Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Telecommunications & Network Security > Flashcards

Telecommunications & Network Security Flashcards

1
Q

What are the 7 layers of the OSI Model

A 
Physical
Data
Network
Transport
Session
Presentation
Application
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is Data encapsulation?

A

In the OSI Model, Data encapsulation wraps protocol information from the layer immediately above in the data section of the layer immediately below.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the 4 common network topologies in use today?

A

Star
Mesh
Ring
Bus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which is the most common network topology in use today? Ring, Bus, Star, Mesh

A

Star

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

In which topology are all systems interconnected to provide multiple paths to all other resources.
Star, bus, mesh or ring

A

Mesh

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

In which topology is each individual node connected to a switch, hub or concentrator?
Star, Mesh, Bus, Ring

A

Star

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which network topology is commonly used for the most critical network components, ie routers, switches servers by using multiple NICs, server clustering, etc. to eliminate single points of failure?
Mesh, Bus, Ring, Star

A

Mesh

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

In which network topology does traffic travel in a single direction?
Star, Bus, Ring, Mesh

A

Ring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

In which network topology are all devices connected via a single cable that’s terminated on both ends
Star, Bus, Mesh, Ring

A

Bus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the 4 basic cable types used in networks?

A

coaxial, twin-axial, twisted pair and fibre optic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which type of cable is commonly used for cable or satellite television receivers?
twin-axial, coaxial, twisted pair, fibre optic

A

coaxial

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Which type of signal conveys information in a series or pulses through the presence or absence of electrical signals as opposed to wave frequencies?
Digital or Analog

A

Digital

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which type of cable is used to achieve high transmission speeds over short distances (often used by SAN’s or switches connecting critical servers to a high speed core)
coaxial, fibre optic, twin-axial, twisted pair

A

Twin-Axial

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is Bit Error Ratio?

A

It’s the ratio of incorrectly received bits to total received bits over a specified period of time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which cable is the most common cable used by LAN’s today?

Coaxial, Twisted pair, Fibre-optic, twin-axial

A

twisted pair

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Twisted pair cabling can be shielded or unshielded. What are the benefits of shielded with regards security?

A

Reduces electromagnetic emissions which can be intercepted by an attacker. Also protects it from EMI and RFI from other sources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which term refers to the study of electromagnetic emissions from computers or related equipment?

A

TEMPEST

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which type of CAT cables are available as Shielded Twisted pair only

A

CAT 7 and CAT 7a

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which type of cable uses light signals as opposed to electrical signals?
twisted pair, coaxial, twin-axial, fibre optic

A

fibre optic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Which cable has the advantage or high speed, long distance and best resistance to interference and interference?
twisted pair, coaxial, fibre optic, twin-axial

A

fibre optic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

At which layer of the OSI model are network topologies, cable/connector types and interfaces defined

A

Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

At which layer of the OSI model are NIC cards used?

A

Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Which type of card is used to connect a computer to a network?

A

NIC card

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the term used for a device that amplifies a signal to compensate for attenuation (signal loss)?

A

Repeater

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What two devices connect LAN segments together such as servers and workstations?

A

Hub (concentrator) and Switch

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are the two basic types of hubs?

A

Active and Passive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What s the difference between a hub and switch?

A

A switch sends packets to destination devices as opposed to a hub which will send packets to all devices on the network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

At which two layers of the OSI model can a switch operate?

A

Physical and Data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Which layer ensures that messages are delivered to the proper device across a physical network link?

A

Data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Which layer formats messages form layers above into frames for transmission, handles point to point synchronisation and error control and can perform link encryption

A

Data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What are the two sub layers of the Data layer?

A

Logical Link Control and Media Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Which Data sub layer handles flow control and controls sequencing and acknowledgement of frames?

A

Logical Link Control (operates between the network layer above and sub MAC layer below)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Which Data sub layer performs error control, identifies the hardware device and controls media access?

A

Media Access Control (operates between the LLC sub layer above and Physical layer below)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

How many bits are used in a MAC address?

A

48 bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

A MAC address is split into two 24-bit portions? Which portion identifies the device?

A

Second portion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What are the 3 basic types of media access?

A

Contention
Token Passing
Polling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

In which media access type must devices viefor control of the physical network medium? contention, token passing or polling?

A

Contention

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

In which media access type must individual devices wait for a special frame before transmitting data across the physical network medium? contention, token passing or polling?

A

token passing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

In which media access type are devices checked to see whether they have any data to transmit? contention, token passing, polling?

A

Polling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What are 3 common examples of a wide area network? (WAN)

A
  • Internet
  • Intranet
  • Extranet
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What is the purpose of the OSI Model?

A

to facilitate interoperability between network devices independent on the manufacturer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What are 5 benefits of the OSI model?

A
  • clarifies general functions of a communications process.
  • reduces complex networking processes into simpler sub-layers and components.
  • Promotes interoperability by defining standard interfaces
  • Aids development by allowing vendors to change individual features at a single layer, instead of rebuilding the entire stack
  • Facilitates easier troubleshooting
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q 
Which type of network connects an individuals electronic devices together or to a larger network?
Personal Area Network (PAN)
Storage Area Network (SAN)
Virtual Local Area Network (VLAN)
Wireless Local Area Network (WLAN)
Campus Area Network (CAN)
Metropolitan Area Network (MAN)
Value-added network (VAN)
A

Personal Area Network (PAN)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q 
Which type of network connects servers to a separate physical storage device?
Personal Area Network (PAN)
Storage Area Network (SAN)
Virtual Local Area Network (VLAN)
Wireless Local Area Network (WLAN)
Campus Area Network (CAN)
Metropolitan Area Network (MAN)
Value-added network (VAN)
A

Storage Area Network (SAN)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q 
Which type of network is implemented on network switches in a LAN as a way of logically grouping users and resources together?
Personal Area Network (PAN)
Storage Area Network (SAN)
Virtual Local Area Network (VLAN)
Wireless Local Area Network (WLAN)
Campus Area Network (CAN)
Metropolitan Area Network (MAN)
Value-added network (VAN)
A

Virtual Local Area Network (VLAN)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q 
Which type of network connects multiple buildings across a high performance backbone?
Personal Area Network (PAN)
Storage Area Network (SAN)
Virtual Local Area Network (VLAN)
Wireless Local Area Network (WLAN)
Campus Area Network (CAN)
Metropolitan Area Network (MAN)
Value-added network (VAN)
A

Campus Area Network (CAN)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q 
Which type of network extends across a large area such as a small city?
Personal Area Network (PAN)
Storage Area Network (SAN)
Virtual Local Area Network (VLAN)
Wireless Local Area Network (WLAN)
Campus Area Network (CAN)
Metropolitan Area Network (MAN)
Value-added network (VAN)
A

Metropolitan Area Network (MAN)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q 
Which type of network is a type of extranet?
Personal Area Network (PAN)
Storage Area Network (SAN)
Virtual Local Area Network (VLAN)
Wireless Local Area Network (WLAN)
Campus Area Network (CAN)
Metropolitan Area Network (MAN)
Value-added network (VAN)
A

Value-added network (VAN)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q 
Which type of network topology is commonly used in token-ring or FDDI networks?
Star
Mesh
Bus
Ring
A

Ring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q 
Which two types of network topology has a single point of failure?
Star
Mesh
Bus
Ring
A

Bus and Ring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What are the characteristics of a coaxial cable?

A
  • single solid copper wire sourrounded by a plastic or teflon insulator, braided metal shielding with a plastic wrap.
  • durable and resistant to EMI and RFI.
  • commonly used to connectcable /satellite tv
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What are the two types of coaxial cable?

A

Thick (RG8 or RG11) screw type

Thin (RG58) bayonet type

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What are the characteristics of twin-axial cable?

A
  • similar to coax cable but consists of two solid copper wires
  • used to achieve high data transmission speeds over very short distances at low cost
  • typically used for SANs or top of rack switches that connect critical servers to a high sped core.
  • also low transceiver latency, power consumption and Bit Error ratio (BER)
  • durable and resistant to EMI and RFI.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What are the characteristics of a twisted pair cable?

A
  • most popular LAN cable in use today
  • lightweight, flexible, inexpensive
  • consists of 4 copper wire pairs twisted together to improve transmission and reduce crosstalk and attenuation.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What is crosstalk in relation to cabling?

A

occurs when a signal transmitted over one channel or circuit negatively affects the signal transmitted over another.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What is attenuation in relation to cabling?

A

gradual loss of intensity of a wave as it travels over a medium

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Which 4 twisted pair cables are defined as standards by TIA/EIA?

A

Cat 3, Cat 5e, Cat 6, Cat 6a

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Which 3 twisted pair cables are typically used in network today?

A

Cat 5, Cat 5e, Cat 6

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What are the characteristics of a fibre optic cable?

A
  • most expensive most most reliable
  • typically used in backbone and HA networks (FDDI)
  • uses light signals rather than electrical signals
  • high speed, long distance and best resistance to interference, inference
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Which type of cabling has the least resistance to EMI/RFI?

Fibre, twisted pair (UTP/STP), coax cable, twin-coax cable

A

Unshielded twisted pair, followed by shielded twisted pair

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

What is the difference between a passive and active hub?

A

Passive: data enters one port and exits all others without any signal amplification or re-regeneration
Active: Combines the features of a passive hub and repeater. (Multi-port repeater)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

What is the process used by the MAC sub-layer for error checking?

A
  1. uses a cyclic redundancy check (CRC): a simple mathematical calculation or checksum used to create a message profile.
  2. CRC is re-calculated by the receiving device.
  3. If calculated CRC does not match received CRC, then packet is dropped and request to re-send is transmitted.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

LAN protocols are defined at the Data Link layer. What are 6 common types?

A 
ARCnet
Ethernet
Token-Ring
Fiber Distributed Data Interface (FDDI)
Address Resolution Protocol (ARP)
Reverse Address Resolution Protocol (RARP)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Which LAN protocol has the following characteristics?
- one of the earliest LAN technologies
- transports data to the physical LAN medium using the token passing media access method
implemented in star topology using coaxial cable
- provides slow but predictable network performance

A

ARCnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Which LAN protocol has the following characteristics?

  • transports data to the physical LAN medium using CSMA/CD
  • designed for networks characterised by sporadic, sometimes heavy traffic requirements
  • most common LAN protocol
  • most often implemented with twisted pair
  • normally operates at speeds of 10, 100 or 1000Mbps
A

Ethernet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

Which LAN protocol has the following characteristics?

  • transports data to the physical LAN medium using the token passing media access method
  • all nodes are attached to a multi-station access unit (MSAU) in a logical ring topology
  • one node is designated as the active monitor ensuring that no more than one token is one the network at any one given time
  • operate at speed of 4 and 16 Mbps
A

Token-ring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

Which LAN protocol has the following characteristics?

  • transports data to the physical LAN medium using the token passing media access method
  • implemented as a dual counter rotating ring over fiber at speeds up to 100 Mbps
  • All stations on network are connected to both rings
  • in event of a fault the ring wraps back round to the nearest node on the secondary ring
A

Fiber Distributed Data Interface (FDDI)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

Which LAN protocol has the following characteristics?

- maps an IP to a MAC

A

Address Resolution Protocol (ARP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

Which LAN protocol has the following characteristics?

  • maps MAC to an IP
  • necessary when a system such as a disk-less machine needs to discover its own IP
A

Reverse Address Resolution Protocol (RARP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

LAN data transmission are classified into 3 categories. What are they?

A

Unitcast: packets sent from source to single destination
Broadcast: packets sent to every device on network using broadcast address.
Multi-cast: packets copied and sent from source to multiple destinations using special Multi-cast IP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

WLAN standards

A

Type, Speed, Description

  • 802.11a, 54Mbps, Operates at 5GHz (less interference than 2.4GHz,
  • 802.11b, 11Mbps, Operates at 2.4GHz (first used protocol)
  • 802.11g, 54Mbps, Operates at 2.4GHz (backward compatible with 802.11b)
  • 802.11n, 600Mbps, Operates at 5GHz or 2.4 GHz
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

At which 3 layers do WAN technologies operate at?

A

Physical, Data (primary) and Network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

What are 5 types of WAN protocols?

A
  • Point to Point Links
  • Circuit switched networks
  • Packet switched networks
  • High level data link controls (HLDC)
  • Synchronous Data Link Control (SDLC)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

What is a Point to Point Link?

A

a pre-established WAN comms path from customer network across a carrier network to a remote network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

Point to Point Links include which 5 protocols?

A
  • Layer 2 Forwarding Protocol (L2F)
  • layer 2 Tunnelling Protocol (L2TP)
  • Point to Point Protocol (PPP)
  • Point to Point tunnelling protocol (PPTP)
  • Serial Line IP (SLIP)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

Which Point to Point Link protocol has the following characteristics?

  • a tunnelling (data encapsulation) protocol used to implement VPN’s, specifically PPP traffic.
  • doesn’t provide encryption or confidentiality
A

Layer 2 Forwarding Protocol (L2F)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

Which Point to Point Link protocol has the following characteristics?

  • a tunnelling protocol used to implement VPN’s
  • is derived from L2F and PPTP
  • uses UDP port 1701 to create a tunnelling session
  • commonly implemented with an encryption protocol such as IPSec.
A

layer 2 Tunnelling Protocol (L2TP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

Which Point to Point Link protocol has the following characteristics?

  • is a successor to SLIP
  • provides router to router and host to network connections over synchronous and asynchronous circuits
  • more robust than SLIP and provides additional in-built security mechanisms
A
  • Point to Point Protocol (PPP)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

Which Point to Point Link protocol has the following characteristics?

  • tunnelling protocol developed by Microsoft and commonly used to implement VPN’s, specifically PPP traffic
  • doesn’t provide encryption or confidentiality, instead relying on other protocols such as CHAP, PAP, EAP, etc.
A
  • Point to Point tunnelling protocol (PPTP)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

Which Point to Point Link protocol has the following characteristics?

  • the predecessor of PPP
  • originally developed for lines such as dial up modems using TCP/IP networking.
A
  • Serial Line IP (SLIP)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

What is a circuit switched network?

A
  • a dedicated, physical circuit path is established, maintained and terminated between the sender and receiver across a carrier network for each communications message (the call)
  • used extensively in telephone company networks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

What are 3 examples of circuit switched networks?

A
  • Digital Subscriber Line (xDSL)
  • Data Over Cable Services Interface Specification (DOCSIS)
  • Integrated Services Digital Network (ISDN)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

Circuit switched networks are ideally suited for which type of traffic?

A

Always on (constant)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

Which circuit switched network has the following characteristics?
- uses existing analog phone lines to deliver high bandwidth connectivity to remote customers

A

Digital Subscriber Line (xDSL)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

Which circuit switched network has the following characteristics?
- communications protocol for transmitting high speed data over an existing cable TV system

A

Data Over Cable Services Interface Specification (DOCSIS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

Which circuit switched network has the following characteristics?
- communications protocol that operates over analog phone lines that have been converted to use digital signalling
- capable of transmitting both voice and data traffic
-

A
  • Integrated Services Digital Network (ISDN)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

xDSL examples

A
  • ADSL & ADSL 2: asymmetric digital subscriber line. delivers higher bandwidth downstream than upstream, ie from central office to customer site
  • SDSL: single line digital subscriber line. designed to deliver high bandwidth both upstream and downstream using twisted copper pair.
  • HDSL: High rate Digital Subscriber Line. High bandwidth both upstream and downstream using twisted copper pair. commonly used for T1.
  • VDSL: Subscriber Line; designed to deliver extremely high bandwidth over a single copper twisted pair (VDSL2 provides simultaneous upstream/downstream)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

Which xDSL line has the highest operating range?

A

ADSL & ADSL 2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

Which xDSL line can deliver the highest downstream bandwidth?

A

VDSL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

Which xDSL line can deliver the highest upstream bandwidth?

A

ADSL & ADSL 2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

What are the two IDSN service levels?

A

Basic Rate Interference (BRI)

Primary rate Interference (PRI) (quicker)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

What are the characteristics of a packet switched network?

A
  • devices share bandwidth on communications links to transport packets between a sender and receiver over a carrier network
  • more resilient to error and congestion that circuit switched networks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

name 6 types of packet switched networks?

A
  • Asynchronous Transfer Mode (ATM)
  • Frame Relay
  • Multi-Protocol Label Switching (MPLS)
  • Synchronous Optical Network (SONET) and Synchronous Digital Hierarchy (SDH)
  • Switched Multi-megabit Data Service (SMDS)
  • X.25
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

Which type of packet switched network has the following characteristics?

  • very high speed, low delay technology that uses switching and multi-plexing techniques to rapidly relay fixed length cells containing voice, video, data
  • Cell processing occurs in hardware that reduces transit delays
  • ideally suited for fiber-optic networks that handle bursty uneven traffic
A

Asynchronous Transfer Mode (ATM)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

Which type of packet switched network has the following characteristics?

  • a packet switched standard protocol that handles multiple virtual circuits by using High Level Data Link Control (HDLC) encapsulation between connect devices.
  • has no error connection or high speeds
  • can be used on SVC’s (Switched Virtual Circuit) or PVC’s (Permanent Virtual Circuit)
A
  • Frame Relay
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

Which type of packet switched network has the following characteristics?

  • a high speed, highly scalable, highly versatile technology used to create VPN’s
  • can carry IP packets, as well as ATM, SONET or ethernet frames
  • specified at both Layer 2 and Layer 3
  • uses MPLS cloud to route packets using MPLS labels
  • routing decisoin based solely on labels without examining payload.
A
  • Multi-Protocol Label Switching (MPLS)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

Which type of packet switched network has the following characteristics?

  • a high availability, high speed, multi-plexed, low latency technology used on fiber-optic networks
  • SONET was originally designed for the public telephone network and widely used in the US and Canada
  • SSH widely used by rest of the world. Came later
A

Synchronous Optical Network (SONET) and Synchronous Digital Hierarchy (SDH)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

Which type of packet switched network has the following characteristics?

  • a high-speed, connectionless oriented, datagram based technology available over public switched networks
  • typically companies that exchange large amounts of data bursts with other remote networks use this
A
  • Switched Multi-megabit Data Service (SMDS)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

Which type of packet switched network has the following characteristics?

  • the first packet switching network
  • more common outside the US but being superseded by Frame Relay
  • defines how point to point connections between a DTE and DCE are established and maintained
A
  • X.25
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

What is the difference between a Switched Virtual Circuit (SVC) and a Permanent Virtual Circuit (PVC)?

A

SVC is a temporary connection that is dynamically created to transmit data, whereas a PVC are permanently established connections.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

What is the advantage and disadvantage of a Permanent Virtual Circuit over a Temporary Switched Circuit?

A

PVC requires less bandwidth due to the lack of circuit establishment and termination but is more expensive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

What is a disadvantage of using a MPLS packet switched network?

A

Customer loses visibility into the cloud, however so would an attacker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

What is a datagram?

A

A self contained unit of data that is capable of being routed between a source and destination. Similar to a packet that is used in IP, datagrams are commonly used in UDP and other protocols such as AppleTalk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

What are the key differences between a packet switched network and a circuit switched network?

A

Circuit switching is connection oriented, using fixed delays and is ideal for always on connections, constant traffic and voice communications.

Packet switching is connectionless oriented, using variable delays and is ideal for bursty traffic and data communications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

What are the characteristics of the WAN protocol, High Level Data Link Control (HDLC)?

A
  • a bit oriented, synchronous protocol that was created by ISO to support point to point and multipoint configurations.
  • specifies a data encapsulation method for synchronous serial links and is the default for serial links on Cisco routers.
  • various vendors implementations of HDLC are incompatible with each other
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

What are the characteristics of the WAN protocol, Synchronous Data Link Control (SDLC)?

A
  • a bit-oriented full duplex serial protocol that was developed by IBM to facilitate communications between mainframes and remote offices
  • defines and implements a polling method of media access.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

What is the difference between asynchronous and synchronous communications?

A

Asynchronous: data transmitted in a serial stream. devices must communicate at same speed of slowest party. parity bits used to reduce transmission errors as no internal clocking signal is used.

Synchronous: utilises an internal clocking signal to transmit large blocks of data, known as frames. characterised by very high speed transmission rates.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

What are the 5 types of telecommunications circuits used by WAN protocols?

A

DS0 - Slowest (used on T1) - Digital Signalling Level
DS1 (used on E1) - Digital Signalling Level
DS3 -Fastest (used on T3) - Digital Signalling Level
T1 - WAN carrier Facility
T3 - Fastest - WAN carrier Facility
E1 - Wide area digital transmission scheme (Europe)
E3 - Wide area digital transmission scheme (Europe)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

Which telecommunications circuit does SONET use?

A

OC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
110
Q

What is a bridge?

A

a repeater used to connect two or more network segments. maintains an ARP cache that holds MAC addresses of devices connected on network segments. forwards data to all network segments if data isn’t on the local network segment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
111
Q

A serious problem associated with a bridge is a broadcast storm. What is this?

A

broadcast traffic is automatically forwarded by a bridge, effectively flooding a network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
112
Q

What is a switch?

A
  • uses MAC addresses to route traffic
  • unlike a hub, a switch transports data, only to the port connected to the destination MAC address
  • used to create separate collision domains and thus increases transmission rates available on individual network segments.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
113
Q

A switch is a layer 2 device, but can also operate at which other 2 layers due to newer technologies?

A

Layer 3 (Network) and 7 (Application)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
114
Q

What is a DTE (Data terminal Equipment)?

A

term used to classify devices at the user end of a user to network interface, ie a workstation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
115
Q

What is a DCE (Data Communications Equipment)?

A

consists of devices at the network end of a user to network interface. provides the physical connection of the network, forwards network traffic, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
116
Q

What is an example of a DCE?

A

NIC, Modem, CSU (Channel Service Units), DSU (Data Service units)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
117
Q

Routing Information Protocol (RIP), Open Shortest Path First (OSPF) and Border Gateway Protocol are all types of what?

A

Routing Protocols

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
118
Q

IP and IPX are two types of what?

A

Routed Protocols

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
119
Q

In what two ways are routing protocols classified as?

A

Static or Dynamic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
120
Q

Which routing protocol class has the following characteristics?

  • routes created and updated manually
  • can’t re-route traffic to an alternate destination automatically
  • only practical in small networks or where a destination is only available via a single router
  • low bandwidth requirements
  • built in security (users can only get to destinations specified in routing table
A

Static routing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
121
Q

Which routing protocol class has the following characteristics?

  • can discover routes
  • determine best route to a destination
  • routing table periodically updated with new routing information
  • classified as link state, distance vector or path vector
A

Dynamic routing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
122
Q

Which dynamic routing protocol algorithm has the following characteristics?

  • makes routing decision based on distance (hop count or other metric) and vector (the egress router interface)
  • periodically informs its peers of topology changes
  • suffers from convergence
  • RIP uses this dynamic class algorithm
A

distance vector

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
123
Q

What is convergence in relation to routing?

A

the time it takes for all routers in a network to update their routing tables. Without convergence some routers on a network may be unaware of topology changes, however during convergence the network slows down considerably.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
124
Q

The number of router nodes that a packet must pass through to reach its destination is known as what?

A

Hop count

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
125
Q

Which dynamic routing algorithm has the following characteristics?
- requires every router to calculate and maintain a complete map or routing table of the entire network
- periodically transmit updates that contain information about adjacent connections (link states) to all other routers on the network
- computation intensive but can calculate best route to a destination.
convergence occurs rapidly
- OSPF uses this dynamic class

A

link state

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
126
Q

An arbitrary assigned weight or metric in routing is known as what?

A

Cost

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
127
Q

Which dynamic routing protocol algoruthm has the following characteristics?

  • similar to a distance vector protocol but without the scalability issues associated with a limited hop count.
  • the BGP protocol uses this dynamic class
A

path vector

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
128
Q

What is the Routing Information Protocol (RIP)?

A

A distance vector protocol that uses hop count as its routing metric.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
129
Q

What is a routing loop?

A

packets getting stuck bouncing between various router nodes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
130
Q

RIP employs three techniques to prevent routing loops. What are they?

A

Split horizon
Route poisoning
Holddown timers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
131
Q

Which technique to prevent routing loops prevents a router from advertising a route back through the same interface from which the route was learned?
Split horizon
Route poisoning
Holddown timers

A

Split horizon

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
132
Q

Which technique to prevent routing loops sets the hop count on a bad route to 16, effectively advertising the route as unreachable if it takes for than 15 hops to reach.

A

Route poisoning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
133
Q

Which technique to prevent routing loops cause a router to start a timer when the router first receives information that a destination is unreachable. subsequent updates about the destination will not be accepted until the timer expires.

A

Holddown timers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
134
Q

Holddown timers in RIP can help prevent what?

A

Flapping: occurs when a router repeatedly changes state over a short period of time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
135
Q

Which routing protocol uses UDP 520 and is connectionless?

A

RIP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
136
Q

What are 2 disadvantages of RIP?

A
  • slow convergence

- insufficient security (RIPv1 has no authentication and RIPv2 transfers passwords in clear text)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
137
Q

What is the main advantage as to why RIP is still commonly used on many networks?

A

Its simplicity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
138
Q

What is Open Shortest Path First (OSPF)?

A

A link state protocol widely used in large enterprise networks. considered an interior gateway protocol (IGP) because it performs routing with a single autonomous system (AS). OSPF is encapsulated directly into IP datagrams as opposed to using a Transport Layer Protocl such as TCP or UDP.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
139
Q

A group of contiguous IP address ranges under the control of a single internet entity is known as what?

A

An autonomous system (AS) - uses AS Numbers to uniquely identify the network on the internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
140
Q

The following are characteristics of which Routing Protocol?

  • is a link state routing protocol used to route datagrams through a packet switched network
  • is an interior gateway protocol used for routing within an autonomous system.
  • used in large service provider backbone networks
A

(IS-IS) Intermediate System to Intermediate System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
141
Q

The following are characteristics of which Routing Protocol?

  • is a path vector protocol used between autonomous systems
  • is considered an exterior gateway protocol (EGP) as it is performs routing between separate autonomous systems (such as between ISP’s) and on very large private IP networks.
A

Border gateway Protocol (BGP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
142
Q

What is an internal Border Gateway Protocol (iBGP)?

A

When BGP runs within an AS such as a private IP network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
143
Q

What is used to address packets with routing information, allowing those packets to be transported across networks using Routing protocols?

A

Routed Protocols such as IP (internet protocol) and IPX (internetwork packet exchange)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
144
Q

What is the Internet Protocol (IP)?

A

Is part of the TCP/IP suite and contains addressing information that allows packets to be routed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
145
Q

What are the two primary responsibilities of IP?

A
  • Connectionless, best effort (no guarantee) delivery of datagrams
  • Fragmentation and reassembly of datagrams
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
146
Q

Which address range is used as a loopback address for testing and troubleshooting?

A

127.0.0.1 to 127.255.255.255

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
147
Q

The following address ranges are examples of what?

A

IP address ranges reserved for use on private networks and are not routable on the internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
148
Q

What is the purpose of NAT?

A

To conserve IP addresses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
149
Q

How many bits is an IPv6 address?

A

128-bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
150
Q

What are 4 benefits of IPv6?

A

security
multi-media support
plug and play compatibility
backward compatibility with IPv4

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
151
Q

What is IPX (Internet Packet Exchange)?

A

connectionless protocol used primarily in older Novell Netware networks for routing packets across the network. part of the IPX/SPX suite which is analogous to the TCP/IP suite

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
152
Q

Other than IP and IPX, name two other common types of protocols defined at the network layer?

A

Internet Control Message Protocol (ICMP)

Simple Key Management for Internet Protocols (SKIP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
153
Q

What is ICMP used for?

A

error reporting regarding processing of packets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
154
Q

The Packet Internet Groper (PING) uses which network layer protocol?

A

ICMP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
155
Q

What is Simple Key Management for Internet Protocols (SKIP) used for?

A

to share encryption keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
156
Q

What is an advantage and disadvantage of SKIP?

A

doesn’t require a prior communication session to be established before it sends encrypted keys or packet, however it is bandwidth intensive because of additional header size due to encryption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
157
Q

What are the two primary pieces of networking equipment defined at the Network layer?

A

Routers and gateways

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
158
Q

What Network Layer device would you use to link dissimilar programs and protocols such as an Exchange Server to a Lotus Notes server?

A

A Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
159
Q

What is the Transport Layer (Layer 4) used for?

A

transparent, reliable, data transport and end to end transmission control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
160
Q

What are 4 important functions of the Transport Layer?

A
  • Flow Control
  • Multi-plexing (Enables data from multiple applications to be transmitted over a single physical link)
  • Virtual Circuit Management (Establishes, maintains and terminates virtual circuits)
  • Error checking and recovery (detects transmission errors)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
161
Q

Name 4 common Transport Layer Protocols?

A
  • TCP
  • UDP
  • SPX
  • SSL/TLS
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
162
Q

The following are characteristics of which Transport Layer Protocol?

  • capable of simultaneous transmission and reception (full-duplex)
  • connection-oriented
  • slow
  • reliable
A

TCP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
163
Q

What is a three way handshake?

A

SYN - SYN-ACK - ACK

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
164
Q

The following are characteristics of which Transport Layer Protocol?

  • connection-less protocol
  • fast
  • unreliable
  • doesn’t perform re-sequencing, error checking or recovery
A

UDP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
165
Q

Which protocol is used by the following applications?
Domain name System (DNS)
Simple Network Management Protocol (SNMP)
Streaming audio / video

A

UDP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
166
Q

Which protocol was used to guarantee delivery in old Novell Netware IPX/SPX networks?

A

Sequenced Packet Exchange (SPX) - connection-oriented protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
167
Q

Connection-oriented and Connectionless-oriented protocol examples:

A 
TCP (Layer 4) connection-oriented
UDP (Layer 4) connectionless-oriented
IP (Layer 3) connectionless-oriented
IPX (Layer 3) connectionless-oriented
SPX (Layer 4) connection-oriented
168
Q

What is SSL/TLS?

A

Provides session based encryption and authentication for secure communication between clients and servers on the internet.

169
Q

Which layer is responsible for establishing, co-ordinating and terminating communication sessions between networked systems?

A

Session Layer

170
Q

What are the 3 phases at the session layer?

A

Connection establishment
Data transfer
Connection release

171
Q

What are the 3 modes of operation in Connection establishment at the session layer?

A

Simplex Mode (one way) -radio
Half-duplex mode (two way but one at a time) - walkie talkie
Full-duplex mode (two way simultaneously) - phone

172
Q

Name 5 examples of Session layer protocols?

A
  • Net-BIOS - Microsoft Protocol that allows apps to communicate over a LAN
  • Network File System (NFS) - transparent user access to remote resources on a UNIX TCP/IP network
  • Remote Procedure Call (RPC) - client server re-direciton tool
  • Secure Shell (SSH and SSH2) - establishes an encrypted tunnel between client and server
    Session Initiation Protocol (SIP) - signalling protocol for real-time comms such as voice, video, text over IP based networks
173
Q

Which layer is responsible for coding and conversion functions being applied to data at the application layer?

A

Presentation Layer (ensures compatibility)

174
Q

What 4 tasks are associated with the presentation layer?

A
  • Data representation (image, sound, video formats)
  • Character conversion (common character conversion schemes)
  • Data compression
  • Data encryption
175
Q

Name 5 presentation layer protocols?

A
  • American Standard Code for Information Interchange (ASCII) (character encoding scheme ie alphabet)
  • Extended Binary Code Decimal Interchange Code (EBCDIC)
  • GIF
  • JPEG
  • MPEG
176
Q

Which layer is responsible for identifying and establishing availability of communicating partners, determining resource availability and synchronisation?

A

Application Layer

177
Q

HTTPS, FTP, HTTP, IMAP, POP3, PEM, SET, S-HTTP, S/MIME, S-RPC, SMTP, SNMP, Telnet, TFTP are all what?

A

Application layer protocols

178
Q

What is the Intenet Message Access Protocol (IMAP)?

A

a store and forward electronic mail protocol that allows and email client to access, manage and synchronise email on a remote mail server.

179
Q

How can an email client using IMAP be secured?

A

using SSL/TLS

180
Q

In what way does IMAP provide more functionality than POP3?

A

requires users to explicitly delete e-mails from the server

181
Q

What is POP3?

A

An email retrieval protocol that allows an email client to retrieve email from a remote mail server. allows users to authenticate over internet using plain-text passwords. can be secured using TLS/SSL

182
Q

What is the Secure Remote Procedure Call Protocol (S-RPC)?

A

a secure client-server protocol. using public and private keys with diffie-hellman

183
Q

What is the Simple Mail Transfer Protocol (SMTP)?

A

Used to send and receive email across the internet.operates on TCP/UDP port 25. has well known vulnerabilities that make it inherently insecure.

184
Q

What is the Simple Network Management Protocol (SNMP)?

A

Used to collect network information by polling stations or sending traps

185
Q

What is a well known vulnerability of SNMP?

A

uses default cleartext community strings (passwords)

186
Q

What is telnet?

A

Terminal emulation for remote access to system resources

187
Q

What is a weakness of telnet?

A

Passwords sent in cleartext

188
Q

What is the Trivial File Transfer Protocol (TFTP)?

A

A lean version of FTP without directory browsing or authentication. Less secure than FTP

189
Q

Which model was created by the US Department of Defence and preceded the OSI model?

A

The TCP/IP model

190
Q

What are the 4 layers of the TCP/IP model?

A
  • Application Layer (loosely corresponds to the Application, Presentation and Session layer)
  • Transport Layer (corresponds to the OSI Transport Layer)
  • Internet Layer (corresponds to the OSI Network Layer)
  • Network Access (or Link) Layer (corresponds to the Data and Physical Layer of the OSI model)
191
Q

What is an IDPS?

A

An intrusion Detection and Prevention System

192
Q

What is the purpose of a firewall?

A

To control traffic between a trusted network (LAN) and an untrusted network (WAN).

193
Q

What are the 3 basic types of firewalls?

A
  • Packet filtering
  • Circuit level gateway
  • Application level gateway
194
Q

The following are characteristics of which type of firewall?
- suitable for a low risk environment
- permits or denies traffic based solely on TCP, UDP, ICMP and IP headers in packets
- it examines traffic direction, source/destination IP addresses and source/destination port numbers
- information then compared in a pre-defined Access Control List (ACL) to permit or deny traffic
- typical operates at network or transport layer
- is inexpensive, fast and transparent to users
- access decisions based purely on address, port information
- has no protection from IP or DNS spoofing
- doesn’t support strong user authentication
ACL lists difficult to maintain

A

Packet filtering firewall

195
Q

What is an advanced variation of a packet filtering firewall?

A

A dynamic packet filtering firewall (allows the creation of dynamic access list rules for individual sessions)

196
Q

The following are characteristics of which type of firewall?

  • maintains state information about established connections
  • tunnels used for sessions between two hosts, without the need for further inspection of individual packets
  • advantages include speed, support for many protocols and easy maintenance
  • disadvantages include dependence on trustworthiness of connecting user/host and limited logging about individual packets after initial connection
A
  • Circuit level gateway
197
Q

Which type of circuit level gateway captures packets at the network layer, then queues and analyses them at the upper layers of the OSI model?

A

Stateful inspection firewall

198
Q

The following are characteristics of which type of firewall?

  • operates at application layer of the OSI model
  • considered most secure and commonly implemented as a proxy server (no direct communication between each host is permitted)
  • proxy intercepts data packets, analyses contents and if permitted by the firewall rules, sends a copy of the original packet to the intended host.
  • can be used to implement strong user authentication
  • resource intensive and must be tailored to specific applications.
A

Application level gateway

199
Q

Firewalls can be implemented using which 4 firewall architectures?

A
  • screening router
  • dual homed gateway
  • screened host gateway
  • screened subnet
200
Q

The following are the characteristics of which firewall architecture?

  • most basic type
  • external router placed between trusted and untrusted networks with a security policy implemented using ACL’s
  • advantage is transparency, simple to use and inexpensive
  • disadvantages include difficulty in handling certain traffic, limited or no logging, no user authentication, makes masking the internal network structure difficult and is a single point of failure
A
  • screening router
201
Q

The following are the characteristics of which firewall architecture?

  • has two NICs and sits in-between the trusted and untrusted network
  • connected to the untrusted network via an external screening router and a proxy server with the trusted network often requiring authentication
  • offers a more fail-safe operation than a screening router because data isn’t forwarded across the two interfaces
  • internal network structure is masked.
  • disadvantages includes inconvenience to users due to authentication with a proxy server, added latency and proxies may not be available for some services.
A

A dual homed gateway (or bastion host)

202
Q

What is a bastion hosts?

A

a general term used to refer to proxies, firewalls, gateways or any server that provides applications or services directly to an untrusted network

203
Q

The following are the characteristics of which firewall architecture?

  • employs an external screening router and internal bastion host
  • screening router is configured so that the bastion host is the only host accessible from the untrusted network
  • bastion host provides required web services to the untrusted network as permitted by the security policy
  • connections to the internet from the proxy are routed via a application proxy
  • advantages include transparent outbound access, restricted inbound access and distributed security between two devices
  • disadvantages include difficulty in masking internal network structure, can have multiple single points of failure (on screening router or bastion host) and considered less secure because the screening router can bypass the bastion hosts to access trusted services.
A
  • screened host gateway
204
Q

The following are the characteristics of which firewall architecture?

  • most secure
  • employs an external screening route, a dual homed host and a second internal screening router
  • implements concept of DMZ
  • publicly available services are placed on bastion host within DMZ
  • advantages include transparency to end users, flexibility, internal network structure can be masked, provides defence in depth.
  • disadvantages include more expensive, difficult to configure and maintain, more difficult to troubleshoot
A
  • screened subnet
205
Q

What is the reason for placing public services in a DMZ?

A

To separate them from private services on your network

206
Q

What are the 3 ways in which Intrusion Detection Systems can be categorised?

A

Active and Passive
Network based and Host based
knowledge based and behaviour based

207
Q

What is the difference between an active and passive IDS?

A

Active is known as an IPS which blocks attacks, whereas passive is an IDS that only detects attacks?

208
Q

How can an IPS perform a DoS attack on its own network?

A

By flooding the network with alarms that cause it no block connections until no connection or bandwidth is available

209
Q

What is the difference between a network based and host based IDS?

A

network based sniffs all traffic on the network whereas host based is an agent monitoring a single host

210
Q

What is the difference between a knowledge based and behaviour based IDS?

A

Knowledge based uses signatures whereas behaviour based detects anomalies.

211
Q

What kind of devices use remote access?

A

Cable Modems, Wireless Devices and protocols such as asynchronous dial-up, ISDN, xDSL

212
Q

What are the 3 common remote access methods?

A
  • Restricted Access: restricts access based on allowed IP
  • Caller ID: restricts access based on allowed phone No.s
  • Callback: restricts access by requiring a remote user to authenticate with a remote access server (RAS). RAS then disconnects and calls the user back at a pre-configured phone number.
213
Q

In what way is CallerID and Callback more secure method of node authentication than Restricted Access?

A

phone numbers are more difficult to spoof than IP’s

214
Q

What is a way of defeating Callback?

A

Call forwarding

215
Q

PPP incorporates which 3 authentication protocols?

A

EAP, PAP and CHAP

216
Q

Which PPP authentication protocol has the following characteristics?

  • uses a two way handshake to authenticate a peer to a server when a link is initially established
  • transfers passwords in clear text (no protection form replay or brute force attacks)
A

PAP (Password Authentication Protocol)

217
Q

Which PPP authentication protocol has the following characteristics?

  • uses a three way handshake
  • requires both peer and server to be pre-configured with s shared secret stored in cleartext
  • peer uses the secret to calculate the response to a server challenge by using an MD5 one way hash function
A

CHAP (Challenge Handshake Authentication Protocol)

218
Q

What is MS-CHAP?

A

A Microsoft enhancement to CHAP that allows the shared secret to be stored in a encrypted form.

219
Q

Which PPP authentication protocol has the following characteristics?

  • adds flexibility to the PPP protocol by implementing various authentication mechanisms such as MD5-challenge, S-Key, generic token card, digital certificates, etc.
  • implemented on many wireless networks
A

EAP (The Extensible Authentication Protocol)

220
Q

name 4 remote access security technologies?

A

RAS
RADIUS
TACACS
Diameter

221
Q

Which authentication technologies can a RAS server commonly use?

A

PPP, RADIUS, TACACS

222
Q

What are the characteristics of the RADIUS protocol?

A
  • open source, UDP, client-server protocol
  • provides authentication and accountability
  • user provides username/password information to a RADIUS client using PAP or CHAP.
  • RADIUS client encrypts the password and sends the user-name and encrypted password to the RADIUS server for authentication
223
Q

Note regarding Radius:

A

Passwords exchanged between the RADIUS client and RADIUS server are encrypted, however password exchanged between PC client and RADIUS client aren’t if PAP is used. If PC client happens to be RADIUS client all password exchanges are encrypted.

Also the same for TACACS+

224
Q

What is the next generation RADIUS protocol otherwise known as?

A

Diameter

225
Q

What are the advantages of using Diameter over RADIUS?

A
  • uses TCP rather than UDP
  • supports IPSec over TLS
  • has a larger address space
226
Q

What are the characteristics of the authentication protocol, TACACS Terminal Access Controller Access Control System)?

A
  • UDP based which provides authentication, authorisation and accountability (AAA)
227
Q

What is the most common implementation of TACACS?

A

TACACS+ (TCP based and supports practically any authentication mechanism, ie PAP, CHAP, MS-CHAP, EAP, token cards, Kerberos, etc.)

228
Q

What are the 2 advantages of TACACS+?

A
  • wide support for various authentication mechanisms

- granular control of authorisation parameters

229
Q

What is a VPN?

A

Creates a secure tunnel over the internet

230
Q

What can a VPN do to data as it’s transmitted across the internet?

A

Encrypt or encapsulate it

231
Q

The two ends of a VPN are commonly implemented using one of which 4 methods?

A
  • Client to VPN concentrator (or device)
  • Client to Firewall
  • Firewall to Firewall
  • Router to Router
232
Q

What are 5 common VPN protocol standards?

A 
PPTP (Point to Point Tunnelling Protocol)
(L2F) (Layer 2 Forwarding Protocol)
L2TP (Layer 2 Tunnelling Protocol)
IPSec
SSL
233
Q

Which VPN protocol standard has the following characteristics?

  • developed by microsoft
  • enables PPP to be tunnelled through a public network
  • uses native PPP authentication and encryption such as PAP, CHAP and EAP.
  • commonly used for secure dial-up connections
  • operates at layer 2 and is designed for individual client server connections
A

PPTP (Point to Point Tunnelling Protocol)

234
Q

Which VPN protocol standard has the following characteristics?

  • developed by cisco and provides similar functionality to PPTP.
  • operates at layer 2 and permits tunnelling of layer 2 WAN protocol such as HDLC and SLIP.
A

(L2F) (Layer 2 Forwarding Protocol)

235
Q

Which VPN protocol standard has the following characteristics?

  • is an IETF standard that combines microsoft, cisco and other vendor protocols.
  • operates an layer 2 to create secure VPN connections for individual client server connections
A

L2TP (Layer 2 Tunnelling Protocol)

236
Q

Which VPN tunnelling protocol addresses the following end user requirements?

  • Transparency: requires no additional software
  • Robust authentication: Supports PPP authentication protocols, RADIUS, TACACS, smart cards and one time passwords.
  • Local Addressing: The VPN entities rather than the ISP assign IP addresses.
  • Authorisation: managed by the VPN server side, similar to direct dial-up connections.
  • Accounting: Both the ISP and user perform AAA accounting
A

L2TP (Layer 2 Tunnelling Protocol)

237
Q

What does IPSec ensure by providing Layer 3 encryption and authentication to provide an end to end solution?

A

Confidentiality, Integrity and Authenticity

238
Q

Which type of VPN provides a secure connection to web based applications?

A

SSL VPN

239
Q

What is an advantage, but also a disadvantage of an SSL VPN over other protocols?

A

granularity - can grant a user access to a specific application rather than an entire network, however not all applications work over SSL VPN and may lack functions such as File Sharing, printing, etc.

240
Q

What are the 3 basic components of a WLAN?

A

client devices, wireless network cards and wireless access points

241
Q

What is a WNIC in relation to wireless?

A

Wireless network interface card

242
Q

In what type of mode does a wireless access point operate in?
Simplex
Half-duplex
Full-duplex

A

half-duplex

243
Q

What are the 4 basic types of wireless antennas?

A
  • Omni-directional: most common type, short poles that transmit and receive signals with equal strength in all directions around a horizontal axis.
  • Parabolic: dish antennas made of meshed wired grid or solid metal. used to extend wireless signals over great distances
  • Sectorised: similar in shape to omni-directional antennas, but have reflectors that transmit signals in a particular direction to provide greater distance and less interference.
  • Yagi: similar in appearance to a small tv aerial antenna. used for long distances in point to point or point to multipoint wireless applications.
244
Q

Access points and the wireless cards that connect to them must use the same WLAN 802.11 standard. True or False?

A

true

245
Q

What 3 modes can an access point operate in?

A
  • Root mode: default config for most AP’s. directly connected to the wired network. also known as infrastructure mode
  • Repeater mode: doesn’t connect directly to the wired network, but instead provides an upstream link to another AP. extends the range of the WLAN. also known as stand alone mode
    Bridge mode: rare config that isn’t supported in most AP’s. used to connect two separate wired network segments using an AP.
246
Q

What type of wireless architecture does not have any AP’s where the wireless devices communicate directly with each other in a peer to peer network?

A

Ad-hoc

247
Q

What are 3 common security techniques and protocols used by WLAN?

A

WEP
SSID
WPA

248
Q

Which WLAN security technique has the following characteristics?

  • used to uniquely identify a wireless network
  • wireless client must know it before connecting to the network
A

Service Set Identifier (SSID)

249
Q

Which WLAN protocol has the following characteristics?

  • originally developed to provide the same confidentiality as on a wired network
  • uses an RC4 stream cipher for confidentiality and a CRC-32 checksum for integrity
  • uses a 40bit or 104 bit key with a 24bit initialisation vector(IV) to form a 64bit or 128bit key.
  • WEP can easily be cracked due to the short initialisation vector used and other flaws
A

Wired Equivalent Privacy (WEP)

250
Q

Which two methods of authentication does WEP support?

A

Open System Authentication: require no credentials, but encrypts data after client has associated with AP
Shared Key Authentication: uses a 4 way handshake to authenticate with the AP and encrypts data thereafter

251
Q

What two tunnelling protocols can be used to enhance WEP security?

A

IPSec and SSH

252
Q

Which WLAN protocol has the following characteristics?

  • provides significant security enhancements over WEP
  • uses the Temporal Key Integrity Protocol (TKIP) to address some of the encryption problems in WEP.
  • implements a sequence counter to prevent replay attacks and a 64-bit message integrity check
  • supports various EAP extensions including EAP-TLS, EAP-TTLS and PEAP.
A

WiFi Protected Access (WPA)

253
Q

Which WLAN protocol has the following characteristics?

  • supports various EAP extensions including EAP-TLS, EAP-TTLS and PEAP.
  • is an enhancement to WPA
  • uses the AES based algorithm Counter Mode with Cipher Block Chaining Message Authentication Protocol (CCMP) which replaces TKIP and WEP to produce a fully secure WLAN protocol
A

WiFi Protected Access 2 (WPA2)

254
Q

In relation to the WPA protocol, what is TKIP?

A

combines a secret root key with the initialisation vector by using a key mixing function

255
Q

Spam accounts for roughly what percentage of all email traffic?

A

85%

256
Q

What is a risk in using SMTP?

A

most SMTP servers are configured by default to forward or relay all mail regardless of whether the sender or recipient address is valid

257
Q

What is a Realtime Blackhole List (RBL) use for?

A

a blacklist of domain or IP addresses that are known to send spam

258
Q

What 3 risks can be associated with spam email?

A
  • Missing or deleting important emails
  • Viruses and other malicious code
  • Phishing and Pharming scams
259
Q

How can clients and server be protected against the risks posed by email?

A
  • placing mail servers within a DMZ
  • unnecessary or unused services should be disabled (change the default relay setting)
  • most other servers and client PC’s should have port 25 disabled
  • implement a spam filter/secure mail gateway
260
Q

What is SPIM?

A

Spam over instant messaging

261
Q

What is SPIT?

A

Spam over Internet Telephony

262
Q

What are the two principal protocols that make up the World Wide Web?

A

HTTP (Hypertext Transfer Protocol)

HTML (Hypertext Mark-up Language)

263
Q

What is the difference between HTTP and HTML?

A

HTTP is the command and response language used by web browsers to communicate with web servers and HTML is the display language that the defines the appearance of web pages.

264
Q

name 3 common attacks on these protocols?

A
  • Script injection: Hacker injects scripting language commads into forms on web pages in an attempt to fool the web server into sending the contents of a back end database
  • Buffer overflow: Hackers try to send machine language instructions as part of queries to web servers in an attempt to run those instructions
    Denial of Service (DOS): an attacker can send specifically crafter queries to a web server to make it malfunctions or huge volumes of queries to make it stop working.
265
Q

Facsimile Security: 4 general administrative and technical controls?

A
  • Using cover pages that include appropriate routing and classification markings
  • Place fax machines in secure areas
  • using secure phone lines
  • Encrypting fax data
266
Q

What are 3 types of corporate telecommunications infrastructure?

A

PBX (Private Branch Exchange)
POTS (Plain Old Telephone Systems)
VoIP (Voice over IP)

267
Q

How can an organisation protect against fraud and abuse of telecommunications systems?

A

User security policy
regular auditing of calls
strong passwords and patching of systems

268
Q

What 5 methods can be used to forge Caller ID’s to perpetrate fraud or abuse?

A
  • Using a calling card: using a long distance calling card often masks the origin of the call
  • Using callerID services: commercial services are available that can generate any desired callerID
  • Blocking callerID: some wireline or wireless telephone services block callerID
  • Re-configure your telephone switch: a telephone switch connected via a trunk to a telephone network can send callerID data.
  • VoIP: Simple IP smartphone or PC software can be used to generate false callerID data from VoIP phones
269
Q

name 8 common types of network attacks?

A 
Bluejacking and Bluesnarfing
Fraggle
ICMP Flood
Session Hijacking (Spoofing)
Smurf
SYN Flood
Teardrop
UDP Flood
270
Q

Which type of network attack has the following characteristics?
- sending anonymous, unsolicited messages to Bluetooth enabled devices

A

Bluejacking

271
Q

Which type of network attack has the following characteristics?
- stealing personal data from Bluetooth enabled phones

A

Bluesnarfing

272
Q

Which type of network attack has the following characteristics?
- a variant of the SMURF attack that uses UDP packets instead ICMP packets

A

Fraggle

273
Q

Which type of network attack has the following characteristics?
- large number of ICMP packets (usually echo requests) sent to a target network to consume bandwidth or resources

A

ICMP flood

274
Q

Which type of network attack has the following characteristics?
- involves altering a TCP packet so that is appears to come from a known, trusted source

A

Session Hijacking (spoofing)

275
Q

Which type of network attack has the following characteristics?

  • a variation of the ICMP flood attack
  • ICMP echo request packets are sent to the broadcast address of the target network by using a spoofed address on the target network
  • each echo request is then sent to every host on the network in which all hosts respond with an echo reply overwhelming available bandwidth or system resources
A

Smurf

276
Q

Which type of network attack has the following characteristics?
- TCP packets with a spoofed source address requests a connection (SYN). target responds with a (SYN-ACK) packet but source never responds. Half open connections are incomplete communications sessions which can overwhelm a systems resources whilst the system waits for the connection to timeout.

A

SYN flood

277
Q

Which type of network attack has the following characteristics?
- the length and fragmentation offset fields of sequential IP packets are modified causing the target system to become confused and crash.

A

Teardrop

278
Q

Which type of network attack has the following characteristics?
- large number of UDP packets are sent to the target network to consume bandwidth and resources

A

UDP Flood

279
Q

How can a Fraggle attack be countered?

A

Cisco routers can be used to disable TCP and UDP services.

280
Q

How can an ICMP Flood attack be countered?

A

Because ICMP isn’t required for normal network operations, the easiest defence is to drop ICMP packets at the router or filter them at the firewall

281
Q

how can a Smurf attack be countered?

A

Dropping ICMP packets at the router

282
Q

How can SYN Flood attacks be countered?

A

Can be countered on Cisco routers using two methods:

  • TCP intercept which proxies for half-open connections
  • Committed Access Rate: limits bandwidth available to certain types of traffic

Other defences include changing the default maximum number of TCP half-open connections and reducing the timeout period on networked systems

283
Q

How can UDP Flood attacks be countered?

A

drop unnecessary UDP packets at the router

284
Q

What is fragmentation at the Network layer?

A

IP will sub-divide a packet if its size is greater than the maximum size allowed on the local network.

285
Q

What advantages does RIPv2 provide over RIPv1?

A
  • Carries a subnet mask
  • Supports password authentication security
  • specifies the next hop address
  • does not require that routes be aggregated on the network boundary
286
Q

What is an advantage to using OSPF?

A

results in smaller, more frequent updates everywhere. they converge quickly so can prevent routing loops and Count-to-Infinity (when router continually increment the hop count)

287
Q

What is a disadvantage to using OSPF?

A

require large amounts of CPU and memory

288
Q

Which Routing protocol uses a hierarchical structure and supports classless IP address ranges?

A

OSPF

289
Q

What is the latest version of RIP, OSPF and BGP respectively?

A

RIPv2
OSPFv2
BGPv4

290
Q

Which routing protocol allowed the internet to become a de-centralised system?
RIP, OSPF or BGP?

A

BGP

291
Q

Hosts using which routing protocol communicate using TCP and send updated router table information when one host has detected a change? (only the affected part of the routing table is sent)
RIP, OSPF, BGP

A

BGP

292
Q

What are the two message categories in ICMP?

A

Error Messages

Query Messages

293
Q

What are the 4 main functions of ICMP?

A
  • Announce network errors
  • Announce network congestion
  • Assist troubleshooting
  • Announce timeouts
294
Q

IPv4, ICMP, OSPF, IPSec, IPX are all associated with which OSI layer?

A

Network layer

295
Q

What are the 6 control bits used by TCP during data transmission?

A 
URG: Urgent Pointer Field Significant
ACK: Acknowledgement Field Significant
PSH: Push Function
RST: Reset the connection
SYN: Sync sequence numbers
FIN: No more data from sender
296
Q

In a 3 way handshake what assurance does the acknowledgement number provide to the client that requested the connection?

A

proof to the client that the ACK is specific to the SYN the client initiated.

297
Q

TCP, UDP, SPX, RDP are examples of protocols at which OSI layer?

A

Transport

298
Q

What is the H.245 protocol and which layer is it used at?

A

Call control protocol for multimedia communication used at Session layer.

299
Q

L2TP, NetBIOS, PAP, PPTP, RPC are used at which OSI layer?

A

Session

300
Q

What are the two sub-layers of the Presentation layer?

A

CASE (Common Application Service Element) - provides services for the application layer and request services from the session layer
SASE (Specific Application Service Element) - provides application specific services

301
Q

FTP, MIME, Telnet are common protocol at which OSI layer?

A

Presentation

302
Q

FTP, SMTP, HTTP, LDAP, DNS, DHCP are protocols at which OSI layer?

A

Application

303
Q

The following classes of firewall operate at which OSI layers respectively?
Application Proxy
Circuit gateway
Packet switched

A

Application Proxy - Application
Circuit gateway - Session
Packet Filter (SPF) - Network

304
Q

IP classes explained:

A

Class, Range of first octet, No. of octets for Network No., No. of hosts in network.

A 1-127,         1,                 16,777,216
B 128-191,     2,                65,536
C 192-223,   3,                256
D 224-239,  Multicast
E 240-255,   Reserved
305
Q

What Classless Interdomain Routing? (CIDR)

A

does not require that a new address be allocated based on the number of hosts in a network class. used to address shortage of IP’s

306
Q

Ports are broken into 3 ranges. What are they?

A

Well known Ports: 0 to 1023
Registered Ports: 1024 to 49151
Dynamic or Private Ports: 49152 to 65535

307
Q

What can be the reason for choosing a registered port than a well known port?

A

On most systems, the user may not have the privileges to run an application on a well known port.

308
Q

Which protocol is more susceptible to spoofing? TCP or UDP?

A

UDP

309
Q

What is the difference between an extranet and a DMZ?

A

Extranet offers controlled access to authenticated connections, whereas a public facing server in a DMZ must normally support unauthenticated connections.

310
Q

What is RFC 3118 in relation to DHCP?

A

specifies how to implement authentication for DHCP messages so that messages are rejected from invalid sources, ie a protects against an attacker pluggin his machine into a port.

311
Q

In what 4 ways can Ping/tracert (ICMP) maliciously be used?

A
  • Ping of Death: (ICMP echo greater than legal packet limit 65,536 bytes)
  • ICMP re-direct attacks: tells a host to use an attackers machine as default route
  • Ping scanning: basic technique that helps narrow the scope of an attack.
  • Traceroute exploitation: map a victim network to learn about its routing
312
Q

What type of tool is Firewalk?

A

similar to traceroute but instead enumerates a firewall rulset.

313
Q

What is the Internet Group management Protocol (IGMP)?

A

used to manage multi-casting groups, which are a set of hosts anywhere on a network that are interested in a particular multi-cast.

314
Q

What are the 3 versions of IGMP?

A

Ver1: periodically sends queries to a host on its network to update its database of multicast groups membership. Hosts stagger their replies to prevent a storm of traffic. when replies no longer come, agents will stop forwarding multicasts to that group.
Ver2: extends functionality of ver1. does 2 queries, general query and group specific query.
Ver3: allows hosts to specify from which sources they want to receive multicasts.

315
Q

Which Routing Protocol supports automatic failover of routers?

A

Virtual Router Redundancy Protocol (VRRP)

316
Q

What is RPC (Remote Procedure Call)?

A

provides a brokering service between client and application, ie authentication.

317
Q

Why is RPC not used over the open internet?

A

weak authentication mechanism which can be leveraged for privilege escalation by an attacker.

318
Q

CORBA and DCOM are examples of what protocol?

A

RPC

319
Q

What is DNSSEC?

A

DNS authentication

320
Q

What are 3 ways of enhancing DNS security?

A

DNSSEC
Multicasting
Service Directory

321
Q

What port does DNS use?

A

53

322
Q

Can LDAP security be subverted by breaking DNS?

A

Yes

323
Q

What ports are used by NetBIOS for TCP and UDP respectively?

A

TCP: 137 and 138
UDP: 135 (used for remote procedure calls) and 139

324
Q

NIS is a directory service commonly used by which environment?

A

Unix

325
Q

What is a weakness of NIS?

A

Uses RPC

326
Q

What is NIS+?

A

enhancement to NIS that uses Secure RPC.

327
Q

What is CIFS/SMB?

A

A file sharing protocol on Windows. (freeSAMBA is UNIX alternative) designed to run on top of NetBIOS on TCP port 445. authentication can be performed via challenge response.

328
Q

What is the main weakness of CIFS/SMB? (Common Internet File System/Server Message Block)

A

passwords delivered in clear text.

329
Q

What is NFS (Network File Sharing) system?

A

Used by Unix, but can also exist on Linux, Windows, etc.

330
Q

What are the 4 versions of NFS?

A

2, UDP, uses RDP, stateless protocols
3 TCP, uses RDP, stateless protocols
4 TCP, stateful, uses encryption based on kerberos.

331
Q

What are 3 ways of securing NFS?

A

Secure NFS (DES encryption)
Using NFS version 4
tunnel NFS through SSH

332
Q

What port does SMTP use?

A

25

333
Q

What are the two main weaknesses of SMTP?

A

lack of authentication and encryption

334
Q

What is the enhancement to SMTP which allows authentication?

A

ESMTP

335
Q

What 2 ports does FTP use?

A

20 Data stream

21 Control stream

336
Q

What are 3 ways of securing FTP?

A
  • Secure FTP with TLS: uses AUTH TLS to request that FTP session be encrypted
  • SFTP (SSH File Transfer Protocol): not an SFTP protocol so clients cannot be used to talk to an SFTP server, however encrypts both commands and data unlike standard FTP.
  • FTP over SSH: refers to the practice of tunnelling a normal FTP session over SSH. protects only the channel.
337
Q

What are the two transfer modes of FTP?

A

Active (server initiates connection) not common and should be blocked by firewall.
Passive (client initiates connection)

338
Q

What is anonymous FTP

A

guest authentication

339
Q

What is Trivial File Transfer Protocol (TFTP)?

A

used when authentication is not need. simplified version of FTP. operates on UDP 69

340
Q

When is TFTP most commonly used?

A

In LAN’s for pulling packages, ie in booting up a diskles client or deploying images to a client environment

341
Q

What are 3 types of HTTP proxies?

A
  • Anonymising Proxies: allows the anonymisation of HTTP requests. JAP is an example
  • Open proxy Servers: allows unrestricted access to GET commands from the internet, potentially to be used to launch an attack.
  • Content Filtering
342
Q

What is the best way of separating application gateways from the proxy for web browsing?

A

A reverse proxy.

343
Q

Why should a reverse proxy be used?

A

allows direct access from he internet

344
Q

What is HTTP Tunnelling?

A

Allows tunnelling of applications through firewall

345
Q

What is the main concern when using mult-layer protocols?

A

Outdated components

346
Q

What two terms are most commonly associated with Multi-layer protocols?

A

SCADA (Supervisory Control and Data Acquisition) and ICS (Industrial Control System)

347
Q

What are 6 vulnerabilities associated with SCADA?

A
  • Network Perimeter Vulnerabilities
  • Protocol Vulnerabilities through stack
  • Database Insecurities
  • Session Hijacking MIM attacks
  • OS and server weaknesses
  • Device and vendor Backdoors
348
Q

What are two standard industrial communication protocols?

A

MODBUS and FIELDBUS

349
Q

What are weaknesses of the MODBUS and FIELDBUS industrial communication protocols?

A
  • focus in on uptime not security
  • send information in cleartext
  • little or no authentication
350
Q

What is the best way of protecting SCADA systems?

A

physical controls

351
Q

What is a key security function of a boundary router?

A

To prevent IP spoofing

352
Q

What are 3 types of IP spoofing attacks?

A

Non-blind spoofing: attacker on same subnet as victim
Blind spoofing: packets sent to victim to determine sequence numbers
Man in the Middle attack: interception of a legitimate communication (both blind and non-blind spoofing are types of MitM attacks)

353
Q

How does an OS protect against blind spoofing?

A

uses random sequence number generation

354
Q

Network partitioning often includes 3 common security zones. What are they?

A
  • DMZ, Application Zone, Internal Zone.
355
Q

Which network zone would you place proxy servers, SMTP or DNS?

A

DMZ

356
Q

Which network zone would you place web servers, DB, AV, etc?

A

Application Zone

357
Q

A terminal server is a type of which host? Dual-homed or Bastion?

A

Bastion

358
Q

Why are modems discouraged on networks?

A

allow remote users to access a network from almost any analog phone line. allows a backdoor into the network.

359
Q

What is a modem?

A

a modem connected to a user’s computer converts digital signal to analog to be transmitted over a phone line

360
Q

What is a way of combating legacy equipment such as modems on a network?

A

Telephony firewalls

361
Q

What is a Concentrator?

A

multiplex connected devices into one signal , ie FDDI

362
Q

What is GSM?

A

Global Service for Mobile Communications

363
Q

Should Wireless Access Point placement focus on security or strong signal?

A

Strong signal

364
Q

WPA supports which type of authentication?

A

IEEE 802.1x based on the EAP framework

365
Q

What are the 3 EAP authentication models?

A

EAP-TLS: client server authentication with certificates. more secure but more overhead with managing certificates
EAP-TTLS: less secure as only server presents certificate to client, however less overhead to administer
EAP-PEAP: similar to EAP-TLS. server authenticates to client with cert and client employs non-digital cert mechanism to authenticate with server. easier to administer, but still a lack of client side cert

366
Q

What enhancements does WPA2 provide to WEP and WPA?

A
  • uses 802.1x access control to start an EAP authentication method
  • uses Counter Mode/CBC-MAC protocol (CCMP for encryption
367
Q

In relation to Bluetooth what is a Blue Bug attack?

A

an attacker can use the AT commands on a victims phone to initiate calls, send messages

368
Q

What is the IEEE 802.16 standard?

A

WiMAX. Fixed mobile wireless solution meaning that the client devices are highly portable but whilst not in use. 802.16a deals with issues such as improved access. useful for access to MAN network. allow wireless access from long distances

369
Q

What does WiMax use to protect confidentiality of data?

A

AES and authentication options including EAP.

370
Q

What is alternative technology to running fiber cables through a building?

A

Wireless Optics: uses infra-red light or lasers to transmit data between two receivers. have advantages over microwave as they are more difficult to intercept, however they are un-reliable due to weather

371
Q

Light emitting Diodes (LEDs) and Diode Lasers are two types of what?

A

Fiber Optics

372
Q

Why would you use Diode Lasers over LED’s n fiber optics?

A

more bandwidth and distance

373
Q

What is the difference between single mode and multi-mode fiber?

A

in single mode, light is transmitted in a direct path down cable. single mode allows for greater bandwidth, longer cables and is suitable for carrier networks

374
Q

Where should firewalls be installed?

A

Between Domain Trusts

375
Q

What are two important conditions used to determine if a packet should be filtered by a firewall?

A

Address: source/destination address
Service: ie port number TCP UDP

376
Q

An extension to NAT that translates all addresses into one routable IP address if using multiple ports is known as what?

A

Port Address Translation (PAT)

377
Q

What is HAIPE (High Assurance Internet Protocol Encryptor)?

A

based on IPSec, possesses additional restrictions and enhancements. has the ability to encrypt multi-cast data using high assurance hardware encryption which requires that the same key be loaded on all communicating devices. Often used in military.

378
Q

What is SOCKS?

A

a circuit proxy server where users employ a SOCKS client to access a remote server.the client initiates a connection to the SOCKS proxy server which accesses the remote server on behalf of the client.

379
Q

What is a key advantage of SOCKS over other VPN’?

A

The ability to use proxy servers

380
Q

What is a PSTN (Modems and Public Switched Telephone Networks)?

A

designed for analog communications, but today used for data connections over WAN’s.

381
Q

What is the Extensible Messaging and Presence Protocol (XMAPP) and Jabber?

A
  • open instant messaging protocol
  • server based app designed to interact with other instant messaging apps.
  • anyone can offer a Jabber server making the network untrusted.
  • traffic can be encrypted using TLS, though it does not stop eavesdropping on server.
  • offers both cleartext and challenge response authentication though credentials are cached on jabber server.
382
Q

What is Internet relay Chat? (IRC)

A
  • chat system that typically operates through terminal or telnet connections which leave no log related to file transfers.
  • client/server based and unencrypted
  • common platform for social engineering attacks
383
Q

What 4 things does security of instant messaging rely on?

A
  • strength of the protocol
  • quality of the implementation
  • trustworthiness of the operator
  • behaviour of the user
384
Q

What ports does RADIUS typically operate across?

A

1812 and 1813, both TCP and UDP

385
Q

What ports does SNMP operate accross?

A

161 and 162 for both TCP and UDP

386
Q

What port does Telnet operate on?

A

TCP 23

387
Q

What is rlogin, rsh and rcp?

A

rlogin: protocol for granting remote access to a machine, normally a Unix server.
rsh: grants direct remote command execution
rcp: copies data from or to a remote machine

388
Q

What are the weaknesses or rlogin?

A

unencrypted
authentication is host/IP based. although it will take a user ID, the ID is not verified as rlogin relies on trustworthiness of the host.

389
Q

What is a secure alternative to rlogin, crp, rsh?

A

SSH

390
Q

What ports do virtual network terminal services typically operate across?

A

80TCP or 443UDP

391
Q

What is the main method of protecting terminal services?

A

Patching

392
Q

What is a teleworker?

A

A mobile worker

393
Q

What is the Tree Network Topology?

A

similar to a bus, except devices connect to a branching cable.

394
Q

What is CSMA (Carrie Sense Multiple Access)?

A
  • only one device can transmit a time
  • devices compete for available bandwidth
  • referred as a contention-based protocol.
395
Q

What two types of CSMA exist?

A

CSMA/CA(collision avoidance): uses jamming signals so other devices don’t transmit. used in the 802.11 wireless standard
CSMA/CD(collision detection): listens for carrier before transmitting data. used as part of the IEEE 802.3 (ethernet) standard

396
Q

What IEEE standard does token ring use?

A

IEEE 802.5

397
Q

What attack allows an attacker to move across VLAN’s?

A

VLAN hopping

398
Q

What is port scanning?

A

The act of probing tcp services on a machine

399
Q

FIN, NULL and XMAS scanning explained:

A

request to close a connection sent to a target machine. works with UNIX, not Windows. if a response is received it provides recognition that port is open.

400
Q

How to protect against a FIN attack?

A

Firewall Stealth Mode

401
Q

What is a network tap?

A

a device with the ability to copy all data flowing through a network in real time for analysis and storage. can also be deployed for purposes of compliance with legal requirements related to retention of records/transactions for fraud.

402
Q

What are the 4 common steps in the methodology of a network attack?

A

-Target Acquisition: intelligence gathering through network scanning. split network security zone, NAT, etc can protect against this.
target Analysis: target analysed for security weaknesses/vulnerabilities
Target Access: social engineering, unauthorised access via vulnerability.
Target Appropriation: escalate privileges

403
Q

What are two types of scanning tools?

A

Nessus: vulnerability scanner
NMap: discovery scanner

404
Q

What is the difference between a vulnerability scan and a penetration scan?

A

Vulnerability scan uncovers vulnerabilities, whereas penetration scanning exploits them

405
Q

What is an Overlapping fragment attack?

A

used to subvert packet filters that only check the first fragment of a fragmented packet. other packets follow that overwrite the first fragment with malicious data. solution is for TCP/IP stacks not to allow fragments to overwrite each other.

406
Q

What is source routing exploitation and how would you protect against it?

A

where an attacker can specify the path to take to a destination. source routing can be disabled on routers

407
Q

What is the main weakness of Network News Transport Protocol (NNTP)?

A

Authentication. confidentiality is less of a concern as the message is supposed to be published, rather proper identification and authentication of the sender is the issue.

408
Q

What is the Finger User Information Protocol?

A

An identification service that allows a user to obtain information about the last login time of a user and whether he or she s currently logged in. implemented as a UNIX daemon.

409
Q

Why is the Finger User information protocol no longer widely used?

A
  • has been subject to a number of security exploits
  • raises privacy and security concerns. can be abused for social engineering
  • the users self-actuation
410
Q

What ports does NTP (Network Time Protocol) use?

A

TCP and UDP 123

411
Q

How to protect NTP?

A
  • restrict access based on IP
  • NTP3 uses symmetric encryption for authentication
  • NTP4 uses asymmetric encryption for authentication
412
Q

What is the main countermeasure to DNS spoofing?

A

establish DNS servers dedicated to their domain and vigorously monitor them. an internal DNS server which only accepts queries from the internal network/users.

413
Q

To avoid Information Disclosure in DNS, what should a business do?

A

Use split-DNS zones and refrain from using telling name conventions for servers.

414
Q

What are split naming zones?

A

names of hosts that are only accessible on the intranet that are available on the internet

415
Q

What is TCP SYN scanning?

A

no complete connection is opened. instead only the initial steps of the handshake are performed. makes the scans harder to detect but can’t be stopped by firewalls.

CISSP (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions