CISA Domain 5 Part 2

What is a hub? Which layer does it operate on?

A hub is a basic networking device used to connect multiple computers in a local network. It works at the Physical Layer (Layer 1) of the OSI model and simply broadcasts incoming data to all connected devices, regardless of the intended recipient. Because it does not filter or direct traffic intelligently, hubs create unnecessary network traffic and collisions. Due to poor efficiency and security, hubs are now largely obsolete and replaced by switches.

A hub operates at the Physical layer because it only deals with electrical signals. It does not understand data, addresses, or destinations. When a signal enters one port, it is copied and sent to all other ports. Because it cannot filter traffic, hubs create unnecessary network traffic and are rarely used in modern networks

What is a switch? Which layer does it operate on?

A switch is an intelligent device that connects multiple devices within a local area network (LAN). Operating at the Data Link Layer (Layer 2), it uses MAC addresses to identify devices and forwards data only to the intended recipient. This reduces collisions and improves network performance.

A switch operates at the Data Link layer and uses MAC addresses to forward data frames. Instead of broadcasting data to all devices, it sends data only to the intended destination, improving efficiency and reducing congestion

What is a bridge? Which layer does it operate on?

A bridge connects two network segments and controls traffic between them. It operates at Layer 2 and filters data using MAC addresses, allowing only relevant traffic to pass between segments. This helps reduce network congestion and improves performance. Bridges were commonly used to divide networks into smaller segments, but their functionality is now mostly integrated into switches.

Layer 2 – Data Link Layer. A bridge connects two LAN segments and filters traffic using MAC addresses. It forwards data only when necessary, reducing traffic and improving network performance.

What is a repeater? Which layer does it operate on?

A repeater is a Layer 1 device that receives a signal, regenerates it, and retransmits it. A repeater extends the distance of a network by regenerating and strengthening weak signals. It operates at the Physical Layer (Layer 1). Repeaters are useful in large buildings or long-distance communication links where signal strength may degrade over distance.

A repeater regenerates and strengthens weak electrical signals so they can travel longer distances. It does not understand data content or addresses. Its only function is to maintain signal quality over long cable runs.

What is a router? Which layer does it operate on?

A router is a networking device that connects multiple networks and directs data between them using IP addresses. It operates at the Network Layer (Layer 3) and determines the best path for data packets to reach their destination.

A router operates at the Network layer and uses IP addresses to route packets between different networks. It determines the best path for data to reach its destination.

What is a gateway? Which layer does it operate on?

A gateway is a device that enables communication between different networks that use different protocols, architectures, or data formats. It acts as a translator, ensuring that data sent from one system can be understood by another. Gateways can operate at multiple OSI layers depending on their function. For example, an email gateway translates messages between different mail systems, while a VoIP gateway converts voice signals between traditional telephone networks and IP networks. In many home or office networks, the router often functions as the default gateway, allowing devices to access external networks such as the internet.

Why is a Switch more intelligent than a Hub?

Because it learns MAC addresses, sends data only to the intended recipient, reduces collisions, and reduces network traffic.

(This intelligence improves network performance and prevents unnecessary data transmission.)

What is the key difference between a Bridge and a Switch?

Bridge → few ports; Switch → many ports.

(A switch is essentially a multi-port bridge designed for modern networks.)

What is the main difference between a Router and a Switch?

Router → Layer 3, uses IP address, connects different networks

Switch → Layer 2, uses MAC address, connects devices within the same network

(Routers manage inter-network communication, while switches manage local network communication.)

Which device has the capability to store frames and act as a storage and forward device?

A Bridge/Switch

What is Attenuation?

Attenuation refers to the weakening of signal strength as it travels through a transmission medium. It occurs due to resistance, distance, and environmental conditions. Excessive attenuation can lead to data errors and communication failure, and longer cable lengths increase signal loss.

Attenuation occurs in both wired and wireless communication. In wired media, resistance and cable length cause signal loss, while in wireless communication, distance, obstacles, and atmospheric conditions weaken the signal.

What is EMI?

EMI (Electromagnetic Interference) is interference caused by external electromagnetic sources that introduce noise into signals and disrupt transmission. Common sources include electrical storms, lightning, motors, fluorescent lighting, power lines, and heavy machinery.

What is Cross Talk?

Cross talk is interference between adjacent cables. It occurs when signals from one cable interfere with signals in an adjacent cable. It is most common in Unshielded Twisted Pair (UTP) cables because they lack shielding, making them more susceptible to signal leakage.

Best Practices to Reduce Transmission Errors?

• separating electrical cables from data cables to reduce EMI

• using shielded cables in high-noise environments

• using repeaters or boosters to maintain signal strength over long distances.

What is a dedicated line?

A dedicated line is used exclusively by one organization rather than shared with others. This reduces the risk of interception and provides better security and reliability compared to shared transmission media.

What are the types of Twisted Pair Cables?

Unshielded Twisted Pair (UTP) and Shielded Twisted Pair (STP). UTP is commonly used in homes and offices because it is cost-effective and easy to install. STP includes a metallic shield around the wires to protect against interference, making it suitable for industrial environments or areas with high electrical noise.

What is a Twisted Pair Cable?

Twisted pair cable consists of two insulated copper wires twisted around each other, with electrical current flowing in opposite directions. The twisting helps cancel electromagnetic fields, which reduces electromagnetic interference (EMI) and cross talk, thereby improving signal quality. Because it is inexpensive, flexible, and easy to install, twisted pair cable is widely used in Ethernet networks and telephone systems.

What is the difference between UTP and STP?

UTP does not have shielding, making it more vulnerable to interference, attenuation, and cross talk. STP includes shielding that protects signals from external interference and prevents signal leakage, resulting in lower attenuation and reduced cross talk. While UTP is cheaper and more flexible, STP is preferred where maintaining signal integrity is critical.

What is a fiber optic cable?

Fiber optic cable transmits data in the form of light pulses rather than electrical signals. Because it does not emit electromagnetic radiation, it is immune to EMI and cross talk. Fiber optic cables are difficult to tap without detection, have very low transmission loss, and provide extremely high bandwidth, making them ideal for secure and long-distance communication.

Which is the most secure medium to transmit data/media?

Fiber optic cable is considered the most secure transmission media because it does not radiate signals that can be intercepted, is immune to interference, and tapping usually causes signal loss that can be detected. These properties make unauthorized interception extremely difficult.

Which is the preferred Medium for High Volume and Long-Distance Communication

Fiber optic cable is preferred for high-volume and long-distance communication because it supports very high bandwidth and transmits data over long distances with minimal signal loss. It is widely used in telecommunications, internet backbone infrastructure, and high-speed data centers.

What are Coaxial Cables?

Coaxial cable consists of a central copper conductor surrounded by insulation and shielding. This shielding protects signals from interference and leakage, making coaxial cable more secure than twisted pair. It is relatively easy to install and widely available, but it is more expensive, distance sensitive, and difficult to modify once installed.

Ranks the transmission mediums from most secure to least secure?

1. Fiber optic

2. Coaxial

3. STP

4. UTP

Best practices to reduce transmission errors?

• Use shielding (STP or coaxial) in noisy environments

• Separate power cables and data cables to reduce EMI

• Use repeaters or boosters for long distances

• Use fiber optic for high security and long-distance transmission

Which transmission media has lowest attenuation?

Fiber optic cable.

(Light signals experience significantly less signal loss compared to electrical signals in copper cables, enabling long-distance transmission.)

What is NAS?

Network Attached Storage, or NAS, is a type of storage device that connects to a network, allowing multiple users and devices to store and retrieve data from a central location. Think of NAS as a personal cloud that sits in your home or office. Instead of having your files spread across different computers and devices, NAS provides a single place to keep everything together, making it easier to access, share, and manage your data.

What is CDN?

A Content Delivery Network, or CDN, is a system of servers distributed around the world that work together to deliver internet content quickly and efficiently. CDNs are designed to speed up the delivery of websites, videos, images, and other types of content by bringing them closer to the users who are requesting them.

Practical Example

Imagine you're running a popular blog with readers from around the world. Without a CDN, readers in different countries would have to access your blog from a single server, which might be located far from them. This could make your site load slowly for some readers. Here’s how a CDN can help:

Content Distribution: You sign up for a CDN service. The CDN copies your blog's content and stores it on multiple servers around the world.

Faster Load Times: When someone from Asia visits your blog, the CDN delivers the content from a server located in Asia, rather than from your main server in North America. This reduces the distance the data has to travel, making your site load faster for the reader.

Handling Traffic: If your blog suddenly gets a spike in traffic, the CDN can handle it better than a single server, distributing the load across multiple servers.

What is NTP?

Network Time Protocol, or NTP, is a system used to synchronize the clocks of computers over a network. It's like having a universal clock that ensures all devices are telling the same time. This is important for various applications, such as logging events, scheduling tasks, and maintaining security.

How Does NTP Work?

NTP works by having a network of servers that provide accurate time information. These servers get their time from highly precise sources like atomic clocks or GPS signals. When your computer or device connects to an NTP server, it adjusts its clock to match the time provided by the server. This process happens regularly to keep the device's clock accurate.

What is network segmentation?

Network segmentation is the practice of dividing a larger network into smaller, separate sections or segments. Each segment operates independently, but they can communicate with each other as needed. This helps improve security, performance, and management of the network by isolating different parts of the network from one another.

How Does Network Segmentation Work?

Network segmentation involves creating virtual or physical boundaries within your network. These boundaries can be set up using different methods, such as:

VLANs (Virtual Local Area Networks): VLANs create separate network segments within the same physical network infrastructure.

Firewalls: Firewalls can be used to control and limit traffic between different segments.

Subnets: Subnets divide a larger network into smaller, more manageable pieces with their own unique IP address ranges.

Which of the following is a major concern regarding the use of the DHCP?

A. Use of application layer firewall

B. Access to the network port is not restricted

C. Antivirus Software is updated every month

D. Two factor authentication is implemented

B. Access to the network port is not restricted

because unrestricted access to network ports allows unauthorized devices to connect and be assigned IP addresses via DHCP, increasing the risk of security breaches. It's essential to control physical access to network ports to protect the network from potential threats.

The most effective method for restricting an unauthorized internet site is:

A. The installation of an IDS

B. A content filtering proxy server for outbound traffic

C. A content filtering proxy server for inbound traffic

D. Installing client software on each PC computer to restrict web content

B. A content filtering proxy server for outbound traffic

because this method effectively blocks unauthorized internet sites by monitoring and controlling the traffic leaving your network, ensuring that users cannot access restricted content. This choice aligns with the objective of implementing effective internet safety measures by filtering outbound traffic for improved security.

The best control for an internet-based business that is seeking confidentiality, reliability, and integrity of the data is:

A. a router

B. an IDS

C. a secure socket layer

D. an IPS

C. a secure socket layer

because it encrypts data transmitted over the internet, ensuring the confidentiality, reliability, and integrity of sensitive information, which is essential for any internet-based business. This aligns directly with the goal of protecting data during transmission.

Which should be determined first by an IS auditor while reviewing network security?

A. The factor of authentication

B. The firewall configuration

C. An evaluation of the vulnerability assessment report

D. The network entry points

The network entry points. The first thing an IS auditor should review is the network diagram, this will help the auditor determine the network entry points, the placement of network devices, and how they interact with each other.

Disabling the dynamic host configuration protocol:

A. is not suitable for high volume traffice

B. will automatically allot IP addresses to any device on the network

C. reduces the risk of unauthorized access to networks

D. is not suitable for wireless networks

C. reduces the risk of unauthorized access to networks

Disabling DHCP is crucial because it means that devices can no longer automatically join the network without explicit permission, reducing the risk of unauthorized access. This directly aligns with the learning objective of understanding network security measures and fosters a safer environment by controlling which devices can connect.

An organization has one wired as well as one wireless local area network (WLAN). A wired network is used to store and transmit sensitive data, and a wireless network is used for other general purposes. A few employees with wireless access are required to access customer information. Which of the following is the best way to separate both the networks?

A. Separate both networks physically

B. Implement a firewall between both networks

C. Implement an IDS between both networks

D. Implement a VLAN between both networks

B. Implement a firewall between both networks.

The best way is a firewall. It will allow only authorized users on the wireless network to access the wires network. A VLAN would be less secure than a firewall. The function of an IDS is to detect an intrusion so that would not help. If both networks were physically separated, then it would not be possible for the authorized wireless users to access the data.

Which of the following will help to protect a network from acting as a zombie in a denial-of-service attack?

A. Deny all incoming traffic with the source address of the critical host.

B. Deny all incoming traffic with the spoofed source IP

C. Deny all incoming and outgoing traffic for the critical host

D. Deny all outgoing traffic with external source addresses.

D. Deny all outgoing traffic with external source addresses.

In a zombie attack, compromised computers will send huge amounts of traffic to outside networks. But in this case, the source address will be other than the interal IP range. Denying the traffic of the source address external to the network will afford protection from a DoS attack.

Which of the following is the most appropriate security control for implementing a wireless local area network (WLAN)?

A. Enable a SSID for the network

B. Enable a DHCP

C. The physical security of wireless access points.

D. Enable an SNMP to monior the network

C. The physical security of wireless access points.

It is important to have restricted access to wireless devices such as routers in order to protect the same from misconfiguration or theft. If access points are not physically protected, intruders can change the configuration and gain access to the network. An SSID, DHCP, and SNMP should be disabled for the protection of wireless security.

Which should be identified first by an IS auditor while reviewing network security?

A. Determine the importance of network device in topology

B. Determine the lack of network devices

C. Determine the placement of network devices

D. Determine the integration of network devices.

A. Determine the importance of network device in topology.

The first procedure is to determine the use and importance of network devices in the topology. Once the auditor becomes familiar with the topology, he may evaluate the appropriate placement, integration, and the lack of network devices.

it lays the foundational understanding for an IS auditor to assess the network's security by first recognizing how devices are used within the topology. This initial step is essential for evaluating their optimal placement, integration, and overall effectiveness in protecting the network.