Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CompTIA Network+(N10-009) > S18-Network Monitoring > Flashcards

S18-Network Monitoring Flashcards

(76 cards)

Start Studying
1
Q

IDS

A

“Intrusion Detection system”

a cybersecurity tool that monitors network traffic and system activity for suspicious patterns or deviations from normal behavior, potentially indicating an attack or intrusion
- Passive System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

IPS

A

“Intrusion Prevention system”

a cybersecurity tool that actively monitors network traffic for malicious activity and takes automated actions to prevent attacks
- Active System
- can drop or block offending traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the 3 main methods for detecting offending traffic?

A
  • Signature
  • Policy
  • Anomaly
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Signature-Based detection

A

Triggered by a signature that contains a unique string of bytes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Policy-based detection

A

Relies on a specific declaration of a security policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Anomaly-based detection

A

Done through a a statistical or non-statistical anomaly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Statistical Anomaly detection

A

Watches traffic patterns to build baseline and flags things outside the normal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Non-statistical Anomaly detection

A

Admin defines the patterns or baseline

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What other ways can IPSs and IDSs can be distinguished?

A

By if their:
- Host-based
- Network-based

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Network-based IDS/IPS

A

Protects entire network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Host-based IDS/IPS

A

software-based IDS/IPS installed to Protect a host

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Simple Network Management Protocol (SNMP)

A

AN internet protocol for collecting, organizing, and modifying information about managed devices on IP networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Managed Device

A

Device that communicates with SNMP manager or Management info Base (MIB)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

SNMP Manager

A

Machine running SNMP protocol to collect and process information from devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

SNMP Agents

A

Network devices that report info back to the SNMP manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What 3 messages types does an SNMP manager use to communicate with it’s Agents?

A
  • SET
  • GET
  • TRAP
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

SET Request

A

Manager to Agent request to change the value of a variable or a list of variables

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

GET Request

A

Manager to Agent request to retrieve the value of a variable or list of variables

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

TRAP Request

A

Message that is sent asynchronously as notifications from the agent to the manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What to methods are used to encode trap message data in SNMP?

A
  • Granular Tap
  • Verbose Trap
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Granular Trap

A

Each SNMP Trap message is sent with a unique object Identifier (OID)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Verbose Trap

A

SNMP traps that contain all the information about a given alert or event as a payload

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Object Identifier (SNMP)

A

Identifies a variable that can be read or set via SNMP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Management Information Base (MIB)

A

essentially a “dictionary” that translates numerical Object Identifiers (OIDs) into human-readable descriptions, making it easier to monitor and manage network devices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Variable Binding
Data in SNMP traps are sent and stored in a key value pair configuration
26
SNMPv1 & SNMPv2
Uses a plaintext community string to give them access to the devices as their security mechanism, unsecure
27
Underrun
Number of times the sender has operated faster than the router can handle. causing buffers or dropped packets
28
SNMPv3 over SNMPv1/2
SNMPv3 Features: - Message Hashing - Source validation - Encryption (DES) 56-bit encryption key (weak algo) - newer SNMPv3 devices use stronger encryption (AES, DES3)
29
Network Sensors
Monitor the performance of network devices
30
Packet Capture
Used to capture data going to or from a network device
31
Full Packet Capture (FPC)
Captures the entire packet including the header and payload
32
Flow Analysis
Recording metadata and stats about your network traffic, instead of every single packet, using a flow collector
33
Flow Analysis benefits
Highlights trends and patterns
34
What are some tools used for traffic flow analysis?
- NetFlow - Zeek - MRTG
35
NetFlow
Cisco-Developed means of reporting network flow information to a structured database. Captures meta data but cannot do full packet capture.
36
Zeek
A hybrid tool that passively monitors networks like a sniffer but can be configure to perform Full packet captures for data packets of particular interest.
37
Multi Router Traffic Grapher (MRTG)
Creates graphs to show network traffic flows going through different network objects & interfaces
38
System Logging Protocol (Syslog)
Sends System Log or even messages to a central server, called a syslog server
39
T/F Syslog Server configuration requires a Client and a Server
TRUE
40
What does Each component do in a syslog server configuration?
Client - end point device that reports it's log data to syslog server Server - Receives and stores log data from clients
41
What port is used for Syslog traffic?
port 514 with UDP port 1468 with TCP
42
How many Severity levels are there in Syslog?
8 levels starting at 0 counting up to 7, with 0 being the most severe.
43
Syslog Severity levels
0 (emergency) - unstable system 1 (Alert) - requires urgent correction 2 (Critical) - System failure needs immediate attention 3 (Error) - something preventing proper system function 4 (Warning) - Error will occur w/o further action 5 (Notice) - Unusual events 6 (Information) - normal operational message 7 (debugging) - useful Developer information
44
Traffic Logs
Contains information about the traffic flows on the network
45
Audit Log/Audit Trail
Contains a sequence of events for a particular activity
46
what are the 3 main log types for windows systems?
- Application Logs - Security Logs - System Logs
47
Application Log (WIN)
Contains info about software running on a client or server
48
Security Log (WIN)
Contains info about the security of a client or server
49
System Log (WIN)
Contains info about the OS itself
50
What are the 3 severity levels in a windows Application/system log?
- Informational - Warning - Error
51
Security Information and Event Management (SIEM)
Provides real-time or near-real-time analysis of security alerts generated by network hardware and applications
52
What are the 5 essential functions of a SIEM?
- Log collection - Normalization - Correlation - Aggregation - Reporting
53
Log Collection (SIEM)
Forensic tools are used to address compliance reporting requirements
54
Normalization (SIEM)
Maps log messages into a common data model. so related events can be connected and analyzed
55
Correlation (SIEM)
Links logs/events from different systems/apps into a single data feed
56
Aggregation (SIEM)
Reduces the volume of event data by consolidating duplicate event records and merging into a single record
57
Reporting (SIEM)
Presents the correlated, aggregated event data in real-time monitoring dashboards for analysts or long-term summaries for management
58
What ways can a SIEM be implemented?
- As Software - As Hardware - As a Managed Service
59
Network Performance Monitoring
End to End network monitoring of the end user experience
60
Link State
Communicates whether a given interface has a cable connected to it and a valid protocol to use for communication
61
Drop
The Count of dropped packets
62
Flush
The Count of Selective Packet discards (SPD) (when the router decides it needs to load-shed and drops packets selectively)
63
Selective Packet Discards (SPD)
Drops low priority packets when the CPU is too busy, to save capacity for higher priority packets
64
Runt
An Ethernet frame that is less than 64 bytes in size
65
Giant
Ethernet frame that exceeds the 802.3 frame size of 1518 bytes
66
Throttle
Occurs when the interface fails to buffer the incoming packets
67
CRC
Number of packets received that failed the cyclic redundancy checksum, or CRC check upon receipt
68
Frame
Counts the number of packets where a CRC error and a non-integer number of octets was received
69
Overrun
Counts how often the interface was unable to receive traffic due to an insufficient hardware buffer
70
Ignored
Counts the number of packets that the interface ignored since the hardware interface was low on buffers
71
Babble
Used to count any frames that are transmitted and are larger than 1518 bytes
72
Late Collision
Count of collisions that occur after the interface has started transmitting its frame
73
Deferred
Used to count the number of frames that were transmitted successfully after waiting because the media was busy
74
Output Buffer Failure
Number of times a packet was not output from the output hold queue because of a shortage of shared memory
75
Output Buffer Swapped Out
Number of packets stored in main memory when the queue is full
76
Port Mirroring
a technique where network traffic on a specific port is duplicated and sent to another port on the same switch for monitoring and analysis

CompTIA Network+(N10-009) (26 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions