1.4.2 Identifying and Preventing Vulnerabilities

• What is the purpose of penetration testing?

  To determine how resilient a network is against an attack
• Who typically conducts penetration testing?

  Authorized users or external parties who probe the network for weaknesses
• What does anti-malware software do?

  Removes viruses and spyware from the system
• What are the main functions of anti-malware software?

  • Scans for and identifies malware
  • Compares data to a malware database
  • Alerts users and requests action
  • Quarantines or deletes malware
  • Stops the download of malware
• What is a major limitation of anti-malware software?

  It is reactive and can only detect known malware
• What do firewalls do?

  They scan incoming and outgoing traffic
• What are the key functions of firewalls?

  • Scans incoming and outgoing traffic
  • Compares traffic to criteria
  • Blocks unauthorized traffic
• What do network policies define?

  Acceptable use of the network
• What are some components of an acceptable use policy?

  • Secure, hard-to-guess passwords
  • Regular password changes
  • Restrictions on unauthorized equipment
  • Defined access levels for sensitive data
  • Regular backups and disaster recovery procedures
• How do user access levels contribute to network security?

  They limit data and actions users can access, reducing potential threats
• What are some examples of user access levels?

  • Limits on software installation
  • Restrictions on accessing specific network drives
  • Read/write permissions for files
• What is a common threat posed by users on a network?

  Accidental or deliberate actions that compromise security
• What are some countermeasures to user-related threats?

  • Not allowing external devices on the network
  • Blocking access to insecure websites
  • Restricting access to USB ports and email
• What is the purpose of passwords in network security?

  To verify the identity of users accessing the network
• How can password strength be enforced?

  By setting policies that require complex passwords
• What is an example of a strong password?

  “c0Mput!ng”
• What is the role of encryption in data security?

  • Uses an algorithm to scramble data
  • Turns text into cipher text
  • Requires a key for encryption and decryption
  • Renders intercepted data unintelligible
• What are some physical security measures for networks?

  • Locks and keycard entry
  • Biometric entry systems
  • Alarms and security teams
  • CCTV surveillance
• What is a key aspect of physical security for networks?

  Preventing unauthorized physical access