NetSec Professional flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Longest prefix match

Routing selects the most specific matching route; if prefixes tie, the lowest administrative distance then lowest metric wins.

Transparent mode firewall

Forwards frames at Layer 2 between bridged interfaces without an IP address on data ports; management uses a separate IP.

Policy-based routing

Forwards packets using criteria such as source address or user before the main routing table, overriding destination-based lookup.

TCP MSS clamping

Rewrites the maximum segment size in TCP SYN packets to the path MTU minus IP and TCP headers, preventing fragmentation across tunnels.

LACP aggregation

IEEE 802.3ad bundles multiple physical links into one logical interface; member links must share speed, duplex, and VLAN settings.

Administrative distance

A trust rating for route sources; when different protocols offer the same prefix, the route with the lower distance is installed.

Active-passive HA

A cluster where one unit forwards traffic and the other stands by; virtual IP and MAC move on failover.

DHCP relay

An interface function that forwards DHCP broadcasts to a remote server and sets giaddr so the server picks the correct address pool.

Implicit deny

The final default rule in a security policy that drops traffic matching no earlier rule; it is often not logged.

Destination NAT

Translates the destination address or port before route lookup; used for virtual IPs and port forwarding to internal servers.

Source NAT

Translates the source address after route lookup and before egress; PAT overload maps many hosts to one public IP.

NAT hairpin

Allows internal clients to reach an internal server through its public NAT address; requires reflection and a matching policy.

RADIUS

AAA protocol using UDP 1812 for authentication and 1813 for accounting; only the password field is encrypted.

TACACS+

AAA protocol over TCP 49 that encrypts the entire payload and separates authentication, authorization, and accounting functions.

SAML SSO

Browser-based federation where the firewall redirects the user to an identity provider and accepts a signed assertion.

FSSO

Single sign-on that maps IP addresses to Active Directory users by collecting logon events from domain controllers.

IKE phase 1

Negotiates the ISAKMP SA parameters: encryption, hash, Diffie-Hellman group, authentication method, and lifetime; both peers must match.

IKE phase 2

Creates IPsec SAs that protect data; negotiates ESP or AH, traffic selectors, PFS group, and SA lifetime.

ESP

IP protocol 50; provides confidentiality and optional integrity/authentication, and can be encapsulated for NAT traversal.

AH

IP protocol 51; provides integrity and anti-replay but no encryption; it fails through NAT because it hashes IP headers.

NAT traversal

Encapsulates ESP in UDP port 4500 when NAT is detected; IKE uses UDP 500 and switches to 4500.

Policy-based VPN

A tunnel triggered by traffic matching interesting-traffic selectors; no tunnel interface or route is required.

Route-based VPN

Uses a tunnel interface and routing table entry to direct traffic into the VPN; supports multiple subnets and dynamic routing.

Split tunneling

A remote-access setting where only traffic for specified private subnets enters the tunnel and other traffic uses local internet.

Antivirus profile

Scans files and protocols for malware using signatures and heuristics; can block or only log detected files.

IPS profile

Matches traffic against exploit signatures; actions include monitor (log only) or block (drop or reset).

Web filter

Classifies URLs into categories and allows or blocks them per policy; HTTPS inspection requires a trusted CA certificate.

Application control

Identifies applications by signature rather than port, allowing policies to permit or deny specific apps.

Syslog

Standard logging protocol using UDP 514; messages carry a facility and severity from 0 emergency to 7 debug.

SNMP traps

Unsolicited notifications sent to a manager on UDP 162; SNMPv3 adds authentication and encryption.

NetFlow

Exports flow metadata such as source/destination IP, ports, and byte counts; it does not capture full packet payloads.

Log severity levels

Syslog ranks messages 0 emergency, 1 alert, 2 critical, 3 error, 4 warning, 5 notice, 6 info, 7 debug.