AP®︎ Cybersecurity: Unit 3 Flashcards

A local-network protocol that associates IP addresses with MAC addresses in an ARP table

An ARP table maps IP addresses to MAC addresses, while a switch MAC address table maps MAC addresses to physical switch ports

Sending falsified ARP packets that link a target’s IP address to the adversary’s MAC address, redirecting the target’s traffic to the adversary

Faking the MAC address presented by a device, often to impersonate another device or a trusted identity

Secretly intercepting communication between two parties and copying or altering it before forwarding it, while both parties believe they communicate directly

Overwhelming a switch’s MAC address table with frames from many apparent MAC addresses, forcing frames to be broadcast and exposed for capture

Capturing, recording, or copying data in transit without authorization, without necessarily altering it

A distributed naming system that translates human-readable domain names into IP addresses and other network records

Planting a false DNS record that maps a legitimate domain to an adversary-controlled IP address and redirects users to the wrong host

Using a fake login site that imitates a real one to capture users’ genuine credentials

A network-layer protocol used by devices to send error reports and diagnostic messages such as ping replies

A DoS attack that sends ICMP requests with the victim’s spoofed source address to a broadcast address, causing many devices to flood the victim with replies

An attack that makes a system, service, or resource unavailable to authorized users

A DoS attack in which multiple devices attack the same target simultaneously

Gathering information about a network’s internal addresses, devices, services, and connections to identify targets for later attacks

Using access to one compromised device or system to reach and compromise additional devices, accounts, or resources on the network

A switch control that restricts the devices or number of MAC addresses permitted through a physical port, helping prevent unauthorized access and MAC flooding

A frame broadcast by a wireless access point that announces network information such as its SSID and wireless security or encryption protocols

An unauthorized wireless access point connected to an internal network port, creating a wireless path into the LAN that may bypass boundary firewalls

The three core security goals of confidentiality, integrity, and availability

A tool that checks networks, devices, and applications for known vulnerabilities and reports findings, severity, evidence, and recommended mitigations

High risk combines high likelihood and impact, moderate risk presents an intermediate threat, and low risk is difficult to exploit or likely to cause minimal harm

A policy setting the minimum router configuration, such as centralized login, disabled unnecessary services, and an approved firewall

A policy setting the minimum switch configuration, commonly including centralized administrator authentication, port security, and MAC filtering

A policy specifying who may use a VPN, required authentication methods such as keys or MFA, and whether split tunneling is prohibited

Sending some traffic through a VPN while other traffic goes directly to another network; policies may prohibit it to prevent simultaneous trusted and untrusted connections and force traffic through organizational controls

A policy setting minimum wireless authentication, encryption, and beacon-broadcasting requirements

A framework supporting network-access authentication methods, commonly linking wireless infrastructure to an approved authentication server

The name that identifies a wireless network to devices seeking to connect

WEP and original WPA are obsolete wireless security protocols with known vulnerabilities, while WPS is a vulnerable simplified joining mechanism that should be disabled

The strongest current wireless security protocol covered by the course and the preferred choice for protected wireless networks

Permitting or denying network access according to listed MAC addresses; it is supplementary because MAC addresses can be spoofed

Dividing a network into smaller, isolated segments or subnets to contain compromises, isolate traffic, and apply different security controls

A typically lower-security segment between a public network and a private internal network that usually holds public-facing resources behind firewall-controlled boundaries

Dividing an IP network into smaller subnets based on IP addressing so intersubnet traffic must be routed and can be controlled

A logical network segment created by switches that separates devices using shared physical switching infrastructure

A higher-security zone has more restrictive controls for sensitive or critical systems; a lower-security zone is less trusted and accepts greater exposure but remains protected

Software that applies configured rules to permit or deny network traffic crossing a network or segment boundary

A firewall that evaluates each packet independently using header information such as IP addresses, ports, and protocol, without tracking connections

A firewall that filters packet headers and tracks connection state, allowing it to distinguish expected connection traffic from unrelated traffic

A firewall combining stateless and stateful filtering with advanced features such as deep packet inspection, intrusion prevention, and application filtering

An ordered set of firewall rules specifying which inbound or outbound traffic to permit or deny based on criteria such as addresses, ports, protocols, services, or applications

ACL rules are evaluated from top to bottom, and the first matching rule is executed while all later rules are ignored for that traffic

Identify the boundary, direction, source, destination, protocol, port, service or application, allow-or-deny action, and position relative to broader or overlapping rules

Place firewall controls at every internet ingress and egress point and at each network-segment boundary, using policies appropriate to each segment

Inbound traffic enters the segment or zone named by a rule; outbound traffic leaves it, so direction is relative to the protected boundary

Secure Shell is an encrypted protocol for remote command-line access and administration that normally uses TCP port 22

Hypertext Transfer Protocol transfers unencrypted web requests and responses and normally uses TCP port 80

A time-ordered record of events that may include timestamps, addresses, ports, protocols, traffic amounts, actions, and alerts

An automated tool that analyzes network data for malicious activity and generates an alert when its detection criteria are met

A tool that detects malicious network activity and can halt or mitigate it by blocking addresses, closing ports, rejecting protocols, or interrupting traffic

A system that collects and correlates security data from multiple sources to detect suspicious patterns and raise alerts for investigation

Using AI algorithms to analyze large data sets, classify patterns as malicious or normal, and report probabilistic threat likelihoods

The threat-likelihood percentage at which a system generates an alert; lower thresholds create more alerts and false positives, while higher thresholds risk missed attacks

Detection that quickly compares observed data with stored signatures of known IoCs; it suits high traffic but requires updates and cannot detect attacks without signatures

A stored pattern or characteristic associated with a known threat or indicator of compromise

Evidence suggesting that a system or network may have been attacked or compromised

Detection that compares activity with a clean baseline and alerts on deviations beyond a tolerance range; it can find novel attacks but costs more and produces more false positives

A record of normal activity or configuration used as a standard for identifying unusual deviations

Detection combining signature-based and anomaly-based methods for known and novel threats, with greater cost and alert volume

Legitimate or nonmalicious activity incorrectly classified as malicious, wasting investigative resources and potentially contributing to alert fatigue

A condition in which responders become accustomed to false alerts and take new alerts less seriously

Malicious activity that bypasses detection without an appropriate alert or action, allowing the attack to continue

An attack using a malicious wireless access point that imitates a legitimate network to lure users into connecting and expose their traffic or credentials

Locating a wireless transmitter by comparing signal-strength measurements from multiple physical positions

Transmitting radio interference that disrupts wireless signals and prevents legitimate devices from communicating

Unwanted electromagnetic energy that interferes with wireless signals and can cause weak, unreliable, or failed connections

Evidence of possible malicious activity found in network traffic, logs, or packet captures, such as malicious IP connections, scans, traffic changes, or port-application mismatches

A record of packets observed at a monitoring point, used to examine addresses, ports, protocols, and traffic patterns