Midterm Practice Exam – Flashcards

TKIP WPA uses TKIP for encryption. TKIP uses rotating encryption keys for added security over WEP. AES encryption is used with WPA2. WEP is a security method for wireless networks that provides encryption through the use of a shared encryption key (the WEP key). IPsec is an encryption method that is used for VPN tunneling; while it can be used on a wireless network, it is used in addition to encryption provided by either WEP, WPA, or WPA2. 802.1x is an authentication method for wired and wireless networks.

Packet sniffer A packet sniffer is special software that captures (records) frames that are transmitted on the network. Use a packet sniffer to: •View packet contents. •Identify the types of traffic on a network. •View the exchange of packets between communicating devices. For example, you can capture frames related to DNS and view the exact exchange of packets for a specific name resolution request. •Analyze packets sent to and from a specific device. A load tester simulates a load on a server or service. A throughput tester measures the amount of data that can be transferred through a network or processed by a device (such as the amount of data that can be retrieved from disk in a specific period of time). System and event logs record what has happened on a device, but do not record individual frames or packets.

Baseline A baseline is a snapshot of the performance statistics of the network or devices. The baseline is used as a logical basis for future comparison. Baselines enable you to effectively monitor the performance of your system to determine when changes negatively impact performance or when systems need upgrading or replacing. It is important to measure network performance at subsequent intervals to see how your server is performing compared to the baseline. Logs contain a record of events that have happened on a system. Logging capabilities are built into operating systems, services, and applications. Log entries are generated in response to configuration changes, changes in system state, or in response to network conditions. A network diagram shows the logical and/or physical layout of your network. The network diagram could be a collection of diagrams showing the location and IP addresses of hubs, switches, routers, and firewalls.

A user accidentally deletes the new product designs Internal threats are intentional or accidental acts by employees including: •Malicious acts such as theft, fraud, or sabotage. •Intentional or unintentional actions that destroy or alter data. •Disclosing sensitive information through snooping or espionage. External threats are those events originating outside of the organization that typically focus on compromising the organization's information assets. Examples are hackers, fraud perpetrators, and viruses. Natural events are those events that may reasonably be expected to occur over time. Examples are a fire or a broken water pipe.

RADIUS combines authentication and authorization into a single function; TACACS+ allows these services to be split between different servers. TACACS+ provides three protocols, one each for authentication, authorization, and accounting. This allows each service to be provided by a different server. In addition, TACACS+: •Uses TCP. •Encrypts the entire packet contents. •Supports more protocol suites than RADIUS.

Route summarization Route summarization optimizes routing by grouping contiguous networks that use the same routing path and advertising a single route as the destination for the grouped subnets. Keep in mind that summarization: •Reduces the size of the routing table. A single route to the summarized network takes the place of multiple routes to individual subnets. •Speeds convergence. The accessibility of each subnet address is indicated by the accessibility of the summarized address. •Retains all necessary routing information, so all networks are still reachable after summarization. Route redistribution is the process of learning routes from one routing protocol and advertising them as another routing protocol (e.g., learning routes from OSPF and advertising them as RIP). First Hop Redundancy Protocol (FHRP) is used to allow hosts to dynamically switch between a main router and one or more redundant routers, should an outage occur. EIGRP is a routing protocol method used to exchange routing information in an autonomous system.

Hotfix A hotfix is an operating system patch that corrects a specific known problem. Microsoft typically releases hotfixes monthly. Service packs include a collection of hotfixes and other system updates. Service packs are not released as often, but contain all hotfixes released to that time

An agreement which identifies the employee's rights to use company property such as Internet access and computer equipment for personal use. The acceptable use agreement identifies the employee's rights to use company property such as Internet access and computer equipment for personal use. The non-compete agreement prohibits an employee from working for a competing organization for a specified time after the employee leaves the organization. The employee monitoring agreement outlines the organization's monitoring activities. The non-disclosure agreement is a legal contract between the organization and the employee that specifies the employee is not to disclose the organization's confidential information.

Mesh This type of network uses a physical mesh topology. The key characteristics of a mesh topology are: •There's no central connecting point. •Any host can communicate directly with any other host on the network. A mesh network, such as this one, is usually impractical on a wired network. Each host would have to have a separate, dedicated network interface and cable for each host on the network. However, a mesh topology can be implemented with relative ease on a wireless network due to the lack of wires.

PTZ A Pan Tilt Zoom (PTZ) camera lets you dynamically move the camera and zoom in on specific areas to monitor (cameras without PTZ capabilities are manually set looking a specific direction). Automatic PTZ mode automatically moves the camera between several preset locations; manual PTZ lets an operator remotely control the position of the camera. A bullet camera has a built-in lens and is long and round in shape. Most bullet cameras can be used indoor or outdoor. A c-mount camera has interchangeable lenses and is typically rectangle in shape with the lens on the end. Most c-mount cameras require a special housing to be used outdoors. A dome camera is a camera protected with a plastic or glass dome. These cameras are more vandal-resistant than other cameras. PTZ cameras can be bullet, c-mount, or dome cameras.

One IEEE standard for wireless is 802.11b

NAC Network Access Control (NAC) controls access to the network by not allowing computers to access network resources unless they meet certain predefined security requirements. Conditions that can be part of the connection requirements include requiring that computers have: •Anti-virus software with up-to-date definition files. •An active personal firewall. •Specific operating system critical updates and patches. A client that is determined by the NAC agent to be healthy is given access to the network. An unhealthy client, who has not met all the checklist requirements, is either denied access or can be given restricted access to a remediation network, where remediation servers can be contacted to help the client to become compliant. A demilitarized zone (DMZ) is a buffer network (or subnet) that sits between the private network and an untrusted network (such as the Internet). A virtual LAN (VLAN) is a logical grouping of computers based on switch port. VLAN membership is configured by assigning a switch port to a VLAN. An intrusion detection system (IDS) is a special network device that can detect attacks and suspicious activity. A network-based IDS (NIDS) scans network traffic looking for intrusion attempts. Network Address Translation (NAT) modifies the IP addresses in packets as they travel from one network (such as a private network) to another (such as the Internet). NAT allows you to connect a private network to the Internet without obtaining registered addresses for every host. Hosts on the private network share the registered IP addresses.

ACL When you configure a router as a firewall, you configure the access control list (ACL) with statements that identify traffic characteristics, such as the direction of traffic (inbound or outbound), the source or destination IP address, and the port number. ACL statements include an action to either allow or deny the traffic specified by the ACL statement. IPsec is a protocol for encrypting packets. RDP and VNC are remote desktop protocols used for remotely accessing a computer's desktop. PPP is a protocol for establishing a remote access connection over a dial-up link.

Your copy is the same as the copy posted on the website. A hash is a function that takes a variable-length string (message) and compresses and transforms it into a fixed-length value. Hashes ensure the data integrity of files and messages in transit. The sender and the receiver use the same hashing algorithm on the original data. If the hashes match, then the data can be assumed to be unmodified. Hashes do not ensure confidentiality (in other words, hashes are not used to encrypt data). Non-repudiation proves the source of a file, and is accomplished using digital signatures.

A program that performs a malicious activity at a specific time or after a triggering event A logic bomb is a program that performs a malicious activity at a specific time or after a triggering event. Logic bombs can be planted by a virus, a Trojan horse, or by an intruder. Logic bombs may perform their malicious activity at a specific time and date or when a specific event occurs on the system, such as logging in, accessing an online bank account, or encrypting a file. A type of malicious code, similar to a virus, who's primary purpose is to duplicate itself and spread, while not necessarily intentionally damaging or destroying resources is a worm. A program that appears to be a legitimate application, utility, game, or screensaver which performs malicious activities surreptitiously is a Trojan horse. A program that has no useful purpose, but attempts to spread itself to other systems and often damages resources on the systems where it is found is a virus.

100.55.255.255 The broadcast address for the subnet is the last address on the subnet. In this example, the address uses 16 bits in the subnet mask (255.255.0.0), meaning that the first two octets indicate the subnet address (100.55.0.0), and the last two octets are used for host addresses. The last possible address on this subnet is 100.55.255.255.

The WAN provider is throttling bandwidth on the link. In this scenario, its possible that the WAN service provider is the cause of the problem. You should check the contract with the service provider to make sure they aren't throttling the bandwidth of the WAN link. It's not uncommon for service providers to impose bandwidth or utilization caps that could be hampering communications. Because connectivity exists between the home and branch office networks in this scenario, the following are very unlikely to be the cause of the problem: •A disabled WAN interface •A protocol mismatch •An authentication mismatch •An IP address misconfiguration

A proxy server is blocking access to the websites. A proxy server can be configured to block Internet access based on website or URL. Many schools and public networks use proxy servers to prevent access to websites with objectionable content. Ports 80 and 443 are used by HTTP to retrieve all Web content. If a firewall were blocking these ports, access would be denied to all websites. Port forwarding directs incoming connections to a host on the private network. Port triggering dynamically opens firewall ports based on applications that initiate contact from the private network.

Firewall A firewall is the best device to deploy to protect your private network from a public untrusted network. Firewalls are used to control traffic entering and leaving your trusted network environment. Firewalls can manage traffic based on source or destination IP address, port number, service protocol, application or service type, user account, and even traffic content. Routers offer some packet-based access control, but not as extensive as that of a full fledged firewall. Hubs and gateways are not sufficient for managing the interface between a trusted and an untrusted network.

You must configure your DHCP server with an option that delivers the IP address of the DNS server (Option 06). In this scenario, the DHCP server hasn't been configured to deliver the IP address of the DNS server to the workstations. When users try to access websites with a browser, they receive an error message because their workstations can't resolve URLs into IP addresses. To fix this, you must enable option 06 Domain Name Server on the DHCP server and configure it with the IP address of your DNS server. You could statically configure APIPA on each workstation with the IP address of the DNS server. However, this would defeat the purpose of implementing a DHCP server in the first place.

nslookup Use nslookup to troubleshoot name resolution problems. Because the ping test was successful, you know that both the client and the server can communicate using TCP/IP with IP addresses. This tells you that the problem is related to name resolution.

Clustering Clustering connects multiple servers together using special software. If one of the servers in the cluster fails, the other servers immediately take over the tasks the failed server was working on; resulting in no downtime for the end user. Adapter bonding increases fault tolerance of a single server system by implementing multiple network boards in the system that function as a single adapter. Mirroring also increases fault tolerance by creating a mirror copy of the server hard drive on one or more other hard drives. Storage area networks are usually used in conjunction with clustering to provide a common disk system that all servers in the cluster share.

Replace the Omni-directional antenna with a directional antenna A directional antenna is designed to create a narrow, focused signal in a particular direction. This focused signal provides greater signal strength between two points and increases the distance that the signal can travel. Because directional antennas provide a stronger point-to-point connection, they are better equipped to handle obstacles that may be in the way of the signal. The default antenna used with this configuration is an omni-directional antenna that disperses the RF wave in an equal 360-degree pattern. This antenna is commonly used to provide access to many clients in a radius.

Trunking

Satellite Satellite capability is available even in areas that do not have a local network infrastructure. Satellite requires a local portable transmitter with an antenna directed skywards to a satellite. Satellite service providers offer nearly 100% global network coverage by maintaining a series of satellites circling the earth in geosynchronous orbit. Dialup, ISDN and cable modem, require a local network infrastructure provided by either the telephone company or cable television company.

EMI interference In this case, the most likely cause of the problem is electromagnetic interference (EMI) from the florescent lights. Cables run near air conditioners, lights, or other large electronic devices can create interference for data traveling through the cable. UTP cables have a recommended segment cable length of 100 feet. Distances beyond this length may require signal regeneration. Devices such as Ethernet switches provide signal regeneration. Attenuation describes the process of signal degradation as it passes through network media. As mentioned, UTP cable can be run 100 feet before attenuation becomes a significant problem. Crosstalk refers to the interference caused by overlapping signals when cables are run in close proximity to each other.

DNS poisoning DNS poisoning occurs when a name server receives malicious or misleading data that incorrectly maps host names and IP addresses. In a DNS poisoning attack: •Incorrect DNS data is introduced into a primary DNS server. •The incorrect mapping is made available to client applications through the resolver. •Traffic is directed to incorrect sites. ARP poisoning corrupts the ARP cache or sends incorrect ARP data that spoofs MAC addresses, causing devices to send frames to the wrong host or an unreachable host. Spam sent in such great amounts can consume bandwidth or fill a mailbox, leaving no room for legitimate traffic. The SYN flood exploits the TCP threeway handshake.

An unmanaged switch and CAT5e cabling. You should purchase an unmanaged switch and CAT5e cabling. Switches offer guaranteed bandwidth to each switch port and fullduplex communication. Unmanaged switches are autonomous in their function, requiring no port management or configuration. CAT5e cabling supports transfer speeds up to 1000 Gbps. Purchasing a new cable modem with a builtin switch would be more expensive than an unmanaged switch. Additionally, CAT6a cabling is unnecessary for this type of network. Because all of the computers already have wired NICs, purchasing a wireless AP and three new wireless NICs would introduce new costs. The wireless AP would also require additional management and configuration. Hubs suffer from collisions, so only halfduplex communication is possible. This wouldn't support 1000 Gbps speeds. A small business with four computers doesn't need the additional features that a managed switch provides.

The first router in the path to the destination network. The next hop router is the first (or next) router in the path to the destination network. Each router looks at the destination network in the packet, then consults the routing table to identify the next hop router to the destination network. The hop count identifies the number of routers in the path to the destination network. A default gateway router is a router that is used for packets used to external networks. Most routers do not have a default gateway setting, but instead use a default route setting which identifies a next hop router for all unknown networks.

RIP Explanation RIP networks are limited in size to a maximum of 15 hops between any two networks. A network with a hop count of 16 indicates an unreachable network. The other routing protocols do not use the hop count as the metric. EIGRP uses bandwidth and delay for the metric. OSPF and ISIS use a relative link cost. BGP uses paths, rules, and policies for the metric

WPA2 WiFi Protected Access 2 (WPA2) is currently the most secure wireless security specification. WPA2 includes specifications for both encryption and authentication. WPA was an earlier implementation of security specified by the 802.11i committee. WEP was the original security method for wireless networks. WPA is more secure than WEP, but less secure than WPA2. Kerberos is an authentication method, not a wireless security method.

Point to point A pointtopoint circuit is established between two locations. Each destination requires a separate circuit. A pointtomultipoint circuit is a single circuit that can be used to reach multiple locations. A packet switched network allows data to be broken up into packets. Packets are transmitted along the most efficient route to the destination. A hybrid topology combines multiple different topologies.

To prevent hackers from accessing your network Firewalls prevent unauthorized users from accessing private networks connected to the Internet. You should never allow public access to your DHCP server. A proxy server caches web pages. A NAT router or ICS translates Web addresses to private IP addresses. A proxy server and NAT software might be implemented on the same device as your firewall, but they are different concepts.

Install shielded cables near the elevator Interference is a signal that corrupts or destroys regular networking signals. Interference affects the availability of a network because normal communications are not possible. Sources of interference include elevators, generators, motors, and fluorescent lights. Use a UPS or a dedicated power circuit to ensure that devices have constant power. Use a dedicated A/C unit to keep a server room or closet cool.

Bitlevel cloning Only bitlevel cloning is recognized as a sufficient method for duplicating hard drives for forensic investigative purposes. Filebyfile copying, active sector cloning, and drive mirroring are all insufficient copying methods for forensic investigative purposes. These methods fail to duplicate data that has been deleted or which is stored in the slack space of the drive.

Syslog Syslog is a protocol that defines how log messages are sent from one device to a logging server on an IP network. The sending device sends a small text message to the syslog receiver (the logging server). The Open Vulnerability and Assessment Language (OVAL) is an international standard for testing, analyzing, and reporting the security vulnerabilities of a system. LC4 (previously called LOphtcrack) is a password cracking tool. Nmap is a network mapping tool that performs ping and port scans.

Messages are broadcast to all devices connected to the network. Messages sent using a physical bus topology are broadcast to all devices in the network. The device in the middle of the star (typically a hub), receives the message and forwards it on to all other devices.

IMAP4 IMAP4 allows a mail server to hold messages for a client. A POP3 server requires the user to download his or her email. SMTP allows a user to send email to a server. The NTP protocol synchronizes the clocks of all computers on a network.

Wiring schematic A wiring schematic is a type of network diagram that focuses on the physical connections between devices. The wiring diagram typically shows: •The location of drop cables and ports within offices or cubicles. •The path that wires take between wiring closets and offices. •A labeling scheme that matches endpoints in offices and cubicles with specific switch ports or punchdown block locations. A baseline is a record that shows normal network statistics. A policy is a document that describes the overall goals and requirements for a network. A policy identifies what should be done, but may not necessarily define how the goal is to be reached. A procedure is a stepbystep process outlining how to implement a specific action. The design of a procedure is guided by goals defined in a policy, but go beyond the policy by identifying specific steps that are to be implemented.

Use a different Channel ID. Overlapping wireless networks should use different channels to ensure that they do not conflict with each other. Even though you should use a different Service Set Identifier anyway, you would also need to configure a different channel for each of the wireless networks. Using 802.11b instead of 802.11g would not avoid a conflict between the networks, and would limit the speed of the wireless network to 11Mbps as opposed to 54Mbps available with 802.11g. Using Wired Equivalent Privacy (WEP) is a prudent security measure; however, it does not prevent the conflicts that can occur with overlapping wireless networks that use the same channel ID.

Dynamic Use dynamic NAT to share public addresses with multiple private hosts. Dynamic NAT allows private hosts to access the Internet, but does not allow Internet hosts to initiate contact with private hosts.

CSMA/CA 802.11x standards for wireless networking all support the CSMA/CA (carrier sense multiple access with collision avoidance) type of communication path sharing technology. This CSMA/CA allows for multiple baseband clients to share the same communication medium.

netstat Use the netstat command to check the status of a TCP connection.

RADIUS server Port authentication is provided by the 802.1x protocol, and allows only authenticated devices to connect to the LAN through the switch. 802.1x requires a RADIUS server (also called an AAA server) to validate the authentication credentials. A router or a Layer 3 switch are required to enable communication between VLANs. A proxy server controls access based on URL or other upperlayer information.

RJ-45 RJ-45 connectors are used with Ethernet 10BaseT networks.

ping The output shown was produced by the ping utility. Specifically, the information output was created using theping t command. The t switch causes packets to be sent to the remote host continuously until stopped manually. ping is a useful tool for testing connectivity between devices on a network. Using the t switch with ping can be useful in determining whether the network is congested, as such a condition will cause sporadic failures in the ping stream. tracert is similar to ping in that it tests connectivity between two hosts on the network. The difference is that tracert reports information on all intermediate devices between the host system and the target system. ping, on the other hand, does not report information on intermediate devices. nslookup is a tool provided on Linux, Unix and Windows systems that allows manual name resolution requests to be made to a DNS server. This can be useful when troubleshooting name resolution problems. ifconfig is a tool used on Unix, Linux and Macintosh systems to view the configuration of network interfaces, including TCP/IP network settings.

Kerberos Kerberos grants tickets (also called a security token) to authenticated users and to authorized resources. Kerberos uses the following components: •An authentication server (AS) accepts and processes authentication requests. •A service server (SS) is a server that provides or holds network resources. •A ticket granting server (TGS) grants tickets that are valid for specific resources on specific servers. 802.1x is an authentication mechanism for controlling port access. 802.1x uses RADIUS/TACACS+ servers. MSCHAP is Microsoft's proprietary method used for remote access connections. MSCHAP uses a threeway handshake (challenge/response) to perform authentication using a hashed form of a shared secret (password). A Public Key Infrastructure (PKI) is a system of certificate authorities that issue certificates, but is not a mechanism used for authentication.

NAC Network Access Control (NAC) prevents devices from accessing network resources unless they meet certain predefined security requirements. Conditions that can be part of the connection requirements include requiring that computers have: •Antivirus software with uptodate definition files. •An active personal firewall. •Specific operating system critical updates and patches. A client that is determined by the NAC agent to be healthy is given access to the network. An unhealthy client who has not met all the checklist requirements is either denied access or can be given restricted access to a quarantine network, where remediation servers can be contacted to help the client to become compliant. A demilitarized zone (DMZ) is a buffer network (or subnet) that sits between the private network and an untrusted network (such as the Internet). A virtual LAN (VLAN) is a logical grouping of computers based on switch ports. VLAN membership is configured by assigning a switch port to a VLAN. An intrusion detection system (IDS) is a special network device that can detect attacks and suspicious activity. A networkbased IDS (NIDS) scans network traffic looking for intrusion attempts. Network Address Translation (NAT) modifies the IP addresses in packets as they travel from one network (such as a private network) to another (such as the Internet).

Inform senior management Before starting a penetration test (also called a pen test) it is important to define the Rules of Engagement (ROE), or the boundaries of the test. Important actions to take include: •Obtain a written and signed authorization from the highest possible senior management. •Delegate personnel who are experts in the areas being tested. •Gain approval from the Internet provider to perform the penetration test. •Make sure that all tools or programs used in the testing are legal and ethical. •Establish the scope and timeline. •Identify systems that will not be included in the test. Performing reconnaissance, social engineering, or system scanning are all actions performed during a penetration test. However, no actions should be taken before approval to conduct the test is obtained.

Crossover Use a crossover cable to connect two switches through their uplink ports, or to connect the two switches through regular ports. Use a straightthrough cable to connect the uplink port on one switch to a regular port on another switch. Use a rollover cable to connect a workstation to the console port of the switch. Use a loopback plug connected to a single port for troubleshooting.

Late collisions In the output of the show interfaces command, the late collisions statistic displays the number of collisions that occurred after the 64th byte of the frame was transmitted. This may be caused by mismatched duplex settings. Runts are frames that are too small. Giants are frames that are too big. CRC errors are frames that did not pass the FCS check.

Layer 2 Class of Service (COS) marks and classifies individual frames at Layer 2. Frames are assigned a priority value between 0 and 7 to the 3-bit COS field.

Redundancy Redundancy is the primary security feature that can be designed into a network's infrastructure to protect and support availability since it identifies single points of failure. Periodic backups are better than no backups, but real-time and off-site backups are better protections for availability. Fiber optic cables are not a real protection for a network's availability, as they only provide the security benefit of eavesdropping protection. Switches are better than hubs, but there are infrastructure security measures that provide more significant protections for availability.

Incorrect default gateway In this example, the default gateway address is incorrect. The default gateway address must be on the same subnet as the IP address for the host. The host address is on the 192.168.1.0/24 subnet, but the default gateway address is on the 192.168.2.0 subnet.

Require users to install the configuration profile. Enroll the devices in a mobile device management system. A mobile device management (MDM) solution can be implemented that pushes security policies directly to each tablet device over a network connection. This option enables policies to be remotely enforced and updated without any action by the end user. The tablet devices must be enrolled in the MDM system before the policy settings can be applied. One of the key problems associated with managing mobile devices is the fact that they can't be joined to a Windows domain. This means Group Policy can't be used to automatically push security settings to mobile devices. For devices running Apple's iOS operating system, security settings can be distributed in a configuration profile. The profile can be defined such that only an administrator can delete the profile, or you can lock the profile to the device so that it cannot be removed without completely erasing the device. However, this option relies on the end user to install the profile, which can be problematic. It's also not a dynamic strategy; making even the smallest change to your mobile device security policies would require a great deal of effort to implement.

Increases network performance Provides a failover solution for network adapters

Defining a unique hardware address for each device on the network Letting devices on the network have access to the LAN The MAC sublayer defines a unique MAC or data-link address for each device on the network. This address is usually assigned by the manufacturer. The MAC sublayer also provides devices with access to the network media.