Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

(5) Comptia Security + SY0-601 > Lesson 9 Implementing Secure Network Designs > Flashcards

Lesson 9 Implementing Secure Network Designs Flashcards

1
Q

What is a Network Segment

A

A portion of a network where all attached hosts can communicate freely with one another.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is zone

A

an area of the network where the security configuration is the same for all hosts within it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Describe the intranet zone

A

a network of trusted hosts owned and controlled by the organization. Within the intranet, there may be sub-zones for different host groups, such as servers, employee workstations, VoIP handsets, and management workstations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is an Extranet zone

A

a network of semi-trusted hosts, typically representing business partners, suppliers, or customers. Hosts must authenticate to join the extranet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a bastion host

A

A server typically found in a DMZ that is configured to provide a single service to reduce the possibility of compromise.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Described the screened subnet topology

A

uses two firewalls placed on either side of the DMZ. The edge firewall restricts traffic on the external/public interface and allows permitted traffic to the hosts in the DMZ. The edge firewall can be referred to as the screening firewall or router. The internal firewall filters communications between hosts in the DMZ and hosts on the LAN. This firewall is often described as the choke firewall.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Describe the Triple-Homed Firewall

A

using one router/firewall appliance with three network interfaces, referred to as triple-homed. One interface is the public one, another is the DMZ, and the third connects to the LAN. Routing and filtering rules determine what forwarding is allowed between these interfaces

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is East-West traffic

A

Design paradigm accounting for the fact that data center traffic between servers is greater than that passing in and out (north-south).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is Zero Trust

A

Security design paradigm where any request (host-to-host or container-to-container) must be authenticated before being allowed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How can Zero Trust be implemented in a network

A

Continuous authentication and conditional access to mitigate privilege escalation and account compromise by threat actors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is another way Zero Trust can be implemented in a network

A

applying micro segmentation by setting policies to a single node as though it was a zone of its own

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is ARP poisoning?

A

A network-based attack where an attacker with access to the target local network segment redirects an IP address to the MAC address of a computer that is not the intended recipient. This can be used to perform a variety of attacks, including DoS, spoofing, and Man-in-the-Middle.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a Broadcast storm?

A

Traffic that is recirculated and amplified by loops in a switching topology, causing network slowdowns and crashing switches.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a storm control setting on a switch

A

a backup mechanism to rate-limit broadcast traffic above a certain threshold

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a BPDU guard?

A

a switch port security feature that can disable a port if it receives a BPDU from a connected device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is MAC filtering?

A

Applying an access control list to a switch or access point so that only clients with approved MAC addresses can connect to it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is Dynamic ARP inspection?

A

prevents a host attached to an untrusted port from flooding the segment with gratuitous ARP replies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is Endpoint Security?

A

a set of security procedures and technologies designed to restrict network access at a device level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is Port-Based network Access control (PNAC)

A

A switch (or router) that performs some sort of authentication of the attached device before activating the port.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How does PNAC - Port-based network access control work?

A

A switch uses an AAA server to authenticate the attached device before activating the port

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is Network Access Control (NAC)

A

A general term for the collected protocols, policies, and hardware that authenticate and authorize access to a network at the device level.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is a health policy?

A

policies or profiles describing a minimum security configuration that devices must meet to be granted network access

23
Q

What is a posture assessment?

A

The process for verifying compliance with a health policy by using host health checks.

24
Q

What can happen if a an attack on route security is successful?

A

Enables the attacker to redirect traffic from its intended destination

25
Q

What vulnerabilities is Routing subjected to?

A

Spoofed routing information (route injection
Source routing
Software exploits in the underlying OS

26
Q

What is a Basic Service Set Identifier (BSSID)

A

A Wireless Access Points (WAP) MAC address

27
Q

What is Co-Channel interference (CCI)?

A

when two WAPs in close proximity use the same channel, they compete for bandwidth within that channel, as signals collide and have to be re-transmitted

28
Q

What is Adjacent Channel Interference (ACI)

A

occurs when transmissions are sent on an adjacent or partially overlapping channel.

29
Q

What is a site survey?

A

A collection of information about a location for the purposes of building an ideal infrastructure; it often contains optimum locations for wireless antenna and access point placement to provide the required coverage for clients and identifying sources of interference.

30
Q

What is a Heat Map?

A

In a Wi-Fi site survey, a diagram showing signal strength at different locations.

31
Q

When looking at a Heat map if the signal is strong what color will it be?

A

Red

32
Q

When looking at a Heat map if the signal is weak what color will it be?

A

green/blue

33
Q

What are the main features of WPA3

A

Simultaneous Authentication of Equals (SAE)
Enhanced Open
Galois Counter Mode Protocol (GCMP)

34
Q

What is Simultaneous Authentication of Equals (SAE)

A

Personal authentication mechanism for Wi-Fi networks introduced with WPA3 to address vulnerabilities in the WPA-PSK method

35
Q

What is Enhanced Open

A

Enables encryption for the open authentication method

36
Q

What is AES Galois Counter Mode Protocol (GCMP)

A

Mode of operation for AES that ensures authenticated encryption.

37
Q

What is Pre-shared key (PSK)

A

Passphrase-based mechanism to allow group authentication to a wireless network. The passphrase is used to derive an encryption key.

38
Q

How does Pre-shared key work?

A

uses a passphrase to generate the key that is used to encrypt communications. the administrator configures a passphrase of between 8 and 63 ASCII characters. This is converted to a 256-bit HMAC (expressed as a 64-character hex value) using the PBKDF2 key stretching algorithm

39
Q

What is Wifi protected setup (WPS)

A

A feature of WPA and WPA2 that allows enrollment in a wireless network based on an 8-digit PIN

40
Q

What does Extensible Authentication over Wireless allow you to do?

A

to allow an access point to forward authentication data without allowing any other type of network access.

41
Q

How does Enterprise Authentication work with EAPoW?

A

when a wireless station requests an association, the WAP enables the channel for EAPoW traffic only. It passes the credentials of the user (supplicant) to an AAA (RADIUS or TACACS+) server on the wired network for validation. When the supplicant has been authenticated, the AAA server transmits a master key (MK) to the supplicant. The supplicant and authentication server then derive the same pairwise master key (PMK) from the MK. The AAA server transmits the PMK to the access point. The wireless station and access point use the PMK to derive session keys, using either the WPA2 4-way handshake or WPA3 SAE methods.

42
Q

What is EAP-TLS

A

An EAP method that requires server-side and client-side certificates for authentication using SSL/ TLS

43
Q

How does EAP-TLS work?

A

An encrypted Transport Layer Security (TLS) tunnel is established between the supplicant and authentication server using public key certificates on the authentication server and supplicant. As both supplicant and server are configured with certificates, this provides mutual authentication. The supplicant will typically provide a certificate using a smart card or a certificate

44
Q

What is Protected Extensible Authentication Protocol (PEAP)

A

EAP implementation that uses a server-side certificate to create a secure tunnel for user authentication, referred to as the inner method.

45
Q

How does Protected Extensible Authentication Protocol (PEAP) work?

A

n encrypted tunnel is established between the supplicant and authentication server, but PEAP only requires a server-side public key certificate. The supplicant does not require a certificate. With the server authenticated to the supplicant, user authentication can then take place through the secure tunnel with protection against sniffing, password-guessing/dictionary, and on-path attacks

46
Q

How does EAP-TTLS work

A

uses a server-side certificate to establish a protected tunnel through which the user’s authentication credentials can be transmitted to the authentication server. The main distinction from PEAP is that EAP-TTLS can use any inner authentication protocol (PAP or CHAP, for instance), while PEAP must use EAP-MS-CHAPv2 or EAP-GTC

47
Q

What is EAP-FAST

A

uses a Protected Access Credential (PAC), which is generated for each user from the authentication server’s master key.

48
Q

How can you detect a rouge WAP

A

By using a spectrum analyzer

49
Q

How does a Distributed reflection DoS attack/ amplification SYN flood attack work?

A

the threat actor spoofs the victim’s IP address and attempts to open connections with multiple servers. Those servers direct their SYN/ACK responses to the victim server. This rapidly consumes the victim’s available bandwidth.

50
Q

How does an Application Attack work?

A

an application attack targets vulnerabilities in the headers and payloads of specific application protocols.

51
Q

What is a Operational Technology (OT)

A

A communications network designed to implement an industrial control system rather than data networking.

52
Q

What is a blackhole

A

an area of the network that cannot reach any other part of the network

53
Q

What is a sinkhole

A

A DoS attack mitigation strategy that directs the traffic that is flooding a target IP address to a different network for analysis

(5) Comptia Security + SY0-601 (12 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions