112-51 Practice Questions

The cloud layer of IoT architecture is the layer that hosts the servers that accept, store, and process

the sensor data received from IoT gateways. The cloud layer also creates dashboards for monitoring,

analyzing, and implementing proactive decisions to tackle the issue. The cloud layer provides

scalability, reliability, and security for the IoT system. The cloud layer can use various cloud

computing models, such as public, private, hybrid, or community clouds12. Reference: Network

Defense Essentials - EC-Council Learning, IoT Architecture: The 4 Layers of an IoT System

Unauthorized access signatures were identified by Kalley through the installed monitoring system.

Unauthorized access signatures are designed to detect attempts to gain unauthorized access to a

system or network by exploiting vulnerabilities, misconfigurations, or weak credentials. Password

cracking, sniffing, and brute-forcing are common techniques used by attackers to obtain or guess the

passwords of legitimate users or administrators and gain access to their accounts or privileges. These

techniques generate suspicious traffic patterns that can be detected by traffic monitoring systems,

such as Snort, using signature-based detection. Signature-based detection is based on the premise

that abnormal or malicious network traffic fits a distinct pattern, whereas normal or benign traffic

does not. Therefore, by installing a traffic monitoring system and capturing and reporting suspicious

traffic signatures, Kalley can identify and prevent unauthorized access attempts and protect the

security of her organization’s network. Reference:

Network Defense Essentials Courseware, EC-Council, 2020, pp. 3-33 to 3-34

Detecting Suspicious Traffic via Signatures - Intrusion Detection with Snort, O’Reilly, 2003

Threat Signature Categories - Palo Alto Networks, Palo Alto Networks, 2020

anonymous proxy is a type of proxy that hides the user’s IP address and other identifying information

from the web servers they access. An anonymous proxy acts as an intermediary between the user

and the internet, and it modifies the HTTP headers to prevent the web servers from tracking the

user’s location, browser, or device. An anonymous proxy can help the user bypass geo-restrictions,

censorship, and online surveillance. However, an anonymous proxy does not encrypt the user’s

traffic, and it may still leak some information to the proxy provider or other third parties. An

anonymous proxy is the type of proxy employed by Mary in the above scenario, as she used a proxy

tool that makes her online activity untraceable. Reference:

What is a Proxy Server and How Does it Work?

13 Best Proxy Tools for PC [2024 Reviewed] - Section: Anonymous proxies

The Fastest Free Proxy

The network defense approach that was employed by Alice on her laptop was the preventive

approach. The preventive approach aims to stop or deter potential attacks before they happen by

implementing security measures that reduce the attack surface and increase the difficulty of

exploitation. Biometric authentication is an example of a preventive measure that uses a physical

characteristic, such as a fingerprint, iris, or face, to verify the identity of the user and grant access to

the device or system. Biometric authentication is more secure than traditional methods, such as

passwords or PINs, because it is harder to forge, guess, or steal. By locking her laptop and using

biometric authentication, Alice prevented Bob from accessing her laptop and her confidential files

without her permission. Reference:

Network Defense Essentials Courseware, EC-Council, 2020, pp. 1-7 to 1-8

What is Biometric Authentication?, Norton, July 29, 2020

An introduction to network defense basics, Enable Sysadmin, November 26, 2019

Atomic-signature-based analysis is a type of attack signature analysis technique that uses a single

characteristic or attribute of a packet header to identify malicious traffic. Atomic signatures are

simple and fast to match, but they can also generate false positives or miss some attacks. Some

examples of atomic signatures are source and destination IP addresses, port numbers, protocol

types, and TCP flags. Atomic-signature-based analysis is the technique performed by Joseph in the

above scenario, as he analyzed packet headers to check whether any indications of source and

destination IP addresses and port numbers are being changed during transmission. Reference:

[Understanding the Network Traffic Signatures] - Module 12: Network Traffic Monitoring

Network Defense Essentials (NDE) | Coursera - Week 12: Network Traffic Monitoring

[Network Defense Essentials Module 12 (Network Traffic Monitoring) - Quizlet] - Flashcards: What

are Network Traffic Signatures?

The IDS component that analyzes the traffic and reports if any suspicious activity is detected is the

network sensor. A network sensor is a device or software application that is deployed at a strategic

point or points within the network to monitor and capture the network traffic to and from all devices

on the network. A network sensor can operate in one of two modes: promiscuous or inline. In

promiscuous mode, the network sensor passively listens to the network traffic and copies the

packets for analysis. In inline mode, the network sensor actively intercepts and filters the network

traffic and can block or modify the packets based on predefined rules. A network sensor analyzes the

network traffic using various detection methods, such as signature-based, anomaly-based, or

reputation-based, and compares the traffic patterns with a database of attack signatures or a model

of normal behavior. If the network sensor detects any suspicious or malicious activity, such as a

reconnaissance scan, an unauthorized access attempt, or a denial-of-service attack, it generates an

alert and reports it to the IDS manager or the operator. A network sensor can also integrate with a

response system to take appropriate actions, such as logging, notifying, or blocking, in response to

the detected activity123. Reference:

Network Defense Essentials Courseware, EC-Council, 2020, pp. 3-33 to 3-34

Intrusion Detection System (IDS) - GeeksforGeeks, GeeksforGeeks, 2020

Intrusion detection system - Wikipedia, Wikipedia, March 16, 2021

The object of the container network model (CNM) that contains the configuration files of a

container’s network stack, such as routing table, container’s interfaces, and DNS settings, is the

Sandbox. A Sandbox is a logical entity that encapsulates the network configuration and state of a

container. A Sandbox can contain one or more endpoints from different networks, and provides

isolation and security for the container’s network stack. A Sandbox can be implemented using

various technologies, such as Linux network namespaces, FreeBSD jails, or Windows compartments.

A Sandbox allows the container to have its own view and control of the network resources, such as

interfaces, addresses, routes, and DNS settings123. Reference:

The Container Networking Model | Training, Training, 2020

A Comprehensive Guide To Docker Networking - KnowledgeHut, KnowledgeHut, September 27, 2023

Design - GitHub: Let’s build from here, GitHub, 2020

:

A transposition cipher is a type of cipher that encrypts a document by rearranging the same

characters to produce the ciphertext. A transposition cipher does not change the identity or

frequency of the characters, but only their position. A transposition cipher can use various methods

to permute the characters, such as writing them in a grid and reading them in a different order, or

shifting them along a rail fence pattern. A transposition cipher is a simple and fast algorithm, but it

can be easily broken by frequency analysis or anagramming. A transposition cipher is the type of

cipher employed by Kevin in the above scenario, as he used a simple algorithm to encrypt the

document that just rearranges the same characters to produce the ciphertext. Reference:

Transposition cipher - Wikipedia

Network Security: Transposition Cipher Techniques - Coding Streets

Network Defense Essentials (NDE) | Coursera - Module 4: Cryptography Techniques

Columnar Transposition Cipher - GeeksforGeeks

WPA2 (Wi-Fi Protected Access 2) is an encryption technology that secures wireless networks using

the IEEE 802.11i standard. WPA2 uses a four-way handshake to authenticate the client and the access

point, and to generate a pairwise transient key (PTK) for encrypting the data. The PTK is derived from

the password pairwise master key (PMK), which is a shared secret between the client and the access

point. The PMK can be obtained either by using a pre-shared key (PSK) or by using an 802.1X

authentication server. In the above scenario, George performed password cracking on WPA2, as he

used sniffing tools to capture the PMK associated with the handshake authentication process. Then,

using the PMK, he was able to derive the PTK and decrypt the data exchanged between the client

and the access point. Reference:

WPA2 - Wikipedia

How WPA2-PSK encryption works? - Cryptography Stack Exchange

WPA2 Encryption and Configuration Guide - Cisco Meraki Documentation