foreign [Music]
good evening and welcome I am Dr Michael Mann and
I'll be your instructor for this series on preparing for the Security Plus exam
this 12 session series is intended to help you review key material that will be covered
on the CompTIA Security Plus exam through the use of practice questions developed by
the Virginia cyber range in this session we are going to focus on network security
okay wow let's get started so uh good evening everyone and and welcome we're going to be going
over some review questions to help you prepare for the Security Plus exam and tonight's topic
excuse me is network security so we're going to just go ahead and jump in and get started here
um what you're looking at is the Virginia cyber range CTF interface
and it's a Jeopardy style CTF so we'll start with our first question and this is on ARP poisoning
and the question is in a corporate ethernet land which of the following could be used to prevent
Lan ARP poisoning and you need to choose two static ARP entries patching antivirus software
physical security and firewalls and let's just open it up and and see what you're thinking
okay so we're talking about corporate ethernet local area Networks
and ARP poisoning ARP as you may recall is address resolution protocol
and we're looking for ways to mitigate ARP poisoning does anybody have an initial thought
from the five options listed
um firewall okay firewalls okay ARP entries okay static ARP entries
anyone else I was saying and the antivirus software you gotta guess
okay so let's start with the first um correct answer and that is going to be static ARP entries
and you may uh recall that arp is a means for um creating relations between IP and Mac addresses
and the the whole process is dynamic okay normally so uh static type of ARP entry
really cannot be changed once it is manually entered and so that is going to be known by
the person who does the entering of this um static entry and the other thing that's important about
this is that it doesn't age out and it can't be overwritten by a dynamic ARP entry and that
makes it resistant to tampering so there's one other um suggestion here that's correct it is
not firewalls and it is not antivirus software so that leaves patching or physical security
what do you think I'm just taking a guess but um would it be patching no it's not patching
actually it's physical security and the reason for this is that ARP poisoning would occur over
a local area network and this is going to require close proximity to access the local area network
and so good physical security is important to mitigating ARP poisoning attacks okay that's a
might be a little unexpected at first but when you think about where these attacks take place
and how they're implemented it starts to make more sense okay any questions or comments on this one
okay let's go ahead and move on to the second question
okay so this question involves identical Networks
the scenario is you decide to go to your local library to work on some homework while trying
to connect to the internet there you notice two identical local library Wi-Fi networks were not
there previously which are the following best describes what you should do in this situation
your choices are choose either Network because the library is large and probably just needs
two routers to cover the whole building choose neither Network because one is probably a rogue
access point choose both networks and see which one yields the fastest internet speed
or choose neither because one is probably blue jacked okay agendas what do you think
I'm gonna say
number two choose neither Network because one is probably a rogue access point very good and that
is correct the giveaway here is that the SSID that's appearing is identical in both cases
there are two that's a local library Wi-Fi and that's almost always going to be a sure sign
that somebody is trying to get you to do the wrong thing basically okay just because the
library is large yeah it doesn't necessarily um mean or not mean that you don't need two
routers but you know you're not going to have totally identical ssids it doesn't work that way
um the one choosing one to see if it has a faster internet speed than the other is kind
of not the right answer in fact it's not the right answer it's not kind of it's not the right answer
and then blue jacking is also incorrect so what we are basically looking at here is what we would
call an evil twin attack and basically it's where a hacker operates a false access point so in the
attempt to get you to associate with it okay all right doing good I have a question yes please
blue Jack can you explain that what a what is a blue Jack I'm sorry can you speak up a little bit
please yes can you explain what what is a blue Jack ah blue jacket so that basically occurs
when an attacker sends unsolicited unsolicited text messages to a Bluetooth device and so since
you're on this you know Wi-Fi network um and Bluetooth is more of a personal area network
we would not be using any type of Bluetooth technology to connect to the library's Network
let's move on to the next one
and the next topic Network intrusion detection
why would your network administrator configure a signature based Network intrusion detection system
your choices are to authenticate users attempting to connect to the network
to authorize what users are permitted to do on the network to automatically update for
known malicious attack patterns or to make sure that all zero day attacks are detected
so as we head into this question
when you look at the responses is there anything that sticks out as obviously incorrect yes
I'm going to say
to the number [Music] um
number one number one okay and and why do you think that one's obviously wrong
okay I'm sorry can you say that again please sorry I was talking to myself
I don't know exactly why
okay okay well that that's a good sense a good feeling there because um I think it's your
previous studies kicking in and probably what's tipping you off is the word authenticate okay so
there's one other response that's
pretty uh incorrect here what I would call an obvious misdirector anyone
would it be the last one yes it would be and why do you think that would be the misdirector
because it's talking about zero day attacks and that's it
has nothing to do with the network but no one has anything to do for Network
well zero day attacks I mean so when you consider that a zero day exploit is basically you know uh
is a leveraging of zero day vulnerabilities and zero day vulnerabilities our vulnerabilities
that are unknown to the vendor in the case of software say a software vendor
so yeah there wouldn't be a signature yet and so the correct response for this question
is the third choice to automatically update for known malicious attack patterns if it's
a known malicious attack then the fact that it's known means that we have a signature
base for this attack and so we can use that to our advantage okay so it really doesn't
have anything to do with authenticating users or authorizing users so there's the correct answer
okay
let's move to the next one
this question involves open source firewalls which are the following describes a characteristic of
an open source Network firewall your choices are wired Hardware inexpensive and ineffective
okay what do you think about this one
inexpensive inexpensive that's correct that is the correct answer um the actually it is
the best answer so if we look at the rest of these suggested answers what's wrong with wired
is there a possibility it it could be wired
it could be but open source firewalls can also function as wireless access points
so wired is definitely not the best answer what about Hardware yeah
isn't that pertaining to like physical devices yes to an appliance for example
and and remember when we look at these questions and oftentimes you know the the sort of implied
instruction or sometimes it's very explicit is that you need to choose the best answer
and the fact is it's not necessarily going to be a hardware Appliance it can be it can be
so what about ineffective
doesn't that just kind of sound bad if it's ineffective it's not it's not working properly
it's it's definitely probably the worst answer uh suggestion there
um because you know the popularity of Open Source firewalls whether they're software
were deployed on a hardware platform just you know they're they're very popular because they
are affected and they are inexpensive and they work very very well so yeah inexpensive turns
out to be the best answer uh to this question okay all right let's take a look at the next one
so this question involves root cas so to be able to negotiate this question
to come to a successful conclusion you have to know what a CA is so what's a CA
anybody uh the certified uh the authorial authorization or something something like
that okay close yeah it's a certificate Authority okay okay so the question is
which of the following is true about a root CA and we're asked to choose two
your choices are it resides at the highest part of the chain of trust it resides at the
lowest part of the chain of trust IT issues certificates to several intermediate cas
or IT issues certificates to several single cas so let's let's take a stab at this
what's a good one for the first choice
so the use of the word root may be misdirecting or misleading if you think of the root of a tree and
you know when you maybe picture that you see it as the lower part of the tree but really
the root cea resides at the highest part of the chain of trust and that's what's important about
this at the chain of trust the root certificate Authority is at the highest part it's the origin
okay all right so if we believe that's true then that lets out it resides at the lowest part of the
chain of trust that becomes incorrect that leaves us two more choices and we need one of those
so what do you think
okay oh sorry go ahead yes please go ahead oh um is it the intermediate cas
yes it issues certificates to several intermediate cas okay and so
the root certificates um when we're talking about the root CA first of all the thing to know is that
it has a self-signed certificate okay and it uses this to digitally sign all the other certificates
that it creates and the certificate used by the root CA is known as the root certificate
and as we already said is self-signed so depending upon the size of the organization
you can have one or more subordinate Cas but we typically call these intermediate cas and these
Cas the intermediate Cas have their certificates issued and digitally signed by the root CA okay
all right it doesn't really reach down to anything below the intermediate cas
so we say that it issues certificates to several intermediate cas okay
let's move on to the next one
I have a question yes I wanted a restroom so after open source after the question question number
four open source firewalls was the fifth question root CA yes anything yes root CA was the fifth one
and basically the question was which of the following is true
and the root CA resides at the highest part of the chain of the trust chain of trust it's the
origin the point of origin and IT issues certificates to several intermediate cas
okay thank you now the next question jumps out right with port numbers
so the first thing to understand about this is the importance of knowing port numbers
and protocols and you know there's really not going to be any getting around this
um I'm often asked you know how should I negotiate questions like this
um you know how do I deal with this and some of these things and this is one of them
some of this information is pretty much a straight up knowledge based information it's not like a
performance question um it's just really something you have to know and what I usually tell people is
that if there's something you can do to help you with knowledge-based information so such
as protocols and port numbers if there's something that you can physically do
if there's something you can create this is often very helpful to learning the material and one of
the easiest things to do is to create a PowerPoint presentation and you can also create things like
Word documents maybe you're going to use them as flash cards if you really wanted to get
detailed about it you can find Jeopardy style games like this CTF as a Jeopardy Style game
really pretty much you can find these templates for PowerPoint download them and you know
create a whole sequence or a whole series on protocols and port numbers so the question
here which statement below is true regarding TCP Port 636 and your choices are it is used by FTP
it is used by ftps it is used by ldap it is used by ldaps so anybody have a suggestion for this one
I want to say FTP TP at FTP okay no
anyone else
is it the fourth one it is it is ldaps so lightweight directory access protocol
secure or secure ldap uses secure sockets layer SSL over TCP Port 636
to encrypt the communication between the client and the ldap system
again this is one of those things where you basically have to deal with knowledge-based
information and you know oftentimes there's a there's a great deal of it so once again
my suggestion is always try to find some way to create something a study guide a self-help
guide or something that works for you and but just do something because that will often help
to solidify the knowledge okay and you know the thing to understand about that is that we really
do want to try to avoid just cramming things into short-term memory because it really doesn't work
and it's also obviously not very lasting that's why we call it short-term memory
by working with the information and creating something like a study guide
you can better put it into longer term memory okay all right let's go to the next question
what does ldld AP stand for again lightweight directory access protocol
thank you you're welcome okay
the next question the topic is domain name the question is a startup business
thinks that they have found a way to cut some costs by registering a domain name for a short
period and then deleting it repeatedly so that they can avoid paying for the domain name expenses
in this example what term is being described your choices are domain hijacking
domain poisoning domain kiting or domain squatting so let's see what you think
okay would it be domain squatting okay you think it's domain squatting okay is there a reason
kind of just based off of the definition of squatting
okay you don't necessarily own the property you're just there
okay so domain squatting is basically buying a domain name and the the main reason for doing
this the sole purpose for doing it is to prevent someone else from getting it or from buying it
um when this happens typically buyers will resell the domain name at a higher
price to someone else who's you know somewhat desperate to get the name um but that's not
exactly what's being described here I'm going to call that one a pretty good you know misdirector
um what about domain hijacking is that right or is that wrong
wrong yeah that's an incorrect answer okay so domain hijacking basically involves the
hackers taking over a domain name from its original registrant and this can
be done using social engineering techniques um possibly exploiting vulnerabilities on systems
that the host domain name you know to gain authorized access to the domain registration
so that's not the correct answer what about domain poisoning does anybody know what this is
I don't but I don't think that's the correct answer either it's not
um you may have heard this or heard of it as DNS poisoning or DNS cash poisoning
um but that that's not right either and so that leaves us with domain kiting and what's Happening
Here is that someone can purchase and register the domain and take advantage of Grace periods
and so you can use the domain for a grace period then you can cancel the registration but then go
and register it again and then try to keep writing this grace period I guess for as long as you can
and I think when I think about that definition and the the name domain kiting it kind of sort
of resembles you know watching somebody fly a kite because the kite just doesn't go straight
up and up and up and up right it goes up and comes down maybe spins around or something and you know
that's really what you're trying to do here you're trying to sort of ride this wave of the grace
period and then you know when the thing is heading towards the ground well then you let go of it and
re-register it or you send the kite up again it's just how I think of it I'm telling you this
because this is sort of the picture that comes to my mind when I think about this
and you know if you have an impression based on say the name of a term being described in
this case domain kiting that can also go a long ways to helping you remember this okay
let's go on to the next one
this question involves iot security and so of course you know what's going to matter here is
that you understand again acronyms iot um I should point out that certification exams especially
Security Plus um is loaded with acronyms so here again you may be faced with
needing a way a methodology to deal with acronyms and you know the first thing
that comes to my mind of course is using PowerPoint presentations again you can
create these neat slides that work like flash cards or any way that you know you you react
best to okay some people like flash cards some people like straight up notes so what is iot
of things the internet of things and the question is iot sensors with minimal data transmission
requirements are best restrained by a blank Network design obviously our task is to fill
in the blank so your choices are restricted latency client TLS certificates restricted
broadcast domain or restricted bandwidth okay all right anybody have an idea on this one
okay does something stand out as obviously incorrect
anybody no it's okay take a guess constricting bandwidth
okay and and you think that is the incorrect answer
oh no no no I'm so sorry I think the uh maybe it's the client TLC certificate certificate
okay all right so yeah um client TLS certificates yeah that kind of doesn't make too much sense
um I'd say the key to this particular question is that understanding that iot sensors can exist in a
wide range of items and I mean everything from refrigerators to you know fluid level sensors
but the really important part of this question is minimal data transmission requirements
and so if we're told up front that there are minimal data transmission requirements
and we don't want to give any more quarter or any more space or room than we need to
restricted latency is not going to do it for us latency doesn't make sense in this context
ended bandwidth oh sorry yes yes absolutely the the answer to this question is restricted
bandwidth okay and you know I mean we're talking about possibly needing
a bandwidth of say two megabits per second which is very very tight very restricted okay but if
the minimal if the transmission requirements are minimal which they may be coming from iot sensors
you know we we don't need a bandwidth of 50 megabits per second okay
and so the idea here is that you are only giving enough quarter or room
to satisfy what you need okay all right the other thing to remember is that
sensor Transmissions can also be tapped into to get into a network
so by tightening the bandwidth you may in effect be helping to prevent
attacks that are seeking to get into the network okay all right let's go on to the next question
and this one involves Network design
so the question is which term is most closely interchangeable to a reverse proxy
your choices are forward proxy load balancer https server SNMP service
okay anybody wanna take a shot at this question
okay does anything look obviously incorrect
do you think SNMP service has anything to do with a reverse proxy
do you recall what SNMP services
does anybody remember that acronym
okay so simple Network management protocol and this allows us to pull devices and
get and set configurations so to me SNMP service and https server would be the two that stand
out as the least correct okay what about a forward proxy does anybody know what that is
okay so forward proxy is the most common form of a proxy server
generally used to pass requests from isolated private Network to the internet through a firewall
so the most closely interchangeable to reverse proxy the term would be load balancer
okay now a reverse proxy facilitates a user's requests to web server or application server and
the server's response a load balancer receives user requests and distributes them accordingly
among a group of servers and then forwards each server response to its respective user
so you can kind of tell from that that there's a bit of overlap between the functions of the two
and that makes load balancer the best answer to this question okay so here the situation involves
understanding the terminology what proxy servers are what they do and as well as as being able to
spot incorrect answers like SNMP servers or https server okay let's move on to the next
okay this question involves PKA pki excuse me certificate attributes and the question is
which of the following are included within a pki SSL TLS certificate and this time they want
you to choose all that apply so your choices are URL domain name in parentheses cm or common name
certificate Authority reference also CA expiration date or private key okay so what are you thinking
anything that sticks out here I'm sorry say again oh privacy
private key okay is there a reason that you think that private Keys is are you saying
that's a good answer or a bad answer oh well good answer a good answer okay so it is not okay
well it's okay that's okay um this question involves understanding public
key infrastructure okay and so certificate attributes are components of the certificate
and the private key is definitely not going to be one of them okay because it's not stored in
a pki certificate certificates are files with a public key and contain information
of its respective private key owner Okay so private key is not one of the correct choices
what do you think about some of the others how about expiration date do certificates expire do
they have a valid from date and a date and after which they expire what do you think
yes yes they do okay and the certificate Authority reference what about that one
is there a reference to the certificate Authority that generated the certificate
do you think it's important to know where it came from yes yes
okay and the URL domain name what do you think about that one
it's important to know as well it is it's the sin in parentheses stands for
common name and it's also known as fqdn and here we go with the acronyms again
so fqdn fully qualified domain name so our three correct choices here are URL domain name
certificate Authority reference and expiration date all right let's push on to the next question
okay so this one is involving SSL and TLS the question reads what do SSL and TLS get you from
a security compliance perspective and we're asked to choose two your choices are data encryption in
transit data encryption on disk data encryption in memory and client server session encryption
so clearly we're dealing with encryption here
okay so what are you thinking
if we're concerned with data encryption
where do you think it's most critical
and Transit in transit I would agree with that and that is in fact a correct answer oops there we go
data encryption in transit okay what about on disk
does that have anything to do with secure sockets layer or transport layer security
when we look at the rest of the choices
if we're concerned with encryption obviously we are trying to keep the wrong people from seeing
the information or accessing it or being able to do something with it even if they have accessed it
so data encryption on disk and in memory
and then client server session encryption
which one of those three is not like the others
and we're only talking about these three choices now here here and here
if I ask it another way and I say data encryption in transit and then I ask
you to look at the remaining three choices and pick one that is like
data encryption in transit which do you think it would be
number four yes yes absolutely okay if we have a client server session
right then we have communication between at least two endpoints
and again we're sort of dealing with data in transit okay so those two are most closely related
now this doesn't mean you can't do data encryption on disk okay you certainly can there are
several ways to do this the most popular and well-known are going to be full disk
encryption or file level encryption and file level encryption gives you a little more granularity and
control over what exactly you want to encrypt in terms of the files and data encryption on
disk is just the whole thing okay all right let's move on and go to the next question
okay so this involves again Wi-Fi security your it manager has asked
you to verify the security profile of the Wi-Fi access points in your office
so you plan to look at several aspects of your wireless networks what are some
of the top common vulnerabilities you should First Look for and we're told to choose two
we're looking for common vulnerabilities the first things you would look for your choices are MAC
address filtering default admin passwords open Wi-Fi networks or AES 256 encryption
okay what do you think would it make sense to start with Wi-Fi it's open Wi-Fi networks
first yes yes it would unsecured Networks a common vulnerability something that you can easily spot
okay what's another one what do you think that's easily admin password yeah
yep sure because what are they admin and admin admin and password right it depends on the
manufacturer now of course they do this you know too to make it easy when you take something out
of the box and you're getting it set up and not to just you know put it out there with no protection
but everybody knows these things now the other thing is that um Mac address and MAC address
filtering and you know using AES 256 encryption I mean you know they're not they are viable answers
but they certainly are going to require a lot more work to see if you're using AES 128 or 256
or if you have MAC address filtering set up okay so the most obvious common as they were
calling it would be default admin passwords and open Wi-Fi networks okay let's move on
let's see here [Music] oops there we go
okay this involves Federated identity management control the question is which of the following
describes a better rated identity management control your choices are audit specifications
that are designed to ensure that cloud hosting providers meet Professional Standards a virtual
item that contains authorization data and is commonly used in multi-factor Authentication
and authentication process that trusts a third-party Network authenticator to
Grant access to another or different network or an authentication Service that grants Federal access
so anything sticks out as obviously incorrect what do you think
would it be number one Okay so audit specifications that are
designed to ensure that cloud hosting providers meet Professional Standards
okay um why do you think that might be clearly wrong or obviously wrong
because it's talking about cloud and hosting providers okay and not necessarily anything
with identity management yep yeah yeah I would agree with that um the other one I
think that's kind of silly is the last one an authentication Service that grants Federal access
I mean not even quite sure what they're getting at and you know every now and then you get lucky and
you get a question and one of the answers is really kind of out there so what do you think
the correct answer is here it's is it the multi-factor identification no no it's not
okay no because we're we're dealing with identity management and if you are concerned with identity
and identity management and we're really concerned with Authentication okay and so the correct answer
an authentication process that trusts a third-party Network Authenticator
to Grant access to another or different Networks okay what's a third party what would you give an
example of a third-party Network Authenticator yeah I mean it's another type of organization
that maintains the information stores that can be used for single sign-on so like OCTA okay okay
okay so the other thing to understand about this is Federated identity management provides single
sign-on capability okay all right and let's see I think we're gonna have time for another one
okay the network administrator for your organization needs to configure a security
method that allows only specific devices to a port on the land what methods should they administer
your choices are nmap Mac filtering firewall and Source i p affinity
Okay so we're looking for methodology that allows only specific devices
to access a port on the land what is obviously incorrect here do you think
and math and map and Maps a tool yeah okay right it's it's not really a security method it's a tool
is there anything else in that same category that's kind of a tool and
making a security method but still not as much
how about firewall does that answer make sense
I mean firewall's a tool as well right
I do have a question with Mac filtering is that only considered what about say again is Mac
filtering only might sound weird but it's not Mac as an apple right it's like an acronym for
something else Mac yeah Mac addresses okay media Access Control okay in fact Mac filtering is the
correct answer okay this is this is a way that and it can be employed on your home network uh
most modern wireless routers do have mac filtering built into them um certainly uh small office home
office and Enterprise switching equipment can use and often does use Mac filtering um in fact
when a switch is set up for Mac filtering if you connect a host to it with a different Mac address
than it's expecting okay the port will often go into what we might call an error disabled state
so it's it's a really good method for making sure that only certain devices can access ports
and if you're accessing a port on the land you're certainly going to be going through some type of
aggregation Appliance like a layer 2 switch you can also set ports up to accept more than
one Mac address but it's still filtering and and that's correct and what about Source IP affinity
does anybody know what that is okay so it's also known as simple persistence
and Source address Affinity persistence supports TCP and UDP protocols direct session requests to
the same server based solely on the source i p address of a packet in other words it
prefers that source and that's why we use the term Source IP affinity okay we have one more
yeah go ahead just before you move on you said uh Mac was media Access Control yes okay thank you