2.4 Summarize services provided by networked hosts Flashcards
1
Q
What is the current version of SMB?
A
SMB3
2
Q
Why is SMB1 disabled by default on current Windows versions?
A
It has security vulnerabilities
3
Q
How can SMB be implemented on Linux-based devices & NAS appliances?
A
Via Samba software suite
This allows a Windows client to access a Linux host as though it were a Windows file or print server
4
Q
What did the eraliest Windows network use instead of TCP/IP?
A
NetBIOS
5
Q
Meaning of NetBIOS?
A
Network Basic Input/Output System
6
Q
What did NetBIOS allow computers to do?
A
Address one another by name & establish sessions over protocols
protocols like SMB
7
Q
What was NetBIOS re-engineered to work over?
A
TCP & UDP protocols
8
Q
What term is used to describe the re-engineering of NetBIOS to function over TCP and UDP protocols?
A
NetBT
9
Q
Meaning of NetBT?
A
NetBIOS over TCP/IP
10
Q
What port does NetBT use for name services?
A
UDP/137
11
Q
What does NetBT use UDP/137 for?
A
Name services
12
Q
What port does NetBT use for session services?
A
TCP/139
13
Q
What does NetBT use TCP/139 for?
A
Session services
14
Q
Is NetBT obselete?
A
Yes
Modern networks use IP, TCP/IP, & DNS for these functions
15
Q
Why should NetBT be disables on most networks?
A
Poses a risk to security
16
Q
When should NetBT be used?
A
When network needs to support file sharing for pre-Windows 2000 versions
This is because pre-Windows 2000 systems rely on NetBIOS for file and printer sharing
17
Q
What does FTP use TCP/21 for?
A
Establish a connection
Between client & server
18
Q
What does FTP use TCP/20 for?
A
Transfer data in Active or Passive mode
In FTP’s active mode, the server initiates the data connection to the client on port 20, but it can encounter firewall and NAT issues. Passive mode, where the client initiates both control and data connections to the server, is more firewall-friendly.
19
Q
2 FTP options that are encrypted?
A
SFTP & FTPS
FTPS = File Transfer Protocol Secure
20
Q
Meaning of SFTP?
A
FTP over Secure Shell
21
Q
Which encrypted FTP version is widely used?
A
SFTP
22
Q
What does a web server do?
A
Provides client access using HTTP or HTTPS
23
Q
What does HTTP enable clients to do?
Clients are typically web browsers
A
To request resources from an HTTP server
24
Q
How does a server respond to an HTTP resource request from a client?
A
Returning requested data or responding with an error code
25
What kind of webpages does HTTP serve?
HTML webpages
26
What are HTML webpages?
Text files with coded tags describing how to format documents
27
How does a web browser display HTML webpages?
Interprets the tags & other resources associated with the page
## Footnote
HTTP also enables hyperlinking to related documents and supports form submission (POST) for data transfer from client to server.
28
What is the functionality of HTTP often extended by?
Support for scripting & programmable features
| (Web apps)
29
Meaning of URL?
Uniform Resource Locators
30
What are URLs used for?
Accessing resources on the Internet
| They contain the necessary info. to identify & access an item
31
What may a URL for an HTTP resource contain?
- Protocol
- Host location
- File path
32
Can the URL's *Host location* be an IP address instead of the FQDN?
Yes, but IPv6 addresses must be enclosed in `[ ]`
33
What does the URL's *File path* specify?
The directory & file name locatoin of the resource (if required)
## Footnote
The file path may or may not be case sensitive, depending on how the server is configured
34
What do orgs. typically lease a web server or space on a server from?
ISP
## Footnote
Larger orgs. with Internet-connected datacenters may host websites themselves
35
What is the *"intranet"*?
Private network using web technologies for local access
## Footnote
It provides local access to internal resources for employees within an organization. It offers a secure environment for sharing information, collaboration, and communication exclusively among authorized internal users, helping to improve efficiency and streamline operations while maintaining data security.
36
What is the *"extranet*"?
Private network using web technologies for remote access
## Footnote
Enables remote access for authorized users who are external to the organization, such as business partners, suppliers, or customers. It provides a secure way to share specific resources and information with these external parties while maintaining the overall security and integrity of the internal network.
37
Meaning of SSL?
Secure Sockets Layer
38
Why was SSL developed?
To address HTTP
| Since HTTP was unencrypted
39
Meaning of TLS?
Transport Layer Security
40
What was TLS developed from?
SSL
| It was ratified as a standed by the IETF
41
When is HTTP referred to as HTTPS?
When TLS is used with the HTTP application
| Encrypted traffic is sent over TCP/443 rather than unencrypted TCP/80
## Footnote
TLS can be used to secure other TCP app protocols, like FTP, POP3/IMPA, SMTP, LDAP
42
What term is used when TLS is used with UDP?
DTLS
| DTLS = Datagram Transport Layer Security
## Footnote
Most often used in VPN solutions
43
How is HTTPS implemented?
Web server is installed with a digital certificate issued by a trusted CA
| CA = Certificate Authority
44
What do certificates on web servers have?
Encrypted data to prove the identity of the server to the client
| Assuming the client also trusts the CA (Certificate Authority)
45
How is data in digital certificates encrypted?
Using a public/private encryption key pair
46
Who possesses the private key in web server encryption?
Web server
| The private key is kept a secret known only to the server
47
How is the public key in web server encryption given to clients?
via the digital certificate
48
How are encrypted tunnels established in web server encryption?
Using the digital certificate's key pair & a chosen cipher suite in TLS
## Footnote
Even if someone knows the public key, they can't decrypt the tunnel's contents without the server's private key. This ensures secure communication, preventing third-party reading or modification.
49
How does a browser open a secure session to an HTTPS server?
With a URL starting with `https://`
## Footnote
It displays a padlock icon in the address bar, indicating a trusted server certificate and a secure connection. Websites can enforce secure sessions, rejecting or redirecting plain HTTP requests
50
What scheme do email addresses follow?
URL scheme
51
What do email addresses compromise of?
- Username
- Domain name
| Separated by an `@` symbol
## Footnote
i.e. `david.martin@comptia.org` or `david.martin@aol.com`
52
What does SMTP specify?
How email is delivered from 1 mail domain to another
53
How does the sender's SMTP server find the recipient's SMTP server's IP address?
By using the domain name of the recipient's email address
## Footnote
SMTP servers for the domain are registered in DNS using Mail eXchange (MX) & host (A/AAAA) records
For `user@example.com`, the sender's SMTP server queries DNS for the MX record of example.com. The DNS server returns `mail.example.com`, which is then resolved to an IP address for email delivery
54
What is SMTP TCP/25 used for?
Message relay between SMTP servers, or MTAs
| MTA = Message Transfer Agents
## Footnote
This means the process of transferring emails from a SMTP server to another
55
What is SMTP TCP/587 used for?
Mail clients to submit emails to an SMTP server
## Footnote
STMP servers configured to support TCP/587 shoud use encryption & authentication
56
What do SMTP servers deliver emails to?
mailbox servers
| i.e. POP3 or SMTP
## Footnote
A mailbox server could be a separate machine or a separate process running on the same computer
57
What is POP's secure port?
TCP/995
58
What happens when a user logs in to a POP email client?
Mailbox contents are downloaded to the local PC for processing
## Footnote
This allows the user to access and manage their emails locally, even when they are not connected to the internet.
59
What does POP3 typically do to emails after downloading them to a device?
Deletes them from the mailbox server
| Although some clients have the option to leave messages on the server
60
How does IMAP differ from POP?
Allows simultaneous client access to the same mailbox with persistent connections
## Footnote
persistent connections enable clients to interact with the server efficiently, reducing overhead associated with connection setup and teardown.
61
What can clients do to the mailbox with IMAP?
Manage the mailbox on the server & create multiple mailboxes
## Footnote
for instance, to organize messages in folders & to control when they are deleted
62
How can IMAP TCP/143 be secured?
| (Encrypted)
Using TLS
63
Default port for IMAPS?
| IMAPS = IMAP-Secure
TCP/993
64
Meaning of SSO?
Single Sign-On
65
What is SSO?
Centralized authentication for accessing multiple services with 1 login
66
How does a directory database work?
Objects represent records while their attributes function as fields
| attributes = things that are known about the object
67
What standard are most directory databases based on?
X.500
## Footnote
X.500 standard is a set of protocols for directory services in a network. It defines the framework for developing and managing electronic directories that provide access to various resources such as email addresses and public keys.
68
What does LDAP do?
Queries & updates an X.500 directory database
## Footnote
LDAP is widely supported in current directory products, such as Windows Active Directory and the open-source OpenLDAP
69
Meaning of AAA?
Authentication, Authorization, & Accounting
70
What do AAA servers do?
Consolidates authentication services across multiple access devices
## Footnote
AAA servers centralize authentication for various network devices and services, simplifying user logins and access management across the network.
71
What components does AAA use?
- Supplicant
- Network Access Server (NAS) or Network Access Point (NAP)
- AAA server
| NAP = Nework Access Point
72
What is the ***supplicant*** component in AAA?
Device requesting access
| i.e. a user's PC or laptop
73
What is the ***Network Access Server (NAS) or Network Access Point (NAP)*** component in AAA?
| Aka ***AAA clients*** & ***authenticators***
Network devices that control access to the network
| i.e. switches, APs, & VPN gateways
## Footnote
They forward data between the AAA server & the supplicant
74
How is AAA often implemented?
Using RADIUS protocol
75
Meaning of RADIUS?
Remote Authentication Dial-In User Service
76
What does a terminal do?
Accepts input & displays output
## Footnote
Whereas the shell performs the actual processing
77
What does a shell do?
Performs the actual processing
## Footnote
Whereas the terminal accepts input & displays output
78
What is a terminal emulator?
Software that replicates the I/O function of TTY
| (I/O = Input/Output) (TTY = TeleTYpe)
## Footnote
A TTY (Teletypewriter) is a device used for text communication over a network, often in the context of early computer systems. Terminal emulators might support connections to multiple types of shell
79
What does a remote terminal emulator allow you to do?
To connet to the shell of a different host over the network
80
What protocol is mainly used for secure remote access to UNIX, Linux servers, & various network appliances?
| Network appliances like switches, routers, & firewalls)
SSH
81
What is one of the most widely used SSH server implementations?
OpenSSH
82
What is RDP?
Microsoft's protocol for remote GUI connections to Windows
## Footnote
RDP clients for various OSs, including Linux, macOS, iOS, & Android, allow remote connection to Windows desktops from non-Windows devices. Additionally, there are open-source RDP server options like xrdp.
83
What does SNMP consists of?
Management system & agents
84
What do SNMP agents do?
Maintain a database called MIB
| MIB = Management Information Base
85
What is an SNMP agent?
Process running on a SNMP-compatible network device
| i.e. switch router, server, etc.
86
What info. do MIB databased hold?
| This is the database maintained by an SNMP agent
Statistics relating to the activity of the device
| i.e. the number of FPS handled by a switch
87
What does it mean that SNMP agents can initiate a trap operation?
It informs the management system of a notable event
| i.e. port failure
## Footnote
The threshold for triggering traps can be set for each value
88
What does the SNMP management system do?
Polls agents for Management Information Base (MIB) info & displays it for review
| Also displays trap operations as alerts for admin assessment & action
## Footnote
"Polls" in this context means that the monitoring system actively requests information from the SNMP agents at regular intervals.
89
What does a log collector do?
Collects event messages from multiple devices into one location
90
What is syslog?
Protocol & software that facilitates log collection
## Footnote
Syslog is the standard for logging distributed events. i.e. syslog messages can be generated by routers & switches, as well as UNIX or Linux servers & workstations
91
What port does a syslog collector usually listen on?
UDP/514
92
What does a syslog message compromise of?
PRI code
93
What is a syslog message's PRI code?
Header with timestamp & host name, & a message
## Footnote
PRI code calculated from facility & severity. Message includes source process tag and content, format varies.
94
What else do proxy servers do besides translating IP addresses?
## Footnote
Proxy servers act as NATs, translating between LAN's private IP and router's WAN IP
Receive, check, & forward HTTP requests to destination server
| A proxy can also be used for other types of traffic (i.e email)
95
What does a proxy server do upon receiving a reply from the destination server?
Checks it & then forwards it back to the LAN computer
| A proxy can also be used for other types of traffic (i.e email)
96
2 services a proxy server can operate as?
Transparent or nontransparent service
97
How does a transparent proxy server differ from a nontransparent one?
By not requiring any special configuration
## Footnote
A non-transparent proxy requires explicit configuration on client devices, including specifying the IP address and service port of the proxy server, to route traffic through it. On the other hand, a transparent proxy does not require any such configuration on client devices as it intercepts and redirects traffic automatically.
98
How does a nontransparent proxy server differ from a transparent one?
By requiring the IP address & service port of the proxy server
## Footnote
A non-transparent proxy requires explicit configuration on client devices, including specifying the IP address and service port of the proxy server, to route traffic through it. On the other hand, a transparent proxy does not require any such configuration on client devices as it intercepts and redirects traffic automatically.
99
How can a proxy perform a security function?
By acting as a content filter & applying rules to access requests
## Footnote
i.e. it can restrict overall time limits or impose time-of-day restrictions
100
How can a proxy improve performance & reduce bandwidth?
By configuring it to cache content
101
Meaning of IDS?
Intrusion Detection System
102
Meaning of IPS?
Intrusion Prevention System
103
How does an IDS work?
Identifying malicious traffic using programmed scripts
| An IDS can raise an alert when a match is made
104
What does an IPS do?
Takes action to block the source of malicious packets
105
What do antivirus/antimalware do?
Scan network-transferred files for known malware signatures in binary data
106
What do spam gateways do?
Uses SPF, DKIM, & DMARC to verify the authenticity of mail servers
107
What are spam gateways configured with?
Filters that can identify unwanted messages
| i.e. spoofed, misleading, or malicious messages
108
How is a spam gateway installed as?
Network server
## Footnote
Unwanted messages are filtered out before they're delivered to the user's inbox
109
What do content filters do?
Block outgoing access to unauthorized websites & services
110
What do DLP systems do?
| DLP = Data Leak/Loss Prevention
Scans outgoing traffic for confidential or personal data
## Footnote
DLP systems can verify whether the transfer is authorized & block it if it's not
111
Meaning of UTM?
Unified Threat Management
112
What is a UTM?
Appliance that combines multiple security functions
113
What do load balancers do?
Distribute clients requests across servers in a pool
114
When should a load balancer be used?
With multiple servers providing the same function
## Footnote
i.e. web servers, email servers, web conferencing servers, & streaming media servers.
115
Where is a load balancer placed?
In front of the server network
## Footnote
It distributes requests from the client network or Internet to the application servers
116
Why is a load balancer's address advertised as a virtual server to clients?
To provide high availability & scalable services
## Footnote
"A load balancer's address is advertised as a virtual server" means that clients are given a single IP address or domain name to connect to, which represents the load balancer rather than any specific backend server.
117
What is a legacy system?
System that's no longer supported by its vendor
| This could be hardware/software
## Footnote
This coluld be due to the vendor going out of business or formally deprecated use of the product
118
Meaning of EOL?
End Of Life
119
What is an EOL?
Product that is no longer supported
120
Why are legacy systems often retained in networks?
To run complex or expensive-to-migrate services
## Footnote
A service may be too complex or expensive to migrate to a more modern platform
121
Why is using legacy systems a security risk?
Due to lack of vendor patches for vulnerabilities
122
What should you do when using legacy systems in a network?
Isolated them & protect & monitor their network connections
| By "maximise isolation", i mean to isolate them as far as possible
123
What is an embedded system?
Device designed for a specific function
## Footnote
These systems can be as small & simple as a microcontroller in an intravenous drip-rate meter or as large & complex as an industrial control system managing a water treatment plan
124
Where are embedded systems typically designed to operate in?
Within a private network
## Footnote
Meaning there is no connectivity to wider computer data networks. Embedded systems interacting with computer networks require specific network design considerations, particularly regarding security.
125
What is an Industrial Control System (ICS)?
A computer control system to manage & automate industrial processes
| Mechanisms for workflow & process automation
126
What does an Industrial Control System (ICS) control?
Infrastructure machinery
## Footnote
i.e. power suppliers, water suppliers, health services, telecommunications, & national security services
127
How do Industrial Control Systems (ICS) manage infrastructure machinery?
Via embedded PLCs
| (PLC = Programmable Logic Controller) (equipment like plant devices)
## Footnote
A PLC is a specialized computer for industrial automation. It connects to actuators for mechanical control and sensors for local monitoring.
128
What is an embedded system network referred to as?
Operational Technology (OT) network
| To distinguish it from an IT network
129
What is the output & configuration of a PLC performed by?
| (PLC = Programmable Logic Controller)
## Footnote
A PLC is a specialized computer for industrial automation. It connects to actuators for mechanical control and sensors for local monitoring.
Human-Machine Interface (HMI)
| A HMI may be a local control panel or software on a PC
130
Meaning of SCADA?
Supervisory Control And Data Acquisition
131
What does SCADA serve as?
## Footnote
SCADA is a control system architecture used in industrial settings for monitring & controlling processes & equipment
Control server for large, multi-site ICSs
| ICS = Industrial Constrol System
## Footnote
SCADA typically runs as software on a comptuer
132
Meaning of IoT?
Internet of Things
133
What is IoT?
## Footnote
i.e. wearable technology, home appliances, home control systems, vehicles, etc.
Global network of sensor-equipped items with network connectivity
## Footnote
IoT devices have sensors, software, & network connectivity to transmit data
134
What are IoT smart devices used for?
Home automation systems
135
2 components that IoT smart device networks generally use?
- Hub/control system
- Smart devices
136
Why do IoT devices usually require a communication hub?
To facilitate wireless networking
## Footnote
A hub could be implemented as a smart speaker operated by voice control or use an app for configuration
137
Why may IoT devices need a control system?
They may be headless
| Meaning they can't operate directly using I/O devices
138
3 functions IoT smart devices are capable of?
## Footnote
Smart devies like a smart lightbulb, refrigerator, thermostat/heating control, doorbell/video entry phone that you can operate & monitor remotely, etc.
Compute, storage, & network functions
## Footnote
These are all potentially vulnerable to malware
139
What kernal do most IoT smart devices use?
Linux or Android Kernel
140
What attacks are IoT smart devices vulnerable to?
Web app & network attacks
| Integrated peripherals like cameras & mics can be compromised
## Footnote
This is becuase they're effectively running mini-computers
141
2 wireless protocols IoT devices may use?
Z-Wave or Zigbee
## Footnote
IoT smart devices may use these protocols even though the hub itself is usually connected to the Wi-Fi network
142
What are protocols like Zigbee & Z-Wave designed for?
Operating on low-power devices with minimal CPU & storage
