Network Security Implementation Flashcards

Question 1

What are the three core goals of information security often called the CIA triad?

Accepted Answer

The three core goals are confidentiality, integrity, and availability. Confidentiality means only authorized parties can read protected data. Integrity means data is accurate and cannot be altered without detection. Availability means authorized users can reach systems and data when they need them. Network controls aim to protect all three together.

Question 2

What is the difference between a threat, a vulnerability, and a risk?

Accepted Answer

A threat is any potential source of harm, such as an attacker or malware. A vulnerability is a weakness that a threat could exploit. Risk is the likelihood that a threat exploits a vulnerability, combined with the resulting impact. Controls reduce risk by lowering either the likelihood or the impact.

Question 3

What does the principle of least privilege require in a network environment?

Accepted Answer

Least privilege requires that every user, device, and service receive only the access needed to perform its legitimate function, and nothing more. On networks, this means firewall rules allow only required ports. Limiting access this way reduces the damage an attacker can do after compromising one component.

Question 4

Why is defense in depth preferred over relying on a single security control?

Accepted Answer

Defense in depth layers several independent controls so that if one fails, others still provide protection. A single control, such as a perimeter firewall, can be misconfigured, bypassed, or defeated by a new attack. Layers might include filtering, segmentation, authentication, encryption, and monitoring, each addressing different failure modes.

Question 5

What is the purpose of authentication, and how does it differ from authorization?

Accepted Answer

Authentication verifies that an identity is genuine, for example by checking a password and a one-time code. Authorization decides what that verified identity is allowed to do, such as reading a file or opening a port. Authentication comes first, because permissions only make sense once the identity behind a request is established.

Question 6

Why should security teams keep an accurate inventory of network assets?

Accepted Answer

Security teams need inventories because they cannot protect devices they do not know exist. An accurate inventory lists hardware, software, operating system versions, and owners, so teams can apply patches, enforce policies, and spot unauthorized equipment. Unknown devices create unmanaged exposure. Inventory is the foundation for vulnerability management and access decisions.

Question 7

What is a security policy, and why do network standards depend on it?

Accepted Answer

A security policy is a formal statement from management defining what must be protected and the rules for protecting it. Standards and procedures then translate those rules into specific settings. Without a clear policy, administrators may make inconsistent choices that leave gaps, and auditors have no baseline to measure against.

Question 8

What is the principle of separation of duties, and how does it support security?

Accepted Answer

Separation of duties divides a critical task among several people so that no single individual can complete it alone. For network changes, one person might request a firewall rule while another approves and a third deploys it. This reduces fraud, mistakes, and insider abuse, because misuse requires collusion among multiple people.

Question 9

What is a firewall, and what basic job does it perform on a network?

Accepted Answer

A firewall is a control that examines network traffic and permits or blocks it according to defined rules. Its basic job is to enforce a boundary between trusted and untrusted networks, such as a private office network and the internet. Firewalls can be hardware appliances, software on a host, or cloud services.

Question 10

How does stateless packet filtering decide whether to allow a packet?

Accepted Answer

A stateless packet filter evaluates each packet on its own, comparing header fields such as source and destination addresses, ports, and protocol against an ordered rule list. The first matching rule determines the action, and a default rule usually denies everything else. It does not track whether a packet belongs to an established connection.

Question 11

What is stateful inspection, and what advantage does it offer over stateless filtering?

Accepted Answer

Stateful inspection keeps a table of active connections and judges each packet in the context of that connection. A reply packet is allowed only if it matches a session that an internal host opened, which blocks many forged or unsolicited packets. This gives finer control than stateless filtering, though it uses more memory.

Question 12

What is the difference between an allowlist and a denylist in firewall policy?

Accepted Answer

An allowlist permits only traffic that is explicitly approved, and everything else is blocked. A denylist blocks traffic that is explicitly known to be harmful, and everything else is allowed. Allowlists are generally more secure because unknown threats are blocked by default, while denylists are easier to start with but miss new attacks.

Question 13

Why is the default deny rule placed at the end of a firewall rule set?

Accepted Answer

The default deny rule is placed last because rules are evaluated in order, and it should catch only traffic that no earlier rule matched. Placing it at the end ensures that unmatched connections are dropped rather than accidentally allowed. Administrators often log denied traffic at this point to aid troubleshooting and detection.

Question 14

What is a demilitarized zone, and which kinds of servers are usually placed there?

Accepted Answer

A demilitarized zone, or DMZ, is a separate network segment that sits between the internet and the internal network. Servers that must accept connections from outside users, such as public web servers, are usually placed there. Internal systems stay behind a second firewall, so a compromised public server has limited access inward.

Question 15

Why must a firewall rule set be reviewed regularly after it is first deployed?

Accepted Answer

Business needs, applications, and network layouts change over time, so rules that were once necessary can become unnecessary or overly broad. Old rules may remain for retired services, creating unmonitored openings. Regular review removes stale rules, confirms each remaining rule has an owner and purpose, and keeps the policy aligned with current requirements.

Question 16

What is a web application firewall, and how does it differ from a network firewall?

Accepted Answer

A web application firewall inspects HTTP and HTTPS requests and filters them for attack patterns, such as malicious input. A network firewall mainly controls which addresses and ports may communicate, without understanding application content. Because the web application firewall understands requests, it can block attacks that pass through port rules alone.

Question 17

What is network segmentation, and what problem does it primarily address?

Accepted Answer

Network segmentation divides a larger network into smaller, isolated zones, each with its own controls over what traffic may enter or leave. It primarily addresses the problem of lateral movement, where an attacker who compromises one system moves freely to others. Limiting that movement contains incidents and protects sensitive systems.

Question 18

How do virtual LANs help separate traffic on a shared physical switch?

Accepted Answer

Virtual LANs, or VLANs, logically divide one physical switch into separate broadcast domains, so devices in different VLANs cannot exchange traffic at layer two. Traffic between VLANs must pass through a router or firewall where rules can be enforced. VLANs are a segmentation tool, not a complete security boundary by themselves.

Question 19

What is the principle of zero trust, and how does it change network access?

Accepted Answer

Zero trust is a model that assumes no user, device, or network location is inherently trustworthy, even inside the corporate perimeter. Every access request is verified based on identity, device health, and context before it is granted. Access is limited to specific resources, so being on the internal network no longer implies broad permission.

Question 20

What is role-based access control, and why do organizations use it?

Accepted Answer

Role-based access control grants permissions to defined roles rather than to individual users, and users receive the roles their job requires. Organizations use it because it simplifies administration, since changing a role updates every member at once. It also supports least privilege and makes audits easier, because access can be reviewed by role.

Question 21

What is the purpose of a network access control list on a router or switch?

Accepted Answer

An access control list is an ordered set of rules on a router, switch, or similar device that permits or denies traffic based on attributes such as addresses, protocols, and ports. Like firewall rules, ACL entries are evaluated in order, so placement and sequence matter. Misplaced entries can silently allow or block the wrong traffic.

Question 22

Why should administrative interfaces of network devices be placed on a separate management network?

Accepted Answer

Administrative interfaces control configuration, so a compromise there can change every rule and bypass every other control. Placing them on a separate management network restricts who can reach them, typically only designated administrators on trusted hosts. This keeps routine user traffic away from management services and makes unauthorized access attempts easier to detect.

Question 23

What is network access control, and what does it check before admitting a device?

Accepted Answer

Network access control is a system that decides whether a device may join the network, based on policy. Before admitting a device, it typically checks the user's identity, whether the device is recognized, and whether its security posture meets requirements. Noncompliant devices can be denied access or placed in a restricted quarantine network.

Question 24

What is a jump host, and how does it improve control over administrative access?

Accepted Answer

A jump host is a hardened system that administrators must pass through to reach sensitive servers. Access to it is tightly restricted and closely logged, so every administrative session has a single, monitored entry point. This reduces the number of paths an attacker could use and simplifies auditing of who connected to what.

Question 25

What is the difference between symmetric and asymmetric encryption?

Accepted Answer

Symmetric encryption uses the same secret key for encrypting and decrypting, so both parties must share that key securely. Asymmetric encryption uses a linked pair of public and private keys, where data encrypted with one key is decrypted with the other. Symmetric methods are fast for bulk data, while asymmetric methods suit key exchange.

Question 26

What is Transport Layer Security, and what protections does it provide?

Accepted Answer

Transport Layer Security is a protocol that encrypts communication between two endpoints, most commonly a web browser and a server. It provides confidentiality through encryption, integrity through message authentication, and server authentication through digital certificates. It is the foundation of HTTPS, and it can also secure email and other application traffic.

Question 27

Why is a digital certificate needed when a server offers a public key?

Accepted Answer

A certificate binds a public key to an identity, such as a domain name, and is signed by a trusted certificate authority. Without it, a client has no reliable way to know that a public key truly belongs to the server it reached, and an attacker could substitute their own key. Certificates let clients verify that binding before trusting the key.

Question 28

What is the purpose of a cryptographic hash, and how does it help verify data?

Accepted Answer

A cryptographic hash turns data of any size into a fixed-length digest that changes sharply when the input changes. Recomputing the hash of received data and comparing it with a trusted value reveals whether the data was altered. Hashes support integrity checks, but they do not hide content, because they are not encryption.

Question 29

What is perfect forward secrecy, and why is it valued in modern protocols?

Accepted Answer

Perfect forward secrecy means each session uses temporary keys generated for that session only, so the long-term private key cannot decrypt past recorded traffic. Even if an attacker later steals the server's private key, earlier sessions remain protected. This is why modern protocols favor ephemeral key exchange methods.

Question 30

Why should weak protocols like Telnet and plain FTP be replaced with encrypted alternatives?

Accepted Answer

Telnet and plain FTP send usernames, passwords, and data in cleartext, so anyone who can observe the traffic can read or capture credentials. Encrypted alternatives such as SSH and SFTP protect confidentiality and integrity during transmission. Replacing legacy protocols removes an easy path for eavesdropping and credential theft on shared or untrusted networks.

Question 31

What is a virtual private network, and what does it protect when used remotely?

Accepted Answer

A virtual private network creates an encrypted tunnel between a device and a network, allowing remote users to reach internal resources. When used remotely, it protects data in transit over public Wi-Fi or the internet from interception and tampering. It does not protect the endpoint itself, so device security still matters.

Question 32

Why is key management considered as important as the choice of encryption algorithm?

Accepted Answer

A strong algorithm protects little if its keys are exposed, reused, stored carelessly, or never rotated. Key management covers generating keys with adequate randomness, storing them in protected locations, distributing them securely, and retiring them on schedule. Compromised keys, not broken mathematics, are a frequent cause of failure.

Question 33

What is the difference between an intrusion detection system and an intrusion prevention system?

Accepted Answer

An intrusion detection system monitors traffic or hosts and alerts administrators when it sees suspicious activity. An intrusion prevention system sits inline or otherwise acts on traffic, and it can block or drop malicious packets automatically. Detection is passive and notifies people, while prevention actively interrupts traffic.

Question 34

What is log management, and why is centralized logging important for security?

Accepted Answer

Log management is the practice of collecting, storing, protecting, and reviewing logs from firewalls, servers, applications, and network devices. Centralized logging gathers these records in one location, so analysts can correlate events across systems. It also protects evidence, because an attacker who compromises a host may try to alter or delete its local logs.

Question 35

What information should a firewall or network device log for each connection?

Accepted Answer

Useful connection logs record the timestamp, source and destination addresses, ports, protocol, and the action taken, such as allowed or denied. Byte counts and session duration help reveal data exfiltration or unusual volume. Logs should be synchronized to a reliable time source so events from different devices can be ordered correctly during investigations.

Question 36

What is a security information and event management system used for?

Accepted Answer

A security information and event management system, often abbreviated SIEM, collects logs and alerts from many sources and correlates them to highlight likely threats. It normalizes data into a common format, applies detection rules, and supports searching and reporting. Analysts use it to prioritize alerts and reconstruct how an incident unfolded across systems.

Question 37

What is baseline traffic analysis, and how does it help reveal abnormal behavior?

Accepted Answer

Baseline traffic analysis records what normal network activity looks like over time, such as typical volumes, common destinations, and usual working hours. Deviations from that baseline become candidates for investigation. A baseline gives context, so alerts are judged against expected behavior rather than in isolation.

Question 38

What are the main phases of an incident response process?

Accepted Answer

A common model includes preparation, detection and analysis, containment, eradication, recovery, and post-incident review. Preparation builds playbooks, tools, and contacts in advance. Detection and analysis confirm whether an event is a real incident and how severe it is. Containment limits spread, eradication removes the cause, recovery restores normal service, and review captures lessons learned.

Question 39

Why is it important to preserve evidence before making changes during an incident?

Accepted Answer

Early changes can destroy volatile memory, logs, and clues about how an attacker got in, so evidence must be preserved first. Preserved evidence supports root cause analysis, lets teams understand the scope of the breach, and may be needed for legal or regulatory purposes. Responders should document actions and follow established handling procedures.

Question 40

What is a post-incident review, and what should it produce?

Accepted Answer

A post-incident review is a structured discussion held after an incident is resolved, examining what happened, how it was handled, and what could be improved. It should produce a written timeline, a root cause summary, and specific action items with owners and deadlines. Blameless reviews encourage honest reporting, which speeds future response.

Network Security Implementation Flashcards

1Core Security Principles

2Firewalls and Packet Filtering

3Network Segmentation and Access Control

4Encryption and Secure Protocols

5Monitoring, Detection, and Response

Learning Resources