Network Security & Vulnerability Flashcards

What is the primary purpose of a firewall in network security?

Answer: To prevent unauthorized access to or from a private network.

A firewall acts as a critical security barrier, filtering incoming and outgoing network traffic based on a set of predefined security rules. Its primary purpose is to prevent unauthorized users or malicious software from gaining access to a private network. By controlling traffic flow, it protects sensitive data and systems from external threats.

What is the difference between an IDS and an IPS in network security?

Answer: IDS monitors while IPS monitors and blocks attacks.

An Intrusion Detection System (IDS) monitors network traffic for suspicious activity and alerts administrators to potential threats. In contrast, an Intrusion Prevention System (IPS) not only monitors for threats but also actively takes steps to block or prevent those attacks in real-time. This makes an IPS a more proactive security measure, as it can stop malicious traffic before it reaches its target.

What is the main goal of penetration testing?

Answer: To find and fix vulnerabilities in a network or system.

Penetration testing involves simulating real-world cyberattacks against a system, network, or application. The main goal is to proactively identify security weaknesses and vulnerabilities before malicious actors can exploit them. By uncovering these flaws, organizations can then implement necessary patches and improvements to strengthen their overall security posture.

Which of the following is an example of a DDoS (Distributed Denial of Service) attack?

Answer: Flooding a server with traffic to cause disruption.

A Distributed Denial of Service (DDoS) attack involves overwhelming a target server, service, or network with a flood of internet traffic from multiple compromised computer systems. The sheer volume of requests exhausts the target's resources, making it unavailable to legitimate users. This disruption is the defining characteristic of a DDoS attack, aiming to deny service rather than steal data.

What is the purpose of network encryption?

Answer: To prevent unauthorized access to data during transmission.

Network encryption transforms data into a coded format, making it unreadable to anyone without the correct decryption key. Its purpose is to protect the confidentiality and integrity of information as it travels across a network. This ensures that even if data is intercepted during transmission, unauthorized parties cannot understand or misuse it.

What is social engineering in the context of cybersecurity?

Answer: Manipulating individuals into disclosing confidential information.

Social engineering is a psychological manipulation tactic used by attackers to trick people into performing actions or divulging confidential information. Instead of technical hacking, it exploits human psychology, often through deception, persuasion, or impersonation. Common examples include phishing emails or pretexting phone calls designed to gain access to systems or data.

What is the function of a VPN (Virtual Private Network)?

Answer: To create a secure connection to a remote network.

A Virtual Private Network (VPN) establishes an encrypted connection, often called a 'tunnel,' over a public network like the internet. This secure tunnel allows users to send and receive data as if their computing device were directly connected to the private network. VPNs are primarily used to provide secure remote access to corporate resources or to enhance privacy by encrypting internet traffic.

What is a vulnerability assessment in network security?

Answer: A process to identify and fix security weaknesses.

A vulnerability assessment is a systematic process of identifying, quantifying, and prioritizing security weaknesses (vulnerabilities) in a system, network, or application. It involves using various tools and techniques to scan for known flaws and misconfigurations. The goal is to provide an organization with a comprehensive list of potential security risks so they can be addressed and mitigated.

What does the term 'phishing' refer to in cybersecurity?

Answer: Sending emails that trick individuals into providing personal information.

Phishing is a type of social engineering attack where attackers send fraudulent communications, typically emails, appearing to come from a reputable source. The goal is to trick recipients into revealing sensitive information, such as usernames, passwords, or credit card details, or to click on malicious links. These attacks often mimic legitimate organizations to gain trust and exploit victims.