Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CompTia Network+ N10-1008 > Network Security - Objective 4 > Flashcards

Network Security - Objective 4 Flashcards

Common concepts, attack types, network hardening, remote access methods, physical security

1
Q

Type of encryption used by WPA

A

RC4 (Rivest Cipher 4)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Geofencing

A

Uses GPS or RFID to define real-world boundaries where barriers can be active or passive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

NAC

A

Network Access Control

Permits or denies access to the network based on a device’s characteristics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Difference between active & passive geofencing

A

Whether an alert is sent or only a log created

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Wireless client isolation a.k.a. AP isolation

A

Devices on a wireless network can’t communicate with each other

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Guest network isolation

A

The guest network does not have access to other networks on the access point

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Encryption protocol used by SNMP3

A

DES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

CRAM-MD5

A

MD5 variant used in email systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

DAC

A

Discretionary Access Control

An access control method where access is determined by the owner of the resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

MAC
(not the address)

A

Mandatory Access Control

An access control policy where the computer system gets to decide who gets access to what objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

RBAC

A

Role-based Access Control

Access model that is controlled by the system but focuses on a set of permissions versus an individuals permissions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Zero-Trust

A

A security framework that requires users to be authenticated and authorized before being granted access to applications or data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Transport layer protocols used by RADIUS & TACACS+, respectively

A

UDP & TCP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

802.1x

A

A standardized framework that’s used for port-based network access control (NAC) on both wired and wireless networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

3-roles in 802.1x authentication

A
  • supplicant
  • Authenticator
  • authentication server
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

3 examples of devices that can act as an authenticator in an 802.1X network

A
  • Switch
  • WAP
  • VPN concentrator
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

EAP

A

Extensible Authentication Protocol [actually a series of them]

Allows for numerous different mechanisms of authentication performed using 802.1x

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

EAP-MD5

A

Utilizes simple passwords and the challenge handshake
authentication process to provide remote access
authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

EAP-TLS

A

Uses public key infrastructure with a digital certificate
being installed on both the client and the server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

EAP-TTLS

A

Requires a digital certificate on the server and a password
on the client for its authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

EAP-FAST

A

EAP Flexible Authentication via Secure Tunneling

Uses a protected access credential to establish mutual
authentication between devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

PEAP

A

Protected EAP

Uses server certificates and Microsoft’s Active Directory
databases to authenticate a client’s password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Reason to disable dynamic switchport mode on your switchports

A

To prevent switch spoofing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

RD Gateway

A

Remote Desktop Gateway

A server role that uses RDP over HTTPS & port 443 to provide a connection using the SSL/TLS protocols for remote users accessing an internal network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
3 things an RD gateway does for remote access
- create an **encrypted** connection - **control access to network resources** based on permissions and group policies - **Monitor** the **status** of the gateway *and* any **RDP connection** passing through the gateway
26
4 remote access authentication protocols
- PAP *unencrypted, not used* - CHAP - MS-CHAP - EAP *can use more than just UN/PW* (Use EAP/TLS in conjunction with a RADIUS or TACACS+ server)
27
VNC
Virtual Network Computing Designed for thin client architecture and things like virtual desktop infrastructure (VDI)
28
2 ways of accessing a virtual desktop
- web browser - specialized thin client device that uses a PXE network boot image that loads up a specialized client that can connect to the centralized server
29
Difference between full tunnel & split tunnel VPN
Full tunnel routes & encrypts all traffic & split only does the traffic bound for the headquarters. Which you use determines which network you are logically a part of & therefore can access the resources of.
30
When not to use a split tunnel VPN
On an untrusted Wi-Fi network
31
Clientless VPN
VPN in a web browser (https)
32
Protocol used instead of SSL or TLS for streaming or VoIP data in a VPN
DTLS datagram transport layer security
33
L2TP
Layer 2 Tunneling Protocol Early tunneling protocol - no native encryption
34
L2F
Layer 2 Forwarding Unused now (Cisco tunneling protocol for the P2P protocol)
35
PPTP A pro and a con
Point-to-Point Tunneling Protocol Supports dial-up networks but also lacks native security features except when used with Microsoft Windows
36
IPSec
IP Security Provides authentication and encryption of packets to create a secure encrypted communication path between two computers
37
4 protocols used to establish VPN connection
- L2TP - L2F - PPTP - IPSec
38
What is a SIEM
Security Information and Event Management Provides real-time or near-real-time analysis of security alerts generated by network hardware & applications
39
When should log analysis occur?
Regularly
40
5 functions performed by SIEM
- Log collection - Normalization - Correlation - Aggregation - Reporting
41
SIEM normalization
Maps log messages into a common data model, enabling the organization to connect and analyze related events
42
SIEM correlation
Links the logs and events from different systems or applications into a single data feed
43
SIEM aggregation
Reduces the volume of event data by consolidating duplicate event records and merging them into a single record
44
X
Y
45
How a SIEM takes data
Using the Syslog protocol (UDP 514 or TCP 1468), & with it classified on a scale of 0-7
46
Port Security
Prevents unauthorized access to a switchport by identifying and limiting the MAC addresses of the hosts that are allowed. Can be done statically, dynamically, or both.
47
2 Ways port security can create a list of authorized MAC addresses
- static configuration - dynamic learning
48
Port Security static configuration
Allows an administrator to define the static MAC addresses to use on a given switchport
49
Port Security dynamic learning
Defines a maximum number of MAC addresses for a port and blocks new devices that are not on the learned list A.k.a. Sticky MAC
50
DAI
Dynamic ARP Inspection Validates the address resolution protocol, or ARP, packets in your network
51
How an ARP database is built
From replies to ARP requests
52
DHCP snooping
Provides security by - inspecting DHCP traffic - filtering untrusted DHCP messages - building and maintaining a DHCP snooping binding table
53
2 things to configure to allow DHCP snooping
Switches and VLANs
54
RA-Guard
IPv6 Router Advertisement Guard Mitigates attack vectors based on forged ICMPv6 router advertisement messages
55
What OSI layer does RA-guard operate at?
Layer 2
56
CPP
Control Plane Policing Configures a QoS filter that manages the traffic flow of control plane packets to protect the control plane of Cisco IOS routers and switches
57
2 types of attacks mitigated by SNMPv3
- on-path/MITM - replay
58
3 different types of VLANS
- Primary - Secondary isolated - Secondary community
59
Secondary isolated VLAN
Switchports can only reach the primary VLAN
60
Secondary community VLAN
Switchports can communicate with each other and the primary VLAN
61
Promiscuous Port (P-Port)
Can communicate with anything connected to the primary or secondary VLANs
62
Default VLAN is known as...
VLAN 1
63
Native VLAN
VLAN where untagged traffic is put once it is received on a trunk port. It is also the default VLAN.
64
9 things to secure SNMP
1. Use v3 2. Whitelist the MIB 3. Use authPriv 4. Strong passwords for admins 5. Roll separation between polling/receiving traps (for reading) 6. Users & groups (for writing) 7. ACLs 8. Patching 9. Separate management network
65
ACL line entry for an implicit deny
deny ip any any
66
Is it better to use explicit allow or deny when configuring MAC filtering?
Allow
67
9 things to help secure wireless networks
1. MAC filtering 2. Antenna placement 3. Antenna power levels 4. Pre-shared keys with strong passwords 5. Guest network isolation 6. Wireless client isolation 7. EAP instead of pre-shared key 8. Geofencing 9. Captive portals
68
7 considerations with IoT
1. Understand your endpoints 2. Track & manage your devices 3. Patch vulnerabilities 4. Conduct test & evaluation before adding to the production network 5. Change default credentials 6. Use encryption protocols 7. Segment IoT devices
69
2 things CPP helps protect a network from
- Reconnaissance - DoS
70
Geofencing
Uses GPS or RFID to define real-world boundaries where barriers can be active or passive
71
CVE
Common Vulnerabilities Exposures A list of publicly disclosed information, security, vulnerabilities, and exposures
72
Remote Desktop Gateway
Provides a secure connection using the SSL/TLS protocols to the server via RDP
73
In-Band Management
Technology that enables managed devices to be managed by any authorized host that is connected to a non-management network.
74
Out-of-Band Management
Method to connect to and administer a managed device that does not use a standard user-network connected host as the administrative console. E.g. computer connected to the consul port of a switch or use of a management network
75
LDAP
Lightweight Directory Access Protocol A database used to centralize information about your clients and your objects on your network
76
How LDAP performs authentication
Validation of a username and password against an LDAP server
77
Kerberos
Performs secure, mutual authentication and authorization within a Windows environment
78
How 802.1x usually provides authentication
EAP provides authentication credentials which are checked against a Radius, LDAP, or TACACS+ server
79
File transfer protocol that supports resuming interrupted transfers
SFTP
80
Attacks stateless firewalls vulnerable to
DoS and IP spoofing
81
Where stateless firewalls are best used
An internal network
82
Biggest difference between RDP and VNC
RDP is a resource-sharing method. Multiple users can independently connect to the same device. VNC is a screen-sharing method. A remote user can control a device while the local user can watch (and does not lose the ability to control the device). It is useful for tech support and education.
83
TACACS+
Terminal Access Controller Access Control System A network security protocol used for AAA services
84
3 servers often placed in screened subnets
Email Web FTP
85
4 ways IPSs identify intrusions
- Signatures (exact) - Anomalies (compared to baseline) - Behaviors (not exact signatures but more general) - Heuristics (AI learning your network)
86
Technique commonly used in man-in-the-middle attacks
ARP poisoning
87
Private VLAN
A.K.A port isolation A technique where a VLAN contains switch ports that are restricted to using a single uplink - Primary - Secondary isolated - Secondary community
88
3 common methods of captive portal implementation
- HTTP redirect - ICMP redirect - DNS redirect
89
Authentication protocol designed to send data over insecure networks while using strong native encryption
Kerberos
90
Discovery protocols
Protocols that can get detailed information such as the IP addresses, system version, and device information from supporting devices directly
91
3 primary discovery protocols
- Simple network management protocol (SNMP) - Link layer discovery protocol (LLDP) - Ping

CompTia Network+ N10-1008 (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions