I85PREP
⌘ K
Ruankao Network Engineer (Intermediate) study materials
Ruankao Network Engineer (Intermediate) study resources

Ruankao Network Engineer (Intermediate): Network Security and Management

Ruankao Network Engineer (Intermediate) · Work through your exam, one topic at a time.

All guide sections

Network Security and Management

This domain mixes cryptographic principles with operational security controls and monitoring. The exam likes questions where key usage is reversed, or where protocol encapsulation order is asked.

Security principles and cryptography

  • CIA triad: confidentiality, integrity, availability; extended by authentication, non-repudiation and access control.
  • Symmetric: DES (56-bit), 3DES, AES (128/192/256). Fast, but key distribution is the problem.
  • Asymmetric: RSA, ECC. Used for key exchange and signatures, not bulk data.
  • Hash: MD5 (128-bit, broken), SHA-1 (160-bit, deprecated), SHA-256. Hashes give integrity; a MAC adds a shared key.
  • Digital signature: sign with the sender's private key, verify with the sender's public key. Encryption is the reverse: encrypt with the recipient's public key, decrypt with the recipient's private key.
  • PKI: CA issues X.509 certificates binding identity to public key; CRL and OCSP handle revocation.

Network security controls

  • Firewall, IDS (detect) versus IPS (detect and block), WAF for web traffic, NAC and 802.1X for admission control.
  • AAA: RADIUS (1812/1813) and TACACS+ (TCP 49) centralise authentication and accounting.
  • IPSec: AH (protocol 51, integrity and authentication, no encryption) and ESP (protocol 50, adds encryption). Transport mode protects payload; tunnel mode protects the whole packet and is used for site-to-site VPN. IKE negotiates over UDP 500. SSL/TLS VPN suits remote users through a browser.
  • Attacks: ARP spoofing (mitigate with DHCP snooping and dynamic ARP inspection), DoS/DDoS, sniffing, phishing, SQL injection.

Management and recovery

  • SNMP manager/agent with MIB and OIDs; traps are unsolicited alerts to port 162. RMON provides richer remote statistics. Syslog (514) centralises events; NTP (123) keeps timestamps trustworthy.
  • Backups: 3-2-1 rule (three copies, two media, one offsite), tested restores, configuration backups after every change, encrypted archives, defined RPO/RTO.

Worked example

A user must send a confidential, signed message to a server. The user hashes the message, encrypts the hash with their private key (signature), then encrypts the whole package with a random symmetric session key protected by the server's public key. The server decrypts the session key with its private key, verifies the signature with the user's public key, and recomputes the hash to confirm integrity.

Traps that cost marks

  • Reversing signature keys - signing with a public key provides no authentication.
  • Claiming AH encrypts payload; it does not.
  • Confusing IDS with IPS, or describing a firewall as an antivirus.
  • Treating a snapshot as a backup strategy.