Network+ Flashcards
1
Q
Layer 1 - Physical:
A
Receives the frames and data and sends them via the local media (copper wires, fiber-optic cables, etc.) to the switches, routers, etc., along the network path.
2
Q
Layer 2 - Data link:
A
- Receives the packets and adds physical addressing by adding sender and receiver MAC addresses to each data packet.
- This information forms a unit called a frame.
3
Q
Layer 3 - Network:
A
The routing layer (IP addresses, routers, packets).
4
Q
Layer 4 - Transport:
A
The functions defined in this layer provide for the reliable transmission of data segments, as well as the disassembly and assembly of the data before and after transmission.
5
Q
Layer 5 - Session:
A
- Establishes, manages, and terminates sessions between two communicating hosts.
- Synchronizes dialog between the presentation layers of the two hosts and manages their data exchange.
6
Q
Layer 6 - Presentation:
A
- Ensures that info sent at application layer of one system is readable by the application layer of another system.
- May translate between multiple data formats by using a common format.
7
Q
Layer 7 - Application:
A
- Closest to the user.
- Provides network services to the applications of the user, such as email, file transfer, and terminal emulation.
8
Q
Router:
A
A device that forwards data packets between computer networks.
9
Q
Switch:
A
A computer networking device that connects network segments.
10
Q
Firewall:
A
A part of a computer system or network that is designed to block unauthorized access while permitting outward communication.
11
Q
Intrusion detection system (IDS):
A
Monitors network traffic to identify possible malicious activity and log information about it.
12
Q
Intrusion prevention system (IPS):
A
Sits behind the firewall and uses anomaly detection or signature-based detection to identify and respond to network threats.
13
Q
Load Balancer:
A
Hardware or software that balances the load between two or more servers.
14
Q
Proxy:
A
A system or router that provides a gateway between users and the internet.
15
Q
Network-attached storage (NAS):
A
A server that is placed on a network with the sole purpose of providing storage to users, computers, and devices attached to the network.
16
Q
Storage area network (SAN):
A
A high-speed network with the sole purpose of providing storage to other attached servers.
17
Q
Wireless Access point (AP):
A
A device that enables wireless systems to communicate with each other, provided that they are on the same network.
18
Q
Wireless Controller:
A
A central management console for all of the APs on a network.
19
Q
Content delivery network (CDN):
A
- An information system that serves content to Web pages over the Internet.
- To reduce wait time, data is typically stored and served from many geographic locations.
20
Q
Virtual private network (VPN):
A
A private data network that creates secure connections, or “tunnels,” over regular Internet lines.
21
Q
Quality of service (QoS):
A
Policies that control how much bandwidth a protocol, PC, user, VLAN, or IP address may use.
22
Q
Time to live (TTL):
A
The maximum amount of time a packet is allowed to circulate through a network before it is destroyed.
23
Q
Network functions virtualization (NFV):
A
Provisioning virtual network appliances, such as switches, routers, and firewalls, via VMs and containers.
24
Q
Virtual private cloud (VPC):
A
A private network segment made available to a single cloud consumer within a public cloud.
25
Network security groups:
Allows you to filter network traffic. Can contain multiple inbound and outbound security rules that enable you to filter traffic to and from resources.
26
Network security lists:
Consists of a set of ingress and egress security rules that apply to all the VNICs in any subnet that the list is associated with.
27
Internet gateway:
A device or node that connects networks by translating protocols.
28
Network address translation (NAT) gateway:
You can use this so that instances in a private subnet can connect to services outside your VPC, but external services cannot initiate a connection with those instances.
29
Public cloud:
Provides cloud services to just about anyone.
30
Private cloud:
Serves only one customer or organization and can be located on the customer's premises or off the customer's premises.
31
Hybrid cloud:
A mixed computing environment where applications are run using a combination of computing, storage, and services in different environments.
32
Software as a service (SaaS):
A form of cloud computing where a firm subscribes to a third-party software and receives a service that is delivered online.
33
Infrastructure as a service (IaaS):
Delivers hardware networking capabilities, including the use of servers, networking, and storage, over the cloud using a pay-per-use revenue model.
34
Platform as a service (PaaS):
Supports the deployment of entire systems including hardware, networking, and applications using a pay-per-use revenue model.
35
Scalability:
Refers to how well a system can adapt to increased demands.
36
Elasticity:
Refers to the ability of a cloud to automatically expand or compress the infrastructural resources on a sudden up and down.
37
Multitenancy:
A single instance of a system serves multiple customers.
38
Internet Control Message Protocol (ICMP):
- An IP network protocol used to determine if a particular service or host is available.
39
Transmission Control Protocol (TCP):
A protocol for sending packets that does error-checking to ensure all packets are received and properly ordered.
40
User Datagram Protocol (UDP):
A protocol for sending packets quickly with minimal error-checking and no resending of dropped packets.
41
Generic Routing Encapsulation (GRE):
Method of encapsulation of IP packet in a GRE header which hides the original IP packet.
42
Internet Protocol Security (IPSec):
A set of protocols developed to support the secure exchange of packets between hosts or networks.
43
Authentication Header (AH):
An IPsec protocol that authenticates that packets received were sent from the source identified in the header of the packet.
44
Encapsulating Security Payload (ESP):
An IPsec protocol that provides authentication, integrity, and encryption services.
45
Internet Key Exchange (IKE):
Method used by IPSec to create a secure tunnel by encrypting the connection between authenticated peers.
46
Unicast:
A form of message delivery in which a message is delivered to a single destination.
47
Multicast:
A form of transmission in which a message is delivered to a group of hosts.
48
Anycast:
A network addressing and routing method in which incoming requests can be routed to a variety of different locations or "nodes."
49
Broadcast:
Used to transmit a message to any reachable destination in the network without the need to know any information about the receiving party.
50
Frequency bands used by 802.11 networks include:
- 5.0 GHz.
- 2.4 GHz.
51
IEEE 802.11a wireless standard:
- 5.0 GHz frequency band.
- Maximum data signaling rate of 54 Mbps.
52
IEEE 802.11b wireless standard:
- 2.4 GHz frequency range.
- Maximum data signaling rate of 11 Mbps.
53
IEEE 802.11g wireless standard:
- 2.4 GHz frequency range.
- Maximum data signaling rate of 54 Mbps.
54
IEEE 802.11n wireless standard:
- 2.4 GHz frequency band.
- 5.0 GHz frequency band.
- Maximum data signaling rate of up to 600 Mbps.
- Multiple Input / Multiple Output (MIMO).
55
IEEE 802.11ac (WiFi 5) wireless standard:
- 5.0 GHz frequency band.
- Maximum data signaling rate of up to 6.933 Gbps.
- Multi-User Multiple Input / Multiple Output (MU-MIMO).
56
IEEE 802.11ax (WiFi 6) wireless standard:
- 2.4 GHz frequency band.
- 5.0 GHz frequency band.
- Maximum data signaling rate of up to 9.607 Gbps.
- Multi-User Multiple Input / Multiple Output (MU-MIMO).
57
Refers to directional antenna types suitable for long-range point-to-point bridging links?
- Yagi antenna.
- Dish antenna.
- Parabolic antenna.
58
Cellular:
- Radio network distributed over land through cells where each cell includes a fixed location transceiver known as base station.
- These cells together provide radio coverage over larger geographical areas.
59
IEEE 802.3af:
PoE (Power over Ethernet).
60
IEEE 802.3at:
PoE+.
61
IEEE 802.3bt:
- PoE++.
- 4PPoE.
62
Single-mode Fiber (SMF):
- Uses lasers.
- Longer distance and smaller diameter.
- Used in telecom and CATV networks.
63
Multimode fiber (MMF):
- Uses LEDs.
- Shorter distance and wider diameter.
- Used in LAN, security systems, and CCTV.
64
Direct attach copper (DAC) cable:
Allows direct communication between devices over copper wire.
65
Twinaxial cable:
A variant of coaxial cables, which features two inner conductors instead of one and is used for very-short-range high-speed signals.
66
Coaxial cable:
Insulated copper wire; used to carry high-speed data traffic and television signals.
67
Plenum vs. Non-Plenum Cables:
- Plenum cables are engineered with fire-retardant materials, emitting minimal smoke and toxic fumes in case of fire.
- Non-plenum cables often come at a lower cost than plenum cables.
68
Ethernet:
A physical and data layer technology for LAN networking.
69
Protocol:
A set of rules governing the exchange or transmission of data between devices.
70
Fibre Channel (FC):
- A high-speed data transfer protocol providing in-order, lossless delivery of raw block data.
- Primarily used to connect computer data storage to servers in storage area networks (SAN) in commercial data centers.
71
Small form-factor pluggable (SFP):
Fiber optic transceiver module type supporting duplex 1 Gbps (SFP) or 10 Gbps (SFP+) links.
72
Quad small form-factor pluggable (QSFP):
- Small, high-density pluggable interface used for high-speed data transmission.
- It connects between network devices and fiber optic or copper cables, providing multiple channels for simultaneous data transmission.
73
Local Connector (LC):
Fiber-optic cable connector that corresponds to the mini form-factor standard.
74
Subscriber connector (SC):
Push/pull connector used with fiber optic cabling.
75
Straight tip (ST):
Bayonet-style twist-and-lock connector for fiber optic cabling.
76
Multi-fiber push on (MPO):
Accommodates multiple fibers in a single physical connector interface.
77
Registered jack (RJ) 11:
Connector wired for one telephone line.
78
RJ45:
A common connector or plug used on the end of the network cable.
79
F-type:
Used with Coaxial Cabling.
80
Mesh Topology:
Every computer connects to every other computer; no central connecting device is needed.
81
Hybrid Topology:
A physical topology that combines characteristics of more than one simple physical topology.
82
Star/hub and spoke:
A network topology where all devices are connected to a central hub or switch, which manages the data flow between them.
83
Spine and leaf:
A newer network topology that consists of just two layers.
84
Point to point:
A data transmission that involves one transmitter and one receiver.
85
Three-Tier Hierarchical Model:
- Access layer: Provides access points for hosts to connect to the network.
- Distribution layer: Acts as an intermediary between the Core Layer and the Access Layer, and keeps local traffic confined to local networks.
- Core layer: Handles and transports huge amounts of data quickly and reliably and connects multiple end networks together.
86
Collapsed core:
A network design where the core and distribution layers are collapsed or combined into a single layer of switches.
87
North-south traffic flow:
Data transmission pattern that describes data flow between local network endpoints and external networks and services, such as the World Wide Web, cloud services, etc.
88
East-west traffic flow:
Transfer of data packets from server to server within a data center.
89
Automatic Private IP Addressing (APIPA):
A networking feature in operating systems that enables DHCP clients to self-configure an IP address and subnet mask automatically when a DHCP server isn't available.
90
RFC1918:
Defined the 3 ranges of private IPv4 Addresses:
- 10.0.0.0 - 10.255.255.255 /8
- 172.16.0.0 - 172.31.255.255 /16
- 192.168.0.0 - 192.168.255.255 /32
91
Loopback/localhost:
- Used to test the IP stack on the local computer.
- Can be any address from 127.0.0.1 through 127.255.255.254.
92
Public vs. private network:
- Public networks are "open" access networks prioritizing accessibility and availability over network performance and security.
- Private networks are "closed" and secure networks prioritizing network safety, confidentiality, and performance over accessibility and ease of use.
93
Subnetting:
The act of dividing a network into smaller logical subnetworks.
94
Variable Length Subnet Mask (VLSM):
- The capability to specify a different subnet mask for the same Class A, B, or C network number on different subnets.
- VLSM can help optimize available address space.
95
Classless Inter-domain Routing (CIDR):
- Allows network administrators to expand the number of network nodes assigned to an IP address.
- Based on the idea that IP addresses can be allocated and routed based on their network prefix rather than their class.
96
Class A IPv4:
1.x.x.x to 126.x.x.x
97
Class B IPv4:
128.x.x.x - 191.x.x.x
98
Class C IPv4:
192.x.x.x - 223.x.x.x
99
Class D IPv4:
224.x.x.x - 239.x.x.x
100
Class E IPv4:
240.x.x.x - 255.x.x.x
101
Software-defined network (SDN):
The entire network, including all security devices, is virtualized.
102
Software-defined wide area network (SD-WAN):
An extension of the SDN practices to connect to entities spread across the internet to support WAN architecture especially related to cloud migration.
103
Application aware:
Refers to systems or technologies that have built-in information about individual applications, allowing them to better interact with these applications.
104
Transport agnostic:
A software component is unaware regarding the specific nature of the components or input with which it interacts.
105
Zero-touch provisioning:
- Mechanism which allows unconfigured devices to automatically load deployment files upon power-on, including system software, patch and configuration files.
- Eliminates the need for onsite, manual configuration and deployment.
106
Central policy management:
Practice of managing access policies from a single, centralized location.
107
Virtual Extensible Local Area Network (VXLAN):
The technology used in creating this tunnel between nodes on an SDN computer network.
108
Data center interconnect (DCI):
Technology that connects two or more data centers together over short, medium, or long distances using high-speed packet-optical connectivity.
109
Layer 2 encapsulation:
The encapsulation or framing of data for transmission over the physical medium.
110
Zero trust architecture (ZTA):
An approach to access control in IT networks that does not rely on trusting devices or network connections; rather, it relies on mutual authentication to verify the identity and integrity of devices, regardless of their location.
111
Policy-based authentication:
Security model in ASP.NET Core that decouples authorization and application logic. It centers around three main concepts: policies, requirements, and handlers.
112
Authorization:
The process of giving someone permission to do or have something.
113
Least privilege access:
User is only given access needed to perform job.
114
Secure Access Service Edge (SASE):
A new type of network architecture that combines both network security and wide area network (WAN) capabilities into a single solution.
115
Security Service Edge (SSE):
A collection of integrated, cloud-centric security capabilities that facilitates safe access to websites, software-as-a-service (SaaS) applications and private applications.
116
Infrastructure as code (IaC):
- A provisioning architecture in which deployment of resources is performed by scripted automation and orchestration.
- Automation and source control.
117
Automation:
- Playbooks/templates/ reusable tasks.
- Configuration drift/compliance.
- Upgrades.
- Dynamic inventories.
118
Source control:
- Version control.
- Central repository.
- Conflict identification.
- Branching.
119
IPv6 addressing:
- 128 bit address written in hexadecimal.
- 8 octets.
120
Tunneling:
A data transport technique in which a data packet is transferred inside the frame or packet of another protocol, enabling the infrastructure of one network to be used to travel to another network.
121
Dual stack:
A type of network that supports both IPv4 and IPv6 traffic.
122
NAT64:
Together with DNS64, the primary purpose of NAT64 is to allow an IPv6-only client to initiate communications to an IPv4-only server.
123
Static Routing:
An type of routing used by a network administrator to manually specify the mappings in the routing table.
124
Dynamic Routing:
Allows a router to determine the best route between two nodes automatically and then store this information in a routing table.
125
Border Gateway Protocol (BGP):
The postal service of the Internet. When someone drops a letter into a mailbox, the Postal Service processes that piece of mail and chooses a fast, efficient route to deliver that letter to its recipient.
126
Enhanced Interior Gateway Routing Protocol (EIGRP):
A dynamic routing protocol designed by Cisco Systems; it is used for automating routing decisions and configuration on computer networks.
127
Open Shortest Path First (OSPF):
An interior gateway routing protocol developed for IP networks based on the shortest path first or link-state algorithm.
128
Administrative distance:
In the event there are multiple routes to a destination with the same prefix length, the route learned by the protocol with the lowest administrative distance is preferred.
129
Prefix length:
The longest-matching route is preferred first.
130
Metric:
In the event there are multiple routes learned by the same protocol with same prefix length, the route with the lowest metric is preferred.
131
Network Address Translation (NAT):
A technique that allows private IP addresses to be used on the public Internet.
132
Port address translation (PAT):
A port number is tracked with the client computer's private address when translating to a public address.
133
First Hop Redundancy Protocol
(FHRP)
A networking protocol designed to protect the default gateway used on a subnetwork by allowing two or more routers to provide backup for that address.
134
Virtual IP (VIP):
An IP address and a specific port number that can be used to reference different physical servers.
135
Subinterfaces:
A virtual interface that is created by dividing up one physical interface into multiple logical interfaces.
136
Virtual Local Area Network
(VLAN):
A logical network that can separate physical devices without regard to the physical location of the device.
137
VLAN database:
Saved in either Flash or NVRAM, depending on the model of switch.
138
Switch Virtual Interface (SVI):
A logical interface on a layer 3 switch that provides layer 3 processing for packets from all switch ports associated with a VLAN.
139
Native VLAN:
Untagged traffic that arrives on an 802.1Q trunk port is placed on a VLAN designated as the native VLAN.
140
Voice VLAN:
A VLAN defined for use by IP Phones, with the Cisco switch notifying the phone about the voice VLAN ID so that the phone can use 802.1Q frames to support traffic for the phone and the attached PC (which uses a data VLAN).
141
802.1Q tagging:
A method of adding a 4-byte tag to Ethernet frames to identify the VLAN that they belong to.
142
Link aggregation:
Allows multiple physical connections to be logically bundled into a single logical connection.
143
Spanning Tree Protocol (STP):
- A Layer 2 link management protocol that provides path redundancy while preventing loops in the network.
- 5 states (disabled, blocking, listening, learning, forwarding).
144
Maximum transmission unit (MTU):
The largest packet size supported on an interface.
145
Jumbo frames:
Usually 9000 bytes long, though technically anything over 1500 bytes qualifies, these frames make large data transfer easier and more efficient than using the standard frame size.
146
Channel Width:
Refers to the range of frequencies occupied by a WiFi channel.
147
Non-overlapping channels:
Channels 1, 6, and 11.
148
802.11h:
It is an extension of 802.11a, allowing for a fourth band frequency (known as UNII-2 Extended).
149
2.4GHz:
A Wi-Fi frequency range that has 14 channels.
150
5GHz:
- At this higher frequency, throughput is faster.
- On the negative side, the transmission range is shorter, as the signal gets attenuated by objects such as walls and floors.
151
6GHz:
A new development in Wi-Fi technology.
152
Band steering:
A technique used in wireless networks to optimize the distribution of devices between different frequency bands.
153
Service set identifier (SSID):
A network name that wireless routers use to identify themselves.
154
Basic service set identifier
(BSSID):
MAC address of an access point supporting a basic service area.
155
Extended service set identifier
(ESSID):
An SSID applied to an Extended Service Set as a network naming convention.
156
Mesh networks:
Networks composed of multiple Wi-Fi access points that create a wide area network that can be quite large.
157
Ad hoc network:
A network created when two wireless devices connect to each other directly.
158
Point-to-point:
A data transmission that involves one transmitter and one receiver.
159
Infrastructure network:
Network where devices connect via a central device like a router.
160
Wi-Fi Protected Access 2
(WPA2):
A network security technology for Wi-Fi wireless networks that provides stronger data protection and network access control.
161
Wi-Fi Protected Access 3
(WPA3):
The latest Wi-Fi security standard that tackles the shortcomings of WPA2.
162
Captive portals:
Most public networks, including Wi-Fi hotspots, use a captive portal, which requires users to agree to some condition before they use the network or Internet.
163
Pre-shared key (PSK) vs.
Enterprise:
- While easy to set up, PSK poses security risks if the key is weak or shared with unauthorized users.
- Enterprise authentication, also known as 802.1X or WPA-Enterprise, is a more secure and scalable method.
164
Autonomous access point:
A device that is separate from other network devices including other autonomous access points and that contains all the intelligence required for wireless authentication, encryption, and management.
165
Lightweight Access Point (LAP):
A device that cannot work independently and relies on an external wireless LAN controller (WLC)
166
Intermediate distribution
frame (IDF):
Contains an edge switch, a patch panel, and other associated equipment to support the floor and offices nearest to it.
167
Main distribution frame (MDF):
The room in a building that stores the demarc, telephone cross-connects, and LAN cross-connects.
168
Port-side exhaust/intake:
- Port side intake is suitable for mounting switches on a rack.
- In a rack setup, multiple switches can be installed consecutively, and hot air can be expelled through the rear air vent, maximizing the rack's cooling capacity.
- Port side exhaust is suitable for mounting switches on a wall.
169
Patch panel:
A wall-mounted panel of data receptors into which cross-connect patch cables from the punch-down block are inserted.
170
Fiber distribution panel:
The fiber equivalent of a patch panel; used to terminate horizontal fiber cabling.
171
Uninterruptible power supply
(UPS):
An alternative power supply device that protects against the loss of power and fluctuations in the power level by using battery power to enable the system to operate long enough to back up critical data and safely shut down
172
Power distribution unit (PDU):
A device fitted with multiple outputs designed to distribute electric power, especially to racks of computers and networking equipment.
173
Voltage:
An electromotive force or potential difference expressed in volts.
174
Environmental factors:
Humidity, fire suppression, and temperature.
175
Physical Diagram:
A diagram that displays specific connections and explains why a network system functions in a specific manner; used for diagnostics.
176
Logical diagram:
- Shows network devices like routers, firewalls, voice gateways, subnets, VLAN IDs, subnet masks, and IP addresses.
- It also shows routing protocols, traffic flows, routing domains, and network segments.
177
Rack diagram:
A drawing that shows the devices stacked in a rack system and is typically drawn to scale.
178
Cable map:
General network documentation indicating each cable's source and destination as well as where each network cable runs.
179
Asset Inventory:
A catalog of assets that need to be protected.
180
IP address management (IPAM):
- Planning, tracking, and managing the Internet Protocol address space used in a network.
- Integrates DNS and DHCP so that each is aware of changes in the other.
181
Service-level agreement (SLA):
Part of a service contract where the service expectations are formally defined.
182
Wireless Survey/Heat map:
A process of planning and designing a wireless network, to provide the required wireless coverage, data rates, network capacity, etc.
183
End-of-life (EOL):
Product life-cycle phase where mainstream vendor support is no longer available.
184
End-of-support (EOS):
When a device or application is no longer provided with basic service and security support for patching and customer service.
185
Firmware:
- Software that is permanently stored in a chip.
- The BIOS on a motherboard is an example of this.
186
Decommissioning:
Refers to the process of officially stopping the use of something and removing it from service.
187
Configuration management:
A process to properly track changes to a system's configuration through its whole lifecycle.
188
Backup configuration:
The version of the Cisco device configuration stored in the NVRAM of the system.
189
Baseline/golden configuration:
- The standard, approved configuration of a system.
- It can specify things like the approved operating system, patching levels and installed software.
190
SNMP (Simple Network Management Protocol):
- An Internet Standard protocol for collecting and organizing information about managed devices on IP networks.
- It is an application layer protocol.
- Ports 161/162.
191
SNMP Trap:
- A type of SNMP protocol data unit (PDU).
- Unlike other PDU types, with this, an agent can send an unrequested message to the manager to notify about an important event.
192
Management information base
(MIB):
A virtual database included in an SNMP-compliant device, containing information about configuration and state of the device that can be queried by the SNMP management station.
193
SNMP v2C, SNMP v3:
SNMP version(s) that use MD5 encryption.
194
Community strings:
SNMP uses these to establish trust between a network management station and agent on a managed device.
195
SNMP Authentication:
Amounts to nothing more than a password (community string) sent in clear text between a manager and agent.
196
Baseline metrics:
Anomaly alerting/notification.
197
Log aggregation:
The practice of gathering up disparate log files for the purposes of organizing the data in them and making them searchable.
198
Security information and
event management (SIEM):
An application that collects and analyzes log data to monitor critical activities in an organization.
199
Syslog collector:
A syslog server integrated to SIEM - can receive messages from different systems/devices:
200
Application programming
interface (API):
A set of software routines that allows one software system to work with another.
201
Port mirroring:
The practice of duplicating all traffic on one port in a switch to a second port.
202
Network discovery:
A setting that when turned on allows a computer to see other computers on a network and to be seen by those other computers.
203
Availability monitoring:
The process of checking the uptime, functionality, speed, and performance of infrastructure components such as servers and applications.
204
Configuration monitoring:
A process for assessing or testing the level of compliance with the established baseline configuration of software systems or servers.
205
DR metrics:
Used to measure your preparedness and manage expectations during recovery.
206
Recovery point objective (RPO):
- The maximum amount of data that can be lost after a recovery from a disaster before data loss will exceed what is acceptable to an organization.
- "How much data can I afford to lose?"
- Determines the maximum age of the data or files in backup storage needed to be able to meet the objective specified by the RPO, should a network or computer system failure occur.
207
Recovery time objective (RTO):
The maximum tolerable time to restore an organization's information system following a disaster, representing the length of time that the organization is willing to attempt to function without its information system.
208
Mean time to repair (MTTR):
The average amount of time a computer repair technician needs to resolve the cause of a failure through replacement or repair of a faulty unit.
209
Mean time between failures (MTBF):
The average time until a component fails, cannot be repaired, and must be replaced.
210
Cold site:
A separate facility that does not have any computer equipment but is a place where employees can move after a disaster.
211
Warm site:
A separate facility with computer equipment that requires installation and configuration.
212
Hot site:
A separate and fully equipped facility where the company can move immediately after a disaster and resume business.
213
Active-active:
A configuration in which all load balancers are always active.
214
Active-passive:
A configuration in which the primary load balancer distributes the network traffic to the most suitable server while the secondary load balancer operates in a "listening mode."
215
Tabletop exercises:
Exercises that simulate an emergency situation but in an informal and stress-free environment.
216
Validation tests:
The process of ensuring that the tested and developed software satisfies the client/user needs.
217
DHCP Reservations:
DHCP lease assignments that enable you to configure a permanent IP address for a client.
218
DHCP Scope:
The predefined range of addresses that can be leased to any network device on a particular segment.
219
DHCP Lease time:
- The specified amount of time that an IP configuration assigned by DHCP is valid.
- It is specified when a device is assigned an IP configuration.
220
DHCP Options:
Options that are assigned when the addresses are assigned or renewed, including the default gateway and the primary and secondary DNS servers.
221
DHCP Relay/IP helper:
Used to forward request and replies between a DHCP server and client when the server is present on the different network.
222
DHCP Exclusions:
IP addresses residing within the exclusion range are excluded from the pool of available IP addresses.
223
Stateless address
autoconfiguration (SLAAC):
A feature of IPv6 in which a host or router can be assigned an IPv6 unicast address without the need for a stateful DHCP server.
224
Domain Name Security
Extensions (DNSSEC):
A suite of extensions to the domain name system used to protect the integrity of DNS records and prevent some DNS attacks.
225
DNS over HTTPS (DoH):
Domain Name System (DNS) over Hypertext Transfer Protocol using Transport Layer Security (HTTPS).
226
DNS over TLS (DoT):
The DNS name resolution service that uses TLS to encrypt communications between the client and server to ensure privacy and confidentiality.
227
Address (A) record:
A type of DNS data record that maps the IPv4 address of an Internet-connected device to its domain name.
228
AAAA Record:
The DNS record that maps a hostname to a 128-bit IPv6 address.
229
Canonical name (CNAME) Record:
Sometimes referred to as an Alias, maps an alias DNS domain name to another primary or canonical name.
230
Mail exchange (MX) Record:
A DNS record type that specifies the DNS hostname of the mail server for a particular domain name.
231
Text (TXT) Record:
Adds text into the DNS.
232
Nameserver (NS) Record:
Indicates which DNS nameserver has the authority.
233
Pointer (PTR) Record:
Maps an IP address to a domain/host name.
234
Forward Zone:
A DNS lookup file that holds A records.
235
Reverse Zone:
- A DNS lookup file that holds A records where the IP addresses must be stored in reverse— with the last octet listed first.
- For example, the IP address 1.2.3.4 would be stored in a PTR record as 4.3.2.1.
236
Authoritative vs.
non-authoritative:
- Primary and secondary zones where the server holds the records are authoritative.
- Forwarded requests are non-authoritative.
237
Primary vs. secondary name resolution:
- Primary DNS servers contain all relevant resource records and handle DNS queries for a domain.
- By contrast, secondary DNS servers contain zone file copies that are read-only, meaning they cannot be modified.
238
Recursive Name Resolution:
Process by which a DNS server uses the hierarchy of zones and delegations to respond to queries for which it is not authoritative.
239
Hosts file:
File used to resolve FQDNs into IP addresses.
240
Precision Time Protocol (PTP):
A protocol used to synchronize clocks throughout a computer network.
241
Network Time Security (NTS):
- Provides cryptographic security for the client-server mode of the Network Time Protocol (NTP).
- This allows users to obtain time in an authenticated manner.
242
Site-to-site VPN:
Interconnects two sites.
243
Client-to-site VPN:
Clients from the Internet can connect to the server to access the corporate network or Local Area Network (LAN) behind the server but still maintains the security of the network and its resources.
244
Clientless VPN:
Creates a secure, remote-access VPN tunnel using a web browser without requiring a software or hardware client.
245
Split tunnel vs. full tunnel:
- Split tunnel - only some traffic over secure VPN while the rest of the traffic directly accesses the Internet.
- Full tunnel - all of the traffic is sent over the secure VPN.
246
Jump box/host:
A system on a network used to access and manage devices in a separate security zone.
247
In-band vs. out-of-band
management:
In-band management uses the same network infrastructure for management traffic, while out-of-band management uses a separate dedicated network.
248
Data in transit:
Any data sent over a network.
249
Data at rest:
Data stored on a drive, in the cloud, or otherwise not currently utilized by the owner, group, or other network personnel.
250
Certificates:
Digitally signed electronic documents that bind a public key with a user identity.
251
Public key infrastructure (PKI):
System for creating public and private keys using a certificate authority (CA) and digital certificates for authentication.
252
Self-signed:
A signed digital certificate that does not depend upon any higher level authority for authentication.
253
Identity and access management
(IAM):
The security discipline that enables the right individuals to access the right resources at the right times for the right reasons.
254
Single sign-on (SSO):
Using one authentication credential to access multiple accounts or applications.
255
Remote Authentication
Dial-in User Service
(RADIUS):
Protocol that provides centralized authentication, authorization, and accounting (AAA) management for users who connect and use a network service.
256
LDAP (Lightweight Directory Access Protocol):
- Protocol that defines how a client can access information, perform operations, and share directory data on a server.
- Port 389.
257
Security Assertion Markup
Language (SAML):
An XML-based standard used to exchange authentication and authorization information.
258
Terminal Access Controller
Access Control System Plus
(TACACS+):
A family of protocols made by Cisco used for authentication and authorization through a centralized server.
259
Time-based authentication:
A computer algorithm that generates a one-time password (OTP) using the current time as a source of uniqueness.
260
