4.5 Flashcards

Question

802.1x standard

Answer 1

port based network access control mechanism based on IEEE 802.1x standard modern NAC solutions build on this

Answer 2

NAC can use rule based methods like -time based factors -location based -role based -rule based (implement complex admission policies with logicial statements)

Answer 3

Web filtering or content filtering is used to control or restrict the content users can access on the internet ■ Crucial for businesses, educational institutions, and parents to ensure safe and productive internet use

Answer 4

agent based centralized proxy URL scanning content categorization block rules reputation based filtering

Answer 5

involves installing an agent on each device monitors and enforces web usage policies effective for remote and mobile workers

Answer 6

uses a proxy server as an intermediary between an organization’s end users and the Internet ● Evaluates and controls web requests based on policies ● If the request does not conform with the policies, the request is simply blocked or denied

Answer 7

Analyzes website URLs to check for matches in a database of known malicious websites

Answer 8

Classifies websites into categories (e.g., social media, adult content) and blocks or allows categories based on policies

Answer 9

Specific guidelines set by organizations to prevent access to certain websites or categories, often used to address security threats

Answer 10

Blocks or allows websites based on a reputation score determined by third-party services, considering factors like hosting malware or phish

Answer 11

DNS filtering (Domain Name System filtering) blocks access to specific websites by preventing the translation of domain names to their IP addresses -Users' devices request domain name translation from DNS servers; if the domain is on the block list, the server withholds the IP address to prevent access ■ Commonly used to enforce internet usage policies, block inappropriate content, and protect against malicious websites ■ Often employed by schools, universities, and organizations to ensure safe and educational internet usage

Answer 12

domainkeys identified mail -Allows the receiver to verify the source and integrity of an email by adding a digital signature to the email headers ● The recipient server validates the DKIM signature using the sender's public cryptographic key in the domain's DNS records ● Benefits ○ Email authentication ○ Protection against email spoofing ○ Improved email deliverability ○ Enhanced reputation score

Answer 13

sender policy framework Prevents sender address forgery by verifying the sender's IP against authorized IPs listed in the sender's domain DNS records ● A receiving server checks if the sender's IP is authorized in the SPF recor

Answer 14

domain based message authentication reporting and conformance DMARC detects and prevents email spoofing by setting policies for email sending and handling failures ● DMARC can work with DKIM, SPF, or both ● Implementation helps protect against ○ Business email compromise attacks ○ Phishing ○ Scams ○ Cyber threats

Answer 15

Email gateways serve as entry and exit points for emails, facilitating secure and efficient email transmission ● They use SMTP (Simple Mail Transfer Protocol) to send and receive emails ● Email gateways handle email routing, email security, policy enforcement, and email encryption

Answer 16

on premiscloud based hybrid

Answer 17

Spam filtering detects and prevents unwanted and unsolicited emails from reaching users' inboxes ■ Techniques ● Content analysis ● Bayesian filtering ● DNS-based sinkhole list ● Email filtering rules

Answer 18

end point detection and response Category of security tools that monitor endpoint and network events and record the information in a central databas

Answer 19

Data Collection ● Collects data from endpoints (devices that are physically on the endpoint of a network) ○ System processes ○ Registry changes ○ Memory usage ○ Network traffic patterns ■ Data Consolidation ● Sends collected data to a centralized security solution or database ■ Threat Detection ● Analyzes data using techniques like signature-based and behavioral-based detection to identify threats ■ Alerts and Threat Response ● Takes actions such as creating alerts or performing threat response actions when threats are detected ■ Threat Investigation ● Provides tools for security teams to investigate threats, including detailed timelines and forensic data ■ Remediation ● Removing malicious files ● Reversing changes ● Restoring systems to their normal state

Answer 20

file integrity monitoring Validates the integrity of operating system and application software files by comparing their current state with a known, good baseline ■ Identifies changes to ● Binary files ● System and Application Files ● Configuration and Parameter Files ■ Monitors critical system files for changes using agents and hash digests, triggering alerts when unauthorized changes occur

Answer 21

extended detection and response ecurity strategy that integrates multiple protection technologies into a single platform ■ Improves detection accuracy and simplified incident response ■ Correlates data across multiple security layers to detect threats faster, including ● email ● endpoint ● server ● cloud workloads ● network ○ Difference between EDR and XDR ■ EDR is focused on the endpoints to detect and respond to potential threats ■ XDR is more comprehensive solution because it focuses on endpoints, but also on networks, cloud, and email to detect and respond to potential threats ● It integrates multiple protection technologies

Answer 22

user behavior analytics advanced security strategy that uses big data and machine learning to analyze behaviors for detecting security threats

Answer 23

User and Entity Behavior Analytics (UEBA) ■ Technology similar to UBA but extends the monitoring of entities like routers, servers, and endpoints in addition to user accounts

Answer 24

Choose secure protocols to protect data in transit from unauthorized access ● Examples include HTTP vs. HTTPS, FTP vs. SFTP, Telnet vs. SSH

Answer 25

app layer protocol that allows one computer to log onto another computer that is part of the same network transmits in plaintext use ssh instead of

Answer 26

TCP (Transmission Control Protocol) ● Connection-oriented, ensuring data delivery without errors ● Ideal for applications where data accuracy is crucial, like web and email servers ● Uses acknowledgments, retransmission, and sequencing for data integrity

Answer 27

Connectionless and faster, but doesn't guarantee data delivery ● Suitable for applications prioritizing speed over accuracy, like streaming video or gaming