Chapter 7 Part 1 of 2 - Security Fundamentals AIT MOS 25B

With VDI user applications and data are stored on a server.

A DNS Database does not consist of the name of a site and a corresponding IP address

DNS poisoning substitutes a fraudulent IP address

DNS is a TCP/IP protocol that maps IP addresses to their symbolic name

DNS Poisoning can be done in local host table or external DNS server.

Vulnerabilities of virtualized environments: Not all hypervisors have the security controls to defend against an attack.

In SIEM sensors, collectors, and filters should be placed where the stream of data is largest.

DDoS Mitigator is hardware that identifies and blocks real-time distributed denial of service (DDoS) attacks.

Using FTP behind a firewall can present challenges

An advantage of Host Virtualization is the virtual server machines can be made available (host availability).

A TCP/IP protocol used for transferring files which is File Transfer Protocol (FTP).

The DNS database is organized as a hierarchy

TCP/IP is the combination of several protocols functioning together.

In Host Virtualization, host elasticity is when resources an be easily expanded or contracted as needed.

File transfer protocol (F T P) is an unsecure protocol used to connect to an F T P server

Security logs reveal types of attacks that are being directed at the network and if attacks were successful.

FTP uses which two ports:

A File Integrity Check (FIC) monitors for changes made to computer files, such as OS files.

In regard to Host Virtualization what does VDE stand for

DNS is NOT often the focus of attacks

Security software can produce important data that can be analyzed.

A security-related advantage of host virtualization is snapshots of VM state to be saved for later.

Access logs provide details regarding requests for specific files.

Host Virtualization is a VM monitor program is called a hypervisor.

A zone transfer allows attacker access to network, hardware, and operating system information.

In FTP active mode a Client’s firewall may sometimes drop packets on Port 20 (the data channel connection).

An Aggregation Switch is used to combine multiple network connections into a single link.^

For Analyzing Security Data logs can be useful supporting the organization’s internal investigations.

Port 21 is the FTP control port

Vulnerabilities of virtualized environments: VMs must be protected from outside networks & other VMs on the same device.

In regard to Hypervisors: Type 2 runs directly on the computer’s hardware instead of the underlying OS.

Which type of security device/technology should be located between routers & servers in order to detect & stop attacks?

For Analyzing Security Data: A routine review of logs helps to identify:

A security-related advantage of host virtualization is security control testing for testing existing security settings.

Significant security enhancements were made to the current version known as SNMPv3

SNMP is also called a community string

Methods for using FTP on local host computer:

VDE is an Ethernet-compliant virtual network that can connect physical computers and/or virtual machines together.

DNS poisoning can be thwarted by using Domain Name System Security Extensions (DNSSEC)

A security-related advantage of host virtualization is the ability to test security updates on virtual machines.

SNMP allows administrators to remotely monitor, manage, and configure network devices.

VDI enables personalized desktops for each user to be available on any computer or device that can access the server.

Firewall log items to be examined for IP addresses rejected and dropped.

Protocols are essential for proper communication between network devices.

An Aggregation Switch can located between routers and servers to detect/stop attacks directed at a server or application

Live migration allows a virtual machine to be moved to a different physical computer with no impact to the user(s).

Logs can provide documentation of organizational compliance to laws and regulatory requirements.

SNMPv3 supports authentication and encryption.

Hosted services are servers, storage, & supporting networking infrastructure shared over a remote network connection.

DNSSEC adds additional resource records and header information to verify the integrity of the requested data.

SIEM filters block traffic for Internet content filters.

Firewall log items to be examined for probes to ports that have no application services on them

Audit logs record which user performed an action

VMs maybe able to "escape" from the contained environment and directly interact with the host OS.

A security-related advantage of host virtualization is that a VM can be used for sandbox testing of suspicious programs

In regard to Hypervisors: Type 2 runs on the host OS, much like an application.

What does VDI stand for in regard to Host Virtualization

Port 20 is the data port

Host Virtualization is a means of managing & presenting computer resources without regard to physical layout or location

A Correlation Engine should be in a protected internal network using data collected from the logs of different hardware.

The challenge of log management relates to:

The SIEM process analyzes activity from many different resources across an IT infrastructure but doesn't aggregate data.

In regard to Hypervisors: Type 1 runs on the host OS, much like an application.

Firewall log items to be examined for suspicious outbound connections.

Which type of security device/technology should be in the network where the largest stream of data can be monitored?

DDoS Mitigator should be in the network where the largest stream of data can be monitored.

For Analyzing Security Data logs can be useful for performing auditing analysis.

Vulnerabilities of virtualized environments: Existing security tools were designed for single physical servers.

TCP/IP is the most common protocol suite used for local area networks and the internet.

Several basic TCP/IP Protocols related to security include:

Firewall log items to be examined for unsuccessful logins.

Firewall log items to be examined for source-routed packets.

SIEM sensors monitor traffic for network intrusion detection and prevention devices.

Hardware devices designed for security usually generate logs.

No security vulnerabilities were present in SNMP versions 1 and 2

In regard to Hypervisors: Type 1 runs directly on the computer’s hardware instead of the underlying OS.

SNMP prevents unauthorized users from taking control of a device.

Virtualization can provide uninterrupted server access to users through live migration.

A File Integrity Check (FIC) changes can compromise security and indicate a security breach has occurred.

In regard to contained environments using VMs, It is important to have VM escape protection.

VDI is the process of running a user desktop inside a VM that resides on a server.

Cloud computing is a model that enables convenient, on-demand network access to a shared pool of configurable resources.

Host Virtualization is an entire operating system environment is simulated.

In regard to log management challenges a solution is to use a centralized device log analyzer

Virtualization can reduce costs because fewer physical computers must be purchased and maintained.

The database is distributed to many different servers on the Internet to prevent bottlenecking and to ensure efficiency

SIEM aggregates & analyzes activity from many different resources across an IT infrastructure.

SNMP is used to manage network equipment and is supported by most network equipment manufacturers.

SNMP functions by exchanging management information between network devices

In regard to Host Virtualization: A hypervisor manages virtual operating systems and supports one or more guest systems

Protocols are rules for communication

VDI allows centralized management of all virtual desktops.

A Correlation Engine aggregates and correlates content from different sources to uncover an attack.

Host Virtualization is a Virtual machine (VM) is a software-based simulation of a computer

Each SNMP-managed device has an agent or a service which listens for and executes commands.

For Analyzing Security Data logs can be useful identifying operational trends and long-term problems.

Sandbox testing malware on a Virtual Machine will isolate the impact of a suspicious program.

Log management includes generating, transmitting, storing, analyzing, and disposing of computer security log data.

Virtual machine sprawl is the widespread proliferation of VMs without proper oversight or management.

Event logs document unsuccessful events and the most significant successful events.