Module 10 Flashcards
(47 cards)
What does AAA stand for in network security?
Authentication, Authorization, Accounting
AAA provides a framework for network access control.
What is Local AAA Authentication?
Stores usernames and passwords locally in a network device
Ideal for small networks.
What is Server-Based AAA Authentication?
Router accesses a central AAA server using RADIUS or TACACS+ protocols
More appropriate for networks with multiple devices.
What is the purpose of AAA Authorization?
Governs what users can and cannot do on the network after authentication
Uses attributes to determine user privileges.
What does AAA Accounting do?
Collects and reports usage data for auditing or billing
Logs data such as connection times and executed commands.
What is the IEEE 802.1X standard?
A port-based access control and authentication protocol
Restricts unauthorized workstations from connecting to a LAN.
What roles do devices play in 802.1X authentication?
Client (Supplicant), Switch (Authenticator), Authentication Server
Each has a specific function in the authentication process.
What types of attacks are categorized under Layer 2 Security Threats?
MAC Table Attacks, VLAN Attacks, DHCP Attacks, ARP Attacks, Address Spoofing Attacks, STP Attacks
These attacks exploit vulnerabilities at Layer 2 of the OSI model.
What is a MAC Address Table Attack?
Involves flooding a switch with fake source MAC addresses until the table is full
This can disrupt normal network operations.
What is a VLAN Hopping Attack?
Enables traffic from one VLAN to be seen by another VLAN without a router
This attack can compromise network segmentation.
What is DHCP Snooping?
A security feature that prevents DHCP starvation and DHCP spoofing attacks
Helps to secure DHCP operations on a network.
What is Dynamic ARP Inspection (DAI)?
Prevents ARP spoofing and ARP poisoning attacks
It verifies ARP packets on the network.
What is IP Source Guard (IPSG)?
Prevents MAC and IP address spoofing attacks
It ensures that only valid IP addresses are used on a network.
True or False: Layer 2 vulnerabilities can affect all layers above it.
True
Compromise at Layer 2 can render security measures at higher layers ineffective.
What is the function of a Next-Generation Firewall (NGFW)?
Provides stateful packet inspection and advanced malware protection
It integrates multiple security functions into one device.
Fill in the blank: The primary use of AAA accounting is to combine it with AAA _______.
authentication
This provides a log of user actions and helps in auditing.
What does the Cisco Email Security Appliance (ESA) do?
Monitors SMTP, blocks known threats, and encrypts outgoing email
It uses real-time threat intelligence to enhance email security.
What does the Cisco Web Security Appliance (WSA) provide?
Mitigation technology for web-based threats and application visibility
It controls web traffic based on organizational policies.
What is Port Security?
Prevents MAC address flooding attacks and DHCP starvation attacks
It limits the number of MAC addresses that can be learned on a port.
What is an example of an attack that can be mitigated by implementing BPDU Guard?
STP Attack
BPDU Guard protects against manipulation of the Spanning Tree Protocol.
What is IP address spoofing?
IP address spoofing is when a threat actor hijacks a valid IP address of another device on the subnet or uses a random IP address.
How can IP and MAC address spoofing be mitigated?
Implementing IP Source Guard (IPSG).
What is a STP attack?
A STP attack involves threat actors manipulating Spanning Tree Protocol (STP) to spoof the root bridge and change the topology of a network.
How can STP attacks be mitigated?
By implementing BPDU Guard on all access ports.
