Threat Defense Technologies

Question 1

AAA

Answer 1

Authentication, Authorization, Accounting

Question 2

Authentication

Answer 2

Who is the user?

Question 3

Authorization

Answer 3

Which resources the user is allowed to access and which operations the user is allowed to perform?

Question 4

Accounting

Answer 4

What did they do?

Question 5

AAA Uses

Answer 5

Device access/administration. Network Access.

Question 6

Cisco Traffic Telemetry Methods

Answer 6

Network admin needs to monitor the kind of traffic, unusual network traffic, and device failures
Dates & time between devices should be accurate and sync(NTP-Network Time Protocol)
Notification about network device status or SNMP traps
Notification about unusualy network activity using logging
Exporting the network traffic flows using Net-flow

Question 7

What is a Firewall?

Answer 7

A system or a group of systems that manages access between two or more networks
Wall=what traffic is allowed to pass between
Fire=Allowed traffic will be inspected based on security policies
Firewall configured between trusted and untrusted zones
Main scope to control traffic coming from untrusted zones(internet)

Question 8

Reasons to have a Firewall

Answer 8

And essential element for network security

• Internal network and hosts are unlikely to be properly secured
• Internet is a dangerous place
• To prevent an attacker from launching DOS attacks
• To prevent unauthorized modification/access of internal data

Question 9

Modern Firewall Design

Answer 9

Firewalls define traffic policies between security zones(Network Segments)

• Inside(Most trusted. LAN Users and endpoints)
• Outside(Untrusted Networks. Internet)
• DMZ(Maintain public servers/services. Accessible from the LAN and Internet)

Question 10

IPS(Intrusion Prevention Systems)

Answer 10

Hardware/software used to detect and prevent intrusion or malicious traffic

• Identify, classify, then stop/block in real time
• Performs deep packet inspection.
• Examines network traffic flows to detect/prevent vulnerability exploits.
• Ensure that protocols are running per standards
• Identify intrusion, log information about intrusion
• Attempt to stop/block intrusion. report intrusion.

Question 11

VPN(Virtual Private Network)

Answer 11

Using an intermediary group of logically connected devices to simulate p2p/p2m connections without needing to directly connection point-to-point
-Used primarily to reduce costs from using leased lines
X.25, frame relay, ATM, MPLS, L2TPv3, GRE,DMVPN,IPSEC

Question 12

Next Generation Firewall Features

Answer 12

• Identity based access controls. Rules based on user/pass or security tags
• URL Filtering. Which users can access what websites
• Application and visibility control. What applications are you using while browsing(facebook, chat, audio, video)
• Next gen IPS(NGIPS)
• Advanced Malware Protection. Scan content to defend known and unknown malwares