Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 4 - Communication and Network Security > Flashcards

Domain 4 - Communication and Network Security Flashcards

1
Q

Virtual extensible LAN (VXLAN)

A

network virtualization enabling high scale segmentation, can make MILLIONS versus just 4096 VLANS, tunneling protocol that encapsulates an ethernet frame (layer 2) in a UDP packet, layer 2 can typically only be attacked from within ie MAC spoofing or flooding, RFC 7348 is the vxlan rfc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Software defined networks (SDN)

A

enables network to be centrally controlled using software, can reprogram the data plane at any time, SD-LAN and SD-WAN, typically uses ABAC!! separate control plane from data plane and create sec challenges, vulns include man in the middle attacks and DoS, secure with TLS!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

SDWAN

A

enables users in branch offices to remotely connect to an enterprises network, enables use of many network services MPLS, LTE, broadband, etc. Sec is based largely on VPN tunnels, Ipsec, next gen firewalls (NGFWs), and micro-segmentation of application traffic, uses secure access service edge (SASE) to decentralize connectivity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Li-Fi

A

uses LED to transmit data, can function in areas susceptible to electromagnetic interference, can theoretically transmit up to 100gbit/s, only requires working LEDs but walls are a barrier, still in development

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Zigbee

A

short range wireless personal area network (PAN), supports automation/ machine to machine comms/ remote control/ monitoring of IOT devices, supports centralized/ distributed models and mesh topology, assumes that symmetric keys used are transmitted securely (encrypted in transit), IOT smart home hubs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

5G

A

faster speed lower latency, doesn’t identify users through SIM cards = can assign identity through device, standalone (SA) version of 5G will be more secure than non-standalone (NSA) version, anchors control signaling of 5G networks to the 4G core, Diameter protocol provides authentication/ authorization/ accounting (AAA), DDoS is a concern due to scale of IoT endpoints

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Content delivery networks (CDN)

A

geographically distributed network of proxy servers and their data centers, goal is fast and highly available content delivery by distributing content spatially relative (close to) users, CDN networks serving Javascript have been targeted to inject malicious content into pages, vendors in CDN space offer DDoS protection and web application firewalls (WAFs), video/ audio streaming

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

The OSI MODEL

A

All People Seem To Need Data Processing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Physical (layer 1 OSI)

A

contains device drivers that tell the protocol how to use the hardware for tramission/ reception of bits. 802.11 - Wifi, ethernet, bluetooth, EIATIA-232, EIA/TIA-449, X21, HSSI, SONET

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Data Link (layer 2 OSI)

A
  • Frames!! are the transmission type, formatting packet from Network layer in proper format for transmission, ARP, PPP, L2F, L2TP, PPTP, FDDI, ISDN, SLIP
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Network (layer 3 OSI)

A
  • PACKETS!! routing and addressing information (source and destination) ICMP, IP, IPSec, NAT, SKIP, IPX, RIP, OSPF, IGMP
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Transport (layer 4 OSI)

A
  • manages integrity of a connection and controlling the session (segment or diagram), TLS, TCP, UDP, SPX, SSL
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Session (layer 5 OSI)

A
  • establishing/ maintining/ terminating communication sessions between computers, SMB, RPC, NFS, SQL
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Presentation (layer 6 OSI)

A
  • transforms data received from application layer into a format that any system following the model can understand, encryption protocols and format types such as ASCII, EBCDICM, TIFF, JPEG, MPEG, MIDI
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Application (layer 7 OSI)

A
  • interfacing user applications, network services, or the OS with the protocol stack, HTTP, SSH, FTP, SMTP, POP3, IMAP, SNMP, SET, telnet
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

TCP/IP stack vs OSI

A

Application = Application/presentation/session

Transport = Transport

Internet = Network

Link = Datalink / Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Common ports

A

FTP = TCP 20/21
SSH = TCP 22
Telnet = TCP 23
SMTP = TCP 25
DNS = TCP/UDP 53
DHCP = UDP 67/68
TFTP = UDP 69
HTTP = TCP 80
Kerberos = TCP/UDP 88
POP3 = TCP 110
NTP = UDP 123
NetBIOS = TCP/UDP 137/138/139
iMAP = TCP 143
SNMP = TCP/UDP 161/162
BGP = TCP 179
Syslog = UDP 514
LDAP = TCP 636
FTP over TLS = TCP 989/990

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

TCP

A

connection oriented, byte stream= every byte matters, does NOT support multicasting/ broadcasting, supports full duplex transmission, reliable service of data transmission, packet is called a segment , provides error detection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

UDP

A

connection-less protocol, message stream, supports multi-casting and broadcasting, NO support for full duplex (simultaneouse bidirectional), unreliable service of data transmission, packet is called a datagram, no support for error detection, media streaming!!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Cabling types

A

CAT 5 = 100mb
CAT 5e = 1gb
CAT 6 = 10gb 55meters
CAT6e = 10gb 55meters
CAT7 = 10gb 100 meters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Star (network topology)

A
  • central connection device (can be hub or switch), each system is connected to central hub by a dedicated segment, MODERN ETHERNET
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Mesh (network topology)

A

connects systems to all other systems using numerous paths, partial mesh connects many systems to many other systems, redundant connections allow for multiple segment failures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Ring (network topology)

A

connects each system as points on a circle, connection medium acts as a unidirectional transmission loop, only one system can transmit data at a time, traffic management is performed by a token, token ring is a ring based network, “collision avoidance”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Bus (network topology)

A

connects each system to a trunk, all systems on a bus can transmit simultaneously which can result in collisions (when 2 systems transmit data at the same time and signals interfere)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Analog

A

continuous signal that varies in frequency/ amplitude/ phase etc. variances in continuos signal produce a wave shape as opposed to square shape of digital, comms become altered and corrupted because of attenuation over long distances

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Digital

A

comms occur through electrical signal and state change (0s and 1s), more reliable over distance or when interference is present, uses current voltage that creates binary data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Synchronous

A

comms rely on timing or clocking mechanism, high rates of data transfer, i.e. networking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Asynchronous

A

comms rely on a stop and start delimiter bit to manage transmission of data, small amounts of data, i.e. public switched telephone network (PSTN)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Baseband

A

single comm channel, form of digital signal, direct current applied to cable. i.e. ETHERNET

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Broadband

A

supports multiple simultaneous signals, suitable for high throughput and multiplexing several channels, form of ANALOG signal. Ie TV, cable modem, ISDN, DSL, T1, T3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Broadcast,Multicast,Unicast

A

determine how many destinations a single transmission can reach. Broadcast=all possible, Multicast=multiple specific recipients ie windows OS deployment, Unicast=single communication to specific recipient

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Carrier sense multiple access (CSMA)

A
  • decreases chances of collisions when 2 or more stations start sending signals over datalink layer.

-Each state must check the state of the medium.

-CSMA/CA=collision avoidance=grants single comm at any given time ie ring networks with token/ wireless/ used in 802.11 standard,

-CSMA/CD=collision detection=responds to collisions by having each member of the collision domain wait for a short but random period of time before restarting process the resends data frame ie wired networks/ 802.3 standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Token passing

A

performs comms using digital token, releases token once transmission is complete, prevents collisions in ring networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Polling

A

performs comms using master-slave config, primary system polls the secondary system in turn when they have to transmit data, used by synchronous datalink control (SDLC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Network segmentation

A

boosts performance, dedicated environment to reduce comm problems, security via isolating traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Intranet

A

private network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Extranet

A

sectioned off portion of network to act as intranet for private network, but also serves information to public internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

DMZ

A

extranet for public consumption aka perimeter network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Bluetooth (IEEE 802.15)

A
  • connects wireless devices, connections are paired with 2.4ghz radio, often a 4 digit code to pair
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Bluejacking

A

pushing unsolicted messages to nearby bluetooth users, more of an annoyance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Bluesnarfing

A
  • data theft, wirelessly connecting to some early BT enabled mobile devices without owners knowledge to download data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Bluebugging

A

grants hackers remote control over the feature and functions of a BT device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Wi-Fi versions (latest 802.11)

A

802.11n = 200+ mb/s > 2.4ghz
802.11ac = 1gb/s > 5ghz

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

SSID broadcast

A
  • wireless networks announces SSID on regular basis with a beacon frame, any device can try to connect, hiding SSID is considered “security through obscurity”
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Temporal key integrity protocol/ WPA (TKIP)

A
  • commonly known as WPA, was designed as replacement for WEP without need to replace legacy hardware
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

CCMP

A
  • used with WPA2, counter mode with cipher block chaining message authentication code protocol, created to replace WEP and TKIP/WPA, uses AES with 128bit
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

WPA2

A
  • encryption scheme with CCMP, AES encryption, modern day wireless uses this
48
Q

Fibre channel

A
  • form of network data storage solution ie SAN (storage area network) or NAS (network attached storage) that allows for high speed file transfers
49
Q

FCoE (fiber channel over ethernet)

A
  • encapsulate fiber channel communications over ethernet networks
50
Q

iSCSI (internet small computer system interface)

A
  • networking storage standard based on IP, high speed but not as fast as fiber
51
Q

Site survey

A
  • process of investigating the presence, strength and reach of wireless access points deployed in environment, usually walking around with portable network device and marking on a map/ floor plan
52
Q

Extensible authentication protocol (EAP)

A
  • authentication framework, brings new auth technologies to existing hardware
53
Q

Protected extensible authentication protocol (PEAP)

A
  • encapsulates EAP methods within a TLS tunnel
54
Q

Lightweight extensible authentication protocol (LEAP)

A
  • cisco proprietary, developed to replace WPA BEFORE WPA2
55
Q

MAC filtering

A
  • uses list of authorized wireless client interface MAC addresses, used by a WAP to block access to all non-authorized devices
56
Q

Captive portals

A
  • portal is an auth technique that redirects a newly connected wireless web client to a portal access control page
57
Q

Antenna types

A

omnidirectional (loop, monopole, dipole) vs unidrectional (panel, parabolic, yagi, cantenna)

58
Q

Firewall

A
  • manage/ control/ filter network traffic at the perimeter
59
Q

Static packet filtering (firewalls)

A
  • filters traffic by examing data from MESSAGE HEADER, layer 3 and up
60
Q

Application level (firewalls)

A
  • filters based on single internet service, protocol, or application, operates at layer 7
61
Q

Circuit level (firewalls)

A
  • establish comm sessions between trusted partners, session layer 5 of the OSI model, SOCKS is an example
62
Q

Stateful inspection (firewall)

A
  • evaluate state, session, or context of network traffic, watch traffic streams from end to end, can implement various IP security functions such as tunnels and encryption, identify forged/ unauthorized communications
63
Q

Deep packet inspection (firewall)

A
  • filtering mechanism that operates at the application layer in order to filter the payload contents of a communication rather than only header values, looks at both header and payload, detects protocol compliance/ spam/ viruses/ intrusions
64
Q

Stateless (firewalls)

A
  • restrict or block traffic based on source/ destination or other static values, not aware of patterns or session information, FASTER and perform better under load than stateful because they are doing less
65
Q

Web application firewalls (WAF)

A
  • protect web apps by filtering and monitoring HTTP/S traffic between web app and internet, protects against XSS, CSRF, and SQL injection, come preconfigured with OWASP rulesets often
66
Q

Next gen firewall (NGFW)

A
  • deep packet inspection, adds application level inspection, intrusion prevention, and brings threat intelligence from outside the firewall
67
Q

Unified Threat Management (UTM)

A
  • multifunction device (MFD) composed several sec features including firewall, may include IDS/IPS/ TLS proxy/ web filtering/ QoS management/ bandwidth throttling/ NAT/ VPN anchoring/ antivirus, doesn’t scale well so more common in small to medium businesses
68
Q

Network address translation gateway (NAT)

A

allows private subnets to communicate with other cloud services and the internet but hides the internal network from internet users, has the network access control list (NACL) for the private subnets ,used for browsing internet to hide users behind NAT gateway

69
Q

Content/ URL filter

A

looks at content on requested web and blocks based on filters, associated with deep packet inspection

70
Q

Open source firewall

A

-license freely available, access to source code, no vendor support, pfsense

71
Q

Proprietary firewalls

A
  • expensive but more functionality and support than open source, cisco/ checkpoint/ palo alto/ barracuda, no source code access
72
Q

Hardware (firewall)

A
  • purpose built network hardware, often has superior throughput because it is DESIGNED to
73
Q

Software (firewall)

A
  • install on your own hardware and place it anywhere, “host based” can be more vulnerable
74
Q

Application (firewall)

A
  • catered to app level comms, HTTP or web traffic, example is a next gen firewall (NGFW)
75
Q

Host based (firewall)

A

installed on a host OS ie windows/ linux

76
Q

Virtual (firewall)

A
  • cloud firewalls implemented as a virtual network appliance (VNA), available from CSP directly and 3rd party partners (commercial vendors)
77
Q

Switch

A
  • repeats traffic out of port where the destination is, create separate collision domains and improve throughput of data, usually layer 2, sometimes layer 3 if it’s a hybrid “routing” switch
78
Q

Routers

A
  • control traffic flow on networks, connect networks and control flow between the 2, can function with static routing tables or dynamic routing system, layer 3 with IP
79
Q

Gateways

A

-connects networks that are using different protocols aka protocol translators, ie IPv4 to IPv6, can be standalone hardware devices or a software service, work at layer 3

80
Q

Repeaters/ concentrators/ amplifiers

A
  • layer 1, strengthen signal over a cable segment and connect segments that use the same protocol
81
Q

Bridges

A
  • connect 2 networks using the same protocol, layer 2
82
Q

Hubs

A
  • connect multiple systems/ segments that use the same protocol, multiport repeater, layer 1, not really used in businesses anymore
83
Q

LAN extenders

A
  • remote access, multilayer switch used to connect distant networks over WAN links
84
Q

Sensors/ Collectors

A
  • place on network to alert NIDS of changes in traffic patterns, if you place on internet side of network it can scan ALL TRAFFIC but will need to be very beefy hardware
85
Q

WAN

A
  • wide area network, can provide private circuit and packet switching
86
Q

Private circuit (WAN technology)

A
  • use dedicated physical circuits, expensive, ie dedicated lines/ point to point (PPP) protocol/ SLIP (serial line internet protocol)/ ISDN (integrated services digital network)/ DSL (digital subscriber line)
87
Q

Packet-Switching (WAN technology)

A
  • uses virtual circuits instead of physical, efficient and cost effective, ie X.25 frame relay/ asynchronous transfer mode (ATM)/ synchronous data link control (SDLC)/ high-level data link control (HDLC)
88
Q

Intrusion Detection Systems (IDS)

A
  • analyzes whole packets (header and payload), looking for known events. When a known event is detected a log message is generated, both host (HIDS) and network (NIDS) can be a combination of behavior and knowledge based
89
Q

Intrusion Prevention System (IPS)

A
  • analyzes whole packets, both header and payload, looking for known events, when a known event is detected the packet is rejected
90
Q

Behavior based (IDS/ IPS)

A
  • creates a baseline of activity to identify normal behavior and then measures system performance against baseline to detect abnormal, can detect previously unknown attack methods
91
Q

Knowledge based (IDS/ IPS)

A
  • uses signatures similar to the signature definition used by anti-virus, only effective against known attacks
92
Q

Host based (IDS/ IPS)

A
  • software form installed on a host, often a server
93
Q

Network based (NIDS/ NIPS)

A
  • network level, often in hardware form as a purpose built appliance
94
Q

Inline mode (NIDS/ NIPS)

A
  • in band, traffic runs through it, placed on or near firewall as additional layer of security
95
Q

Passive mode (NIDS/ NIPS)

A
  • traffic does not run through it, “out of band”, uses sensors/ collectors to forward logs
96
Q

Bastion host

A
  • hardened!! Computer or appliance that is exposed on the internet, all unnecessary elements removed such as services/ programs/ protocols/ ports
97
Q

Screened host

A
  • MOST SECURE, firewall protected system logically positioned inside a private network
98
Q

Screened subnet

A
  • similar to screened host in concept except a subnet is placed between routers/ firewalls and the bastion host is located within the subnet
99
Q

Proxy server

A

functions on behalf of a client requesting service, masking the true origin of the request to the resource

100
Q

Honeypot

A
  • lure bad people into doing bad things so we can watch them, only ENTICE not ENTRAP, not allowed to let them download items, ie allowing download of a fake payroll file would be entrapment, goal is to distract from real assets and isolate in a padded cell until they can be tracked down
101
Q

Teardrop attack

A

denial of service attack that involves sending FRAGMENTED PACKETS to a target machine, machine cannot reassemble them due to a bug in TCP/IP fragmention reassembly, the packets overlap and crash the machine

102
Q

Fraggle attack

A
  • DoS attack that sends large amount of SPOOFED UDP TRAFFIC to a routers broadcast address within a network, similar to SMURF attack which uses spoofed ICMP traffic
103
Q

Land attack

A
  • layer 4 DoS, attacker sets SOURCE AND DESTINATION of a TCP packet to be the same value, a vulnerable machine will crash due to the packet being repeatedly processed by the TCP stack
104
Q

SYN Flood

A
  • DoS attack, attacker sends a succession of SYN REQUESTS to target system to make it unresponsive to legit traffic
105
Q

Ping of death

A

-DoS attack, oversized ping packet, bigger than 65,536 bytes which is the usual max

106
Q

TCP 3 way handshake

A
  • SYN > SYN-ACK > ACK.
107
Q

Internal segmentation firewall (ISFW)

A

used to segment a network

108
Q

ad hoc wireless mode

A

directly connect 2 wireless clients ie tablet and laptop

109
Q

standalone wireless mode

A

connects 2 clients together using a wap, but not to wired resources like a central network, ie laptop and tablet communicating through wap

110
Q

infrastructure mode (wireless)

A

connects endpoints to a central network, not directly to each other

111
Q

wired extension mode

A

uses a WAP to link wireless clients to a central network

112
Q

Authentication Header (AH)

A

part of IPsec, provides authentication, integrity and nonrepudiation

113
Q

Encapsulating security payload (ESP)

A

part of IPsec, provides encryption and thus confidentiality, prevents replay attacks

114
Q

L2TP

A

independent VPN protocol

115
Q

IP Payload Compression (IPcomp)

A

used by IPsec to compress data prior to ESP it in order to attempt to keep up with wire speed transmission

116
Q

Internet Key Exchange (IKE)

A

IPsec mechanism that manages crypto keys and is composed of 3 elements: OAKLEY, SKEME, and ISAKMP

CISSP (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions