CompTIA Security+ Rapid Review: Network Security

Answers

This section contains the answers to the “Can you answer these questions?” sections in this chapter.

Objective 1.1: Explain the security function and purpose of network devices and technologies

1. Yes, sniffers can capture many types of traffic, including unencrypted FTP traffic. This includes clear text, user name, and password.

2. You could choose to use an all-in-one device. Typically, these devices reside at the edge of a network and serve multiple purposes, such as SPAM detection, firewall, and virus detection.

3. URL filtering can be used to deal with this issue. URL filtering can be used to block specific sites that might contain objectionable content such as pornography and gambling.

4. NIDS are used to capture and analyze network traffic. This form of intrusion detection is widely used and typically deployed with sensors in various locations such as in the DMZ, at the gateway, and in the internal network.

5. While NIDS are very useful, they do have limits just like any security tool. NIDS can see encrypted traffic but cannot decrypt it or examine the contents.

Objective 1.2: Apply and implement secure network administration principles

1. The broadcast storm stopped because of loop protection. Loop protection functions by looking for loops in networks and blocking one of the ports to prevent the loop from occurring.

2. Use port security. With port security, you can filter allowed devices by MAC address. Only approved MAC addresses can connect to and use the active port.

3. Yes, you can use an ACL. With the ACL, you can set basic controls on the type of traffic that can ingress or egress your network.

4. Log analysis is a detective control because it is reviewed after the event.

5. Bridges are considered dumb devices. Switches are smarter and faster. They have replaced bridges in almost all networks.

Objective 1.3: Distinguish and differentiate network design elements and compounds

1. A natural mask for a class C network is 255.255.255.0. Any value in the last octet besides a zero indicates that it has been subnetted.

2. PaaS is a way to rent hardware, operating systems, storage, and network capacity over the Internet.

3. A PBX is a private telephone system designed for use by a company or business. Many companies might have one or more public phone lines and might use the PBX to connect this to many internal private extensions.

4. Virtualization. Common examples include VMware, Virtual PC, Virtual Server, Hyper-V, and VirtualBox.

5. NAC is designed to enforce adherence to security policy.

Objective 1.4: Implement and use common protocols

1. The Encapsulating Security Payload (ESP) header provides privacy and protects against malicious modification.

2. IPv4 uses a 32-bit address and is being phased out and replaced with IPv6.

3. The ping. Ping is the most common type of ICMP message.

4. SSL was developed to secure application data while in transit over the Internet. It was developed by Netscape and set the standard for Internet security at the time of its release. SSL makes use of hybrid encryption.

5. This CNAME record is an alias.

Objective 1.5: Identify commonly used default network ports

1. FTP uses port 20 for data exchange.

2. On Linux systems, SSH typically uses port 22.

3. TFTP uses UDP for a transport protocol.

4. HTTP uses TCP port 80.

5. HTTPS uses port 443.

Objective 1.6: Implement wireless networks in a secure manner

1. WEP used RC4 and an encryption algorithm.

2. WPA improved on WEP and made use of a 48-bit IV that does not repeat or roll over.

3. WPA2 uses AES and can support a 256-bit key.

4. CCMP provides data confidentiality, authentication, and access control.

5. EAP is an authentication framework.