Pass the ECCouncil NDE 112-51 Questions and answers with ExamsMirror

A firewall is a software or a hardware device on a network or host that filters the incoming and outgoing traffic to prevent unauthorized access to private networks. A firewall can use various criteria, such as IP addresses, ports, protocols, or application rules, to allow or deny the traffic. A firewall can also perform other functions, such as logging, auditing, encryption, or proxy services.A firewall can be deployed at different levels of a network, such as network perimeter, network segment, or host level12.References:Network Defense Essentials - EC-Council Learning,Firewall (computing) - Wikipedia

A device-to-cloud model is a type of IoT communication model that connects the IoT devices directly to the cloud platform, where the data is stored, processed, and analyzed. The device-to-cloud model enables remote access, real-time monitoring, and scalability of IoT applications. The device-to-cloud model requires the IoT devices to have internet connectivity and cloud compatibility. In the above scenario, John used a device-to-cloud model to monitor his grandfather’s health condition, as he placed a smart wearable ECGon his grandfather’s wrist that sent the data to the cloud platform, where John could access it from his mobile phone and receive alerts periodically.References:

Communication Models in IoT (Internet of Things)- Section: Device-to-Cloud Model

IoT Communication Models - IoTbyHVM- Section: Device to Cloud Communication Model

Logical Design of IoT | Communication Models | APIs | Functional Blocks- Section: Device-to-Cloud Communication Model

Anomaly-based IDS is a type of IDS that detects intrusions by comparing the observed network events with a baseline of normal behavior and identifying any deviation from it. Anomaly-based IDS can detect unknown or zero-day attacks that do not match any known signature, but they can also generate false positives due to legitimate changes in network behavior. Anomaly-based IDS can use various techniques to model the normal behavior, such as statistical analysis, machine learning, or artificial intelligence. Anomaly-based IDS is the type of IDS employed by Messy in the above scenario, as he deployed an IDS that depends on observing and comparing the observed events with the normal behavior and then detecting any deviation from it.References:

Anomaly-Based Intrusion Detection System- Chapter 2: Anomaly-Based Intrusion Detection System

Network Defense Essentials (NDE) | Coursera- Week 10: Intrusion Detection and Prevention Systems

A systematic literature review for network intrusion detection system (IDS)- Section 3.2: Anomaly-based IDS

Centralized authentication is a method that uses a central server to authenticate users and devices on a network. The central server stores the credentials and access rights of the users and devices, and verifies them when they request to access the network resources. The central server can also provide encryption keys to the users and devices for secure communication. In the scenario, Jessica’s laptop and the access point use a RADIUS server as the central server for authentication.The RADIUS server transmits authentication keys to both the access point and Jessica’s laptop, which helps the access point identify the wireless client12.References:Network Defense Essentials - EC-Council Learning,Centralized Authentication: What It Is and How It Works

A VPN protocol is a component of VPN that is used to manage tunnels and encapsulate private data. A VPN protocol defines the rules and standards for establishing and maintaining a secure connection between the VPN client and the VPN server. A VPN protocol also specifies how the data is encrypted, authenticated, and transmitted over the tunnel.Some common VPN protocols are IPSec, SSL/TLS, PPTP, L2TP, and OpenVPN12.References:Network Defense Essentials - EC-Council Learning,VPN Protocols Explained & Compared: OpenVPN, IPSec, PPTP, IKEv2

Denial-of-service (DoS) is the category of suspicious traffic signature that George identified in the above scenario. DoS signatures are designed to detect attempts to disrupt or degrade the availability or performance of a system or network by overwhelming it with excessive or malformed traffic. SYN flood and ping of death are examples of DoS attacks that exploit the TCP/IP protocol to consume the resources or crash the target server. A SYN flood attack sends a large number of TCP SYN packets to the targetserver, without completing the three-way handshake, thus creating a backlog of half-open connections that exhaust the server’s memory or bandwidth. A ping of death attack sends a malformed ICMP echo request packet that exceeds the maximum size allowed by the IP protocol, thus causing the target server to crash or reboot.DoS attacks can cause serious damage to the organization’s reputation, productivity, and revenue, and should be detected and mitigated as soon as possible123.References:

Network Defense Essentials Courseware, EC-Council, 2020, pp. 3-33 to 3-34

What is a denial-of-service attack?, Cloudflare, 2020

Denial-of-service attack - Wikipedia, Wikipedia, March 16, 2021

A permissive policy is a type of Internet access policy that allows users to access the Internet from any device and any location, without any restrictions or security measures. A permissive policy provides convenience and flexibility for the users, but also exposes them to various risks, such as malware infection, data leakage, or cyberattacks. In the scenario, Sarah was accessing confidential office files from a remote location via her personal computer connected to the public Internet, and accidentally downloaded a malicious file onto her computer.This indicates that the organization had a permissive policy for Internet access12.References:Network Defense Essentials - EC-Council Learning,Internet Access Policy: Definition and Best Practices

SHA-3 is the algorithm that uses a sponge construction where message blocks are XORed into the initial bits of the state that the algorithm then invertible permutes. SHA-3 is a family of cryptographic hash functions that was standardized by NIST in 2015 as a successor to SHA-2. SHA-3 is based on the Keccak algorithm, which won the NIST hash function competition in 2012. SHA-3 uses a sponge construction, which is a simple iterated construction that can produce variable-length output from a fixed-length permutation. The sponge construction operates on a state of b bits, which is divided into two sections: the bitrate r and the capacity c. The sponge construction has two phases: the absorbing phase and the squeezing phase. In the absorbing phase, the input message is padded and divided into blocks of r bits. Each block is XORed into the first r bits of the state, and then the state is transformed by the permutation function f. This process continues until all the input blocks are processed. In the squeezing phase, the output is generated by repeatedly applying the permutation function f to the state and extracting the first r bits as output blocks. The output can be truncated to the desired length. SHA-3 uses a permutation function f that is based on a round function that consists of five steps: theta, rho, pi, chi, and iota. These steps perform bitwise operations, rotations, permutations, and additions on the state. The permutation function f is invertible, meaning that it can be reversed to obtain the previous state. SHA-3 has four variants with different output lengths: SHA3-224, SHA3-256, SHA3-384, and SHA3-512. SHA-3 also supports two additional modes: SHAKE128 and SHAKE256, which are extendable-output functions that can produce arbitrary-length output.References:

Network Defense Essentials Courseware, EC-Council, 2020, pp. 3-23 to 3-25

SHA-3 - Wikipedia, Wikipedia, March 16, 2021

The sponge and duplex constructions - Keccak Team, Keccak Team, 2020

The object of the container network model (CNM) that contains the configuration files of a container’s network stack, such as routing table, container’s interfaces, and DNSsettings, is the Sandbox. A Sandbox is a logical entity that encapsulates the network configuration and state of a container. A Sandbox can contain one or more endpoints from different networks, and provides isolation and security for the container’s network stack. A Sandbox can be implemented using various technologies, such as Linux network namespaces, FreeBSD jails, or Windows compartments.A Sandbox allows the container to have its own view and control of the network resources, such as interfaces, addresses, routes, and DNS settings123.References:

The Container Networking Model | Training, Training, 2020

A Comprehensive Guide To Docker Networking - KnowledgeHut, KnowledgeHut, September 27, 2023

Design - GitHub: Let’s build from here, GitHub, 2020