Networking Flashcards

Question

What port does DNS use?

Answer 1

Port 53, primarily UDP.

Answer 2

Port 21 (control) and port 20 (data transfer).

Answer 3

Port 3389.

Answer 4

Translates domain names (e.g. google.com) into IP addresses (e.g. 142.250.185.46).

Answer 5

A server that does the work of finding a DNS answer by querying other servers on your behalf. Example: 8.8.8.8 (Google DNS).

Answer 6

The server that holds the actual DNS records for a domain and gives the final answer.

Answer 7

Maps a domain name to an IPv4 address. Example: google.com -> 142.250.185.46.

Answer 8

Specifies the mail server responsible for receiving email for a domain.

Answer 9

An alias that points one domain name to another. Example: www -> google.com.

Answer 10

An attacker injects fake DNS records into a resolver's cache, redirecting users to a malicious site without their knowledge.

Answer 11

Encoding data inside DNS queries to bypass firewalls or secretly transfer data out of a network.

Answer 12

HyperText Transfer Protocol — used to request and deliver web pages and data between clients and servers. Operates on port 80.

Answer 13

HTTP sends data in plaintext. HTTPS encrypts traffic using TLS on port 443.

Answer 14

Encrypts data between client and server, verifies the server's identity, and ensures data is not altered in transit.

Answer 15

Requests data from a server. Parameters are visible in the URL.

Answer 16

Submits data to a server inside the request body, not the URL.

Answer 17

Client-side errors. Example: 404 = Not Found, 403 = Forbidden.

Answer 18

Server-side errors. Example: 500 = Internal Server Error.

Answer 19

Network Address Translation — allows multiple devices with private IPs to share one public IP address. The router handles the translation.

Answer 20

The IP address of the router a device sends traffic to when the destination is outside its local network. Usually the first address in a subnet (e.g. 192.168.1.1).

Answer 21

A list of known networks and the next hop needed to reach them. Routers use this to decide where to forward each packet.

Answer 22

Static: routes set manually, reliable but does not adapt to changes. Dynamic: routes learned automatically via protocols like OSPF, adapts to network changes.

Answer 23

A network security device or software that monitors and filters incoming and outgoing network traffic based on an organization’s previously established security policies. ## Footnote Allowing or blocking connections by IP, port, and protocol.

Answer 24

A firewall that tracks the state of active connections. It knows whether an incoming packet belongs to an established session, not just its IP and port.

Answer 25

Checks each packet's IP, port, and protocol individually with no memory of previous packets. Simpler and faster but easier to bypass than a stateful firewall.

Answer 26

A rule at the end of a firewall policy that blocks all traffic not explicitly allowed. The default: deny everything unless permitted.

Answer 27

Web Application Firewall — inspects HTTP/HTTPS traffic at Layer 7 to detect attacks like SQL injection and cross-site scripting.

Answer 28

Intrusion Detection System — monitors traffic and generates alerts when suspicious activity is detected. It does not block traffic.

Answer 29

Intrusion Prevention System — monitors traffic and automatically blocks malicious activity in real time.

Answer 30

IDS is passive — it only detects and alerts. IPS is active — it detects and blocks.

Answer 31

Matches traffic against a database of known attack patterns. Accurate for known threats but cannot detect new unknown attacks.

Answer 32

Establishes a baseline of normal behaviour and alerts on deviations. Can catch unknown attacks but produces more false positives.

Answer 33

An alert triggered by legitimate, non-malicious traffic. Example: an internal port scan incorrectly flagged as an attack.

Answer 34

Wired Equivalent Privacy (1997) — the first Wi-Fi security protocol. Uses RC4 encryption. Considered completely broken and should never be used.

Answer 35

Wi-Fi Protected Access 2 (2004) — uses AES-CCMP encryption. The most widely used Wi-Fi security standard. Vulnerable to offline attacks if a weak password is used.

Answer 36

The current Wi-Fi security standard (2018). Uses SAE handshake, which prevents offline password cracking even if the handshake is captured.

Answer 37

A rogue access point that mimics a legitimate Wi-Fi network. Devices connect to it unknowingly, allowing the attacker to intercept their traffic.

Answer 38

Sending forged frames to disconnect a device from Wi-Fi. When it reconnects, the attacker captures the handshake to crack the password offline.

Answer 39

Virtual Private Network — creates an encrypted tunnel between a device and a network over the internet, protecting data in transit.

Answer 40

Allows individual users to securely connect to a company network from a remote location, as if they were physically in the office.

Answer 41

Permanently connects two separate office networks together via an encrypted tunnel between their routers.

Answer 42

Only company-bound traffic goes through the VPN. Personal browsing uses the local internet connection directly.

Answer 43

Testing network connectivity (ping) and reporting errors. Operates at Layer 3.

Answer 44

Address Resolution Protocol — resolves an IP address to a MAC address on a local network.

Answer 45

Dynamic Host Configuration Protocol — automatically assigns IP addresses and network settings to devices when they connect to a network. Uses ports 67 and 68.

Answer 46

Simple Mail Transfer Protocol — used to send email between servers. Runs on port 25.

Answer 47

FTP transfers files in plaintext on port 21. SFTP transfers files encrypted over SSH on port 22.

Answer 48

The process of capturing, monitoring, and logging data packets as they traverse a network

Answer 49

is a process performed by a VPN service that protects data in transit by wrapping sensitive data in other data packets.

Networking Flashcards

(74 cards)