Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CompTIA Network+ (N10-008) > Security Technologies (1.5, 2.1, 3.1, 4.1, 4.3 & 4.4) > Flashcards

Security Technologies (1.5, 2.1, 3.1, 4.1, 4.3 & 4.4) Flashcards

1
Q

Firewall

A

o Uses a set of rules defining the traffic types permitted or denied through device
▪ Software or hardware
▪ Virtual or physical
▪ Host-based or network-based
▪ Can perform Network Address Translation (NAT) and/or Port Address
Translation (PAT)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Stateful Firewall

A

▪ Inspects traffic as part of a session and recognizes where the traffic
originated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

NextGen Firewall (NGFW)

A

▪ Third-generation firewall that conducts deep packet inspection and
packet filtering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Access Control List (ACL)

A

▪ Set of rules applied to router interfaces that permit or deny certain traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Switch

A

o MAC address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Router

A

o IP address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Switch Firewall

A

o IP address or port
▪ Source/destination IP
▪ Source/destination port
▪ Source/destination MAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Firewall Zone

A

▪ Firewall interface in which you can set up rules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Inside

A

o Connects to corporate LAN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Outside

A

o Connects to the Internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Demilitarized Zone (DMZ)

A

o Connects to devices that should have restricted access

from the outside zone (like web servers)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Unified Threat Management (UTM) Device

A

▪ Combines firewall, router, intrusion detection/prevention system, antimalware, and other features into a single device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Signature-based Detection

A

▪ Signature contains strings of bytes (a pattern) that triggers detection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Policy-based Detection

A

▪ Relies on specific declaration of the security policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Statistical Anomaly-based Detection

A

▪ Watches traffic patterns to build baseline

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Non-statistical Anomaly-based Detection

A

▪ Administrator defines the patterns/baseline

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Network-based (NIDS/NIPS)

A

o A network device protects entire network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Host-based (HIDS/HIPS)

A

o Software-based and installed on servers and clients
▪ Network and host-based systems can work together for a more complete
protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Telnet Port 23

A

▪ Sends text-based commands to remote devices and is a very old
networking protocol
▪ Telnet should never be used to connect to secure devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Secure Shell (SSH) Port 22

A

▪ Encrypts everything that is being sent and received between the client
and the server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Remote Desktop Protocol (RDP) Port 3389

A

▪ Provides graphical interface to connect to another computer over a
network connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Remote Desktop Gateway (RDG)

A

▪ Provides a secure connection using the SSL/TLS protocols to the server
via RDP
● Create an encryption connection
● Control access to network resources based on permissions and
group roles
● Maintain and enforce authorization policies
● Monitor the status of the gateway and any RDP connections
passing through the gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Virtual Private Network (VPN)

A

▪ Establishes a secure connection between a client and a server over an
untrusted public network like the Internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Virtual Network Computing (VNC) Port 5900

A

▪ Designed for thin client architectures and things like Virtual Desktop
Infrastructure (VDI)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Virtual Desktop Infrastructure (VDI)

A

▪ Hosts a desktop environment on a centralized server

▪ Desktop as a Service (DaaS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

In-Band Management

A

▪ Managing devices using Telnet or SSH protocols over the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Out-of-Band Management

A

▪ Connecting to and configuring different network devices using an
alternate path or management network
▪ Prevents a regular user’s machine from connecting to the management
interfaces of your devices
▪ Out-of-band networks add additional costs to the organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Authentication

A

▪ Confirms and validates a user’s identity

▪ Gives the user proper permissions to access a resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Password Authentication Protocol (PAP)

A

▪ Sends usernames and passwords in plain text for authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Challenge Handshake Authentication Protocol (CHAP)

A

▪ Sends the client a string of random text called a challenge which is then
encrypted using a password and sent back to the server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

MS-CHAP

A

▪ Microsoft proprietary version that provides stronger encryption keys and
mutual authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Extensible Authentication Protocol (EAP)

A

▪ Allows for more secure authentication methods to be used instead of just
a username and a password
▪ Use EAP/TLS in conjunction with a RADIUS or TACACS+ server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Virtual Private Networks (VPNs)

A

o Extends a private network across a public network and enables sending and
receiving data across shared or public networks
▪ Site to site
▪ Client to site
▪ Clientless

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Virtual Private Networks (VPNs)

A

o Extends a private network across a public network and enables sending and
receiving data across shared or public networks
▪ Site to site
▪ Client to site
▪ Clientless

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Full Tunnel VPN

A

▪ Routes and encrypts all network requests through the VPN connection
back to the headquarters

36
Q

Split Tunnel VPN

A

▪ Routes and encrypts only the traffic bound for the headquarters over the
VPN, and sends the rest of the traffic to the regular Internet
● For best security, use a full tunnel
● For best performance, use a split tunnel

37
Q

Clientless VPN

A

ientless VPN
▪ Creates a secure, remote-access VPN tunnel using a web browser without
requiring a software or hardware client

38
Q

Secure Socket Layer (SSL)

A

▪ Provides cryptography and reliability using the upper layers of the OSI
model, specifically Layers 5, 6, and 7

39
Q

Transport Layer Security (TLS)

A

▪ Provides secure web browsing over HTTP
▪ SSL and TLS use TCP to establish their secure connections between a
client and a server

40
Q

Datagram Transport Layer Security (DTLS)

A

▪ UDP-based version of the TLS protocol which operates a bit faster due to
having less overhead

41
Q

Layer 2 Tunneling Protocol (L2TP)

A

▪ Lacks security features like encryption by default and needs to be
combined with an extra encryption layer for protection

42
Q

Layer 2 Forwarding (L2F)

A

▪ Provides a tunneling protocol for the P2P protocol but also lacks native
security and encryption features

43
Q

Point-to-Point Tunneling Protocol (PPTP)

A

▪ Supports dial-up networks but also lacks native security features except
when used with Microsoft Windows

44
Q

IP Security (IPSec)

A

▪ Provides authentication and encryption of packets to create a secure
encrypted communication path between two computers

45
Q

IP Security (IPSec)

A

o Provides authentication and encryption of data packets to create an secure
encrypted communication path between two computers

46
Q

Confidentiality

A

● Using data encryption

47
Q

Integrity

A

● Ensuring data is not modified in transit

48
Q

Authentication

A

● Verifying parties are who they claim to be

49
Q

Anti-Replay

A 
● Checking sequence numbers on all packets prior to transmission
o Key exchange request
o IKE Phase 1
o IKE Phase 2
o Data transfer
o Tunnel termination
50
Q

Main Mode

A

▪ Conducts three two-way exchanges between the peers, from the initiator
to the receiver

51
Q

First Exchange

A

o Agrees upon which algorithms and hashes will be used to

secure the IKE communications throughout the process

52
Q

Second Exchange

A

o Uses a Diffie-Hellman exchange to generate shared secret
keying material so that the two parties can prove their
identities

53
Q

Third Exchange

A

o Verifies the identity of the other side by looking at an

encrypted form of the other peer’s IP address

54
Q

Authentication methods used

A

▪ Encryption and hash algorithms used
▪ Diffie-Hellman groups used
▪ Expiration of the IKE SA
▪ Shared secret key values for the encryption algorithms

55
Q

Aggressive Mode

A

▪ Uses fewer exchanges, resulting in fewer packets and faster initial
connection than main mode
● Diffie-Hellman public key
● Signed random number
● Identity packet
● Negotiate the IPSec SA parameters protected by an existing IKE SA
● Establish IPSec SA
● Periodically renegotiate IPSec SAs to maintain security
● Perform additional Diffie-Hellman exchanges, if needed

56
Q

Quick Mode

A

▪ Only occurs after IKE already established the secure tunnel in Phase 1
using either main or aggressive mode

57
Q

Diffie-Hellman Key Exchange

A

▪ Allows two systems that don’t know each other to be able to exchange
keys and trust each other
● PC1 sends traffic to PC2 and then RTR1 initiates creation of IPSec
tunnel
● RTR1 and RTR2 negotiate Security Association (SA) to form IKE
Phase 1 tunnel (ISAKMP tunnel)
● IKE Phase 2 tunnel (IPSec tunnel) is negotiated and set up
● Tunnel is established and information is securely sent between
PC1 and PC2
● IPSec tunnel is torn down and the IPSec SA is deleted

58
Q

Transport Mode

A

▪ Uses packet’s original IP header and used for client-to-site VPNs
▪ By default, maximum transmission unit (MTU) size in most networks is
1500 bytes

59
Q

Tunneling Mode

A

▪ Encapsulates the entire packet and puts another header on top of it
▪ For site-to-site VPNs, you may need to allow jumbo frames
● Transport
o Client to site
● Tunneling
o Site to site

60
Q

Authentication Header (AH)

A

▪ Provides connectionless data integrity and data origin authentication for
IP datagrams and provides protection against replay attacks

61
Q

Encapsulating Security Payload (ESP)

A

▪ Provides authentication, integrity, replay protection, and data
confidentiality
▪ In transport mode, use AH to provide integrity for the TCP header and
ESP to encrypt it
▪ In tunneling mode, use AH and ESP to provide integrity and encryption of
the end payload

62
Q

Simple Network Management Protocol (SNMP)

A

Simple Network Management Protocol (SNMP) is used to send and receive data
from managed devices back to a centralized network management station

63
Q

Managed Device

A

▪ Any device that can communicate with an SNMP manager known as the
management information base (MIB)

64
Q

Granular

A

▪ Sent trap messages get a unique objective identifier to distinguish each
message as a unique message being received

65
Q

Management Information Base (MIB)

A

▪ The structure of the management data of a device subsystem using a
hierarchical namespace containing object identifiers

66
Q

Verbose

A

▪ SNMP traps may be configured to contain all the information about a
given alert or event as a payload

67
Q

SNMPv1 and SNMPv2

A

▪ Use a community string to give them access to the device as their security
mechanism
▪ Default community strings of public (read-only) or private (read-write)
devices are considered a security risk

68
Q

SNMPv3

A

▪ Provides three security enhancements which added integrity,
authentication, and confidentiality to the SNMP protocol

69
Q

Integrity

A

o message hashing

70
Q

Authentication

A

o source validation

71
Q

PoE+ 802.3at Confidentiality

A

o DES 56-bit encryption

72
Q

System Logging Protocol (Syslog)

A

▪ Sends system log or event messages to a central server, called a syslog
server
● Security Information Management (SIM)
● Security Event Management (SEM)
● Security Information and Event Management (SIEM)

73
Q

Client

A

▪ Device sending the log information to the syslog server

74
Q

Server

A

▪ Receives and stores the logs from all of the clients

75
Q

Traffic Log

A

▪ Contains information about the traffic flows on the network
▪ Traffic logs allow for investigation of any abnormalities

76
Q

Audit Log/ Audit Trail

A

▪ Contains a sequence of events for a particular activity

77
Q

Application Log

A

▪ Contains information about software running on a client or server
● Informational
● Warning
● Error

78
Q

Security Log

A

▪ Contains information about the security of a client or server

79
Q

System Log

A

▪ Contains information about the operating system itself

80
Q

Security Information and Event Management (SIEM)

A

o Provides real-time or near-real-time analysis of security alerts generated by
network hardware and applications
- Gathers logs and data from all sorts of different systems

81
Q

Log Collection

A

o Provides important forensic tools and helps address

compliance reporting requirements

82
Q

Normalization

A

o Maps log messages into a common data model, enabling the

organization to connect and analyze related events

83
Q

Correlation

A

o Links the logs and events from different systems or

applications into a single data feed

84
Q

Aggregation

A

o Reduces the volume of event data by consolidating duplicate
event records and merging them into a single record

85
Q

Reporting

A

o Presents the correlated, aggregated event data in real-time
monitoring dashboards for analysts or long-term summaries
for management
▪ Software
▪ Hardware
▪ Managed service
▪ Log all relevant events and filter out anything that is considered to be
irrelevant data
▪ Establish and document the scope of the events
▪ Develop use cases to define a threat
▪ Plan incident responses for given scenarios or events
▪ Establish a ticketing process to track all the flagged events
▪ Schedule regular threat hunting with cybersecurity analysts
▪ Provide auditors and analysts an evidence trail
▪ Syslog protocol using UDP Port 514 or TCP Port 1468

CompTIA Network+ (N10-008) (23 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions