StudyXY
RegisterLog in
Information Technology /Security+ (SY0-701): Lesson 5: Secure Enterprise Part 3

Security+ (SY0-701): Lesson 5: Secure Enterprise Part 3

Information Technology30 CardsCreated about 2 months ago

This deck covers key concepts and mechanisms related to intrusion detection and prevention systems, load balancers, web application firewalls, and remote access architecture.

PrintEmbedImportReport

What mechanism does an intrusion detection system (IDS) use to function?

A sensor/packet sniffer (SPAN/TAP)
Tap or swipe ↕ to flip
Swipe ←→Navigate
SSpeak
FFocus
1/30

Key Terms

Term
Definition
What mechanism does an intrusion detection system (IDS) use to function?
A sensor/packet sniffer (SPAN/TAP)
Define 'Snort'
Open source Network intrusion detection system (NIDS).
How does an intrusion detection system (IDS) detect malicious traffic?
When traffic matches a detection signature, the IDS raises an alert or generates a log entry but does not block the source host.
Define an 'intrusion prevention system (IPS)'
Security appliance or software that can detect malicious traffic and can actively block attacks.
How does an intrusion prevention system (IPS) detect malicious traffic?
Scans traffic to match detection signatures.

What are the 3 actions an intrusion prevention system (IPS) can take after matching a signature?

  1. Block the source

  2. Reset the connection

  3. Redirect traffic to a honeypot/honeynet for additional analysis

Log in to view all terms

Related Flashcard Decks

Information Technology

Security+ (SY0-701): Additional Knowledge

This flashcard set explores various cybersecurity topics including credential-stuffing attacks, data classification (e.g., private data), and key disaster recovery metrics like RTO. It also highlights protective measures such as hashing for data integrity, automation support challenges, and the use of URL scanning in web filtering to prevent malware infections.

10 cards
View Deck
Information Technology

Security+ (SY0-701): Cert Master Practice: 5.0 Security Program Management and Oversight

This flashcard set covers key concepts in cybersecurity governance frameworks, including centralized governance, data stewardship roles, and compliance laws like SOX. It also addresses environments supporting development and change management, as well as recovery strategies like Recovery Point Objective (RPO) to minimize data loss during system failures.

8 cards
View Deck
Information Technology

Security+ (SY0-701): Cert Master Practice: 4.0 Security Operations

This flashcard set explores advanced cybersecurity practices including refining SIEM alert handling, email security protocols (DKIM, DMARC), secure authentication methods, and strategic threat-hunting. It emphasizes how to enhance incident response efficiency and leverage proactive defense techniques like maneuvering to counteract potential threats.

11 cards
View Deck
Information Technology

Security+ (SY0-701): Cert Master Practice; 2.0 Threats, Vulnerabilities, and Mitigations

This deck covers key concepts related to threats, vulnerabilities, and mitigations in cybersecurity, focusing on virtual machine security.

1 cards
View Deck
Information Technology

Security+ (SY0-701): Cert Master Practice; 1.0 General Security Concepts

This flashcard deck covers key concepts from the Security+ (SY0-701) exam, focusing on general security concepts such as technical and operational controls, policy enforcement, and tokenization.

6 cards
View Deck
Information Technology

Security+ (SY0-701): Lesson 16: Summarize Data Protection Part 2

This flashcard deck covers key concepts from the Security+ (SY0-701) Lesson 16, focusing on data protection methods, DLP components, and security awareness training.

25 cards
View Deck

Study Tips

  • Press F to enter focus mode for distraction-free studying
  • Review cards regularly to improve retention
  • Try to recall the answer before flipping the card
  • Share this deck with friends to study together
Security+ (SY0-701): Lesson 5: Secure Enterprise Part 3
TermDefinition
What mechanism does an intrusion detection system (IDS) use to function?
A sensor/packet sniffer (SPAN/TAP)
Define 'Snort'
Open source Network intrusion detection system (NIDS).
How does an intrusion detection system (IDS) detect malicious traffic?
When traffic matches a detection signature, the IDS raises an alert or generates a log entry but does not block the source host.
Define an 'intrusion prevention system (IPS)'
Security appliance or software that can detect malicious traffic and can actively block attacks.
How does an intrusion prevention system (IPS) detect malicious traffic?
Scans traffic to match detection signatures.

What are the 3 actions an intrusion prevention system (IPS) can take after matching a signature?

  1. Block the source

  2. Reset the connection

  3. Redirect traffic to a honeypot/honeynet for additional analysis

What are the two ways of deploying an intrusion prevention system (IPS)?

  1. Inline appliance with an integrated firewall and routing/forwarding capability

  2. Passive sensors that can reconfigure a router/firewall as a mitigating action

What are 4 features of a 'next-generation firewall (NGFW)'?

  1. Layer 7 filtering

  2. User directory based filtering to prevent insider threat

  3. Integrated IPS

  4. Integration with cloud networking

Define 'Unified threat management (UTM)'
All-in-one security appliances and agents that combine the functions of a firewall, malware scanner, intrusion detection, vulnerability scanner, data-loss prevention, content filtering, and so on.
What is a downfall to implementing Unified threat management (UTM)?
Creates single point of failure; Latency issues due to consolidated overhead; Overall performance issues.
Define a 'Load balancer'
A type of switch, router, or software that distributes client requests between different resources.
What are the benefits of a load balancer?
Mitigation against denial of service attacks; Provide fault tolerance.

What are the two main types of load balancers?

  1. Layer 4 load balancer

  2. Layer 7 load balancer

Define a 'layer 4 load balancer'
Makes forwarding decisions based on IP address and TCP/UDP port values, working at the transport layer of the OSI model.
Define a 'layer 7 load balancer' (content switch)
Makes forwarding decisions based on application-level data; Uniform resource locator (URL) web address or data types like video or audio streaming.
Define the 'scheduling' function implemented by load balancers
Algorithm and metrics that determine which node is selected for processing each incoming request from the load balancer.
What is the most common/simplest form of the scheduling function in a load balancer?
Round-robin
Define 'Round robin' scheduling
Picking the next node based on a defined metric.
How is a heart beat mechanism used in determine scheduling in a load balancer?
To verify whether each node is available and under load or not.
How does a client keep a persistent connection with a node configured behind a layer 4 load balancer?
Source IP Session affinity
Define 'Source IP/Session Affinity'
Layer 4 load balancer scheduling approach.
What is the function of 'Source IP (Session) Affinity?
To route traffic to nodes that have previously established connections with the client in question.
How does a layer 7 load balancer keep a client connected to a session with a node?
Persistence configuration
Define 'persistence' configuration in a layer 7 load balancer
Sticky Sessions; Enables a client to maintain a connection with a load-balanced server over the duration of the session.
How does the persistence configuration in a layer 7 load balancer keep a client connected to a session?
By setting a cookie on the node or injected by the load balancer.
Define a 'web application firewall (WAF)'
Firewall designed specifically to protect software running on web servers and their back-end databases from code injection and DoS attacks.
How does a web application firewall (WAF) detect/protect?
Uses application-aware processing rules to filter traffic and perform application-specific intrusion detection; Programmed with signatures of known attacks and use pattern matching to block requests containing suspect code.
How can a web application firewall (WAF) be deployed/implemented?
Deployed as an appliance protecting the zone that the web server is placed in or as plug-in software for a web server platform.
Define 'Remote access architecture'
Infrastructure, protocols, and software that allow a host to join a local network from a physically remote location.
What is the most common modern remote access mechanism/technology?
virtual private network (VPN)