¡GoConqr estrena diseño! Cuéntanos qué te parece.

Regístrate gratis

Fichas

1.3 Network and Security Components

DJ Perrone CAS-002 Inglés 118 fichas

Fichas del conjunto (118)

  1. 1What are some different methods of remote access?- VPN
    - SSH
    - RDP
    - VNC
    - SSL
    - FTP / TFTP
  2. 2What are some advantages of RDP?- Data is in the data center
    - Work location flexability
    - Possibly cost reduction where all users are using baseline VM.
  3. 3What are some disadvantages of RDP?- Server downtime is huge issue
    - Insufficient processing power can cause bottlenecks.
    - High learning curve
  4. 4What is VNC?Virtual Network Computing.
  5. 5What are 3 components of VNC?- VNC Server
    - VNC Client
    - VNC Protocol (RFB)
    - Remote Frame Buffer
  6. 6What port does VNC use by default?5900
  7. 7What are some IPv4 to IPv6 transition mechanisms?- 6 to 4
    - Teredo
    - Dual Stack
    - GRE Tunnels
  8. 8What is 6 to 4Allows IPv6 sites to talk over IPv4 network. Treats IPv4 network as unicast point to point.
  9. 9What is Teredo?Assigning addresses and creates host-to-host tunnels for unicast IPv6 traffic when IPv6 hosts are located behind IPv4 NAT's
  10. 10- What is dual stack?Running IPV4 and IPv6 on the same devices.
  11. 11What is a GRE Tunnel?Generic Routing Encapsulation
    - Carries IPv6 packets across an IPv4 network by encapsulating them in GRE IPv4 packets.
  12. 12Name at least 3 Network Authentication Methods- Password Authentication Protocol (PAP)
    - Challenge Handshake Authentication Protocol (CHAP)
    - Extensible Authentication Protocol (EAP)
  13. 13What is PAP?Password Authentication Protocol
    Provides authentication, credentials are sent in plaintext and can be read by sniffer
  14. 14What is CHAP ?Challenge Handshake Authentication Protocol
    - The server sends client a random string of text as a challenge, the client then encrypts the text with the password and sends it back to the server.
  15. 15How many versions of CHAP are there?- MS-CHAP v1
    - MS-CHAP v2
  16. 16What is MS-CHAP v1Works only with MS devices. More secure than CHAP but still susceptible to brute force attacks.
  17. 17What is MS-CHAP v2?An update to v1. Provides stronger encryption and mutual authentication.
  18. 18What is EAP?Extensible Authentication Protocol
    A framework for port based access control using components used in RADIUS. Can use multiple authentication methods.
  19. 19How many versions of EAP are there?- EAP-MD5-CHAP
    - EAP-TLS
    - EAP-TTLS
  20. 20What is EAP-MD5-CHAP?Uses CHAP as challenge process, but challenges and response are sent as EAP message. Allows password use.
  21. 21What is EAP-TLS- Requires PKI due to needing certs on both client and server.
    - Immune to password attacks.
  22. 22What is EAP-TTLS?Requires cert on server only. Client uses password which is sent within EAP message.
  23. 23What are the different authentication factors?- Knowledge factor authentication
    - Ownership factor authentication
    - Characteristic factor authentication
    - Location factor authentication
    - Action factor authentication
  24. 24What is knowledge factor authentication?- Something you know
    - Type 1 authentication
  25. 25What is ownership factor authentication?- Something you have
    - Type 2 authentication
  26. 26What is characteristic factor authentication?- Something you are
    - Type 3 authentication
  27. 27What is location factor authentication?Somewhere you are
  28. 28What is action factor authenticationSomething you do
  29. 29What is 802.1X?Framework for port based authentication
    - Port security
  30. 30What 3 components make up 802.1X?- Supplicant: User or device requesting access
    - Authenticator: Device which supplicant attempts to access the network
    - Authentication Server: Centralized device providing authentication
  31. 31What are some characteristics of RADIUS?- An open standard
    - Uses UDP
    - Encrypts only the password
    - Combines authentication and auth.
    - Doesn't support: ARA, NetBIOS, X.25 PAD
    - Less traffic than TACACS+
  32. 32What are some characteristics of TACACS+- Cisco proprietary
    - Uses TCP
    - Encrypts entire body of packet
    - Separates authentication, auth and accounting.
    - Supports all protocols
    - More traffic than RADIUS
  33. 33What is UTM?Unified Threat Management
    - Performing multiple security functions on the same device.
  34. 34What are some advantages of using UTM?- Low upfront and maintenance cost
    - Lower power consumption
    - Easier to fully integrate
    - Easier to install and configure
  35. 35What are some disadvantages of using UTM?- Single point of failure
    - Lacks granularity
    - Performance issues
  36. 36What is NIPS and what does it do?Network Intrusion Prevention System
    - Scans network traffic for signs of malicious activity and takes action against it.
  37. 37What is NIDS and what does it do?Network Intrusion Detection System
    - Detects unauthorized access or attacks.
  38. 38What is an IDS and what are the categories?Intrusion Detection System
    - Signature Based IDS
    - Anomaly Based IDS
  39. 39What are some characteristics of signature-based IDS?- Pattern matching
    - Stateful matching
  40. 40With a signature-based IDS, what is pattern matching?Compares traffic to a database of attack patterns. Carries out pre-plannned steps if an attack matches pattern.
  41. 41With a signature-based IDS, what is stateful-matching?Records the initial state of OS. Any changes in state that violates a defined rule is reported.
  42. 42What an an anomaly-based IDS?Analyzes traffic and compares it to normal traffic to determine a threat.
  43. 43What are the different types of anomaly-based IDS's?- Statistical anomaly-based IDS
    - Protocol anomaly-based IDS
    - Traffic anomaly-based IDS
    - Rule or heuristic-based IDS
    - Application-based IDS
  44. 44What is a statistical anomaly-based IDS?Samples the live environment and records activity. The longer the IDS is running, the more accurate it is. Activity thresholds are important to prevent false negatives and false positives.
  45. 45What is a protocol anomaly-based IDS?Has knowledge of protocols it will monitor.
  46. 46What is a traffic anomaly-based IDS?Tracks traffic patterns. All future patterns are compared to sample. Must tune threshold. Useful if user activity is static.
  47. 47What is a rule or heuristic-based IDS?Uses a knowledge base, and interference engine and rule-based programming. Often referred to as an if/then system or expert system.
  48. 48What is an application based IDS?Analyzes transaction logs for a single application.
  49. 49What is an INE or HAIPE?Inline Network Encryptor
    High Assurance Internet Protocol Encryptor
    Type 1 encryption device
  50. 50What is SIEM?Security Information and Event Management
    - Utils that receive information from log files and centralize the collection and analysis of that data.
  51. 51What is an HSM?Hardware Security Module
    Manages digital keys. Attaches directly to server.
  52. 52For device placement, where should you place a UTM?Between the LAN and the internet connection.
  53. 53For device placement, where should you place a NIDS?Dependent on org needs.
    - Inside firewall: identify internal attacks and attacks that get through firewall
    - Outside firewall: identify attacks coming from internet.
  54. 54For device placement, where should you place an INE?The point where then network has a connection to an unprotected network.
  55. 55For device placement, where should you place a NIPS?The border of the network and connect it inline between the external and internal network.
  56. 56For device placement, where should you place a SIEM device?In a centralized location where all devices can reach it.
  57. 57What is a WAF?Web Application Firewall
    - Applies rules to HTTP. Covers common attacks like XSS and SQL injections.
    - Usually placed behind firewall
    - Operate inline and out of band
  58. 58What are advantages and disadvantages of in-line operation?- Advantage: Can prevent live attacks.
    - Disadvantage: May prevent legit traffic. May slow web traffic.
  59. 59What are advantages and disadvantages of out-of-band operation?- Advantages: Non-intrusive, doesn't mess with traffic.
    - Disadvantages: Cannot block live traffic.
  60. 60What is a NGFW?Next Generation Firewall
    - Addresses traffic inspection shortcomings of traditional stateful firewalls.
  61. 61Where can a NGFW be placed?-In line
    - Out of Path
    - Out of Path means the gateway redirects traffic to NGFW.
  62. 62What is an IPS?Intrusion Protection System
    Prevents attacks.
  63. 63What are the two IPS types?- Passive Vulnerability Scanners (PVS)
    - Active Vulnerability Scanners (AVS)
  64. 64What is a DAM?Database activity monitor
    Monitors transactions of the activity of database services.
  65. 65What are some DAM architectures?- Interception-based Model
    - Memory-based Model
    - Log-based Model
  66. 66With regards to DAM, what is the interception-based modelWatches the communications between the client and the server
  67. 67With regards to DAM, what is the memory-based modelUses a sensor attached to the database and continually polls the system to collect SQL statements.
  68. 68With regards to DAM, what is the log-based modelAnalyzes and extracts information from transaction logs.
  69. 69For device placement, where should you place a DAM?- In Line
    - It can also perform remote monitoring.
  70. 70What is ARP poisoning?Disrupting the ARP cache on a switch.
  71. 71What are two mitigation techniques for ARP poisoning?- Dynamic ARP Inspection (DAI)
    - DHCP Snooping
  72. 72What are the 5 types of firewalls?- Packet-filtering Firewalls
    - Stateful Firewalls
    - Proxy Firewalls
    - Dynamic Packet-filtering
    - Kernel Proxy Firewalls
  73. 73What is a packet filtering firewall?- Only inspects header of packet for IP addresses and port.
  74. 74What is a stateful firewall?- Aware of TCP handshake and track connections in reference to the 3 way handshake.
    - Maintains a state table of all current connections.
  75. 75What is a proxy firewall?- Stands between an internal-to-external connection.
    - Makes connections on behalf of endpoints.
    - Operates on L5 and L7
  76. 76What is a kernel proxy firewall?- Fifth generation firewall.
    - Inspects packets at every layer of OSI without performance hit of L7 firewall.
  77. 77Which proxy firewall operates at the session layer (L5)- Circuit level proxy
    - Makes decisions based on header and session information
  78. 78Which proxy firewall operates at the application layer (L7)- Application level proxy
    - Performs deep packet inspection.
    - Maintains a different proxy function for each protocol.
    - Big impact on performance
  79. 79Where is a packet-filtering firewall placed?Between subnets, which must be secures.
  80. 80Where is a circuit level proxy placed?At the network edge
  81. 81Where is an application-level firewall placed?Close to the application server it's protecting.
  82. 82Where is a kernel proxy firewall placed?Close to the system it's protecting.
  83. 83What is a bastion host?- Refers to position of any device.
    - Any device exposed to an untrusted network.
    - Important to reduce attack surface.
  84. 84What is a dual-homed firewall?A FW with 2 network interfaces. One for internal network and one for external.
  85. 85What is a multi-homed firewall?- 3 legged firewall is popular
    - One connection to untrusted network, one to trusted and one to DMZ.
  86. 86What are some features of WLC?Wireless LAN Controllers
    - Interference detection and avoidance
    - Load balancing
    - Coverage gap detection.
  87. 87What forms of authentication do WLAN controllers support?- PEAP
    - LEAP
    - EAP-TLS
    - WPA
    - WPA2
    - L2TP
  88. 88What do firewalls use to do their job?Rule sets
  89. 89What is the order that firewall rules are examined?- Type of traffic
    - Source of traffic
    - Destination of traffic
    - Action to take on traffic
  90. 90What are the 5 steps of the formal change control process?- Submit/resubmit a change request
    - Review the change request
    - Coordinate the change
    - Implement the change
    - Measure the results of change
  91. 91What are two types of availability controls?- Redundant hardware
    - Fault-tolerant technologies
  92. 92What are 2 types of metrics used to measure control availability?- SLA
    - MTBF and MTTR
  93. 93What is an SLA?- Service level agreement
    - Support agreed upon for a service
  94. 94What is MTBF and MTTR- Mean Time Between Failures
    - Mean Time to Repair
    - Both of these define how long it will take to get the device or service back online.
  95. 95What is RAID 0?- Disk striping
    - Writes data across multiple drives
    - No fault tolerance
  96. 96What is RAID 1?- Disk mirroring
    - Fault tolerance
    - Usable storage is half of total to account for 1:1 mirror
  97. 97What is RAID 3?- Disk striping with parity
    - Requires at least 3 disks
    - Parity disk is used to rebuild in case of drive failure.
    - All parity data is stored on single disk
  98. 98What is RAID 5?Disk striping with parity
    - Requires at least 3 drives
    - Information and parity distributed throughout RAID.
  99. 99What is fail over?The ability of a system to switch to backup system.
  100. 100What is fail soft?The capability of a system to terminate noncritical processes.
  101. 101What are different types of load balancing?- Clustering (Software)
    - Load Balancing (Hardware)
  102. 102What are the 3 planes in a typical SDN architecture?- Control plane
    - Data plane
    - Management plane
  103. 103In reference to SDN, what is a control plane?- Carries signaling traffic to or from a router.
    - Allows the building of routing tables.
  104. 104In reference to SDN, what is a data plane?- Also known as the forwarding plane.
    - Carries user traffic.
  105. 105In reference to SDN, what is a management plane?- The plane that administers the router.
  106. 106What are different types of cloud managed networks?- IaaS
    - PaaS
    - SaaS
  107. 107What are some indications, and sources of authentication attacks?- Multiple unsuccessful attempts at login
    - AD, Syslog, RADIUD, TACACS+
  108. 108What are some indications, and sources of firewall attacks?- Multiple drop/reject/deny events from same IP address.
    - Firewall, Routers and Switches
  109. 109What are some indications, and sources of IPD/IDS attacks?- Multiple drop/reject/deny events from the same IP address.
    - IPS and IDS
  110. 110What is switch spoofing?When an attacker sets port to "Dynamic Desirable" and forms a trunk, therefore capturing all VLAN traffic.
  111. 111How do you prevent VLAN hopping?Change default Native VLAN of trunk interface.
    - #switchport trunk native vlan 99
  112. 112What are the 5 services in Data-Flow enforcement?- Boundary control services
    - Access control services
    - Integrity services
    - Cryptography services
    - Auditing and monitoring services
  113. 113What is NAC?Network Access Control
    - Examines the state of the computer in combination with authentication.
  114. 114What are the 5 steps of Network Access Protection?- Request access
    - Health state send to NPS (RADIUS)
    - NPS evaluates against local health policies
    - If compliant, grant access
    - If not, restrict network access and remediation
  115. 115What is BACNet?Building Automation and Control Network
  116. 116What is SCADA?Supervisory Control and Data Acquisition
    - Coded signals over comms channels to provide remote equipment controls.
  117. 117What are the components of SCADA?- Sensors
    - Remote Terminal Units (RTU)
    - Programmable Logic Controllers (PLC)
    - Telemetry System
    - Human Interface
  118. 118What publications is useful for SCADA/ICS information?NIST SP 800-82

Información

Descripción
Given a scenario, analyse network and security components, concepts and architectures.
Creado por
DJ Perrone · oct 2017
Actualizado
23 oct 2017
Visitas
79
Valoración

Escríbenos

¿Sobre qué es tu mensaje?

¿Qué te parece el nuevo diseño?

¿Te gusta?