site_logo

previous


  1. A+ Core 1 Practice Tests
  2. A+ Core 2 Practice Tests
  3. Network+ Practice Tests
  4. Security+ Practice Tests

CompTIA® Network : Threats, Vulnerabilities, & Mitigation Techniques & Others

5.4 Explain common threats, vulnerabilities, and mitigation techniques.

  • The evil twin is another access point or base station that uses the same SSID as an existing access point. It attempts to fool users into connecting to the wrong AP, compromising their wireless session.

  • Wardriving is the act of using a vehicle and laptop to find open unsecured wireless networks

  • Rogue access points can be described as unauthorized wireless access points/routers that allow access to secure networks

  • war chalking: On finding an open WLAN user writes a symbol on the structure nearby for others to know the credentials of the network.

  • WEP cracking: Many utilites are available on internet to find preshared key (PSK) by using mathematical algorithms. These collect packets transmitted by secure access point and use algorithm on them to get information.

  • Distributed Denial of Service (DdoS): It is an attack where multiple compromised systems (which are usually infected with a Trojan) are used to send requests to a single system causing target machine to become unstable or serve its legitimate users. A hacker begins a DDoS attack by exploiting a vulnerability in one computer system and making it the DdoS "master", also called as "zombie". It is from the zombie that the intruder identifies and communicates with other systems that can be compromised. The intruder loads hacking tools on the compromised systems. With a single command, the intruder instructs the controlled machines to launch one of many flood attacks against a specified target. This causes Distributed Denial of Service (DDoS) attack on the target computer.

  • Denial-of-service (DoS): These attacks, are explicit attempts to block legitimate users system access by reducing system availability. Any physical or host-based intrusions are generally addressed through hardened security policies and authentication mechanisms. Although software patching defends against some attacks, it fails to safeguard against DoS flooding attacks, which exploit the unregulated forwarding of Internet packets. Hackers use zombies to launch DoS or DDoS attacks. The hacker infects several other computers through the zombie computer. Then the hacker sends commands to the zombie, which in turn sends the commands to slave computers. The zombie, along with slave computers start pushing enormous amount of useless data to target computer, making it unable to serve it legitimate purpose.

  • Smurf attack : It is a denial-of-service attack that uses spoofed broadcast ping messages to flood a target system

  • Man-In-The-Middle: These attacks intercept all data between a client and a server. It is a type of active interception. If successful, all communications now go through the MITM attacking computer. The attacking computer can at this point modify the data, insert code, and send it to the receiving computer. This type of eavesdropping is only successful when the attacker can properly impersonate each endpoint.

  • Virus: A computer virus attaches itself to a program or file so it can spread from one computer to another.Almost all viruses are attached to an executable file, and it cannot infect your computer unless you run or open the malicious program. It is important to note that a virus cannot be spread without a human action, (such as running an infected program) to keep it going.

  • Worm: Worms spread from computer to computer, but unlike a virus, it has the capability to travel without any help from a person. The danger with a worm is its capability to replicate itself. Unlike Virus, which sends out a single infection at a time, a Worm could send out hundreds or thousands of copies of itself, creating a huge devastating effect.

  • Buffer overflow occurs when the input is more than that allocated for that purpose. The system doesn't know what to do with the additional input, and it may result in freezing of the system, or sometimes to take control of the system by a hacker. By validating the inputs, it is possible to reduce this vulnerability to a great extent.

  • Packet sniffing is a form of wire-tap applied to computer networks instead of phone networks. It came into vogue with Ethernet, which is known as a "shared medium" network. This means that traffic on a segment passes by all hosts attached to that segment. Ethernet cards have a filter that prevents the host machine from seeing traffic addressed to other stations. Sniffing programs turn off the filter, and thus see everyone traffic.

5.5 Given a scenario, install and configure a basic firewall.

  • Port Security: It deals more with switches and the restriction of MAC addresses that are allowed to access particular physical ports.

  • Dynamic Packet Filters: Also referred to as Stateful Inspection, DPF, unlike static packet filters, monitors each session and makes sure they are valid. Note that a static packet filtering uses only the header information in a packet traversing the FireWall, whereas a Dynamic Packet Filter inspects all the interfaces based on a state table. CheckPoint's® FireWall-1 uses stateful inspection.

  • Implicit deny: It requires that all access is denied by default and access permissions are granted to specific resources only when required. An implicit deny clause is implied at the end of each ACL, and it means that if the provision in question has not been explicitly granted, then it is denied.

  • Access control lists (ACLs) :ACL resides on a router, firewalls or computers and decides who can access the network and who cannot. That means it enable or deny traffic. It specify which user or group of users are allowed what level of access on which resource. It makes use of IP addresses and port numbers.

  • NAT (Network Address Translation) :It is primarily used to hide internal network from external network, such as the Internet. A NAT basically translates the internal IP addresses to external IP addresses and vice-versa. This functionality assures that external users do not see the internal IP addresses, and hence the hosts.

  • DMZ (DeMilitalized Zone) :It is a place separate from the LAN where servers reside that can be reached by users on the Internet. If a company intends to host its own servers to be accessed from public Internet, a DMZ is most preferred solution. The network segment within the DMZ is secured by two firewalls, one interfacing with the public Internet, and the other interfacing the internal corporate network. Thus, a DMZ provides additional layer of security to internal corporate network. The type of servers that are hosted on DMZ may include web servers, email servers, file servers, DNS servers, etc.

5.6 Categorize different types of network security appliances and methods

  • IDS stands for Intrusion Detection System. There are primarily two types of IDSs. These are Network based IDS (NIDS), and Host based IDS (HIDS).

    • If the IDS monitors network wide communication, it is called Network based IDS.

    • If the IDS monitors security on a per host basis, it is called Host based IDS. A host based IDS should be place on a host computer such as a server.

    • Network based IDS is typically placed on a network device such as a router.

  • Honeypots: Honeypots are designed such that they appear to be real targets to hackers. That is a hacker can not distinguish between a real system and a decoy. This enables lawful action to be taken against the hacker, and securing the systems at the same time.

  • Honeynet :It is one or more computers, servers, or an area of a network; these are used when a single honeypot is not sufficient. Either way, the individual computer, or group of servers, will usually not house any important company information.

  • Vulnerability testing is part of testing corporate assets for any particular vulnerability. These may incl

    • Blind testing: Here the hacker doesn't have a prior knowledge of the network. It is performed from outside of a network.

    • Knowledgeable testing: Here the hacker has a prior knowledge of the network.

    • Internet service testing: It is a test for vulnerability of Internet services such as web service.

    • Dial-up service testing: Here the hacker tries to gain access through an organization's remote access servers.

    • Infrastructure testing: Here the infrastructure, including protocols and services are tested for any vulnerabilities.

    • Application testing: The applications that are running on an organization's servers are tested here.

  • Examples of Vulnerability scanner are NESSUS, NMAP

previous



simulationexams.com ad


certexams.com ad

Disclaimer:TutorialsWeb.com is neither associated nor affiliated with CompTIA® or any other company. A+™, Network+™, Security+™, Server+™ are trademarks of CompTIA® organization and duly acknowledged. The Cram Notes material is a copyright of TutorialsWeb.com and the same is not approved or endorsed by respective certifying bodies.