Chaprer 6 Network Analysis and Security Technologies Quiz
42 Questions
0 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to Lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What is the primary purpose of NetFlow in network analysis?

  • Monitoring network device hardware status
  • Managing IP address allocation
  • Capturing and analyzing network traffic data (correct)
  • Analyzing user application performance

Which technology is associated with micro-segmentation in Cisco ACI?

  • Traffic shaping
  • Access control lists
  • Software-defined networking (correct)
  • VLAN tagging

What is a significant benefit of network telemetry?

  • Proactive security threat detection (correct)
  • Reduction of data storage requirements
  • Enhanced endpoint device compliance
  • Increased bandwidth availability

Which of the following is NOT a method of exfiltration techniques?

<p>Smart Contract (D)</p> Signup and view all the answers

What does Cisco Encrypted Traffic Analytics (ETA) help organizations achieve?

<p>Visibility into encrypted traffic flows (D)</p> Signup and view all the answers

What is the primary purpose of using NetFlow in network security?

<p>To analyze and mitigate anomalies in network traffic (D)</p> Signup and view all the answers

How does anomaly-based detection generally work to identify threats?

<p>By monitoring traffic that deviates from established normal behavior (D)</p> Signup and view all the answers

What is a common characteristic of DDoS attacks?

<p>They often use multiple hosts to overwhelm resources (B)</p> Signup and view all the answers

What is the initial step to be taken before implementing anomaly-detection capabilities?

<p>Perform thorough traffic analysis to understand patterns (A)</p> Signup and view all the answers

Which of the following best describes a 'bot host' in the context of network attacks?

<p>A compromised system used to launch coordinated attacks (C)</p> Signup and view all the answers

What is crucial for an anomaly-detection system to do effectively react to network traffic anomalies?

<p>Alert and respond to sudden increases in traffic (A)</p> Signup and view all the answers

In network security, what does the term 'normal behavior' refer to?

<p>The average operational parameters of the network (D)</p> Signup and view all the answers

Which additional mechanisms can be paired with NetFlow to enhance security data collection?

<p>Simple Network Management Protocol (SNMP) and syslog (B)</p> Signup and view all the answers

What characterizes an immediate cache in network monitoring?

<p>It accounts for a single packet, suitable for real-time traffic. (C)</p> Signup and view all the answers

What does the permanent cache allow for?

<p>It tracks flows without expiring them from the cache. (B)</p> Signup and view all the answers

How is traffic in a flow defined in relation to a session?

<p>Flows are distinct from sessions, despite their relatedness. (D)</p> Signup and view all the answers

Which of the following is NOT a purpose of NetFlow?

<p>Enhancing cloud storage capabilities (D)</p> Signup and view all the answers

Which statement about flow aging in the cache is accurate?

<p>Entries are removed based on active and inactive timeout settings. (B)</p> Signup and view all the answers

What role does NetFlow play in achieving network security?

<p>It provides complete visibility necessary for threat detection. (A)</p> Signup and view all the answers

What is a disadvantage of using the immediate cache?

<p>It may lead to increased CPU and memory utilization. (C)</p> Signup and view all the answers

Which statement correctly differentiates IP Accounting from NetFlow?

<p>NetFlow is more well-known and comprehensive than IP Accounting. (A)</p> Signup and view all the answers

What is the primary function of the FlowSensor?

<p>To enhance packet capture capabilities where NetFlow is absent (A)</p> Signup and view all the answers

How does NetFlow assist in historical event tracking?

<p>By maintaining a transactional record of network events (C)</p> Signup and view all the answers

Which of the following statements about syslog is accurate?

<p>Every security professional relies heavily on good logging mechanisms (C)</p> Signup and view all the answers

What role does the logging process serve on Cisco devices?

<p>It controls how logging messages are delivered to various destinations (B)</p> Signup and view all the answers

What can historical records show during an investigation of a security breach?

<p>Details about the initial infection and its communication channels (D)</p> Signup and view all the answers

Which tools are included in the monitoring event correlation systems?

<p>Elastic Search, Logstash, and Kibana (C)</p> Signup and view all the answers

What is a significant limitation of syslog?

<p>Message delivery is solely dependent on the device configuration (A)</p> Signup and view all the answers

When configuring the FlowSensor, what is typically used along with it?

<p>The FlowCollector (A)</p> Signup and view all the answers

What is the most common UDP port used by NetFlow?

<p>UDP port 2055 (D)</p> Signup and view all the answers

Which tool is designed to be highly scalable and can process high-volume traffic?

<p>YAF (B)</p> Signup and view all the answers

What does the Metering Process (MP) do?

<p>It generates flow records from packets. (C)</p> Signup and view all the answers

Which of the following tools is web-based and provides real-time traffic monitoring?

<p>Ntopng (B)</p> Signup and view all the answers

What is the default port used by IPFIX?

<p>UDP port 4739 (B)</p> Signup and view all the answers

What role do IPFIX mediators play in network monitoring?

<p>Transform and re-export IPFIX streams (B)</p> Signup and view all the answers

Which of the following statements about the Exporting Process (EP) is true?

<p>The EP sends flow records to one or more collecting processes (CPs). (B)</p> Signup and view all the answers

Which of the following is NOT a listed open-source tool for IPFIX?

<p>NetFlow Analyzer (B)</p> Signup and view all the answers

What is one of the benefits of combining bandwidth and QoS features?

<p>Enhanced ability to drop non-critical packets to prevent delays (B)</p> Signup and view all the answers

Which performance metric is NOT collected by the Cisco AVC embedded monitoring agent?

<p>Throughput efficiency (D)</p> Signup and view all the answers

What is the purpose of protocol discovery features in Cisco AVC?

<p>To identify the mix of applications and help define QoS policies (A)</p> Signup and view all the answers

What format is used to export metrics collected by the Cisco AVC monitoring agent?

<p>NetFlow v9 or IPFIX (B)</p> Signup and view all the answers

Which QoS feature can be applied after traffic classification by administrators?

<p>Class-based weighted fair queuing (CBWFQ) (A)</p> Signup and view all the answers

Flashcards

Network Visibility

The ability to see and understand network traffic and activity.

NetFlow

A network protocol that gathers and analyzes network traffic data.

Network Segmentation

Dividing a network into smaller, isolated parts to improve security.

Cisco Secure Network Analytics

A security product that analyzes network traffic for security threats.

Signup and view all the flashcards

Micro-segmentation

A method of network segmentation that isolates even smaller parts of the network.

Signup and view all the flashcards

Flow Cache

A temporary storage area used by NetFlow to collect and analyze network traffic data.

Signup and view all the flashcards

Immediate Cache

A type of flow cache designed for real-time analysis of individual packets, commonly used for traffic monitoring and detecting distributed denial-of-service (DDoS) attacks.

Signup and view all the flashcards

Permanent Cache

A type of flow cache designed for long-term tracking of flows without expiration. The data is periodically exported.

Signup and view all the flashcards

Flow vs. Session

A flow refers to traffic moving in one direction, while a session represents a two-way communication between a client and server.

Signup and view all the flashcards

NetFlow's Key Applications

NetFlow is used for network security, traffic engineering, network planning, and network troubleshooting.

Signup and view all the flashcards

NetFlow for Security

NetFlow provides nonrepudiation, anomaly detection, and investigative capabilities to enhance network security.

Signup and view all the flashcards

Complete Network Visibility

The ability to see and understand all network traffic and activity, essential for identifying and mitigating security threats.

Signup and view all the flashcards

NetFlow vs. IP Accounting

NetFlow is a comprehensive and widely adopted network flow analysis protocol, while IP Accounting is a Cisco-specific tool for network accounting.

Signup and view all the flashcards

Anomaly Detection

Identifying network traffic that deviates from normal patterns.

Signup and view all the flashcards

Normal Network Behavior

The typical patterns of network traffic, including volume, type, and source/destination.

Signup and view all the flashcards

DDoS Attack

A malicious attack that floods a network with traffic, overwhelming resources and causing outages.

Signup and view all the flashcards

Zombie Host/Botnet

A compromised computer controlled by an attacker to participate in a coordinated attack.

Signup and view all the flashcards

What does NetFlow monitor?

NetFlow monitors network traffic and provides data for anomaly detection and security analysis.

Signup and view all the flashcards

Traffic Analysis

Examining network traffic patterns to understand normal usage and identify potential anomalies.

Signup and view all the flashcards

Learning Interval

The period of time over which an anomaly detection system observes network traffic to establish normal patterns.

Signup and view all the flashcards

Security Mechanisms

Tools and techniques used to protect a network from threats.

Signup and view all the flashcards

FlowSensor

A network appliance that provides deeper visibility into network traffic beyond NetFlow, connecting to SPAN, mirror ports, or TAPs.

Signup and view all the flashcards

NetFlow Data Storage

NetFlow data is easier to store than packet captures because it only includes transaction records, allowing for longer historical records.

Signup and view all the flashcards

Analyzing Network Transactions

Examining network transactions helps identify the source of an infection, command-and-control channels, and infected hosts accessed.

Signup and view all the flashcards

Syslog Logging Facility

A feature on Cisco devices that allows saving system logs locally or on a remote server.

Signup and view all the flashcards

Syslog Severity Levels

Controls the type of log messages displayed, allowing for filtering of less important events.

Signup and view all the flashcards

Importance of Logs

Essential for security professionals and incident responders to understand what happened during an attack.

Signup and view all the flashcards

Syslog Limitations

Syslog has limitations, indicating its importance to consider alternative methods for network monitoring.

Signup and view all the flashcards

ELK Stack

A suite of open-source tools (Elasticsearch, Logstash, Kibana) used for log analysis and visualization.

Signup and view all the flashcards

QoS benefits

Combining features in QoS allows for control of bandwidth allocation, packet prioritization, and congestion management, leading to better network performance for critical applications.

Signup and view all the flashcards

Cisco AVC Metrics

Cisco AVC uses an embedded monitoring agent and NetFlow to collect various network metrics, including TCP performance metrics (bandwidth usage, response time, latency) and VoIP performance metrics (packet loss, jitter).

Signup and view all the flashcards

Metrics Exporting

Cisco AVC exports collected metrics in NetFlow v9 or IPFIX format to a management and reporting system. Metrics records can be sent directly from the data plane for speed or exported at a lower speed from the route processor for more complex processing.

Signup and view all the flashcards

QoS Capabilities

QoS capabilities can control application prioritization based on protocol discovery and statistics. This helps define QoS classes and policies, such as bandwidth allocation for mission-critical applications and traffic policing.

Signup and view all the flashcards

QoS Features

After classifying traffic, administrators can apply features like Class-based Weighted Fair Queuing (CBWFQ) for guaranteed bandwidth and other QoS techniques to manage network traffic effectively.

Signup and view all the flashcards

NetFlow Standard Port

The default UDP port used by NetFlow protocol is 2055. However, other ports like 9555, 9995, 9025, and 9026 can also be used for NetFlow traffic.

Signup and view all the flashcards

IPFIX Default Port

UDP port 4739 is the default port used by IPFIX protocol, a newer and more advanced version of NetFlow.

Signup and view all the flashcards

IPFIX Metering Process (MP)

The MP is responsible for generating flow records from network packets. It captures data, timestamps it, samples it, classifies it, and prepares it for forwarding.

Signup and view all the flashcards

IPFIX Exporting Process (EP)

The EP sends IPFIX flow records from one or more MPs to one or more collecting processes (CPs).

Signup and view all the flashcards

IPFIX Collecting Process (CP)

The CP receives IPFIX flow records from one or more EPs. It's responsible for collecting and processing information from various sources.

Signup and view all the flashcards

IPFIX Mediator

A mediator acts as a middleman between different IPFIX components. It gathers IPFIX streams, potentially modifies them, and then re-exports them to one or more IPFIX collectors.

Signup and view all the flashcards

What is Softflowd?

Softflowd is a lightweight tool that analyzes network traffic and generates IPFIX flow records. It's compatible with various operating systems, including Linux, BSD, and macOS.

Signup and view all the flashcards

What is YAF?

Yet Another Flowmeter (YAF) is an open-source flow-based traffic analyzer that generates IPFIX records. It's known for its scalability, handling large volumes of network traffic.

Signup and view all the flashcards

Study Notes

Chapter 5: Network Visibility and Segmentation

  • This chapter covers network visibility and segmentation, including topics like NetFlow, IPFIX, Cisco Secure Network Analytics, Cisco Cognitive Intelligence, and Network Segmentation.
  • It also covers exam objectives related to secure network access, visibility, and enforcement, including device compliance and application control, exfiltration techniques, network telemetry, and components of security products.

Introduction to Network Visibility

  • Network visibility is a crucial element in cybersecurity.
  • It involves maintaining a good level of visibility across all environments, especially in multi-cloud environments.
  • Good visibility is essential for maintaining services and business continuity.
  • Organizations need a flexible architecture with multiple technologies that offer visibility and maintain control during abnormal or malicious events.

NetFlow

  • NetFlow is a Cisco technology that provides comprehensive insights into all network traffic traversing a Cisco-supported device.
  • Initially designed for billing and accounting network traffic, it also measures bandwidth utilization, application performance, and availability.
  • It's a critical tool for network security, providing nonrepudiation, anomaly detection, and investigative capabilities.
  • NetFlow gathers information about network traffic, allowing administrators to monitor what's happening throughout the network, identify DoS attacks, quickly identify compromised devices, monitor employee, contractor, or partner network usage, and detect firewall misconfigurations.

IP Flow Information Export (IPFIX)

  • IPFIX is an IETF standard for exporting flow information from routers, switches, firewalls, and other network devices.
  • IPFIX standardizes the format and transfer of flow information from an exporter to a collector.
  • It's based on NetFlow v9 and offers increased features and capabilities compared to older NetFlow versions.

Cisco Secure Network Analytics (formerly known as Cisco Stealthwatch)

  • This is a cloud-based solution used for network visibility, threat detection, and incident response.
  • It gathers data from various network devices using NetFlow and IPFIX.
  • Network telemetry is analyzed to detect anomalies and malicious behavior.
  • It helps in identifying suspicious activities, data exfiltration, and anomaly detection, such as DDoS attacks and zero-day exploits. It also allows for incident response and forensics.

Cisco Cognitive Intelligence (ETA)

  • Cisco ETA passively monitors encrypted traffic, extracts relevant data, and uses behavioral modeling and machine learning to identify malicious communications.
  • It does not decrypt packets and enhances network visibility without needing to decrypt the network traffic, for example, identifying suspected ransomware communications.

Network Segmentation

  • Network segmentation logically groups network assets, resources, and applications.
  • Segmentation provides flexibility to implement different security and control mechanisms.
  • Network segmentation involves separating network into sections or zones where different access control rules apply.

Micro-segmentation using Cisco ACI

  • Micro-segmentation allows organizations to place endpoint groups (EPGs) into logical Zones.
  • EPGs are used to group VMs to which specific filtering and forwarding policies are applied.
  • Flexible policies can be applied to endpoints (VMs) based on network or VM attributes, dynamically.
  • Cisco ACI facilitates granular policies and automatic assignment of devices, enhancing security.

Segmentation Using Cisco ISE

  • Cisco ISE is a crucial element for network segmentation.
  • It facilitates configuring security policies based on users, devices, and other characteristics to segment based on groups of users, applications and devices.

Studying That Suits You

Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

Quiz Team

Related Documents

Chapter 5: Network Visibility and Segmentation PDF

Description

Test your knowledge on key concepts in network analysis and security technologies. This quiz covers NetFlow, micro-segmentation in Cisco ACI, network telemetry benefits, exfiltration techniques, and Cisco Encrypted Traffic Analytics. Perfect for IT professionals and students looking to deepen their understanding of network security.

More Like This

Use Quizgecko on...
Browser
Open
Browser
Browser