Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

MC-CompTia Network+ (N10-008) > Section 15: Security Technologies > Flashcards

Section 15: Security Technologies Flashcards

1
Q

Firewall

A

Uses a set of rules defining the traffic types permitted or denied through device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Stateful Firewall

A

Inspects traffic as part of a session and recognizes where the traffic originated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

NGFW

A

NextGen Firewall (OSI Levels 5, 6, 7, using DPI Deep Packet Inspection)
▪ Third-generation firewall that conducts deep packet inspection and packet filtering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

ACL

A

Access Control List
▪ Set of rules applied to router interfaces that permit or deny certain traffic
● Switch - Will be based on MAC address
● Router - Will be based on IP address
● Firewall - Will be based on IP address or port
Using criterion based on:
▪ Source/destination IP
▪ Source/destination port
▪ Source/destination MAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Firewall Zone

A

Inside - Corporate/Local network
Outside - Internet
DMZ - Devices that with restricted access from the outside zone (like web servers).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

UTM

A

Unified Threat Management Device (Border device. Physical, Virtualized, or Cloud Solution)
▪ Combines firewall, router, intrusion detection/prevention system, anti-malware, and other features into a single device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

IDS

A

Intrusion Detection System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

IPS

A

Intrusion Prevention System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

IDS / IPS Signature-based Detection

A

Signature contains strings of bytes (a pattern) that triggers detection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

IDS / IPS Policy-based Detection

A

Relies on specific declaration of the security policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

IDS / IPS Statistical Anomaly-based Detection

A

Watches traffic patterns to build baseline.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

IDS / IPS Non-statistical Anomaly-based Detection

A

Administrator defines the patterns/baseline.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Network-based (NIDS/NIPS)

A

A network device protects entire network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Host-based (HIDS/HIPS)

A

Software-based and installed on servers and clients

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Remote Access: Telnet / Port

A

Port 23
▪ Sends text-based commands to remote devices and is a very old networking protocol
▪ Telnet should never be used to connect to secure devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Remote Access: Secure Shell (SSH) / Port

A

Port 22
▪ Encrypts everything that is being sent and received between the client and the server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Remote Access: Remote Desktop Protocol (RDP)

A

Port 3389
▪ Provides graphical interface to connect to another computer over a network connection (Use VPN or RDG for security)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Remote Access: Remote Desktop Gateway (RDG)

A

▪ Provides a secure connection using the SSL/TLS protocols to the server via RDP (Use for Win 2008 or later OSs)
● Create an encryption connection (No need for VPN)
● Control access to network resources based on permissions and group roles
● Maintain and enforce authorization policies
● Monitor the status of the gateway and any RDP connections passing through the gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Remote Access: Virtual Private Network (VPN)

A

▪ Establishes a secure connection between a client and a server over an untrusted public network like the Internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Remote Access: Virtual Network Computing (VNC) / Port

A

Port 5900
▪ Designed for thin client architectures and things like Virtual Desktop Infrastructure (VDI)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Remote Access: Virtual Desktop Infrastructure (VDI)

A

▪ Hosts a desktop environment on a centralized server
▪ Desktop as a Service (DaaS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Remote Access: In-Band Management

A

▪ Managing devices using Telnet or SSH protocols over the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Remote Access: Out-of-Band Management

A

▪ Connecting to and configuring different network devices using an alternate path or management network

24
Q

Remote Access Technologies Authentication Considerations

A

▪ Confirms and validates a user’s identity
▪ Gives the user proper permissions to access a resource

25
Q

Remote Access Authentication: PAP

A

Password Authentication Protocol (PAP)
▪ Sends usernames and passwords in plain text for authentication

26
Q

Remote Access Authentication: CHAP

A

Challenge Handshake Authentication Protocol (CHAP)
▪ Sends the client a string of random text called a challenge which is then encrypted using a password and sent back to the server

27
Q

Remote Access Authentication: MS-CHAP

A

▪ Microsoft proprietary version of CHAP that provides stronger encryption keys and mutual authentication

28
Q

Remote Access Authentication: EAP

A

Extensible Authentication Protocol (EAP)
▪ Allows for more secure authentication methods to be used instead of just a username and a password (Smart Card, Kerberos,…)
▪ Use EAP/TLS in conjunction with a RADIUS or TACACS+ server

29
Q

VPN / Types

A

Virtual Private Network -Extends a private network across a public network and enables sending and receiving data as if connected on that private network.

Three Main Types of VPN:
▪ Site to site - Connect two office
▪ Client to site - Single remote user to
▪ Clientless - Web browsing

30
Q

VPN Communication Method: Full Tunnel

A

▪ Routes and encrypts all network requests through the VPN connection back to the headquarters
- Best for security

31
Q

VPN Communication Method: Split Tunnel

A

▪ Routes and encrypts only the traffic bound for the headquarters over the VPN, and sends the rest of the traffic to the regular Internet
- Best for performance

32
Q

VPN: Clientless

A

▪ Creates a secure, remote-access VPN tunnel using a web browser without requiring a software or hardware client

33
Q

Secure Socket Layer (SSL)

A

▪ Provides cryptography and reliability using the upper layers of the OSI model, specifically Layers 5, 6, and 7
▪ Less Secure so Clientless VPNs are moving toward TLS

34
Q

Transport Layer Security (TLS)

A

▪ Provides secure web browsing over HTTPS
▪ SSL and TLS use TCP to establish their secure connections between a client and a server (Slower because of the TCP overhead. Could opt. for DTLS.)

35
Q

Datagram Transport Layer Security (DTLS)

A

▪ UDP-based version of the TLS protocol which operates a bit faster due to having less overhead (Better for Video Streaming, VOIP)

36
Q

VPN Protocol: Layer 2 Tunneling Protocol (L2TP)

A

Older protocol. Lacks security features like encryption by default and needs to be combined with an extra encryption layer for protection (Still used when used with an encryption protocol.)

37
Q

VPN Protocol: Layer 2 Forwarding (L2F)

A

Older protocol. Provides a tunneling protocol for the P2P protocol but also lacks native security and encryption features (Not used much)

38
Q

VPN Protocol: Point-to-Point Tunneling Protocol (PPTP)

A

Supports dial-up networks but also lacks native security features
(Microsoft added security features so it is considered pretty secure when used with Windows.)

39
Q

VPN Protocol: IP Security (IPSec)

A

▪ Provides authentication and encryption of packets to create a secure encrypted communication path between two computers. Most widely used protocol suite used with VPNs.

40
Q

IPSec 5 Step Process

A
  1. Key exchange request
  2. IKE (Internet Key Exchange) Phase 1: Main mode or aggressive mode
  3. IKE Phase 2
  4. Data transfer
  5. Tunnel termination
41
Q

Data Transfer Method: Transport Mode

A

▪ Uses packet’s original IP header (header not protected) and used for client-to-site VPNs
▪ Works well if cannot increase packet size. By default, maximum transmission unit (MTU) size in most networks is 1500 bytes

42
Q

Data Transfer Method: Tunneling Mode

A

▪ Encapsulates the entire packet and puts another header on top of it
▪ For site-to-site VPNs, you may need to allow jumbo frames

43
Q

AH

A

Authentication Header
▪ Provides connectionless data integrity and data origin authentication for IP datagrams and provides protection against replay attacks. (No confidentiality of the data.)

44
Q

ESP

A

Encapsulating Security Payload (No protection for the header.)
▪ Provides authentication, integrity, replay protection, and data confidentiality
▪ In transport mode, use AH to provide integrity for the TCP header and ESP to encrypt it
▪ In tunneling mode, use AH and ESP to provide integrity and encryption of the end payload

45
Q

SNMP

A

Simple Network Management Protocol (SNMP) is used to send and receive data from managed devices back to a centralized network management station.
(Message Types:
▪ Set (Manager to agent request to change value of variable or list of variables.),
▪ Get (Manager to agent to retrieve variable),
▪ Trap (Unsolicited. Sent asynchronously as notifications from agent to manager. Event or alarms.) messages)

46
Q

Syslog

A

System Logging Protocol (Syslog) - Sends system log or event messages to a central server, called a syslog server
● Security Information Management (SIM)
● Security Event Management (SEM)
● Security Information and Event Management (SIEM)

47
Q

Syslog Level 0

A

Emergency

48
Q

Syslog Level 1

A

Alert

49
Q

Syslog Level 2

A

Critical

50
Q

Syslog Level 3

A

Error

51
Q

Syslog Level 4

A

Warning

52
Q

Syslog Level 5

A

Notice

53
Q

Syslog Level 6

A

Information

54
Q

Syslog Level 7

A

Debugging

55
Q

SIEM

A

Security Information and Event Management (SIEM)
▪ Provides real-time or near-real-time analysis of security alerts generated by network hardware and applications
▪ Uses Syslog protocol to collect data using UDP Port 514 / TCP Port 1468
▪ Data will be classified based on log level 0-7
▪ The SIEM will Normalize, Correlate, Aggregate data for further analysis.

MC-CompTia Network+ (N10-008) (22 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions