Help
Options
Didn't know it?
click below
click below
Knew it?
click below
click below
Don't Know
Remaining cards (0)
Know
retry
shuffle
restart
0:00
Embed Code - If you would like this activity on your web page, copy the script below and paste it into your web page.
Normal Size Small Size show me how
Normal Size Small Size show me how
3D052 Volume 1
Network Management & Security
| Question | Answer |
|---|---|
| Define the internetwork. | A set of subnets that are connected with routers to a larger network. |
| What does a heterogeneous network environments consist of? | Computer systems from different vendors that run different OSs and communication protocols. |
| A network of components from the same vendor or compatible equipment that all run under the same OS or NOS is what kind of network? | Homogeneous. |
| Which type of network (homogeneous verses heterogeneous) is more common? | Heterogeneous networks are more common because most organizations purchase their equipment from a variety of vendors. |
| What is a communications network that serves users within a confined geographical area? | A LAN. |
| What type of network usually provides services for 2 to 10 users? | Peer-to-peer network. |
| How many users does a single server network normally service? | 10-50 users. |
| What type of network can service 1000 or more users? | An enterprise network. |
| What is used for addressing on a physically connected network to identify network nodes? | When all the devices were physically connected to the same network, the MAC address was enough. |
| What is the numbering system that computers use to represent data? | Binary is the base two number system that computers use to represent data. |
| Within IP addressing, how many bits are used and how are they broken down? | 32-bit IP address is broken into four sets of eight bits. |
| The following is a representation of a single octet, provide the decimal value of each position. ___0__0__0__0_0_0_0_0 | 128 64 32 16 8 4 2 1 0 0 0 0 0 0 0 0 |
| What mechanism is used to designate a part of an IP address as the network address, and other parts as the host address? | Three, Network, Subnet, and Host fields. |
| What is the primary reason for subnetting in IPv4? | Subnetting was initially utilized to improve efficiency in using a limited number of available address spaces, especially in IPv4, and to improve security. |
| What bits in an IP address are routers mainly concerned with? | The bits that belong to the network/subnet field. |
| What is the Air Force instruction series that covers NM? | 33 - Communications-computer networking and information management. |
| What does AFPD 33–1, Information Resources Management, establishes policy on? | For responsibly acquiring, planning, and managing its information resources. |
| AFI 33–104, Base-Level Planning and Implementation, outlines what actions? | Standardized management practices and tells how to manage planning and implementation of communications and information systems and the base-level infrastructure. |
| What are three areas of distributed responsibility does the DIICC consist of? | (1) Global. (2) Regional. (3) Local levels. |
| What is NM? | The systems management mechanism that monitors and controls data collection for the purpose of data analysis and report generation on an OSI-based communications network. |
| What is a NM server? | A bundle of application software designed to significantly improve network efficiency and productivity that specifically runs SNMP-based management applications. |
| Where should the NM server be located? | In an area that is controlled strictly by the NCC. |
| Briefly describe the three most common NM architectures. | Centralized: Has a NM platform on one computer system. Hierarchical: Uses multiple systems, with one system acting as a central server and the others working as clients. Distributed: Combines centralized and hierarchical. |
| Briefly describe each of the four levels of activity that one must understand before applying management to specific services or devices? | Inactive — No monitoring. Reactive — Network support personnel react to a problem after it has occurred(No monitoring). Interactive — Monitoring components, but must interactively troubleshoot. Proactive — Automated monitoring components. |
| What is configuration management? | The process of obtaining data from the network and using that data to manage the setup of all managed network devices. |
| What are the two features built into an NMS that alleviate manually configuring a network’s devices? | (1) Automatic discovery. (2) Auto-mapping features. |
| What does performance management consist of? | The facilities needed to evaluate the behavior of network objects and the effectiveness of communications activities. |
| List the steps that you must take to provide accurate performance management. | (1) Gather statistical information. (2) Maintain and examine logs of system state. (3) Determine system performance under natural and artificial conditions. (4) Alter system modes of operation for the purpose of conducting performance management. |
| What are the two functional categories of performance management? Describe each. | (1) Monitoring –The function that tracks historical data by tracking activities on the network. (2) Tuning–Deals strictly with the adjustment of the parameters on the network devices to improve their overall operation. |
| What is security management? | The protection of sensitive information on devices attached to a data network by controlling access points to that information. |
| What are the two subsections of security management? | (1) Network security. (2) NMS security. |
| What is fault management? | The process of identifying, locating and correcting network problems. |
| What is the difference between a fault and an error? | Faults are abnormal conditions that require NCC personnel to take action to correct or repair. Errors sometimes arise on a normal functioning of the network and do not necessarily require attention. |
| What are some drawbacks to ICMP pinging as a NM tool? | Unreliable delivery of packets, need for polling (user intensive), and limited information derived from responses. |
| What is a MIB? | A hierarchical, structured format that defines the NM information available from network devices. |
| What are the two parts of the labeled node? | (1) An object identifier. (2) A short text description. |
| What are the two types of nodes that make up the MIB tree? | (1) Labeled nodes. (2) Leaf nodes. |
| What are the differences between the two types of nodes that make of the MIB tree? | Labeled nodes may have subordinate nodes, leaf nodes never have subordinate nodes. Word formatted (labeled) nodes allow people to read and understand what the label is pointing to, while the decimal (leaf) nodes are how the NMS tracks the information. |
| What are some examples of what a node in SNMP can represent? | A node can represent a workstation, client, network user, personal computer, server, printer, or other device attached to a data network. |
| Briefly describe each of the two categories of SNMP. | (1) Managers—Typically a computer that is used to run one or more NMS applications (suite). (2) Agents—Responsible for monitoring, collecting and reporting management data to the management system. |
| What does the Get operation do? | The Get query retrieves the value of one instance of management information. |
| What does the Set operation do? | Modifies the value of one or more instances of management information. |
| What is a trap? | An unsolicited message from an agent to the manager; it does not have a corresponding request message. |
| What are community names? | Each SNMP community is a group that contains at least one agent and one management system. The logical name assigned to such a group we call the community name. |
| Describe each of the two types of community names. | (1) Read—Community names as implied define a community that is read only. (2) Write—Community names are defined to allow the manager to remotely change configuration information from the management station or server. |
| What do the two hierarchies provided by the CIM describe? | Physical hierarchies describe the real-world components, while Logical hierarchies are visible through network protocols. |
| What are the three methods for creating a representation of a network topology within the domain managers repository? | (1) Auto-discovery. (2) Manual discovery. (3) Topology import. |
| What are the three main components of SMARTS? | (1) Domain manager(s). (2) A broker. (3) Clients. |
| List the five different map types that can be accessed through the map console? | (1) Physical Connectivity. (2) IP Network Connectivity. (3) IP Network Membership. (4) VLAN Connectivity. (5) VLAN Membership. |
| What is the primary console in SMARTS and what does it display? | Monitoring console; it is used to display the results of the domain manager’s correlation alarms. |
| Briefly describe the differences between the two types of polling used by SMARTS to gather information? | Fault and performance data is collected using SNMP while device connectivity is monitored using ICMP. |
| What two factors determine if a SMARTS map is opened with read-write access or with readonly access? | (1) Only one user can have a specific map opened with read-write access at anyone time. (2) You can use the file system (FAT or NTFS) to purposely allow specific users to read-write or read-only access to a map by setting permission to the files. |
| What are the three types of notifications used in SMARTS? | (1) Problem. (2) Compound event. (3) Symptomatic event. |
| List eight of the objects that can be tracked through the Windows performance monitor. | Browser Network Interface Server Cache Objects Server Work Queues ICMP (PING) Paging File System IP Physical Disk TCP Logical Disk Process Telephony Memory Processor Thread NBT Connection Redirector UDP0 |
| What are the primary capabilities provided by a protocol analyzer? | Digital network diagnostics and developing communications software. |
| What is the difference between a protocol analyzer NIC and other NICs? | The NIC in a protocol analyzer is configured to process all frames, whereas other NICs only process broadcast frames and frames with its MAC address. |
| What is the recommended minimum amount of time to acquire network information to establish a performance baseline? | 24 hours. |
| What function of the protocol analyzer excludes specific types of frames? | The Capture filters option allows you to display and store only the data you are interested in analyzing. You may also use a capture filter to exclude specific types of frames. |
| List four types of specific occurrences that can be displayed by counters in the protocol analyzer. | (1) Packets transmitted. (2) CRC errors. (3) Undersize packets. (4) Oversize packets. (5) ARP requests. (6) Data frame collisions. (7) Bit errors. |
| On the protocol analyzer, what menu is best used to report errors that occur at the physical layer such as bad FCS, short frames, and jabbers? | MAC node statistics. |
| On the protocol analyzer, what kind of information does the connection statistics menu provide? | Information concerning the bandwidth utilization and the number of connections that are related to specific nodes. |
| What are the three types of active tests that are conducted with a protocol analyzer? | (1) PING. (2) Trace route. (3) Traffic generator. |
| What is identification as it pertains to information protection? | Process of proving that a subject (e.g., a user or a system) is what the subject claims to be. |
| What is authentication as it pertains to information protection? | Authentication is defined as a measure used to verify the eligibility of a subject and the ability of the subject to access certain information. |
| What are the three primary ways to authenticate oneself on the network? | (1) Knowledge based. (2) Possession-based. (3) Biometrics based Or to put it another way, something you know, something you have, and/or something you are. |
| On an Air Force network, what is your password required to have in it? | The Air Force requires a network password to be at least nine characters long, to have at least two upperand lower-case letters (A/a, B/b, etc.), two numbers (0–9), and two special characters. |
| Where are biometrics based authentication and identification generally used, and why? | While biometric based systems provide very high levels of security (unique physical characteristics are generally harder to counterfeit), they tend to be much more expensive, and are reserved for area’s that require a very high level of security. |
| What is the biggest risk with a possession based system for identifying and authenticating yourself? | Risk of counterfeiting, (creating a fake token). |
| Why would you use a combination of methods for identifying and authenticating yourself? | It substantially increases the security of an I &A system. |
| What are the three methods of providing strong authentication? | (1) Biometric and possession based methods. (2) Cryptographically protected authentication (encrypted). (3) Using one time passwords. |
| Where can you find specific guidance concerning remanence security? | AFSSI 8580, Remanence Security. |
| What is remanence security? | Remanence security is the use of prescribed safeguards and controls to prevent reconstruction or disclosure of sensitive or classified information to persons who do not have the proper clearance or need to know for this information. |
| When something is sanitized, is it automatically declassified? | Sanitization does not automatically declassify media. |
| Until when must you retain classification controls? | Until the media is sanitized and declassified, or destroyed in an approved manner. |
| When does the information owner of storage media declassify the media? | After the information owner provides evidence that no information resides on the media, the information owner can declassify the media. |
| When is destroying storage media NOT necessary? | Physical destruction is not required if the media is sanitized and declassified. |
| What must you ensure when you are degaussing storage media? | You must ensure that the coercivity strength of the magnetic field generated by the degausser is strong enough to return the magnetic media to its zero state. |
| Which AFI governs the AFCAP? | AFI 33–210, Air Force Certification and Accreditation Program (AFCAP). |
| What is the biggest difference between DIACAP and previous processes? | In previous processes, the C&A was usually accomplished as a separate process accomplished just prior to connecting an IS to the network. DIACAP takes a different approach. It is a process meant to track every IS and network from inception to retirement. |
| What are the five phases of the DIACAP process? | (1) Initiate and plan IA C&A. (2) Implement and validate assigned IA controls. (3) Make certification determination and accreditation decision. (4) Maintain authorization to operate and conduct reviews. (5) Decommission. |
| What two publications provide the basic framework of the C&A process? | (1) The IT lean re-engineering process. (2) AFI 33–210. |
| What is the SISSU checklist? | The SISSU checklist is a consolidated list of requirements covering each of those areas that a program office must adhere to when developing and fielding a system. |
| What are the most common Air Force circuit-enclaves? | The base networks. |
| What are the SIPRNET, and NIPRNET, and how does the SIPRNET differ from the NIPRNET? | NIPRNet is an Unclassified but Sensitive IP Router Network. SIPRNET is also a long-haul IP based network, but it supports data classified up to secret. The SIPRNET does not provide access to the internet or any other lower classification networks. |
| What is the name of the concept that DOD uses in network defense? | Defense in depth. |
| What are some examples of computer security incidents? | (1) Compromise of integrity (2) Denial of service (3) Misuse (4) Damage (5) Intrusions (6) Alterations |
| Where would a network monitoring device such as an ASIM be placed in relation to the network? | An integrated network monitoring device, such as the ASIM, is placed outside the network boundary protection mechanism to monitor all attempted attacks. |
| Describe tunneling. | This is the practice of encapsulating a message (that would be rejected by the firewall) inside a second message that will pass through the firewall. |
| What kind of servers would typically be found in a DMZ? | (1) Web servers. (2) SMTP (e-mail) servers. (3) DNS servers. (4) Proxy servers. (5) Dial-up servers. (6) Web Mail servers. |
| What is the simplest and least expensive type of firewall, and what is its purpose? | A packet filtering; it stops messages with inappropriate network addresses. |
| What type of firewall is used to separate secure sites, networks, or network segments from less secure areas? | Bastion host. |
| Describe the two categories that security related access controls fall into? | (1) Technical controls, such as passwords and encryption that are part of normal network security. (2) Administrative controls, such as segregation of duties and security screening of users. |
| Regardless of the source of the threat, what is it usually targeting? | The vulnerability or weakness in the network. |
| How does a virus activate? | For the virus to execute, the infected program must execute, activating the virus. |
| Describe botnets. | The term botnet refers to a group of computers that have been infected by bots under the control of a person or group. |
| How is a Trojan horse different from a regular virus? | It acts as a cover or disguise for something else. It does not replicate itself, so it technically is not a virus. |
| What step is taken before an IS is connected to the AFGIG? | All ISs on the AFGIG have a baseline configuration applied to them prior to being connected to the network. |
| What does the PKI enable users of basically unsecured public networks to do? | It enables users of basically unsecured public networks, such as the Internet, to securely and privately exchange data through the use of public and private cryptographic key pairs obtained and shared through a trusted authority. |
| What are the components that compose a PKI? | (1)A certificate policy management system. (2)A RA verifies user requests for certificates and tells the CA to issue them. (3)A CA that is manages certificates. (4)One or more directories or repositories are created where the cetificates are held. |
| Describe a symmetric central server architecture. | A symmetric-cipher-based central server architecture is where each entity in the community shares a secret key with the central server (usually called a Key Distribution Center or KDC). |
| Why are PKI keys said to by asymmetric? | The key for encryption and the key for decryption were related but conspicuously different. These keys would be so different, in fact, that it would be possible to publicize one without danger of anyone being able to derive or compute the other. |
| How do digital signatures work? | A digital signature functions similar to a hand-written signature because a single entity can sign some data, but any number of entities can read the signature and verify its accuracy with the public key. |
| What do users use to verify that a particular public key belongs to a particular user? | Users can use that PKI certificate to verify that a particular public key belongs to a particular individual. |
| What is a CA responsible for? | Establishing, authenticating, maintaining, and, when needed, revoking certificates and hardware. |
| What are the two ways that key establishment can occur? | (1) By key transfer. (2) Key agreement. |
| Describe key transfer. | In key transfer, one entity generates the symmetric key and sends it to the other entity. |
| Describe key agreement. | In key agreement, both entities jointly contribute to the generation of the symmetric key. |
| How long should ECDSA and ECDH keys be to provide adequate security for the medium-tolong term? | The current state of research with respect to discrete logarithms over EC points suggests that ECDH and ECDSA keys should be at least 192 bits long to provide adequate security for the medium-to-long term. |
| What was the fundamental premise in the original formulation of public-key cryptography? | The original formulation of public-key cryptography was that two strangers should be able to communicate securely. |
| What does the PKI user population trust CA authorities to do? | To perform the function of binding a public key pair to a given identity. |
| What are the four configurations for CA servers? | (1) Enterprise root CA. (2) Enterprise subordinate CA. (3) Stand alone root CA. (4) Stand alone subordinate CA. |
| What happens when a certificate on a CRL is used? | If a certificate on the CRL is used for any reason, it will be rejected. |
| Describe a “user’s key history.” | This collection of certificates and corresponding private keys is known as the user’s key history. |
| What is the difference between a software token and a hardware token? | The hardware token has built in security of some sort, such as a code or password that must be entered to use the certificates and keys; a software token has no security other then what is provided by the host system. |
| List the three types of certificates and what they are used for. | (1) Identity—Used for digital signature and authentication functions. (2) E-mail signing—Used to sign e-mail. This supports non-repudiation. (3) Encryption—To support data confidentiality. |
| What does the global directory service provide for? | The ability to search for individuals, access information about them such as what their work phone number is or what their e-mail address is. It also contains the public key encipherment certificates. |
| What does middleware allow the use of? | In the case of PKI, middleware refers to the software that resides on the users system that allows the use of the CAC and the certificates contained on the CAC. |
| What does combat-ready communications and information forces provide? | The first-in and sustaining capabilities to support peacetime through combat operations worldwide. |
| Who plans, engineers, deploys, and employs support for all air and space forces? | Communications and information professionals. |
| What will disappear as personnel become adept in the standardized expeditionary C&I skill sets needed to support Expeditionary Air and Space Forces throughout the entire predeployment/deployment cycle? | The dividing line between “fixed” and “tactical” C |
| Why do we have quicker response times, an efficient use of resources, and more effective training than previous Air and Space Expeditionary Force deployments? | Versatility and flexibility of certain systems utilized during both initial and sustained deployments. |
| Initial communications support is a major player in what area? | They provide the communicating link between forces securing the area and setting up support facilities as well as providing messaging capabilities back to the garrison units. |
| Within what time frames are initial communications support designed to provide basic communications to a bare base operation? | Within 24 to 72 hours of deployment notification and remain in place for up to 30 days. |
| What are the three major components in the TDC program and what does it provide? | (1) The LMST. Provides easily deployable, long haul communications. (2) The ICAP. Provides switched voice and data traffic. (3) The NCC-D. Provides radio, voice, record, and data communications; visual information services; and information protections. |
| What is the mission of the sustained communications support teams? | To ensure AEF and AEW commanders have connectivity and an uninterrupted flow of mission critical information to field units, in-garrison units, and to command structures for the duration of the contingency. |
| What program is a state-of-the-art ground communications infrastructure that is designed to replace existing older communication systems? | TDC program. |
| Is TDC-ICAP used in initial communications support or sustained communications support? | Both. |
| What is the TDC-ICAP network designed to provide and to what network area? | The TDC-ICAP network is a scalable network providing telephone, data, and switched message service to customers at various locations within a metropolitan area. |
| What concept allows planners to scale the network to meet the needs of deployments ranging from a few subscribers to a full wing, or even a Joint Air Force Command Component? | Building block concept. |
| What is the conduit that ties all the LANs together and provides the interface to other networks? | The base hub (MAN) is the conduit that ties all the LANs together and provides the interface to other networks. |
| Which phase of the deployment cycle is all the preparation done? | The pre-deployment phase. |
| What order indicates that your unit may deploy? | Warning order. |
| Which phase in the deployment cycle do you enter after disembarking from your transportation? | Establish services. |
| In which phase of the deployment cycle do you replace and or repair worn equipment and replenish supplies? | Reconstitution. |
Created by:
3D0X2
Popular Military sets