Cybersecurity Network Security Flashcards

24 sample cards from the Network Security deck

Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.

1. Name three security functions commonly performed by a reverse proxy.

   SSL/TLS termination and offloading, load balancing across backend servers, and hiding/protecting backend server identity while enabling caching, WAF filtering, and DDoS mitigation.

2. What is the fundamental difference between an IDS and an IPS?

   An IDS (Intrusion Detection System) is passive—it monitors and alerts on suspicious traffic (out-of-band, on a mirror/SPAN port). An IPS (Intrusion Prevention System) is active and inline—it can block or drop malicious traffic in real time.

3. Compare signature-based and anomaly-based detection in IDS/IPS.

   Signature-based detection matches known attack patterns; it is accurate for known threats but misses zero-days. Anomaly-based (behavioral) detection flags deviations from a learned baseline; it can catch novel attacks but produces more false positives.

4. Define false positive and false negative in the context of an IDS.

   A false positive is a legitimate/benign event incorrectly flagged as an attack. A false negative is a real attack that goes undetected (not flagged). False negatives are generally more dangerous.

5. What is the difference between a NIDS and a HIDS?

   A NIDS (Network IDS) monitors network traffic at strategic points/segments. A HIDS (Host IDS) runs on an individual host and monitors that system's logs, files, and processes for suspicious activity.

6. What is a VPN and what two core security services does it provide?

   A VPN (Virtual Private Network) creates an encrypted tunnel over an untrusted network. It provides confidentiality (encryption of traffic) and integrity/authentication of the endpoints, extending private network access securely.

7. Compare full-tunnel and split-tunnel VPN configurations.

   In full tunnel, all client traffic is routed through the VPN, maximizing security/inspection but adding latency. In split tunnel, only corporate-bound traffic uses the VPN while internet traffic goes directly, improving performance but reducing visibility/control.

8. What are the two IPsec protocols AH and ESP, and what does each provide?

   AH (Authentication Header, protocol 51) provides integrity and authentication but no encryption. ESP (Encapsulating Security Payload, protocol 50) provides confidentiality (encryption) plus integrity and authentication.

9. Compare IPsec transport mode and tunnel mode.

   Transport mode encrypts only the packet payload, leaving the original IP header intact (used for host-to-host). Tunnel mode encrypts the entire original packet and adds a new IP header (used for site-to-site gateways).

10. What is a jump server (jump box / bastion host) and why is it used?

    A jump server is a hardened, monitored host that acts as the single controlled entry point for administrators to access devices in a secure/isolated zone. It centralizes and audits access, reducing the attack surface by preventing direct connections to internal systems.

11. What is Secure Access Service Edge (SASE) and what two broad capabilities does it converge?

    SASE is a cloud-delivered architecture that converges networking (SD-WAN) with security (network security as a service). It typically bundles SD-WAN, SWG, CASB, ZTNA, and FWaaS, delivered at the network edge close to users.

12. What is Zero Trust Network Access (ZTNA) and how does it differ from a traditional VPN?

    ZTNA grants access per-application based on continuous identity and context verification ('never trust, always verify'), with no implicit network trust. Unlike a VPN, which grants broad network-level access after connecting, ZTNA hides resources and limits access to specific authorized applications.

13. List the 802.11 Wi-Fi standards a/b/g/n/ac/ax with their primary frequency bands.

    802.11a: 5 GHz; 802.11b/g: 2.4 GHz; 802.11n (Wi-Fi 4): 2.4 & 5 GHz; 802.11ac (Wi-Fi 5): 5 GHz; 802.11ax (Wi-Fi 6/6E): 2.4, 5 & 6 GHz.

14. Compare the 2.4 GHz and 5 GHz Wi-Fi bands in terms of range and speed.

    2.4 GHz offers longer range and better wall penetration but lower throughput and more interference/congestion. 5 GHz offers higher throughput and more channels but shorter range and weaker penetration.

15. Rank the Wi-Fi security protocols WEP, WPA, WPA2, and WPA3 from weakest to strongest and note key encryption.

    WEP (weakest, RC4, broken IVs) < WPA (TKIP) < WPA2 (CCMP/AES) < WPA3 (strongest, SAE + AES-GCMP). Only WPA2 and WPA3 are considered acceptable today.

16. What is SAE in WPA3 and what attack does it defend against?

    SAE (Simultaneous Authentication of Equals, aka Dragonfly) replaces the WPA2 pre-shared key handshake. It provides forward secrecy and resists offline dictionary/brute-force attacks by preventing capture-and-crack of the handshake.

17. What is the difference between WPA2/WPA3 Personal (PSK) and Enterprise modes?

    Personal mode uses a shared pre-shared key (PSK/passphrase) for all users. Enterprise mode uses 802.1X with a RADIUS server for individual per-user authentication (EAP), providing unique credentials and centralized control.

18. What is a rogue access point?

    A rogue AP is an unauthorized wireless access point connected to the network (often by an insider or attacker) without administrative approval, creating a backdoor that bypasses perimeter security controls.

19. What is an evil twin attack and how does it differ from a rogue AP?

    An evil twin is a malicious AP that impersonates a legitimate one by cloning its SSID (and often a captive portal) to trick users into connecting, enabling credential theft and man-in-the-middle. A rogue AP is any unauthorized AP on the network; an evil twin specifically mimics a trusted SSID to deceive clients.

20. What is a deauthentication attack and why is it a precursor to an evil twin attack?

    A deauth attack sends spoofed 802.11 deauthentication frames to force clients off a legitimate AP. It is used to disconnect victims so they reconnect—often to the attacker's evil twin—enabling handshake capture or MITM.

21. What is Bluejacking versus Bluesnarfing?

    Bluejacking sends unsolicited messages to a Bluetooth device (relatively harmless). Bluesnarfing is the unauthorized access to and theft of data (contacts, messages, files) from a Bluetooth device—a serious data breach.

22. What is the typical range and frequency band of classic Bluetooth, and why does short range matter for security?

    Classic Bluetooth operates in the 2.4 GHz ISM band with a typical Class 2 range of about 10 meters. The short range limits an attacker's proximity requirement, but it does not prevent attacks like bluesnarfing or bluebugging within range.

23. Compare passive and active RFID tags and note a key security concern.

    Passive RFID tags have no battery and are powered by the reader's signal (short range); active tags have their own battery and longer range. A key security concern is skimming/eavesdropping and cloning, since many RFID tags transmit data without encryption or authentication.

24. What is an RFID relay (man-in-the-middle) attack, and what mitigations exist?

    A relay attack captures an RFID/NFC signal and relays it in real time to a distant reader to impersonate the legitimate tag (e.g., keyless car entry). Mitigations include shielding (Faraday sleeves), distance-bounding protocols, encryption/mutual authentication, and requiring user action.

What this deck covers

Network Security flashcards FAQ