Network and Infrastructure Security Flashcards

During a network review, an auditor finds that network administrators share a single privileged account. This PRIMARILY violates the principle of:

Answer: Non-repudiation and individual accountability

Shared accounts make it impossible to attribute actions to specific individuals, undermining accountability and audit trails.

Which of the following network redundancy configurations provides the HIGHEST availability for a critical link?

Answer: Hot standby with automatic failover

Hot standby with automatic failover switches traffic to the backup link instantly without human intervention, maximizing uptime.

A CISA auditor is reviewing router access control lists (ACLs). The MOST important audit step is to verify that ACLs:

Answer: Reflect the organization's network security policy and follow least privilege

ACLs should be derived from and aligned with the security policy, permitting only necessary traffic on each interface.

Which attack does port security on a switch PRIMARILY mitigate?

Answer: MAC flooding and unauthorized device connections

Port security limits the number of MAC addresses per port, preventing MAC flooding attacks that can overflow CAM tables.

An IS auditor finds that network infrastructure devices have not received security patches in 18 months. The BEST recommendation is to:

Answer: Implement a formal patch management process with defined SLAs for critical devices

A formal patch management process with defined timelines ensures vulnerabilities are addressed systematically without unnecessary disruption.

Which of the following is the PRIMARY purpose of network traffic analysis in an IS audit?

Answer: To detect anomalous traffic patterns that may indicate a security incident

Traffic analysis helps auditors identify deviations from baseline behavior that could signal unauthorized access, data exfiltration, or malware.