Security+ Study Guide-04 Securing Your Network

A HIDS reported a vulnerability on a system based on a known attack. After researching the alert from the HIDS, you identify the recommended solution and begin applying it.

What type of HIDS is in use?

• Network-based

• Signature-based

• Heuristic-based

• Anomaly-based

Answer explanation

If the host-based intrusion detection system (HIDS) identified a known issue, it is using signature-based detection (sometimes called definition-based detection). A HIDS is not network-based but a network-based IDS (NIDS) can also use signature-based detection.

Heuristic-based or behavior-based (sometimes called anomaly-based) detection systems identify issues by comparing current activity against a baseline. They can identify issues that are not previously known.

You are preparing to deploy a heuristic-based detection system to monitor activity. Which of the following would you create first?

• BPDU guard

• Signatures

• Baseline

• Honeypot

Answer explanation

A heuristic-based (also called behavior-based or anomaly-based) detection system compares current activity with a previously created baseline to detect any anomalies or changes.

Signature-based systems (also called definition-based) use signatures of known attack patterns to detect attacks.

A honeypot is a server designed to look valuable to an attacker and can divert attacks.

A Bridge Protocol Data Unit (BPDU) guard is used to protect against BPDU-related attacks and is unrelated to this question.

Lenny noticed a significant number of logon failures for administrator accounts on the organization's public website. After investigating it further, he notices that most of these attempts are from IP addresses assigned to foreign countries. He wants to implement a solution that will detect and prevent similar attacks.

Which of the following is the BEST choice?

• Implement a passive NIDS

• Block all traffic from foreign countries

• Implement an inline NIPS

• Disable the administrator accounts

Answer explanation

An inline network-based intrusion prevention system (NIPS) can dynamically detect, react to, and prevent attacks An inline system is placed inline with the traffic, and in this scenario, it can be configured to detect the logon attempts and block the traffic from the offending IP address before it reaches the internal network.

A passive network-based intrusion detection system (NIDS) is not placed inline with the traffic and can only detect the traffic after it has reached the internal network, so it cannot prevent the attack.

If you block all traffic from foreign countries, you will likely block legitimate traffic.

You should disable administrator account is they're not needed. However, if you disable all administrator accounts, administrators won't be able to do required work.

Lisa created a document called password.txt and put the usernames of two accounts with elevated privileges. She then placed the file on her administrator account desktop on several servers.

Which of the following BEST explains her actions?

• She can use this file to retrieve the passwords if she forgets them

• This file will divert attackers from the live network

• The document is a honeyfile

• The file is needed by an application to run when the system starts

Answer explanation

A honeyfile is a file with a deceptive name (such as password.txt) that will deceive an attacker and attract his/her attention. It is not appropriate to place a file holding credentials on a desktop for any reason.

A honeypot or honeynet diverts attackers from the live network.

A file on an administrator's desktop on the live network. It is unlikely that any application needs a file name password.txt to run. Even if an application needs such a file, the file would be inaccessible if it is placed on the administrator's desktop.

Your organization is planning to upgrade the wireless network used by employees. It will provide encrypted authentication of wireless users over TLS.

Which of the following protocols are the MOST likely implementing?

• EAP

• PEAP

• WPA2

• WPA3

Answer explanation

Protected EAP (PEAP) can be used for wireless authentication and it uses Transport Layer Security (TLS) to encapsulate and encrypt the authentication conversation within a TLS tunnel.

Extensible Authentication Protocol (EAP) is the basic framework for authentication. By itself, EAP doesn’t provide encryption, but it can be combined with other encryption protocols.

Neither Wi-Fi Protected Access 2 (WPA2) nor Wi-Fi Protected Access 3 (WPA3) use TLS.

Lisa is creating a detailed diagram of wireless access points and hotspots within your organization. What is another name for this?

• Remote access VPN

• Wireless footprinting

• Channel overlap map

• Architectural diagram

Answer explanation

Wireless footprinting creates a detailed diagram of wireless access points and hotspots within an organization. It typically displays a heat map and dead spots if they exist.

A remote access virtual private network (VPN) provides access to a private network and is unrelated to this question.

Wi-Fi analyzers provide a graph showing channel overlaps but not a diagram of wireless access points. An architectural diagram is typically laid on top of a heat map to create the wireless footprint document, but by itself, it shows the building layout.

You are assisting a small business owner in setting up a public wireless for her customers. She wants to allow customers to access the hotspot without entering a password. Which of the following is the MOST appropriate for this hotspot?

• Use Open mode

• Use a PSK

• A Raspberry Pi device

• Rogue AP

• APT

Answer explanation

Open mode is the best choice of those given for a public wireless hotspot that doesn’t require a password. A pre-shared key (PSK) is the same as a password and the scenario says a password isn’t desired. Enterprise mode requires each user to authenticate and is typically enabled with a RADIUS server. If you disable service set identifier (SSID) broadcast, it will make it harder for the customers to find the hotspot, but unless Open mode is used, it will still require a password.

A network administrator routinely test the network looking for vulnerabilities. He recently discover a new access point set to open. After connecting to it, he found he was able to access network resources.

What is the BEST explanation for this device?

• Evil twin

• A Raspberry Pi device

• Rogue AP

• APT

Answer explanation

This describes a rogue access point (AP). A rogue AP is not authorized (also known as shadow IT) but provides access to an internal network because it has been plugged into the network. In this scenario, the access point has no security, so someone could connect to it from the parking lot and then access the internal network. An evil twin has the same or similar service set identifier (SSID) as a legitimate access point, but the SSID isn’t mentioned. A Raspberry Pi device is an embedded system, and it can be configured as a wireless AP, but there isn’t any indication of the type of wireless AP in this scenario. An advanced persistent threat (APT) attacks from external locations and is unlikely to connect to a physical wireless AP inside a network.

You are an administrator at a small organization. Homer contacted you today and reported the following:

* He logged on normally on Monday morning and accessed network shares.

* Later, when he tried to access the Internet, a pop-up window with the organization's wireless SSID prompted him to log on.

* After doing so, he could access the Internet but no longer had access to the network shares.

* Three days later, his bank notified him of suspicious activity on his account.

Which of the following indicates the MOST likely explanation for this activity?

• An evil twin

• A rogue access point

• A DDoS attack

• A captive portal

Answer explanation

This describes an evil twin. Normally, a user shouldn’t have to log on again to access the Internet. Because he lost access to network resources after logging on, it indicates he didn’t log on to a corporate access point (AP) but instead logged on to an unauthorized AP. Because the service set identifier (SSID) is the same as the corporate SSID, it indicates the AP is an evil twin.

An evil twin is a rogue access point with the same or similar SSID as a legitimate AP, so an evil twin is a more accurate description.

A distributed denial-of-service (DDoS) attack is an attack against a single computer from multiple attackers and is unrelated to this question.

A captive portal forces web browser users to complete a specific process, such as agreeing to an acceptable use policy, before it allows them access to a network.

Mobile users in your network report that they frequently lose connectivity with the wireless network on some days, but they don't have any problems on other days. You suspect this is due to an attack. Which of the following attacks is MOST likely to cause these symptoms?

• Wireless jamming attack

• IV attack

• Replay attack

• Bluesnarfing attack

Answer explanation

A wireless jamming attack is a type of denial-of-service (DoS) attack that can cause wireless devices to lose their association with access points and disconnect them from the network. It transmits noise or another radio signal on the same frequency used by the existing wireless network.

An initialization vector (IV) attack attempts to discover the passphrase.

A replay attack captures traffic intending to replay it later to impersonate one of the parties in the original transmission.

Bluesnarfing is a Bluetooth attack that attempts to access information on Bluetooth devices.