- Welcome to Lesson 18, Deep Dive Quiz.
Now, in Lesson 18, it was all about given a scenario,
modify enterprise capabilities to enhance security.
In 18.1, we talked about enhancing security
with network devices,
something already studied and some new ones.
In 18.2, we talked about TCP/IP, both IP version four,
and IP version six, as well as the use of secure protocols.
In 18.3, we looked at email security
primarily from the server side.
And then in 18.4, I introduced you to a group policy,
part of Microsoft's Active Directory and SELinux.
So you're ready to do a 10 question quiz?
All right, make sure you've got a pen
or a pencil and a piece of paper.
You're gonna put me on pause
as often as you need to to answer these questions.
All right, let's get started.
You've been asked to research tools that will continuously
monitor activity across the enterprise, network traffic,
cloud workloads, email,
and other relevant security data sources
for security threats.
Which type of tool is going to fit this requirement?
XDR, EDR, FIM, or IPS?
And we do need to know acronyms for the exam.
So XDR, EDR, FIM, or IPS.
Put me on pause if you need to.
I am gonna choose XDR, right?
Because XDR is going to be the tool
that I can use that is going to continuously
monitor activity across my whole enterprise, right,
network, cloud, email, and really,
anything else that I tune it to.
Remember, EDR is going to just be looking
at the the endpoint devices.
FIM was File Integrity Monitoring
and IPS, our intrusion prevention system.
Well, it's really just looking at network traffic.
So I like XDR, how about you?
Let's check.
And that is correct.
Question two.
Your organization has decided to implement web filtering.
There's a specific concern
about access to and downloading of images.
Which filtering approach would address this issue?
URL filtering, allow and block lists,
content analysis or category filtering?
Okay, so what are we looking at here?
We're concerned about access to and downloading of images.
So which one of these types
of filtering is going to also be able to look
at images for us?
URL, allow and block lists, content, or category?
Well, URL filtering is just gonna filter by URLs, right?
A list of URLs.
It really won't know what the images are.
Allow and block list is just lists that we've set up.
These are the sites that are allowed,
these are the sites that are blocked.
Category filtering is going to look
at categories of information.
Maybe it's adult content, maybe it's violence,
maybe it's guns, maybe it's shopping, right?
It doesn't have to be negative.
It could be neutral or positive.
Content analysis, this is the one I'm gonna choose,
because content analysis can look
at the content of what's on that page, including images,
so I'm gonna choose content analysis.
Do you agree? You like it?
All right, well, check it out and that's correct.
All right, question four.
And it looks like we are going to do a matching here
and we're matching the secure protocol with their function.
Down the left hand side, we have DNSSec, HTTPS,
TLS, and SRTP.
On the right side, we have enhanced security
for VoIP, audio and video transmission,
digitally-signed zone files.
Establish a secure communication channel
between two TCP sessions,
or encrypt sessions between a browser and a website.
So where do we wanna start this time?
I guess we'll start on the right hand side again.
We wanna look for what matches enhanced security
for VoIP, audio, and video transmission.
Oh, if I look down that list, I like SRTP.
Next is we're going to use this to encrypt the session
between a browser and a website.
Oh, you use this one all the time.
What is this?
That's gonna be HTTPS, digitally signed-zone files?
Remember, zone files are our DNS files,
so that must be right here.
DNSSec.
And lastly, establish a secure communication channel
between two TCP sessions.
That sounds a lot like what TLS does.
So DNSSec, digitally-signed zone files,
HTTP, encrypt session between a browser and a website,
TLS, establish a secure communication channel
between two TCP sessions,
and SRTP to enhance security for VoIP.
That's voice over IP.
Audio and video transmissions.
You like it?
You agree?
We'll check and that is correct.
All right, this one is a secure replacement
for Telnet Terminal Emulation.
There's this remote desktop software.
Sometimes you'll see that as RDP,
a virtual private network,
VPN, secure socket layer, SSL, or secure shell, SSH.
Now, I'm giving you the acronyms.
You may not be getting both
in your question, but you need to know both, right?
Always know the acronym and what it actually is.
So what's our secure replacement
for Telnet Terminal Emulation?
Remote desktop.
Virtual Private network.
Secure socket layer, or secure shell?
Are you ready?
It's gonna be secure shell for sure.
All right, Telnet, why don't we wanna use Telnet?
Because it's a clear text protocol
with very basic authentication, username and password.
So secure shell or SSH is our secure replacement,
our cryptographic replacement for Telnet.
Let's check it.
And that is correct.
Blank best describes the use
of the IP protocol to transmit a variety of formats,
including voice, data, multimedia, television, and music.
Is this IP extensibility,
an open standard, unified communications, or IP convergence?
So which of these terms best describes the use
of the IP protocol to transmit a whole variety of formats,
right, voice, data, multimedia, television and music.
Put me on pause if you need to.
Well, let's go through our list.
IP extensibility.
That's when we can extend or modify functionality
without really changing the underlying basis.
An open standard is a standard
that can be freely adopted and modified.
Unified communications, which refers to having
a unity of communication devices, right,
in our VoIP environment.
IP convergence, that's the one we're gonna like.
IP convergence is when we use IP,
we converge all of these different formats.
Instead of using, you know, different types of protocols,
we're going to use IP as our standard protocol.
So IP convergence is what I'm gonna choose.
You good?
Let's check and that's correct.
All right, we are gonna drag and drop
some words here and I'm gonna read it
to you first so you can figure out
where we even need to start.
A blank address is made up of blank
divided into blank blank,
converted into hexadecimal numbers and separated by blank.
Wow, that's a lot of blanks.
So below, we've got IP four, IP six, periods,
colons, four, 128, 16-bit blocks,
32 bit, eight-it blocks, eight digit, eight and comma.
So where are you gonna start?
Well, we know this must be either
IP four or IP six 'cause they're both there, right?
We're gonna assume it's one of them.
Is there any word there that's gonna help us
know whether it's IP four or IP six?
Can you find one?
Yeah, the fact that it's hexadecimal,
we must be talking about IP six.
So now that you know that,
go ahead and put me on pause
and see if you can come up with the rest of these answers.
All right, so we have an IP six address,
is made up of, it's going to be our,
if I'm doing this right,
16-bit blocks divided into, oh no, sorry,
it's not gonna be 16 bit blocks.
That's not what we're looking for.
It's really made up of 128 bits, right?
IP version six is made up
up of 128 bits divided into, how about eight?
Oops, nope, we don't want 8-bit blocks.
How about eight 16 bit blocks,
converted into hexadecimal numbers and separated by colons.
How's that look?
Took a little bit of doing there, right?
An IP six address is made up of 128 bits
divided into eight 16 bit blocks,
eight times 16, and converted
into hexadecimal numbers and separated by a colon.
Do you like that one?
Let's check.
And that is correct.
This was a tough one
because you really had to just try to figure out
what were you even talking about.
And so you wanna be looking for those keywords
and as soon as you saw hexadecimal,
that should have said, oh,
we must be talking about IP version six, not version four.
And right up in the top, it said drag and drop the words
to describe an IP address.
So we had to figure out IP four or IP six.
All right, let's continue on.
Which object is a GPO
not explicitly associated with?
An organizational unit, a domain, a user, or a site.
Now, if you're not familiar with the Windows environment,
and we did this one really quickly with Active Directory,
this may be a more challenging one,
but which object is a GPO, group policy object,
not explicitly associated with?
An OU, an organizational unit, a domain, a user, or a site.
Put me on pause if you need to.
The answer is going to be user.
A GPO can be explicitly associated with
an OU, an organizational unit
with a domain, as well as with a site.
But we don't usually have a GPO
explicitly associated with a user.
Let's check.
And that's correct.
Your organization is enhancing their email security.
For assurance purposes,
they'd like to receive feedback including details
about successful and failed authentication checks.
What components need to be installed?
S/MIME, an SPF policy, DKIM and SPF,
or DMARC and SPF and/or DKIM?
What do you think?
You're welcome to put me on pause
while you read through that again
and think through your answers.
Well, if they're going to get feedback,
they're going to need DMARC.
But you can't just have DMARC.
You have to have DMARC and either SPF or DKIM.
So the only way to get feedback, right, is to have our DMARC
and then have it with either SPF or DKIM or both.
So I'm gonna choose that one.
Do you like it?
Let's check.
And that's correct.
All right, next question.
Your organization has adopted a new email policy
that states all email classified
as protected must be encrypted
and can only be decrypted by the intended recipient.
So which implementation approach is required?
End-to-end encryption, homomorphic encryption,
TLS encryption, or server-to-server encryption?
So tell me which approach.
The email policy says all email classified
as protected must be encrypted
and only decrypted by the intended recipient.
What implementation approach are we gonna use?
End-to-end, homomorphic, TLS, and server-to-server.
Go ahead, make that choice.
What do you think?
Now, it's gotta go from the sender
all the way to the recipient, right,
from one end to the other, right?
Not just server to server, right, from one end to the other.
So what are we gonna choose?
End-to-end encryption, right?
Let's go to our next question.
Oh, another matching.
This one, we're gonna match the following items
with their descriptions.
We have a Linux account, processes and resources,
a common Linux policy, and SELinux user,
and a default Linux mode.
So let's see if we can match those items
with the descriptions.
Down the right hand side,
we have enforcing, type, role, user, and targeted.
So starting let's say on the left hand side, this time,
just a Linux account enforcing type, role, user, targeted.
I like user.
Processes and resources.
What do we call those in our SELinux environment?
That's gonna be a type.
A common Linux policy.
We have role, enforcing, or targeted.
I think what we're probably looking
for here is going to be targeted
which says that we're not going to try to do SELinux
for everything, for all processes and resources, right,
we're going to target specific ones.
The SELinux user, that's a role.
And the default SELinux mode.
Well, when we put it on, that's gonna be enforcing.
So Linux account, user, processes and resources,
type, common Linux policy, targeted, an SELinux user
is a role and a default SELinux mode, enforcing.
Hope you put me on pause so you could start doing that.
Or maybe you just did it with me
as we kind of worked through it.
You agree?
Let's check it out, and that is correct.
Awesome, another great job.
All right, up next, we're gonna have Lesson 19,
Given a Scenario, Implement and Maintain
Identity and Access Management.
I'll see you there.