Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cyber > Section 7: Delving into Network and Security Concepts > Flashcards

Section 7: Delving into Network and Security Concepts Flashcards

1
Q

What is the purpose of a web application firewall, and where is it normally placed?

A

Web Application Firewall (WAF) is normally installed on or before a web server. It’s job is to protect web apps from attack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is Implicit Deny, and which two devices does it effect?

A

Used by both the firewall and the router. If there is no allow rule, they get the last rule, which is deny all.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the firewall that does content filtering, URL filtering, and malware inspection?

A

Unified Threat Management (UTM), provides value for money.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which network device connects two networks?

A

Router. Works at Layer 3, Network Layer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which type of internal device connects users on the same network?

A

Switch. Normally in a star topology. Works at Layer 2, Data Link Layer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which type of device hides the internal network from hackers on the internet?

A

Network Address Translator (NAT).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What does an inline NIPS do?

A

Screens incoming traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which type of IPS protects virtual machines from attack?

A

Host-Based IPS (HIPS). Installed on the guest VM or computer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which type of of IPS is placed behind the firewall as an additional layer of security?

A

Network-Based IPS (NIPS). Prevents unauthorized access to the network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

If you don’t have a NIDS on your network, which device can passively monitor network traffic?

A

NIPS can fulfill functionality of a NIDS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the difference between a signature and anomaly-based NIDS?

A

Signature-based: works off a known of variants.

Anomaly-based: starts with the database and can learn about new patterns or threats. Also known as heuristic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the passive device that sits on your internal network?

A

NIDS. Can detect changes to your network using sensors and collectors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

If you receive an alert that server 1 has a virus, and you inspect the server to find there are no viruses, what is this known as?

A

False positive.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How can you prevent someone from accessing a medical center’s network by plugging their laptop into a port in the waiting room?

A

Enable port security, where you turn the port off on the switch.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How can you prevent someone from plugging a rouge access point into your network?

A

Enable 802.1x, which ensures that the device is authenticated before being able to use the port.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How do 802.1x and port security differ? Which one gives me more functionality?

A

A managed switch uses 802.1x, which authenticates the device but does not disable the port.

Port security disables the port.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the purpose of web caching on a proxy server?

A

Keeps copies of the web pages locally, ensuring faster access to the web pages and preventing the need to open a session to the internet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the purpose of a VPN?

A

Create a tunnel across unsafe networks from home or a hotel to the workplace.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What happens in the IKE phase of a VPN session?

A

Diffie Hellman, using port 500, sets up a secure session before the data is transferred.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the purpose of a VPN concentrator?

A

Set up a secure session for a VPN.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the most secure VPN tunneling protocol?

A

L2TP/IPSec. Uses AES encryption for the ESP.

22
Q

What modes would you use in a L2TP/IPSec tunnel over the internet and then internally?

A

Internet: Tunnel mode
Internal: Transport mode (between internal hosts)

23
Q

Which VPN session type would you use on a site-to-site VPN?

A

Always-on mode (as opposed to dial-on-demand). Can be used to create a point-to-point connection between the main and remote sites.

24
Q

What network device should you use to manage a high volume of web traffic?

A

Load balancer. Sends requests to the least-utilized node that is healthy.

25
Q

What type of network is used by a virtual network so that the route requests are forwarded to a controller?

A

Software-Defined Networking (SDN).

26
Q

What is the purpose of a screened subnet, and what type of web server is located there?

A

Boundary layer that hosts an extranet server. Sometimes known as extranet zone. Used to be called the DMZ.

27
Q

If you want to find out what attack methods a potential hacker is using, what do you need to set up?

A

Honeypot: a website with lower security to monitor the attack methods being used and then harden your actual web server against potential attacks.

28
Q

What is the purpose of network access control? Name two agents that it uses.

A

Ensures that devices connecting to your network are fully patched.

  1. Permanent
  2. Dissolvable (single-use)
29
Q

What type of device can be used to automate the collection of log files across many different devices?

A

SIEM server, which can correlate log files from many devices and notify you of potential attacks. Syslog server can also collect log files.

30
Q

If you wanted to back up data to a backup device but, at the same time, prevent someone from deleting the data, what device do you need to use?

A

Write-One Read-Many (WORM) Drive.

31
Q

Explain the port mirror process and name another device that could be used for the same process.

A

Makes a copy of the data going to a port and diverts it to another device for analysis.

A TAP can be used for the same purpose, but is more expensive.

32
Q

What type of records are created by DNSSEC?

A

RRSIG records are created for each DNS host and a DNSKEY record used to sign the KSK or ZSK.

33
Q

What are the two portions of an IPSec packet?

A
  1. Authenticated Header (AH), uses either SHA-1 or MD5
  2. Encapsulated Payload (ESP), uses DES, 3DES or AES
34
Q

How can you tell whether your laptop fails to get an IP address from a DHCP server?

A

You would receive a 169.254.x.x IP address, known as APIPA, which could be caused by network connectivity or resource exhaustion.

35
Q

What type of IP address is 2001:123A:0000:0000:aBC0:00AB:0DCS:0023 and how can you simplify it?

A

IPv6. Simplified by changing leading zeros to 2001:123A::aBC0:AB:dCS:23

36
Q

What is the benefit of an HTML 5 VPN?

A

No infrastructure needs to be setup as it uses certificates for encryption.

37
Q

What mode is an L2TP/IPSec VPN if it encrypts both the header and the payload?

A

Tunnel mode, which would be used externally.

38
Q

What is the purpose of a jump server?

A

Allows an administrator to connect remotely to the network. Can be placed in a screen subnet or LAN.

39
Q

What is load balancing persistence or affinity?

A

Where the host is sent to the same server for the session.

40
Q

What is the downside to using two load balancers in an active/active mode?

A

Both load balancers are working close to capacity. If one fails, the users would find that traffic is slower.

41
Q

Three different groups of workers are in an open plan office, and they are all connected to the same physical switch. What can be done to isolate them from each other?

A

A VLAN can be used for departmental isolation on the same switch.

42
Q

How does East-West traffic operate?

A

Moves laterally between servers within a data center.

43
Q

What is a zero-trust network and where is it likely to be used?

A

Where every user or device must prove their identity before accessing the network. This would be used in the cloud.

44
Q

Why would someone use Angry IP?

A

Angry IP is an IP scanner that would scan an IP range to determine hosts that are active or inactive.

45
Q

When can you use curl or nmap?

A

Banner grabbing: a technique used to gain information about a computer system on a network and the services running on its open ports.

46
Q

When would someone use the Harvester tool?

A

Collect email addresses of a particular domain from search engines like Google.

47
Q

How can an attacker find the DNS records from your domain?

A

Use the dnsenum tool.

48
Q

Why would you use the scanless tool?

A

Allows anonymous port scanning so that it cannot be traced back to you.

49
Q

What tools can you use as a sandbox to analyze files for malware?

A

Cuckoo, or create a virtual sandbox.

50
Q

What is the purpose of DHCP snooping?

A

Prevent rogue DHCP servers from operating openly on your network.

51
Q

What are the two main reasons why you would receive an APIPA address of 169.254.1.1?

A
  1. Resource exhaustion (DHCP server has run out of IP addresses)
  2. Network connectivity between client and DHCP server

Cyber (12 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions