Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Network Foundations > Network Security Operations > Flashcards

Network Security Operations Flashcards

1
Q

Blank start with understanding how a firewall is used to secure a network

A

Foundational Network security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is a barrier that intercepts and inspects traffic moving from one area of the network to another?

A

Firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What may be physical appliances or may be virtual appliances operating as a VMS.

A

firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the term for a firewall that operates as apps running on workstations and servers

A

host-based firewalls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

All firewalls have what in common that will determine whether the firewall will permit or deny traffic to pass on to its intended destination

A

Set of rules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Blank is a firewall that operates on layers 3 & 4.

A

Packet Filtering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Most networks equate what to layer 3 and what to layer 4

A

IP address
TCP or UDP port number

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Blank inspect incoming (ingress) and outgoing (egress) traffic and compare the attributes to a database of packet filter rules that determine if the movement is permitted

A

Firewalls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Name the five attributes in a packet filter

A

Protocol (typically IP)
Source of IP address
Destination IP address
Source TCP or UDP port number
Destination TCP or UDP port number

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Packet filters are only concerned with what of the packets and perform no level of inspections on the contents of the package

A

Address label (header)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What could pass through packet filtering undetected as long as the source and destination values were approved by the firewall rules

A

Dangerous payloads

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a device that operates as a middleman between two or more systems to help conceal the true nature of the client and server

A

Circuit Level Gateways

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

The circuit level gateway may change what two things to allow two networks to communicate that otherwise could not

A

IP address and TCP/UDP port number

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What does NAT stand for

A

Network address translation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What does PAT stand for

A

Port address translation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What refers to the connection state of a conversation between two computers

A

State

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What term operates on levels 3,4,5 that allows a firewall to identify traffic as conversational and automatically create temporary firewall rules to permit the response traffic to flow back to the sender

A

Stateful Inspection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

The goal of stateful inspections is to reduce what?

A

Firewall rules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

To combat malicious traffic passing into the network unchecked (packet filtering) , what was created as a middle-man that reads and parses the traffic payload before forwarding it (if safe)

A

Proxy servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Inspection of payload is commonly called what?

A

Application-aware firewalls or Layer-7 firewalls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What two things are advanced security solutions that can identify malicious traffic based on a database of known behaviors and payload signatures?

A

IDS and IPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What monitors networks to detect threats?

A

IDS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What intercepts and blocks threats?

A

IPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the term for when IDS and IPS attach to a network in listen-only mode, alerting a network admin if they detect any suspicious behavior

A

Tap mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What mode refers to the configuration required for an IPS to intercept and block suspicious traffic?

A

In-line mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is the term for when an IPS device blocks files known to carry viruses and malware, like .exe files

A

Reputation-based protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What device monitors the network to detect threats, listens passively and alerts network admins of suspicious behavior?

A

IDS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What device intercepts and blocks and creates choke points?

A

IPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Which layer includes protocols such as 802.3 and 802.11?

A

Layer 2 (data link)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is a layer 1 threat because it involves tampering with the physical cables of a victim’s network?

A

Wiretapping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Wiretapping, theft of devices, and unlocked equipment racks are all threats at what layer?

A

Layer 1 (physical)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What as a Layer 1 attack could interfere with a victim’s wireless network card and prevent him from communicating with a WAP?

A

Radio Jammer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What layer attack would a wireless deauthentication attack be?

A

Layer 2 (Data Link)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What type of attack involves sending a special frame to a WAP that disconnects it from the wireless network?

A

Wireless Deauthentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What can be the goal of deauthentication attacks?

A

Getting the wireless network password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What layer is an ARP poisoning attack?

A

Layer 2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What attack sends special frames to the network that quickly poison the switch’s internal traffic handling database?

A

ARP poisoning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What does FIB stand for?

A

Forwarding Information Base

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

The switch is a network device at what level?

A

Layer 2 (Data Link)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

An attacker can merge ARP poisoning with what to reconstruct and analyze the received frames to gather info for future attacks?

A

Packet Sniffer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Ethernet switches separate traffic into multiple logical networks called what?

A

Virtual local area network (VLANS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

A switch can operate in one of what two modes?

A

Access mode (untagged mode)
Trunk Mode (tagging mode)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What ports are used by servers and workstations assigned to a single VLAN?

A

Access Mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What ports are used to interconnect multiple switches or routers and carry traffic to multiple VLANS

A

Trunk mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What is a layer 2 attack that occurs when an attacker gets access to a computer connected trunk port that allows them to join a network that would not normally be available to them?

A

VLAN hopping attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What attack can be mitigated by following a switch vendor’s recommendation for VLAN configuration as well as designating computer switch ports as access mode?

A

VLAN hopping attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What layer attack is a ping attack?

A

Layer 3: Network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What can mitigate a ping attack?

A

Packet filtering firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Spoofing attacks can occur on what two levels?

A

Layer 2 (data Link) and Layer 3(network)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What does MAC stand for?

A

Media Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Which protocol is a connection-oriented protocol?

A

TCP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Which protocol is a connection-less protocol?

A

UDP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

A connection-oriented protocol provides what when data is sent between two computers?

A

Delivery confirmation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What tool can an attacker run that allows him to scan the victim’s computer for open ports that they could later attack?

A

Port Scanner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What helps against a port scanning attack?

A

Packet-filtering firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What layer does a port scanning attack work on?

A

Layer 4: Transport

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What is a commonly known port number?

A

TCP port 8080

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What is the practice of redirecting a commonly known port number in hopes of hiding that the computer is running a web browser?

A

Port redirection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What is a protocol at layer 5: Session?

A

Remote Procedure Call (RPC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What attacks are at layer 5?

A

RPC attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

How do you mitigate RPC attacks?

A

Regular operating system updates and patches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

What conceals data and is commonly performed at presentation level?

A

Encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Encryption at the presentation level uses what, which is the replacement for what?

A

Transport Layer Security
SSL protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

What attack occurs at Layer 6?

A

Man-in-the-middle attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

How do you mitigate man-in-the-middle attacks?

A

Use an Application-layer proxy or an IPS

66
Q

What does API stand for?

A

Application Programming Interface

67
Q

What can be attacked at Layer 7?

A

API

68
Q

How can you mitigate attacks via the API of you application?

A

By adding authentication

69
Q

What do security professionals use to detect problems and known bad code in an application?

A

Vulnerability scanner

70
Q

SQL injection, buffer overrun, and other take control attacks happen at what layer?

A

Layer 7: Application

71
Q

What are two other ways other than authentication that helps mitigate attacks at the application level?

A

Reverse Proxy system and an IPS device

72
Q

Encrypted data is referred to as what?

A

Ciphertext

73
Q

What is the proper term for an encryption algorithm?

A

Cipher

74
Q

What is also known as private key encryption that uses the same key to encrypt data as it does to decrypt data?

A

Symmetric key encryption

75
Q

The what of the symmetric key encryption depends on the complexity of the cipher and the key?

A

Security

76
Q

What is the most vulnerable point of a symmetric key encryption?

A

During key exchange

77
Q

What are the two advantages of a symmetric key encryption?

A

Simplicity
Speed

78
Q

What relies on two different keys to encrypt and decrypt traffic?

A

Asymmetric key encryption

79
Q

Asymmetric key encryption relies on what since customers have no reliable and secure means to exchange a secret key prior to data transfer?

A

Public key infrastructure

80
Q

In a PKI system, each party that can either send or receive data must first create a what that contains what two things?

A

Key pair
Public Key
Private key

81
Q

The key pair is created using what that enables one key to decrypt the ciphertext that the other key has written>

A

algorithm

82
Q

What feature is known as allowing anybody to decrypt your data who downloaded your public key guaranteeing that you haven’t changed it since creation?

A

Digital Signature

83
Q

Blank is one downside to asymmetric key ciphers?

A

Computational power

84
Q

What type of encryption uses a symmetric key to cipher, but exchanges that key by using an asymmetric key to have both speed and security?

A

Transport Layer Security (TLS)

85
Q

What uses algebraic structures to create a key that is even smaller than traditional asymmetric keys, yet is substantially more difficult to breach without the aid of quantum computers?

A

Elliptic Curve Cryptography (ECC)

86
Q

What is the most common forms of encryption found on the internet today?

A

SSL/TLS encryption

87
Q

What type of encryption creates a secure channel over the internet in order to exchange a public key in the form of a certification (certification authority like Verisign) issued by a well known authority that is presented to the public when the user connects to the website while the private key is kept on the webserver in secret and protected?

A

TLS

88
Q

When a client computer (the web browser) contacts the web server, the client initiates what that establishes a symmetric key that encrypts a token with the web server’s public key, ensuring that only a computer holding the private key can decrypt the token?

A

Encryption handshake

89
Q

What type of encryption provides an authentication and encryption solution that secures IP network traffic at Layer 3?

A

Internet Protocol Security (IPSEC)

90
Q

TLS encryption works at what layer?

A

Layer 6

91
Q

IPSEC encryption works at what layer?

A

Layer 3

92
Q

IPSEC encryption is commonly used to create what across the internet or other untrusted networks that allow computers to communicate with each other?

A

VPN tunnels

93
Q

IPSEC traffic is what and what, which allows the devices to create an encrypted tunnel that traffic may pass through.

A

Encapsulated and authenticated

94
Q

What hides the fact that the packets are flowing across an untrusted network and gives the client the illusion they are directly connected to each other in the same network in IPSEC encryption?

A

Encapsulation

95
Q

IPSEC encryption is composed of what which provides the encryption for the connection, and the security associations which define the algorithms to be used and the key exchange methods?

A

Authentication Header (AH) protocol

96
Q

IPSEC is often used with what negotiation that holds the tunnel?

A

Internet Key Exchange (IKE)

97
Q

What in IPSEC encryption is used to create encrypted IP packets for transferring data?

A

IPSEC keys

98
Q

Data payload in IPSEC is encrypted how?

A

DES or AES

99
Q

Data integrity in IPSEC encryption is ensured how?

A

One way hash functions (MD5 or SHA1)

100
Q

When data is stored in a permanent or semi-permanent state, the data is said to be at what and should be treated with the same level care as data in transit?

A

At rest

101
Q

What is the most secure algorithm for storing and encrypting data at rest?

A

Advanced Encryption Standard (AES)

102
Q

What is the term for a symmetric key cipher that makes use of different key and block sizes and creates a near-impenetrable encryption by using a series of transformations on plain text?

A

AES

103
Q

What three things all play a role in protecting data?

A

Data Classification
Data Protection
Encryption

104
Q

What is the term for identifying the type of data you are storing and creating policies that describe how to handle the data>?

A

Data classification

105
Q

What is the term for something that dictates how long a piece of data should remain active whether in day-to-day storage or in archive copies?

A

Retention policy

106
Q

Data stored in the public cloud is or isn’t backed up automatically and can be restored at any time?

A

Is not

107
Q

Sending backup from your onsite premises to the cloud would cause how much in network fees with a cloud provider?

A

Nothing

108
Q

What provides a physical safeguard for your data because even if the server is stolen, the data remains protected?

A

Encryption for data at rest

109
Q

What is the term for the thing used to encrypt and decrypt your data that must be kept from an attacker getting?

A

Data Encryption Key (DEK)

110
Q

What are the two ways to mitigate an attacker from getting access to your data through a DEK?

A

1) Rotate the DEK regularly
2) Seek a method that does not require you to expose the DEK to anybody

111
Q

What should you do to ensure you have a method that does not require you to expose the DEK to anybody?

A

Encrypt the DEK

112
Q

What does KMS stand for?

A

Key management System

113
Q

Data in transit is also known as what?

A

Data in flight

114
Q

What is the term that means users can can authenticate to your app using identity servers like Google or Facebook?

A

Federated Identity management

115
Q

What is the term for a secured region of your private network where firewalls are configured to carefully inspect and traffic entering and leaving the network and where an IPS can be implemented?

A

Extranet

116
Q

What stems from the idea that you will have to authenticate using different methods - what you know (username and password) and what you have (fingerprints or other biometric data)?

A

Multifactor Authentication (MFA)

117
Q

Most public cloud providers rely on what that may be a device or a virtual identification program that generates a PIN

A

Token

118
Q

What is a key chain-like device?

A

Key fob

119
Q

Public cloud providers keep detailed what that account the actions taken within your system to help you see changes and unauthorized use of privileged credentials?

A

Audit logs

120
Q

In a private cloud, who holds the final responsibility for all of the hardware and most, if not all, of the physical data center security concerns?

A

Owner of the equipment

121
Q

Who is generally responsible for the physical data center security in a public cloud?

A

Public Cloud provider

122
Q

Who typically owns the responsibility of security for the data center in a hybrid cloud service?

A

Whoever owns the equipment

123
Q

Whenever you connect to what, you are sending and receiving all of your data in the clear, meaning unencrypted?

A

Open Wi-Fi network

124
Q

What is the term for a symmetric encryption algorithm that uses the now antiquated DES (data encryption standard) algorithm three times in a row to encrypt your data?

A

3DES (triple DES)

125
Q

3DES uses only what bit encryption and can be compromised by brute force software running on modern hardware in less than a day?

A

56-bit

126
Q

What does AES stand for?

A

Advanced Encryption Standard

127
Q

What form of encryption is used by most wireless networks today?

A

AES

128
Q

AES can be used with what three bit lengths?

A

128-bit, 192-bit, or 256-bit

129
Q

Today, most AES use what bit length?

A

256-bit (AES-256)

130
Q

In AES, most modern processors support hardware acceleration via the CPU instruction set called what which allow the CPU to process AES encryption at very fast speeds?

A

AES-NI (AES new instruction)

131
Q

What does WEP stand for?

A

Wired Equipment Privacy

132
Q

What was the first wireless standards proposed by the IEEE in 1997 that was designed to provide the same level of security as wired networks?

A

WEP

133
Q

A WEP key is either 10 or 26 what?

A

hexadecimal

134
Q

In 2004, what did the WI-FI alliance deprecate?

A

WEP

135
Q

What was created by the WI-FI alliance and IEEE to overcome the weakness of WEP that was first released in 2003?

A

WPA (Wi-Fi Protected Access)

136
Q

In WPA, the key is a what that can range from 8-63 characters in length?

A

variable-length alphanumeric passphrase

137
Q

A difference between WEP and WPA was the addition of what, which gave WPA a significant security boost by generating a new 128 bit encryption key for every packet sent on the network (not the same key like in WEP)?

A

Temporal key integrity protocol (TKIP)

138
Q

What was introduced in 2004 and quickly became the standard for wireless security for the next 15 years?

A

WPA2

139
Q

What was the major difference between WPA and WPA2?

A

Counter Blocking Message Authentication Code (CCMP)

140
Q

What was designed to provide data confidentiality authentication and access control to WPA2?

A

CCMP

141
Q

What was released in 2018 that increases minimum key strength to 192 bits, provides SAE and PFS?

A

WPA3

142
Q

What does SAE stand for?

A

Simultaneous Authentication of Equals

143
Q

What is the term for the method to exchange the network key in personal mode by eliminating the need to tell others the key before connecting?

A

SAE

144
Q

What does PFS stand for?

A

Perfect forward secrecy

145
Q

What ensures that even if one session key is compromised that no past or future session’s data will be compromised, just that one session?

A

PFS

146
Q

In what wireless network infrastructure is all wireless communication performed in a peer-to-peer fashion and does not require of involve WAP?

A

Ad-hoc

147
Q

In what wireless network infrastructure is a WAP, or a wireless router, used to connect wireless devices to the network?

A

Infrastructure

148
Q

What is the security standard used to provide network access control at the port level and provides an authentication standard level based on Extensible Authentication Protocol (EPA)?

A

802.1x

149
Q

What does RADIUS stand for?

A

Remote Authentication Dial-In User Service

150
Q

What type of wireless attack is a DoS attack that can prevent access to a network, can force users to reconnect to the attacker’s point instead, and captures the 4-way handshake to gain intelligence to gain access to the corporate network?

A

Deauth attack

151
Q

What is the simplest defense against a deauth attack?

A

Use WPA3 since the management packets are encrypted

152
Q

In what attack, does the attacker set up an illegitimate wireless network to gain access to unencrypted data from the victim?

A

Fake Access

153
Q

How can you mitigate a fake access attack if you must use an unsecured network?

A

Create a VPN tunnel

154
Q

What are the three As in AAA?

A

Authentication, Authorization, and accounting

155
Q

What is the process of confirming a person’s identity?

A

Authentication

156
Q

What determines what the user may access?

A

Authorization

157
Q

What is auditing needed to verify the restrictions put in place are working?

A

Accounting

158
Q

What is the term for carefully reviewing the security settings, updating device software and testing the security of the device?

A

Device Hardening

159
Q

What are ten steps to harden devices?

A

1) Change Default Passwords
2) Remove unnecessary logins
3) Enforce a strong password policy
4) Remove unnecessary services
5) Keep patches up to date
6) Limit Physical Access to devices
7) Only allow for changes from a trusted network
8) Require Encryption for wireless networks
9) Control Audit access
10) Backup

160
Q

What is the common way to get audit logs?

A

Syslog

161
Q

How long before a vulnerability has to be publicly disclosed from discovery?

A

90 days

Network Foundations (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions