Karteikarten
Protecting the Network
Karten in diesem Stapel (85)
- 1This is the Cisco layer where network security is provided. ACL's, Firewalls, and address translation are implemented in this area.Distribution Layer
(AKA: DMZ or isolation LAN) - 2This layer contains switches and controls user and work group access. VLANs and subnets can be used used. Where switchport and VLAN security should be implemented.Access Layer
viewed as an organization's trusted network - 3A layered approach is used to provide security to a router. What are the 4 Layered Security concepts?1) Physical Security
2) Core Configuration
3) Dynamic Configuration
4) Network Traffic - 4Which layered security concept is this: any router can be compromised by an attacker with full physical accessPhysical Integrity
- 5Which layered security concept is this: the stored software and config state of the router itself. if accessed can gain control of the 2 outer layers.Core Configuration
(items include: interfaces, usernames, passwords, privileges, etc) - 6Which layered security concept is this: Routing tables, ARP tables, and audit logs. Once compromised network traffic can be controlled.Dynamic Configuration
- 7Which layered security concept is this: The information that routers manage, forward, and filter, such as permitted protocols and services.Network Traffic
- 8T or F: Access to an inner layer provides access to the outer layers.True
- 9This type of security not only covers unauthorized access but also environmental protection and catastrophic events.Physical Security
- 10-if not needed, AUX port should be disabled -ACLS to limit remote admin access -use encryption -any thing that can be plugged into a router is a potential point of ingress into the dynamic config and networkShit to know about physical security
- 11True or False: IOS updates are important to manage because newer IOS versions fix bugs and vulnerabilities found in older versions.True
- 12Name at least 5 best practices for switch security1) control STP by using BPDU guard & root guard
2) Turn off all unused ports and assign them to an unused VLAN
3) do not use VLAN 1
4) enable port security to limit MAC Access
5) designate an unused VLAN for the native trunk VLAN - 13How does BPDU guard help preserve an STP topology?BPDU guard prevents the processing of any BPDUs received on a port. if a BPDU is received on a port where BPDU guard is present, the port is disabled
- 14T or F: BPDU guard is enabled by interface: int range f0/1 - 24 spanning-tree bpduguard enableTrue
- 15Root guard is another way to protect the STP topology. What does Root Guard do?Root guard provides a way to to enforce the root bridge placement in the network, by not allowing a port to become a root port.
- 16This Cisco proprietary protocol is used in order to negotiate trunking on VLAN aware switches.Dynamic Trunking Protocol
(DTP) - 17What does DTP allow switches to do?DTP allows switches to automatically learn and change port configurations based on info gathered on each port.
- 18T or F: DTP allows ease for admin but it is contrary to security. This would allow an attacker to gain access to all VLANs allowed on the port, which by default is all of them.True
- 19What type of attack is done using the vulnerability that DTP provides?VLAN hopping
- 20How do you mitigate the risk on VLAN hopping?switch ports need to be manually configured as either access or trunk ports, and turn of DTP.
- 21What are the commands to manually disable DTPint range f0/1 -24
switchport mode access
***switchport nonegotiate - 22What is the Native VLAN on a switch?VLAN 1
- 23T or F: VLAN 1 should never be used?True
- 24What do you do to secure the native VLAN on a switch?1) changed the number of the VLAN
2) shut down any unused ports and assign them to a shutdown vlan - 25What syntax is used to secure the native VLAN?int vlan 100
shutdown
int range f0/1-24
switchport access vlan 100
shutdown - 26T or F: Untagged traffic across a trunk associates that traffic to the native trunk VLAN. this is a risk and must be mitigated.True
- 27T or F: In order to mitigate, the native trunk VLAN should be changed to an unused VLAN. This ensures all traffic coming across the trunk is tagged. any traffic rejected as untagged would then go to the unused VLAN.True
- 28What syntax is used to secure the Native Trunk VLAN?int vlan 101
shutdown
int range f0/1 - 24
switchport trunk native vlan 101 - 29T or F: By default, many switches allow multiple MAC addresses to use a single port. The specific MAC addresses allowed to connect to each port can be configured.True
- 30The method of securing the switch in regards to MAC Addresses is known as what?Port security
- 31this type of port security: is manually configured by the administratorStatic
- 32this type of port security: is learned dynamically from traffic. stored in the address table but not in the running configuration.Dynamically
- 33this type of port security: can be manually configured or learned dynamically from traffic. stored in the running config. running config can then be saved, making the address staticSticky
- 34What are the 3 actions than can be configured when using port security on a switch?protect
restrict
shutdown - 35What action are we focused on in this mod?restrict
- 36T or F: Port security can only be applied to access ports not (trunk ports)True
- 37command to know for Port security...int range f0/1 - 24
switchport port-security
switchport port-security mac-address sticky
switchport port-security violation restrict - 38T or F: CDP is cisco proprietary layer 2 protocol that is a big vulnerability.True
- 39To turn off CDP what commands are used?GLOBAL:
switch(config)# no cdp run
switch(config)# exit
switch# show cdp
INTERFACE:
switch(config-if)#no cdp enable - 40The restrict action does what?will allow traffic from known MAC but not an unknown MAC and writes to a log
- 41What does protect do?will allow traffic from known MAC but not an unknown MAC (no log)
- 42This router threat: is access by an entity or individual other than authorized users.Unauthorized Access
- 43This router threat: occurs when an attacker manipulates and falsifies info and can be used to inject bogus data into a network. referred to as spoofing. (such as IP addresses)Masquerading
- 44This router threat: involves a hacker inserting a spoofed TCP/IP packet into a stream thereby enabling commands to be executed on the remote host.Session Hijacking
me....|....you - 45This router threat: includes manipulating router updates tp cause traffic to flow to unauthorized destinations-sometimes called route injection attacks.Rerouting
(not redirect)
(routers only) - 46This router threat: refers to willful attempts to cause disruptions by overwhelming the targeted system with improperly formatted traffic.Denial of Service
DoS
(healthcare.gov) - 47This router threat: the unauthorized viewing and collection of network traffic, usually accomplished with a packet sniffing program.Eavesdropping and Information Theft
- 48This is a technique of dialing a list of telephone numbers in search of other modems, since a computer is usually connected to those modems.War-Dialing
- 49What are the 4 ports and services in regards to TCP and UDP Small Servers?7 = echo
9 = discard
13 = daytime
19 = chargen - 50what syntax is used to disable TCP and UDP Small servers?no service tcp-small-servers
no service udp-small-servers - 51This protocol is used for querying a host about logged on usersFinger Server
telnet 14.2.9.230 finger - 52Cisco and other hosts use this protocol to keep their time-of-day clocks accurate and in sync.NTP
Network Time Protocol - 53Cisco routers are capable of acting as this type of server. it is for other cisco hardware in a deployment strategy with one router acting as a central repository of IOS images or config files for other routers.BootP Servers
- 54T or F: BOOT SYSTEM instructs the device to load a specific IOS. When command line mentions an IP instead of flash:filename , it is referencing the bootP server.True
boot system flash:
boot system tftp://[IP of BootP server]/ - 55This allows Cisco devices to load their config files from over the network, and is sometimes referred to as config auto-loading.Boot Network
- 56What are the 3 ICMP messages? RAD...Redirect
Destination Unreachable
Address Mask Reply - 57This ICMP message: has 16 sub-types (codes), showing what is unreachable and why.Destination Unreachable
- 58This ICMP message: informs a host that a packet was sent to the wrong destination, and tells the machine the correct destination. (usually occurs in a LAN that has more than 1 router and the host sends a packet to the wrong interface)Redirect
- 59T or F: Redirect ICMP message applies to hosts. and if not secured can alter the hosts routing tableTrue
- 60This ICMP Message: is intended to provide diskless hosts with a method to determine their network mask info. to a hacker this info may be used to ID routers and to collect subnet info, useful in mapping out networksAddress Mask Reply
- 61True or False: Automatic generation of the 3 ICMP messages should be disabled on all interfaces, especially those connected to untrusted networksTrue
- 62For DNS lookups, by default IOS sends DNS name queries to the what broadcast address?255.255.255.255
- 63DNS look-ups makes the router susceptible to what type of attack.DNS Poisoning
- 64T or F: by disabing DNS lookups on a router it forces you to use IP addresses instead of DNS queries.True
- 65T or F: Web based administration using HTTP server is a viable mechanism for a hacker to monitor, configure and attack a router.True
- 66True or False: HTTPS Server is encrypted with the SSL and the TLS cryptographic protocols but poses the same risk as HTTP Server is accessed. (no knowledge to do shit)True
- 67This term is used to force data through an area to troubleshoot. when used it forces a packet to take a certain route through the network and is used in several types of attacks.IP Source Routing
(should be disabled) - 68What protocol is considered CDP on steroids?Simple Network Management Protocols
(SNMP) - 69T or F: SNMP is the standard for automated remote monitoring and administration. (allows you to shutdown devices).True
- 70What are the basic steps to that must be performed in order in disabling the SNMP scheme if it was used?1) explicitly unset (erase) all existing community strings
2) disable SNMP system shutdown and trap features
3) disable SNMP system processing - 71SNMP has 3 flavors...What are they?1 - plain text
2 - plain text
3 - 53 bit DES (Digital Encryption Standard) - 72What service, when running on a router, breaks the LAN security perimeter, extending the LAN at Layer 2 across multiple segments?Proxy ARP
- 73T or F: A Cisco router can act as a intermediary for ARP; responding to ARP queries on selected interfaces and thus enabling transparent access between multiple LAN segments. (PROXY ARP)TRUE
- 74What does IP directed broadcast allow a host to do on a LAN segment?initiate a physical broadcast on a different LAN segment. allows you to send a datagram to the broadcast address (this is a technique use to create a DoS attack)
- 75This verification helps mitigate problems caused by the introduction of malformed or forged (spoofed) IP source addresses into a network by discarding packets lacking lacking a verifiable IP source address.uRPF
Unicast Reverse-Path Forwarding Verfication - 76T or F: uRPF can only run if the routing mode called Cisco Express Forwarding (CEF) is enabled.True
- 77T or F: first enable CEF, then enable uRPF verification on the desired interfacesTrue
- 78T or F: the strength of uRPF is that is only forwards packets w/valid addressesTrue
- 79What are the 2 types of logical devices?local
&
remote - 80T or F: Turn off the aux port if we don't need itTrue
- 81What command is used to create a user?username
- 82T or F: After the usenames nad passwords are set, you must change the interface's login from login to login localtrue
- 83T or F: if the interface is set to login local before creating an account using the username command, and log out of the system, access back in via that interface will not be allowed.True
- 84What do you turn on to allow the router the capability to log errors and block packets to an internal trusted syslog host.logging
- 85When logging is enabled which port is used and what internal host is used?port 514 UDP
syslog
Informationen
- Beschreibung
- college Enterprise Networking (Protecting the Network) Karteikarten am Protecting the Network, erstellt von jeriel.juarbe2031 am 15/09/2014.
- Erstellt von
- jeriel.juarbe2031
- Aufrufe
- 10
- Bewertung