Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

SCOR 350-701 > Network Visibility and Segmentation > Flashcards

Network Visibility and Segmentation Flashcards

1
Q

Is a unidirectional series of packets between a given source and destination

A

Flow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

In a “flow”, source , destination, source port, destination ports and ip protocols are often referred as?

A

five-tuple

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Flexible Netflow, Cisco’s next generation NetFlow can track a wide range of Layer 2, IPv4, and IPv6 flow information, such as?

A 
Source and Destination MAC
Source and Destination IPv4/IPv6
Souce and Destination Ports
ToS
DSCP
Packet and byte counts
Flow timestamps
Input and output interface
TCP flags and encapsulated protocol
Section of packet for deeper inspection
All field in ipv4 and ipv6
routing information
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q
  • Type of Netflow Cache
  • Default cache type. Entries in the flow are removed (aged out) based on the configured timeout active and timeout inactive seconds settings
A

Normal Cache

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q
  • Type of Netflow Cache

- Flow account for a single packet. Desirable for real-time traffic monitoring and DDOS detection

A

Immediate Cache

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q
  • Type of Netflow Cache

- Used to track a set of flows without expiring the flows from the cache. Entire cache is periodically exported

A

Permanent Cache

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Is a technology created by Cisco that provides comprehensive visibility into all network traffic that traverse a Cisco-supported device.

A

Netflow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Is a network appliance that functions similarly to a traditional packet capture appliance or IDS in that it connect into a Switch Port Analyzer (SPAN), mirror port or a Test Access port (TAP).

A

Cisco Stealthwatch Flow Sensor.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are network telemetry sources that ca also be correlated with Netflow while responding to security incidents and performing forensics

A 
DHCP logs
VPN Logs
NAT information
802.1x logs
server logs
web proxy logs
spam filter from email security appliance such as Cisco Email Security Appliance (ESA)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

is a network flow standard led by the internet engineering task force (IETF). It was created for a common, universal standard of export for the flow information from routers, switches, firewall and other infra devices. Documented thru RFC7011-7015 and 5103

A

IPFIX(Internet Protocol Flow Information Export)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

IPFIX defines different elements that are grouped into the following 12 categories

A
  1. identifiers
  2. metering and exporting process configuraiton
  3. metering and exporting process statistics
  4. IP header fields
  5. transport header fields
  6. sub-ip header fields
  7. derived-packet properties
  8. min/max flow properties
  9. flow timestamps
  10. per-flow counters
  11. miscellaneous flow properties
  12. padding
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q
  • Protocol used by IPFIX
  • Refer as simple state machine than feature provided by TCP
  • Combines the best effort reliability of UPD while still providing TCP-like congestion control
A

Stream Control Transmission Protocol (SCTP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q
  • Cisco Solution
  • Is a collection of services available in serveral cisco network infra devices to provide application level classification,monitoring and traffic control. Supported by Cisco ISR, Cisco ASR 1000, WLC.
A

Cisco Application Visilbility and Control (AVC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Netflow Deployment scenarios

A 
User access layer
Wireless lan
Data Centre
Internet Edge
Netflow site-to-site and remote access VPN
Netflow in cloud environments
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

This solutions allow network administrators and cybersecurity professionals to analyze network telemetry in a timely manner to defend against advance cyber threats

A

Cisco Stealtwatch

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

-Components of Cisco Stealtwatch

A physical or virtual appliance that collects Netflow data from infrastructure devices

A

FlowCollector

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

-Components of Cisco Stealtwatch

The main management applications that provides detailed dashboards and the ability to correlate network flow and events

A

Stealtwatch Management Console (SMC)

18
Q
  • Components of Cisco Stealtwatch

- Required to aggregate flows at the stealtwatch management console

A

Flow licences

19
Q

-Optional component of stealtwatch

A

FlowSensor and Flow Replicator

20
Q

-A Software as a Service (SaaS). Use to monitor many different public cloud environments such ash Amazon AWS, Google, Cloud Platform and Microsoft Azuere

A

StealtWatch Cloud

21
Q

Is the concept of proactively and actively searching for advanced threats that may evade your security products and capabilities

A

Threat Hunting with CiscoStealtwatch

22
Q

Can identify malicious (malware) communications in encrypted traffic through passive monitoring, the extraction of relevant data elements, and a combination of behavioral modeling and machine learning without decrypting the packet

A

Cisco Encrypted traffic Analysis(ETA)

23
Q

Is a cloud based Cisco Solution that uses machine learning and statistical modeling of networks. Creates a baseline of the traffic in your network and identifies anomalies. Can also analyze user and device behavior as well as web traffic to uncover malicious command and control communications and data exfiltration

A

Cisco Cognitive Threat Analytics (CTA)

24
Q

4 Steps in creating netflow

A
  • Define a flow record
  • Define a flow exporter
  • Define a flow monitor
  • Apply the monitor to an interface
25
Q

Configuring a flow record

A
  • config t
  • flow record record-1
  • match ipv4 destination address (key field use match)
  • collect interface input (non key field use collect)
  • end
26
Q

Configuring a flow exporter

A

-config t
-flow export exporter-1
-export-protocol netflow-v9
-destination 1.1.1.1
-transport udp 9995
end

27
Q

configuring a flow monitor

A
  • config t
  • flow monitor monitor-1
  • exporter exporter-1(name of recorder configured)
  • end
28
Q

Applying netflow to interface

A
  • interface gi0/0/1

- ip flow monitor monitor-1 input

29
Q
  • types of network segmentation
  • a segment of internal network that requires a higher degree of protection. Internal accessability is further restricted through the use of firewalls, vpns, vlans and network access control
A

Enclaved network

30
Q
  • -types of network segmentation
  • The internal network that is accessible to authorized users. External accessability is restricted thru the use firewalls and ips/ids devices.
A

Trusted network (wired or wireless)

31
Q
  • types of network segmentation

- A network that is designed to be internet accessible. Host like web-servers, email gateways are generally located

A

DMZ

32
Q
  • types of network segmentation

- A network that is specifically used by visitors to connect to internet

A

Guest network

33
Q
  • types of network segmentation

- a network outside your security controls

A

Untrusted network

34
Q

-Is a control plane protocol used to convey IP-to-SGT mappings to network devices when you cannot perform inline tagging. user tcp 64999

A

Scalable Group Tag Exchange Protocol (SXP)

35
Q

Command to enable netflow in NX-OS

A

feature netflow

36
Q

a micro segment in ACI is often reffered to as

A

uSeg EPGs

37
Q

Cisco ISE scales by deploying service instances

called “______” in a distributed architecture

A

personas

38
Q

Cisco ACI allows organization to automatically assign endpoints to logical security zone called? This is used to group VMs within a tenant and apply filtering and forwarding policies to them

A

Endpoint Groups (EPGs)

39
Q

Is the concept of proactivelly or actively searching for advance threats that may evade your security products and capabilities.

A

Threat Hunting

40
Q

Physical or virtual appliance that can generate NetFlow data when legacy Cisco network infrastructure components are not capable of producing line-rate,unsampled netflow data

A

Stealthwatch FlowGenerator

41
Q

Two minimum required components of Cisco Stealthwatch

A

SMC and FlowCollector

SCOR 350-701 (14 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions