Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ 701 > Networks/Network Security (Ch. 3,4) > Flashcards

Networks/Network Security (Ch. 3,4) Flashcards

1
Q

OSI Model

A

_ open systems interconnection model layers (mnemonic: “all people seem to need data processing” – know layer numbers too)
_ (1) physical - hardware
_ (2) data link - switches that format data into data frames and route between systems on a local network using MAC addresses
_ (3) network - introduces IP addresses, routing between systems not on the same local network
_ (4) transport - end-to-end communication (e.g. TCP, UDP)
_ (5) session - establishes and manages sessions between apps
_ (6) presentation - translates data into standard format, provides encryption, compression, other data transformation
_ (7) application - provides network services to apps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

TCP

A

_ transmission control protocol
_ 3-way handshake (client sends SYN, server sends SYN/ACK, client sends ACK)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

UDP

A

_ user datagram protocol
_ connectionless (no 3-way handshake)
_ DoS attacks often use UDP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

IP

A

_ internet protocol
_ IPv4 - 32 bits, dot-delimited numbers
_ IPv6 - 128 bits, colon-delimited hex

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

ICMP

A

_ internet control message protocol
_ tests basic connectivity
_ includes tools like ping and traceroute
_ DoS often uses ICMP
_ firewalls and routers often block to prevent DoS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

TFTP

A

_ trivial file transfer protocol
_ transfers small amounts by FTP
_ used for comms with some devices
_ usually disabled to prevent attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

TLS

A

_ transport layer security
_ replaced SSL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

IPsec

A

_ internet protocol security
_ encrypts IP payload traffic
_ includes authentication header

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

SSH and SFTP port

A

22

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

HTTPS/TLS port

A

443

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

IMAP ports

A

_ internet message access protocol
_ 143 plaintext
_ 993 TCP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

SMTP ports

A

_ simple main transfer protocol
_ 25 plaintext
_ 587 TLS (SMTPS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

POP3 ports

A

_ post office protocol
_ 110 plaintext
_ 995 TCP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Email gateway

A

_ network device or software app that filters external mail for an internal mail system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

AD DS

A

_ Microsoft Active Directory Domain Services
_ uses TLS-encrypted LDAP
_ uses Kerberos for authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

RTP/SRTP

A

_ real-time transport protocol
_ for audio and video over IP
_ includes VoIP
_ SRTP secures transmission

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

SIP

A

_ session initiation protocol
_ inits and manages voice/video sessions
_ establishes RTP/SRTP connection in cleartext

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

RDP

A

_ remote desktop protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

OpenSSH

A

_ suite of tools that simplify use of SSH
_ supports SCP and SFTP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Create SSH key pair

A

_ ssh-keygen -t rsa
_ creates “id_rsa.pub”, the public key
_ creates “id_rsa”, the private key
_ use “ssh-copy-id” to copy public key to remove server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Private IPv4 addresses

A

_ any of form 10.x.y.z
_ 172.16.y.z - 172.31.y.z
_ 192.168.y.z
_ routers block all traffic from or to private IP addresses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Unique local IPv6 addresses

A

_ start with prefix FC00

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

DNS port

A

_ 53, for both TCP and UDP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

DNS zone record types

A

_ A - host record for IPv4
_ AAAA - host record for IPv6
_ PTR - pointer record, used to provide reverse lookup from IP to domain name
_ MX - mail exchange record identifying a mail server
_ CNAME - canonical name record (aka alias record), assigns additional domains to an IP
_ SOA - start of authority record, providing domain or zon info such as TTL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

TTL

A

_ time to live
_ duration of a DNS cache entry in seconds

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

DNS poisoning

A

_ replacing a DNS cache entry to an IP, causing domains to incorrectly resolve to the false IP
_ happens on the DNS server (DNS pharming is the client attack)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

DNSSEC

A

_ domain name system security extensions
_ adds a digital signature to each DNS cache entry, providing integrity and authentication to DNS replies
_ helps prevent DNS poisoning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Unicast

A

_ 1-to-1 traffic between IP addresses (intervening hosts may see the data, but they won’t process it)
_ can’t be captured by a protocol analyzer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

broadcast

A

_ 1-to-all traffic, sending traffic to all other hosts on a subnet using a broadcast address
_ 255.255.255.255 is an example broadcast address
_ every host processes broadcast traffic
_ switches pass broadcast traffic but not routers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

switch

A

_ devices connect to a switch’s physical ports
_ internally connects ports
_ when it receives a packet from a port, it knows the MAC address of the device at that port
_ to send a packet to a MAC address for which it doesn’t have a port mapping, it sends packet to all ports
_ can limit MAC addresses per port for security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

hub

A

_ broadcasts received data to all ports
_ switches provide better security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Switching loop

A

_ where output of one switch port enters another port of the switch
_ when looped data is broadcast, called a “broadcast storm”
_ can degrade performance
_ Spanning Tree Protocol (STP) can prevent this
_ Rapid STP can also prevent this
_ without prevention, easy to slow network to a crawl by connection two ports, such as within a conference room

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

BPDU

A

_ bridge protocol data unit
_ sent by STP (spanning tree protocol) to detect loops
_ edge ports should not be able to send this; if they do, problem discovered

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

router

A

_ routes traffic between network segments
_ don’t pass broadcasts between networks
_ each segment also called a “broadcast domain”
_ can implement ACL rules based on IP and port

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Implicit deny

A

_ principle of ACLs by which all traffic that isn’t explicitly allowed is implicitly denied
_ the last rule of an ACL, if not the default behavior
_ routers and firewalls include the implicit deny rule

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Default gateway

A

_ IP address of the router on the network
_ typically provides a path to the Internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

route command

A

_ shows known paths to other networks
_ shows the default gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

SNMP

A

_ simple network management protocol
_ monitors and manages network devices such as routers and switches
_ can monitor device config
_ can have devices report status
_ can install agents on devices
_ only use SNMPv3, as it encrypts credentials
_ SNPMPv3 uses ports 161 and 162

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Host-based firewall

A

_ monitors traffic to and from a single host (server or workstation)
_ many OSs provide a software-based firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Network-based firewall

A

_ usually a network appliance
_ has 2 or more NICs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Stateless firewall

A

_ applies ACL rules to traffic
_ a router is a stateless firewall
_ rules may specify protocol, source, destination, and port, in addition to the associated permission. Source and destination can include wildcards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Stateful firewall

A

_ bases decisions on traffic context or state
_ tracks sessions (e.g. after TCP handshake)
_ blocks traffic not part of a session
_ operate on transport layer (layer 4)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

WAF

A

_ web application firewall
_ placed between web server and clients
_ can protect against XSS and other attacks
_ provides HTTP security on top of network security provided by a network firewall
_ analyzes all layers of firewall, so called a “layer 7 firewall”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

First generation firewall

A

_ packet-filtering firewall
_ stateless
_ based decisions per packet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Second generation firewall

A

_ stateful
_ evaluates based on session state

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

NGFW

A

_ next-generation firewall
_ understand traffic for various apps
_ provides app-level inspection
_ performs content filtering and URL filtering
_ analyzes all layers of firewall, so called a “layer 7 firewall”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Failure modes

A

_ fail-open system - everything passes through when system fails, so no traffic disruption, but also no security
_ fail-closed system - nothing passes through when system fails, traffic disruption but provides security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Security zones

A

_ portion of network with its own security characterization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Screened subnet

A

_ aka demilitarized zone (DMZ)
_ security zone between private network and the Internet
_ by a firewall on both external and internal sides
_ contains servers that are to be available to the Internet, such as mail server, web server, and CA server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

NAT

A

_ network address translation
_ translates public IP addresses to private IP addresses and back to public addresses
_ hosted by a NAT gateway
_ prevents public IPs from having to be purchased for each client
_ hides internal computers from the Internet
_ not compatible with IPsec

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Static NAT

A

_ maps a private IP to a single public IP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Dynamic NAT

A

_ maps multiple public IPs, choosing based on load

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

ICS

A

_ industrial control system

54
Q

SCADA

A

_ supervisory control and data acquisition
_ typically for industrial control
_ physically isolated from other networks
_ has embedded systems that control an ICS
_ e.g. for power plants, manufacturing plants, etc.

55
Q

Air-gapped system

A

_ a system or network that is not connected to any other system

56
Q

Network segmentation

A

_ routers segment traffic between networks

57
Q

subnetting

A

_ dividing large address ranges into smaller ranges

58
Q

VLAN

A

_ virtual local area network
_ uses switches to group computers into a virtual network, rather than just by using cabling
_ dynamically reconfigurable
_ can separate traffic type (e.g. minimize traffic by putting those who use VoIP on their own VLAN)

59
Q

East-west traffic

A

_ traffic between servers
_ diagrams usually show servers side-by-side with clients above or below them

60
Q

Proxy server

A

_ aka forward proxy server
_ forwards requests from client to servers
_ serves a private network forwarding to the Internet
_ performs intermediary services, such as caching or filtering
_ admins configure clients to use proxy servers for specific protocols

61
Q

Agent-based proxies

A

_ sit on each computer, proxying from there

62
Q

Reverse proxy

A

_ accepts requests from the Internet
_ usually the front end for web server, which can therefore be behind a firewall
_ caches web pages to improve performance

63
Q

Load balancer

A

_ a kind of reverse proxy server
_ forwards to multiple backend web servers

64
Q

Transparent vs non-transparent proxy servers

A

_ transparent proxy servers forward requests without modifying them.
_ non-transparent proxy servers filter out access to specify URLs.

65
Q

UTM

A

_ unified threat management
_ security service bundles
_ available within a single appliance
_ might do URL filtering (like a proxy server)
_ might do malware/content inspection
_ might mitigate DDoS (the way an IPS does)
_ placed at boundary with the Internet

66
Q

Jump server

A

_ aka jump box
_ a hardened server used to access and manage devices in a different security zone
_ often allows a passwordless SSH login for connecting to a remote server
_ e.g. to connect to a device via a jump server, enter “ssh -J maggie@jump maggie@ca1”, which has the jump server TCP-forward to the CA server
_ target systems should only allow connections from the jump server

67
Q

ZTNA

A

_ zero trust network access
_ trust decisions are not based on location (e.g. within the same local network)
_ use authentication and policy-based access control

68
Q

Adaptive identity authentication

A

_ means of authentication may vary by user location

69
Q

Control and data planes

A

_ control plane controls and configures the network
_ data plane is where users and software communicate

70
Q

PEP

A

_ policy enforcement point
_ used in zero trust networks as a gatekeeper for accessing resources
_ uses adaptive identity authentication

71
Q

Components of a zero-trust control plane

A

_ PE (policy engine) - decides whether to grant resources to a given subject
_ PA (policy administrator) - communicates decisions made by the PE to the tools that enforce those decisions, specifically the PEP
_ PEP (policy enforcement point) - gatekeeper for accessing resources, using adaptive identity authentication, enforcing authorization in the data plane

72
Q

SASE

A

_ secure access service edge
_ cloud service that builds on zero-trust
_ provides firewall services
_ provides secure web gateway services
_ provides anti-malware service
_ provides intrusion prevention services
_ provides cloud access broker (CASB) services
_ provides data loss prevention (DLP) services

73
Q

Intranet vs. extranet

A

_ intranet is for internal users
_ extranet is for internal users and authorized external users

74
Q

IPS

A

_ intrusion prevention system
_ a kind of intrusion detection system (IDS)
_ reacts to attacks in progress to prevent them from reaching systems and networks
_ “in-line” with traffic (all traffic passes through)
_ can block traffic

75
Q

HIDS

A

_ host-based intrusion detection system
_ software installed on workstation or server
_ monitors traffic passing through the NIC
_ many also monitor application traffic
_ some monitor log files or system resources
_ can detect malware that antivirus programs might miss

76
Q

Port tapping

A

_ aka port mirroring
_ configuration of a switch or router that sends all traffic to a single port, where it can be monitored

77
Q

NIDS

A

_ network-based intrusion detection system
_ admin installs NIDS sensors (aka collectors) on network devices to gather info and report to the NIDS
_ often includes a sensor on a port tap
_ can only analyze plaintext traffic
_ provides a monitoring console

78
Q

Signature-based IDS

A

_ aka definition-based IDS
_ uses a database of known vulnerabilities or known attack patterns

79
Q

Trend-based detection

A

_ aka anomaly detection
_ compares current network behavior to a previously established baseline behavior
_ can be effective at discovering zero-day exploits, which don’t yet have signatures
_ admin should establish a new baseline every time they make a significant change to the network
_ rules assign thresholds at which point to consider recurrence of a behavior an attack

80
Q

SYN flood attack

A

_ DoS attack
_ attacker sends many SYN packets without ever ACKing the returned SYN/ACK packets
_ a server can limit the number of resources made available to connections to prevent it from crashing due to running out of resources
_ IDS can detect this, IPS can stop it
_ a firewall can also guard against SYN flood attacks

81
Q

IDS aggregator

A

_ stores log entries from dissimilar systems
_ IDS analyzes they log entries for insights
_ logs may be collected in batches or in realtime

82
Q

NOC

A

_ network operations center

83
Q

NIPS

A

_ network intrusion prevention system

84
Q

RAT

A

_ remote access trojan
_ allows outsiders to work inside a network
_ reason to have IDS/IPS even within an assumed-secure network

85
Q

honeypot

A

_ server with intentional vulnerabilities and fake data
_ allows security to gather info on attackers

86
Q

honeyfile

A

_ file designed to attract an attacker by its file name

87
Q

honeytoken

A

_ a fake datum or record maintained to see where else it ends up
_ if it ends up anywhere else, it was stolen

88
Q

WLAN

A

_ wireless local area network

89
Q

AP

A

_ wireless access point
_ connects wireless clients to a wired network
_ can also be routers, in which case both wired ports and wireless connections use an internal switch

90
Q

SSID

A

_ service set identifier
_ name of a wireless network
_ default SSIDs tell attackers what type of AP it is
_ broadcasts of SSID tell users of your device but can be disabled

91
Q

MAC filtering

A

_ restricts access to allowed MAC addresses
_ a wireless sniffer can discover the allowed MAC addresses, telling attacker what MAC to use

92
Q

MAC address cloning

A

_ allows a workstation to use the MAC of its internet-facing router

93
Q

Wireless footprinting

A

_ detailed diagram of wireless APs, hotspots, and dead spots

94
Q

WEP and WPA

A

_ Wired Equivalent Privacy
_ Wi-Fi Protected Access
_ poor security
_ no longer used

95
Q

RADIUS

A

_ remote authentication dial-in user service
_ aka diameter server
_ central authentication service VPNs can use
_ helps companies having many offices with different VPN servers
_ usually accesses an LDAP server
_ during sign-on, only encrypts password
_ uses EAP to encrypt sessions

96
Q

WPA2

A

_ Wi-Fi Protected Access 2
_ uses CCMP to protect traffic
_ CCMP is based Advanced Encryption Standard (AES)
_ not the best security available
_ has modes: open (cleartext), anonymous pre-shared key (PSK), or enterprise (authenticates with a RADIUS/802.1X server)
_ enterprise mode requires the RADIUS IP and port, and a shared secret
_ home networks typically use PSK

97
Q

WPA3

A

_ Wi-Fi Protected Access 3
_ enhanced open mode - allows unauthenticated users but encrypts data (replaces WPA2 open mode)
_ simultaneous authentication of equals (SAE) mode - uses a passphrase plus additional security (replaces WPA2 PSK mode)
_ enterprise mode - supports RADIUS server w/ individual authentication

98
Q

EAP

A

_ extensible authentication protocol
_ allows two systems to create a secure encryption key (aka pairwise master key or PMK)
_ Uses a pairwise transient key (PTK) to encrypt data between devices
_ used in CCMP

99
Q

PEAP

A

_ protected EAP
_ builds on EAP
_ encapsulates communication in a TLS tunnel
_ requires the server to have a certificate
_ helps compensate for lack of physical security

100
Q

EAP-FAST

A

_ EAP-flexible authentication via secure tunneling
_ secure replacement for Cisco’s LEAP (Lightweight EAP)
_ supports protected access credential (PAC) instead of certifications

101
Q

EAP-TLS

A

_ EAP transport layer security
_ “one of the most secure EAP standards”
_ like PEAP but also requires clients to have certificates

102
Q

EAP-TTLS

A

_ EAP-tunneled TLS
_ extension of EAP-TLS
_ allows older auth methods such as PAP
_ only requires a certificate on the server

103
Q

RADIUS federation

A

_ single-sign-on federated access

104
Q

IEEE 802.1X

A

_ a port-based authentication protocol
_ requires authentication to a wireless AP or a physical port
_ block access to network if not authenticated
_ prevents port access from being sufficient to send traffic over a network
_ used in both wireless and wired networks
_ used in VPNs
_ can be used in VLANs to control access to resources

105
Q

Captive portal

A

_ way of forcing web browsers to complete a process before giving them access to a network
_ common for free internet access points
_ cheaper alternative authentication than 802.1X

106
Q

Disassociation attack

A

_ a client ends its association with an AP by sending a “disassociation frame” that includes the client’s MAC address
_ any device on the network can sniff the MAC and send the dissociation frame to disconnect any device
_ some hotels do this with wireless hotpots to force customers to use their paid internet service

107
Q

WPS

A

_ Wi-Fi Protected Setup
_ allows users to configure wireless devices without typing in a passphrase
_ users press buttons or enter a PIN
_ susceptible to brute-force attacks with WPA2
_ safe with WPA3
_ experts recommend disabling WPS

108
Q

Rogue access point

A

_ aka counterfeit access point

109
Q

Data exfiltration

A

_ unauthorized transfer of data to a location controlled by an attacker

110
Q

Evil twin

A

_ rogue access point with the same SSID as (or similar to) a legit access point
_ when set up in a public area, users may connect to it instead of the desired AP
_ wireless scanners can detect evil twins during site surveys

111
Q

Jamming attack

A

_ transmits noise or other radio data on the frequency used by the wireless network

112
Q

IV attack

A

_ initialization vector attack
_ some encryption systems require pre-sharing a key
_ the smaller the key, the more likely it will eventually get reused
_ an attack can add data to the network to force cycling through keys faster, until the attacker’s guessed key works

113
Q

NFC attack

A

_ near field communication (NFC) attack
_ contactless near-device communication
_ an antennae can boost NFC range to allow an attacker to intercept

114
Q

RFID attack

A

_ radio-frequency identification attack
_ RFID tags are placed on inventory to manage it
_ various obvious attacks

115
Q

bluejacking

A

_ sends unsolicited messages to bluetooth devices
_ annoying but harmless

116
Q

bluesnarfing

A

_ unauthorized access to or theft of info from a bluetooth device

117
Q

bluebugging

A

_ a kind of bluesnarfing
_ attacker installs a backdoor to have the device call the attacker at any time to listen in on conversations in a room or on a phone call
_ can enable call forwarding, send messages, etc.

118
Q

Bluetooth pairing

A

_ manual pairing of bluetooth devices eliminates most attacks

119
Q

War driving

A

_ practice of looking for vulnerable wireless networks
_ used by attackers in cars or walking around a city
_ useful for finding vulnerabilities as part of an audit

120
Q

War flying

A

_ war driving done from planes or drones

121
Q

VPN concentrator

A

_ dedicated device providing services need for a VPN
_ typically goes in the screened subnet, selectively routing external (firewall-provided) traffic to the intranet

122
Q

VPN server

A

_ software equivalent of a VPN concentrator
_ uses RADIUS for authentication, which might delegate to LDAP
_ implements IPsec tunnel mode

123
Q

IPsec tunnel mode

A

_ encrypts entire IP packets, including headers
_ internal IP and MAC addresses are encrypted
_ attacker can only see address of client and address of the VPN server

124
Q

IPsec transport mode

A

_ only encrypts payload
_ includes authentication header

125
Q

Split vs full tunnel

A

_ split tunnel allows client to hit Internet directly, only tunneling for internal resources
_ full tunnels all traffic

126
Q

NAC

A

_ network access control
_ continuously monitors computers
_ blocks computer access to network if it doesn’t pass inspection (health checks such as using a firewall, OS is up-to-date and patched, using antivirus software)
_ good for controlling access from 3rd party computers or devices
_ useful on VPNs where random devices connect
_ can redirect unhealthy clients to a “remediation network”

127
Q

PAP

A

_ password authentication protocol
_ used with PPP (point-to-point protocol)
_ sends passwords in cleartext
_ was used with dial-up connections

128
Q

CHAP

A

_ challenge handshake authentication protocol
_ uses PPP
_ client and server hashes password with a shared secret and nonce (number used once)

129
Q

TACACS+

A

_ alternative to RADIUS
_ encrypts entire authentication process, not just password
_ unlike RADIUS, uses multiple challenges to authenticate
_ can interact with Kerberos
_ can authenticate users before they access a router or switch

130
Q

AAA protocols

A

_ provide authentication, authorization, and accounting
_ e.g. RADIUS, TACACS+, Diameter
_ (Kerberos doesn’t provide accounting services on its own)

Security+ 701 (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions