Cissp Communications And Network Security

Front 1

Layers of the OSI model

Back 1

Application

Presentation

Session

Transport

Network

Data link

Physical

Front 2

Application layer device/protocols

Back 2

User applications

HTTP

FTP

Telnet

DHCP

SMTP

etc.

Front 3

Presentation layer device/protocols

Back 3

JPG

AFCII

TIFF

SSL

Front 4

Session layer device/protocol

Back 4

Logical ports / inter host communication

AppleTalk

WinSock

RPC

Front 5

Transport layer device/protocols

Back 5

TCP

UDP

SPX

SCTP

Front 6

Network layer device/protocols

Back 6

Routers

IP

IPSec

ICMP

IGMP

Front 7

Data link layer device/protocols

Back 7

Switch

BridgeWAP

PPP

SLIP

CSLIP

L2TP

Front 8

Physical layer device / protocols

Back 8

Physical characteristics of the hardware -

Volts

Pins

Bit-rate

Transmission

etc.

Front 9

Layer 1

Back 9

The physical layer describes the networking hardware, such as electrical signals and network interfaces and cabling.

Front 10

Layer 2

Back 10

The data link layer describes data transfer between machines, for instance by an Ethernet.

Front 11

Layer 3

Back 11

The network layer describes data transfer between networks, for instance by the Internet Protocol IP.

Front 12

Layer 4

Back 12

The transport layer describes data transfer between applications, flow control, and error detection and correction, for instance by TCP.

Front 13

Layer 5

Back 13

The session layer describes the handshake between applications, for instance, authentication processes.

Front 14

Layer 6

Back 14

The presentation layer describes the presentation of information, such as ASCII syntax

Front 15

Layer 7

Back 15

The application layer describes the structure, interpretation, and handling of information. Insecurity terms, it is relevant because it relies on all underlying layers.

Front 16

The layer in which Ethernet is described in the OSI reference model

Back 16

Layer 2 data-link layer

Front 17

Port address translation PAT

Back 17

An extension to network address translation (NAT) that permits multiple devices on a local area network (LAN) to be map to a single public IP address.

Front 18

Tracert

Back 18

A utility that will attempt to trace the route to the target address over a maximum of 30 hops. As a result, it will tell the user which routes are valid, and where the packets are being dropped, allowing them to quickly diagnose connectivity problems.

Front 19

Ping scanning

Back 19

A basic network mapping technique that helps narrow the scope of an attack. An attacker can use one of many tools such as a Very Simple Network Scanner for Windows based platforms NMAP for Linux and Windows based platforms to ping all of the addresses in a range. If the host replies to a ping, than the attacker knows the host exist at the address.

Front 20

Power over Ethernet PoE

Back 20

Allows a single cable to provide both data connection and electrical power to devices such as wireless access points or IP cameras.

Front 21

Virtual Private Network VPN

Back 21

Extends a private network across a public network such as the Internet. It enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network and thus are benefiting from the functionality, security and management policies of the private network.

Front 22

Virtual local area network VLAN

Back 22

Any broadcast domain that is partitioned and isolated in a computer network at the data link layer.

Front 23

Optimal location for network based intrusion detection system

Back 23

On the network perimeter, to alert the network administrator of all suspicious traffic.

Front 24

Intrusion detection system IDS

Back 24

Monitor activity and send alerts when they detect suspicious traffic.

Front 25

Two types of intrusion detection systems

Back 25

Host based IDS - which monitor activity on servers and workstations

Network based IDS - monitor network activity

Front 26

Two parts of a subnet mask

Back 26

Network ID and host ID

Front 27

Network ID

Back 27

Represents the network the device is connected to

Front 28

Subnet Mask

Back 28

Only devices in the same subnet mask are able to communicate with other devices on the same subnet

Front 29

Convert ip-based networks can contain the following devices

Back 29

Physical security, industrial monitoring, CCTV, voice services, data, television

Front 30

TCP/IP port filtering

Back 30

The practice of selectively enabling or disabling the Transmission Control Protocol (TCP) ports and user Datagram Protocol (UDP) ports on computers or network devices.

Front 31

Content filtering

Back 31

HTTP proxy is used as a means to implement. Logging or blocking traffic that has been defined as or is assumed to be non business related for some reason.

Front 32

Devices that should be part of a network's perimeter defense

Back 32

A firewall

A proxy server

A host-based intrusion detection system(HIDS)

Front 33

Security perimeter

Back 33

The first line of protection between trusted and untrusted networks.

Front 34

Principal security risks of wireless LANs

Back 34

Lack of physical access control - wireless networks allow users to be mobile while remaining connected to a LAN.

Front 35

IPv4 routing protocols

Back 35

RIPvl: (legacy) IGP, distance vector, classful protocol

IGRP: (legacy) IGP, distance vector, classful protocol developed by Cisco

RIPv2: IGP, distance vector, classless protocol

EIGRP: IGP, distance vector, classless protocol developed by Cisco

OSPF: IGP, link-state , classless protocol

IS-IS: IGP, link-state , classless protocol

BGP: EGP, path-vector, classless protocol

Front 36

IPSec

Back 36

Provides mechanisms for authentication and encryption

Front 37

IP security IPSec

Back 37

A suite of protocols for communicating securely with IP by providing mechanisms for authenticating an encryption. Authenticates only to hosts with each other

Front 38

SEM/SEIM

Back 38

Have to understand a wide variety of different applications and network element (routers/switches) logs and formats; consolidate these logs into a single database and then correlate events looking for clues to unauthorized behaviors that would be otherwise inconclusive isf observed in a single log file.

Front 39

What is Security Event Management (SEM) service performs

Back 39

Aggregates logs from security devices and applications servers looking for suspicious activity.

Front 40

Principal weakness of DNS (Domain Name System)

Back 40

Lack of authentication of servers and thereby authenticity of records. Authentication services have been delegated upward to higher protocol layers.

Front 41

Open email relay

Back 41

A server that forwards email from domains other than the one it serves. Also widely considered a sign of bad system administration.

Front 42

Principal tool for the distribution of spam

Back 42

Open email relays

Front 43

Botnet

Back 43

A group of dispersed, compromised machines controlled remotely from illicit reasons.

Front 44

Bots and botnets

Back 44

Zombies controlled by ethereal entities from the dark places on the internet

Front 45

WPA2 ( Wi-Fi Protected Access 2)

Back 45

Security technology commonly used on Wi-Fi wireless networks. Replace the original WPA technology on all certified Wi-Fi hardware since 2006 and is based on the IEEE 802.11i technology standard for data encryption.

Front 46

Disabling the SSID will

Back 46

Further enhances the security of the solution, as it requires a user that wants to connect to the WAP to have the exact _______ as opposed to selecting it from a list.

Front 47

HDSL

Back 47

Requires two twisted pair so it is deployed primarily for PBX network connections, digital loop carrier systems, interchange POPs, Internet servers, and private data networks.

Front 48

Operating range of HDSL

Back 48

Limited to 12,000 feet so signal repeaters are installed to extend the service

Front 49

DSL (digital subscriber line) methods

Back 49

ADSL- Asymmetric digital subscriber line - downstream transmission rates are much greater than upstream one typically 256 or 512 kbps downstream and 64 kbps upstream

RADSL- Rate adaptive DSL - the upstream transmission rate is automatically tuned based on the quality of the line

SDSL - Symmetric digital subscriber line - uses the same rates for upstream and downstream transmissions what are you doing

VDSL - Very high bitrate DSL- supports much higher transmission rates than other DSL technologies, such as 13 mbps downstream and 2 megabytes per second upstream

Front 50

Fiber cable

Back 50

Relies on light. Electromagnetic and source power based distortions do not affect it.

Front 51

Media types that rely on electromagnetic principles to operate and are therefore susceptible to electromagnetic interference

Back 51

Coax cable

Wireless

Shielded twisted pair

Front 52

Media types that rely on electromagnetic principles to operate and are therefore susceptible to electromagnetic interference

Back 52

Coax cable

Wireless

Shielded twisted pair

Front 53

Coaxial cable (or simply coax)

Back 53

Uses one thick conductor that is surrounded by a grounding braid of wire. A non-conducting layer is placed between the two layers to insulate them. The entire cable is placed within a protective sheath.

Front 54

Disadvantages of coaxial cable

Back 54

Is expensive, and is difficult to bend during installation.

Front 55

Thicker than the twisted pair and therefore can support greater bandwidth and longer cable length

Back 55

Coax cable

Front 56

Shielding

Back 56

On coax cable ____ makes it harder for an intruder to monitor the signal with antenna or install a tap.

Front 57

Protects coax cable from electrical interference such as EMI and RFI

Back 57

Superior insulation

Front 58

UTP unshielded twisted pair

Back 58

The most common cable type. Is inexpensive and can be easily bent during installation. Risks of drawbacks does not justify more expensive cables.

Front 59

STP - Shielded twisted pair

Back 59

Pairs of insulated twisted copper are in close in a protective jacket. Uses an electronically grounded shield to protect signal. The shield surrounds each of the twisted pairs in the cable, surround the bundle of twisted pairs, or both. Disadvantages over UTP = more expensive and is bulkier and hard to bend during installation

Front 60

Multi layer protocols such as Modbus

Back 60

Are often insecure by their very nature as they are not designed to natively operate over today is IP networks. Often used in industrial control systems.

Front 61

Packet switched technologies include

Back 61

X. 25

Link access / procedure balanced LAPB

Frame Relay

Switched multi megabyte data services SMDS

Asynchronous transfer mode ATM

Voice over IP VoIP

Front 62

Generation 1 firewalls

Back 62

Static packet filter

Stateful Packet Inspection

Front 63

Second-generation firewalls

Back 63

Proxy services

Front 64

Firewall

Back 64

A system designed to prevent unauthorized access to or from a private network.

Front 65

Third-generation firewalls, firewalls evolved, next generation firewalls

Back 65

Stateful multilevel inspection, screen see entire packet, OSI layers 2 through 7, rapidly compares each packet to known bit patterns of friendly packets before deciding whether to pass the traffic. Coupled with or integrated into intrusion detection system IDS, SMLI offers the first glimpse of this new definition of firewall.

Front 66

If the communication mode is gateway-gateway or host-gateway

Back 66

Encapsulating security payload (ESP) authentication must be used

Front 67

Polling

Back 67

A LAN transmission protocol

Front 68

What are layer 1 endpoints for cables from wall jacks?

Back 68

Patch panels

Front 69

Which is more resistant to EMI, Coax or twisted pair?

Back 69

Coax

Front 70

UTP (Unshielded Twisted Pair) is more vulnerable to interference, crosstalk, and ______________.

Back 70

Eavesdropping

Front 71

What is the main TP (Twisted Pair) used today?

Back 71

Cat 5e. (Next Gen is Cat 6a)

Front 72

What are fire retardant cables called?

Back 72

Plenum (cost 2x as much)

Front 73

What is the Twisted Pair Cat 7 speed and how is it used?

Back 73

10 Gbps, backbone cabling

Front 74

What is the difference between broadband and baseband?

Back 74

Baseband: Binary (single channel)

Broadband: Analog (multiple channels)

Front 75

What is the effective communication distance for copper communication cables?

Back 75

100m

Front 76

What is a loss of signal strength over distance?

Back 76

Attenuation

Front 77

What causes corruption in binary signals?

Back 77

Noise

Front 78

What happens when a signal spills from one cable to a nearby cable?

Back 78

Crosstalk

Front 79

Regarding fiber, what light source is used for single and multi–mode?

Back 79

single mode – Laser (kilometers)

multi–mode – LEDs (within buildings)

Front 80

What is the difference between synchronous and asynchronous signals?

Back 80

Synchronous: No start stop, continuous signal

Asynchronous: Bits sent sequentially

Front 81

What topology is good for several servers being linked in a high availability (HA) need situation?

Back 81

Mesh

Front 82

What is the normal topology we use?

Back 82

Star

Front 83

What are the layers of the OSI model? Bottom to top.

Back 83

1. Physical
2. Data Link
3. Network
4. Transport
5. Session
6. Presentation
7. Application
All People Seem To Need Data Processing

Front 84

What is it called when data is packaged to travel through the OSI model (up or down) and communicates with same layers at the the other end.

Back 84

Encapsulation

Front 85

What is Layer 1 of the OSI model for?

Back 85

Physical – media – patch panels, fiber cable

Front 86

What is Layer 2 of the OSI model for?

Back 86

Network: Ethernet, switches

Front 87

What is Layer 3 of the OSI model for?

Back 87

Networking: Routers, IPV4, IPV6, OSPF, BGP

Front 88

What is Layer 4 of the OSI model for?

Back 88

Transport: TCP, UDP, SSL, TLS (port #s/sockets)

Front 89

What is Layer 5 of the OSI model for?

Back 89

Session: NetBIOS, NFS, SQL, RPC

Front 90

What is Layer 6 of the OSI model for?

Back 90

Presentation: ASCII, TIFF, GIF, JPEG, etc.

Front 91

What is Layer 7 of the OSI model for?

Back 91

Application: FTP, SSH, API, MIME, TELNET, HTTP

Front 92

At OSI Layer 1, how does communication happen? In the form of.....

Back 92

Bits

Front 93

Where does the MAC address get resolved in the OSI model?

Back 93

Layer 2

Front 94

Where does IP addressing happen in the OSI model?

Back 94

Network Layer (3)

Front 95

Where is UDP and TCP used in the OSI model?

Back 95

Layer 4, Transport

Front 96

At what layer does segment size and sequence numbering happen?

Back 96

Layer 4, Transport

Front 97

What is the difference between TCP and UDP?

Back 97

TCP: Reliable (3 way handshake – connection oriented, sequential series of packets)
UDP: Fast (Connectionless – best effort – used for VoIP and Streaming)

Front 98

What OSI Layer allows applications to organize and synchronize how they will transfer data?

Back 98

Layer 5, Session

Front 99

Which OSI Layer translates messages into standard presentations? (encryption and compression, as well as formatting – like jPEG)

Back 99

Layer 6, Presentation

Front 100

Which OSI Layer includes Application Programming Interfaces (API)
Popular protocols: SMTP, HTTP, FTP, Telnet, TFTP)

Back 100

Application Layer, 7

Front 101

At which layers are the following data frame types:
Data
Segment
Packet
Frame ( last frame element is Frame Check Sequence)

Back 101

Data: Presentation

Segment: Transport

Packet: Network
Frame & FCS: Data Link / Physical

Front 102

What are the TCP/IP Layers?

Back 102

Application
Transport (host to host)
Internet
Network Interface


A TIN man

Front 103

How does the TCP/IP map to OSI?

Back 103

Application
Presentation.

Front 104

What are the common network devices on layers 1, 2, and 3? What device is multi–layer?

Back 104

1 – Hub
2 – Switch
3 – Router
Multi–layer: Gateway

Front 105

What is 802.3?

Back 105

Standard for Ethernet (3 is like a backwards E)

Front 106

Switches work at Layer _____ using a standard called _______.

Back 106

2, Ethernet

Front 107

What device is subject to MAC flooding and Spoofing attacks?

Back 107

Layer 2 switch (Data Link)

Front 108

Where is a NIC used?

Back 108

Layer 2 – with switches

Front 109

What routing protocol simply used hops to decide routes?

Back 109

RIP (Routing Information Protocol) – 15 hop limit (TTL – Time to Live)

Front 110

What routing protocol keeps a topology map and determines shortest path/

Back 110

OSPF (Open Shortest Path First)

Front 111

What is the exterior routing protocol and is used by ISPs?

Back 111

BGP (Border Gateway Protocol)

Front 112

What acts as a translator (between media or protocols) and works at several layers of the OSI model?

Back 112

Gateway

Front 113

What is the primary protocol suite used on the Internet today?

Back 113

TCP/IP
(TCP – Layer 4, IP – Layer 3)

Front 114

What are the ports for FTP, SMTP, SNMP, HTTP, Telnet, and SSH?

Back 114

FTP – 20, 21
SMTP – 25
SNMP – 161
HTTP – 80
Telnet – 23
SSH – 22 (Secure Telnet Replacement)

Front 115

Source port numbers are dynamic, or __________ and used to track communications sessions.

Back 115

Ephemeral

Front 116

What defines the network and host portions of an IP address?

Back 116

Subnet Mask

Front 117

In 192.168.0.1:23, what does the 23 represent?

Back 117

The port number

Front 118

In 192.168.0.1/24, what does the 24 represent?

Back 118

Subnet Mask

Front 119

What are the ranges for IP addresses for Classes A – E?

Back 119

A – 0–127 (First byte defines network)
– Note: 127 is reserved for loopback testing

B – 128–192 (First 2 bytes define network)

C – 193–224 (First 3 bytes define network)

D – 225–240 (multicast)

E – Invalid Experimental

Front 120

What is an IPv6 address?

Back 120

Unique 128 bit address scheme –

8 blocks of four hexadecimal units

Front 121

How is an IPv6 unicast network and host split up?

Back 121

equal 64 bits of each

Front 122

How can you shorten the IPv6 address?

Back 122

By eliminating leading zeros and adjacent blocks of zeros with ::
e.g. ...2f29:0:0:0:3d... becomes: 2f29::3d...

Front 123

For global addressing of IPv6, what is the global routing prefix and subnet ID?

Back 123

Global routing = first 48 bits
Subnet ID = next 16 bits

Front 124

In IPv6, what does Link Local Addressing always begin with?

Back 124

fe80:: (understood as fe80:0:0:0

Front 125

T/F IPv6 Tunnels may be misused by attackers.

Back 125

True

Front 126

What protocol does DHCP use?

Back 126

UDP

Front 127

What defines the DHCP sequence of actions?
DORA

Back 127

DORA:
– Discover message
– Offer message
– Request proper network info
– Acknowledge

Front 128

What is a major man in the middle attack threat that redirects IP addressing?

Back 128

Rogue DHCP Server

Front 129

What is a High Availability (HA) practice for DHCP and DNS to ensure redundancy?

Back 129

Split DNS or Split DHCP (shares the load)

Front 130

Routers can be a _______________ for DHCP services, rebroadcasting across subnets.

Back 130

Relay Agent

Front 131

Split DNS (or split–Brain DNS) is a best practice, allowing....?

Back 131

One Internal DNS server (locates domain resources)
One Exernal DNS server (locates Internet resources)

Front 132

T/F – DNSSEC encrypts.

Back 132

False, it uses digital signatures for authentication

Front 133

What is the directory service database (standard for storing details about the network) and in what standard does it store?

Back 133

Lightweight Directory Access Protocol (LDAP), X.500

Front 134

Difference between x.500 and x.509?

Back 134

x.509 = Public Key (digital certificates)
x.500 = LDAP naming standards (Leafs)

Front 135

In LDAP, what is a subject called?

Back 135

A leaf

Front 136

What is the protocol that resolves MAC addresses from a known IP address?

Back 136

Address Resolution Protocol (ARP)

Front 137

What is it called when someone puts bad information into an ARP table to misdirect users?

Back 137

ARP Poisoning (man in the middle)

Front 138

ICMP can be misused through which utility?

Back 138

Ping (Packet Internet Network Grope)

Front 139

Which version of SNMP is most secure?

Back 139

v3 (SNMP v4 works with IPv6)

Front 140

ATM works at which layer of the OSI model?

Back 140

Multiple layers

Front 141

ATM has which 2 circuit methods?

Back 141

Switched Virtual Circuit (SVC) – created on demand
Permanent Virtual Circuit (PVC) – programmed in advance

Front 142

What is an L2/L3 (or just L3) Switch?

Back 142

It is a layer 3 switch (VLAN capable) that performs routing functions. (multilayer device)

Front 143

A proxy server does NAT (Network Address Translation) and deep packet inspection at ______layers?

Back 143

Multi–layers

Front 144

What is it called when two separate standards come together to do something better, such as with protocols?

Back 144

convergence or converged protocols

Front 145

Evolving from specialized Fibre channel storage, this convergence allowed Ethernet to communicate with Fibre SANs?

Back 145

FCoE (Fibre Channel over Ethernet)

Front 146

What was the convergence of SCSI and IP?

Back 146

iSCSI

Front 147

What is MPLS?

Back 147

Multiprotocol Label Switching – used by ISPs to create private WANs across their backbone (forwards with labels instead of IP addresses)
– Isolates traffic, as in a VLAN
– More secure than normal IP routing
– Good for VoIP (meaning good for QoS)

Front 148

What device hides internal addresses by centralizing them on one router and forwarding only the source address of that router?

Back 148

Network Address Translation (NAT)

Front 149

VoIP requires _________ to provide lag–free communication

Back 149

Quality of Service, or Traffic Shaping

Front 150

What is the initiation protocol that is used to setup and tear down VoIP sessions?

What protocol carries the actual media payload?

Back 150

SIP (Session Initiation Protocol)
RTP (Real–time Transfer Protocol)

Front 151

What IEEE standard defines Wi–Fi standards for security?

Back 151

802.11i

Front 152

What WPA function keeps you from eavesdropping?

Back 152

TKIP (Temporal Key Integrity Protocol)

Front 153

WPA also replaced CRC error checking in WEP with better ____________________ (MIC)

Back 153

Message Integrity Check

Front 154

WPA2 enhances security. Replaces RC4 with ____________ (AES.....?)

Back 154

AES–CCMP

Front 155

TKIP (Temporal Key Integrity Protocol) is a ___________ encryption key. It is a single use session key. Also uses strong/long keys.

Back 155

Symmetric

Front 156

What is a network protocol that provides client/server authentication and authorization, and audits remote users. It also provides enterprise authentication?

Back 156

RADIUS (Remote Authentication Dial–In User Service)

Front 157

What is the difference between bluejacking and bluesnarfing?
How can you eliminate the threat?

Back 157

Bluejacking: Send anonymous spam
Bluesnarfing: stealing info from bluetooth device
– Eliminate by disabling discovery

Front 158

What is the best protection for "bring your own device" mobile devices?

Back 158

MDM (mobile device management) infrastructure

Front 159

What are some good MDM choices to implement?

Back 159

Sophos and Airwatch

Front 160

What is "footprinting"?

Back 160

Discovery – gathering data about a target (security profile) before attacking.

Front 161

Firewalls have moved from static postures to...

Back 161

Dynamic Stateful firewalls. Keeps track of "state" or dialog process of a communication stream between internal and external hosts

Front 162

What is an application layer firewall that inspects 100% of the packet (deep packet inspection) called?

Back 162

Application firewall

Front 163

Proxy Firewalls are better than hardware firewalls at ___________ information.

Back 163

logging

Front 164

What is a proxy that hides the real sender's info?

Back 164

Anonymizer proxy

Front 165

TOR (TOR Onion Networks) is free software that does what?

Back 165

enables anonymous communication over the Internet.

Front 166

Open ________________ are used to mask SPAM senders

Back 166

mail relays

Front 167

What is a Bastion Host?

Back 167

Extremely hardened system. Locked down due to being Internet accessible.

Front 168

What two methods hide and extend your IP address scheme for your internal network?

Back 168

NAT and PAT (Port Address Translation)

Front 169

What is our IT "network burglar alarm" system?

Back 169

IDS

Front 170

Does an IDS block intrusion?

Back 170

No!

Front 171

What does block an intrusion?

Back 171

Network Intrusion Prevention System (NIPS)

Front 172

When alerted by an IDS/IPS, what is the responding administrator called?

Back 172

First responder

Front 173

What advantage does an application–based proxy firewall have over packet–filtering firewalls?

Back 173

Better Security

Front 174

What are the two intrusion detection techniques:
Anomaly Detection and Signature Based?

Back 174

Anomaly Detection: comparing current systems to baseline activities.
Signature Based: comparing LAN traffic to a variety of attack signatures

Front 175

Host HIDS/HIPS can examine encrypted traffic after it is decrypted. T/F?

Back 175

True

Front 176

PPTP, L2TP/IPsec, SSL/TLS, and SSTP are modern _________ Protocols

Back 176

VPN Tunneling

Front 177

What is CHAP

Back 177

Challenge Handshake Authentication Protocol, authentication protocol that validates user through handshake instead of sending password.

Front 178

ISDN has two connection types. What are they and what are their speeds?

Back 178

– BRI (Basic Rate Interface) 2 b channels and 1 d channel

– PRI (Primary Rate Interface) 23 b channels and 1 d channel


b channels: 64 KBps (data)
d channels: 64 KBps (control)

Front 179

What are the Internet, X.25, and Frame Relay examples of?

Back 179

Packet switching?

Front 180

What is an early fast WAN packet–switched technology that uses PVCs and SVCs?

Back 180

Frame Relay (Early WAN)

Front 181

What connection–oriented technology uses 53–byte packets in the form of fixed cells?

Back 181

ATM

Front 182

What is an encryption protocol that is a hybrid of Cisco L2F and PPTP?

Back 182

L2TP (Layer 2 Tunneling Protocol) and IPSec.

Front 183

In L2TP, what does the encryption at Layer 3?

Back 183

ESP in IPSec.

Front 184

The IPSec protocol that performs only integrity checking (doesn't encrypt) is __________

Back 184

AH (Authentication Header) Protocol

Front 185

The IPSec protocol that performs encryption (most used) is ____________

Back 185

ESP (Encapsulating Security Payload) in tunneling mode with encapsulation

Front 186

With the ESP protocol, what is the difference between transport and tunnel mode?

Back 186

Transport mode: Only data is secured
Tunnel mode: Entire packet encapsulated

Front 187

Browser based VPN solutions (utilizing SSL and TLS) are harder to implement. T/F

Back 187

False. They are easier to implement.

Front 188

What is an IP address combined with a Port Number called?

Back 188

A Socket

Front 189

Regarding VLANs, what is 802.1q?

Back 189

The header in the frame has an extra piece of information (VLAN Tag) that will allow it to forward or reject traffic.

Front 190

In the TCP/IP model, where does the PPP protocol reside?

Back 190

Network access

Front 191

What is a Loki attack?

Back 191

A backdoor ICMP attack

Front 192

What does CDN (Content Distribution Network) provide?

Back 192

Improves the delivery or performance of streaming or large file application. Stores data closer to where user needs it.

Front 193

In virtualization, it doesn't require an overarching OS. What runs the functions (multiple instances of OS) instead?

Back 193

Hypervisor

Front 194

What is a Virtual Desktop Infrastructure (VDI)?

Back 194

A client/server solution that utilizes virtualization and centralized servers to run a desktop operating system across a LAN or WAN connection to a host system (thin client)

Front 195

What are the three primary categories of cloud computing?
(Hint: Hosted – I, P, S)

Back 195

– Hosted Infrastructure (Iaas): virtualized servers and disk storage
– Hosted Platforms (PaaS): Rent virtual servers with the OS installed
– Hosted (applications) Software (Saas): Leasing the use of a service providers configured software (Netflix)


aaS = as a Service

Front 196

What are these cloud models:
Public, Private, Community, Hybrid

Back 196

Public: Internet Public Clouds
Private: provisioned or single organization
Community: specific community of organizations, like federal gov.
Hybrid: Any combination of the above

Front 197

What was a solution that incorporated the physical separation (decoupling) of the network control plane of packets from the data plane (hardware)? (single large virtualization that removes hardware from the equation)

Back 197

Software Defined Networking

Front 198

What are two multi–layer protocols?

Back 198

ATM and DNP3

Front 199

What is providing conversion at the perimeter of most networks?

Back 199

Router (normally Cisco)

Front 200

Can a router be a firewall?

Back 200

Yes

Front 201

In WiFi what does the key exchange?

Back 201

TKIP

Front 202

SSL VPN uses what for access?

Back 202

web browser

Front 203

What two primary concerns with VoIP technology?

Back 203

Lag – QoS (Quality of Service)
Sniffing

Front 204

What is a screenscraper?

Back 204

Data mining....???

Front 205

What is a guest operating system?

Back 205

An operating system running under a hypervisor

Front 206

What is port isolation?

Back 206

A management VLAN. E.g. Only one port can be used to program a router or switch.

Front 207

What does a stateful firewall look at that a normal one doesn't?

Back 207

Ephemeral port. (session states)

Front 208

How is a proxy firewall different from a normal one?

Back 208

Deep packet inspection.

Front 209

What is an anonymizer proxy used for?

Back 209

Hides the sender's information. (e.g. TOR)

Front 210

What device:
– Does MPLS translation
– uses BGP
– Stateful Firewall
– ATM mode
– VPN concentrator for IPSec

Back 210

Edge Router

Front 211

WiFi encrypts what portion of the communication?

Back 211

Antenna to Antenna (radiated signal)

Front 212

OSI Model

Back 212

Front 213

Federal Communications Commission (FCC)

Back 213

Regulate the telecommunications system includes voice and data

Front 214

Open Network Architecture

Back 214

No vendor owns , that is not proprietary, and that can easily integrate various technologies and vendor implementations of those technologies.

Open system -> interoperability

Front 215

What is Datalink comprises of

Back 215

Logical Link Control (LLC)

- Multiplexing protocols transmited over MAC layer

- IP / IPX, Appletalk

Media Access Control (MAC)

Front 216

Antirelaying features

Back 216

Company's mail server should only accept mail destined for its domain and should not forward messages to other mail servers and domain that may be suspicious

Front 217

Email Spoofing

Back 217

Modifying the fields of email headers, (from, return path and reply to), to appears from trusted source

Counter measure - SMTP Authentication (SMTP-AUTH)

Measures : SMTP Authentication , Sender Policy Framework (SPF)

Front 218

Open Mail Relay

Back 218

It allows anyone on the internet to send email through it, not just email destined to or originating from known users.

Front 219

Phishing

Back 219

Social engineering

phishing email scam - steal details

nefarious web site or email

spear-phishing - phising attack to trick a specific target

Front 220

Pharming

Back 220

redirects victim to seemingly legitimate but fake site.

DNS Poisoning

Front 221

Tiered architecture

Back 221

Single-tiered : Screened-host architecture -

Two-tiered : Screened-subnet architecture

Three Tiered : Three firewalls create two separate DMZs

Front 222

Screened host

Back 222

firewall communicates directly with perimeter router

Front 223

Screened Subnet

Back 223

another layer of security to screened host architecture

2 firewall create DMZ

Front 224

DNS Splitting

Back 224

DNS Server in the DMZ handles external hostname to IP resolution request.

While an internal DNS server handls only internal request

Ensure layer of protection not expose by being internet facing

Internal DNS only contain resource records for internal computer systems.

Front 225

RADIUS Server

(Remote Authentication Dial-In User Service)

Back 225

Network protocol that provides client/server authentication and authorization, and audits remote users.

DSL , T1 Line , ISP to authenticate user before allowed access to internet

Network protocol that provides AAA

Front 226

Sender Policy Framework

Back 226

Email validation system by verifying sender's IP address

Specify which hosts from domain are allowed to send email. Using SPF record in DNS.

Front 227

PPTP vs L2TP

Back 227

Both are tunneling protocol for VPN, both extend PPP connetions by providing tunnel

PPTP

cons: cannot support multiple connections over one VPN tunnel

allows attacker easily uncover password values

Restricted to only IP network

not industrial standard, incompatibilities across devices

L2TP

Cons: Over various network type (IP,ATM, X.25), both IP based and WAN based

integrate IPSec to provide confidentiality, integrity

Front 228

IPSec (Internet Protocol Security)

Back 228

method of setting up secure channel for protected data exchang between two devices

Strong encryption and authentication methods

provide security on top of IP

two mode

transport mode

tunnel mode

Front 229

Bluejacking

Back 229

unsolicited messsage to device that is Bluetooth enabled

non discoverable mode

Front 230

DNS Spoofing

Back 230

DNS cache poisoning

Front 231

IP Telephony issues

Back 231

VOIP telephony network faces all the flaws that traditional computer networks have faced.

intercept incoming and outgoin gcalls, DoS attack, spoof phone calls, eavesdrop

Front 232

Autonomous System (ASs)

Back 232

AS is individual routers on the internet

independently controlled by different service providers and organization.

Using common Interior Gateway Protocol (IGP)

Front 233

Static vs Dynamic routing protocol

Back 233

dynamic routing protocol to finds out that a route has gone down or congested, and update routing table

Static routing protocol admin manually configure routing table.

Front 234

Type of Interior Routing protocols

Back 234

Distance vector Routing protocol

Distance(number of hops) vs Vector (direction)

Link-state routing protocol

look at variables such as link speed, network load, packet size, reliability to determine best routes

Routing Information Protocol (RIP)- Distance, how to exchange routing table data, calculate shortest distance between source and destinatio

Open Shortest Path First (OSPF) - link state, allows smaller more frequent routing table, more stable network

Interior Gateway routing (IGRP) - distance, five criteria to find out best path

Enhanced interior gateway routing protocol (EIGRP) - Cisco priopietary advaced distance

virtual router redundancy protocol - link?

Front 235

IGP vs EGP

Back 235

IGP - Interior Routing protocol within AS

EGP - routing protocol between different autonomous systems

Front 236

Border Gateway Protocol (BGP)

Back 236

enables routers on different ASs to share routing information to ensure effective and efficient routing between AS networks

Front 237

What are the Authentication Protocols

Back 237

Password Authentication Protocol (PAP)

Challenge Handshake Authentication Protocol (CHAP)

Extensive Authentication Protocol (EAP)

Front 238

Transport Adjacency

Back 238

More than one security protocol (ESP and AH) is used in the VPN tunnel

can also provide iterated tuneling - IPSec in another IPSec

Front 239

What are the type of Authentication Protocols

Back 239

PAP (Password authenticate protocol ) - authenticate over PPP, send in clear text

CHAP ( Challenge Handshake Authentication Protocol ) - challenge response to authenticate, more secure

EAP ( Extensible Authentication Protocol) - extend of Authentation method to OTP , Token , biometrics

Front 240

Wireless authentication method

Back 240

Open system authentication (OSA) - no pwd

Shared Key authentication (SKA)

- WEP ( Wired Equivalent Privacy)

Front 241

802.1x

Back 241

Different approaches that provide more security and protection than 802.11(static IV?)

Only allow access until full authentication and authorization

Temporary key integrity protocol (TKIP) - solve statick key, iv value and itegrity issue

Provide different EAP modules to plugged in

802.1x and EAP work together to enforce mutual authentication between wireless device and authentication server

Front 242

802.11 vs 802.1x

Back 242

802.11

- not mutual authentication, device can authenticate to AP but AS not require to autheticate to device

Front 243

Remote Connectivity

Back 243

Dial Up - Tie up with phone line so cannot call

DSL (Digital Subscriber Line) - Uses phone line and wont tie up phone. must close to telephone central office to get service

Cable Modem - Transmits digital data over existing cable television lines

ISDN(integrated services digital network) - digital telephone line, over digital manner . must close to telephone central office to get service

Front 244

IPv4 vs IPv6

Back 244

IPv6 - more address space - 128 bits vs 32 bits

has host portion and network portioon

support stateless auto reconfiguration so doesn't require dhcp server and NAT

QoS priority values to be assign for time-sensitive transmission

IPSec integrated provide end to end secure transmission and authentication

Front 245

What are the layer 2 security

Back 245

802.1AE - MACSec

- integrates security protection into wired Ethernet network to

- specifies set of protocols to meet security req for protecting data traversing ethernet LANs

802.1AR - DevID

- secure DevID is crytographically bound to a device and supports authentication of the device's ID

Binding device to its identifiers

802.1AF

Front 246

Zone Transfer

Back 246

Primary and secondary DNS servers synchronize information through zone transfer. Replicate DNS databases across set of DNS Servers

- cons: attacker can map out the network

properly configure to allows only specific DNS Servers

Front 247

DNSSEC

Back 247

DNS Security , implements PKI and digital signatures, which allows DNS servers to validate the origin of a message to ensure not spoofed and malicious

Front 248

Type of Virtual Firewall

Back 248

Bridge-mode firewall -

act like physical world firewall , sits in a strategic part of the network infrastructure, inter-network virtual switch or bridge.

Hypervisor -mode firewall

- resides in hypervisor to capture VM activity

Front 249

Software Defined Networking (SDN)

Back 249

computer networking allows network adminstrators to manage network services centrally

Front 250

How VoIP works

Back 250

employs Session Initiation Protocol (SIP)

breaks down the call sessions,

provides phone-line features such as ring ,dialing and busy signal

part of Multiservice Access technologies

public switched telephone network- circuit switching - regular phone system

Front 251

IP Spoofing

Back 251

creation of IP packets with false source IP address, to hide the identity of the sending / impersonate

Front 252

Session Hijacking / cookie hijacking

Back 252

hijack using session key / session id

man in the middle attack - impersonate sender ip address, DoS to the sender,

TCP Hijacking

- spoof sender address and use the correct sequence number value

Front 253

Unified Threat management

Back 253

provide all network equipments ( IDS/IPS, firewall, antispam, vpn) functionalities in a single network appliance

all inclusive security product

Front 254

TLS vs SSL

Back 254

SSL is propietary, so cannot easily extend functionality

TLS is open community protocol

TLS more extensible and backward compatible with SSL

Front 255

Link Encryption

Back 255

Ecrypt data along specific communication path , such as satellite link, T3 link , or telephone line. All including header ,paylaod , address routing table encrypted

except data link control messaging info - communciation method

also called online encryption. provided by service provider and into network protocol

have to decrypt at each hop to find routing information

Front 256

End to end encryption

Back 256

packet do not need to be decrypted and encrypted again at each hop because headers and trailers are not encrypted.

initiated by user , more flexible , called end to end because message stay encrypted from one end to another end

Front 257

Security Association for IPSec

Back 257

Each IPSec VPN device will have at least one security association for secure connection. record the configuration of the IPSec architecture, it's a record of the configuration of the device needs to support an IPSec connection over VPN Connection