Network Security & Protocols Flashcards

What distinguishes a stateful firewall from a stateless (packet-filter) firewall?

Answer: It tracks the state of active network connections when filtering packets

A stateful firewall monitors the state of network connections and makes decisions based on context, not just individual packet headers.

What is the purpose of a DMZ (Demilitarized Zone) in network architecture?

Answer: To isolate publicly accessible servers from the internal private network

A DMZ places public-facing servers (web, email) in a separate network segment, limiting exposure to the internal network if those servers are compromised.

What does NAT (Network Address Translation) primarily accomplish?

Answer: Maps private internal IP addresses to one or more public IP addresses

NAT allows multiple devices on a private network to share a single public IP address, also providing a layer of obscurity for internal hosts.

What is a site-to-site VPN primarily used for?

Answer: Connecting two entire networks securely over the public internet

A site-to-site VPN creates an encrypted tunnel between two network gateways, connecting entire office networks as if they were on the same LAN.

What is the key difference between an IDS and an IPS?

Answer: An IDS detects and alerts on threats; an IPS can actively block them

An Intrusion Detection System (IDS) passively monitors and alerts, while an Intrusion Prevention System (IPS) sits inline and can block malicious traffic in real time.

Why is network segmentation considered a security best practice?

Answer: It limits the lateral movement of an attacker who breaches one segment

Segmenting a network into smaller zones (VLANs, subnets) contains breaches, preventing an attacker from freely moving between all systems.

Which device operates at OSI Layer 3 and makes forwarding decisions based on IP addresses?

Answer: Router

Routers operate at Layer 3 (Network layer) and use IP addresses in routing tables to forward packets between different networks.