Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Securing Your Network > Securing Your Network > Flashcards

Securing Your Network Flashcards

1
Q

Difference between IDS and IPS

A

IDS - identify threats and provides alerts

IPS - Identify threats and reacts to threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Difference between HIDS and NIDS

A

HIDS - host based and traffics goes through a NIC

NIDS - Network based

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

The two types of detection methods used in IDS

A

Signature-based aka definition

Heuristic / behavioral based aka anomaly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

The difference between SYN flood guard and flood guard on a switch

A

SYN Flood guard - Usually included in firewalls

Flood Guard on switch - Used to prevent MAC flood attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Difference between false positives and false negatives in regards to IDS

A

False Positive - An alarm or alert on an event that is non-threatening.

False Negative - When an attack is occurring but the IDS does not identify the threat.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the threshold range of IDS. What is the result of the threshold being to low or to high

A

1 to 1000.
Too Low - IDS will raise too many alerts on events that are legitimate.
Too High - IDS will fail to identify threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Intrusion system that is in-line aka in-band

A

IPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Intrusion system that collects data passively or out-of-band

A

IDS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Intrusion system that have protocol analyzer capabilities

A

Both IDS and IPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the disadvantage of an active NIDS

A

It blocks an attack only after the attack has started

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Hardware devices that focus on handling TLS traffic. Allows systems to off-load encryption workload to a separate hardware device to alleviate stress on computer resources.

A

SSL/TLS Accelerator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Used in conjunction with NIPS to mitigate threats that use encryption technologies.

A

SSL Decryptors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

It uses virtualization technologies to separate data and control planes within a network. Commonly used with ABAC.

A

SDN - Software Defined Network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

A port based authentication protocol that authenticates prior to granting access to a network

A

IEEE 802.1x

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Methods used to authenticate VPN clients before they connect

A

Implement IEEE 802.1x as Remote Authentication Dial-In User Service (RADIUS) or Diameter Server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

The two distinctions of wireless AP

A
  • All wireless routers are AP’s

- Not all AP’s are wireless routers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

A stand alone, intelligent, or autonomous AP, includes everything needed to connect wireless clients to a wireless network

A

Fat AP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Is not a stand alone AP

A

Thin AP or controller-based AP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

This identified an AP or wireless network

A

SSID - Service Set Identifier

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Disabling SSID is a sure way to deny an attacker from finding a network. True or False

A

False. Makes it more difficult but an attacker can find it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

How would an attacker over-ride MAC Filtering.

A

An attacker could sniff an allowed mac address and spoof the address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

A strong security protocol for wireless networks

A

WPA2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is the replacement for WPA

A

WPA2 aka 802.11i

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What encryption method does WPA and WPA2 use

A

WPA - Temporal Key Integrity Protocol (TKIP)

WPA2 - Chaining Message Authentication Code Protocol (CCMP)

25
Q

Strong encryption based on Advanced Encryption Standard (AES)

A

CCMP - Chaining Message Authentication Code Protocol

26
Q

Description of PSK, Enterprise, and Open modes

A

WPA/WPA2 modes.

PSK - Pre-shared Keys - uses a passphrase. Provides authorization without authentication.

Enterprise - Uses 802.1x server and RADIUS to provide authorization with authentication.

Open - Open access. No security is enabled for network access

27
Q

What is the RADIUS port

A

1812 but some use vendors use 1645

28
Q

What are the 6 Authentication Protocols

A

EAP - creates secure encryption key aka Pairwise Master Key
EAP FAST - Cisco -supports certificates (optional)
PEAP - Encrypts EAP with TLS. Requires certificate on Server
EAP-TTLS - Extension of PEAP. Requires certificate on 802.1x server.
EAP TLS - Most secure. Requires certificates on 802.1x server and each of the wireless clients
RADIUS Federation -

29
Q

A technical solution that forces clients using web browsers to complete a specific process before it is allowed access to a network.

A

Captive Portal

30
Q

What two security protocols are considered the strongest for wireless networks.

A

WPA2 using CCMP

31
Q

A type of attack that removes a wireless client form a wireless network.

A

Disassociation Attack

32
Q

This allows users to configure wireless devices without typing in a passphrase. It is also susceptible to brute attacks and therefore should be disabled.

A

WPS - Wifi Protected Setup

33
Q

Difference between a Rogue AP and an Evil Twin

A

Rogue AP - Illegal Access Point

Evil Twin - Deliberately set up to look like a legitimate Access Point.

34
Q

A DOS attack that prevents users from connecting to a wireless network by transmitting noise or another radio frequency on the same frequency as the network.

A

Jamming Attack

35
Q

A type of attack that attempts to discover the pre-shared key from the IV. WEP is susceptible. The attack is successful when an encryption system reuses the IV.

A

Initiation Vector attack.

36
Q

A type of attack that eavesdrops communication between mobile devices

A

NFC Attack - Near Field Communication

37
Q

Define Bluejacking, Bluesnarfing, Bluebugging

A

Bluejacking - unauthorized messages are sent to devices. Harmless
Bluesnarfing - attacker gains access to information on bluetooth device
Bluebugging - attacker gains access and control of device.

38
Q

A type of attack that captures data between two entities and modifies to impersonate the data of one of the entitites

A

Replay Attack - WPA and TKIP is susceptible to this attack.

39
Q

RFID attacks include the following

A

Sniffing or eavesdropping
Replay
DoS

40
Q

A dedicated device use by large organization to provide VPN capabilities

A

VPN Concentrator - placed in the DMZ.

41
Q

A method of encrypting data in transit that support both transit and tunnel mode.

A

IPsec

42
Q

IPsec support two modes. Which is one is used in a VPN.

A

Transit and Tunnel. Tunnel mode is used for VPN’s

43
Q

IPsec. Provides security in three ways. What are they.

A

AH - Authentication Header. Port id 51. Provides Authentication and Integrity.
Encryption - Encapsulating Security Payload (ESP). Port ID 50. ESP provides Authentication, Integrity, and Confidentiality
IKE - Internet Key Exchange - UDP port 500 to authenticate clients.

44
Q

What tunneling protocol uses TLS. What port?

A

Secure Socket Tunneling Protocol. TCP 443.

45
Q

Split Tunnel vs Full Tunnel

A

Split - IPsec configured to determine what traffic should be encrypted.

Full - All traffic is encrypted.

46
Q

A VPN configuration model in which two networks separated geographically are connected by two VPN Servers

A

Site to Site VPN’s

47
Q

VPN configuration that can be both site to site and remote access VPN

A

Always on VPN

48
Q

Provides a way to monitor and inspect computers to mitigate risks of remote access to a private network. Can inspect internal clients.

A

NAC - Network Access Control

49
Q

What happens when client doesn’t meet health conditions set forth by a NAC.

A

Client goes to remediation network aka quarantine network

50
Q

A type of NAC agent that is installed on a client and stays on the client in order to streamline NAC from remote connections

A

Permanent Agent

51
Q

A type of NAC agent that is downloaded and run on the client when the client logs on remotely

A

Dissolvable Agent.

52
Q

What are the 7 remote access authentication mechanisms

A

PAP - Password Authentication Protocol
CHAP - Challenge Handshake Authentication Protocol
MSCHAP
MSCHAPv2
(RADIUS) Remote Authentication Dial-In User Service
DIAMETER
Terminal Access Controller Access-Control System Plus (TACACS+)

53
Q

What is PAP

A

Password Authentication Protocol - uses Point to Point Protocol (PPP) and not secure because data is sent clear text

54
Q

What is CHAP

A

Challenge Handshake Authentication Protocol uses PPP but is more secure because it uses hashing.

55
Q

What is MS-CHAP and MS-CHAPv2

A

Microsoft version of CHAP. CHAPv2 does mutual authentication.

56
Q

What is RADIUS

A

A centralized authentication service. Can also be used with 802.1x server with WPA enterprise mode.

57
Q

What is TACACS+

A

Terminal Access Controller Access-Control System Plus - Cisco alternative to RADIUS but encrypts entire authentication process and uses multiple challenges and responses between client and server. Can be used with Kerberos.

58
Q

What is Diameter

A

An extension of RADIUS and has more capabilities. It uses TCP instead of UDP.

59
Q

What remote access authentication systems are AAA protocols

A

AAA - Authentication Authorization Accounting.

RADIUS
Diameter
TACACS+

Kerberos is not. It doesn’t do accounting.

Securing Your Network (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions