Authentication

Question 1

Identity and Access Management

Answer 1

security protocol that provides identification, authentication, and authorization mechanisms for users, computers, and other entities to work with organizational assets such as network, OS and applications.

Question 2

Kerberos

Answer 2

Kerberos is a network authentication protocol designed to allow computers to verify the identity of users and services securely over an untrusted network (like the internet or a local network).

Kerberos is a widely used protocol for implementing SSO, especially in Active Directory (AD) environments.

Question 3

Single Sign-On

Answer 3

Single Sign-On (SSO) is an authentication method that lets users log in once and gain access to multiple applications or services without needing to log in again.

Question 4

Three components of Kerberos

Answer 4

1. Client – Requests access to a service
2. Server – Provides the requested service
3. KDC (Key Distribution Center) – Verifies identity and issues tickets

Question 5

KDC Components

Answer 5

1. Authentication Service (AS)
   
   • Verifies initial login requests
   • Issues the Ticket Granting Ticket (TGT)
   • The user (or principal) is now authenticated
2. Ticket Granting Service (TGS)
   
   • Receives the TGT from the client
   • Issues a Service Ticket, which allows the user to access a specific resource (like a file share or email server)

Question 6

Kerberos Authentication flow

Answer 6

1. User logs in → Sends request to KDC (AS)
2. KDC validates → Sends back a TGT
3. User wants service → Sends TGT to TGS
4. TGS validates TGT → Issues Service Ticket
5. User presents Service Ticket → Access granted to the application

Question 7

Public Key Infrastructure (PKI)

Answer 7

Framework of certificate authorities, digital certificates, software, services, and other cryptographic components deployed for the purpose of validating subject identities.

Question 8

Remote Authentication Dial-in User Service (RADIUS)

Answer 8

AAA protocol used to manage remote and wireless authentication infrastructures.

Question 9

Terminal Access Controller Access Control System (TACACS+)

Answer 9

a protocol used for authentication, authorization, and accounting (AAA) in network devices like routers, switches, and firewalls. It is commonly used by organizations to manage who can access their devices and what actions they can perform.

Question 10

Access Control Models

Answer 10

1. Discretionary Access Control (DAC)
   - Ownership-based: Every resource has an owner.
   - The owner has full control over it and can assign permissions via Access Control Lists (ACLs).
   - Example: If you create a file, you can give or deny access to other users.
2. Role-Based Access Control (RBAC)
   - Task/role-based: Permissions are grouped into roles based on job functions.
   - Users (called principals) are assigned to roles, which grant them access indirectly.
   - Only system owners can assign or change roles—users can’t assign themselves permissions.
   - More secure and controlled than DAC (nondiscretionary).
3. Security Groups
   - A hybrid concept used in systems like Windows.
   - Users are assigned to security group accounts, which have permissions.
   - Users gain rights by group membership, not by direct assignment.
   - Not the same as RBAC:

Question 11

Privileged Access Management (PAM)

Answer 11

The practice of securing and controlling the use of these accounts to reduce the risk of abuse or compromise

Question 12

Core principles of PAM

Answer 12

Least privilege: Only give users the access they absolutely need to do their job.
Separation of Duties: Divide critical responsibilities among different people.

Question 13

Authorization Creep

Answer 13

when a user gradually accumulates more privileges over time

Question 14

Separation of Duties

Answer 14

Security policy concept that states that duties and responsibilities should be divided among individuals to prevent ethical conflicts or abuse of powers.

Question 15

Lightweight Directory Access protocol (LDAP)

Answer 15

Network protocol used to access network directory databases, which store information about authorized users and their privileges, as well as other organizational information.

Question 16

Methods to make LDAP secure

Answer 16

1. Simple bind: Sends DN + Password (insecure)
2. Simple Authentication and Security Layer (SASL): Framework that supports secure mechanisms
3. LDAP over TLS/SSL: Uses TLS encryption with server certificate.

Question 17

Defense in Depth

Answer 17

A modern security approach using multiple layered defenses across the network.

Question 18

Network Access Control

Answer 18

Security solution that authenticates and controls which devices can access a network.

Question 19

Sinkhole VLAN

Answer 19

A type of VLAN that traps and isolates unwanted traffic.

Question 20

MAC Filtering

Answer 20

Limits which devices can access the network based on their MAC address.

Question 21

MAC Filtering implementation

Answer 21

1. Static MAC filtering: Manually assign valid MAC addresses.
2. Sticky MACs: Switch learns and remembers the first connected MAC(s).
3. MAC address limit: Restricts how many devices can use the port.

Question 22

Extensible Authentication Protocol (EAP)

Answer 22

A framework that supports different authentication methods like passwords, digital certificates, and smart cards.

Question 23

IEEE802.1X (AKA Port-based NAC)

Answer 23

Works with EAP to enforce pre-authentication. It is applied before Ethernet switch ports, WAPs, VPN gateways.

Question 24

Dynamic ARP Inspection (DAI)

Answer 24

Prevents ARP poisoning and on-path attacks by inspecting the ARP packets and checking against an IP:MAC databse.

Question 25

DHCP Snooping

Answer 25

Detects MAC spoofing and blocks rogue DHCP servers by monitoring DHCP traffic on access ports. Only trusted ports can send DHCP offers.

Question 26

IPv6 Protections:

Answer 26

Neighbor Discovery Inspection: Validates neighbor discovery messages. Router Advertisement Guard: Blocks unauthorized router advertisement messages.

Question 27

VLAN Security

Answer 27

1, Double tagging mitigation: avoid using default VLAN ID for user access. 2. Trunk Protection: Allow specific ports to act as trunks and prevent auto-enabling trunking.

Question 28

Spanning Tree protection

Answer 28

Attackers can try to become the root bridge to intercept and reroute traffic. Bridge Protocol Data Unit Guard can be used to block ports if unexpected BPDUs are received. Root Guard ensures designated ports don't accept new root bridge elections.

Question 29

Port Mirroring

Answer 29

A network switch feature that allows traffic on one or more ports to be copied and sent to another port for analysis. It's essential for network monitoring, troubleshooting, and security auditing.

Question 30

Unicast Traffic

Answer 30

Usually is sent from one device to another.

Question 31

Firewall ACL (Access Control List)

Answer 31

Rules used to control traffic between network segments. These segments are often based on VLANs or subnets and traffic between them must be routed or filtered.