foreign
[Music]
good evening and welcome
I am Dr Michael Mann and I'll be your
instructor for this series on preparing
for the Security Plus exam
this 12 session series is intended to
help you review key material that will
be covered on the CompTIA Security Plus
exam through the use of practice
questions developed by the Virginia
cyber range
in this session we are going to focus on
network security
okay
wow let's get started
so uh good evening everyone and and
welcome
um we're going to be going over some
review questions to help you prepare for
the Security Plus exam and uh tonight's
topic
excuse me is network security so we're
going to just go ahead and jump in and
get started here
um what you're looking at is the
Virginia cyber range CTF interface
and it's a Jeopardy style CTF so we'll
start with our first question
and this is on ARP poisoning
and the question is in a corporate
ethernet land
which of the following could be used to
prevent Lan ARP poisoning
and you need to choose two
static ARP entries patching anti-virus
software physical security and firewalls
and let's just open it up and and see
what you're thinking
okay so we're talking about corporate
ethernet local area Networks
and
ARP poisoning ARP as you may recall is
address resolution protocol
and we're looking for
ways to mitigate ARP poisoning
does anybody have an initial thought
from the five
options listed
um
firewall
okay firewalls
okay ARP entries
okay static ARP entries
anyone else
I was saying and the antivirus software
you gotta guess
okay
so let's start with the first
um correct answer and that is going to
be static ARP entries
and you may recall
that
um IRP
is a means for
um
creating relations between IP and Mac
addresses
and the the whole process is dynamic
okay normally
so uh static
type of ARP entry
really cannot be changed once it is
manually entered
and so that is going to be known by the
person who does the entering of this
static entry and the other thing that's
important about this is that it doesn't
age out and it can't be overwritten by a
dynamic ARP entry and that makes it
resistant to tampering so there's one
other
um
suggestion here that's correct
it is not firewalls
and it is not anti-virus software so
that leaves patching or physical
security
what do you think
I'm just taking a guess but um would it
be patching
no it's not patching actually it's
physical security
and the reason for this is that
ARP poisoning would occur over a local
area network
and this is going to require close
proximity to access the local area
network
and so good physical security is
important to mitigating ARP poisoning
attacks
okay
that's a might be a little unexpected at
first but when you think about
um where these attacks take place and
how they're implemented it starts to
make more sense
okay
any questions or comments on this one
okay
let's go ahead and move on to the second
question
okay so this question involves identical
Networks
the scenario is you decide to go to your
local library to work on some homework
while trying to connect to the internet
there
you notice two identical local library
Wi-Fi networks were not there previously
which are the following best describes
what you should do in this situation
your choices are choose either Network
because the library is large and
probably just needs two routers to cover
the whole building
choose neither Network
because one is probably a rogue access
point
choose both networks and see which one
yields the fastest internet speed or
choose neither because one is probably
blue jacked
okay
notes
what do you think
I'm gonna say
number two choose neither Network
because one is probably a rogue access
point
very good and that is correct
the giveaway here is that
the SSID that's appearing
is identical in both cases there are two
that's a local library Wi-Fi
and that's almost always going to be a
sure sign that
somebody is trying to get you to do the
wrong thing basically okay
um just because the library is large
yeah it doesn't necessarily
um mean or not mean that you don't need
two routers but you know you're not
going to have totally identical ssids it
doesn't work that way
um the one choosing one to see if it has
a faster internet speed than the other
is kind of not the right answer in fact
it's not the right answer it's not kind
of it's not the right answer
and then blue jacking
um is also incorrect so what we are
basically looking at here is what we
would call an evil twin attack
and basically it's where a hacker
operates a false access point
so in the attempt to get you to
associate with it
okay
all right doing good I have a question
yes please
blue Jack can you explain that what a
what is a blue Jack I'm sorry can you
speak up a little bit please
yes can you explain what what is a blue
Jack ah blue jacket so that basically
occurs when an attacker sends
unsolicited unsolicited text messages to
a Bluetooth device
and so since you're on this you know
Wi-Fi network
um and Bluetooth is more of a personal
area network we would not be using any
type of Bluetooth
technology to connect to the library's
Network
let's move on to the next one
and the next topic
Network intrusion detection
why would your network administrator
configure a signature based Network
intrusion detection system
your choices are
to authenticate users attempting to
connect to the network
to authorize what users are permitted to
do on the network
to automatically update for known
malicious attack patterns
or to make sure that all zero-day
attacks are detected
so
as we head into this question
when you look at the responses is there
anything that sticks out as obviously
incorrect
yes
I'm gonna say
to the number
[Music]
um
number one
number one okay and and why do you think
that one's obviously wrong
okay I'm sorry can you say that again
please
I'm sorry I was talking to myself
um
I don't know exactly why I chose that
one just doesn't seem right okay
okay well that that's a good sense a
good feeling there because
um I think it's your previous studies
kicking in and probably what's tipping
you off is the word authenticate
okay
so
there's one other response that's
pretty uh incorrect here
what I would call an obvious misdirector
anyone
would it be the last one yes it would be
and why do you think that would be the
misdirector
because it's talking about zero day
attacks and that's it has nothing to do
with the network but no one has anything
to do with the network
well zero day attacks I mean so when you
consider that a zero day exploit is
basically you know uh
is a leveraging of zero day
vulnerabilities and zero day
vulnerabilities our vulnerabilities that
are unknown to the vendor in the case of
software say a software vendor
so yeah there wouldn't be a signature
yet
and so the correct response for this
question
is the third choice to automatically
update for known malicious attack
patterns if it's a known malicious
attack
then the fact that it's known means that
we have a signature
base for this attack
and so we can use that to our advantage
okay
so it really doesn't have anything to do
with authenticating users or authorizing
users
so
there's the correct answer
okay
foreign
let's move to the next one
this question involves open source
firewalls
which are the following describes a
characteristic of an open source Network
firewall
your choices are
wired Hardware
inexpensive and ineffective
foreign
what do you think about this one
inexpensive
that's correct that is the correct
answer
um the actually it is the best answer
so
if we look at the rest of these
suggested answers
what's wrong with wired
foreign
it could be wired
it could be
but open source firewalls can also
function as wireless access points
so wired is definitely not the best
answer
what about Hardware
isn't that pertaining to like physical
devices yes to an appliance for example
and and remember when we look at these
questions and oftentimes you know the
the
sort of implied instruction or sometimes
it's very explicit is that you need to
choose the best answer
and the fact is
it's not necessarily going to be a
hardware Appliance it can be
it can be
so what about ineffective
doesn't that just kind of sound bad if
it's ineffective it's not it's not
working properly
it's it's definitely probably the worst
answer uh suggestion there
um because you know the popularity of
Open Source firewalls whether they're
software
or deployed on a hardware platform just
you know they're they're very popular
because they are affected and they are
inexpensive and they work very very well
so yeah inexpensive turns out to be the
best answer
uh to this question
okay
all right let's take a look at the next
one
so this question involves root cas
so
to be able to negotiate this question
to
come to a successful conclusion you have
to know what a CA is so what's a CA
anybody
uh the certified
uh
The Authority or authorization or
something something like that okay close
yeah it's a certificate Authority okay
okay so the question is which of the
following is true about a root CA
and we're asked to choose to
your choices are
it resides at the highest part of the
chain of trust
it resides at the lowest part of the
chain of trust
IT issues certificates to several
intermediate cas
es or IT issues certificates to several
single cas
so let's let's take a stab at this
thank you
what's a good one for the first choice
so the use of the word root
may be misdirecting or misleading if you
think of the root of a tree and
you know when you maybe picture that you
see it as the lower part of the tree but
really
the root cea resides at the highest part
of the chain of trust
and that's what's important about this
at the chain of trust
the root
certificate Authority is at the highest
part it's the origin
okay
all right so if we believe that's true
then that lets out it resides at the
lowest part of the chain of trust that
becomes incorrect that leaves us two
more choices and we need one of those
so what do you think
okay
oh sorry go ahead yes please go ahead oh
um is it the intermediate cas
yes it issues certificates to several
intermediate cas
es okay
and so
the root certificates
um when we're talking about the root CA
first of all to the thing to know is
that it has a self-signed certificate
okay and it uses this to digitally sign
all the other certificates that it
creates
and the certificate used by the root CA
is known as the root certificate and as
we already said is self-signed
so depending upon the size of the
organization
you can have one or more subordinate Cas
but we typically call these intermediate
cas
and these Cas the intermediate cas
have their certificates issued and
digitally signed by the root CA okay
all right
um it doesn't
really reach down to anything
below the intermediate cas
so we say that it issues certificates to
several intermediate cas
okay
let's move on to the next one
I have a question yes I wanted a
restroom so after open source after the
question question number four open
source firewalls was the fifth question
root CA yes anything yes root CA was the
fifth one
and basically the question was which of
the following is true
and the root CA resides at the highest
part of the chain of the trust chain of
trust it's the origin the point of
origin and IT issues certificates to
several intermediate cas
okay
thank you now the next question
jumps out right with port numbers
so the first thing to understand about
this is the importance of knowing port
numbers
and protocols and
you know there's really not going to be
any getting around this
um I'm often asked you know how should I
negotiate questions like this
um you know how do I deal with this and
some of these things and this is one of
them
some of this information
is pretty much a straight up knowledge
based information it's not like a
performance question
um it's just really something you have
to know and what I usually tell people
is
that if there's something you can do
to help you with knowledge-based
information so such as protocols and
port numbers if there's something that
you can physically do
if there's something you can create
this is often very helpful
to learning the material and one of the
easiest things to do is to create a
PowerPoint presentation
and you can also create things like Word
documents maybe you're going to use them
as flash cards
um if you really wanted to get
um detailed about it you can find uh
Jeopardy style games like this CTF as a
Jeopardy Style game really pretty much
you can find these templates for
PowerPoint download them and you know
create a whole sequence or a whole
series on protocols and port numbers
so the question here which statement
below is true regarding TCP Port 636
and your choices are it is used by FTP
it is used by ftps it is used by ldap it
is used by ldaps
so anybody have a suggestion for this
one
um I want to say ftps
FTP ft FTP
okay no
anyone else
is it the fourth one
it is it is l d a p s
so lightweight directory access protocol
secure or secure ldap
uses
secure sockets layer SSL over TCP Port
636
to encrypt the communication between the
client and the ldap system
again this is one of those things where
you basically have to deal with
knowledge-based information
and you know oftentimes there's a
there's a great deal of it so once again
my suggestion is always try to find some
way to create something a study guide a
self-help
guide or something that works for you
and but just do something
because that will often help to
solidify the knowledge okay and you know
the thing to understand about that is
that we really do want to try to avoid
just cramming things into short-term
memory because it really doesn't work
um and it's also obviously not very
lasting that's why we call it short-term
memory
um by working with the information and
creating something like a study guide
you can
better put it into longer term memory
okay
all right let's go to the next question
what does LD LD AP stand for again
lightweight directory access protocol
thank you you're welcome
okay
the next question
the topic is domain name
the question is
a startup business
thinks that they have found a way to cut
some costs
by registering a domain name
for a short period
and then deleting it repeatedly
so that they can avoid paying for the
domain name expenses
in this example
what term is being described
your choices are domain hijacking
domain poisoning
domain kiting
or domain squatting
so let's see what you think
would it be domain squatting
okay you think it's domain squatting
okay is there a reason
kind of just based off the definition of
squatting okay you don't necessarily own
the property you're just there when it's
benefited
okay so domain squatting is basically
buying a domain name and the the main
reason for doing this the sole purpose
for doing it is to prevent someone else
from getting it or from buying it
um when this happens typically buyers
will resell the domain name at a higher
price to someone else who's you know
somewhat desperate to get the name
um but that's not exactly what's being
described here
I'm gonna call that one a pretty good
you know Miss director
um what about domain hijacking is that
right or is that wrong
yeah that's an incorrect answer okay so
domain hijacking basically involves the
hackers taking over a domain name
from its original registrant
and this can be done using social
engineering techniques
um
uh possibly exploiting vulnerabilities
on systems that the host domain name you
know to gain authorized access to the
domain registration
so that's not the correct answer uh what
about domain poisoning does anybody know
what this is
I don't but I don't think that's the
correct answer either it's not um you
may have heard this or heard of it as
DNS poisoning or DNS cash poisoning
um but that that's not right either and
so that leaves us
with domain kiting
and what's Happening Here
is that someone can
purchase and register the domain
and take advantage of Grace periods
and so you can use the domain for a
grace period
then you can cancel the registration
but then go and register it again
and then try to keep writing this grace
period
I guess for as long as you can
and I think when I think about that
definition and the the name domain
kiting
it kind of sort of resembles you know
watching somebody fly a kite because the
kite just doesn't go straight up and up
and up and up right it goes up and comes
down maybe spins around or something and
you know that's really what you're
trying to do here you're trying to sort
of ride this wave of the grace period
and then you know when the thing is
heading towards the ground well then you
let go of it and
re-register it or you send the kite up
again it's just how I think of it I'm
telling you this because this is sort of
the picture that comes to my mind when I
think about this and
you know if you have an impression based
on say the name of a term being
described in this case domain kiting
that can also go a long ways to helping
you remember this
okay
let's go on to the next one
this question involves iot security
and so of course you know what's going
to matter here is that you understand
again acronyms iot
um I should point out that
um certification exams
um especially
Security Plus
um
is loaded with acronyms
so here again you may be faced with
um needing a way a methodology to deal
with acronyms and you know the first
thing that comes to my mind of course is
using PowerPoint presentations
again you can create these neat slides
that work like flash cards or any way
that you know you you react best to okay
some people like flash cards some people
like straight up notes
so what is iot
of things
the internet of things and the question
is
iot sensors
with minimal data transmission
requirements
are best restrained
by a blank Network design obviously our
task is to fill in the blank
so
your choices are restricted latency
client TLS certificates
restricted broadcast domain
or restricted bandwidth
okay all right anybody have an idea on
this one
okay does something stand out as
obviously incorrect
anybody no
um
it's okay take a guess
okay and and you think that is the
incorrect answer
foreign
I think the uh maybe it's the client TLC
certificate certificate
okay
all right so yeah
um client
TLS certificates
yeah that kind of doesn't make too much
sense
um I'd say the key to this particular
question
is that understanding that iot sensors
can exist in a wide range of items and I
mean everything from
refrigerators to you know fluid level
sensors
but
the really important part of this
question
is minimal data transmission
requirements
and so
if we're told up front
that there are minimal data transmission
requirements
and we don't
want to give any more quarter or any
more space or room than we need to
restricted latency is not going to do it
for us
latency doesn't make sense in this
context
yes yes absolutely the the answer to
this question is restricted bandwidth
okay
and
you know I mean we're talking about
possibly needing a bandwidth of say two
megabits per second which is
very very tight very restricted okay but
if the minimal if the transmission
requirements are minimal which they may
be coming from iot sensors
you know we we don't need a bandwidth of
50 megabits per second okay
and so the idea here is that you are
only giving enough
quarter or room
to satisfy what you need
okay
all right
the other thing to remember is that
sensor Transmissions
can also be tapped into
to get into a network
so by tightening the bandwidth
you may in effect
be helping to prevent
attacks that are seeking to get into the
network okay
all right
let's go on
to the next question
and this one involves Network design
so the question is which term is most
closely interchangeable to a reverse
proxy
your choices are forward proxy
load balancer
https server
SNMP service
okay
anybody want to
take a shot at this question
okay does anything look obviously
incorrect
do you think SNMP service has anything
to do
with a reverse proxy
do you recall what SNMP services
does anybody remember that acronym
okay so simple Network management
protocol
and this allows us to pull devices and
get and set configurations
so
to me SNMP service
and https server would be the two that
stand out as the least correct
okay
what about a forward proxy
does anybody know what that is
okay so forward proxy is the most common
form of a proxy server
generally used to pass requests from
isolated private Network to the internet
through a firewall
so
the most
closely interchangeable to reverse proxy
the term would be load balancer okay
now a reverse proxy facilitates a user's
requests to web server or application
server and the server's response
a load balancer receives user requests
and distributes them accordingly
among a group of servers
and then forwards each server response
to its respective user
so
you can kind of tell from that that
there's a bit of overlap between the
functions of the two and that makes load
balancer the best answer to this
question
okay so here
the situation involves understanding the
terminology what proxy servers are what
they do and as well as as being able to
spot
incorrect answers like SNMP servers or
https server
okay
let's move on to the next
okay this question involves PKA pki
excuse me certificate attributes and the
question is
which of the following are included
within a pki
SSL slash TLS certificate and this time
they want you to choose all that apply
so
your choices are URL domain name
in parentheses CN
or common name
certificate Authority reference
also CA
expiration date
or private key
okay so what are you thinking
anything that sticks out here
I'm sorry say again oh private key
private key okay is there a reason that
you think that private Keys is are you
saying that's a good answer or a bad
answer
good answer a good answer okay
so it is not
okay
it's okay that's okay
um this question involves understanding
public key infrastructure okay
and so certificate attributes are
components of the certificate
and the private key is definitely not
going to be one of them
okay because it's not stored in a pki
certificate
certificates are files with a public key
and contain information
of its respective private key owner
okay
so
private key is not one of the correct
choices
what do you think about some of the
others how about expiration date do
certificates expire
do they have a valid from date and a
date and after which they expire what do
you think
yes yes they do
okay
and the certificate Authority reference
what about that one
is there a reference to the certificate
Authority
that generated the certificate
do you think it's important to know
where it came from yes yes
okay
and the URL domain name what do you
think about that one
it's important to me as well it is it's
the CN in parentheses stands for common
name and it's also known as
fqdn and here we go with the acronyms
again
so
fqdn fully qualified domain name
so are three correct choices here
our URL domain name certificate
Authority reference and expiration date
all right let's push on to the next
question
okay so this one is involving SSL and
TLS
the question reads
what do SSL and TLS get you
from a security compliance perspective
and we're asked to choose two
your choices are data encryption in
transit
data encryption on disk data encryption
in memory
and client server session encryption
so clearly
we're dealing with encryption here
okay so what are you thinking
if we're concerned with
data encryption
where do you think it's most critical
and Transit
in transit
I would agree with that and that is in
fact
a correct answer
oops there we go
data encryption in transit okay
what about on disk
does that have anything to do with
secure sockets layer or transport layer
security
when we look at the rest of the choices
if we're concerned with encryption
obviously we are trying to keep the
wrong people
from
seeing the information or accessing it
or being able to do something with it
even if they have accessed it
so
data encryption on disk and in memory
and then client server session
encryption
which one of those three is not like the
others
and we're only talking about these three
choices now
here here and here
if I ask in another way and I say data
encryption in transit and then I ask you
to look at the remaining three choices
and pick one that is like
data encryption in transit which do you
think it would be
number four
yes yes absolutely
okay
if we have a client server session
right then we have communication between
at least two endpoints
and again we're sort of dealing with
data in transit
okay
so those two are most closely related
now this doesn't mean you can't do data
encryption on disk okay you certainly
can
um there are
several ways to do this the most popular
and well known are going to be full disk
encryption or file level encryption and
file level encryption gives you a little
more granularity and control over
what exactly you want to encrypt in
terms of the files and data encryption
on disk is just the whole thing
okay all right let's move on and go to
the next question
okay so this involves again Wi-Fi
security
your it manager has asked you to verify
the security profile of the Wi-Fi access
points in your office
so you plan to look at several aspects
of your wireless networks
what are some of the top common
vulnerabilities you should First Look
for and we're told to choose two
we're looking for common vulnerabilities
the first things you would look for
your choices are MAC address filtering
default admin passwords
open Wi-Fi networks
or AES 256 encryption
okay
what do you think
would it make sense to start with Wi-Fi
it's open Wi-Fi networks first yes yes
it would
unsecured Networks
a common vulnerability
something that you can easily spot
okay what's another one what do you
think that's easily admin password yeah
yep
sure because what are they
admin and admin
admin and password
right it depends on the manufacturer now
of course they do this you know to to
make it easy when you take something out
of the box and you're getting it set up
and not to just you know put it out
there with no protection
but
everybody knows these things
now the other thing is that
Mac address
and MAC address filtering and you know
using AES 256 encryption
I mean
you know they're not
they are viable answers but they
certainly are going to require a lot
more work to see
if you're using AES 128 or 256 or if you
have MAC address filtering set up okay
so the most obvious
common as they were calling it would be
default admin passwords
and open Wi-Fi networks
okay let's move on
let's see here
of course
there we go
foreign
Federated identity management control
the question is which of the following
describes a better rated identity
management control
your choices are
audit specifications that are designed
to ensure that cloud posting providers
meet Professional Standards
a virtual item that contains
authorization data and is commonly used
in multi-factor Authentication
an authentication process that trusts a
third-party Network authenticator to
Grant access to another or different
network
or an authentication Service that grants
Federal access
so
anything sticks out as obviously
incorrect what do you think
would it be number one
Okay so
audit specifications that are designed
to ensure that cloud hosting providers
meet Professional Standards okay
um why do you think that might be
clearly wrong or obviously wrong
because it's talking about cloud and
hosting providers okay
and not necessarily anything with
identity management yep yeah
yeah I would agree with that
um the other one I think that's kind of
silly is the last one an authentication
Service that grants Federal access
I mean
not even quite sure what they're getting
at and you know every now and then you
get lucky and
you get a question and one of the
answers is really kind of out there
so
what do you think the correct answer is
here
is it the multi-factor identification
no no it's not okay no because we're
we're dealing with identity management
and if you are concerned with identity
and identity management and we're really
concerned with Authentication
okay
and so the correct answer
an authentication process that trusts a
third-party Network Authenticator
to Grant access to another or different
Networks
okay what's a third party what would you
give an example of a third-party Network
Authenticator
yeah I mean it's another type of
organization that maintains the
information stores that can be used for
single sign-on so like OCTA mm-hmm okay
okay
so the other thing to understand about
this is Federated identity management
provides single sign-on capability
okay
all right and let's see I think we're
gonna have time for another one
okay
the network administrator for your
organization needs to configure a
security method that allows only
specific devices to a port on the land
what method should they administer
your choices are nmap Mac filtering
firewall and Source IP affinity
Okay so
we're looking for methodology
that allows only specific devices
to access a port on the land
what is obviously incorrect here do you
think
and math and map and Maps a tool yeah
okay right it's it's not really a
security method it's a tool
is there anything else in that same
category that's kind of a tool and
make me a security method but still not
as much
how about firewall does that answer make
sense
I mean a firewall's a tool as well right
um
I do have a question with Mac filtering
is that only
say again
we're filtering only
might sound weird but it's not Mac as an
apple right it's like an acronym for
something else Mac yeah Mac addresses
okay media Access Control okay in fact
Mac filtering is the correct answer
okay this is this is a way that and it
can be employed on your home network uh
most modern wireless routers do have mac
filtering built into them
um certainly uh
small office home office and Enterprise
switching equipment can use and often
does use Mac filtering
um in fact when a switch is set up for
Mac filtering
if you connect a host to it with a
different Mac address than it's
expecting
okay report will often go into what we
might call an error disabled state so
it's it's a really good method
for making sure that only certain
devices can access ports
um and if you're accessing a port on the
land you're certainly going to be going
through some type of aggregation
Appliance like a layer 2 switch
you can also set ports up to accept more
than one Mac address
but it's still filtering and and that's
correct and what about Source IP
affinity
does anybody know what that is
okay so it's also known as simple
persistence
and Source address Affinity persistence
supports TCP and UDP protocols direct
session requests to the same server
based solely on the source i p address
of a packet in other words it prefers
that source and that's why we use the
term Source i p affinity
okay
we have one more
yeah go ahead just before you move on
you said uh Mac was media Access Control
yes okay thank you
[Music]