Network Security Controls & Protocols Flashcards

Which protocol provides hop-by-hop authentication and integrity for IPv6 packets?

Answer: AH (Authentication Header)

AH provides hop-by-hop authentication and integrity checking for IPv6 but does not provide confidentiality.

What is the primary purpose of 802.1X port-based access control?

Answer: Authenticate devices before granting network access

802.1X enforces authentication via EAP before a port is authorized, preventing unauthorized device access.

A network engineer wants to prevent rogue DHCP servers on a LAN. Which switch feature should be enabled?

Answer: DHCP Snooping

DHCP Snooping validates DHCP messages and restricts DHCP server responses to trusted ports only.

Which TLS handshake message is used by the client to prove possession of a private key during mutual authentication?

Answer: CertificateVerify

The CertificateVerify message contains a digital signature over handshake data, proving the client holds the private key.

What does a stateful firewall track that a stateless packet filter does not?

Answer: Connection state and session context

Stateful firewalls maintain a state table tracking active connections, allowing return traffic without explicit rules.

Which SNMPv3 security level provides both authentication and encryption?

Answer: authPriv

authPriv uses HMAC for authentication and DES/AES for encryption, providing the highest SNMPv3 security level.

An attacker sends packets with the SYN flag set to exhaust server connection resources. Which control best mitigates this?

Answer: Enabling SYN cookies on the server

SYN cookies allow the server to respond to SYN packets without allocating resources until the handshake completes.

Which protocol replaces Telnet with encrypted remote management and supports public key authentication?

Answer: SSH

SSH (Secure Shell) encrypts all traffic and supports password or public-key authentication for remote CLI access.

What is the role of a Certificate Revocation List (CRL) in PKI?

Answer: List certificates no longer trusted before expiry

A CRL is a signed list published by a CA containing serial numbers of certificates that have been revoked before their expiration.

Which network segmentation control isolates traffic by assigning logical broadcast domains on a physical switch?

Answer: VLAN

VLANs (Virtual Local Area Networks) segment broadcast domains logically, limiting lateral movement between device groups.

A security engineer needs to ensure data integrity without confidentiality for routing protocol updates. Which IPsec mode is most appropriate?

Answer: AH in Transport mode

AH in Transport mode authenticates the packet payload and IP header without encrypting data, providing integrity only.

What is the function of Network Address Translation (NAT) as a security control?

Answer: Hides internal IP address space from external networks

NAT maps private internal IP addresses to a public address, obscuring the internal network topology from external observers.

Which wireless security protocol introduced CCMP as its mandatory encryption algorithm?

Answer: WPA2

WPA2 mandates CCMP (Counter Mode CBC-MAC Protocol) based on AES, replacing the weaker TKIP used by WPA.

During a penetration test, a tester captures a WPA2 4-way handshake. What is the tester attempting?

Answer: Perform an offline dictionary attack against the pre-shared key

The 4-way handshake contains enough information to perform an offline brute-force or dictionary attack against the WPA2 PSK.

Which firewall architecture places publicly accessible servers in a network segment separated from both the internet and the internal LAN?

Answer: Screened subnet (DMZ)

A screened subnet (DMZ) isolates public-facing servers so a compromise does not directly expose the internal network.

What does OSPF use to authenticate routing updates in a secure network deployment?

Answer: Pre-shared keys or MD5/SHA HMAC

OSPF supports plain-text passwords and cryptographic authentication using MD5 or SHA HMAC to validate routing neighbors.

A CND analyst wants to ensure DNS responses are cryptographically validated. Which technology should be deployed?

Answer: DNSSEC

DNSSEC uses digital signatures to allow resolvers to verify that DNS responses have not been tampered with.

Which access control model assigns permissions based on job functions defined by an organization, rather than individual identity?

Answer: RBAC (Role-Based Access Control)

RBAC grants permissions to roles (e.g., admin, auditor) and then assigns users to those roles, simplifying access management.

What is the primary security risk mitigated by enabling BPDU Guard on an access port?

Answer: Rogue switch insertion and Spanning Tree topology manipulation

BPDU Guard disables a port that receives a Bridge Protocol Data Unit, preventing unauthorized switches from influencing STP topology.

Which protocol is used by network devices to synchronize clocks, which is critical for accurate log correlation during incident response?

Answer: NTP

NTP (Network Time Protocol) synchronizes device clocks, ensuring log timestamps are consistent across the network for accurate forensic analysis.