ISC2 Domain 4: Network Security

What is a network?

two or more computers linked together to share data

What does LAN stand for?

Local Area Network

What does WAN stand for?

Wide Area Network

What are these?

• Hubs

• Firewall

• Switch

• Server

• Router

• Endpoint

Network Devices

What are Hubs and what are they used for?

Wired devices used to connect multiple devices in a network

What is a firewall?

A network device used to filter incoming traffic

What are Switches?

Wired devices that know the addresses of devices connected to them so that they can direct traffic to the right port/device

What is a server?

a computer that provides information to other computers on a network

What is a router used for?

used to control traffic flow on networks, and are often used to connect similar networks and control traffic flow between them

What are endpoints?

the ends of a network communication link

What is a standard that defines wired connections between networked devices and defines the way data is formatted?

Ethernet (IEEE 802.3)

What does MAC stand for?

Media Access Control

What is a MAC address?

A unique ID that is given to every network device, which defines certain things such as the vendor or manufacturer of the physical network interface

What does IP stand for?

Internet Protocol

What is the difference between a MAC address and an IP address?

A MAC address is typically assigned in the firmware, while an IP address represents the network interface within the network

In a network diagram where does the firewall lie between?

The router and the switch

What is the ultimate end state of the defense-in-depth philosophy?

Microsegmentation

What does IDS stand for?

Intrusion Detection System

What does an IDS do?

automates the inspection of logs and real-time system events to detect intrusion attempts and system failures

______ monitors a single computer or host wile _____ monitors a network by observing network traffic patterns.

Host-based IDS and Network-based IDS

Why can NIDS detect intrusions on the computer but HIDS can?

HIDS has much more detailed monitoring on the computer than NIDS because of the administrative access

What does SIEM stand for?

Security Information and Event Management

How does a SIEM solution help defense-in-depth?

It collects the information from multiple tools to better understand security concerns

What does VPN and SDN stand for?

Virtual Private Network and Software-designed networking

What security principle does microsegmentation help the most?

least privileged

What does IPS stand for?

Intrusion Prevention services

What does IAM stand for?

identity and access management

Firewalls can manage traffic at layers 2, 3 and 7, what are those layers?

2. MAC Address

3. IP Ranges

7. Application Programming Interface (API)

What is a distinguishing difference between an IDS and an IPS?

The IPS is placed in line with traffic

What does DMZ stand for?

Demilitarized Zone

What is DMZ used for?

Network Segmentation

What is a point-to-point connection between two hosts that allows them to communicate?

VPN

What is an alternative to expensive point-to-point connections?

gateway-to-gateway VPNs

Rather than a DMZ network, what do other organizations use?

Web-application Firewall

What does a WAF do?

Monitors all traffic from the outside for maliscous behavior before passing commands to a web server

What does VLAN stand for?

Virtual Local Area Network

What do VLANs allow network administrators to do?

use swtches to create software based LAN segments

Why is an abnormal system shutdown in a data center a concern?

It may result in the loss or corruption of data

What is network monitoring or sniffing?

Monitoring traffic patterns to obtain informaion about a network

What are the 3 stages of a TCP connection

SYN, SYN-ACK, ACK Handshake

What is SaaS, Paas and IaaS?

Cloud computing service models

What do Managed Service Providers (MSP) do for other companies?

Manage information technology assets

What does MDR stand for?

Managed Detection and Response

What organization has the most commonly used definition of cloud computing?

NIST

What type of agreement is used between a cloud service and their customer?

Service-level agreement

What is the main purpose of an SLA?

To document specific parameters and minimum service levels

What is the main goal of network segmentation?

control traffic among networked devices

What is often the host of public web, email, file, and other resource servers?

DMZ

What are created by switches to logically segment a network without altering its physical topology?

VLANs

What concept controls access to an environment
through strict adherence to and implementation of security policy?

Network Access Control (NAC)

What is an example of a NAC network?

hotel Wifi

What are well-known ports (0-1023) associated with?

Common protocols at the core of TCP/IP

What are the 2 basic layers in a network?

Application and Data Transport

What is the main purpose of the application layer?

Manages, formats, and enables communication sessions between computers

What is the main purpose of the data transport layer?

Converts raw bits into standardized frames and adds routing information to create packets for transport.

What are the 4 layers of the TCP/IP Protocol?

1. Application layer

2. Transport layer

3. Internet layer

4. Network Interface layer

What is the OSI Model?

A common way to describe the communication structure for interconnected systems

How many layers are in the OSI Model?

7

From the first layer to the last in the OSI model, what is partially removed during each layer?

The header and footer

What are the 4 cloud deployment models?

1. Public

2. Private

3. Hybrid

4. Community

What does CSP stand for?

Cloud Service Provider

What type of network does this depict?

A Zero trust network

What are Man-in-the-middle attacks also called?

On-path attacks

Whats the difference between side channel and on-path attacks?

Side channel attacks are used specifically for data survelience while on-path attacks change the integrity of the data

What threats arise from individuals from inside the organization?

Insider threats

What type of threats are mainly caused by hacker groups and can last months to even years?

Advanced Persistent Threats

What is the difference between a worm and a virus?

a worm is self-replicating without human interaction

What type of attack is this: An attack against the availability of a network/system; typically uses many attacking machines to direct traffic against a given target.

Distributed Denial of Service

What does this picture depict?

IPv4 Address

How many bits is an IPv6 address?

128

What did network designers create to reuse IP addresses?

Private address groups

What IP version is formatted as a 8 groups of 4 digits with a : as the separator?

IPv6

What is the purpose of a subnet mask in IPv4?

it defines the part of the address used for the subnet

What are 4 insecure protocols?

1. HTTP

2. IMAP

3. FTP

4. Telnet