Secure Communications
This network protocol enables secure file transfer over SSH.
What is SFTP?
SFTP (SSH File Transfer Protocol) is specifically designed to provide secure file transfer capabilities over the SSH protocol, leveraging SSH's encryption and authentication.
This cryptographic protocol, the successor to SSL, is designed to provide secure communications over a computer network.
What is TLS?
TLS (Transport Layer Security) is the industry standard for secure communication over a network, replacing the older and less secure SSL (Secure Sockets Layer).
What is the primary purpose of a Demilitarized Zone (DMZ) in a network architecture?
What is to provide an additional layer of security for publicly accessible services by isolating them from the internal network?
The DMZ acts as a buffer zone between the internet and the internal network, hosting servers like web servers or email servers that need to be accessible from outside.
This older network protocol, often used for file transfer, sends credentials and data in plain text, making it highly susceptible to eavesdropping attacks.
What is FTP (File Transfer Protocol)?
FTP transmits data, including usernames and passwords, unencrypted, making it vulnerable to sniffers. SFTP and FTPS are secure alternatives.
The MIME specification extends the email message format beyond plain text, enabling the transfer of graphics, audio, and video files. The protocol that specifically enhances MIME for email security features by providing encryption and authentication is called this.
What is S/MIME?
S/MIME (Secure/Multipurpose Internet Mail Extensions) builds upon MIME to add cryptographic security services to email. MIME itself handles content types, but S/MIME adds the security.
A type of cryptographic network protocol for secure data communication, remote command-line login, and remote command execution between two networked computers.
What is SSH?
SSH (Secure Shell) is widely used for secure remote access and command execution over an unsecured network.
Name two common deprecated or insecure encryption protocols and two cryptographic hash functions from the following list: DES, AES-256, MD5, ECC, SHA-1, SSL, RC4.
What are DES, MD5, SHA-1, SSL, RC4? (Any two of each type)
DES (Data Encryption Standard): An older symmetric cipher with a small key size, making it vulnerable to brute-force attacks.
MD5 (Message Digest Algorithm 5): A hash function widely considered broken due to collision vulnerabilities.
SHA-1 (Secure Hash Algorithm 1): A hash function also considered broken due to collision vulnerabilities, though less severe than MD5.
SSL (Secure Sockets Layer): The predecessor to TLS, it has known vulnerabilities (e.g., POODLE).
RC4 (Rivest Cipher 4): A stream cipher with known weaknesses, especially when used improperly.
AES-256, ECC, are currently considered secure.
What is the main security benefit of implementing VLANs (Virtual Local Area Networks) beyond simple network organization?
What is network segmentation to reduce the scope of a breach and limit lateral movement of attackers?
VLANs allow you to logically separate devices within the same physical network, creating distinct broadcast domains and restricting communication between them unless explicitly allowed by a router or firewall.
What is an ARP Spoofing attack, and what common network device is targeted to facilitate this attack?
An ARP Spoofing attack involves an attacker sending false ARP messages to link their MAC address with another device's IP address, often targeting a router to intercept traffic.
By poisoning ARP caches, an attacker can position themselves as a "man-in-the-middle," intercepting, modifying, or dropping traffic.
This email filtering technique uses a list of verified DNS domains to verify that an email is coming from a trusted IP address.
What is Sender Policy Framework (SPF)?
SPF allows domain owners to publish which mail servers are authorized to send email on behalf of their domain, helping to prevent email spoofing.
This suite of protocols and technologies provides encryption, authentication, and data integrity for network traffic, often operating at the network layer.
What is IPsec?
IPsec (Internet Protocol Security) is a set of protocols that provide security for IP communications by authenticating and encrypting each IP packet.
Which three of the algorithms listed below are not symmetric ciphers? (Select 3 answers): AES, DES, DHE, ECC, IDEA, RC4, RSA.
What are DHE, ECC, RSA?
DHE (Diffie-Hellman Ephemeral): An asymmetric key exchange protocol.
ECC (Elliptic Curve Cryptography): An asymmetric cryptography approach.
RSA (Rivest-Shamir-Adleman): An asymmetric encryption and digital signature algorithm.
AES, DES, IDEA, and RC4 are all symmetric ciphers.
When designing a highly available and secure network, implementing redundancy for critical network devices like firewalls and routers is crucial. What is the common term for this concept?
What is High Availability (HA) or Failover Clustering?
HA ensures that if one device fails, a backup device can seamlessly take over, minimizing downtime and maintaining security posture.
This common email protocol, often used for retrieving emails, is inherently insecure as it transmits credentials in clear text unless secured with SSL/TLS.
What is POP3 (Post Office Protocol version 3)?
POP3 (like IMAP and SMTP) needs to be explicitly secured with SSL/TLS (often referred to as POP3S) to encrypt credentials and message content.
What is it called when you create very small, separate security zones within your cloud network to stop attackers from easily moving from one part to another if they get in?
What is Micro-segmentation?
Micro-segmentation helps isolate parts of your network, making it harder for an attacker to spread if they compromise a single component.
Which part of IPsec provides both encryption (confidentiality) and integrity, allowing for secure data transfer?
What is ESP?
ESP (Encapsulating Security Payload) provides confidentiality (encryption), data origin authentication, connectionless integrity, an anti-replay service, and limited traffic flow confidentiality.
Which of the following algorithms do not fall into the category of asymmetric encryption? (Select all that apply): AES, DES, DHE, ECC, IDEA, RC4, RSA.
What are AES, DES, IDEA, RC4?
These are all symmetric encryption algorithms, meaning they use the same key for both encryption and decryption. DHE, ECC, and RSA are all forms of asymmetric encryption or key exchange.
Describe the "Zero Trust" security model in the context of network access and how it fundamentally differs from traditional perimeter-based security.
Zero Trust assumes no user or device, whether inside or outside the network, should be trusted by default, requiring strict verification for every access attempt, unlike perimeter-based models that trust internal users.
Traditional models focus on building a strong perimeter, trusting everything inside. Zero Trust adopts a "never trust, always verify" approach, micro-segmenting the network and enforcing granular access controls.
Describe a "DNS Spoofing" or "DNS Cache Poisoning" attack and its primary goal from an attacker's perspective.
A DNS Spoofing attack involves injecting fraudulent DNS data into a DNS resolver's cache, causing the resolver to return incorrect IP addresses for domain names, with the primary goal of redirecting users to malicious websites.
This attack can lead users to phishing sites, malware downloads, or simply deny service by misdirecting traffic.
What acts like a simple gatekeeper or mini-firewall for your individual virtual machines (computers) that you use in the cloud?
What is a Security Group?
A Security Group controls who can access your cloud computers and what traffic they can send out, acting as a basic network filter at the virtual machine level.
Explain how a Web Application Firewall (WAF) differs from a traditional network firewall in terms of its primary protection scope and attack vectors it addresses.
A WAF specifically protects web applications from attacks like SQL injection, XSS, and CSRF by inspecting HTTP/HTTPS traffic, whereas a traditional network firewall protects the network as a whole at lower OSI layers.
This cryptographic algorithm is considered the least vulnerable to current attacks among DES, RC4, 3DES, and AES.
What is AES?
AES (Advanced Encryption Standard) is the current standard for symmetric encryption and is considered highly secure. DES is easily broken, RC4 has known weaknesses, and 3DES (Triple DES) is more secure than DES but much slower and less efficient than AES.
This decoy system is intentionally left vulnerable to attract attackers, allowing security teams to study their methods and gather intelligence
What is a honeypot?
A honeypot is designed to be attacked. It has no production value, so any traffic to it is inherently suspicious. By monitoring activity on a honeypot, organizations can learn about new attack techniques, malware signatures, and the origin of attacks without risking their actual production systems.
Explain how an attacker can leverage "ICMP Redirects" in a malicious way to perform a man-in-the-middle attack or persistent traffic redirection.
An attacker can send a forged ICMP Redirect message to a host, telling it that a better route exists through the attacker's machine, thereby redirecting subsequent traffic through the attacker's system for interception or manipulation.
ICMP Redirects are legitimate messages used by routers to inform hosts of more efficient routes. However, if unauthenticated, a malicious actor can send a fake redirect to trick a host into routing traffic through the attacker's machine.
In cloud applications, especially those built with "containers," what is a small helper program that runs alongside your main application to handle security tasks like encryption?
What is a sidecar proxy?
A sidecar proxy simplifies cloud application development by taking care of security functions (like encrypting communication) so the main application doesn't have to manage them directly.