Section 16: Network Hardening

Question 1

Patch Management

Answer 1

Planning, testing, implementing, and auditing of software patches
▪ Provides security
▪ Increases uptime
▪ Ensures compliance
▪ Improves features

Question 2

Patch Management: Planning

Answer 2

▪ Tracks available patches and updates and determines how to test and deploy each patch

Microsoft End Point Configuration manager, patch management server, Mobile device management,

Firmware managers: Cisco UCS Manager, ManageEngine Device Expert

Question 3

Patch Management: Testing

Answer 3

▪ Tests any patch received from a manufacturer prior to automating its deployment through the network
▪ Have a small test network, lab, or machine for testing new patches before deployment

Question 4

Patch Management: Implementing

Answer 4

▪ Deploys the patch to all of the workstations and servers that require it
▪ Disable the Windows Update service from running automatically on the workstation
▪ Also implement patching through a mobile device manager (MDM), if needed

Question 5

Patch Management: Auditing

Answer 5

▪ Scans the network and determines if the patch was installed properly and if there are any unexpected failures that may have occurred
▪ Also conduct firmware management for your network devices (Microsoft SCCM, Linux RPM)

Question 6

Inspection and Policing: DAI

Answer 6

Dynamic ARP Inspection (DAI)
▪ Validates the Address Resolution Protocol (ARP) packets
▪ Only valid ARP requests and responses are relayed
▪ Invalid ARP packets are dropped

Question 7

Inspection and Policing: DHCP Snooping

Answer 7

DHCP Snooping
▪ A layer two security protocol that inspectd DHCP traffic and filters untrusted DHCP packages.

Question 8

Inspection and Policing: Untrusted Interface

Answer 8

Untrusted Interface
▪ Any interface that is configured to receive messages from outside the network or firewall

Question 9

Inspection and Policing: Trusted Interface

Answer 9

Trusted Interface
▪ Any interface that is configured to receive messages only from within the network
▪ Configure switches and VLANs to allow DHCP snooping

Question 10

Inspection and Policing: IPv6 RA-Guard

Answer 10

IPv6 Router Advertisement Guard (RA-Guard)
▪ Mitigates attack vectors based on forged ICMPv6 router advertisement messages
▪ Operates at Layer 2 for IPv6 networks to specify which interfaces are not allows to have router advertisements

Question 11

Inspection and Policing: CPP

Answer 11

Control Plane Policing (CPP)
▪ Configures a QoS filter that manages the traffic flow of control plane packets to protect the control plane of Cisco IOS routers and switches
● Data plane
● Management plane
● Control plane
● Service plane