Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

secure cyber systems > network security and defence > Flashcards

network security and defence Flashcards

(63 cards)

Start Studying
1
Q

what is a worm

A

a standalone malicious program that self-replicates throughout the network without needed to attach itself to other files and programs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

what do worms mostly target

A

systems and network resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

what is a virus

A

a program that attaches itself to other programs or files and requires user interaction to activate and spread

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

what makes viruses slightly better than worms

A

spreads slower and relies on human interaction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

what do viruses usually target

A

files and programs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

what are 0 day vulnerabilities

A

undiscovered vulnerabilities in the system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

what are firewalls

A

software or applications at the networks gateway that filters information that is sent and received from outside the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

what do firewalls do

A

restrict access between protected networks (internal) and others (external e.g. the internet)
protects the internal network from malicious attempts and users trying to use unauthorised internet services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

what are the four types of firewalls

A

packet filtering firewall
stateful inspection firewall
proxy firewall
application layer firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

what does the packet filtering firewall do

A

applies rules to incoming packets based on the ip or port number
it can forward or discard the packets
it can be configured to filter packets going both in and out of the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

what does the stateful inspection firewall do

A

inspects packets and tracks connection states e.g. tcp handshakes
it uses the ongoing record/state table to make a decision

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

what do we mean by the stateful inspection firewall tracking connection states

A

it determines if the packet is at the start, a part of , or not qa part of the connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

what does the proxy firewall do

A

acts as a middleman between the client and server and proxies all the traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

how does the proxy firewall work

A

it processes requests by setting up a connection to the request service on behalf of the user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

what are two negatives of the proxy firewall

A

has low performance
may become a bottleneck

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

what are two benefits of the proxy firewall

A

provides deep inspection
can filter application layer content

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

what does the application layer firewall do

A

designed to protect a website or app by checking application level traffic
can be configured to support only specific apps and features in an app

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

what is intrusion detection

A

network security technology that monitors abnormal activities and security threats and issues alarms on time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

what is an intrusion detection system (ids)

A

an app that implements intrusion detection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

what are the four roles that the ids carries out

A

monitoring
detection
alert
logging

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

how does the ids carry out monitoring

A

it analyses traffic and system activity in real time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

how does the ids carry out detection

A

via signature, anomaly, and specification based detection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

what does signature detection do and what is a drawback of this

A

identify known attack patterns
since it compares to signatures you must capture attacks first to create the pattern database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

what is a negative of signature detection

A

doesnt detect 0 day attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
what are two positives of signature detection
accurate and fewer false alarms
26
what does anomaly detection do and what must you do first before being able to implement it
identify abnormal behaviour must first establish normal behaviour by observing the system/network hen identify deviations
27
what is a positive of anomaly detection
can detect unknown attacks
28
what are two negatives of anomaly detection
lots of false alarms limited by the training data
29
specification-based detection
uses predetermined universal profiles developed by security managers that have accepted definitions of benign activity
30
how does the ids carry out alerting
tells admins when the threats are detected
31
how does the ids carry out logging
record activities for later analysis and forensics
32
what is an ethical issue with intrusion detection
privacy concerns as it monitors the entire network
33
what are the three types of intrusion detection
network based ids; nids host based ids; hids hybrid ids
34
network based ids
deployed in the network to monitor traffic
35
host based ids
deployed on a host to monitor system logs and detects malicious activities
36
hybrid ids
combines the benefits of nids and hids
37
what is the difference between the ids and ips ( intrusion preventin system)
ids monitors and alarms whilst the ips takes blocking and isolation measures when a threat is detected
38
what are four security protocols
vpn; virtual private network tls; transport layer security ssl; secure socket layer ipsec; internet protocol security
39
what is ipsec
a protocol suite for protecting ip communications and provide data security via encryption, authentication and integrity protection at the network layer
40
what are the three protocols used in ipsec
ah; authentication header esp; encapsulating security payload sa; security association
41
authentication header
checks of the data comes from a trusted source and hasnt been changed
42
encapsulating security payload
authenticates and encrypts data
43
security association
defiens security parameters used in ipsec communication e.g. shared keys, protocol mode
44
what are the two operation modes in ipsec
transport tunnel
45
transport mode (ipsec)
operates on payload/data of the og packet so only the payload is encrypted and the header stays the same
46
what is transport mode usually used for
end to end communication
47
tunnel mode (ipsec)
the og packet is encapsulated into a new one and the payload of it is the og packet
48
what is tunnel mode usually used for
network to network/ host to network communication e.g. vpn
49
what is the communication initiation process for ipsec
we need to create and share cryptographic keys via the internal key exchange (ike)
50
how does the internal key exchange work in ipsec (phase 1 and 2)
1: the sender exchanges proposals for security services (e.g. the encryption algorithm) then the sender and receiver agree on a collection of parameters that the two devices use 2: devices between the sender and receiver choose which protocol (ah / esp) and algorithm to use
51
what is the secure socket layer (ssl)
an encryption protocol used to protect network communication
52
how does ssl work
it establishes an encrypted connection between the client and sever ensuring confidentiality integrity and identitiy authentication of data during transmission via the handshake protocol
53
what are the steps in the handshake protocol
negotiate encryption algorithm to be used establish a shares session authenticate server authenticate client (optional) complete session and can now start communicating with secure data transmission
54
transport layer security (tls)
an encryption protocol used to protect network communication security
55
what are the three protocols used in tls
tls handshake protocol tls record protocol tls alert protocol
56
tls handshake protocol
uses asymmetric cryptography varies based on the key exchange algorithm but similar to ssl handhsake
57
tls record protocol
splits data into smaller records which are all encrypted and transferred separately
58
tls alert protocol
conveys errors/ warning info
59
what to vpns do
virtual private network; establishes a secure connection via a public network (e.g. the internet) and allows users to remotely access private network resources
60
how does vpn work
it creates an encrypted tunnel between the users device and the target network therefore data cannot be eavesdropped or tampered with during transmissin
61
what are the steps used in vpn
connect to the vpn authenticate the users identity establish an encrypted tunnel transmit data through it user accesses the resources through the tunnel
62
when do we use ipsec with a vpn
when using a site-to-site vpn connecting two or more private networks
63
what do we use ssl/tls with a vpn
remote access vpn; encrypted tunnel ensure confidentiality and data integrity

secure cyber systems (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions