Security+

Front 1

Describe SNMP

Back 1

It is basically a network health-monitoring and diagnostic tool. SNMP operates at the Application layer of the OSI reference model, over port 161.

Front 2

Describe LDAP

Back 2

Lightweight Directory Access Protocol (LDAP) is a TCP/IP networking protocol for interacting with directory services databases. LDAP arranges network directories into inverted trees. Each tree starts with a root. The root encompasses all directories in the tree in the same way that a disk's root directory encompasses all directories (folders) on a disk.

Front 3

What is the purpose of VPN?

Back 3

A virtual private network (VPN) is a communication protocol that provides secure remote access to company networks. Let me explain what this means. Computers in a private LAN are all in the same building. That makes it relatively easy for administrators to control communications between computers. But the public telephone lines and the Internet are public networks—what a security professional might call an untrusted network.

Front 4

How does VPN work?

Back 4

creates a secure tunnel between a remote computer and the company LAN. This tunnel acts like a cable in a private network, hence the name virtual private network.

Front 5

Define PPTP

Back 5

provides authentication, encryption, and compression for data sent over IP connections. It has built-in encryption and decryption capabilities. PPTP can create a secure dial-up connection to an ISP. PPTP operates over TCP port 1723 over IP (Internet Protocol) connections only.

Front 6

Define L2TP

Back 6

newer and more flexible than PPTP. It operates over UDP port 1701 and supports numerous data protocols, including IP, IPX (Internetwork Packet Exchange), and NetBEUI (NetBIOS Extended User Interface).

Front 7

What is the main flaw of L2TP

Back 7

does not have its own built-in encryption and decryption capabilities. It must rely on some other protocol, typically IPSec, for encryption.

Front 8

Define IPSec

Back 8

IP Security Protocol (IPSec) is a VPN tunneling protocol that operates at the Network layer (layer 3) of the OSI reference model over TCP ports 50 and 51. IPSec is used to authenticate and encrypt IP traffic.

Front 9

What are the four parts of IPSec encryption protocol?

Back 9

1. Authentication Header (AH): Provides authentication and integrity to protect against replay attacks.
2. Encapsulating Security Payload (ESP): Encrypts the payload to provide data confidentiality and data integrity.
3. IP Payload Compression Protocol (IPComp): Can be used to compress data prior to sending.
4. Internet Key Exchange (IKE): Provides a method for negotiating secret encryption keys.

Front 10

What is the purpose of RADIUS?

Back 10

RADIUS is an AAA server that offers secure authentication over dial-up networks.

Front 11

What is the purpose of TACACS?

Back 11

TACACS is another AAA server. It uses TCP port 49.

Front 12

What is the purpose of SSH (Secure Shell)?

Back 12

SSH (Secure Shell) provides secure Telnet connections over TCP port 22.

Front 13

What is the purpose of PAP?

Back 13

PAP (Password Authentication Protocol) is any early remote authentication protocol that sends user credentials in clear text.

Front 14

Decentralized privilege management requires?

Back 14

That user accounts (including usernames and passwords) be stored on each individual server, as illustrated below. that user accounts (including usernames and passwords) be stored on each individual server, as illustrated below.

Front 15

Centralized privilege management means?

Back 15

Controlling access to all servers from a single, centralized location. The central server may be called a domain controller, authentication server, or directory server. Regardless of what you call it, it contains user accounts and permissions for accessing all the servers in a network.

Front 16

Privilege Escalation

Back 16

All modern operating systems let you collect information about successful and unsuccessful attempts to log in and access files. This information is stored in a file called an audit trail.

Front 17

Kerberos Authentication

Back 17

Kerberos works by granting tickets to authenticated users. Each ticket gives the authenticated users access to a specific resource for a limited time. System clocks within the Kerberos network must be synchronized to ensure that tickets expire correctly. Without proper time synchronization between clients and servers, Kerberos authentication won't work properly.

Front 18

Dumpster Diving

Back 18

In Dumpster diving, attackers search through the trash for information that would help them gain unauthorized access to a network. This includes things like network diagrams, IP address lists, system configuration data, and old passwords. To prevent Dumpster diving, all paper trash should be shredded and all magnetic media destroyed.

Front 19

RAID

Back 19

RAID is a technology solution for high availability. The RAID acronym stands for Redundant Array of Independent Drives. The redundant part refers to the fact that the technology uses two or more hard drives to store the same data, as in the image below.

Front 20

Server Clustering

Back 20

Server clustering is a second technical solution that provides high availability. As the name implies, server clustering involves using several different computers to host a server. In the example below, the four server computers look like a single server to users.

Front 21

What is the Common Criteria?

Back 21

This is a document that was created by numerous organizations, including CSE (Canada), SCSSI (France), BSI (Germany and Netherlands), CESG (UK), NIST and NSA (USA). In the words of the Security+ exam, the Common Criteria document is considered the de facto Information Technology security evaluation criteria for the international community.

Front 22

What is Piggybacking

Back 22

Piggybacking is when an authorized person allows an unauthorized person into a secured room.

Front 23

What is the purpose of a mantrap?

Back 23

A mantrap is a room that's specially designed to prevent piggybacking.

Front 24

Which term describes privilege escalation?

Back 24

While reviewing audit trails, an administrator notices that a regular user ran a program that requires administrative privileges.

Front 25

How does hashing work?

Back 25

Unlike symmetric and asymmetric cryptography, hashing doesn't encrypt the original message or file. Instead, when you hash a file or message, you end up with a new, separate file called a hash value, message digest, or message authentication code.

Front 26

Hashing Algorithms

Back 26

Several hash functions (also called hashing algorithms) have come and gone over the years. These days, SHA-1 (Secure Hashing Algorithm 1) and MD5 (Message Digest 5) are the most widely used. MD5 produces a 128-bit hash value. SHA-1 produces a 160-bit hash value and is considered the more reliable of the two.

Front 27

How is data integrity best achived?

Back 27

Data integrity is best achieved through hashing, message digests or through message authentication codes.

Front 28

SSL/TLS Is Asymmetric Encryption

Back 28

Secure Sockets Layer (SSL) sends encrypted data across the Internet. It does so to protect sensitive data like personal and financial information.

Behind the scenes, your Web browser is encrypting the sensitive information with a public key. The Web server then decrypts that information using its private key. Thus, SSL is a form of asymmetric encryption used to maintain confidentiality. You don't need to purchase your own public and private keys for this to work. The keys are built into the SSL/TLS system.

Front 29

How does a digital signature work?

Back 29

Digital signatures use encryption and hashing to provide integrity, authentication, and nonrepudiation. Unlike normal message encryption, in digital signatures, the sender does not encrypt the actual message. Rather, the sender uses a hash function to create a message digest. Then the sender encrypts the message digest using his or her own private key.

Front 30

Explain the digital signature process to provide data integrity and authentication?

Back 30

Digital signatures use encryption and hashing to provide integrity, authentication, and nonrepudiation. Unlike normal message encryption, in digital signatures, the sender does not encrypt the actual message. Rather, the sender uses a hash function to create a message digest. Then the sender encrypts the message digest using his or her own private key.

Front 31

How does a Replay Attack work?

Back 31

For example, let's say legitimate user Babs enters her credentials (username and password) to gain access to a system. Her computer encrypts her credentials and sends the encrypted data to the server. The server decrypts her credentials, verifies them, and then grants her access.

Front 32

How does CHAP prevent Replay Attacks?

Back 32

CHAP's ability to send a random challenge string to the client at any time provides a good defense against replay attacks. When CHAP sends a random challenge string to the client, it expects a different answer back. There is no way for an intruder to know in advance what the challenge string will be. And there's no way for an intruder to capture and play back the response to a challenge string from another computer. The session will terminate as soon as the intruder's computer fails to send the correct response to the challenge string.

Front 33

What types of attacks are hashed passwords vulnerable to?

Back 33

Brute Force and Birthday Attacks

Front 34

How do you destroy a digital certificate key?

Back 34

The preferred method of key destruction is called zeroization. In this method, every bit in the key is converted to a zero. Once the key has been zeroized, there is no way to restore its original value.

Front 35

What's the first step in implementing a Firewall?

Back 35

The first step to implementing a firewall is to develop a firewall policy.

Front 36

What is the meaning of "Stateful Inspection" Firewalls?

Back 36

That the firewall can inspect each packet to determine whether or not it's part of an already-established TCP connection. Such a firewall can detect and discard any rogue packets from would-be hackers trying to gain access through an open connection.

Front 37

What is one benefit of a Switch?

Back 37

Provides a good defense against hostile packet sniffing

Front 38

What's the benefit of a Router?

Back 38

Unlike a switch or hub, a router can have an Access Control List (ACL) that manages traffic according to rules an administrator defines. As such, a router can act as both a connecting point and a firewall.

Front 39

What's the best defense against IP spoofing?

Back 39

Set up a perimeter router with ingress filtering. Then you define ingress packet filtering rules to reject all packets that have a source IP address from inside the network.

Front 40

How does callback offers the best security tool for dial-up modems.

Back 40

It requires that users call from a specific telephone number and log in normally. Once connected and authenticated, the modem hangs up and calls back at the predetermined number. This ensures that the user is authenticated and located at a specific telephone known to the network.

Front 41

What is the best defense against IP spoofing?

Back 41

Set up a perimeter router with ingress filtering. Then you define ingress packet filtering rules to reject all packets that have a source IP address from inside the network.

Front 42

What is privilege management?

Back 42

Privilege management is the process of assigning and managing access to network resources.

Front 43

Where are usernames and accounts stored in decentralized privilege management?

Back 43

Decentralized privilege management requires that user accounts (including usernames and passwords) be stored on each individual server.

Front 44

Where are usernames and accounts stored in centralized privilege management?

Back 44

Centralized privilege management means controlling access to all servers from a single, centralized location. The central server may be called a domain controller, authentication server, or directory server.

Front 45

What is privilege escalation?

Back 45

As its name implies, privilege escalation occurs when a user is granted more access than his or her user account normally provides.

Front 46

Define Kerberos Authentication scheme:

Back 46

Kerberos is a centralized privilege management scheme that provides access to multiple network resources. A Kerberos server consists of three main components called an authentication server, privilege server, and security database.

Front 47

How does Fault Tolerance address high availability?

Back 47

Fault tolerance: The ability of a system to keep working despite failures in one or more of its components.

Front 48

How does Redundancy address high availability?

Back 48

Redundancy: Having two or more of the same device so that if one fails, the other can take over.

Front 49

How does Fail-over address high availability?

Back 49

Fail-over: Having a second, redundant device kick in automatically if the first device fails.

Front 50

How does RAID work?

Back 50

RAID is a technology solution for high availability. The RAID acronym stands for Redundant Array of Independent Drives. The redundant part refers to the fact that the technology uses two or more hard drives to store the same data, as in the image below.

Front 51

How does Server clustering work?

Back 51

Server clustering is a second technical solution that provides high availability. As the name implies, server clustering involves using several different computers to host a server. In the example below, the four server computers look like a single server to users.

Front 52

What is the Common Criteria?

Back 52

This is a document that was created by numerous organizations, including CSE (Canada), SCSSI (France), BSI (Germany and Netherlands), CESG (UK), NIST and NSA (USA). In the words of the Security+ exam, the Common Criteria document is considered the de facto Information Technology security evaluation criteria for the international community.

Front 53

How does a differential backup work?

Back 53

A differential backup backs up all files that have changed since the last full backup. Recovery requires fist restoring the original full backup and then restoring the most recent differential backup.

Front 54

How does an incremental backup work?

Back 54

An incremental backup backs up files in increments so that only files that have changed since the previous incremental backup are copied. Recovery requires restoring the last full backup plus every incremental backup made since the last full backup.

Front 55

What does the term due care mean?

Back 55

The term due care really refers to written policies and procedures that are specifically designed to minimize damage and injury. Combined, these written documents form an organization's security policy.

Front 56

Who writes a PKI policy?

Back 56

An in-house CEO or other policy maker writes the PKI policy. It describes how an organization is taking due care in using its certificate to maximize security without breaching the terms set forth in the certificate policy.

Front 57

Who writies a certificate policy?

Back 57

A Certificate Authority writes the certificate policy, basing it on industry-wide standards.