- Welcome to lesson 11, deep dive quiz.
Now, lesson 11 was all about given a scenario,
apply security principles to secure the enterprise.
And we talked about a wide range of topics here.
We started with lesson 11.1,
just understanding network devices and how they operate.
Then in 11.2, we did network access control
and looked at a whole array of devices, IPSs
and jump servers and proxy servers and DLPs and NACs.
In 11.3, we focused in specifically on firewalls
and different types and generations of firewalls
as well as how we configure them, how we plan for them
and looking at access control lists.
And then in 11.4, we looked at secure communications.
We looked at SSL and TLS and IPSec VPNs
and then just some different ancillary overlays
of how we could really secure communications in our network,
in our enterprise, and even in our cloud environment.
So that brings us to five questions in this deep dive quiz.
Great time to have a pen or a pencil, piece of paper.
Put me on pause as often as you need to.
I really want you answering these questions.
And then when you're ready, take me off pause
and we'll go through the answers together.
So let's get started.
This tool is used to govern connections
to the network based on pre and post admission policies.
Is this a NAC, an IDS/IPS, a DLP or an EDR?
Now you will see acronyms on this exam, so be prepared.
NAC, IDS/IPS, DLP or an EDR?
What are you gonna choose?
I'm gonna choose NAC which actually stands
for network access control.
Network Access control is what we use
to govern connections to the network, right?
Based on those pre and post admission policies,
you go to connect your device to the network.
The NAC says, okay, I have to evaluate your device.
Not evaluating you, right?
Evaluating your device for things like
do you have the right antivirus?
Are you patched and up to date?
What operating system are you running?
Do you have a local firewall, you know, running?
Whatever it is that are in the policies.
And then based on that, you're either allowed
to continue in and the post admission policies will apply
or you're maybe sent to a quarantine network
or a remediation segment
or just not even allowed on the network.
So I'm going with NAC, do you like it?
Yeah, let's double check and it's correct.
All right, you receive a vulnerability assessment report,
and much to your surprise and dismay, there appear
to be several missing critical security patches.
Upon further investigation, it was determined
that the patches were installed
as part of a cumulative update.
How would you classify the original report findings?
A false positive, a false negative,
a true negative or a true positive?
So you get this report, you're like, wow,
there's all these missing patches
but then you investigate it.
It's like, no, no, no, they're all there.
They just, they were part of a cumulative update.
So the vulnerability scanner didn't see it correctly.
Just a false positive, false negative,
true negative or true positive.
Go ahead and make your choice.
Well, this is going to be a false positive.
A false positive as in everything's okay
but the system's coming back and saying, nope,
there's something wrong.
It's aggravating, it's time consuming, right?
You have to like be chasing it down to try to figure it out.
And maybe there's even a little panic
that sets in for a while, but really everything's okay.
A false negative is a really dangerous state.
A fault negative is when there really is a problem
but the system doesn't report it as such.
It says, oh, everything's really fine.
So that's really dangerous.
A true negative is when abnormal or unexpected
events or activities are correctly identified.
A true positive is when your expected
or normal activities or events are correctly identified.
So both true, negative and true positive,
correctly identified, false negative
and false positive are incorrectly identified.
And in this case, we're looking at a false positive.
Agree?
Let's check and that's correct.
All right, question three.
The firewall rule Deny any any any any should be where
in the rule set sequence?
At the end, before the allow statements, at the beginning
or it doesn't matter where.
Okay, so what was the really important thing
I said you needed to remember about a firewall rule?
How are those rules processed?
Well, they processed, remember, from top to bottom.
So as soon as it got to that rule, deny any any any,
right, at that point, it's gonna deny any port,
any protocol, any destination IP and any source IP.
So at the end's a good place for it.
But if you put it before the allow statements,
all those allow statements will be irrelevant.
They'll never be read.
If we put it the very beginning
everything past that won't matter
because we've already said deny everything.
All ports, all protocols, all destination IPs,
all source IPs.
And doesn't matter where.
Well, no, it really does matter where, again,
because once that rule is read,
anything after that is gonna be absolutely irrelevant.
So we're gonna put it at the end.
You like that?
I'll double check and that's correct.
All right, question four.
I want you to identify the two IPsec configuration modes.
Tunnel mode, transmission mode, transport mode, or TLS.
I guess we're doing some alliteration
here with Ts.
Tunnel, transmission, transport or TLS.
These are the two IP set configuration modes.
Okay, make that choice.
I am gonna choose tunnel mode
which is the default mode where the entire packet
is encapsulated in another packet with a new header added
and transport mode where the payload is going to
be encapsulated, but the header is still exposed.
Transmission mode is really just a made up term
and TLS isn't relevant here.
So I'm going with tunnel and transport.
How about you?
Let's check and that is correct.
All right, our last question.
These are going to be true or false.
So let's read all these questions first.
SSL establishes a secure channel by negotiation.
True or false?
In 2015, SSL version 3.0 was determined to be broken.
True or false?
TLS uses a well-known port 43.
True or false?
TLS establishes a secure channel by negotiation.
True or false?
TLS 1.0 and 1.1 have officially been declared deprecated.
True or false?
And TLS can be used to secure browser-based VPNs.
True or false?
All right, great time to put me on pause
and go through each of these and decide
if they are true or false.
All right, let's answer each one.
SSL establishes a secure channel by negotiation.
That is true.
In 2015, SSL 3.0 was determined to be broken.
That's gonna be false.
It hasn't been broken.
It has been what?
Deprecated, so found to be weak, not found to be broken.
You shouldn't be using it
but it has not been officially designated as broken.
It's still been being designated as deprecated.
TLS uses well known port 43.
It's a lot about reading for comprehension here.
It's not 43.
What port does both TLS and SSL use?
443.
So that's gonna be false.
TLS establishes a secure channel by negotiation.
Is that true or false?
No, that's gonna be false
because it's by a cryptographic exchange.
So there's false.
TLS 1.0 and 1.1 have officially been declared
deprecated, true or false?
That one is true.
And TLS can be used to secure browser-based VPNs,
true or false?
And that is also going to be true.
So SSL establishes a secure connection by negotiation.
True.
In 2015, SSL 3.0 was determined to be broken?
False because it's deprecated.
TLS uses well-known port 43?
False 'cause it's 443.
TLS establishes secure channel by negotiation.
False 'cause they do a cryptographic exchange.
TLS 1.0 and 1.1 have officially been declared deprecated.
That is true.
And TLS can be used to secure browser-based VPNs
and that is true.
Let's double check.
Do you agree?
Let's see how we do and those are all correct.
Awesome.
All right, congratulations.
You did great again, I'm sure.
I'm going through a lot of information here,
but stick with us.
You know, we're not even quite halfway through this course.
We're at lesson 12, we have 29 lessons.
Just keep on going.
Lesson 12 is gonna be all about compare
and contrast concepts and strategies to protect data.
I'll see you there.