Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Security Plus > Ch4: Securing Your Network > Flashcards

Ch4: Securing Your Network Flashcards

1
Q

HIDS

A

Host-based intrusion detection system can monitor all traffic on a single host system to detect malicious activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

NIDS

A

Network-based intrusion detection system is installed on network devices such as routers or firewalls to monitor network traffic and detect network-based attacks. Cannot monitor encrypted traffic or traffic on individual hosts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

TCP handshake sequence

A

SYN, SYN/ACK, ACK

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

SYN flood attack

A

Attacker sends multiple SYN packets but never completes the handshake with an ACK

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Signature-based detection (IDSs)

A

Identifies issues based on known attacks or vulnerabilities and can detect known anomalies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Heuristic/Behavioral-based detection (IDSs)

A

Can detect unknown anomalies by starting with a performance baseline of normal behavior and comparing network traffic against it to detect abnormal behavior

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

False positive

A

Indicates an attack is occurring when no attack is active (increases admins workload)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

False negative

A

System does not detect or report an attack that is actually occurring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

An IPS can…

A

detect, react, and prevent attacks. It can actively monitor data streams, detect malicious content, and stop attacks in progress.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

An IDS can…

A

monitor and respond to an attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

IPS and IDS collect data differently because…

A

IPS is inline with the traffic - all traffic passes through the IPS (in-band). IDS collects data passively, not inline with the traffic (out-of-band)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

IPS is what type of control?

A

Preventive control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Honeypot

A

A “sweet”-looking server that has been left open or unsecured in order to divert attackers from the live network or allow observation of the attacker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Honeynet

A

A group of honeypots within a separate network or zone, but accessible from an organization’s primary network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

IEEE 802.1x

A

Port-based authentication protocol that ensures only authorized clients can connect to a network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Fat AP

A

A stand-alone access point that is managed independently

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Thin AP

A

A controller-based AP managed by a wireless controller. The controller configures the AP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

SSID

A

Service set identifier identifies the name of the wireless network (you should change the name so it’s not ‘Netgear’)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

SSID Broadcasting

A

You can disable the SSID broadcast to hide the network from casual users, but it will not be hidden from an attacker with a wireless sniffer (and is not more secure)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

MAC filtering

A

Can restrict access to a wireless network to specific clients

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

To bypass MAC filtering…

A

use a wireless sniffer to discover the allowed MAC addresses, then configure your NIC to have one of the allowed MACs (spoof it)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Easy way to limit the range of an AP

A

Reduce the AP’s power level so people outside the intended area will be out of range

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

WPA

A

Wi-Fi Protected Access provided an immediate replacement for WEP and originally used TKIP. Later implementations support the stronger AES encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

TKIP

A

Temporary Key Integrity Protocol is an older encryption protocol used with WPA (deprecated by IEEE due to security issues)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
WPA2
Permanent replacement for WEP and WPA. Supports CCMP (based on AES) which is much stronger than TKIP
26
CCMP
Cipher Block Chaining Message Authentication Code Protocol
27
PSK
Pre-shared key. Does not provide individual authentication
28
Why does PSK not provide authentication?
Authentication is proving a user's identity by using credentials. PSK is a pre-shared key or password. Simply providing a password with no username provides authorization but no authentication since no user's identity was proven
29
What modes can WPA and WPA2 operate in?
PSK or Enterprise mode (or Open mode)
30
Open mode
No security, allows all users to use the AP
31
Enterprise mode
Provides strong authentication. Uses an 802.1x server
32
EAP
Extensible Authentication Protocol is an authentication framework that provides general guidance for authentication methods
33
EAP-FAST
EAP-Flexible Authentication via Secure Tunneling supports certificates, but they are optional
34
PEAP
Protected EAP encapsulates and encrypts the EAP conversation in a TLS tunnel. PEAP requires a certificate on the server, but not the clients
35
EAP-TTLS
EAP-Tunneled TLS is an extension of PEAP allowing systems to use some older authentication methods (like PAP) within a TLS tunnel. Requires a certificate on the 802.1x server but not the clients
36
EAP-TLS
One of the most secure EAP standards. Requires certificates on the 802.1x server and on each of the wireless clients
37
Disassociation attack
Removes a wireless client from a wireless network, forcing it to reauthenticate
38
WPS
Wi-Fi Protected Setup allows users to configure wireless devices by pressing buttons OR entering an 8-digit PIN
39
WPS attack
Brute forces the 8-digit PIN within hours, then uses it to discover the passphrase
40
Rogue AP
Provides access to unauthorized users and are often used to capture and exfiltrate data
41
Evil twin
Rouge AP using the same SSID as a legitimate AP
42
Bluejacking
Unauthorized sending of text messages to a nearby Bluetooth device
43
Bluesnarfing
Unauthorized access to, or theft of information from, a Bluetooth device
44
Prevent bluejacking and bluesnarfing by
Ensuring devices cannot be paired without manual user intervention
45
Replay attack
Attacker captures data sent between two entities, modifies it, and attempts to impersonate on of the parties by resending the data
46
Prevent network replay attacks by using
WPA2 with CCMP/AES. TKIP is vulnerable to replay attacks
47
RFID attacks
Eavesdropping, replay, and DoS
48
VPN
Virtual private network provides remote access to a private network via a public network.
49
VPN concentrators
Dedicated devices used for VPNs that include all services needed to create a secure VPN supporting many clients
50
IPsec
Internet protocol security is a secure encryption protocol used with VPNs
51
ESP
Encapsulating Security Payload provides confidentiality, integrity, and authentication for VPN traffic
52
IPsec Tunnel Mode
Used for VPN traffic, has protocol ID 50 for ESP
53
IPsec authenticates clients using
IKE (Internet Key Exchange) over port 500
54
Full tunnel
Encrypts all traffic after a user has connected to a VPN
55
Split tunnel
Only encrypts traffic destined for the VPN's private network
56
NAC
Network access control includes methods to inspect clients for health, like having up-to-date AV software. NAC can restrict access of unhealthy clients to a remediation network. NAC can be used for VPN or internal clients
57
NAC agents
Permanent agents are installed on the clients. Dissolvable agents are not installed and are often used to inspect employee-owned mobile devices
58
PAP
Password Authentication Protocol uses a password or PIN, but send the information over a network in plaintext, making it susceptible to sniffing attacks.
59
CHAP
Challenge Handshake Authentication Protocol is more secure than PAP because passwords are not sent over the network in cleartext
60
Centralized authentication services
RADIUS, TACACS+, Diameter
61
TACACS+
Proprietary to Cisco but can be used with Kerberos
62
Diameter
Improvement over RADIUS and supports many additional capabilities like securing transmissions with EAP

Security Plus (12 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions