Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CompTIA Network+ (N10-008) > Security Technologies (1.5, 2.1, 3.1, 4.1, 4.3 & 4.4) > Flashcards

Security Technologies (1.5, 2.1, 3.1, 4.1, 4.3 & 4.4) Flashcards

(85 cards)

Start Studying
1
Q

Firewall

A

o Uses a set of rules defining the traffic types permitted or denied through device
▪ Software or hardware
▪ Virtual or physical
▪ Host-based or network-based
▪ Can perform Network Address Translation (NAT) and/or Port Address
Translation (PAT)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Stateful Firewall

A

▪ Inspects traffic as part of a session and recognizes where the traffic
originated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

NextGen Firewall (NGFW)

A

▪ Third-generation firewall that conducts deep packet inspection and
packet filtering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Access Control List (ACL)

A

▪ Set of rules applied to router interfaces that permit or deny certain traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Switch

A

o MAC address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Router

A

o IP address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Switch Firewall

A

o IP address or port
▪ Source/destination IP
▪ Source/destination port
▪ Source/destination MAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Firewall Zone

A

▪ Firewall interface in which you can set up rules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Inside

A

o Connects to corporate LAN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Outside

A

o Connects to the Internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Demilitarized Zone (DMZ)

A

o Connects to devices that should have restricted access

from the outside zone (like web servers)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Unified Threat Management (UTM) Device

A

▪ Combines firewall, router, intrusion detection/prevention system, antimalware, and other features into a single device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Signature-based Detection

A

▪ Signature contains strings of bytes (a pattern) that triggers detection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Policy-based Detection

A

▪ Relies on specific declaration of the security policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Statistical Anomaly-based Detection

A

▪ Watches traffic patterns to build baseline

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Non-statistical Anomaly-based Detection

A

▪ Administrator defines the patterns/baseline

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Network-based (NIDS/NIPS)

A

o A network device protects entire network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Host-based (HIDS/HIPS)

A

o Software-based and installed on servers and clients
▪ Network and host-based systems can work together for a more complete
protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Telnet Port 23

A

▪ Sends text-based commands to remote devices and is a very old
networking protocol
▪ Telnet should never be used to connect to secure devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Secure Shell (SSH) Port 22

A

▪ Encrypts everything that is being sent and received between the client
and the server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Remote Desktop Protocol (RDP) Port 3389

A

▪ Provides graphical interface to connect to another computer over a
network connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Remote Desktop Gateway (RDG)

A

▪ Provides a secure connection using the SSL/TLS protocols to the server
via RDP
● Create an encryption connection
● Control access to network resources based on permissions and
group roles
● Maintain and enforce authorization policies
● Monitor the status of the gateway and any RDP connections
passing through the gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Virtual Private Network (VPN)

A

▪ Establishes a secure connection between a client and a server over an
untrusted public network like the Internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Virtual Network Computing (VNC) Port 5900

A

▪ Designed for thin client architectures and things like Virtual Desktop
Infrastructure (VDI)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Virtual Desktop Infrastructure (VDI)
▪ Hosts a desktop environment on a centralized server | ▪ Desktop as a Service (DaaS)
26
In-Band Management
▪ Managing devices using Telnet or SSH protocols over the network
27
Out-of-Band Management
▪ Connecting to and configuring different network devices using an alternate path or management network ▪ Prevents a regular user’s machine from connecting to the management interfaces of your devices ▪ Out-of-band networks add additional costs to the organization
28
Authentication
▪ Confirms and validates a user’s identity | ▪ Gives the user proper permissions to access a resource
29
Password Authentication Protocol (PAP)
▪ Sends usernames and passwords in plain text for authentication
30
Challenge Handshake Authentication Protocol (CHAP)
▪ Sends the client a string of random text called a challenge which is then encrypted using a password and sent back to the server
31
MS-CHAP
▪ Microsoft proprietary version that provides stronger encryption keys and mutual authentication
32
Extensible Authentication Protocol (EAP)
▪ Allows for more secure authentication methods to be used instead of just a username and a password ▪ Use EAP/TLS in conjunction with a RADIUS or TACACS+ server
33
Virtual Private Networks (VPNs)
o Extends a private network across a public network and enables sending and receiving data across shared or public networks ▪ Site to site ▪ Client to site ▪ Clientless
34
Virtual Private Networks (VPNs)
o Extends a private network across a public network and enables sending and receiving data across shared or public networks ▪ Site to site ▪ Client to site ▪ Clientless
35
Full Tunnel VPN
▪ Routes and encrypts all network requests through the VPN connection back to the headquarters
36
Split Tunnel VPN
▪ Routes and encrypts only the traffic bound for the headquarters over the VPN, and sends the rest of the traffic to the regular Internet ● For best security, use a full tunnel ● For best performance, use a split tunnel
37
Clientless VPN
ientless VPN ▪ Creates a secure, remote-access VPN tunnel using a web browser without requiring a software or hardware client
38
Secure Socket Layer (SSL)
▪ Provides cryptography and reliability using the upper layers of the OSI model, specifically Layers 5, 6, and 7
39
Transport Layer Security (TLS)
▪ Provides secure web browsing over HTTP ▪ SSL and TLS use TCP to establish their secure connections between a client and a server
40
Datagram Transport Layer Security (DTLS)
▪ UDP-based version of the TLS protocol which operates a bit faster due to having less overhead
41
Layer 2 Tunneling Protocol (L2TP)
▪ Lacks security features like encryption by default and needs to be combined with an extra encryption layer for protection
42
Layer 2 Forwarding (L2F)
▪ Provides a tunneling protocol for the P2P protocol but also lacks native security and encryption features
43
Point-to-Point Tunneling Protocol (PPTP)
▪ Supports dial-up networks but also lacks native security features except when used with Microsoft Windows
44
IP Security (IPSec)
▪ Provides authentication and encryption of packets to create a secure encrypted communication path between two computers
45
IP Security (IPSec)
o Provides authentication and encryption of data packets to create an secure encrypted communication path between two computers
46
Confidentiality
● Using data encryption
47
Integrity
● Ensuring data is not modified in transit
48
Authentication
● Verifying parties are who they claim to be
49
Anti-Replay
``` ● Checking sequence numbers on all packets prior to transmission o Key exchange request o IKE Phase 1 o IKE Phase 2 o Data transfer o Tunnel termination ```
50
Main Mode
▪ Conducts three two-way exchanges between the peers, from the initiator to the receiver
51
First Exchange
o Agrees upon which algorithms and hashes will be used to | secure the IKE communications throughout the process
52
Second Exchange
o Uses a Diffie-Hellman exchange to generate shared secret keying material so that the two parties can prove their identities
53
Third Exchange
o Verifies the identity of the other side by looking at an | encrypted form of the other peer’s IP address
54
Authentication methods used
▪ Encryption and hash algorithms used ▪ Diffie-Hellman groups used ▪ Expiration of the IKE SA ▪ Shared secret key values for the encryption algorithms
55
Aggressive Mode
▪ Uses fewer exchanges, resulting in fewer packets and faster initial connection than main mode ● Diffie-Hellman public key ● Signed random number ● Identity packet ● Negotiate the IPSec SA parameters protected by an existing IKE SA ● Establish IPSec SA ● Periodically renegotiate IPSec SAs to maintain security ● Perform additional Diffie-Hellman exchanges, if needed
56
Quick Mode
▪ Only occurs after IKE already established the secure tunnel in Phase 1 using either main or aggressive mode
57
Diffie-Hellman Key Exchange
▪ Allows two systems that don’t know each other to be able to exchange keys and trust each other ● PC1 sends traffic to PC2 and then RTR1 initiates creation of IPSec tunnel ● RTR1 and RTR2 negotiate Security Association (SA) to form IKE Phase 1 tunnel (ISAKMP tunnel) ● IKE Phase 2 tunnel (IPSec tunnel) is negotiated and set up ● Tunnel is established and information is securely sent between PC1 and PC2 ● IPSec tunnel is torn down and the IPSec SA is deleted
58
Transport Mode
▪ Uses packet’s original IP header and used for client-to-site VPNs ▪ By default, maximum transmission unit (MTU) size in most networks is 1500 bytes
59
Tunneling Mode
▪ Encapsulates the entire packet and puts another header on top of it ▪ For site-to-site VPNs, you may need to allow jumbo frames ● Transport o Client to site ● Tunneling o Site to site
60
Authentication Header (AH)
▪ Provides connectionless data integrity and data origin authentication for IP datagrams and provides protection against replay attacks
61
Encapsulating Security Payload (ESP)
▪ Provides authentication, integrity, replay protection, and data confidentiality ▪ In transport mode, use AH to provide integrity for the TCP header and ESP to encrypt it ▪ In tunneling mode, use AH and ESP to provide integrity and encryption of the end payload
62
Simple Network Management Protocol (SNMP)
Simple Network Management Protocol (SNMP) is used to send and receive data from managed devices back to a centralized network management station
63
Managed Device
▪ Any device that can communicate with an SNMP manager known as the management information base (MIB)
64
Granular
▪ Sent trap messages get a unique objective identifier to distinguish each message as a unique message being received
65
Management Information Base (MIB)
▪ The structure of the management data of a device subsystem using a hierarchical namespace containing object identifiers
66
Verbose
▪ SNMP traps may be configured to contain all the information about a given alert or event as a payload
67
SNMPv1 and SNMPv2
▪ Use a community string to give them access to the device as their security mechanism ▪ Default community strings of public (read-only) or private (read-write) devices are considered a security risk
68
SNMPv3
▪ Provides three security enhancements which added integrity, authentication, and confidentiality to the SNMP protocol
69
Integrity
o message hashing
70
Authentication
o source validation
71
PoE+ 802.3at Confidentiality
o DES 56-bit encryption
72
System Logging Protocol (Syslog)
▪ Sends system log or event messages to a central server, called a syslog server ● Security Information Management (SIM) ● Security Event Management (SEM) ● Security Information and Event Management (SIEM)
73
Client
▪ Device sending the log information to the syslog server
74
Server
▪ Receives and stores the logs from all of the clients
75
Traffic Log
▪ Contains information about the traffic flows on the network ▪ Traffic logs allow for investigation of any abnormalities
76
Audit Log/ Audit Trail
▪ Contains a sequence of events for a particular activity
77
Application Log
▪ Contains information about software running on a client or server ● Informational ● Warning ● Error
78
Security Log
▪ Contains information about the security of a client or server
79
System Log
▪ Contains information about the operating system itself
80
Security Information and Event Management (SIEM)
o Provides real-time or near-real-time analysis of security alerts generated by network hardware and applications - Gathers logs and data from all sorts of different systems
81
Log Collection
o Provides important forensic tools and helps address | compliance reporting requirements
82
Normalization
o Maps log messages into a common data model, enabling the | organization to connect and analyze related events
83
Correlation
o Links the logs and events from different systems or | applications into a single data feed
84
Aggregation
o Reduces the volume of event data by consolidating duplicate event records and merging them into a single record
85
Reporting
o Presents the correlated, aggregated event data in real-time monitoring dashboards for analysts or long-term summaries for management ▪ Software ▪ Hardware ▪ Managed service ▪ Log all relevant events and filter out anything that is considered to be irrelevant data ▪ Establish and document the scope of the events ▪ Develop use cases to define a threat ▪ Plan incident responses for given scenarios or events ▪ Establish a ticketing process to track all the flagged events ▪ Schedule regular threat hunting with cybersecurity analysts ▪ Provide auditors and analysts an evidence trail ▪ Syslog protocol using UDP Port 514 or TCP Port 1468

CompTIA Network+ (N10-008) (23 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions