Ethical Hacking Networking Fundamentals Syllabus

What port does SSH use, and what does it provide?

TCP port $22$; SSH provides encrypted remote shell access and secure tunneling/file transfer (SCP/SFTP).

What ports and protocols does DNS use?

DNS uses UDP port $53$ for standard queries and TCP port $53$ for zone transfers and large responses.

What ports do SMTP, POP3, and IMAP use?

SMTP = TCP $25$ (submission $587$), POP3 = TCP $110$, IMAP = TCP $143$ (secure IMAPS = $993$).

What ports do Telnet and RDP use?

Telnet uses TCP port $23$ (unencrypted); RDP uses TCP port $3389$.

What ports does DHCP use?

DHCP uses UDP port $67$ (server) and UDP port $68$ (client).

What is the well-known port number range, and what is the total number of TCP/UDP ports?

Well-known ports are $0$–$1023$; total ports range $0$–$65535$, i.e. $2^{16} = 65536$ ports.

What is the primary functional difference between a hub and a switch?

A hub is a Layer 1 device that repeats signals to all ports (one collision domain); a switch is a Layer 2 device that forwards frames only to the destination port using a MAC table, giving each port its own collision domain.

What is a VLAN and what security benefit does it provide?

A Virtual LAN logically segments a switch into separate broadcast domains. It isolates traffic, limiting broadcast scope and reducing the attack surface between groups of hosts.

What is the difference between a collision domain and a broadcast domain?

A collision domain is a segment where packet collisions can occur (bounded by switches/routers); a broadcast domain is the set of devices that receive a broadcast frame (bounded by routers/VLANs).

What Layer 2 protocol prevents switching loops, and how?

Spanning Tree Protocol (STP); it blocks redundant paths to build a loop-free logical topology while keeping backup links available.

What is the difference between a stateless (packet-filtering) firewall and a stateful firewall?

A stateless firewall inspects each packet independently against rules (IP/port/protocol). A stateful firewall tracks connection state in a state table and allows return traffic for established sessions.

What is a next-generation firewall (NGFW) and how does it differ from a traditional firewall?

An NGFW adds deep packet inspection, application awareness (Layer 7), integrated IPS, and user identity/threat intelligence beyond simple port/IP filtering.

What is the difference between a firewall's default-deny (whitelist) and default-allow (blacklist) policy?

Default-deny blocks all traffic except explicitly permitted flows (more secure); default-allow permits everything except explicitly blocked flows (less secure).

What is a DMZ in network design?

A demilitarized zone is a perimeter subnet that hosts public-facing services (web, mail, DNS) between the untrusted internet and the trusted internal network, isolating them so a breach doesn't directly expose the LAN.

What is the difference between the 2.4 GHz and 5 GHz Wi-Fi bands?

$2.4\,\text{GHz}$ offers longer range and better wall penetration but fewer non-overlapping channels and more interference; $5\,\text{GHz}$ offers higher throughput and more channels but shorter range.

Rank the Wi-Fi security protocols WEP, WPA, WPA2, and WPA3 from weakest to strongest, noting their encryption.

WEP (weakest, RC4, broken) < WPA (TKIP) < WPA2 (AES-CCMP) < WPA3 (strongest, AES + SAE/forward secrecy).

What is an 'evil twin' attack on a wireless network?

An attacker sets up a rogue access point mimicking a legitimate SSID to trick users into connecting, enabling interception of their traffic and credentials.

What is the difference between an SSID and a BSSID?

The SSID is the human-readable network name; the BSSID is the MAC address of the specific access point's radio.

What is the core difference between an IDS and an IPS?

An IDS (Intrusion Detection System) passively monitors and alerts on suspicious traffic; an IPS (Intrusion Prevention System) sits inline and can actively block or drop malicious traffic in real time.

Compare signature-based and anomaly-based detection in IDS/IPS.

Signature-based detection matches traffic against known attack patterns (low false positives, misses zero-days). Anomaly-based detection flags deviations from a learned baseline (can catch novel attacks but has more false positives).

What is the difference between a NIDS and a HIDS?

A Network IDS (NIDS) monitors traffic across a network segment; a Host IDS (HIDS) monitors activity, logs, and files on a single host.

Define true positive, false positive, false negative, and true negative for an IDS.

True positive = attack correctly alerted; false positive = benign traffic wrongly alerted; false negative = attack missed (no alert); true negative = benign traffic correctly ignored.

What is network segmentation and why is it a security best practice?

Dividing a network into isolated segments/zones so that traffic between them is controlled. It limits lateral movement, contains breaches, and reduces the attack surface (enforcing least privilege at the network level).

What is microsegmentation?

A fine-grained segmentation approach that isolates individual workloads or hosts (often down to the VM/container level) with per-workload policies, typically enforced in software to stop east-west lateral movement.

What is the primary purpose of a VPN?

To create an encrypted tunnel over an untrusted network (like the internet), providing confidentiality, integrity, and authentication for data in transit between endpoints.

Compare IPsec and SSL/TLS VPNs.

IPsec operates at Layer 3, securing all IP traffic (often site-to-site), needing a client. SSL/TLS VPNs operate at Layers 4-7, are typically clientless via a browser, and are used for remote-access to specific applications.

What are the two IPsec modes, and how do they differ?

Transport mode encrypts only the packet payload (host-to-host). Tunnel mode encrypts the entire original IP packet and adds a new header (used for site-to-site gateways).

What is the difference between IPsec's AH and ESP protocols?

AH (Authentication Header) provides integrity and authentication but no encryption. ESP (Encapsulating Security Payload) provides confidentiality (encryption) plus integrity and authentication.

What is a packet sniffer, and name a common tool used for network monitoring and analysis.

A packet sniffer captures and inspects network traffic for analysis. Wireshark is the most common tool; tcpdump is a common CLI alternative.

What is the difference between a SPAN/port-mirror and a network TAP for monitoring?

A SPAN port copies traffic in software on a switch (can drop packets under load); a network TAP is a passive hardware device inserted inline that copies traffic without loss and is invisible to attackers.