StudyXY
RegisterLog in
Information Technology /Security+ (SY0-701): Lesson 5: Secure Enterprise Part 2

Security+ (SY0-701): Lesson 5: Secure Enterprise Part 2

Information Technology30 CardsCreated about 2 months ago

This deck covers key concepts from Lesson 5: Secure Enterprise Part 2, focusing on firewalls, ACLs, proxy servers, and intrusion detection systems.

PrintEmbedImportReport

What is the risk of entering a fail-closed state of failure?

System downtime
Tap or swipe ↕ to flip
Swipe ←→Navigate
SSpeak
FFocus
1/30

Key Terms

Term
Definition
What is the risk of entering a fail-closed state of failure?
System downtime
Define a 'Packet Fileting Firewall'
A Layer 3 device; Compares packet headers against ACLs to determine which network traffic to accept.
What information from a packet header is used to define rules in an ACL?
IP, Protocol, and Port.
What actions can be defined in an ACL rule?
Accpet/permit, drop/deny, reject/block
What is the outcome of a drop/deny?
Silently discards the packet.
What is the outcome of a reject/block?
Blocks the packet but responds to the sender with an ICMP message, such as 'port unreachable'.
Log in to view all terms

Related Flashcard Decks

Information Technology

Security+ (SY0-701): Additional Knowledge

This flashcard set explores various cybersecurity topics including credential-stuffing attacks, data classification (e.g., private data), and key disaster recovery metrics like RTO. It also highlights protective measures such as hashing for data integrity, automation support challenges, and the use of URL scanning in web filtering to prevent malware infections.

10 cards
View Deck
Information Technology

Security+ (SY0-701): Cert Master Practice: 5.0 Security Program Management and Oversight

This flashcard set covers key concepts in cybersecurity governance frameworks, including centralized governance, data stewardship roles, and compliance laws like SOX. It also addresses environments supporting development and change management, as well as recovery strategies like Recovery Point Objective (RPO) to minimize data loss during system failures.

8 cards
View Deck
Information Technology

Security+ (SY0-701): Cert Master Practice: 4.0 Security Operations

This flashcard set explores advanced cybersecurity practices including refining SIEM alert handling, email security protocols (DKIM, DMARC), secure authentication methods, and strategic threat-hunting. It emphasizes how to enhance incident response efficiency and leverage proactive defense techniques like maneuvering to counteract potential threats.

11 cards
View Deck
Information Technology

Security+ (SY0-701): Cert Master Practice; 2.0 Threats, Vulnerabilities, and Mitigations

This deck covers key concepts related to threats, vulnerabilities, and mitigations in cybersecurity, focusing on virtual machine security.

1 cards
View Deck
Information Technology

Security+ (SY0-701): Cert Master Practice; 1.0 General Security Concepts

This flashcard deck covers key concepts from the Security+ (SY0-701) exam, focusing on general security concepts such as technical and operational controls, policy enforcement, and tokenization.

6 cards
View Deck
Information Technology

Security+ (SY0-701): Lesson 16: Summarize Data Protection Part 2

This flashcard deck covers key concepts from the Security+ (SY0-701) Lesson 16, focusing on data protection methods, DLP components, and security awareness training.

25 cards
View Deck

Study Tips

  • Press F to enter focus mode for distraction-free studying
  • Review cards regularly to improve retention
  • Try to recall the answer before flipping the card
  • Share this deck with friends to study together
Security+ (SY0-701): Lesson 5: Secure Enterprise Part 2
TermDefinition
What is the risk of entering a fail-closed state of failure?
System downtime
Define a 'Packet Fileting Firewall'
A Layer 3 device; Compares packet headers against ACLs to determine which network traffic to accept.
What information from a packet header is used to define rules in an ACL?
IP, Protocol, and Port.
What actions can be defined in an ACL rule?
Accpet/permit, drop/deny, reject/block
What is the outcome of a drop/deny?
Silently discards the packet.
What is the outcome of a reject/block?
Blocks the packet but responds to the sender with an ICMP message, such as 'port unreachable'.

What are the two types of ACLs?

  1. Inbound ACL

  2. Outbound ACL

Define an 'appliance firewall'
A standalone hardware device that performs only the function of a firewall (filter/monitor inbound and outbound traffic)

What are the 3 ways to deploy an appliance firewall?

  1. Routed (Layer 3)

  2. Bridged (Layer 2)

  3. Inline (Layer 1)

Define a 'routed (layer 3)' firewall
Performs forwarding between subnets; Each interface connects to a different subnet representing a different security zone; Interfaces configured with an IP and MAC address.
Define a 'bridged (layer 2)' firewall
Inspects traffic passing between two nodes, such as a router and a switch; bridges the Ethernet interfaces between the two nodes and each interfaces is configured with a MAC but no IP.
Define a 'Inline (layer 1)' firewall
Firewall acts as a cable segment and has no MAC or IP address; Traffic received on one interface is either blocked or forwarded over the other interface.
Define a 'transparent firewall'
Standalone firewall deployed in front or in-between nodes without having to reconfigure subnets and reassign IP addresses on other devices; Bridged and Inline firewalls.
Define a 'router firewall'
A hardware device that has the primary function of a router, but also has firewall functionality embedded into the router firmware.
Why is a packet filtering firewall stateless?
Does not persevere information about network sessions/connections.
Define a 'stateful inspection firewall'
Tracks information about the session established between two hosts; analyze packets down to the application layer rather than filtering packets only by header information.
How does a stateful inspection firewall process packets?
Firewall confirms whether it belongs to an existing connection; If not, it applies ordinary packet filtering rules to determine whether to allow it.
What two layers of the OSI model does a stateful inspection firewall operate at?
layer 4 and layer 7
Define a 'layer 4 firewall'
A stateful inspection firewall that can monitor TCP/UDP sessions.
What mechanism does a layer 4 firewall inspect when determining if packet belongs to an existing connection?
Examines the TCP three-way handshake to distinguish new from established connections.
How does a layer 4 firewall leverage the 3 way handshake to process a packet?
A legitimate TCP connection should follow a SYN > SYN/ACK > ACK sequence with corresponding sequence number; Deviations from this can be dropped as malicious flooding or session hijacking attempts.
Define a 'layer 7 firewall'
A stateful inspection firewall that can filter traffic based on specific application protocol headers and payload, such as web or email data.
Define a 'proxy server'
Mediates the communications between a client and another server; Can filter/forward communicates and improve performance with caching.
Define a 'caching engine'
Feature of many proxy servers that enables the servers to retain a copy of frequently requested web pages.
Define a 'forward proxy server'
Outbound protocol specific proxy connections.

Besides Forward/Reverse proxy, what are the two proxy server implementations?

  1. Non-transparent proxy

  2. Transparent proxy

Define a 'non-transparent proxy server'
A server that redirects requests and responses for clients configured with the proxy address and port.
Define a 'Transparent proxy server'
Implemented as a router or as an inline network appliance to intercept client traffic.
Define a 'reverse proxy server'
Proxy server that protects servers from direct contact with client requests; Deployed on the network edge and configured to listen for protocol-specific inbound traffic.
Define an 'intrusion detection system (IDS)'
Performs real-time analysis of either network traffic or system and application logs.