1
Q
What are some examples of Fault Tolerance?
A
RAID
UPS
Clustering
Load balancing
Any redundant hardware components or network paths
2
Q
What does “High Availability” mean?
A
Automatic fault tolerance such that there is essentially zero down time.
3
Q
What is NIC Teaming?
A
- Multiple network adapters combined in software to work as a single adapter.
- Used particularly in virtualization / SDN.
- Aggregates bandwidth and provides redundant paths.
- NICs communicate with each other to fail over when a NIC doesn’t respond.
- LBFO: Load Balancing / Fail Over.
4
Q
What is Port Aggregation?
A
Using multiple interfaces as a single port, which provides redundancy. If used across multiple switches, it provides fault tolerance.
5
Q
What is a Cold Site?
A
A recovery site.
- Has no hardware, no data, and no people.
- Just an empty location that you would need to bring everything to if the main site went down.
6
Q
What is a Warm Site?
A
A recovery site that functions somewhere between a cold site and a hot site.
- May have some hardware ready and waiting, but you would need to bring the data.
- Or, it may just have empty rack space, and you’d also need to bring hardware.
7
Q
What is a Hot Site?
A
A type of recovery site that is an exact (or, at least sufficient) replica of your main site.
- Has all necessary hardware. You buy two of everything, one for the main site and one for the hot site.
- Applications, software, and data are constantly updated via automated replication from the main site.
8
Q
What is MTTR?
A
Mean Time to Restore (or, Repair)
9
Q
What is MTBF?
A
Mean Time Between Failures
10
Q
What is an SLA?
A
Service Level Agreement
- Contractual recovery expectations. If there is an outage, it must be restored within a certain time.
- May include penalties for not meeting certain service levels.
11
Q
What is SIEM?
A
Security Information and Event Management
- Software or a device which allows you to consolidate logs and real-time monitoring data for long-term storage.
- Usually needs a lot of disk space.
- Can create reports, send out security alerts, and provide details for forensic analysis.
12
Q
What is a vulnerability scan?
A
Checks for vulnerabilities on your network, but is usually minimally invasive, unlike a penetration test.
- Runs a scan, identifies systems and security devices.
- Can test the network from both the inside and the outside.
13
Q
What are some examples of what a vulnerability scan is useful for identifying?
A
- Lack of security controls, such as no firewall or no AV.
- Misconfigurations, such as open shares or guest access.
- Application and service vulnerabilities
- Finds unknown devices on the network
14
Q
What is Syslog?
A
A standardized way to transfer log information from a variety of different devices to a centralized log receiver, often a SIEM.
15
Q
What is a MIB?
A
Management Information Base
- A database of data used for SNMP.
- MIB-II is the standardized database, that most devices use.
- Proprietary MIBs also exist. A MIB for a specific device can be provided to an SNMP system so it knows how to read that device’s SNMP metrics.
16
Q
What is IPSec?
A
Internet Protocol Security
- A remote access protocol.
- One of the most popular. Different vendors can be implemented together.
- Commonly used for Site-to-Site VPNs.
- Provides security at OSI Layer 3 (network)
- Authenticates and encrypts every packet.
17
Q
What is an SSL VPN?
A
- Commonly used for end-user / client-to-site VPN access.
- Uses the common SSL/TLS protocol (tcp/443), which is typically allowed through firewalls without requiring additional configuration.
- Uses software or clients built into the OS.
18
Q
What is a DTLS VPN?
A
Datagram Transport Layer Security
- Provides the security of SSL/TLS, but the speed of datagrams.
- Transport uses UDP instead of TCP.
- Useful for streaming and VoIP.
19
Q
What is Out-of-band management?
A
- Allows access to a device without using the external network.
- Usually a separate management interface, often a serial or USB connection.
- A modem could be connected to that interface, to allow remote access to the device over phone lines.
20
Q
What is a Console Router?
A
Out-of-band access for multiple devices.
- Connected to a modem to allow dial-in remote access.
- Multiple out-of-band management interfaces are connected to the Console Route to allow access.
- Also known as a Comm Server
21
Q
What is a Comm Server?
A
Another name for a Console Router.
22
Q
What is a Privileged User Agreement?
What are the related best practices?
A
- A signed agreement outlining the policies of privileged access to data.
- Since Network and System Admins have such high access, best practices are to:
- use non-privileged methods when possible and appropriate
- use privileged access only for assigned job duties
23
Q
What are On-Boarding and Off-Boarding policies?
A
Policies regarding when a new person is coming into an organization, and when an employee is leaving an organization.
24
Q
What is DLP?
A
Data Loss Prevention
- Policies relating to how sensitive information is appropriately handled.
- For example, requiring that medical information is encrypted a certain way when transferred.
- DLP solutions can monitor traffic and create alerts when a policy violation occurs.
25
What should be included in an Incident Response Policy?
* How an incident is identified
* How an incident is categorized
* Who responds to an incident
* What process is followed
26
What is an AUP?
Acceptable Use Policy
• Defines acceptable use of company assets.
27
What is an NDA?
Non-Disclosure Agreement
* Legal agreement for confidentiality.
* Prevents the use and dissemination of confidential information.
28
What is an MSDS?
Material Safety Data Sheet
Provides safety information for proper handling of materials and disposal of waste.
29
What is TACACS?
Terminal Access Controller Access-Control System
* A remote authentication protocol.
* An alternative to RADIUS, and similar.
* Created to control access to dial-up lines to ARPANET.
* Not often used anymore.
30
What is RADIUS?
Remote Authentication Dial-In User Service
* A remote authentication protocol (AAA protocol)
* Standard and widely used, available on almost any server OS
* Centralizes authentication for users to routers, switches, firewalls, servers, remote VPN access, etc.
31
What is XTACACS?
Extended TACACS
* A proprietary, customized version of TACACS created by Cisco
* Provides additional support for accounting and auditing.
* Not often used anymore.
32
What is TACACS+?
* The latest version of TACACS, and usually the only one still used today.
* Not backwards compatible
* Released as an open standard in 1993
* Adds more authentication requests and response codes.
33
What is Kerberos?
A network authentication protocol
* Single sign-on feature: authenticate once, and you're trusted by the system. No need to re-authenticate to everything separately.
* Mutual authentication: client authenticates to the server, and the server also authenticates to the client
* Also provides encryption, preventing man-in-the-middle or reply attacks.
* A standard since the 1980s, developed by MIT.
* Microsoft started using Kerberos in Windows 2000.
34
What is "local authentication"?
A type of authentication in which credentials are stored on the local device, rather than any centralized database or directory.
For example, switches typically only use local authentication.
• Most devices include an initial local account, which has a default password.
35
What are possible factors of MFA?
Multi-factor authentication
Factors could include:
* Something you are
* Something you have
* Something you know
* Somewhere you are
* Something you do
36
What is NAC?
Network Access Control
A form of port-based access control (physical ports, not TCP/UDP ports). Requires authentication before allowing access to any interface on the switch.
IEEE 802.1X is the most common standard of NAC.
37
What is Port Security, and how does it operate?
A method for preventing unauthorized connections to a switch interface, based on the source MAC address (even if it is forwarded from elsewhere).
* Configure the max number of MAC addresses allowed on an interface (Might just be a single MAC, and/or you might configure an allow list of specific MACs).
* The switch monitors the number of unique MACs
* Once the max is exceeded, port security activates. The default is usually to disable the interface.
* Also referred to as Flood Guard
38
What is MAC filtering?
Limits access by MAC address, either through allow lists or block lists.
However, MACs are easy to spoof, so this is only security through obscurity.
39
What is an ACL?
Access Control List
* Used to allow or deny traffic, or apply NAT, QoS, or other settings on the traffic.
* Usually configured on routers
* Can evaluate based on criteria such as Source, Destination, Port number, ICMP, etc.
40
What are common types of Wireless Encryption (including historical)?
WEP
WPA
WPA2
41
What is WPA?
Wi-Fi Protected Access
* Created in 2002 to replace WEP, which had a serious cryptographic weakness.
* Every packet gets a unique 128-bit encryption key
* Uses RC4 with TKIP.
42
What is WEP?
Wired Equivalent Privacy
An old method for wireless encryption
Unsafe to use due to vulnerabilities and cryptographic weaknesses.
43
What is TKIP?
Temporal Key Integrity Protocol
* Changes encryption key information constantly.
* Uses a sequence counter to protect against replay attacks.
• Uses as 64-bit Message Integrity Check to protect
against tampering.
• No longer used due to vulnerabilities; deprecated in the 802.11 standard in 2012.
44
What is an IV?
Initialization Vector
45
What is WPA2?
Replacement for WPA, beginning in 2004.
* Uses AES instead of RC4
* Uses CCMP instead of TKIP
46
What is AES?
Advanced Encryption Standard
47
What is CCMP?
Counter Mode with Cipher Block Chaining Message Authentication Code Protocol
* Uses AES for data confidentiality
* Uses a 128-bit key and a 128-bit block size
* Requires additional computer resources
* Superior encryption than TKIP
48
What is EAP?
Extensible Authentication Protocol
An authentication framework, allowing many different ways to authenticate.
Used by WPA and WPA2.
49
What is EAP-FAST?
EAP Flexible Authentication via Secure Tunneling.
50
What is PEAP?
Protected Extensible Authentication Protocol
• Encapsulates EAP in a TLS tunnel
51
What is EAP-TLS?
EAP over TLS. Also available as EAP-TTLS, a tunneled version.
Strong security, widely adopted
52
What is the difference between WPA2-Personal and WPA2-Enterprise?
Personal uses a pre-shared key; everyone uses the same key.
Enterprise authenticates uses an 802.1X authentication server, such as RADIUS. Everyone has their own credentials which can be changed or revoked individually.
53
What is a logic bomb, and how should they be dealt with?
A type of malware that is set to take harmful effect under certain conditions, such as a specified time or event.
Because each is unique and has no predefined signature, they are best prevented by formal change control and automated change alerting.
54
What is 802.1X?
IEEE 802.1X is the most common standard of Network Access Control.
A form of port-based access control (physical ports, not TCP/UDP ports). Requires authentication before allowing access to any interface on the switch.
55
What is Wardriving?
Collecting information about area networks while driving / travelling, by using a WiFi monitor and GPS.
56
What is a "deauthentication" attack?
An DOS attack that causes a device to disconnect from a resource, typically a wireless network, and prevents it from reconnecting.
57
What is VLAN hopping?
Connecting to a VLAN other than the one you're on.
Two primary methods:
• Switch spoofing
• Double tagging
58
What is Double Tagging?
A form of VLAN hopping.
* The device sends traffic with multiple VLAN tags, to get through multiple switches. The first switch removes the first tag, but sends it to the next switch with the second tag.
* The communication is only one way, so no responses will be received back.
* Useful for a DOS.
59
What is Switch Spoofing?
A form of VLAN hopping.
* Some switches support auto-configuration to determine if a port is connected to a device or a trunk.
* A device can take advantage of this by pretending to be a trunk link (a switch), which allows TX and RX with any VLAN.
* This can be prevented by disabling automatic trunk negotiation.
60
What is ARP Poisoning?
Sending out ARP data that tells target systems that you have the MAC address which actually belongs to another device.
Used for Man-in-the-Middle attacks.
61
What is the difference between a vulnerability and an exploit?
A vulnerability is a weakness in a system.
An exploit is an attack that takes advantage of that vulnerability.
62
What is an out-of-band update?
An update released outside of the normal schedule, usually in emergency to address a zero-day exploit or important security discovery.
63
What is file hashing?
A hash is a unique, short string of text that's created by running an algorithm against a data source.
* The string is called a "message digest."
* It allows you to verify the integrity of a downloaded file, because you can compare the downloaded file hash against the posted hash value.
64
What is FIM?
File Integrity Monitoring
Monitors important OS and application files that should generally never change, and identifies when changes occur.
It can monitor constantly, or on demand.
65
What are some examples of FIM?
* Windows: SFC (System File Checker
* Linux: Tripwire
* Many host-based IPS options that can monitor any system
66
What is the difference between a vulnerability scan and a penetration test?
Unlike a vulnerability scan, a penetration test will actually attempt to exploit the vulnerabilities it finds.
67
What is Flood Guard, and how does it operate?
Also known as Port Security.
A method for preventing unauthorized connections to a switch interface, based on the source MAC address (even if it is forwarded from elsewhere).
* Configure the max number of MAC addresses allowed on an interface (Might just be a single MAC, and/or you might configure an allow list of specific MACs).
* The switch monitors the number of unique MACs
* Once the max is exceeded, port security activates. The default is usually to disable the interface.
68
What is DHCP Snooping?
Can be enabled on switches to help prevent rogue DHCP servers.
You configure certain interfaces on the switch as trusted, where you know your DHCP server connects. You would then configure the other interfaces as untrusted.
The switch then watches for DHCP conversations, and adds a list of trusted and untrusted devices to a table.
If the switch sees static IP addresses, rogue DHCP server responses, or other invalid traffic patterns, it can filter that traffic out.
69
What is BPDU?
Bridge Data Protocol Unit
The Spanning Tree control procotol.
STP uses BPDU to communicate between all the different switches on the network.
70
What is BPDU Guard?
When connecting a device to a network, STP convergence can take 20-30 before the new device is able to communicate.
When BPDU Guard is enabled on a particular switch interface, it will bypass the STP configuration phase so devices can connect and communicate immediately on that interface.
It works because non-switch devices should never send BPDU frames. If the switch detects BPDU frames from that interface, it will disable the interface to prevent a potential loop.
71
What is PortFast?
Cisco's name for BPDU Guard.
72
How does STP determine which switch is the root bridge?
STP configures the root bridge automatically, but you can also configure it manually by setting a "root bridge priority."
The switch with the lowest root bridge priority will be set as the root. (0 is the lowest priority option.)
If more than one switch has the same root bridge priority, STP will give priority to the one with the lowest MAC address.
73
What is Root Guard?
A feature of Cisco switches, designed to prevent a rogue root bridge.
If you manually configured your root bridge, and it receives a superior BPDU on a root guard port, then root guard will change that interface to listening-only status, and show a "root-inconsistent" message, effectively disabling any inbound traffic from the rogue root interface.
74
How can a network be segmented?
It can be segmented:
* Physically (using separate, disconnected devices),
* Logically (using VLANs),
* or Virtually (using virtual networks).
75
What is an SOW?
Statement of Work
A document that outlines all the work that is to be performed, as well as the agreed-upon deliverables and timelines.
76
What is a "legal hold"?
A legal hold is a process that an organization uses to preserve all forms of relevant information when litigation is anticipated.
For example: If a legal hold notice has been given to a backup service provider, the provider will not destroy old backups until the hold is lifted.
77
What is LACP?
Link Aggregation Control Protocol
Configured on a switch to allow port aggregation.
78
What is a Man Trap?
A man trap, like an air lock, is a physical security access control system comprising a small space with two sets of interlocking doors, such that the first set of doors must close before the second set opens.
In a manual man trap, a guard locks and unlocks each door in sequence.
79
What is SHA-1?
Secure Hash Algorithm
a hashing function used for checking data integrity
80
What is MD5?
Message Digest
a hashing function used for checking data integrity
81
What are the most popular file hashing functions?
Secure Hash Algorithm (SHA) and Message Digest (MD) are a series of hashing functions used for checking data integrity (SHA-1 and MD5 are the most popular versions).
