Wondershare EdrawMind
MindMap Gallery CISSP Study Notes-Domain 4 (Communications and Network Security)
- 32
CISSP Study Notes-Domain 4 (Communications and Network Security)
This is a mind map about CISSP study notes - Domain 4 (Communications and Network Security). The main content includes: practice questions and knowledge points.
Edited at 2024-03-31 11:18:11
- cáncer de pulmón
El cáncer de pulmón es un tumor maligno que se origina en la mucosa bronquial o las glándulas de los pulmones. Es uno de los tumores malignos con mayor morbilidad y mortalidad y mayor amenaza para la salud y la vida humana.
- diabetes
La diabetes es una enfermedad crónica con hiperglucemia como signo principal. Es causada principalmente por una disminución en la secreción de insulina causada por una disfunción de las células de los islotes pancreáticos, o porque el cuerpo es insensible a la acción de la insulina (es decir, resistencia a la insulina), o ambas cosas. la glucosa en la sangre es ineficaz para ser utilizada y almacenada.
- sistema digestivo
El sistema digestivo es uno de los nueve sistemas principales del cuerpo humano y es el principal responsable de la ingesta, digestión, absorción y excreción de los alimentos. Consta de dos partes principales: el tracto digestivo y las glándulas digestivas.
CISSP Study Notes-Domain 4 (Communications and Network Security)
- cáncer de pulmón
El cáncer de pulmón es un tumor maligno que se origina en la mucosa bronquial o las glándulas de los pulmones. Es uno de los tumores malignos con mayor morbilidad y mortalidad y mayor amenaza para la salud y la vida humana.
- diabetes
La diabetes es una enfermedad crónica con hiperglucemia como signo principal. Es causada principalmente por una disminución en la secreción de insulina causada por una disfunción de las células de los islotes pancreáticos, o porque el cuerpo es insensible a la acción de la insulina (es decir, resistencia a la insulina), o ambas cosas. la glucosa en la sangre es ineficaz para ser utilizada y almacenada.
- sistema digestivo
El sistema digestivo es uno de los nueve sistemas principales del cuerpo humano y es el principal responsable de la ingesta, digestión, absorción y excreción de los alimentos. Consta de dos partes principales: el tracto digestivo y las glándulas digestivas.
- Recommended to you
- Outline
CISSP Study Notes-Domain 4 (Communications and Network Security)
Knowledge points
4.1 Evaluate and implement security design principles in network architecture
4.1.1 OSI and TCP/IP models
4.1.1.1 Comparison between OSI and TCP/IP
4.1.1.2 Attack vectors for each layer of the network model
1. Physical layer
•Passive sniffing
•Electrical interference
•Cut the cable
2. Data link layer
•Forged MAC address (eg: ARP spoofing)
3. Network layer
•MITM attack
•Denial of Service (DoS) attack
4. Transport layer
•SYN flood attack
• Session hijacking
5. Session layer
• Pitfalls in the Secure Sockets Layer (SSL) protocol
•Less secure version of Transport Layer Security (TLS)
6. Presentation layer
•Attacks on encryption schemes
7. Application layer
•Weaknesses of application layer protocols (such as HTTP, FTP, etc.)
•SQL injection
•Common web attacks such as cross-site scripting (XSS) attacks
4.1.2. Internet Protocol (IP) Networks
Utilizing core protocols such as IP, ARP, ICMP, and IGMP, the Internet layer is responsible for the addressing, packaging, and routing functions of data packets that make the Internet a reality. There are two versions of IP: IPv4 (version 4) is the main version in use today, and IPv6 (version 6) is the version that is evolving for devices connected to the Internet.
4.1.2.1 IP v4
IP v4 uses 32-bit addresses, which was theoretically exhausted years ago. However, the life of IPv4 has been extended with the advent of Network Address Translation (NAT), private IP addresses, and other technologies.
1. IPv4 range
2.NAT
NAT is a technology used to map one or more local (internal) IP addresses to one or more global (external) IP addresses, and vice versa.
4.1.2.2 IP V6
IPv6 extends IPv4's limited 32-bit address to 128 bits for addressing. It also includes features such as address scope, auto-configuration, security, and Quality of Service (Q0S).
4.1.2.3 Cyber attacks
4.1.2.3.1 Distributed denial of service attack
A typical DDoS attack consists of a large number of individual machines that are controlled to bombard a target with overwhelming traffic for a short period of time.
4.1.2.3.2 SYN Flooding
SYN flood is a DoS attack launched by utilizing the characteristics of TCP protocol. The attacker sends a large number of SYN packets to the target but does not respond with SYN-ACK packets, causing the target system resources to be exhausted and the software to crash. Defense measures include: expanding the backup queue, half-open connections on recycling days, and using SYN cookies technology
4.1.2.3.3 Man-in-the-middle attack (MTM)
In a MITM attack, the attacker intercepts the signal and secretly forwards (and possibly alters) the communication before stopping transmission or allowing the message to reach its intended recipient.
Defense methods: authentication, tamper detection
4.1.2.3.4 Packet sniffing
Packet theft can involve grabbing packets in transit and trying to extract useful information from the contents.
Some packets contain usernames, passwords, IP addresses, credit card numbers and other valuable payloads. Encrypting sensitive traffic is the best way to prevent network theft.
4.1.2.3.5 Hijacking attack
Hijacking attacks are malicious interference in network communications. They are divided into connection hijacking (such as ARP spoofing and DNS hijacking) and session hijacking (such as man-in-the-middle attack). They are designed to intercept session tokens or cookies to obtain sensitive information and impersonate the victim.
4.1.2.3.6 MITER ATT&CK Framework
MITER ATT&CK was developed by MITER Corporation to provide a foundation for security professionals to develop threat models and methodologies in their organizations, as well as provide tactics and techniques.
4.1.3. Security protocols
4.1.3.1 SSH (Secure Shell Protocol)
••An alternative to Telnet for encrypted interactive text communication over TCP
•Prevent session hijacking and MITM attacks
•SSH-1 is not secure, SSH-2 is secure
4.1.3.2TLS (Transport Layer Security)
•Replaced SSL as the primary protocol for secure network traffic
•Secure HTTP sessions and other end-to-end encryption needs
•Support server authentication and mutual authentication between client and server
SSL3.0 has been found to be vulnerable to the POODLE attack and is no longer safe
4.1.3.3 Kerberos
• Communication protocol to protect login credentials
•Uses the ticket concept to allow systems on unsecured networks to securely prove identity
4.1.3.4. IPSec (P Security Protocol)
IPSec is a set of protocols designed to provide confidentiality, integrity, and authentication for data sent over IP networks.
•IPSec mainly consists of the following parts:
1Authentication Header (AH): Provides data source authentication and data integrity protection. It can detect any tampering of data during transmission and confirm the identity of the sender.
2. Encapsulated Security Payload (ESP): Provides data source authentication, data integrity protection, and encryption. By encrypting the data payload, ESP ensures the confidentiality of the communication content.
3. Security Association (SA): Provides parameters for the IPSec protocol, including keys and encryption algorithms. SA defines how data in transit is handled and how AH and ESP are handled.
•IPSec has two working modes:
1. Transport mode: Only the payload (data part) of the IP packet is encrypted and authenticated. Suitable for end-to-end communication security to protect data integrity and confidentiality.
2 Tunnel mode: Encrypt and authenticate the entire IP packet, including data and IP header information. This mode is used to create a secure communication tunnel, such as a VPN, connecting two network nodes and protecting the entire data transmission process.
4.1.3.5 Internet Key Exchange (IKE)
-Part of the IPSec suite used to establish a secure communication channel between two entities
• Typically uses an X .509 PK certificate for authentication, utilizing the Dittie-Hellman-Merkle key exchange protocol to establish a shared session key
•Two versions: IKEV1 and 1KEv2, both are vulnerable to offline attacks and require high-entropy password protection
4.1.4. Impact of multi-layer protocols
1 Introduction
•Multi-layer network communication protocols allow different systems to communicate with each other
•Common multi-layer protocols: TCP/IP network protocol suite
•Example: Distributed Network Protocol (DNP3) for Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) networks, including data framework layer, transport layer, and application layer.
2. Advantages of multi-layer protocols
•Various protocols can be used at higher layers
• Encryption can be included in various layers
•Support flexibility and resilience in complex network structures
3. Disadvantages of multi-layer protocols
•Allow covert passage
•Filters can be bypassed
•Logically imposed segment boundaries can be transcended
4.1.5. Fusion protocol
Fusion protocols combine proprietary and standard protocols (such as the TCP/P suite of protocols) and are designed to reduce reliance on expensive proprietary hardware and provide varying performance depending on the fusion protocol used. Here are some of the major convergence protocols:
4.1.5.1 Fiber Channel over Ethernet (FCOE)
•Application: Storage Area Network (SAN) Solutions
•Technology: Uses Fiber Channel protocols and specialized network equipment
•Speed: High-speed operation (minimum 10 Gbps)
•OS1 model location: second layer
• Development: Fiber Channel over IP (FCIP) as a follow-up technology, suitable for a wider range of network environments
4.1.5.2 Internet Small Computer System Interface (iSCSI)
•Application: Low-cost alternative to Fiber Channel
•Technology: IP-based network storage standards
•Advantages: Easily connect to remote storage volumes over the network
4.1.5.3 Multiprotocol Label Switching (MPLS)
•Application: High-performance networking technology for creating virtual private circuits
•Technology: Guide data according to short path labels to improve forwarding speed
•0S1 model location: Layer 2.5 (between data link layer and network layer)
4.1.5.4 Voice over Internet Protocol (VoP)
•Application: Inexpensive telephony solution
Technology: Uses a variety of technologies to encapsulate voice communications and multimedia sessions over IP networks
• Advantages: Becoming a mainstream telephony solution for businesses and individuals
4.1.6. Micro-segmentation
Micro-segmentation is a method of creating zones in a network that isolate resources and provide independent protection for each network segment. Micro-segmentation requires re-authentication when access to cross-zone resources is required. Here are some techniques related to micro-segmentation:
4.1.6.1 Software Defined Networking (SDN)
1. Management method: Centrally manage the network to achieve unified management across suppliers, applications and technologies
2. Standard: OpenFlow (one of the earliest SDN standards)
3. Architecture level:
. Infrastructure layer (data plane): includes network switches, routers and data forwarding processes
. Control layer: Determine the flow of traffic and make decisions based on the status of the infrastructure layer and the needs of the application layer
•Application layer: network services, utilities and applications that interface with the control layer
4.1.6.2 Software Defined Security (SDS)
•Security mode: a security mechanism controlled and managed by security software
•Features: Policy-driven, including network segmentation, intrusion detection and prevention, user and device identification, application control, etc.
4.1.6.3 Software-Defined Wide Area Network (SD-WAN)
•Applications: Support WAN architecture, especially those related to cloud environments
•Features: Use software to control the connection and management services between the data center and the remote network
•Four characteristics mentioned by Gartner:
1) Must support multiple connection types (such as Internet, MPLS, LTE, etc.)
2) Dynamic path selection can be performed to support load sharing across WAN connections
3) Provide a simple interface to manage WAN
4) VPN and other third-party services must be supported
4.1.6.4 Virtual Extensible LAN (VxLAN)
•Technology: Network virtualization technology, encapsulating the second layer in large network frames in the fourth layer UDP datagram
•Benefits: Allows for larger scale partitioning of networks (compared to VLANs), meeting the needs of large multi-tenant public cloud providers
4.1.7. Wireless Network
3. Wireless Access Point (WAP)
A wireless access point (WAP), sometimes just called an access point (AP), is a network device that allows wireless-enabled devices to connect to a wired network. A WAP connects directly to a wired local area network and then uses Wi-Fi or other wireless technologies (such as Li-Fi) to provide wireless connectivity to that wired LAN.
4.1.7.11 Securing wireless access points
1.
Site investigation
•Purpose: To identify rogue APs and determine AP location and configuration.
•Importance: Ensure compliance and security on a regular basis.
2. Determine the location of the wireless access point
• Optimize signal coverage area: use central location.
• Westbrook signal attenuation: avoid obstacles, interference and reflections.
3 Select the appropriate antenna type
•Omnidirectional antenna: wide coverage.
•Directional antennas: focus coverage in a specific direction.
4. Select the appropriate wireless channel
•Note: Different countries have different numbers of channels.
5. Choose the appropriate deployment model
•Basic mode: including independent mode (wireless clients interconnect), wired extension (wireless clients connect to wired networks), enterprise extension (multiple WAPs provide coverage for the same ESSID), and bridge (connecting two wired networks).
6. Set up and manage service set identifiers (SSIDs)
•Ad hoc mode: Wireless devices communicate without centralized control.
•ESSID: Wireless network name in infrastructure mode.
°B5S10: Wireless network name in Ad hoc mode.
• Improved security: Do not broadcast SSID and use WPA3.
7. Use restricted portals for authentication
•Scenario: Public wireless network, such as hotels, airports, etc.
•Method: Requires entry of credentials, payment or access code.
8. Implement MAC filters
•Function: List of authorized devices allowed to access the WAP.
•Disadvantages: Difficult to manage and scale to large environments.
4. Wireless attacks
4.1.7.12 Signal interference
Overview: Malicious activity that overwhelms WAP and prevents legitimate traffic from being processed.
Preventive measures: Use equipment with anti-interference technology, conduct signal monitoring, detect and eliminate interference sources in time, etc.
4.1.7.13 War driving
Overview: It is the behavior of attackers to search and locate wireless networks to find vulnerabilities while on the move. These networks are usually not accessible to attackers.
Preventive measures: Use strong encryption protocols, not disclose SSIDs, restrict network access permissions, etc.
5. Wireless transmission technology
4.1.7.14 LiFi
Overview: Wireless communication technology that uses light to transmit data using visible, ultraviolet or infrared light.
Advantages: Security advantages, can be controlled within the physical space; fast speed, 100 times the bandwidth of Wi-Fi.
4.1.7.15 Bluetooth
Overview: Wireless technology standard that supports short-distance point-to-point wireless transmission.
Advantages: No base station is required, and devices are directly connected.
Disadvantages: Lack of encryption; slow speed.
4.1.7.16 ZigBee
Overview: Low-cost, low-power, low-latency wireless communication standard, based on IEEE 802,15.4, applied to the Internet of Things.
Security features: Access control lists (ACLs); frame counters; encryption (using 123-bit AES keys
4.1.8. Cellular Network
A cellular network is a wireless communication system that communicates through cells and base stations dispersed within a geographical area. Users connect to cell sites, other cellular devices, or the Internet via portable devices on specific radio frequencies.
One of the attack scenarios faced by cellular networks is man-in-the-middle attacks using cell towers to capture traffic. These threats should be considered when developing or managing your organization's bring-your-own-device (BYOD) policy.
4.1.9. Content Delivery Network (CDN)
A content delivery network (CDN), also known as a content delivery network, is a geographically distributed collection of resource services, proxy servers, and data centers. The nature of this architectural model is to provide low latency, high performance, and high availability for content, especially multimedia, e-commerce, and social networking sites.
Content is fetched as close as possible to the requesting client, which results in lower latency and greater throughput. Because data is stored or processed in multiple jurisdictions, CDNs and their users must understand how local regulations impact their business and their customers.
4.2. Secure network components
4.2.1. Hardware operation
1. Security and correct operation of network hardware
•Standards, policies and procedures
Organizations should establish standards for the security baseline of hardware devices, establish policies for operating and managing these devices, and formalize daily operating procedures to support consistent device management.
•Training
Network administrators and others who manage or operate hardware should receive regular training on proper and safe operation.
•Change management
Configurations, patches, and other changes should be properly documented and follow the organization's standard change management procedures.
•Redundant power supply
Deploy redundant power supplies on critical network infrastructure to ensure availability in the event of a power outage.
•monitor
Monitor network equipment for failures, anomalies, or other security-related events.
•Warranty and support
A valid warranty should be maintained on all network equipment to provide coverage in the event of system failure.
2. Internet terminology
4.2.1.1 data collision
If two systems transmit simultaneously, trying to use the network medium at the same time, a data collision will occur, with the result that one or both messages may be corrupted.
4.2.1.2 Broadcast domain
Is a logical division of a computer network in which all nodes can reach each other through broadcasts at the data link layer (layer 2).
4.2.1.3 Collision domain (collision domain)
Consists of all devices connected using shared media. Collisions between devices may occur at any time.
3. Network components
4.2.1.4 Firewall
Firewalls are used to prevent unauthorized data from flowing from one area of the network to another.
Firewall type:
1. Static packet filtering firewall: The earliest and simplest firewall design, operating at the network layer (Layer 3) of the OSI model, inspects each packet according to established rules. This type of firewall does not provide an authentication mechanism and may be susceptible to spoofing.
2 Application-level fire blocking: operates at the application layer (layer 7) and performs in-depth inspection of data packets and network traffic. This firewall acts as a barrier between end users and the external network, acting as a proxy. Deep inspection takes time, so this type of firewall is the slowest of all types.
3 Stateful Inspection Firewall: Operates at the network and transport layers of the OSI model (layers 3 and 4 respectively) and monitors the status of network connections. Based on the TCP operation mode, the connection status and other attributes are recorded, and these attributes are filtered.
4 Circuit-level firewall: Works only at the session layer (Layer 5) of the OSI model, ensuring that the TCP handshake is completed. No actual packets are inspected, nor are any individual packets dropped. The advantage of this type of firewall is that it authenticates sessions while masking any details about the protected network.
5 Next-generation firewall (NGFW): Combines traditional firewall capabilities with the advanced capabilities of other network-based security devices such as IDS or IPS. Operates at multiple levels of the OSl model.
6. Multi-interface firewall: A firewall with two or more network interfaces uses a set of software-defined rules to determine which traffic can pass between the networks it is connected to, reducing the risk of data being inadvertently transferred between the two networks. Exchange Risks.
7 Bastion Host/Screened Host: A special purpose firewall or host located behind services on core network routing equipment or in the DMZ. Separate internal private networks from untrusted networks (possibly the Internet). Acts as a proxy as the only device reachable from external sources, masking the identity of internal nodes and adding a layer of protection.
Firewall deployment architecture:
. Select firewall type: including static packet filtering, application level, stateful inspection, circuit level, next generation
•Determine deployment location: such as network perimeter, internal network segmentation, DMZ or core network.
•Choose firewall form: hardware firewall or software firewall.
•Choose technology: open source firewall technology or proprietary firewall technology.
•Deployment method: physical device or virtual device.
•Management and Maintenance: Configure, monitor, update and handle security events.
4.2.1.5 Repeaters, concentrators and amplifiers
•Works at the physical layer
• Extend the maximum transmission length of a signal on a specific media type
•Connect to network segments using the same protocol
4.2.1.6 Hubs
•Works at the physical layer
•Connect multiple network devices using the same protocol to the same collision domain
•With the popularity of switches, hubs have been gradually eliminated
4.2.1.7 Bridges
•Works at the data link layer
. Connect network segments using the same protocol and split collision domains
• Use Spanning Tree Algorithm (STA) to prevent broadcast storms
•Has been replaced by switches due to their higher performance
4.2.1.8 Switches
•Mainly works at the data link layer
•Smart hub, connect multiple devices and create independent collision domains
•Advanced switches can operate at the network layer and provide routing capabilities
•Supports VLAN division to help improve network security and efficiency
4.2.1.8 Routers
••Works at the network layer
•Forwarding based on IP, responsible for decision-making and controlling network traffic
•Ability to connect to different types of networks such as LAN and WAN
4.2.1.9Gateways
•Usually works at the application layer
•Protocol translator to realize communication between different networks
•Ability to convert the format of a data stream from one network to a compatible format that can be used by another network
4.2.1.10 Proxies
•—a special gateway
• Act as an intermediary, filter, repository server or address translation server between networks
•No cross-protocol translation, often used in NAT servers
4.2.1.11 LAN Extenders
•Multilayer switches
•Used to extend a network segment beyond the distance limits of a specific cable type
•Can be implemented as a WAN switch, WAN router, repeater or amplifier
4.2.1.12 Wireless Access Points (WAPs)
•Works at the data link layer
. Provides wireless network connectivity, allowing devices to connect to wired networks wirelessly
4.2.2. Transmission media
1. LAN technology:
4.2.2.1Ethernet
•Broadcast technology based on the IEEE 802.3 standard, allowing multiple devices to communicate on the same medium
•Low implementation cost, easy to understand, implement and maintain
•Typically deployed in star or bus topology
•Supports two-way full-duplex communication using twisted pair cables
•Works at the physical and data link layers of the OSI model
•Classified by data transmission rate and distance: Fast Ethernet (100Mbps), Gigabit Ethernet (1Gbps), 10 Gigabit Ethernet (10Gbps)
4.2.2.2 Wireless LAN (Wi-Fi)
•Wireless communication technology that complies with the IEEE 802.11 standard
•Divided into infrastructure mode (connecting devices through access points) and Ad Hoc mode (direct connections between devices)
2. Network cabling:
4.2.2.3 Coaxial cable
•The central core is copper wire, and the outer layer has an insulation layer and a conductive shielding layer
•Enables two-way communication and has anti-electromagnetic interference (EMI) capabilities
•More expensive and bulky than twisted pair, but carries signals longer distances
4.2.2.4 Baseband cables and broadband cables
• Naming convention follows the xxyyyzZ pattern
xx represents the maximum speed offered by the cable type, yyy represents whether it is a baseband or milliband cable, and zZ represents the maximum distance the cable can be used or is an abbreviation for the cable technology. For example, 10Base2 cable means: 10Mbps baseband cable has a transmission distance of approximately 200 meters.
STP features foil-wrapped wires for extra protection from crosstalk and EMI
4.2.2.6 Conductors
•Copper Wire: Cost effective and performs well at room temperature. But with resistance, the signal strength will decrease
• Optical fiber cable: transmits light pulses, fast, resistant to eavesdropping and interference, long transmission distance, but difficult to install and high initial cost
4.2.2.7 Other cabling considerations
•Avoid using more than four repeaters in a row
•Follow the 5-4-3 rule: a maximum of five network segments, connected by a maximum of four repeaters and concentrators, only three of which may have additional or other users, servers or network devices connected.
3. Network topology
There are four basic variations in the physical topology of a network: ring, bus, star, and mesh.
4.2.2.8 Ring topology
In a ring topology, devices are connected and packets are transmitted in a unidirectional ring pattern. Data is transmitted system by system, and if one system fails, the entire network is disrupted.
4.2.2.9 Bus topology
Each node or system in a bus topology is connected by a line or main cable. If the bus is disconnected from a segment, that segment becomes disabled. However, within the segment, nodes can still contact each other.
Types of bus topology are: linear and tree
4.2.2.10 Star topology
•Each independent node is directly connected to a central node (switch, hub or concentrator)
•All data communication must pass through the central node, which may become a bottleneck or single point of failure
•Easy to install and maintain, network faults are easy to isolate and do not affect other parts
•Logical architecture of bus or ring topology can form star topology
•The Ethernet network can be deployed as a physical star since it is bus based
4.2.2.11 Mesh topology
A mesh topology is a network in which all systems are connected to each other through separate paths.
Advantages: Redundant connections increase availability
Disadvantages: Complex management and additional costs
4.2.3. Network Access Control Appliances (NAC)
NAC technology intercepts the device's network traffic and verifies its connection authorization, using the 802.1x authentication protocol. The goals of NAC include enforcing network policy, enforcing security policy, and authenticating and authorizing network connections. Indirectly prevent/reduce zero-day attacks by executing a series of network policies.
1. Two stages of implementing NAC:
•Before admission: Check whether the endpoint complies with the policy, such as IP, MAC, identity information, etc.
•After admission: grant network access, control user behavior, and decide whether to cancel access based on rule compliance
2.NAC implementation method:
. Proxy NAC: Uses a proxy server for authentication and authorization. Authentication and authorization can be achieved through authentication protocols, such as 802.1× and RADIUS.
•Agentless NAC: Enables authentication and authorization functions on network devices. Authentication and authorization can be achieved through authentication protocols such as 802.1X and RADIUS.
•Out-of-band NAC: Separates analysis and execution functions, reporting to a central console. However, without security measures, out-of-band configuration can undermine network security.
• In-band NAC: The device sits in the middle of network traffic and decides whether to allow or restrict traffic based on when the endpoint logs in. The advantage is that authentication and authorization can be done directly in the middle of the traffic flow, but it can become a network performance bottleneck if the device is overloaded.
3. Repair method:
Remediation is a necessary step to resolve blocked access. There are two different methods of repair:
•Isolation: Endpoints are restricted to a specific IP network or VLAN, providing limited access.
. Capture Portal: Redirect web access to a specific web page, such as a login page or authorization page.
4.2.4. Endpoint Security
4.2.4.1 Endpoint
Endpoints include laptops, desktops, servers, mobile devices, IoT devices, industrial control systems, autonomous mobile systems, robots, and more
4.2.4.2 Endpoint Detection and Response (EDR)
EDR enables continuous monitoring and response to advanced threats on all types of endpoints. Detect, investigate, and respond to suspicious activity by monitoring endpoint and network events and analyzing these events.
4.2.4.3 Endpoint security policy
A defense-in-depth strategy combines next-generation endpoint controls such as zero-trust architecture, local host firewalls, advanced threat protection applications, multi-factor authentication, auditing (such as UEBA), and client-based 1DS/IPS to isolate infected or suspicious endpoints. outside the network.
4.2.4.4 Endpoint security measures
Endpoint security should include the effectiveness of anti-virus and anti-malware software, properly configured host-based firewalls, hardened configurations that disable unnecessary services, and patched operating systems.
4.2.4.5 Mobile devices
1. Mobile device security policies include:
•Storage: Minimum data retention and regular deletion of data that exceeds the data retention policy.
•Authentication: Use multi-factor authentication such as passwords, biometrics, and more to lock your device when not in use.
•Encryption: Encrypt data at rest on mobile devices, combined with hardware security modules (HSM) to provide a higher level of security management.
•Remote Wipe: Erase the contents of a lost device over the network.
2. Mobile device management (MDM) and its development:
•MDM: Register and manage employees’ mobile devices, including asset management, configuration management, remote wipe and other functions.
•EMM: An enhanced version of MDM, enabling more fine-grained content control and protecting corporate data.
• UEM: Integrate MDM and EMM to expand the scope of management and control, including mobile devices, PCs, 1oT, wearable devices, ICS, etc.
3 Mobile device management strategies:
•Application Control: Manage applications on mobile devices in blacklist or whitelist mode.
• Containerization and storage segmentation: Provides secure encrypted portions of sensitive organizational data, allowing users unrestricted access to other parts of the device.
•Removable Storage: Disable the use of removable storage on the device to reduce the risk of data leakage.
•Content filtering: Prevent users from accessing unauthorized content on their devices.
4. Mobile Device Tracking
•Asset tracking: Manage the entire life cycle of the device, including device application, ordering, receipt, initial configuration, security policy application, device assignment to users, and device retirement.
•Geolocation: Utilizes your mobile device’s GPS capabilities to determine device location.
. Geofencing: Set up a virtual fence around a specific area and trigger an alarm when the device leaves the fence
•Need to be aware of privacy issues and ensure legal and ethical disclosure of surveillance and authorized uses to monitored employees.
5. Mobile application security
•Authentication: Requires authentication for applications accessing data or resources.
•Data Encryption: Ensure your application's sensitive data is encrypted at rest and in transit, and implement strong key management.
•Geotagging permissions: Ensure your app's geotagging permissions meet enterprise requirements.
6 Mobile Device Security Enforcement
•Avoid using third-party app stores
•Prevent jailbreaking or rooting by monitoring devices for signs of jailbreak and ensuring device firmware is up to date and patched against known vulnerabilities.
4.2.4.6 Mobile deployment mode
1. Bring your own device (BYOD)
Employees use personal devices to connect to the company network and complete work tasks. This model improves work efficiency, but involves privacy issues and requires company security management and restrictions.
2 Choose your own device (CYOD)
The company provides a range of devices for employees to choose from. This model provides employees with freedom while enabling companies to centrally manage devices and implement security controls.
3 Company owned, personally enabled (COPE)
The company provides devices so employees can switch freely between work and personal life. This model is good for work-life balance, but makes company management and security more difficult.
4 Organization owned, business only (COBO/COMS):
The company purchases mobile devices that comply with security policies and are for company business use only. This is the most secure deployment
5 Virtual Desktop Infrastructure (VDI)
Businesses run virtual desktops in data centers or in the cloud, and employees connect using personal devices. Data is always kept within the virtualized environment, ensuring security.
7. Typical concerns for mobile device implementation strategies include:
•Device management: registration, configuration, update, replacement and withdrawal, etc.
•Application management: installation, update, disabling and uninstallation, etc.
•Data security: encryption, backup, recovery and erasure, etc.
•Network security: network connections, firewalls, VPNs, etc.
•Device positioning: positioning, monitoring and locking, etc.
•Wireless Security: Wireless network security, Wi-Fi encryption, and more.
•Privacy Protection: Personal privacy and information protection.
•Battery management: battery usage, power management, charging strategy, etc.
•Support & Services: Mobile device management support, user assistance, and more.
•Third-party application management: Management, monitoring, disabling of third-party applications, etc.
. Policy and Guidance: Develop clear usage policies and guidance.
•Mobile Device Management (MDM): configuration, policy, security, monitoring, and more.
•User Identity Management (UIM): Ensures only authorized users access corporate networks and data.
•Multi-factor authentication: Increase security such as fingerprint, facial recognition, password, etc.
•Sustainability management: Equipment life cycle management, including purchase, use, maintenance, renewal and recycling.
•Disaster recovery: Develop a disaster recovery plan to deal with equipment failure or loss caused by emergencies.
•Log management: Collect and analyze device logs to understand usage and discover security threats.
•Centralized management: Improve management efficiency and security.
•User training: Improve user security awareness and skills.
•Compliance: Follow laws, regulations and industry standards.
4.3. Implement secure communication channels by design
4.3.1. Voice
4.3.1.1 Private Branch Exchange (PBX)
PBX (Private Branch Exchange) is an enterprise-level telephone system. PBXs with analog signals may be at risk of bill fraud. Mitigation measures include problem identification, vulnerability management, training and monitoring.
4.3.1.2 POTS (Plain Old Telephone Service)
POTS is a traditional telephone service that uses PSTN lines to provide calling services. Voice communications over POTS connections are prone to interception, eavesdropping, etc. Security controls rely on physical controls, isolating network traffic, and monitoring vulnerable areas.
4.3.1.3 Public Switched Telephone Network (PSTN)
PSTN (Public Switched Telephone Network) is a traditional telephone communication network that mainly provides voice call services. PSTN signals can be converted to digital signals via a modem for dialing DSL or ISDN Internet connections.
4.3.1.4 VolP
VolP (Voice over Internet Protocol) Voice communication via Internet Protocol. VoIP vulnerabilities include phishing, SPIT attacks, call manager system compromise, MITM attacks, and unencrypted traffic leaks. Remedies include the use of encryption, network segmentation, and network access control technologies.
4.3.2. Multimedia collaboration
Multimedia collaboration is a general term that includes video conference calls, instant messaging, email, etc. During the COVID-19 pandemic, these technologies have become critical services for doing business. Many organizations have embraced remote working as an acceptable option.
4.3.2.1 Remote conference
Remote meetings require ensuring authentication, such as pre-registering for the meeting using a unique password. Transmissions of voice, data or video may require encryption to protect them. Zoombombing is the act of unauthorized individuals or entities entering a zoom video conference, which usually includes posting inappropriate content or interfering with normal proceedings in the video conference.
4.3.2.2 Instant messaging
•Instant Messaging (IM) is also known as Private Messaging (PM). IM may be exposed to the following security threats:
•Account spoofing: This threatens authenticity when IM does not enforce strong authentication.
•Packet theft: Without encryption, instant messaging is vulnerable to packet theft, threatening its integrity.
•Malicious code storage, infection, or data exfiltration: File transfers and remote access increase these risks.
•Social engineering attacks: IM users are often subject to many forms of social engineering attacks.
•SPIM: Spam SMS, that is, sending a large number of useless or unauthorized SMS messages.
Note: Blocking ports on the firewall to prevent IM attacks is ineffective because IM usually uses open ports (such as 80/443).
4.3.2.3 Email
Email Server: Sendmail and Microsoft Exchange are common email server software that support the SMTP protocol for sending email and the POP3 and IMAP protocols for receiving email. The SMTP server should ensure that it is properly configured for strong authentication of inbound and outbound mail.
•E-mail security objectives: Ensure confidentiality, integrity, availability, non-repudiation, and authenticity of e-mail (CIANA).
•E-mail attacks: phishing, spam, etc.
•Email security policy: Usage guidelines, access control, privacy, email backup and retention policies.
•Email security solutions: digital signatures, anti-malware scanning, blocking of suspicious attachments and potentially risky filename extensions, filters, encryption, user training, antivirus and endpoint protection, and more.
•Email Security Standards:
Provide assurance by enforcing the use of TLS for email encryption.
1) S/MIME (Secure Multipurpose Internet Mail Extensions)
Enable email authentication and confidentiality using public key encryption and digital signatures. Authentication is provided using X.509 digital certificates, and Public Key Cryptozoology Standard (PKCS) encryption provides privacy.
2) MOSS (MIME Object Security Service)
There are security vulnerabilities using the MD2 and MD5 algorithms. MOSS was never widely deployed and has now been abandoned, mainly due to the popularity of PGP.
3) PEM (Privacy Enhanced Email)
Provides email encryption mechanisms, including authentication, integrity, confidentiality, and non-repudiation services. Uses RSA, DES, and X.509.
4)DKIM (Domain Name Key Identified Mail)
Verify domain identity to ensure the email is coming from the organization it claims to be. Implementing DKM relies on public keys and digital signatures.
5) PGP (Pretty Good Privacy)
Protect email messages and other digital assets using a variety of encryption algorithms. PGP is not a standard, but an independently developed product widely used on the Internet. OpenPGP and GnuPG are open source products based on PGP.
6) Forced encryption
Email encryption over TLS
4.3.3. Remote access
4.3.3.1 Remote access technology
•Remote access to specific services: Allow users to remotely access and use specific services, such as email only
•Remote Control: Allows an authorized user to gain remote access to another system and have physical control over the remote system.
•Screen scraping: Copying information displayed in one application to another application for use or display.
Encryption is implemented to reduce the risk of unauthorized disclosure or destruction.
4.3.3.2 Remote access security management
•Multi-factor authentication: Use multiple verification methods for added security.
. Limit remote access: Allow only those who need and frequently use remote access.
•Transmission link encryption: Protect data transmission using technologies such as VPN, SSL, TLS, SSH and IPSec.
4.3.3.3 Authentication method
4.3.3.4 VPN
Is a communication tunnel that establishes a secure point-to-point connection over an untrusted network (such as the Internet). Most VPNs use encryption to protect encapsulated traffic, but encryption is not a requirement for a connection to be considered a VPN.
•Tunnel technology
The initial packet is protected by encapsulating it using another protocol, with the traffic visible only to systems on both ends of the tunnel and hidden from untrusted networks.
Common VPN protocols:
1 PPTP: Point-to-Point Tunneling Protocol, developed from the PPP dial-up protocol, is used to encapsulate traffic at the data link layer and is used on IP networks. Authentication traffic is protected using the same authentication protocols supported by pPP. Now considered unsafe and obsolete.
2 L2TP: Layer 2 Tunneling Protocol, used to create point-to-point tunnels to connect different networks. L2TP itself does not provide encryption and therefore does not provide confidentiality or strong authentication, but it can be combined with IPSec to provide these services. L2TP supports TACACS and RADIUS. The L2TPV3 version has improved security features, including improved encapsulation and support for more communication technologies, such as Frame Relay, Ethernet, and ATM.
3 IPSec: A network layer security protocol that can add encryption and authentication information to IP data packets.
4 OpenVPN: An open source VPN protocol based on the SSLITLS protocol and supports multiple encryption algorithms.
5 SSTP: A tunneling protocol based on HTTPS that can be transmitted through firewalls.
4.3.4.1 Frame Relay
•A fast data transmission technology based on packet switching technology
•Use virtual circuits rather than dedicated physical circuits
•Encrypt traffic on shared virtual circuits via VPN to ensure confidentiality
•Wide Area Network (WAN) lines mainly used in small and medium-sized enterprises
•Gradually replaced by ATM, IP and other protocols (including VPN)
4.3.4.2 Asynchronous Transfer Mode (ATM)
•A high-speed data transmission technology mainly used to provide high-speed data transmission and various types of information transmission services
•Use fixed-size (53 bytes) data units (cells) for data transmission
•Support high-speed transmission, high flexibility and high reliability
•With the popularity of IP networks, ATMs are gradually being replaced
4.3.4.3 Multiprotocol Label Switching (MPLS)
Please refer to 4.1.5.3 Fusion Protocol Introduction to MPLS
4.3.4. Data communication
4.3.5.Virtualized Network
Network virtualization integrates hardware and software network resources into a unified entity, with software controlling various network functions. This facilitates sensitive network segmentation and host isolation. Network security can be improved by using virtual local area networks (VLANs) and applying different security policies. Network virtualization can also dynamically reconfigure the network in the event of an attack or disaster, improving resiliency.
4.3.6. Third-party connections
1. Third-party connections include:
•Data and telecommunications providers (such as ISPs)
•Cloud service provider
•Suppliers, customers, partner organizations, etc.
2 risks
The main risk is compliance risk. As data owners, organizations are responsible for ensuring that third-party partners’ data management and protection practices comply with legal and regulatory requirements. This includes aspects such as the location of servers and systems that host and process data.
3 Best Practices
•Use compliance reports (such as SOC2 reports) to assess security and compliance risks associated with third-party connections.
• Ensure third-party accountability through Service Level Agreements (SLAs).
•Protect data using transport encryption, strong access control procedures, and email filtering.
. Continuously monitor third-party connections to detect new threats, anomalous behavior, or deviations from SLAs.
Practice questions
1.Gary wants to distribute a large file and prefers to use a peer-to-peer content delivery network (CDN). Which of the following is the most common example of this type of technology? A.CloudFlare B. BitTorrent C. Amazon CloudFront D. Akamai Edge
B
2. While conducting a security assessment of wireless networks, Jim discovered that a network using WPA was using LEAP. What advice should Jlim make? A Continue using LEAP. For WPA networks, it provides better security than TKIP. B. Use other protocols such as PEAP or EAP-TLS and implement WPA2 if supported. C. To avoid authentication issues, continue using LEAP, but switch to WPAz. D. Use other protocols such as PEAP or EAP-TLS. and implement Wired Equivalent Privacy to avoid wireless security issues.
B look up books P410 There are two types of WAP identity authentication: OSA (plain text) and SKA (pre-communication authentication) The Wired Equivalent Privacy in option D is WEP
3.Ben connected his laptop and tablet using 802.11ac. What wireless network mode is he using to connect these devices? A.Infrastructure model B. Wired expansion mode C. Ad hoc network mode D.Independent mode
C
4. Selah's and Nick's PCs send traffic at the same time, causing them to send data at the same time. Which of the following networking terms describes the range of systems in a network that may be affected by the same problem? A. Subnet B. Supernet C.Conflict domain D.Broadcast domain
C
5. Sarah is manually reviewing a packet capture of TCP traffic and discovers that a system is sending TCP packets repeatedly over a short period of time with the RST flag set. In the TCP packet header, what does this flag mean? A.RST flag represents "Rest". The server requires traffic to be paused for a short period of time. B.RST flag represents "Relay-set". The packet will be forwarded to the address set in the packet. C.RST flag represents "Resume Standard". Communications will return to normal format. D. RST stands for “Reset”. The TCP session will be disconnected.
D
6.Gary is deploying a wireless network and wants to deploy the fastest wireless technology. Which of the following wireless network standards should be used? A. 802.11a B. 802.11g C. 802.11n D. 802.11ac
D
7Michele hopes to replace FTP traffic with a secure protocol. Which security protocol should she choose? A.TFTP B. HFTPS C.SecFTP D.SFTP
D
8.Jake is informed that his network has a layer 3 problem. Which of the following is related to No. 3 in the OSI model? Layer related? A.IP address B.TCP and UDP protocols C.MAC address port. Send and receive bits through hardware
A
9. Frank is responsible for ensuring that his organization has reliable, supported network hardware. Which of the following is not a common problem faced by network administrators as they try to ensure continued operation of their networks? A. Is the device supported by the vendor? B. Is the equipment within the warranty period? C. Whether the main equipment supports redundant power supply D. Whether all devices support redundant power supplies
D
10.Brian is selecting an authentication protocol for a PPP connection. He wanted an option that would encrypt usernames and passwords and prevent replay attacks through challenge/response conversations. He also wants to re-certify the remote system regularly. Which protocol should he use? A.PAP B. CHAP C. EAP D. LEAP
B
11. Which of the following protocols is commonly used to provide backend authentication services for VPNs? A. HTTPS B. RADIUS C.ESP D.AH
B
12. Issca wants to ensure that his VoIP session initialization is secure. Which protocol should he make sure to enable and require? A. SVOIP B.PBSX C. SIPS D.SRTP
C P405 In the original words of the book, RTP or SRTP carries the Session Initiation Protocol (SIP) resume after the communication link between the endpoints is taken over Use SIPS for initialization security
For Questions 13-15, please refer to the following scenario and diagram: Coris is designing a hierarchical network for his organization 13. Which firewall design is shown in the diagram? A. Single layer firewall B. Double-layer firewall C. Three-layer firewall D. Four-layer firewall 14. If the VPN grants the remote user the same access to network and system resources as the local workstation, which security question should Chris ask? A.VPN users will not be able to access the web server. B. No additional security issues; the logical network location of the VPN aggregator is the same as the logical network of the workstation Location match. C. Web server traffic is not statefully inspected. D. VPN users should only connect from controlled PCs. 15. If Chris wants to prevent cross-site scripting attacks against a web server, what is the best device for this purpose and where should he place it? A. Firewall, location A B. Intrusion Detection System (1DS), Location A C. Intrusion Prevention System (IPS), Location B D.web application firewall (WAF), location C
B
D
C
16. Susan is deploying a routing protocol that maintains a list of destination networks, including the number of hops to reach the destination network and the direction in which traffic should be sent. What type of protocol is she using? A. Link State Protocol B. Link Distance Protocol C. Destination Metric Protocol D. Distance vector protocol
D
17.Ben has configured his network not to broadcast the SSID. What was Ben's reason for disabling SSID broadcasting, and how was his SSID discovered? A. Disabling SSID broadcast prevents attackers from discovering encryption keys. The SSID can be recovered from decrypted packets. B. Disabling SSID broadcast can hide the network from unauthorized personnel. The SSID can be discovered by using a wireless sniffer. C. Disabling SSID broadcasting can prevent beacon frame issues. The SSID can be recovered by rebuilding the BSSID. D. Disabling SSID broadcast helps avoid SSID conflicts. SSDs can be discovered by trying to connect to the network.
B
18. Which of the following network tools protects the client's identity and provides Internet access while accepting a client request, modifying the request's source address, mapping the request to the client, and sending the modified request to the destination address? A. Switch B.Agent C router D. Firewall
B P423 Original words in the book, focus on protecting client identity in the question
19 Susan wants to secure communications traffic sent from her company's second location through multiple Internet service providers. For an always-connected link, which technique should she use to protect the stream? A. FCoE B.SDWAN C. Site-to-site IPsec VPN D.Zigbee
C
20. Melissa wants to consolidate multiple physical networks in her organization in a manner that is transparent to users while allowing resource allocation based on the needs of network services. What type of network should she deploy? A. iSCSI B. Virtual Network C.SDWAN D.CDN
B
21. Which email security solution provides two main usage modes: (1) Provide integrity, and confidentiality encapsulated message pattern? Signed message with sender authentication and non-repudiation: (2) Provides integrity, sender authentication A.S/MIME B. MOSS C.PEM D.DKIM
A Look up books PEM provides email encryption mechanisms, including authentication, integrity, confidentiality and non-repudiation services. Uses RSA, DES, and X.509. But the question says there are two modes, so choose A P461
•Email Security Standards:
1) S/MIME (Secure Multipurpose Internet Mail Extensions)
Enable email authentication and confidentiality using public key encryption and digital signatures. Authentication is provided using X.509 digital certificates, and Public Key Cryptozoology Standard (PKCS) encryption provides privacy.
Two mechanisms (message types) are provided: signed messages and secure envelope messages. Signed messages provide integrity, identity authentication, and non-repudiation, and secure envelope messages provide recipient identity authentication and confidentiality.
2) MOSS (MIME Object Security Service)
There are security vulnerabilities using the MD2 and MD5 algorithms. MOSS was never widely deployed and has now been abandoned, mainly due to the popularity of PGP.
3) PEM (Privacy Enhanced Email)
Provides email encryption mechanisms, including authentication, integrity, confidentiality, and non-repudiation services. Uses RSA, DES, and X.509.
4)DKIM (Domain Name Key Identified Mail)
Verify domain identity to ensure the email is coming from the organization it claims to be. Implementing DKM relies on public keys and digital signatures.
5) PGP (Pretty Good Privacy)
Protect email messages and other digital assets using a variety of encryption algorithms. PGP is not a standard, but an independently developed product widely used on the Internet. OpenPGP and GnuPG are open source products based on PGP.
6) Implicit SMTPS
SMTP is encrypted over TLS, using port tcp465
7) DMARC
DNS-based email authentication system to prevent phishing and other fraud
22. While conducting a security assessment, Jim discovered that the organization he was working with used multiple layers of protocols to handle SCADA systems and, more recently, connecting the SCADA network to the rest of the organization's production networks. About Via TCP/IP What kind of concern should he raise about the serial data transmission? A. SCADA devices connected to the network can now be attacked over the network. B. Unable to encrypt serial data over TCP/IP. C. Serial data cannot be transmitted in TCP packets. D.The throughput of TCP/IP can lead to a simple denial of service attack on a serial device.
A P404 P292 SCADA attack
23.Ben provides network and security services to a small coffee chain. A coffee chain wants to provide customers with free, secure Wi-Fi. If Ben does not need to worry about protocol support, which of the following options is best for allowing customers to securely connect to a wireless network without requiring a user account? A. WPA2 using PSK mode. B. WPA3 using SAE mode. C. Use WPAz in enterprise mode. D. Use a captive portal.
B P412 SAE uses default passwords and client and AP memory authentication and key exchange PSK uses fixed static passwords for identity authentication Obviously B is safer Supplement ENT enterprise mode, support RADIUS or TACACS
24.Alicia's company has implemented multi-factor authentication using SMS messages to provide digital codes. What are the main safety concerns Alicia might express about this design? A. SMS messages are not encrypted. B. SMS messages can be disguised by the sender. C. SMS messages may be received by multiple mobile phones. D. SMS messages may be stored on the receiving mobile phone.
A
What speeds and frequency ranges does 25.802.11n use? A. 5 GHz only B.900 MHz and 2.4 GHz C.2.4 GHz and 5 GHz D. 2.4 GHz only
C
26. Address Resolution Protocol (ARP) and Reverse Address Resolution Protocol (RARP) in the OSI model Which level of operation does the type operate on? A. Level 1 B. Level 2 C.Level 3 D. Level 4
B
27.Which of the following is a converged protocol that allows storage mounting over TCP and is often used as a lower cost alternative to Fiber Channel? A. MPLS B.SDN C.VolP D. iSCSI
D
28. Chris is building an Ethernet network and knows he needs to span a distance of more than 150 meters in a 1000BaseT network. What networking technology should he use to help solve this problem? A. Install a repeater, switch or hub 100 meters in front. B. Use Category 7 cables with better screen performance for higher speeds. C. Install a gateway to handle distance issues. D. Use STP cables to handle high-speed transmission over longer distances.
A
For questions 29-31, please refer to the following scenarios and illustrations: Selah's organization has been using a popular messaging service for years. Recently, some concerns have been raised about the use of Messages 29. Based on the diagram, what protocol is most likely used by message traffic? A. SLACK B.HTTP C SMTP D HTTPS 30. What security concerns arise from sending internal communications from A to B? A. The firewall cannot protect system B. B. System C can see broadcast traffic from system A to B. C. It is transmitted through an unencrypted protocol. D. Messaging does not provide non-repudiation. 31. How can Selah's company best meet the need for secure messaging for users of internal systems A and C? A. Use a third-party messaging service. B. Implement and use locally hosted services. C. Use HTTPS. D. Stop using messaging and use more secure email instead
B
C
B remember
32. Which of the following disadvantages is a concern when allowing multilayer protocols? A. A range of protocols can be used at higher layers. B. Allow hidden channels. C. Cannot bypass the filter. D. There is no way to encrypt on multiple levels.
B
33 Which of the following is not a fusion protocol? A. MIME B. FCoE C. iSCSI D.VolP
A P404
Converged protocols: SAN, FCoE, MPLS, iSCSI, VoIP, VPN, SDN, cloud, virtualization, SOA, microservices, infrastructure as code, serverless architecture
34.Chris uses a mobile hotspot to provide Internet access while traveling. Which security issue might he cause if he maintains a hotspot connection while his personal computer is connected to the organization's corporate network? A. Traffic may not be routed correctly, exposing sensitive data. B. His system may act as a bridge from the Internet to the local network. C. His system could be an entry point for a reflected DDoS attack. D. The security administrator may not be able to determine his IP address when a security issue occurs.
B
35. As an information security professional, Susan was asked to identify places on her organization's wireless network that could potentially be accessed, even though this was not intended. What should Susan do to determine where her organization's wireless network has access? A. On-site survey B. Walking detection C. Driving detection D. Design the map
A
36. What capabilities does IPsec provide for secure communications? A. Encryption, access control, non-repudiation and message authentication B. Protocol convergence, content distribution, micro-segmentation and network virtualization C. Encryption, authorization, non-repudiation and message integrity checking D. Micro-segmentation, network virtualization, encryption and message authentication
A P471 does not support authorization IPsec AH supports authentication, access control, and anti-replay IPsec ESP supports encryption and identity authentication AH provides integrity and non-repudiation ESP provides confidentiality and integrity
37.Casey was asked to determine whether Zigbee network traffic could be protected in transit. What security mechanisms does zigbee use to protect data traffic? A.3DES encryption B.AES encryption C. ROT13 encryption D. Blowfish encryption
B P420 Zigbee uses Bluetooth technology, low power consumption and low throughput rate, close to the device, and supports 128-bit encryption algorithm P190 3DES key is 168 bits or 112 bits AES supports 128 192 256
38. Sue changes her MAC address to allow on networks that use MAC filtering to provide security. What technique did Sue use, and what non-security issue might her actions cause? A. Broadcast domain utilization, address conflict B. Cheating, token loss C. Spoofing, address conflict D. Fake EUI created, token lost
C
39.jim wants to deploy 4GLTE as an out-of-band management solution at all certification sites. Which of the following is safe Feature not usually available with 4G service providers? A. Encryption function B. Device-based authentication C. Dedicated towers and antennas for security service subscribers D. SIM card based authentication
C
40. SMTP, HTTP and SNMP belong to which layer of the 0SI model? A. Level 4 B. Level 5 C Level 6 D.Level 7
D
41. Melissa uses the ping utility as part of a penetration testing exercise to check whether a remote system is online. If she doesn't want to see her ping packets in the packet sniffer's logs, which protocol should she filter out? A.UDP B TCP C.IP D. ICMP
D
42.selah wants to provide port-based authentication on her network to ensure that clients must authenticate before using the network. Which of the following technologies is an appropriate solution for this requirement? A. 802.11a B.802.3 C. 802.15.1 D. 802.1x
D
43. Ben has deployed a 1000BaseT Gigabit network and needs to run a cable through a building. If Ben connects his link directly from one switch to another switch in the building, what is the maximum distance that Ben can cover according to the 1000BaseT specification? A.2 kilometers B.500 meters C.185 meters D.100 meters
D
44.Which security control in a wired network does MAC cloning attempt to bypass? A. Port security B. VLAN hopping C.802.1q Thousand Roads D. Etherkiller protection
A
45.Kathleen's company has moved most of its employees to remote work and wants to ensure that their multimedia collaboration platform for voice, video, and text-based collaboration is secure. Which of the following security options provides the best user experience for communications and provides appropriate security? A. Requires a software VPN connection to the corporate network for all communications using the collaboration platform. B. Require the use of SIPS and SRTP for all communications. C. Use TLS for all traffic to the collaboration platform. D. Deploy secure VPN endpoints at each remote location and use point-to-point VPNs for communication.
C Interference choice D, it should not be point-to-point
46.Chris wants to use a low-power personal area network wireless protocol for a device he is designing. Which of the following wireless protocols is best suited for communicating between small, low-power devices connected over relatively short distances between buildings or rooms? A. WiFi B.Zigbee C.NFC D.Infrared ray
B
47. Which of the following options contains standards or protocols that exist at layer 6 of the OSI model? A NFS, SQL and RPC B. TCP, UDP and TLS C.JPEG, ASCII and MIDI D.HTTP, FTP and SMTP
C
48.cameron is concerned about a distributed denial-of-service attack on the company's main web application. Which of the following options provides the greatest resilience to large-scale DDoS attacks? A.CDN B. Increase the number of servers in the web application server cluster C. Sign up for DDoS mitigation services through your company’s ISP D. Increase the amount of bandwidth provided by one or more ISPs
A
49. There are four common protocols for VPNs. Which option below contains all common VPN protocols? A. PPTP, LTP, L2TP, IPsec B. PPP. L2TP. IPsec. VNC C. PPTP. L2F. L2TP. IPsec D. PPTP. L2TP. IPsec, SPAP
C
50. Wayne wants to deploy a secure voice communications network. Which of the following technologies should be considered? (Select all that apply.) A. Use private VLANs for VoIP phones and devices. B. Requires SIPS and SRTP. C. Require VPN for all remote VoIP devices. D. Implement VoIP IPS.
AB Remember
Which layer of the 51.0S1 model includes electrical specifications, protocols, and interface standards? A. Transport layer B. Device layer C.Physical layer D. Data link layer
C
52.Ben is designing a WiFi network and is asked to choose the most secure network security standard. Which wireless security standard should he choose? A.WPA2 B. WPA C.WEP D.WPA3
D
53.Kathleen has two main locations in town and wants both environments to look like the same locale network. Routers, switches and wireless access points are deployed at each location. Which of the following techniques is best for making the two facilities appear to be on the same network segment? A.SDWAN B. VXLAN C. VMWAN D. iSCSI
B
54 Segmentation, ordering, and error checking all occur within the OS!I model associated with SSL, TLS, and UDP -layer? A Theological Layer B network layer C session layer D. Presentation layer
A
55. The Windows ip-config command displays the following information: BC-5F-F4-78-48-7D. What is this term? What information can typically be obtained from it? A IP address, the network location of the system B MAC address, manufacturer of network interface card C. MAC address, media type used D.IPV6 Client 1D, manufacturer of network interface cards
B
56. Chris asked for a choice between implementing PEAP and LEAP for wireless authentication. he should choose what why? A LEAP. Because it fixes issues related to TKIP, thereby providing stronger security B.PEAP. Because it implements CCMP to provide security C. LEAP because it implements EAP-TLS for end-to-end session encryption D.PEAP. Because it can provide a TLS tunnel that encapsulates the EAP method, protecting the entire session
D
57.Ben is troubleshooting a network problem and discovers that the internal network of the NAT router he is connected to is 192.168.x.x subnet, and outside that is 192.168.1.40. What's his problem? A 192.168.x.x is a non-routable network and is not transmitted to the Internet. B.192.168 1.40 is not a valid address because it is reserved by RFC 1918. C Unable to select double NAT using the same 1 range• D. The upstream system cannot decapsulate his packets and needs to use PAT instead.
C
58. What is the default subnet mask for a Class B network? A. 255.0.0.0 B. 255.255.0.0 C. 255.254.0.0 D. 255.255.255.0
B
59.Jim's organization uses a traditional PBX for voice communications. What are the most common security issues with internal communications? What measures should he recommend to prevent it? A. Eavesdropping, encryption B Man-in-the-middle attack, end-to-end encryption C eavesdropping, physical security D. Dial-up scanning and deploying an intrusion prevention system (IPS)
C P452 is easy to be eavesdropped and intercepted. The security of voice communication must be protected through physical security.
60 What are the technical differences in wireless communication via WiFi and LiFi A. LiFi is not susceptible to electromagnetic interference. B.LiFi cannot provide broadband speeds. C. WiFi is not susceptible to electromagnetic interference. D.WiFi cannot provide broadband speeds.
A
61.Soan's organization has VoIP phones deployed on the same switch as the desktop computers. What security issues might this cause and what solutions might help resolve it? A. VLAN hopping attack; using physically separated switches. B. VLAN hopping attack; using encryption. C. Calling number spoofing: Use MAC filtering. D. Denial of service attack; use firewalls between networks.
A
For questions 62-65, please refer to the following scenario: Susan is designing the organization's new network infrastructure for the branch office. 62. Susan wants to use a non-routable set of IP addresses for the location's internal network address. Based on your knowledge of secure network design principles and IP networking, which of the following IP address ranges could be used for this purpose? (Select all that apply.) A. 172.16.0.0/12 B. 192.168.0.0/16 C. 128.192.0.0/24 D. 10.0.0.0/8 63. Susan knows that she will need to implement a WiFi network for her customers and wants to collect the customers' information, such as their email addresses, without having to provide them with their wireless network passwords or keys. What type of solution will provide this combination of capabilities? A.NAC B. A captive portal C. Pre-shared key D. SAE mode of WPA3 64. After setting up her wireless network, Susan set out to ensure that her network would remain operational even if outages occurred. If there is a temporary outage or other temporary power problem, which of the following is the simplest way she can ensure that her network equipment, including routers, access points, and network switches, remain powered on? A. Purchase and install a generator with an auto-start feature. B. Deploy dual power supplies for all network devices. C. Install the UPS system and pre-cover all network devices that must remain online. D. Contract with multiple different power companies to obtain redundant power. 65. Susan wants to provide a 10Gigabrt network connection to the equipment in the new branch office. Which of the following structured cabling options can meet these speed requirements? (Select all that apply.) A. Cat5e B fiber optic C Cat6 D coaxial cable
ABD
B
C
B.C.
66 In which three levels of the OSl model do data flows appear? A. Application layer, presentation layer and session layer B. Presentation layer, session layer and transport layer C. Physical layer, data link layer and network layer D. Data link layer, network layer and transport layer
A remember
67.Lucca wants to protect endpoints that are in production use but are no longer supported and cannot be patched from cyberattacks. What measures should he take to best protect these devices? A. Install a firewall on the device. B. Disable all services and open ports on the device. C. Place a hardware network security device in front of the device. D. Unplug devices from the network as these devices cannot be properly protected.
C remember
68. selah’s networking team was asked to find a technology that could dynamically change an organization’s network by treating the network as code. What type of architecture should she recommend? A. A network that follows the 5-4-3 rule B. Converged network C. Software-Defined Networking D. Virtualization-based network
C
69.Jason knows that protocols using the OSI model rely on encapsulation when data flows from one layer to another. As data flows through the OSI layers, what does each layer add? A. Information is added to the header. B. Information is added to the body of the data. C. The data is encrypted using the new secret key. D. A secure envelope that provides complete forward secrecy.
A
70 During the troubleshooting process, when Alyssa communicated with technical support, they stated that the problem was a Layer 3 issue. Which of the following possible problems is not a Tier 3 problem? A. TTL mismatch B.MTU mismatch C. Wrong Access Control List (ACL) D. Network cable failure
D
71, while conducting an audit of the organization's network, Angela discovered that the network suffered a broadcast storm and that precontractors, guests, and organization managers were all on the same network segment. Which design should Angela recommend? A. Require all users to encrypt B. Install firewalls at network boundaries. C. Enable spanning tree loop detection. D. Segment the network based on functional requirements.
D
72. At which layer of the OSI model do ICMP, RIP, and Network Address Translation occur? A. Level 1 B. Level 2 C. Level 3 D.Level 4
C
For questions 73-75, consider the following scenario: Ben is an information security professional whose organization is replacing its physical servers with cloud-hosted virtual machines. As organizations build virtual environments, it is moving towards a hybrid cloud operating model, where some system services remain in on-premises data centers while other systems and services are hosted in the cloud. The image below shows the network IP ranges for this data center and the cloud VPC (the same address, 10.0.0.0/24 is used). You will need to consider this information when answering the questions. 73.Ben wants to ensure that traffic between instances (system to system) in his cloud-hosted Infrastructure-as-a-Service environment is secure. What can he do to completely ensure that virtualized network traffic will not be captured and analyzed? A. Prevent packet sniffers from being installed on all hosts. B. Disable promiscuous mode for all virtual network interfaces. C. The use of any virtual TAP is prohibited. D. Encrypt all traffic between hosts. 74. What issue is most likely to occur due to the subnets configured for the data center and VPC? A.IP address conflict B. Routing loop C.MAC address conflict D. All of the above 75. Ben wants to use multiple Internet Service Providers (ISPs) to connect to his cloud VPC to ensure reliable access and bandwidth. What techniques can he use to manage and optimize these connections? A. FCoF B. VXLAN C.SDWAN D.LiFi
D
A
C P406 SDWAN is mainly used for the management and control of WAN links in cloud services.
76. What common encryption scheme is WPA2's Counter Mode Cipher Block Chained Message Authentication Mode Protocol (CCMP) based on? A.DES B. 3DES C.AES D.TLS
C P410 AES-CCMP
77. When a host in an Ethernet network detects a collision and sends an interference signal, what happens next? A. The host sending the jamming signal is allowed to resend the data, while other hosts suspend sending until the transmission is successfully received. B. All hosts stop sending, and each host waits for a random period of time before trying to resend. C. All hosts stop sending, and each host waits for a period of time based on its most recent successful send. D. The host waits for the token to be passed and then resumes transmitting data when the token is passed.
B remember
78.Mark is concerned about the physical security of network cables. What type of network connection is the most difficult to eavesdrop without specialized equipment? A. WiFi B.Bluetooth C. Cat5/ Cat6 twisted pair D. Optical fiber
D
79.Rich wants to connect his network to a building half a mile from his current location. There are trees and terrain features along the way, but a path leads through the trees to another location. Which transmission medium is best for this deployment? A. Set up the repeater every 200 to 300 yards of the Ethernet cable B. WiFi directional antenna C. Fiber optic cable D. LiFi system
C
80. What are the most common challenges faced in deploying endpoint security systems? A. damaged B. Large amount of data C Monitor encrypted traffic on the network D Handles non-TCP protocols
B P432 After the first paragraph is summarized, the answer is B
81. What type of address is 127.0.0.1? A. Public IP address B. RFC 1918 address C.APIPA address D. Loopback address
D
82.Susan is writing a best practice statement for organizational users who need to use Bluetooth. She knows that Bluetooth has potential security issues. Which of the following sets of guidelines should be included in Susan's statement? A Use the strong encryption built into Bluetooth, change the default PIN on your device, and turn off discovery mode and Bluetooth during inactive use. B. Only use Bluetooth when not involved in confidential activities, change the default PIN on the device, and Turn off discovery mode and Bluetooth when in use. C. Use the strong encryption built into Bluetooth and use an extended (eight digit or longer) Bluetooth PIN code to turn off discovery mode and Bluetooth functionality during inactive use. D. Only use Bluetooth when not involved in confidential activities, use extended (eight-digit or longer) Bluetooth PIN code to turn off discovery mode and Bluetooth functionality during inactive use.
B P416 No extended password
83. Which type of network device is most commonly used to assign endpoint systems into virtual LANs (VLANs)? A. Firewall B. Router C.Switch D. hub
C
84. Steve is tasked with implementing a network storage protocol on an IP network. Which storage-centric convergence protocol is he most likely using in his implementation? A. MPLS B. FCoE C.SDN D. VoIP
B
85. Michelle is told that the organization she is joining uses an SD-WAN controller architecture to manage their wide area network (WAN) connectivity. What assumptions can she make about the management and control of the network? (All that apply.) A network uses predefined rules to optimize performance. B. The network is continuously monitored to support better performance. C. The network uses self-learning technology to respond to network changes. D. All connections are managed by the organization's primary Internet service provider.
ABC remember
86 The following photo shows the horizontal layers of 03) in the correct order from the fresh construction layer to the 7th layer. Please put the layers of the OS1 model shown here in the correct order, from layer 1 to layer 7. A Layer 1 = data link layer; Layer 2 = physical layer, Layer 3 = network layer; Layer 4 two transmission Layer; Layer 5 = session layer; Layer 6 - presentation layer; Layer 7 = application layer B. Layer 1 = physical layer; Layer 2 = data link layer; Layer 3 = network layer; Layer 4 = transmission Layer; Layer 5 = Session Layer; Layer 6 = Presentation Layer; Layer 7 = Application Layer C Layer 1 = Physical layer: Layer 2 and data link layer; Layer 3 = Network layer; Layer 4 = Transmission Layer; Layer 5 = session layer; Layer 6 = application layer; Layer 7 = presentation layer 口. Layer 1 = physical layer; Layer 2 = data link layer; Layer 3 = network layer; Layer 4 = session layer; Layer 5 = transport layer; Layer 6 = presentation layer; Layer 7 = Application layer
B
87. Valerie has enabled port security on her network switch. Which type of attack is she most likely trying to prevent? A. IP spoofing B.MAC aggregation C. CAM table flooding D.VLAN hopping
C P402 port security blocks communication with unknown, unauthorized and malicious devices Another method is static ARP entries
88. Alaina wants to ensure that the system complies with her network security settings before being allowed onto the network and wants to test and verify the system settings as much as possible. What type of NAC system should she deploy? A. Pre-authentication, no need for client-side NAC system B. Post-authentication, client-based NAC system C. Pre-authenticated, client-based NAC system D. Post-authentication, no need for client-side NAC system
C
89． Derek wants to deploy redundant core routers, as shown in the figure. Which high-availability cluster model will provide him with the maximum throughput? A. Master/Master Mode B. Line interaction mode C. Active/standby mode D. Adjacent line mode
A
90 Angela wants to choose among the following protocols for secure authentication and does not want to introduce unnecessary technical complexity. Which authentication protocol should she choose? Why? A.EAP because it provides strong encryption by default B.LEAP because it provides frequent re-authentication and changing WEP keys C.PEAP because it provides encryption and is not affected by the same vulnerabilities as LEAP D. EAP-TLS
C
91. What are the concerns that often arise for systems that require high-performance Internet connectivity when satellite Internet is the only option available? A. Security B. Compatibility with protocols such as LiFi C. Compatibility with protocols such as zigbee D.delay
D
92.Which layer of an SDN implementation uses programs to communicate resource requirements through APIs? A. Data plane B. Control plane C. Application plane D.Monitoring plane
C API-Application not found
93. Which of the following is not a disadvantage of multi-layer protocols? A. They can bypass filters and rules. B. They can run at higher OSI levels. C. They can allow covert passage. D. They can bypass network segment boundaries.
B
94. Arrange the following layers of the TCP/IP model in order, starting with the application layer and moving down the protocol stack. 1. Application layer 2. network access layer 3. Internet layer 4. Transport layer A.1,2.3.4 B. 1,4,2,3 C. 1,4,3,2 D. 4,1,3,2
C
95. What is the maximum speed of Category 5e cable? A. 5Mbps B. 10Mbps C. 100Mbps D. 1000Mbps
D
What are the two main advantages of 96.56G network over 4G network? (Select all that apply.) A Anti-interference function B Enhanced user identity protection C Mutual Authentication Capability D.Multi-factor authentication
B.C. Not found, remember
97. What function does VXLAN play in a data center environment? A It removes the maximum distance limitation of Ethernet cables. B It allows multiple subnets to exist in the same IP space, using hosts with the same IP address. D. All of the above C. It tunnels the layer 2 connection over the layer 3 network, extending it to the underlying layer network.
C remember
98.Chris is setting up a hotel network and needs to ensure that systems in each room or suite can connect to each other, but that systems in other suites or rooms cannot. At the same time, he also needs to ensure that all systems in the hotel can connect to the Internet. Which solution should he recommend as the most effective business solution? A. VPN for each room B.VLAN C.Port security D. Firewall
B
99. While conducting a forensic investigation, Charles was able to determine the media access control (MAC) addresses of systems connected to the compromised network. Chariles knows that the MAC address is associated with the manufacturer or vendor and is the system part of the fingerprint. Which layer of OSI is the MAC address? A. Application layer B. Session layer C.Physical layer D. data link layer
D
100. Mikayla is reviewing her organization's VoIP environment configuration and finds a diagram showing the following design. What kind of concern should she express? A The voice connection is not encrypted and may be eavesdropped. B. There are no safety concerns in this diagram. C. The session initialization connection is not encrypted and may be viewed. D. Both the session initialization and the voice data connection are unencrypted and may be captured and analyzed.
C Initialization should use SIPS