Cisco Ccna Chapter 6

Front 1

Endpoints

Back 1

Hosts commonly consist of laptops, desktops, servers, and IP phones which are susceptible to malware-related attacks.

Front 2

Network infrastructure

Back 2

LAN infrastructure devices interconnect endpoints and typically include switches, wireless devices, and IP telephony devices.

Front 3

AMP

Back 3

Advanced Malware Protection provides endpoint protection from viruses and malware.

Front 4

ESA

Back 4

Email Security Appliances (ESA) provide filtering of SPAM emails before they reach the endpoint.

Front 5

WSA

Back 5

Web Security Appliances provide filtering of websites and blacklisting before they reach the endpoint.

Front 6

NAC

Back 6

Network Admission Control only permits authorized and compliant systems to connect to the network.

Front 7

URL filtering

Back 7

Provide filtering of websites before they reach the endpoint.

Front 8

Blacklisting

Back 8

Identify websites with bad reputations. Blacklisting immediately blocks connections based on the latest reputation intelligence, removing the need for a more resource-intensive, in-depth analysis.

Front 9

Data loss prevention (DLP)

Back 9

Prevent sensitive information from being lost or stolen.

Front 10

Antivirus / Antimalware

Back 10

Protect endpoints from viruses and malware.

Front 11

SPAM filtering

Back 11

Provide filtering of SPAM emails before they reach the endpoint.

Front 12

AMP solution:

File Reputation

Back 12

Analyze files inline and block or apply policies

Front 13

AMP solution:

File Sandboxing

Back 13

Analyze unknown files to understand true file behavior

Front 14

AMP solution:

File retrospection

Back 14

Continue to analyze files for changing threat levels

Front 15

AMP

Back 15

BEFORE

AMP helps to prevent known malware, policy-violating file types, and policy-violating communications from entering an extended network.

DURING

AMP continuously analyzes files and network traffic for threats that evade the first lines of defense.AMP continuously analyzes files and network traffic for threats that evade the first lines of defense.

AFTER

AMP can quickly and efficiently understand, scope, contain, and remediate an active attack.

Front 16

Cisco Email Security solutions:

Global threat intelligence

Back 16

Cisco Talos provides a 24-hour view into global traffic activity. It analyzes anomalies, uncovers new threats, and monitors traffic trends.

Front 17

Cisco Email Security solutions:

Spam blocking

Back 17

A multilayered defense combines an outer layer of filtering based on the reputation of the sender and an inner layer of filtering that performs a deep analysis of the message.

Front 18

Cisco Email Security solutions:

Advanced malware protection

Back 18

It delivers protection across the attack continuum: before, during, and after an attack.

Front 19

Cisco Email Security solutions:

Outbound message control

Back 19

Controls outbound messages through DLP and email encryption to help ensure that important messages comply with industry standards and are protected in transit.

Front 20

Cisco Web Security Appliance solutions:

Talos Security Intelligence

Back 20

Fast and comprehensive web protection backed by a large threat detection network.

Front 21

Cisco Web Security Appliance solutions:

Cisco Web Usage Controls

Back 21

Combines traditional URL filtering with dynamic content analysis to mitigate compliance, liability, and productivity risks.

Front 22

Cisco Web Security Appliance solutions:

Advanced Malware Protection (AMP)

Back 22

AMP is an additionally licensed feature available to all Cisco WSA customers.

Front 23

Cisco Web Security Appliance solutions:

Data Loss Prevention (DLP)

Back 23

Prevent confidential data from leaving the network by creating context-based rules for basic DLP.

Front 24

Cisco Cloud Web Security (CWS)

Back 24

a cloud-based security service that uses web proxies in Cisco’s cloud environment to scan traffic for malware and policy enforcement.

Front 25

Cisco customers can connect to the Cisco CWS service directly by using a

Back 25

proxy autoconfiguration (PAC) file in the user’s end device or through connectors integrated into four Cisco products:

Cisco ISR G2 routers

Cisco ASA

Cisco WSA

Cisco AnyConnect Secure Mobility Client

Front 26

Cisco Network Admission Control (NAC) is

Back 26

to allow only authorized and compliant systems, whether managed or unmanaged, to access the network

Front 27

NAC framework

Back 27

The NAC framework uses the existing Cisco network infrastructure and third-party software to enforce security policy compliance on all endpoints

Front 28

Cisco NAC appliance

Back 28

incorporates NAC functions into an appliance and provides a solution to control network access.

Front 29

Cisco NAC Manager (NAM)

Back 29

The policy and management center for an appliance-based NAC deployment environment, Cisco NAC Manager defines role-based user access and endpoint security policies.

Front 30

Cisco NAC Server (NAS)

Back 30

Assesses and enforces security policy compliance in an appliance-based NAC deployment environment.

Front 31

Cisco NAC Agent (NAA)

Back 31

performs deep inspection of the device's security profile by analyzing registry settings, services, and files.

Front 32

Cisco NAC guest server

Back 32

Manages guest network access, including provisioning, notification, management, and reporting of all guest user accounts and network activities

Front 33

Cisco NAC profiler

Back 33

Helps to deploy policy-based access control by providing discovery, profiling, policy-based placement, and post-connection monitoring of all endpoint devices.

Front 34

CAM table attacks

Back 34

Includes CAM table overflow (also called MAC address flooding) attacks.

a result, the attacker can capture all of the frames sent from one host to another.

to stop implement port security

Front 35

VLAN attacks

Back 35

Includes VLAN hopping and VLAN double-tagging attacks. It also includes attacks between devices on a common VLAN.

Front 36

DHCP attacks

Back 36

Includes DHCP starvation and DHCP spoofing attacks.

Front 37

ARP attacks

Back 37

Includes ARP spoofing and ARP poisoning attacks.

Front 38

Address spoofing attacks

Back 38

Includes MAC address and IP address spoofing attacks.

Front 39

STP attacks

Back 39

Includes Spanning Tree Protocol manipulation attacks.

Front 40

VLAN Hopping attacks

Back 40

enables traffic from one VLAN to be seen by another VLAN without the aid of a router.

Front 41

VLAN hopping attack can be launched in one of two ways:

Back 41

Spoofing DTP messages from the attacking host to cause the switch to enter trunking mode

Introducing a rogue switch and enabling trunking.

Front 42

VLAN Double-tagging attack

Back 42

This can allow an attacker in specific situations to embed a hidden 802.1Q tag inside the frame.

An important characteristic of the double-encapsulated VLAN hopping attack is that it works even if trunk ports are disabled,

Front 43

VLAN Double-tagging attack

Back 43

this type of attack is unidirectional and works only when the attacker is connected to a port residing in the same VLAN as the native VLAN of the trunk port.

Front 44

Mitigating VLAN Hopping Attacks

Back 44

Disable DTP

Manually enable trunking

Set the native vlan to something other than 1

Disable unused ports and put them in an unused vlan.

Front 45

PVLAN (Private VLAN) Edge feature

Back 45

ensures that there is no exchange of unicast, broadcast, or multicast traffic between PVLAN edge ports on the switch

Front 46

PVLAN Edge feature has the following characteristics:

Back 46

only control traffic is forwarded

Forwarding behavior between a protected port and a non-protected port proceeds as usual.

The default is to have no protected ports defined.

Front 47

There are three types of PVLAN ports:

Back 47

Promiscuous

Isolated

Community

Front 48

Promiscuous

Back 48

A promiscuous port can talk to everyone.

Front 49

Isolated

Back 49

An isolated port can only talk to promiscuous ports.

Front 50

Community

Back 50

Community ports can talk to other community and promiscuous ports.

Front 51

DHCP Spoofing attacks

Back 51

occurs when a rogue DHCP server is connected to the network and provides false IP configuration parameters to legitimate clients

mitigated using DHCP snooping on trusted ports.

Front 52

DHCP Starvation attack

Back 52

DoS for connecting clients

DHCP requests ip address for the whole available range. DHCP offers for all requests depleting the pool.

mitigate by port security

Front 53

ARP Poisoning Attack

Back 53

an attacker uses ARP spoofing to redirect traffic. ARP poisoning leads to various man-in-the-middle attacks, posing a serious security threat to the network.

mitigated by dynamic arp inspection

Front 54

ARP Spoofing attack

Back 54

a malicious user can send unsolicited ARP Replies to other hosts on the subnet with the MAC Address of the attacker and the IP address of the default gateway.

mitigated by dynamic arp inspection

Front 55

Address Spoofing Attacks

Back 55

Spoofing attacks occur when one host poses as another to receive otherwise inaccessible data, or to circumvent security configurations.

Front 56

MAC address spoofing attacks

Back 56

occur when attackers alter the MAC address of their host to match another known MAC address of a target host

Mitigated by configuring IP Source Guard (IPSG)

Front 57

IP address spoofing

Back 57

when a rogue PC hijacks a valid IP address of a neighbor, or a uses a random IP address.

Mitigated by configuring IP Source Guard (IPSG)

Front 58

possible levels of IP traffic security filtering:

Source IP address filter

Back 58

IP traffic is filtered based on its source IP address and only IP traffic with a source IP address that matches the IP source binding entry is permitted

Front 59

possible levels of IP traffic security filtering:

Source IP and MAC address filter

Back 59

IP traffic is filtered based on its source IP address in addition to its MAC address

Front 60

STP port types

Back 60

Root port

Designated port

Alternate port

Front 61

Root port

Back 61

Root ports are switch ports closest to the root bridge.

Front 62

Designated port

Back 62

Designated ports are all non-root ports that are still permitted to forward traffic on the network.

Selected on per-trunk basis

all ports on root bridge are designated ports

Front 63

Alternate ports

Back 63

Alternate or backup ports are configured to be in a blocking state to prevent loops.

selected when neither end is a root port

Front 64

Bridge ID made up of:

Back 64

Bridge Priority

Extended System ID

Mac Address

Front 65

STP Manipulation Attacks

Back 65

the attacking host broadcasts STP configuration and topology change BPDUs to force spanning-tree recalculations. This causes there host to become the root bridge gaining permission to traffic they would usually not see.

Front 66

Mitigating STP Manipulation Attacks

Back 66

PortFast

BPDU Guard

Root Guard

Loop Guard

Front 67

PortFast

Back 67

PortFast immediately brings an interface configured as an access or trunk port to the forwarding state from a blocking state, bypassing the listening and learning states.

Front 68

BPDU Guard

Back 68

BPDU guard immediately error disables a port that receives a BPDU.

Front 69

Root Guard

Back 69

Root guard prevents an inappropriate switch from becoming the root bridge.

Front 70

Loop Guard

Back 70

Loop guard prevents alternate or root ports from becoming designated ports because of a failure that leads to a unidirectional link.