Security + Domain 1 – Flashcards

Unlock all answers in this set

Unlock answers
question
Firewalls. (1.1)
answer
Provide protection by controlling traffic entering and leaving a network. They manage traffic using filters or rules. (1.1)
question
Packet Filter Firewall. (1.1)
answer
Works on the Network Layer 3 and Transport Layer 4. Filters traffic based on basic ID items found in the network packets header. This includes Destination addresses port numbers and protocols used (1.1)
question
Circuit-Level Gateway Firewall. (1.1)
answer
Monitoring occurs at the Network Layer 3 or the Session Layer 5. Filters traffic by filtering on the connection between an internal trusted host and an external untrusted host. Job is to make sure packets involved are used in a proper manner. Once a circuit level gateway allows a connection no further filtering on that communication is performed. (1.1)
question
Application-Level Gateway Firewall. (1.1)
answer
Operates at the Application Layer 7. Filters traffic based on user access, group membership, the application or service used, or the type of resource being transmitted. Such a firewall can be called a proxy. Focused on aspects of a specific appliance and protocol combination as well as actual content of the conversation. (1.1)
question
Stateful Inspection Firewall. (1.1)
answer
Deep packet inspections, creates rules on the fly. Can make intelligent and complex filtering decisions based on higher order information. Related to TCP. (1.1)
question
Routers. (1.1)
answer
Layer 3 device that enables traffic from one network segment to traverse into another network segment. However, the traffic must pass through the router's filters in order to make the transition. (1.1)
question
Switches. (1.1)
answer
A layer 2 device, it receives signals in one port and transmits them out the port where the intended recipient is connected. Often used to create VLANs. (1.1)
question
Load Balancer. (1.1)
answer
Used to spread or distribute network traffic load across several network links or network devices. Its purpose is to obtain more optimal infrastructure utilization, minimize response time, maximize throughput, reduce overloading, and eliminate bottlenecks. (1.1)
question
Proxy. (1.1)
answer
A variation of an application-level firewall or circuit-level firewall. Serves as a barrier against external threats to internal clients. Performed by using Network Address Translation (NAT), which hides the IP (Internet Protocol) configuration of internal clients and substitutes the IPconfig of the proxy server's own public external NIC in outbound requests. (1.1)
question
Proxy Server. (1.1)
answer
Used as a proxy or middleman between clients and servers. (1.1)
question
Host Based Intrusion Detection System (HIDS). (1.1)
answer
Used to protect the local client, user, and network from various malicious events. (1.1)
question
Intrusion Detection System (IDS). (1.1)
answer
An automated system that either watches activity in real time or reviews the contents of audit logs in order to detect intrusions or security policy violations. (1.1)
question
Network-Based Intrusion Detection System (NIDS). (1.1)
answer
watches network traffic in real time. It's reliable for detecting network focused attacks, such as bandwidth-based DoS attacks. (1.1)
question
Host Based Intrusion Detection System (HIDS). (1.1)
answer
Watches the audit trails and log files of a host system. It's reliable for detecting attacks directed against a host, whether they originate from an external source or are being perpetrated by a user locally logged in to the host. (1.1)
question
Detection Mechanisms. (1.1)
answer
Signature detection compares event patterns against known attack patterns (signatures) stored in the IDS database. Anomaly detection watches the ongoing activity of the environment and looks for abnormal occurrences. (1.1)
question
Response Methods. (1.1)
answer
An IDS with active detection and response is designed to take the quickest action to reduce potential damage caused by an intruder. This response may include shutting down the server or the affected service or disconnecting suspicious connections. An IDS with passive detection and response takes no direct action against the intruder; instead it may increase the amount of data being audited and recorded and notify the administrators about the intrusion. (1.1)
question
Behavior-based Detection. (1.1)
answer
Relies upon the establishment of a baseline or a definition of normal and benign. Once this baseline is established, the monitoring tool is able to detect activities that vary from that standard of normal. (1.1)
question
Signature-based Detection. (1.1)
answer
Relies on a database of signatures or patterns of known malicious or unwanted activity. The strength of a signature-based system is that it can quickly and accurately detect any event from its database of signatures. (1.1)
question
Anomaly-based Detection. (1.1)
answer
Relies on definitions of all valid forms of activity. This database of known valid activity allows the tool to detect any and all anomalies. (1.1)
question
Protocol Analyzer. (1.1)
answer
a tool used to examine the contents of network traffic. (1.1)
question
Sniffers. (1.1)
answer
Can either be used as a synonym for protocol analyzer or as a slightly distinct type of product. Generally a packet (or frame) capturing tool, while a protocol analyzer is able to decode and interpret packet/frame contents. (1.1)
question
Spam. (1.1)
answer
Undesired or unsolicited email. (1.1)
question
Web Security Gateways. (1.1)
answer
a web content filter (often URL - and content Keyboard based) that supports malware scanning. Implemented by an organization to have better policy enforcement over employee web activity. (1.1)
question
Virtual Private Network. (1.1)
answer
A communication tunnel between two entities across an immediate network. (1.1)
question
VPN Concentrator. (1.1)
answer
a dedicated hardware device designed to support a large number of simultaneous VPN connections, often hundreds to thousands. (1.1)
question
Spam Filter. (1.1)
answer
A hardware or software tool whose primary purpose is to identify and block/filter/remove unwanted messages (i.e. spam.) (1.1)
question
All-In-One. (1.1)
answer
A hardware device designed to operate inline between an Internet connection and a network. Its goal is to detect and filter all manner of malicious, wasteful, or otherwise unwanted traffic. Can also be called security gateways or UTM (unified Threat Management) systems. (1.1)
question
Web Application Firewall. (1.1)
answer
Intended to be an application-specific server-sided firewall to prevent cross-site scripting, SQL injection, and other web application attacks. (1.1)
question
Network Firewall. (1.1)
answer
Designed to provide broad protection for an entire network. (1.1)
question
URL Filtering. (1.1)
answer
Also known as web filtering is the act of blocking access to a site based on all or part of the URL used to request access. (1.1)
question
Content Inspection. (1.1)
answer
The security filtering function where the contents of the application protocol are inspected. (1.1)
question
Malware Inspection. (1.1)
answer
The use of a malware scanner to detect unwanted software content in network traffic. (1.1)
question
Rule-Based Management. (1.2)
answer
The concept of controlling the security of communications and IT events through rule or filter driven systems. Firewalls, proxies, routers, IDS, IPS, antivirus, and more are examples of this definition. (1.2)
question
Access Control Lists . (1.2)
answer
used to define who is allowed to or denied from performing a specified activity or action. (1.2)
question
802.1x (1.2)
answer
is a port-based authentication mechanism, based on EAP and is commonly used in closed environment wireless networks. It can also be used on firewalls, proxies, VPN gateways, and other locations where an authentication handoff service is desired. (Authentication Proxy). (1.2)
question
Loop Protection. (1.2)
answer
A transmission pathway that repeats itself. Includes spanning-tree protocol (SPT) for Ethernet and the IP header TTL value. (1.2)
question
Implicit Deny. (1.2)
answer
The default security stance that if you are not specifically granted access or privileges over a resource, you are denied access by default. (1.2)
question
Firewall Rules. (1.2)
answer
Follow First-Match-Apply rule system, the final rule should be a default deny. Anything that is not allowed or was denied is blocked by default. A great example of White-list management system. (1.2)
question
VLAN Management (1.2)
answer
The use of VLANs to control traffic for security or performance reasons. VLANs can be used to isolate traffic to isolate traffic between network segments. (1.2)
question
Secure Router Configuration. (1.2)
answer
Where malicious or unauthorized route changes are prevented 1: Set the routers password to something unique and secret. 2: Set the router to ignore ICMP (internet Control Management Protocol) type 5 redirect messages. 3: Use secure routing protocol that requires authentication and data encryption to exchange data. 4: Preconfigure the IP address of other trusted routers with which routing data can be exchanged. (1.2)
question
Port Security. (1.2)
answer
Physical control of all connection points. The management of TCP and UDP ports, if the service is active and assigned to a port, then the port is opened. All of the other 65,535 ports (of TCP or UDP) are closed if they do not have service actively using them. Hackers can detect the presence of active services by providing a port scan. (1.2)
question
Port Knocking. (1.2)
answer
A security system where all ports on a system appear closed. (1.2)
question
Flood Guards. (1.2)
answer
A defense against flooding or massive traffic DoS attacks. Detects flooding activity and begins to block it. Also a formal command in the Cisco IOS that is used to disable the Flood Defender. (1.2)
question
Prevent Network Bridging by network separation. (1.2)
answer
Network bridging does not limit or divine broadcast domains, does not scale well, can cause latency, and can result in loops. (1.2)
question
Log Analysis. (1.2)
answer
The art and science of reviewing audit trials, log files, or other forms of computer-generated records for evidence of policy violations, malicious events, downtimes, bottlenecks, or other issues of concern. (1.2)
question
Demilitarized Zone (DMZ) (1.3)
answer
An area of a network that is designed specifically for public users to access. A buffer network between the public untrusted Internet and the private trusted LAN. Deployed through the use of a multihomed firewall. (1.3)
question
Extranets (1.3)
answer
An intranet that functions as a DMZ for business-to-business transactions. Let organizations offer specialized services to business partners, suppliers, distributors, or customers. (1.3)
question
Subnetting (1.3)
answer
A divisioning process used on networks to divide larger groups of hosts into smaller collections. (1.3)
question
Virtual Local Area Network. (VLAN) (1.3)
answer
a logical creation of subnets out of a single physical network. It logically segments a network without altering its physical topology. They're easy to implement, have little administrative overhead, and are a hardware-based solution. (1.3)
question
Network Address Translation (NAT) (1.3)
answer
Converts the IP addresses of internal systems found in the header of network packets into public IP addresses. It hides the IP addressing scheme and structure from external entities. Serves as a basic firewall by only allowing incoming traffic that is in response to an internal system's request. It reduces expense by requiring fewer leased public IP addresses, and it allows the use of the private IP addresses (RFC 1918). (1.3)
question
RFC 1918. (1.3)
answer
Defines the ranges of private IP addresses that aren't routable across the Internet: 10.0.0.0-10.255.255.255 (10.0.0.0 /8 subnet), 1 Class A range; 172.16.0.0-172.31.255.255 (172.16.0.0 /12 subnet), 16 Class B ranges; and 192.168.0.0-192.168.255.255 (192.168.0.0 /16 subnet), 255 Class C ranges. (1.3)
question
Remote Access (RAS). (1.3)
answer
a network server that supports connections from distant users or systems. Often support modem banks, VPN links, and even terminal services connections. (1.3)
question
Telephony. (1.3)
answer
The collection of methods by which telephone services are provided to an organization or the mechanisms by which an organization uses telephone services for either voice and/or data communications. Traditionally, telephony included POTS or PSTN services combined with modems. However, this has expanded to include PBX, VoIP, and VPN. (1.3)
question
Network Access Control (NAC) (1.3)
answer
A concept of controlling access to an environment through strict adherence to and implementation of security policy. The goals are to prevent/reduce zero-day attacks, enforce security policy throughout the network, and use identities to perform access control. (1.3)
question
Virtualization Technology. (1.3)
answer
Used to host one or more operating systems within the memory of a single host computer. (1.3)
question
Cloud Computing. (1.3)
answer
A concept of computing where processing and storage are performed elsewhere over a network connection rather than locally. Often thought of as Internet-based computing. (1.3)
question
Platform as a Service. (1.3)
answer
The concept of providing a computing platform and software solution stack to a virtual cloud or based service. Essentially, it is the concept of paying for a service that provides all the aspects of a platform (i.e., operating system and complete solution package). (1.3)
question
Software as a Service. (1.3)
answer
Provides on-demand online access to specific software applications or suites without the need for local installation (or even local hardware and operating system (OS) requirements in many cases). Software as a service can be implemented as a subscription service, pay-as-you-go service, or a free service. (1.3)
question
Infrastructure as a Service. (1.3)
answer
Takes the platform as a service model yet another step forward into providing not just on-demand operating solutions but complete outsourcing options. This can include utility or metered computing services, administrative task automation, dynamic scaling, virtualization services, policy implementation and management services, and managed/filtered Internet connectivity. Ultimately, it allows an enterprise to quickly scale up new software- or data-based services/solutions through cloud systems quickly and without having to install massive hardware. (1.3)
question
Internet Protocol Security (IPsec) (1.4)
answer
both a stand-alone VPN protocol and a module that can be used with L2TP. Can be used in dial-up or network-to-network connections. It operates at the OSI model Layer 3 (The Network Layer). (1.4)
question
Authentication Header (AH) (1.4)
answer
Provides authentication of the sender's data. (1.4)
question
Encapsulating Security Payload (ESP). (1.4)
answer
Provides encryption of the transferred data as well as limited authentication. (1.4)
question
Tunnel Mode. (1.4)
answer
IPsec provides encryption protection for both the payload and the message header by encapsulating the entire original LAN protocol packet and adding its own temporary IPsec header. (1.4)
question
Transport Mode (1.4)
answer
IPsec provides encryption protection for just the payload and leaves the original message header intact. (1.4)
question
Internet Key Exchange (IKE) (1.4)
answer
Ensures the secure exchange of secret keys between communication partners in order to establish the encrypted VPN tunnel. (1.4)
question
Internet Security Association and Key Management Protocol (ISAKMP) (1.4)
answer
Used to negotiate and provide authenticated keying material (a common method of authentication) for security associations in a secured manner. The four major functional components are authentication of communications peers, threat mitigation, security association creation and management, and cryptographic key establishment and management. (1.4)
question
Secure Shell (SSH) (1.4)
answer
A secure replacement for Telnet, rlogon, rsh, and RCP. It can be called a remote access or remote terminal solution. Encrypts authentication and data traffic, and it operates over TCP port 22. (1.4)
question
Domain Name Server/system (DNS) (1.4)
answer
The hierarchical naming scheme used both in public and private networks. It links IP addresses and human friendly fully qualified domain names (FQDNs) together. (1.4)
question
TLS (Transport Layer Security) (1.4)
answer
The updated replacement for the Netscape Corporation's SSL. TLS is generally the same as SSL; however it uses more secure cryptographic protocols and algorithms. (1.4)
question
Secure Sockets Layer (SSL) (1.4)
answer
used to encrypt traffic between a web browser and a web server. Through the use of SSL or TLS, web surfers can make online purchases, interact with banks, and access private information without disclosing the contents of their communications. SSL and TLS can make web transactions private and secure. (1.4)
question
Simple Network Management Protocol (SNMP) (1.4)
answer
A standard network management protocol supported by most network devices and TCP/IP compliant hosts. This includes routers, switches, bridges, wireless access points, firewalls, VPN appliances, modems, printers, and so on. (1.4)
question
File Transfer Protocol Secure (FTPS) (1.4)
answer
is FTP Secure or FTP SSL, which indicates it is a variation of FTP secured by SSL (or now TLS). This is a distinct FTP service variation from SFTP, which is SSH-secured FTP. (1.4)
question
File Transport Protocol (FTP) (1.4)
answer
is an in-the-clear file exchange solution. An FTP server system is configured to allow authenticated or anonymous FTP clients to log on in order to upload or download files. FTP employs TCP ports 20 and 21. (1.4)
question
Secure FTP (SFTP) (1.4)
answer
a secured alternative to standard or basic FTP that encrypts both authentication and data traffic between the client and server. SFTP employs SSH to provide secure FTP communications. (1.4)
question
Anonymous FTP. (1.4)
answer
a form of nameless logon to an FTP server. Site administrators should carefully configure FTP servers that allow anonymous access. (1.4)
question
Blind FTP (1.4)
answer
A configuration of anonymous FTP or authenticated FTP where uploaded files are unseen and unreadable by visitors. Thus, users can upload files but not see the resulting uploads. (1.4)
question
FTP vulnerabilities (1.4)
answer
Because all FTP traffic is transmitted in the clear, all FTP traffic is vulnerable to packet sniffing and other forms of eavesdropping. Not all operating systems or file systems support long filenames. If an FTP server's host operating system and file systems support only the 8.3 naming convention, then uploaded files with longer filenames will be automatically truncated to comply with 8.3 restrictions. (1.4)
question
HTTPS (1.4)
answer
When SSL or TLS is used to secure transactions, this is known as Hypertext Transfer Protocol over SSL. (1.4)
question
SCP (Secure Copy Protocol) (1.4)
answer
A secure file transfer facility based on SSH and RCP. (1.4)
question
ICMP (Internet Control Messaging Protocol) (1.4)
answer
A network health and link testing protocol. Operates in Layer 3 as the payload of an IP packet. Is the protocol commonly used by tools such as ping, traceroute, and pathping. (1.4)
question
FTP (1.5)
answer
uses TCP ports 20 (data) and 21 (control) (1.5)
question
SFTP (1.5)
answer
SFTP, or SSH-secured FTP, uses TCP port 22. (1.5)
question
FTPS (1.5)
answer
FTPS, or FTP over SSL, uses TCP ports 990 (control channel) and 989 (data channel). (1.5)
question
TFTP (1.5)
answer
uses UDP port 69. (1.5)
question
TELNET (1.5)
answer
uses TCP port 23. (1.5)
question
HTTP (Hypertext Transfer Protocol) (1.5)
answer
uses TCP port 80. (1.5)
question
HTTPS (1.5)
answer
(with SSL or TLS), uses TCP port 443. (1.5)
question
SCP (1.5)
answer
or SSH secured RCP, uses TCP port 22. (1.5)
question
SSH (1.5)
answer
uses TCP port 22. (1.5)
question
NetBIOS (1.5)
answer
Uses TCP ports 137-139 (1.5)
question
802.11 (1.6)
answer
The IEEE standard for wireless network communications. (1.6)
question
802.11 & 802.11a (1.6)
answer
Speed (2 Mbps) Frequency (2.4 GHz) (1.6)
question
802.11b (1.6)
answer
Speed (11 Mbps) Frequency (5 GHz) (1.6)
question
802.11g (1.6)
answer
Speed (54 Mbps) Frequency (2.4 GHz) (1.6)
question
802.11n (1.6)
answer
Speed (200+ Mbps) Frequency (2.4 GHz or 5 GHz) (1.6)
question
Site Survey (1.6)
answer
The process of investigating the presence, strength, and reach of wireless access points deployed in an environment. This task usually involves walking around with a portable wireless device, taking note of the wireless signal strength, and mapping this on a plot or schematic of the building. (1.6)
question
Wi-Fi Protected Access (WPA) (1.6)
answer
An early alternative to WEP, this technique was an improvement but was itself not fully secure. It is based on the LEAP and TKIP cryptosystem and employs a secret passphrase. (1.6)
question
Wi-Fi Protected Access Version 2 (WPA2) (1.6)
answer
A new encryption scheme known as the Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP), which is based on the AES encryption scheme. (1.6)
question
Wired Equivalent Privacy (WEP) (1.6)
answer
Defined by the IEEE 802.11 standard. It was designed to provide the same level of security and encryption on wireless networks as is found on wired or cabled networks. It provides protection from packet sniffing and eavesdropping against wireless transmissions. A secondary benefit of is that it can be configured to prevent unauthorized access to the wireless network. It also uses a predefined shared secret key. (1.6)
question
EAP (Extensible Authentication Protocol) (1.6)
answer
Not a specific mechanism of authentication; rather it is an authentication framework. Effectively, it allows for new authentication technologies to be compatible with existing wireless or point-to-point connection technologies. (1.6)
question
PEAP (Protected Extensible Authentication Protocol) (1.6)
answer
Encapsulates EAP methods within a TLS tunnel that provides authentication and potentially encryption. (1.6)
question
LEAP (Lightweight Extensible Authentication Protocol) (1.6)
answer
A Cisco proprietary alternative to TKIP for WPA. This was developed to address deficiencies in TKIP before the 802.11i/WPA2 system was ratified as a standard. (1.6)
question
MAC Filter (1.6)
answer
a list of authorized wireless client interface MAC addresses that is used by a wireless access point to block access to all non-authorized devices. (1.6)
question
SSID Broadcast (1.6)
answer
Wireless networks traditionally announce their SSID on a regular basis within a special packet known as the beacon frame. When the SSID is broadcast, any device with an automatic detect and connect feature is not only able to see the network, they can initiate a connection with the network. (1.6)
question
TKIP (Temporal Key Integrity Protocol) (1.6)
answer
Designed as the replacement for WEP without requiring replacement of legacy wireless hardware. It was implemented into 802.11 wireless networking under the name WPA (Wi-Fi Protected Access). (1.6)
question
CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol) (1.6)
answer
Created to replace WEP and TKIP/WPA. CCMP uses AES (Advanced Encryption Standard) with a 128-bit key.
question
Antenna Placement (1.6)
answer
Use Center Location Avoid solid Physical Obstructions Avoid reflective or other flat metal surfaces Avoid Electrical Equipment. (1.6)
question
Omnidirectional Antenna's (1.6)
answer
An antenna that should be pointed strait up. (1.6)
question
Directional Antenna (1.6)
answer
Point the focus toward the area of desired use. Keep in mind that wireless signals are affected by interference, distance, and obstructions. (1.6)
question
Power Controls (1.6)
answer
Typically set by the manufacturer to a setting that is suitable for most situations. When adjusting power levels, make minor adjustments instead of attempting to maximize or minimize the setting. Also take note of the initial/default setting so you can return to that setting if desired. After each power level adjustment, reset/reboot the wireless access point before re-performing site survey and quality tests. Sometimes lowering the power level can improve performance. (1.6)
Get an explanation on any task
Get unstuck with the help of our AI assistant in seconds
New