Compare Network IDS (NIDS) and Network IPS (NIPS) in terms of physical/logical topology, failure modes, and response capabilities.

NIDS is deployed out-of-band (connected to a switch SPAN/mirror port or network TAP); it passively analyzes copies of traffic to raise alerts and send TCP RSTs, but cannot block the initial malicious packet. NIPS is deployed inline in the active data path; it drops malicious packets in real time and supports Fail-Open (pass traffic if appliance crashes for availability) or Fail-Closed (block all traffic for strict security).

Trace the evolution of Wi-Fi security from WEP to WPA, WPA2, and WPA3, including encryption algorithms.

WEP (Deprecated): 24-bit cleartext IV + RC4 stream cipher + CRC-32; IV collisions allow full key recovery in minutes. WPA (Deprecated): Interim fix using TKIP (128-bit per-packet key mixing + MIC) over RC4. WPA2 (IEEE 802.11i): Mandatory AES-CCMP (Counter Mode with CBC-MAC) 128-bit block encryption. WPA3: Replaces PSK with SAE (Simultaneous Authentication of Equals), enforces Protected Management Frames (802.11w), and offers 192-bit CNSA suite in Enterprise mode.

Compare IPsec VPNs and TLS/SSL VPNs (and WireGuard), and define Split Tunneling vs Full Tunneling.

IPsec operates at Layer 3 (Network), connecting whole subnets (Site-to-Site) or requiring OS kernel VPN clients. TLS VPNs operate at Layer 4–7 (e.g., OpenVPN or clientless browser portals). WireGuard is a modern, minimal Layer 3 VPN using fixed cryptography (`ChaCha20-Poly1305`, `Curve25519`, `BLAKE2s`). Full Tunneling routes ALL client internet and corporate traffic through the VPN concentrator; Split Tunneling routes only corporate subnet traffic over the VPN while local internet traffic exits directly (faster, higher risk).

What are the security risks of IPv6 (SLAAC Rogue Router Advertisements, NDP Spoofing, Dual-Stack tunneling) and how does RA Guard mitigate them?

IPv6 replaces ARP with ICMPv6 Neighbor Discovery Protocol (NDP) and supports Stateless Address Autoconfiguration (SLAAC) via Router Advertisements (RAs). An attacker on the link can send spoofed ICMPv6 Router Advertisements to become the default IPv6 gateway (even on networks that think they only use IPv4, since modern OSes prefer IPv6 by default). IPv6 RA Guard and SEND (Secure Neighbor Discovery) block unauthorized RAs on access switch ports.

Compare Forward Proxy, Reverse Proxy, and Open Mail Relay / SMTP security controls (SPF, DKIM, DMARC).

Forward Proxy: Sits in front of internal clients to filter outbound web requests, cache content, and hide client IPs. Reverse Proxy: Sits in front of backend servers to terminate TLS, load-balance, and hide server IPs. Email security: SPF (`TXT` record listing IPs authorized to send mail for a domain); DKIM (cryptographically signs email headers/body with domain private key, verified via `TXT` public key); DMARC (`TXT` policy telling receivers to `none`, `quarantine`, or `reject` emails failing SPF/DKIM alignment).

Why was the WPA2-PSK 4-Way Handshake vulnerable to offline dictionary cracking and the KRACK attack, and how does WPA3-SAE (Dragonfly) fix it?

In WPA2-PSK, an attacker sending deauthentication frames captures a single 4-Way Handshake (`ANonce`, `SNonce`, `MIC`) and runs offline GPU dictionary attacks against the static Pre-Shared Key (and KRACK forced nonce reuse by blocking message 4). WPA3-Personal replaces PSK with SAE (Dragonfly handshake), an authenticated Diffie-Hellman exchange requiring active interaction for every password guess, defeating offline dictionary cracking and providing Forward Secrecy.

Classify DDoS attacks into Volumetric, Protocol (State-Exhaustion), and Application-Layer (Layer 7) categories, with examples and mitigations.

Volumetric (Gbps/Tbps bandwidth saturation): DNS/NTP/Memcached UDP amplification & reflection (mitigated by upstream BGP Anycast scrubbing and BCP 38 egress source IP filtering). Protocol (pps state exhaustion): TCP SYN Floods filling firewall/server connection tables, Smurf ICMP, Ping of Death (mitigated by SYN Cookies). Application Layer (RPS): Slowloris, HTTP GET/POST floods targeting expensive DB queries (mitigated by WAF rate limiting, bot challenges, CDN caching).

Compare Stateless Packet Filtering, Stateful Inspection, Next-Generation Firewalls (NGFW), and Web Application Firewalls (WAF).

Stateless (Layer 3/4 ACL): Evaluates each packet in isolation against static IP/port rules without tracking connection state. Stateful (Layer 3/4): Maintains a state table tracking active TCP handshakes (`SYN`, `ESTABLISHED`) and automatically permits return traffic. NGFW (Layer 3–7): Adds Deep Packet Inspection (DPI), Application awareness, user identity (AD integration), and inline IPS. WAF (Layer 7): Inspects HTTP/HTTPS traffic to block SQLi, XSS, CSRF, and OWASP Top 10 attacks.

How does a MAC Flooding (CAM Table Overflow) attack work, and how does Switch Port Security mitigate it?

A switch stores learned MAC-to-port mappings in fixed-size Content Addressable Memory (CAM). Flooding a port with thousands of frames containing bogus source MAC addresses fills the CAM table, causing some switches to fail open and broadcast unknown unicast frames out all ports like a Layer 1 hub. Port Security (`switchport port-security`) limits the maximum number of MACs per port (or binds sticky MACs) and enforces `Protect`, `Restrict`, or `Shutdown` (err-disable) violations.

Compare Jump Servers (Bastion Hosts) and Air-Gapped / Data Diode networks in ICS/SCADA (OT) environments.

A Bastion Host / Jump Box is a heavily hardened, MFA-protected, session-recorded server providing the sole administrative entry point into a secure management enclave. In Operational Technology (OT / ICS / SCADA, Purdue Model), critical safety networks use Air Gaps (physical isolation) or Optical Data Diodes (unidirectional fiber hardware with a transmit LED on one side and a photoreceiver on the other) so telemetry can flow out to IT without any physical path for attacks to flow in.

Compare IPsec Transport Mode and IPsec Tunnel Mode.

Transport Mode encrypts/authenticates ONLY the IP payload (TCP/UDP segment + data) while preserving the original IP header; it is used for end-to-end host-to-host communication or encapsulating GRE tunnels (`GRE over IPsec`). Tunnel Mode encrypts the ENTIRE original IP packet (header + payload) and encapsulates it inside a brand-new outer IP header; it is the standard for Site-to-Site and Remote Access VPN gateways.

What is a Rogue DHCP Server / DHCP Starvation attack, and how does DHCP Snooping prevent it?

In DHCP Starvation, an attacker exhausts a legitimate DHCP server's IP pool with spoofed `DHCPDISCOVER` requests, then stands up a Rogue DHCP server handing out a malicious Default Gateway and DNS server. DHCP Snooping categorizes switch ports as Trusted (uplinks to real DHCP servers) or Untrusted (access ports), immediately dropping any `DHCPOFFER` or `DHCPACK` server messages arriving on untrusted ports and building the IP-MAC binding table.

How does a TCP SYN Flood work, and how do SYN Cookies mitigate it without exhausting server memory?

In a SYN Flood, an attacker sends thousands of TCP `SYN` packets with spoofed source IPs and never completes the 3-way handshake (`SYN -> SYN/ACK -> ACK`), filling the server's half-open backlog queue. With SYN Cookies enabled, the server does not allocate a state table entry upon receiving `SYN`; instead, it encodes the connection parameters and a cryptographic hash into the initial Sequence Number of the `SYN-ACK` and only allocates memory if a valid `ACK` returns.

How does a Spanning Tree Protocol (STP) Root Bridge Manipulation attack work, and how do BPDU Guard and Root Guard stop it?

STP (IEEE 802.1D / 802.1w RSTP) prevents Layer 2 switching loops by electing a Root Bridge with the lowest Bridge ID (Priority + MAC). An attacker plugs in a rogue switch broadcasting Superior BPDUs with Priority 0 to become Root Bridge and intercept traffic. BPDU Guard immediately puts any PortFast access port into `err-disable` if it receives ANY BPDU; Root Guard blocks a port (`root-inconsistent`) if a superior BPDU arrives.

Compare Network TAPs (Test Access Points) and Switch SPAN (Switched Port Analyzer / Port Mirroring) for packet capture.

A Hardware Network TAP is a passive optical or copper inline splitter that duplicates 100% of full-duplex Layer 1/2 traffic (including malformed frames and physical errors) without dropping packets even under 100% link saturation. A Switch SPAN port copies frames in software/ASIC to a monitoring port, which is inexpensive and remotely configurable, but drops malformed frames and may drop mirrored packets when the switch backplane is congested.

Explain Nmap scan flags: `-sS` (TCP SYN Stealth), `-sT` (TCP Connect), `-sU` (UDP), `-sN/-sF/-sX` (Null/FIN/Xmas), and `-sV/-O`.

`-sS` (SYN/Half-open): Sends `SYN`; if `SYN/ACK` returns (port open), immediately sends `RST` before completing handshake. `-sT` (Connect): Completes full 3-way OS `connect()` syscall (logged by app). `-sU`: UDP scan (slow; open ports often send no response, closed ports return ICMP Port Unreachable). `-sX` (Xmas): Sets `FIN`, `PSH`, and `URG` flags. `-sV` probes open ports for service/version banners; `-O` fingerprints OS TCP/IP stack.

What is a Screened Subnet (DMZ), and how does North-South traffic differ from East-West traffic in Zero Trust Microsegmentation?

A Screened Subnet (DMZ) places public-facing servers (web, mail, reverse proxy) between an external perimeter firewall and an internal firewall (or three-legged firewall) so an external web compromise cannot directly reach internal databases. North-South traffic flows into/out of the data center perimeter; East-West traffic moves laterally between internal servers/workloads and is restricted using host-based or SDN microsegmentation.

Compare Signature-Based, Anomaly/Behavioral-Based, and Heuristic detection engines, and define False Positives vs False Negatives.

Signature-Based: Matches traffic against known exploit patterns/hashes (low false positives, blind to zero-days). Anomaly-Based: Learns a statistical baseline of normal network behavior and alerts on deviations (can catch zero-days, higher false positives if baseline is noisy). False Positive (Type I): Benign traffic flagged/blocked as malicious. False Negative (Type II): Actual malicious attack missed and allowed through (most dangerous).

What is the difference between NetFlow (IPFIX / sFlow) and Full Packet Capture (PCAP)?

NetFlow / IPFIX records only session metadata (5-tuple: source IP, destination IP, source port, destination port, protocol, plus byte/packet counts, TCP flags, and timestamps)—consuming ~1% storage for long-term traffic visibility and anomaly hunting, but containing zero payload content. Full Packet Capture (PCAP) records the entire packet header and application payload, enabling deep forensic reconstruction at high storage cost.

What are Evil Twin, Rogue Access Point, Deauthentication, and WPS (Wi-Fi Protected Setup) PIN attacks?

Rogue AP: An unauthorized AP plugged directly into a corporate wired LAN switch port. Evil Twin: An external attacker-controlled AP broadcasting the same SSID as a legitimate network to lure clients into connecting. Deauthentication Attack: Spoofing unencrypted 802.11 management deauth frames to force clients off the legitimate AP onto the Evil Twin (mitigated by 802.11w PMF). WPS Attack: Brute-forcing the 8-digit WPS PIN in only 11,000 attempts because the last digit is a checksum and the two halves are validated separately.

How does DNSSEC protect against DNS Cache Poisoning (Kaminsky attack), and what are the roles of `DNSKEY`, `RRSIG`, `DS`, and `NSEC/NSEC3` records?

DNSSEC adds cryptographic origin authentication and integrity (NOT confidentiality/encryption) to DNS responses. `DNSKEY` holds the zone's public signing keys (Zone Signing Key ZSK and Key Signing Key KSK); `RRSIG` contains the digital signature over a DNS record set; `DS` (Delegation Signer) is placed in the parent TLD zone containing a hash of the child zone's KSK to build the chain of trust to the Root; `NSEC/NSEC3` provides authenticated denial of existence.

Compare IPsec Authentication Header (AH) and Encapsulating Security Payload (ESP), including protocol numbers and NAT Traversal (NAT-T).

AH (IP Protocol 51): Provides connectionless integrity, data origin authentication, and anti-replay over the entire IP packet (including immutable outer IP header fields), but provides NO encryption (no confidentiality) and breaks across NAT because NAT alters the IP header. ESP (IP Protocol 50): Provides Confidentiality (encryption), Integrity, Authentication, and anti-replay for the payload, and works across NAT by encapsulating ESP inside UDP Port 4500 (NAT-T).

What are the default TCP/UDP port numbers for Kerberos, POP3/POP3S, IMAP/IMAPS, SNMP, LDAP/LDAPS, SMB, Syslog, RADIUS, and RDP?

Kerberos: TCP/UDP 88; POP3: TCP 110 / POP3S: TCP 995; IMAP: TCP 143 / IMAPS: TCP 993; SNMP: UDP 161 (Agent queries) & UDP 162 (Manager traps); LDAP: TCP/UDP 389 / LDAPS: TCP 636; SMB/CIFS: TCP 445; Syslog: UDP 514 / Syslog-TLS: TCP 6514; RADIUS: UDP 1812 (Auth) & UDP 1813 (Accounting); RDP: TCP/UDP 3389.

How do IKEv1 (Phases 1 and 2, Main vs Aggressive Mode) and IKEv2 (UDP Ports 500 and 4500) negotiate an IPsec VPN?

In IKEv1, Phase 1 authenticates peers (PSK or certificates) and performs a Diffie-Hellman exchange to build a bidirectional ISAKMP management tunnel (Main Mode uses 6 messages protecting identity; Aggressive Mode uses 3 messages exposing the PSK hash to offline cracking). Phase 2 negotiates unidirectional IPsec Security Associations (SAs) for data traffic. IKEv2 consolidates negotiation into 4 messages (`IKE_SA_INIT` and `IKE_AUTH`), adds built-in NAT-T, MOBIKE mobility, and EAP support.

What are QoS (Quality of Service), Traffic Shaping vs Policing, and CoPP (Control Plane Policing) on network infrastructure?

QoS prioritizes latency-sensitive traffic (e.g., VoIP EF DSCP 46) during congestion. Traffic Shaping buffers excess packets in a queue to smooth bursts to a target rate; Traffic Policing immediately drops (or remarks DSCP) excess packets exceeding a token-bucket rate limit. Control Plane Policing (CoPP) rate-limits packets destined for the router/switch CPU itself (SSH, BGP, OSPF, ARP, ICMP) to prevent a DoS flood from crashing the routing engine.

How does ARP Poisoning (ARP Spoofing) work at Layer 2, and how does Dynamic ARP Inspection (DAI) prevent it?

Because standard ARP is stateless and unauthenticated, an attacker on the local subnet broadcasts forged gratuitous ARP replies claiming their own MAC address owns the Default Gateway's IP, positioning themselves as a Layer 2 Man-in-the-Middle. Dynamic ARP Inspection (DAI) on managed switches intercepts all ARP packets on untrusted ports and drops any packet whose IP-to-MAC mapping does not match the trusted DHCP Snooping binding database.

Compare Honeypots, Honeynets, Honeytokens/Canary Files, and Sinkholes in network deception and defense.

Honeypot: A decoy system simulating vulnerable services (low-interaction vs high-interaction) to lure attackers, study TTPs, and trigger high-confidence alerts (since no legitimate user should ever touch it). Honeynet: A network of interconnected honeypots simulating an enterprise subnet. Honeytoken: Fake credentials, API keys, or database records planted to alert immediately when accessed. DNS Sinkhole: Redirects outbound traffic destined for known malware C2 domains to an internal analysis server.

What is BGP Hijacking (Prefix Hijacking), and how do RPKI (Resource Public Key Infrastructure) and Route Filtering prevent it?

BGP (Border Gateway Protocol, TCP Port 179) Originally relied on implicit trust between Autonomous Systems (AS). In BGP Hijacking, a malicious or misconfigured AS announces unauthorized ownership of an IP prefix (or a more specific `/24` prefix), diverting global internet traffic. RPKI uses cryptographically signed Route Origin Authorizations (ROAs) to verify that an AS is legitimately authorized by the RIR to originate a given IP prefix.

What are the default TCP/UDP port numbers for SSH, Telnet, SMTP (Relay vs Submission), DNS, DHCP, HTTP, and HTTPS?

SSH ( plus SFTP/SCP): TCP 22; Telnet: TCP 23 (unencrypted); SMTP: TCP 25 (server-to-server relay), TCP 587 (STARTTLS client submission), TCP 465 (SMTPS); DNS: UDP/TCP 53 (UDP for standard queries, TCP for zone transfers AXFR/IXFR and responses >512 bytes); DHCP: UDP 67 (Server) & UDP 68 (Client); HTTP: TCP 80; HTTPS: TCP 443 (TCP/UDP 443 for HTTP/3 QUIC).

How do 802.1Q VLANs, Trunk Ports vs Access Ports, and VLAN Hopping attacks (Switch Spoofing & Double Tagging) work?

IEEE 802.1Q inserts a 4-byte VLAN tag into Ethernet frames to logically segment broadcast domains acrossTrunk Ports (which carry multiple VLANs), while Access Ports carry a single VLAN. Switch Spoofing exploits Cisco Dynamic Trunking Protocol (DTP) to negotiate a trunk; Double Tagging prepends two 802.1Q tags when the attacker's VLAN matches the trunk Native VLAN. Mitigation: Disable DTP (`switchport mode access`, `switchport nonegotiate`) and change the Native VLAN to an unused ID.

Compare DNS over HTTPS (DoH), DNS over TLS (DoT), and traditional DNS over UDP/53.

Traditional DNS sends queries in cleartext over UDP/TCP port 53, exposing browsing history to ISPs and on-path eavesdroppers. DoT (RFC 7858) wraps DNS queries inside a dedicated TLS session on TCP port 853 (easily identifiable and filterable by enterprise network admins). DoH (RFC 8484) encapsulates DNS queries inside standard HTTPS traffic on TCP port 443, blending DNS with normal web traffic (harder to block at the port level).

Compare Load Balancing algorithms (Round Robin, Least Connections, IP Hash) and explain TLS Termination vs TLS Passthrough at the Load Balancer.

Round Robin distributes requests sequentially; Least Connections routes to the backend with the fewest active sessions; IP Hash / Sticky Sessions binds a client to one backend. In TLS Termination (Offloading), the load balancer decrypts HTTPS traffic at the edge (allowing Layer 7 WAF inspection and cookie insertion, optionally re-encrypting to backends). In TLS Passthrough, encrypted TCP packets pass directly to backend servers without edge decryption.

Network Security (Firewalls, IDS/IPS, VPNs, WPA3, DNSSEC & Port Numbers)

Enterprise network defense mastery: essential TCP/UDP port numbers, firewall architectures (Stateless/Stateful/NGFW/WAF), IDS/IPS detection models, VLAN segmentation, Layer 2 attacks and Cisco switch mitigations, IPsec IKEv2 VPNs, WPA3 SAE/802.1X wireless security, DNSSEC/DoH/DoT, and DDoS mitigation.

Level: intermediate
Languages: en → en
Cards: 32
Markdown: Network Security (Firewalls, IDS/IPS, VPNs, WPA3, DNSSEC & Port Numbers) (.md)

Flashcards (32)

#	Front (Term / Question)	Back (Definition / Answer)
1	Compare Network IDS (NIDS) and Network IPS (NIPS) in terms of physical/logical topology, failure modes, and response capabilities.	NIDS is deployed out-of-band (connected to a switch SPAN/mirror port or network TAP); it passively analyzes copies of traffic to raise alerts and send TCP RSTs, but cannot block the initial malicious packet. NIPS is deployed inline in the active data path; it drops malicious packets in real time and supports Fail-Open (pass traffic if appliance crashes for availability) or Fail-Closed (block all traffic for strict security).
2	Trace the evolution of Wi-Fi security from WEP to WPA, WPA2, and WPA3, including encryption algorithms.	WEP (Deprecated): 24-bit cleartext IV + RC4 stream cipher + CRC-32; IV collisions allow full key recovery in minutes. WPA (Deprecated): Interim fix using TKIP (128-bit per-packet key mixing + MIC) over RC4. WPA2 (IEEE 802.11i): Mandatory AES-CCMP (Counter Mode with CBC-MAC) 128-bit block encryption. WPA3: Replaces PSK with SAE (Simultaneous Authentication of Equals), enforces Protected Management Frames (802.11w), and offers 192-bit CNSA suite in Enterprise mode.
3	Compare IPsec VPNs and TLS/SSL VPNs (and WireGuard), and define Split Tunneling vs Full Tunneling.	IPsec operates at Layer 3 (Network), connecting whole subnets (Site-to-Site) or requiring OS kernel VPN clients. TLS VPNs operate at Layer 4–7 (e.g., OpenVPN or clientless browser portals). WireGuard is a modern, minimal Layer 3 VPN using fixed cryptography (`ChaCha20-Poly1305`, `Curve25519`, `BLAKE2s`). Full Tunneling routes ALL client internet and corporate traffic through the VPN concentrator; Split Tunneling routes only corporate subnet traffic over the VPN while local internet traffic exits directly (faster, higher risk).
4	What are the security risks of IPv6 (SLAAC Rogue Router Advertisements, NDP Spoofing, Dual-Stack tunneling) and how does RA Guard mitigate them?	IPv6 replaces ARP with ICMPv6 Neighbor Discovery Protocol (NDP) and supports Stateless Address Autoconfiguration (SLAAC) via Router Advertisements (RAs). An attacker on the link can send spoofed ICMPv6 Router Advertisements to become the default IPv6 gateway (even on networks that think they only use IPv4, since modern OSes prefer IPv6 by default). IPv6 RA Guard and SEND (Secure Neighbor Discovery) block unauthorized RAs on access switch ports.
5	Compare Forward Proxy, Reverse Proxy, and Open Mail Relay / SMTP security controls (SPF, DKIM, DMARC).	Forward Proxy: Sits in front of internal clients to filter outbound web requests, cache content, and hide client IPs. Reverse Proxy: Sits in front of backend servers to terminate TLS, load-balance, and hide server IPs. Email security: SPF (`TXT` record listing IPs authorized to send mail for a domain); DKIM (cryptographically signs email headers/body with domain private key, verified via `TXT` public key); DMARC (`TXT` policy telling receivers to `none`, `quarantine`, or `reject` emails failing SPF/DKIM alignment).
6	Why was the WPA2-PSK 4-Way Handshake vulnerable to offline dictionary cracking and the KRACK attack, and how does WPA3-SAE (Dragonfly) fix it?	In WPA2-PSK, an attacker sending deauthentication frames captures a single 4-Way Handshake (`ANonce`, `SNonce`, `MIC`) and runs offline GPU dictionary attacks against the static Pre-Shared Key (and KRACK forced nonce reuse by blocking message 4). WPA3-Personal replaces PSK with SAE (Dragonfly handshake), an authenticated Diffie-Hellman exchange requiring active interaction for every password guess, defeating offline dictionary cracking and providing Forward Secrecy.
7	Classify DDoS attacks into Volumetric, Protocol (State-Exhaustion), and Application-Layer (Layer 7) categories, with examples and mitigations.	Volumetric (Gbps/Tbps bandwidth saturation): DNS/NTP/Memcached UDP amplification & reflection (mitigated by upstream BGP Anycast scrubbing and BCP 38 egress source IP filtering). Protocol (pps state exhaustion): TCP SYN Floods filling firewall/server connection tables, Smurf ICMP, Ping of Death (mitigated by SYN Cookies). Application Layer (RPS): Slowloris, HTTP GET/POST floods targeting expensive DB queries (mitigated by WAF rate limiting, bot challenges, CDN caching).
8	Compare Stateless Packet Filtering, Stateful Inspection, Next-Generation Firewalls (NGFW), and Web Application Firewalls (WAF).	Stateless (Layer 3/4 ACL): Evaluates each packet in isolation against static IP/port rules without tracking connection state. Stateful (Layer 3/4): Maintains a state table tracking active TCP handshakes (`SYN`, `ESTABLISHED`) and automatically permits return traffic. NGFW (Layer 3–7): Adds Deep Packet Inspection (DPI), Application awareness, user identity (AD integration), and inline IPS. WAF (Layer 7): Inspects HTTP/HTTPS traffic to block SQLi, XSS, CSRF, and OWASP Top 10 attacks.
9	How does a MAC Flooding (CAM Table Overflow) attack work, and how does Switch Port Security mitigate it?	A switch stores learned MAC-to-port mappings in fixed-size Content Addressable Memory (CAM). Flooding a port with thousands of frames containing bogus source MAC addresses fills the CAM table, causing some switches to fail open and broadcast unknown unicast frames out all ports like a Layer 1 hub. Port Security (`switchport port-security`) limits the maximum number of MACs per port (or binds sticky MACs) and enforces `Protect`, `Restrict`, or `Shutdown` (err-disable) violations.
10	Compare Jump Servers (Bastion Hosts) and Air-Gapped / Data Diode networks in ICS/SCADA (OT) environments.	A Bastion Host / Jump Box is a heavily hardened, MFA-protected, session-recorded server providing the sole administrative entry point into a secure management enclave. In Operational Technology (OT / ICS / SCADA, Purdue Model), critical safety networks use Air Gaps (physical isolation) or Optical Data Diodes (unidirectional fiber hardware with a transmit LED on one side and a photoreceiver on the other) so telemetry can flow out to IT without any physical path for attacks to flow in.
11	Compare IPsec Transport Mode and IPsec Tunnel Mode.	Transport Mode encrypts/authenticates ONLY the IP payload (TCP/UDP segment + data) while preserving the original IP header; it is used for end-to-end host-to-host communication or encapsulating GRE tunnels (`GRE over IPsec`). Tunnel Mode encrypts the ENTIRE original IP packet (header + payload) and encapsulates it inside a brand-new outer IP header; it is the standard for Site-to-Site and Remote Access VPN gateways.
12	What is a Rogue DHCP Server / DHCP Starvation attack, and how does DHCP Snooping prevent it?	In DHCP Starvation, an attacker exhausts a legitimate DHCP server's IP pool with spoofed `DHCPDISCOVER` requests, then stands up a Rogue DHCP server handing out a malicious Default Gateway and DNS server. DHCP Snooping categorizes switch ports as Trusted (uplinks to real DHCP servers) or Untrusted (access ports), immediately dropping any `DHCPOFFER` or `DHCPACK` server messages arriving on untrusted ports and building the IP-MAC binding table.
13	How does a TCP SYN Flood work, and how do SYN Cookies mitigate it without exhausting server memory?	In a SYN Flood, an attacker sends thousands of TCP `SYN` packets with spoofed source IPs and never completes the 3-way handshake (`SYN -> SYN/ACK -> ACK`), filling the server's half-open backlog queue. With SYN Cookies enabled, the server does not allocate a state table entry upon receiving `SYN`; instead, it encodes the connection parameters and a cryptographic hash into the initial Sequence Number of the `SYN-ACK` and only allocates memory if a valid `ACK` returns.
14	How does a Spanning Tree Protocol (STP) Root Bridge Manipulation attack work, and how do BPDU Guard and Root Guard stop it?	STP (IEEE 802.1D / 802.1w RSTP) prevents Layer 2 switching loops by electing a Root Bridge with the lowest Bridge ID (Priority + MAC). An attacker plugs in a rogue switch broadcasting Superior BPDUs with Priority 0 to become Root Bridge and intercept traffic. BPDU Guard immediately puts any PortFast access port into `err-disable` if it receives ANY BPDU; Root Guard blocks a port (`root-inconsistent`) if a superior BPDU arrives.
15	Compare Network TAPs (Test Access Points) and Switch SPAN (Switched Port Analyzer / Port Mirroring) for packet capture.	A Hardware Network TAP is a passive optical or copper inline splitter that duplicates 100% of full-duplex Layer 1/2 traffic (including malformed frames and physical errors) without dropping packets even under 100% link saturation. A Switch SPAN port copies frames in software/ASIC to a monitoring port, which is inexpensive and remotely configurable, but drops malformed frames and may drop mirrored packets when the switch backplane is congested.
16	Explain Nmap scan flags: `-sS` (TCP SYN Stealth), `-sT` (TCP Connect), `-sU` (UDP), `-sN/-sF/-sX` (Null/FIN/Xmas), and `-sV/-O`.	`-sS` (SYN/Half-open): Sends `SYN`; if `SYN/ACK` returns (port open), immediately sends `RST` before completing handshake. `-sT` (Connect): Completes full 3-way OS `connect()` syscall (logged by app). `-sU`: UDP scan (slow; open ports often send no response, closed ports return ICMP Port Unreachable). `-sX` (Xmas): Sets `FIN`, `PSH`, and `URG` flags. `-sV` probes open ports for service/version banners; `-O` fingerprints OS TCP/IP stack.
17	What is a Screened Subnet (DMZ), and how does North-South traffic differ from East-West traffic in Zero Trust Microsegmentation?	A Screened Subnet (DMZ) places public-facing servers (web, mail, reverse proxy) between an external perimeter firewall and an internal firewall (or three-legged firewall) so an external web compromise cannot directly reach internal databases. North-South traffic flows into/out of the data center perimeter; East-West traffic moves laterally between internal servers/workloads and is restricted using host-based or SDN microsegmentation.
18	Compare Signature-Based, Anomaly/Behavioral-Based, and Heuristic detection engines, and define False Positives vs False Negatives.	Signature-Based: Matches traffic against known exploit patterns/hashes (low false positives, blind to zero-days). Anomaly-Based: Learns a statistical baseline of normal network behavior and alerts on deviations (can catch zero-days, higher false positives if baseline is noisy). False Positive (Type I): Benign traffic flagged/blocked as malicious. False Negative (Type II): Actual malicious attack missed and allowed through (most dangerous).
19	What is the difference between NetFlow (IPFIX / sFlow) and Full Packet Capture (PCAP)?	NetFlow / IPFIX records only session metadata (5-tuple: source IP, destination IP, source port, destination port, protocol, plus byte/packet counts, TCP flags, and timestamps)—consuming ~1% storage for long-term traffic visibility and anomaly hunting, but containing zero payload content. Full Packet Capture (PCAP) records the entire packet header and application payload, enabling deep forensic reconstruction at high storage cost.
20	What are Evil Twin, Rogue Access Point, Deauthentication, and WPS (Wi-Fi Protected Setup) PIN attacks?	Rogue AP: An unauthorized AP plugged directly into a corporate wired LAN switch port. Evil Twin: An external attacker-controlled AP broadcasting the same SSID as a legitimate network to lure clients into connecting. Deauthentication Attack: Spoofing unencrypted 802.11 management deauth frames to force clients off the legitimate AP onto the Evil Twin (mitigated by 802.11w PMF). WPS Attack: Brute-forcing the 8-digit WPS PIN in only 11,000 attempts because the last digit is a checksum and the two halves are validated separately.
21	How does DNSSEC protect against DNS Cache Poisoning (Kaminsky attack), and what are the roles of `DNSKEY`, `RRSIG`, `DS`, and `NSEC/NSEC3` records?	DNSSEC adds cryptographic origin authentication and integrity (NOT confidentiality/encryption) to DNS responses. `DNSKEY` holds the zone's public signing keys (Zone Signing Key ZSK and Key Signing Key KSK); `RRSIG` contains the digital signature over a DNS record set; `DS` (Delegation Signer) is placed in the parent TLD zone containing a hash of the child zone's KSK to build the chain of trust to the Root; `NSEC/NSEC3` provides authenticated denial of existence.
22	Compare IPsec Authentication Header (AH) and Encapsulating Security Payload (ESP), including protocol numbers and NAT Traversal (NAT-T).	AH (IP Protocol 51): Provides connectionless integrity, data origin authentication, and anti-replay over the entire IP packet (including immutable outer IP header fields), but provides NO encryption (no confidentiality) and breaks across NAT because NAT alters the IP header. ESP (IP Protocol 50): Provides Confidentiality (encryption), Integrity, Authentication, and anti-replay for the payload, and works across NAT by encapsulating ESP inside UDP Port 4500 (NAT-T).
23	What are the default TCP/UDP port numbers for Kerberos, POP3/POP3S, IMAP/IMAPS, SNMP, LDAP/LDAPS, SMB, Syslog, RADIUS, and RDP?	Kerberos: TCP/UDP 88; POP3: TCP 110 / POP3S: TCP 995; IMAP: TCP 143 / IMAPS: TCP 993; SNMP: UDP 161 (Agent queries) & UDP 162 (Manager traps); LDAP: TCP/UDP 389 / LDAPS: TCP 636; SMB/CIFS: TCP 445; Syslog: UDP 514 / Syslog-TLS: TCP 6514; RADIUS: UDP 1812 (Auth) & UDP 1813 (Accounting); RDP: TCP/UDP 3389.
24	How do IKEv1 (Phases 1 and 2, Main vs Aggressive Mode) and IKEv2 (UDP Ports 500 and 4500) negotiate an IPsec VPN?	In IKEv1, Phase 1 authenticates peers (PSK or certificates) and performs a Diffie-Hellman exchange to build a bidirectional ISAKMP management tunnel (Main Mode uses 6 messages protecting identity; Aggressive Mode uses 3 messages exposing the PSK hash to offline cracking). Phase 2 negotiates unidirectional IPsec Security Associations (SAs) for data traffic. IKEv2 consolidates negotiation into 4 messages (`IKE_SA_INIT` and `IKE_AUTH`), adds built-in NAT-T, MOBIKE mobility, and EAP support.
25	What are QoS (Quality of Service), Traffic Shaping vs Policing, and CoPP (Control Plane Policing) on network infrastructure?	QoS prioritizes latency-sensitive traffic (e.g., VoIP EF DSCP 46) during congestion. Traffic Shaping buffers excess packets in a queue to smooth bursts to a target rate; Traffic Policing immediately drops (or remarks DSCP) excess packets exceeding a token-bucket rate limit. Control Plane Policing (CoPP) rate-limits packets destined for the router/switch CPU itself (SSH, BGP, OSPF, ARP, ICMP) to prevent a DoS flood from crashing the routing engine.
26	How does ARP Poisoning (ARP Spoofing) work at Layer 2, and how does Dynamic ARP Inspection (DAI) prevent it?	Because standard ARP is stateless and unauthenticated, an attacker on the local subnet broadcasts forged gratuitous ARP replies claiming their own MAC address owns the Default Gateway's IP, positioning themselves as a Layer 2 Man-in-the-Middle. Dynamic ARP Inspection (DAI) on managed switches intercepts all ARP packets on untrusted ports and drops any packet whose IP-to-MAC mapping does not match the trusted DHCP Snooping binding database.
27	Compare Honeypots, Honeynets, Honeytokens/Canary Files, and Sinkholes in network deception and defense.	Honeypot: A decoy system simulating vulnerable services (low-interaction vs high-interaction) to lure attackers, study TTPs, and trigger high-confidence alerts (since no legitimate user should ever touch it). Honeynet: A network of interconnected honeypots simulating an enterprise subnet. Honeytoken: Fake credentials, API keys, or database records planted to alert immediately when accessed. DNS Sinkhole: Redirects outbound traffic destined for known malware C2 domains to an internal analysis server.
28	What is BGP Hijacking (Prefix Hijacking), and how do RPKI (Resource Public Key Infrastructure) and Route Filtering prevent it?	BGP (Border Gateway Protocol, TCP Port 179) Originally relied on implicit trust between Autonomous Systems (AS). In BGP Hijacking, a malicious or misconfigured AS announces unauthorized ownership of an IP prefix (or a more specific `/24` prefix), diverting global internet traffic. RPKI uses cryptographically signed Route Origin Authorizations (ROAs) to verify that an AS is legitimately authorized by the RIR to originate a given IP prefix.
29	What are the default TCP/UDP port numbers for SSH, Telnet, SMTP (Relay vs Submission), DNS, DHCP, HTTP, and HTTPS?	SSH ( plus SFTP/SCP): TCP 22; Telnet: TCP 23 (unencrypted); SMTP: TCP 25 (server-to-server relay), TCP 587 (STARTTLS client submission), TCP 465 (SMTPS); DNS: UDP/TCP 53 (UDP for standard queries, TCP for zone transfers AXFR/IXFR and responses >512 bytes); DHCP: UDP 67 (Server) & UDP 68 (Client); HTTP: TCP 80; HTTPS: TCP 443 (TCP/UDP 443 for HTTP/3 QUIC).
30	How do 802.1Q VLANs, Trunk Ports vs Access Ports, and VLAN Hopping attacks (Switch Spoofing & Double Tagging) work?	IEEE 802.1Q inserts a 4-byte VLAN tag into Ethernet frames to logically segment broadcast domains acrossTrunk Ports (which carry multiple VLANs), while Access Ports carry a single VLAN. Switch Spoofing exploits Cisco Dynamic Trunking Protocol (DTP) to negotiate a trunk; Double Tagging prepends two 802.1Q tags when the attacker's VLAN matches the trunk Native VLAN. Mitigation: Disable DTP (`switchport mode access`, `switchport nonegotiate`) and change the Native VLAN to an unused ID.
31	Compare DNS over HTTPS (DoH), DNS over TLS (DoT), and traditional DNS over UDP/53.	Traditional DNS sends queries in cleartext over UDP/TCP port 53, exposing browsing history to ISPs and on-path eavesdroppers. DoT (RFC 7858) wraps DNS queries inside a dedicated TLS session on TCP port 853 (easily identifiable and filterable by enterprise network admins). DoH (RFC 8484) encapsulates DNS queries inside standard HTTPS traffic on TCP port 443, blending DNS with normal web traffic (harder to block at the port level).
32	Compare Load Balancing algorithms (Round Robin, Least Connections, IP Hash) and explain TLS Termination vs TLS Passthrough at the Load Balancer.	Round Robin distributes requests sequentially; Least Connections routes to the backend with the fewest active sessions; IP Hash / Sticky Sessions binds a client to one backend. In TLS Termination (Offloading), the load balancer decrypts HTTPS traffic at the edge (allowing Layer 7 WAF inspection and cookie insertion, optionally re-encrypting to backends). In TLS Passthrough, encrypted TCP packets pass directly to backend servers without edge decryption.