vulnerability exploited by a threat

Question 14

Risk Assessment

Answer 14

▪ A process that identifies potential hazards and analyzes what could
happen if a hazard occurs
● Security
● Business

Question 15

Security Risk Assessment

Answer 15

Used to identify, assess, and implement key security controls within an
application, system, or network

Question 16

o Penetration Test

Answer 16

Evaluates the security of an IT infrastructure by safely trying to exploit
vulnerabilities within the systems or network

Question 17

Posture Assessment

Answer 17

Assesses cyber risk posture and exposure to threats caused by
misconfigurations and patching delays
● Define mission-critical components
● Identify strengths, weaknesses, and security issues
● Stay in control
● Strengthen position

Question 18

Security Principles
o Least Privilege

Answer 18

Using the lowest level of permissions or privileges needed in order to
complete a job function or admin task

Question 19

Discretionary Access Control (DAC)

Answer 19

An access control method where access is determined by the
owner of the resource
o Every object in a system has to have an owner
o Each owner must determine the access rights and
permissions for each object

Question 20

Mandatory Access Control (MAC)

Answer 20

An access control policy where the computer system gets to
decide who gets access to what objects
o Unclassified
Confidential
o Secret
o Top secret

Question 21

Role-Based Access Control (RBAC)

Answer 21

An access model that is controlled by the system but focuses on a set of
permissions versus an individual’s permissions
▪ Creating groups makes it easy to control permissions based around actual
job functions

Question 22

Zero-Trus

Answer 22

▪ A security framework that requires users to be authenticated and
authorized before being granted access to applications and data
1. Reexamine all default access controls
2. Employ a variety of prevention
techniques and defense in depth
3. Enable real-time monitoring and
controls to identify and stop
malicious activity quickly
4. Ensure the network’s zero-trust
architecture aligns to a broader
security strategy

Question 23

DMZ

Answer 23

A perimeter network that protects an organization’s internal local area
network from untrusted traffic

Question 24

Screen Subnet

Answer 24

Subnet in the network architecture that uses a single firewall with three
interfaces to connect three dissimilar networks
● Triple-homed firewall

Question 25

Separation of Duties

Answer 25

Prevent frauds and abuse by distributing various tasks and approval
authorities across a number of different users

Question 26

Honeypot/ Honeynet

Answer 26

Attracts and traps potential attackers to counteract any attempts at
unauthorized access to a network
▪ Think vertical through the layers as well as horizontal or lateral across the
network using screen subnets

Question 27

Multifactor Authentication

Answer 27

o Authenticates or proves an identity using more than one method
▪ Something you know
▪ Something you have
▪ Something you are
▪ Something you do
▪ Somewhere you are

Question 28

Dictionary Attack

Answer 28

▪ Guesses the password by attempting to check every single word or
phrase contained within a word list, called a dictionary
● Do not use anything that looks like a regular word

Question 29

Brute Force Attack

Answer 29

Tries every possible combination until they figure out the password
● Use a longer and more complicated password
o Uppercase
o Lowercase
o Numbers
o Special characters
● For good security, use a minimum of 12 characters

Question 30

Local Authentication

Answer 30

Process of determining whether someone or something is who or what it
● Claims itself to be
● Simplified version of X.500

Question 31

Lightweight Directory Access Protocol (LDAP)

Answer 31

▪ Validates a username and password combination against an LDAP server
as a form of authentication
● Port 389 LDAP
● Port 636 LDAP Secure

Question 32

o Active Directory (AD)

Answer 32

Organizes and manages everything on the network, including clients,
servers, devices, and users

Question 33

Kerberos

Answer 33

▪ Focused on authentication and authorization within a Windows domain
environment
▪ Provides secure authentication over an insecure network

Question 34

Remote Authentication Dial-In User Service (RADIUS)

Answer 34

Provides centralized administration of dial-up, VPN, and wireless network
authentication
● Authentication
● Authorization
● Accounting
o Commonly uses:
▪ Port 1812 Authentication messages
▪ Port 1813 Accounting messages
o Proprietary versions of RADIUS may also use:
▪ Port 1645 Authentication messages
▪ Port 1646 Accounting message

Question 35

o Terminal Access Controller Access Control System Plus (TACACS+)

Answer 35

Used to perform the role of an authenticator in an 802.1x network
● RADIUS (UDP)
● TACACS+ (TCP)
● Ensure Port 49 is open
● Excellent if using Cisco devices

Question 36

802.1x

Answer 36

▪ A standardized framework that’s used for port-based authentication on
both wired and wireless networks
● Supplicant
● Authenticator
● Authentication server

Question 37

Extensible Authentication Protocol (EAP)

Answer 37

Allows for numerous different mechanisms of authentication
● EAP-MD5
o Utilizes simple passwords and the challenge handshake
authentication process to provide remote access
authentication
● EAP-TLS
o Uses public key infrastructure with a digital certificate
being installed on both the client and the server
● EAP-TTLS
o Requires a digital certificate on the server and a password
on the client for its authentication
● EAP Flexible Authentication via Secure Tunneling (EAP-FAST)
o Uses a protected access credential to establish mutual
authentication between devices
● Protected EAP (PEAP)
o Uses server certificates and Microsoft’s Active Directory
databases to authenticate a client’s password
● Lightweight EAP (LEAP)
o A proprietary protocol that only works on Cisco-based
devices

Question 38

● Network Access Control (NAC)

Answer 38

o Ensures a device is scanned to determine its current state of security prior to
being allowed network access

Question 39

o Persistent Agent

Answer 39

A piece of software installed on a device requesting access to the
network

Question 40

Non-Persistent Agent

Answer 40

Requires the users to connect to the network and go to a web-based
captive portal to download an agent onto their devices

Question 41

IEEE 802.1x

Answer 41

Used in port-based Network Access Control
● Time-based
o Defines access periods for given hosts on using a timebased schedule
● Location-based
o Evaluates the location of the endpoint requesting access
using IP or GPS geolocation
● Role-Based (Adaptive NAC)
o Reevaluates a device’s authentication when it’s being used
to do something
● Rule-based
o Uses a complex admission policy that might enforce a
series of rules with the use of logical statements

Question 42

Physical Security
o Detection Methods

Answer 42

▪ Security control used during an event to find out whether or not
something malicious may have happened
● Wired
o Allows the device to be physically cabled from its camera
all the way to a central monitoring station
● Wireless
o Easier to install, but they can interfere with other wireless
systems, like 802.11 wireless networks

Question 43

Network Security Attacks

Answer 43

▪ Our security goals (CIA) are subject to attack
▪ Confidentiality attack
● Attempts to make data viewable by an attacker
▪ Integrity attack
● Attempts to alter data
▪ Availability attack
● Attempts to limit network accessibility and usability