Chapter 3 Flashcards
(116 cards)
1
Q
TCP IP has how many layers?
A
4
2
Q
What are the layers of TCP/IP?
A
Application
Host to Host or Transport Layer
Internet Layer
Network Access Layer
3
Q
Host to host is also known as
A
Transport
4
Q
Network Access Layer is also known as
A
Link layer or Network Interface layer
5
Q
TCP/IP host
A
Any device on network running the TCP IP protocol
6
Q
Encapsulation
A
Method by which TCP/IP layers communicate
7
Q
Application layer provides which protocols?
A
HTTP, HTTPS, FTP, SMTP
8
Q
Host to host
A
consists of TCP and UDP. UDP is unreliable connectionless protocol, but faster. Responsible for acknowledging receipt of packets.
9
Q
Internet Layer is responsible for
A
routing, IP addressing and packaging
10
Q
IP
A
Internet protocol, part of Internet Layer.
11
Q
Which layer checks accuracy?
A
TCP
12
Q
Which layer checks if the destination is known?
A
IP
13
Q
If a destination is unknown, where is it sent?
A
to the router, by IP
14
Q
ICMP
A
Internet Control Message Protocol - Ping
15
Q
ICMP is part of which layer?
A
Internet
16
Q
Address Resolution Protocol is in which layer?
A
Internet
17
Q
ARP does what?
A
Resolves IPs to MAC addresses
18
Q
Network Access Layer
A
Communicates through network adapters to place packets on the physical network
19
Q
FTP port
A
21
20
Q
port 21
A
FTP
21
Q
Port 22
A
SSH and SCP
22
Q
Port 25
A
SMTP
23
Q
SMTP port
A
25
24
Q
port 110
A
POP3
25
POP3 port
110
26
DNS names port
Port 53
27
Port 53
Dns Names
28
Port 139
NetBios session
29
NetBIOS session port
139
30
IMAP port
143
31
Port 143
Imap
32
TCP Handshake Initiated by
client
33
Client sends sends first message containing
ISN - initial sequence number, and window size
34
window size
buffer
35
Server responds to initial TCP message
ISN and window size
36
Third part of TCP handshake
Client acknowledges ISN
37
UDP
Connectionless, used for video and voice
38
Tracert uses
ICMP
39
Subnetting secures the network by
confining traffic, reducing traffic and broadcasts
40
vlan does what
splits of segments of network, allows grouping of hosts by data sensitivity
41
PPTP
Tunneling protocol, vulnerable to sniffers, negotiating connection in clear
42
Layer 2 forwarding is a __ protocol
Tunnelling
43
Layer 2 forwarding was created as a protocol for
dial up
44
L2f should not be used for
WAN
45
L2F provides Authentication but not
encryption
46
Layer 2 tunneling protocol combines
L2f and PPTP
47
Layer 2 tunneling is encrypted?
No, but it can be
48
SSH was originally designed for
Unix
49
IPsec is used by ______ protocols
tunneling
50
IPSec has two modes
tunnel and transport
51
IPSec encrypts ____ in tunnel mode
payload and headers
52
IPSec encrypts ____ in transport mode
only the payload
53
NAC stands for
Network Access Control
54
NAC defines
criteria that a client must fulfill to access the network
55
what is an appliance?
A self contained device requiring little configuration
56
packet filter firewall blocks packets based on ____
ports
57
a packet filter firewall may authorize specific _____ to access certain ports
IP addresses
58
proxy firewalls are used to process requests from an ______ network
outside
59
proxy firewalls use _____ to hide IPs
NAT
60
Application level proxy firewall reads the actual _______
commands
61
stateful packet inspection firewall
uses intelligence to monitor sessions, stateless uses no intelligence and just blocks ports
62
what is a border router?
it connects wans and lans
63
wans and lans use the same/different protocols
different
64
Switches route packets using _____ addresses
MAC
65
For security reasons, all user interaction with the internet should be controlled through
a proxy server
66
IDS Activity
element of a data source that is of interest
67
IDS Alert
contains information about suspicious activity
68
IDS Analyzer
analyzes data collected by the sensor
69
IDS data source
raw information used to detect suspicious activity
70
IDS Event
occurrence indicating suspicious activity has occurred
71
IDS manager
console
72
IDS notification
how the manager tells the operator about an alert
73
IDS operator
person responsible for the IDS
74
IDS Sensor
Grabs raw material from the data sources
75
Behavior based IDS
variations in behavior such as unusually high traffic, policy violations
76
Signature based IDS
Misuse, attack signatures and audit trails
77
Anomaly detection IDS
spots deviation from a baseline
78
Heuristic IDS
uses algorithms to analyze traffic passing through the network
79
IPS
Intrusion Prevention System
80
IPS usually responds by
blocking offending IP address
81
Problem with IPS is _____
false positives
82
Best solution for a secure network is
place an IDS in front of AND behind a firewall
83
Network based IDS
attaches to a point in the network where it can report on all traffic
84
Logging
A passive response allowing administrators to evaluate the threat
85
Notification
A passive response relaying information to the IDS operator
86
Shunning
A passive response that ignores the threat
87
Terminating processes or sessions
an active response to a threat
88
IDS can connect to what devices
hub switch or tap
89
Network Configuration changes
active response of an IDS, closing ports or instructing a border router or firewall to close traffic
90
deception
active response of ids, send to honeypot
91
active responses are the least/most implemented
least
92
HIDS
Host-based IDS
93
HIDS are typically active/passive
passive
94
HIDS monitor network traffic t/f
False
95
faillog
log in unix that shows failed login attempts
96
lastlog
log in unix that shows last successful logins
97
messages log
in unix, searched with grep to find login related entries
98
wtmp
log in unix that shows authenticated users
99
packet sniffing is also known as
protocol analyzing
100
one of the best traffic analyzers is
snort
101
UTM
Unified Threat Management (appliance)
102
Smartscreen filter
phishing url blocker from IE
103
Web application firewall
appliance that blocks traffic to and from webservers
104
WAFs operate at the _____ level of the OSI model
highest
105
WAFs are similar to
IPS
106
WAFs are superior/inferior to IPSs
Superior
107
FTP uses TCP/UDP
Only TCP
108
SSH and SCP use TCP/UDP
both
109
SMTP uses TCP/UDP
Only TCP
110
HTTP uses TCP/UDP
both
111
POP3 uses TCP/UDP
only TCP
112
Netbios uses TCP/UDP
both
113
IMAP uses TCP/UDP
both
114
HTTPS uses TCP/UDP
TCP only
115
DNS name queries use TCP/UDP
UDP only
116
Dial up uses
PPP
