IS3220 CHAPTER 7 Flashcards
Mechanism defining traffic or an event to apply an authorization control of allow or deny against is called ___?
Often used interchangeably with the terms rule and filter in relation to firewalls.
ACCESS CONTROL LIST (ACL)
A notification from a firewall that a specific event or packet was detected is called ___?
These notify administrators of events that may need real-time human response or attention.
ALERT
A security stance that allows all communications except those prohibited by specific deny exceptions is called ___? AKA default allow.
ALLOW BY DEFAULT
A form of Intrusion Detection System/Intrusion Prevention System (IDS/IPS) detection based on a defined normal, often defined using rules similar to firewall rules is called ___?
All traffic or events that fail to match defined normal are considered anomalies and potentially malicious.
ANOMALY-BASED DETECTION
A form of IDS/IPS detection based on a recording of real-world traffic as a baseline for normal is called ___?
All traffic or events that fail to match the normal baselines are considered abnormal and potentially malicious.
BEHAVIORAL-BASED DETECTION
____ by a proxy server is the retention of Internet content. Various internal clients may access this content and provide it to subsequent requesters without the need to retrieve the same content from the Internet repeatedly.
CACHING
This mechanism is used to create a redundant copy of all log files in a single warehousing location is called ___?
A technique of storing or copying log events. One common example of this is syslog.
CENTRALIZED LOGGING SYSTEM
A form of IDS/IPS detection based on a collection of samples, patterns, signatures, and so on stored in a database of known malicious traffic and events is called ___?
All traffic or events that match an item in the database is considered abnormal and potentially malicious. AKA signature, knowledge, and pattern-matching based detection.
DATABASE-BASED DETECTION
A security stance that allows all communications except those prohibited by specific deny exceptions and is called ___?
DEFAULT ALLOW
A security stance that prevents all communications except those enabled by specific allow exceptions is called ___?
DENY BY DEFAULT
A technique of load balancing that operates by sending the next transaction to the firewall with the least current workload is called ___?
FAIR QUEUING
An event that does not trigger an alarm but should have, due to the traffic or event actually being abnormal and/or malicious is called ___?
This is the unwanted non-detection of a malicious event.
FALSE NEGATIVE
An event that triggers an alarm but should not have, due to the traffic or event actually being benign is called ___? This is the unwanted false alarm that wastes time and resources pursuing a non-malicious event.
FALSE POSITIVE
A written expression of an item of concern (protocol, port, service, application, user, IP address) and one or more actions to take when the item of concern appears in traffic is called ___?
This expresses the intention to block or deny unwanted items of concern. AKA a rule or ACL.
FILTERS
A hacking technique used against static packet filtering firewalls to discover the rules or filters controlling inbound traffic is called ___?
FIREWALKING
A networking mechanism to hand off or pass off the task of authentication to a third-party dedicated authentication system is called ___?
AKA port authentication, portal authentication, or port-based network access (admission) control (PNAC).
IEEE 802.1x
A form of IDS/IPS detection based on a collection of samples, patterns, signatures, and so on stored in a database of known malicious traffic and events is called ___?
All traffic or events that match an item in the database is considered abnormal and potentially malicious. AKA signature, database, and pattern-matching-based detection.
KNOWLEDGE BASED DETECTION
A network traffic management technique to spread the workload or traffic levels across multiple devices to maintain availability is called ___?
LOAD BALANCING
The command line or graphical interface used to control and configure a device is called ___?
Often accessible through a console (CON) port on the device or through a logical interface across the network.
MANAGEMENT INTERFACE
Used on individual network access devices, such as firewalls, VPN gateways, and wireless routers, to offload authentication to a dedicated authentication server/service is called ___?
Only after valid authentication are communications with or across the network device allowed.
PORT-BASED NETWORK ACCESS (ADMISSION) CONTROL (PNAC)
A form of load balancing which hands out tasks in a repeating non-priority sequence is called ___?
ROUND ROBIN
The list of rules on a firewall (or router or switch) that determine what traffic is and is not allowed to cross the filtering device is called ___?
Most employ a first-match-apply-action process.
RULE SETS
A written expression of an item of concern (protocol, port, service, application, user, IP address) and one or more action(s) to take when the item of concern appears in traffic is called ___? AKA a filter or ACL.
RULE(S)
A form of IDS/IPS detection based on a collection of samples, patterns, signatures, and so on stored in a database of known malicious traffic and events is called ___?
All traffic or events that match an item in the database is considered abnormal and potentially malicious. AKA database, knowledge, and pattern-matching-based detection.
SIGNATURE-BASED DETECTION
