Jeremy's IT Lab CCNA Security Fundamentals Day 48

[...] are a form of authentication often used to prove the identity of a website.

Digital certificates

[...] are malware that infect other software, called a host program.

Viruses

[...] are malware that is disguised as legitimate software.

Trojan horses

[...] are standalone malware that spread on their own, without user interaction.

Worms

[...] attacks are used to gather information about a target.

Reconnaissance

[...] attacks compromise sites that the target victim frequently visits.

Watering hole

[...] attacks involve entering restricted, secured areas by walking in behind an authorized person as they enter.

Tailgating

[...] attacks involve psychological manipulation to make the target reveal confidential information or perform some other action.

Social engineering

[...] is a kind of phishing targeted at high-profile individuals.

Whaling

[...] is a kind of social engineering which typically involves fraudulent emails that try to appear legitimate.

Phishing

[...] is a more targeted form of phishing, for example aimed at employees of a certain company.

Spear phishing

[...] is phishing performed over the phone.

Vishing

[...] is phishing using SMS text messages.

Smishing

[...] programs are designed to make employees aware of potential security threats and risks.

User awareness

[...] programs are formal sessions which educate users on corporate security policies and issues.

User training

[...] protects equipment and data from potential attackers by only allowing authorized users into protected areas such as network closets.

Physical access control

[...] refers to a variety of harmful programs that can infect a computer.

Malware

A [...] attack runs through a list of common words or passwords to find the target's password.

dictionary

A [...] attack tries every possible combination of letters, numbers, and special characters to guess the target's password.

brute force

A [...] is any potential weakness that can compromise the security of a system.

vulnerability

A [...] is the potential of a vulnerability to be exploited.

threat

A [...] technique is something that can protect against threats.

mitigation

A TCP [...] attack exploits the TCP three-way handshake.

SYN flood

A TCP SYN flood results in a [...] on the target.

denial-of-service

AAA: [...] is the process of granting a user the appropriate access and permissions.

Authorization

AAA: [...] is the process of recording the user's activities on the system.

Accounting

AAA: [...] is the process of verifying a user's identity.

Authentication

An [...] attack is a more dangerous kind of reflection attack.

amplification

An [...] is something that can potentially be used to take advantage of a vulnerability.

exploit

ARP spoofing is also known as [...].

ARP poisoning

CIA Triad: [...] = data should not be tampered with by unauthorized users.

Integrity

CIA Triad: [...] = only authorized users should be able to access data.

Confidentiality

CIA Triad: [...] = the network/systems should be operational and accessible to authorized users.

Availability

Cisco's AAA server is [...]

ISE

In a [...] attack, an attacker causes a reflector to send traffic to the target.

reflection

In a [...] attack, an attacker floods the target with DHCP Discover messages.

DHCP exhaustion

In a [...] attack, the attacker intercepts communications between two devices.

man-in-the-middle

In an [...] attack, an attacker sends fraudulent ARP replies.

ARP spoofing

RADIUS uses [...] ports 1812 and 1813.

UDP

RADIUS uses UDP ports [...] and [...].

1812 / 1813

TACACS+ uses [...] port 49

TCP

TACACS+ uses TCP port [...]

49

To [...] an address is to use a fake source address (IP/MAC)

spoof

What are the three factors of multi-factor authentication?

Something you know

Something you have

Something you are

What does AAA stand for?

Authentication, Authorization, and Accounting

What does Cisco ISE stand for?

Identity Services Engine

What does DDoS attack stand for?

distributed denial-of-service

What does DoS attack stand for?

denial-of-service

What does MFA stand for?

Multi-factor authentication

What is the A of the CIA triad?

Availability

What is the C of the CIA triad?

Confidentiality

What is the I of the CIA triad?

Integrity

Which AAA protocol is an open standard?

RADIUS

Which AAA protocol is Cisco proprietary?

TACACS+