7 Network Security Essentials Free Online FlashCards

How should access to network-device management interfaces be restricted?

Allow administration only from trusted administrator devices on a restricted management network; do not expose management interfaces directly to the internet.

Which protocols are recommended for secure network-device management?

Prefer SSH version 2 and HTTPS for management, and use SNMPv3 with authentication and encryption when SNMP is needed. Disable unneeded or unencrypted services such as Telnet and FTP.

What does centralized AAA provide for network administration?

Centralized authentication, authorization, and accounting (AAA) supports role-based privileges and protected, centralized records of administrative activity.

What is the benefit of an out-of-band management network?

A physically isolated out-of-band management network can preserve access to network equipment when production links fail.

Why is a VLAN not a complete security control by itself?

A VLAN organizes traffic and creates a boundary, but it is not sufficient by itself. Routing rules, access-control lists, or firewalls must control traffic crossing between segments.

How should network segments be designed and connected?

Group systems by purpose and risk, then allow only necessary connections between zones using firewalls or access-control rules.

Where should public-facing services be placed?

Place public-facing services in a demilitarized zone (DMZ) rather than giving them direct access to internal systems.

How can segmentation limit an intruder’s lateral movement?

Denying unnecessary traffic between zones limits an intruder’s ability to move laterally from a compromised device toward sensitive systems.

What wireless security approach is preferred for managed organizational networks?

Prefer WPA3-Enterprise with strong authentication such as EAP-TLS for managed organizational networks when supported.

What is the recommended fallback when WPA3 is not compatible?

If compatibility requires WPA2, use a modern AES-based configuration and plan to replace obsolete equipment. Avoid WEP, original WPA, and TKIP.

How should a small network protect Wi-Fi that uses a shared passphrase?

Use a long, unique passphrase and change it if exposed. Shared credentials are harder to control than individual user or device authentication.

How should guest Wi-Fi access be restricted?

Use a separate guest network, restrict guests to internet access, and enable client isolation when available to block access to internal resources and other clients.