WGU D415 Objective Assessment 89 Questions and Answers

WGU D415 SDN | OA | Objective Assessment | 89 Questions and Answers | 2025 Update | 100% Correct Which OSI model layer is responsible for the segment protocol data unit? Network Transport Application Data link - ,,,,,answer,,,,,,..Transport Which protocol in the software-defined networking (SDN) framework is responsible for defining the communication between the controller and a network device? OpenFlow Telnet Point-to-point Address resolution - ,,,,,answer,,,,,,..OpenFlow Which network automation tool is open source? BlueCat gateway Chef Ansible Puppet Enterprise - ,,,,,answer,,,,,,..Ansible What is a benefit of using network automation? Backing up and restoring data Using infrastructure as code to maintain a reliable state Dynamic allocation of IP addresses Boosting storage - ,,,,,answer,,,,,,..Using infrastructure as code to maintain a reliable state Which service introduces flexibility, dynamism, and automation into the management of network objects? Open source for network functions virtualization (NFV) OpenStack Network functions virtualization (NFV) Software-defined networking (SDN) - ,,,,,answer,,,,,,..Software-defined networking (SDN) Which OpenStack unit provides authentication? Cinder Nova Keystone Neutron - ,,,,,answer,,,,,,..Keystone Which interface in SDN allows the controller to communicate, interact, and manage forwarding elements? Westbound Flow ID Southbound Eastbound - ,,,,,answer,,,,,,..Southbound Which OpenFlow SDN controller has a multi-threaded, cross-platform, and modular emphasis? FlowVisor OpenDaylight (ODL) Project Floodlight Beacon - ,,,,,answer,,,,,,..Beacon Which port number is used as the destination of a server by Dynamic Host Configuration Protocol? 23 53 67 68 - ,,,,,answer,,,,,,..67 Which IPv6 address identifies each network interface? Multicast Broadcast Anycast Unicast - ,,,,,answer,,,,,,..Anycast Which network virtualization (NV) approach refers to a logical local area network (LAN) based on physical LANs? Virtual private networks (VPN) Virtual private LAN services (VPLS) Virtual LANs (VLANs) Wide area network (WAN) - ,,,,,answer,,,,,,..Virtual LANs (VLANs) Which network virtualization benefit involves using virtual networks to create slices to reserve networking resources? Debugging and intrusion detection Resource optimization Mobility Testing/quality assurance - ,,,,,answer,,,,,,..Debugging and intrusion detection Which layer 2 virtual networking device is responsible for controlling data frames to connected devices? Router Hub Bridge Switch - ,,,,,answer,,,,,,..Switch Which virtual networking protocol is used to support VPNs and does not provide encryption? Layer 2 Tunneling Protocol (L2TP) Point-to-Point Protocol (PPP) Internet Key Exchange version 2 (IKEv2) Secure Socket Layer (SSL) - ,,,,,answer,,,,,,..Layer 2 Tunneling Protocol (L2TP) What is the AAA mechanism responsible for granting user privileges to network resources? Authorization Authentication Accounting Availability - ,,,,,answer,,,,,,..Authorization Which authentication type validates a user based on what the person knows? Retinal scans Swipe card Password Unique tokens - ,,,,,answer,,,,,,..Password Which phase of an attack involves the attacker gathering information about the target? Escalating privileges Exploiting the system Clearing tracks Reconnaissance - ,,,,,answer,,,,,,..Reconnaissance Which term refers to a weakness or gap in a security system that can be exploited by an attacker? Threat Vulnerability Attack Risk - ,,,,,answer,,,,,,..Vulnerability Which cyber kill chain term implies actual detonation of the attack? Exploitation Command and control Installation Delivery - ,,,,,answer,,,,,,..Exploitation Which defensive in-depth mechanism watches activities on systems and networks to determine attacks and repair the damages? Preventive solutions Detection and response Survivability and recovery Reconnaissance - ,,,,,answer,,,,,,..Detection and response Which organization is responsible for publishing security frameworks and standards to help an organization achieve security outcomes? Open Web Application Security Project (OWASP) Internet Assigned Numbers Authority (IANA) National Institute of Standards and Technology (NIST) International Organization for Standardization (ISO) ,,,,,answer,,,,,,..National Institute of Standards and Technology (NIST) Which security process can help obtain a deep insight into events in the existing system? Vulnerability Logging Threat agent Reconnaissance - ,,,,,answer,,,,,,..Logging Which in-line security technology proactively examines, detects, and prevents an attacker from exploiting a vulnerability in a system? Vulnerability scanner Port scanner Intrusion detection system (IDS) Intrusion prevention system - ,,,,,answer,,,,,,..Intrusion prevention system Which plane can have security problems such as cross-site scripting and cross-site request forgery? Application Data Management Control - ,,,,,answer,,,,,,..Application Which communication protocol makes it possible for the SDN controller to interact with devices such as the switch or the router? Transport Layer Security (TLS) Secure Shell Protocol (SSH) Secure file transfer protocol (SFTP) OpenFlow - ,,,,,answer,,,,,,..OpenFlow Which device prohibits virtual networks from communicating with other networks during the implementation of virtual extensible local networks (VXLANs)? Hub Virtual switch Gateway Virtual router - ,,,,,answer,,,,,,..Virtual Router Which term describes a network security solution that inspects packets and provides filtering as well as monitoring for virtual machines within a virtualized environment? Proxy server Virtual firewall Physical firewall Network address translation - ,,,,,answer,,,,,,..Virtual Firewall Which SDN microsegmentation consideration significantly reduces the available attack surface that a network presents? Zero trust zones Tools for supporting legacy networks Fine-grained data flow and policy management Leveraging cloud-based resource management and support ,,,,,answer,,,,,,..Fine-grained data flow and policy management Which benefit of distributed firewalls ensures that telecommuters are protected whether the tunnel is set up or not? Topology independence Protection from internal attacks Elimination of single point of failure Improved host decision-making - ,,,,,answer,,,,,,..Topology independence Which firewall term refers to a program that deals with external devices on behalf of internal clients? Network address translation Dual-homed host Proxy Perimeter network - ,,,,,answer,,,,,,..Proxy Which networking task would benefit from the use of network automation tools? Configuring multiple wireless access points Changing user privileges due to job changes Creating a physical connection between devices Identifying and fixing a faulty switch protocol ,,,,,answer,,,,,,..Configuring multiple wireless access points Which task can be performed by an administrator using a network's automation software? Add a firewall to the network. Create a network attack graph. Perform a penetration test. Design the topology of the network. - ,,,,,answer,,,,,,..Add a firewall to the network. Which automation tool uses logic referred to as a playbook? Ansible Chef Puppet Apstra - ,,,,,answer,,,,,,..Ansible Which network configuration automation tool is written using C++, Clojure, and Ruby? Ansible Chef Puppet Apstra - ,,,,,answer,,,,,,..Chef How does software-defined networking (SDN) affect information security? A single device can be configured for switching, routing, load balancing, or security monitoring. Each network function is handled by a separate, isolated device. With the complexity of software, carriers have little visibility into security issues. Network information is now centralized on one physical device. ,,,,,answer,,,,,,..A single device can be configured for switching, routing, load balancing, or security monitoring. Which model involves moving services like load balancing, firewalls, and intrusion prevention systems away from dedicated hardware into a nonphysical environment? Network functions virtualization (NFV) Software as a service (SaaS) Open systems interconnection (OSI) Internet Engineering Task Force (IETF) - ,,,,,answer,,,,,,..Network functions virtualization (NFV) A network utilizes virtualized environments with virtual machines running delay-sensitive applications. Which recommendation should be used to protect the virtual workload in accordance with NIST 800-125B? Virtual firewalls should be deployed for traffic flow control instead of physical firewalls. Two identical bastion hosts should be used instead of one primary host. The logical network topology should be either a star topology or a bus topology. - ,,,,,answer,,,,,,..Virtual firewalls should be deployed for traffic flow control instead of physical firewalls. A virtualized network uses a subnet-level virtual firewall. Which recommendation should be used to protect the virtual workload in accordance with NIST 800-125B? The firewall should be integrated with a virtualization management platform. The firewall should be accessible only through a standalone console. The firewall should be located at the center of the network topology. The firewall should be reconfigured and optimized on a daily basis. ,,,,,answer,,,,,,..The firewall should be integrated with a virtualization management platform. A network uses event logging for auditing purposes. How should the audit records be managed according to the recommendations in NIST 800-53? Generate time stamps for audit records. Store audit records for a period of 36 months. Use a designated local device for audit record storage. Manually inspect audit records at specified intervals. ,,,,,answer,,,,,,..Generate time stamps for audit records. How has network functions virtualization (NFV) changed network functions? It has moved network functions from stand-alone appliances to software running on any server. It has moved network functions from software running on any server to stand-alone appliances. It has moved network functions from the network presentation layer to the transport layer. It has moved network functions from the network transport layer to the presentation layer. - ,,,,,answer,,,,,,..It has moved network functions from stand-alone appliances to software running on any server. Which financial benefit does network functions virtualization (NFV) offer to carriers? The opportunity for pay-as-you-go services without a large up-front investment The opportunity to own specialized network hardware rather than rent it The opportunity to materially participate in and profit from software development The opportunity for reduced complexity and cost of network security methods - ,,,,,answer,,,,,,..The opportunity for pay-as-you-go services without a large up-front investment What are the software applications within a network functions virtualization (NFV) architecture that perform specific network tasks? Virtual network functions (VNFs) Application programming interfaces (APIs) Network address translators (NATs) Domain name systems (DNSs) - ,,,,,answer,,,,,,..Virtual network functions (VNFs) How are network functions virtualization (NFV) and software-defined networks (SDNs) related? They are two network infrastructure improvement models that are mutually beneficial and often used together. They are both designed to improve network infrastructure but on different sides of the provider-client relationship. They each improve networking, where SDN addresses only software and NFV addresses only hardware. - ,,,,,answer,,,,,,..They are two network infrastructure improvement models that are mutually beneficial and often used together. Which concept is used to create differentiated access based on entitlement to administer a network device or controller? Role-based administration control (RBAC) Role-based access control (RBAC) Authentication, authorization, and accounting (AAA) Amortization, adjudication, and allowance (AAA) - ,,,,,answer,,,,,,..Rolebased access control (RBAC) What are the advantages of using centralized network infrastructure? It helps in the easy deployment and management of systems and devices within the network infrastructure. It helps in the easy removal of malicious software from systems and devices within the network infrastructure. It helps in easy access for end users to edge systems and devices within the network infrastructure. It helps in easy information retrieval by the end users of the network infrastructure. - ,,,,,answer,,,,,,..It helps in the easy deployment and management of systems and devices within the network infrastructure. What is a direct benefit of using network programmability instead of manual configuration when implementing configuration changes? Increased network stability owing to high latency Reduced user error due to manual configuration Decreased count of security policies Maximized network bandwidth by analyzing the redundant data ,,,,,answer,,,,,,..Reduced user error due to manual configuration Which module of OpenStack should be used to improve efficiency and scalability of user storage and unstructured data? Swift Neutron Ironic Congress - ,,,,,answer,,,,,,..Swift Which module of OpenStack should a developer use for the management of various virtual machine images? Glance Neutron Murano Sahara - ,,,,,answer,,,,,,..Glance Which OpenStack module should be used to improve the storage and management of secure authentication information? Barbican Trove Cinder Zaqar - ,,,,,answer,,,,,,..Barbican How does a software-defined networking (SDN) southbound API function? It allows the controller to communicate with the OpenFlow switch and network routers. It allows the controller to interchange elements among application, control, and infrastructure layers. It allows the controller to make a direct connection between applications and the operating system. It allows the controller to manage elements of the application layer through the controllers. - ,,,,,answer,,,,,,..It allows the controller to communicate with the OpenFlow switch and network routers. Which layers are connected by the northbound API? The application and control layers The control and infrastructure layers The application and operating layers The operating and infrastructure layers - ,,,,,answer,,,,,,..The application and control layers What includes interoperable modules used to orchestrate large pools of computing, storage, and networking resources? OpenStack Network functions virtualization (NFV) OpenFlow Network functions virtualization infrastructure (NFVI) ,,,,,answer,,,,,,..OpenStack How do virtual overlay networks function in relation to existing network structures? Provision and manage networks alongside other virtual resources Link physical computers through secured wired connections Establish a well-defined trusted domain barrier without multiple firewalls Interchange protocols among the application, transport, and network layers - ,,,,,answer,,,,,,..Provision and manage networks alongside other virtual resources A network administrator designed a three-layer security system for the network. An attack on the system has exploited a hole in the first layer of the security system. Which layer does the attack face next? Detection and response mechanisms Preventative mechanisms Recovery mechanisms Encapsulation and encryption mechanisms - ,,,,,answer,,,,,,..Detection and response mechanisms Which technique can a network administrator use to identify potential weaknesses that would be accessible to a trusted network user? Authenticated vulnerability scan Network communication scan Corrupted packet log scan VNF service flooding scan - ,,,,,answer,,,,,,..Authenticated vulnerability scan Which tool can a developer use to ensure that the code loaded in the VNF execution environment is authentic? Secure Boot OpenFlow VNF Manager Ruby vSphere - ,,,,,answer,,,,,,..Secure Boot Which method improves network partitioning to reduce threat effectiveness? Physical segregation of hardware Consolidation of controllers Merging of communication channels Expanding demilitarized zones - ,,,,,answer,,,,,,..Physical segregation of hardware Which function does an intrusion prevention system (IPS) perform in a network? It scans for patterns that could be a threat and only alerts the administrator via text message. It scans for patterns that could be a threat and takes the configured action against them. It scans for threats, logs them as a nuisance, and then allows the traffic through. It scans for nonthreatening traffic and blocks all other traffic to a network. - ,,,,,answer,,,,,,..It scans for patterns that could be a threat and takes the configured action against them. How are security threats that happen within a computer network classified? As detectable and unknown As malicious and robust As divisive and destructive As intentional and unintentional - ,,,,,answer,,,,,,..As intentional and unintentional Why does an intrusion detection system (IDS) use a TAP or SPAN port to analyze a copy of the inline traffic stream? To ensure that inline network performance is not impacted To act as a gatekeeper through which all network traffic must pass To prevent damage to any packet data that is analyzed To facilitate the storage and tracking of network packet data ,,,,,answer,,,,,,..To ensure that inline network performance is not impacted What is a function of the bastion host in a screened subnet firewall architecture? To serve as the main point of contact for incoming connections To protect the perimeter and internal networks from the internet To perform most of the data packet filtering for the firewall To define a clear boundary between trusted and untrusted domains ,,,,,answer,,,,,,..To serve as the main point of contact for incoming connections Which problem do traditional firewalls fail to protect against? Internal attacks Unauthorized access Malicious traffic Non-compliant packets - ,,,,,answer,,,,,,..Internal attacks Which approach improves the strength of software-defined networking (SDN) security and intrusion tolerance? Controller diversity Controller consolidation Logging Virtualization - ,,,,,answer,,,,,,..Controller diversity Which design component is incorporated in the software-defined networking (SDN) framework security? Proactive and reactive security recovery mechanisms maintain optimal service availability. Each controller has controls for every switch with multiple-controller domains. Controller and management plane applications have a built-in mechanism to establish trust. The association between the controller and devices such as OpenFlow switch are static in nature. - ,,,,,answer,,,,,,..Proactive and reactive security recovery mechanisms maintain optimal service availability. What does clustering defend against? Single point of failure in a controller Lateral movement of an attacker Blurred trusted domain boundaries Internal network attacks - ,,,,,answer,,,,,,..Single point of failure in a controller Which tool gives insights into occurred events for analyzing and troubleshooting a network or computer system? Intrusion detection systems PathPing Logs Intrusion prevention systems - ,,,,,answer,,,,,,..Logs A network administrator finds an ongoing attack against a virtual machine (VM) and then swaps computing architectures for that VM. Which moving target defense (MTD) technique did this administrator utilize? Redundancy Diversification Obfuscation Shuffling - ,,,,,answer,,,,,,..Shuffling What is the purpose of the Common Vulnerability Scoring System (CVSS)? CVSS is a proprietary framework made by IBM for identifying and defining software vulnerabilities. CVSS is an open-source framework for identifying and defining software vulnerabilities. CVSS is a spreadsheet of known vulnerabilities that can be used as a reference by security professionals. CVSS is an open-source tool used to conduct statistical analysis in a database for authenticating users. - ,,,,,answer,,,,,,..CVSS is an opensource framework for identifying and defining software vulnerabilities. What are two key features of software-defined security? Choose 2 answers. Enabling policy-driven and automated security orchestration and management Removing the time- and error-prone human middleware via greater automation Transitioning security packages to offshore industry-specific firms Ranking network users based on probabilistic threat and risk assessments - ,,,,,answer,,,,,,..Enabling policy-driven and automated security orchestration and management Removing the time- and error-prone human middleware via greater automation Instead of defending a network infrastructure by detecting, preventing, tracking, and remediating threats, a new model changes the attack surface over time. What is the new model referred to as? Proactive security Attack representation Virtualized security Service function chaining - ,,,,,answer,,,,,,..Proactive security What is an open-source security metric framework that quantifies a network's attack surface? Common Vulnerability Scoring System Cumulative Network Risk Assessment Objective Systematic Threat Value Probabilistic Risk-Threat Quotient - ,,,,,answer,,,,,,..Common Vulnerability Scoring System What is an advantage of Simple Network Monitoring Protocol (SNMP) over NetFlow? SNMP has real-time management functionality. SNMP provides more information on bandwidth use. SNMP gives more detail on network traffic sources. SNMP uses agentless push technology. - ,,,,,answer,,,,,,..SNMP has realtime management functionality. Which network security component restricts access between a protected network and the internet? Firewall Router OpenFlow Network address translation (NAT) - ,,,,,answer,,,,,,..Firewall Which tool has the functionality to reset a network connection automatically in response to analyzed incoming network traffic flows? Intrusion prevention system (IPS) Virtual local area network (VLAN) Network address translation (NAT) Open virtual switch (OVS) - ,,,,,answer,,,,,,..Intrusion prevention system (IPS) Which two interdependent services should be established when providing a centralized logging service for a data center networking environment? Choose 2 answers. Collect logs Transport logs Publish logs Repair logs - ,,,,,answer,,,,,,..Collect logs Transport logs Which kind of device is needed for communication to happen between two local area networks? Router L2 Switch Hub Access point - ,,,,,answer,,,,,,..Router A network administrator uses a telemetry system to monitor and troubleshoot a network. The system uses event-based telemetry to perform these functions.Which information would be exposed by this type of system? An employee logging into a switch and using commands to show the output of the configuration A link going from the "up up" state into the "up down" state A device connected to the wireless network transmitting data with malicious code - ,,,,,answer,,,,,,..A link going from the "up up" state into the "up down" state Which network function commonly blocks the connectivity between a controller and a southbound interface? Virtual private network (VPN) Domain name server (DNS) Firewall Access point - ,,,,,answer,,,,,,..Firewall Which function of a device is needed to have accurate data for timesensitive network event correlation? An Internet Engineering Task Force (IETF) 5905 synchronized clock An Institute of Electrical and Electronics Engineers (IEEE) 1588 synchronized clock An Internet Engineering Task Force (IETF) 1361 synchronized clock An Institute of Electrical and Electronics Engineers (IEEE) 957 synchronized clock - ,,,,,answer,,,,,,..An Institute of Electrical and Electronics Engineers (IEEE) 1588 synchronized clock Which phase of the system design life cycle (SDLC) includes security categorization and preliminary risk assessment? Implementation Initiation Acquisition and development Disposition - ,,,,,answer,,,,,,..Initiation Which risk analysis methodologies are used in information security? Quantitative and qualitative Productive and nonproductive Tested and unknown Tight and loose - ,,,,,answer,,,,,,..Quantitative and qualitative What is an asset as defined in information security? Anything of value to an organization Anything of value to an attacker Anything of value to a law enforcement agency Anything of value to a network user - ,,,,,answer,,,,,,..Anything of value to an organization Which action impacts the quality of service or security of a network function virtualization (NFV) tenant? Workload migrations that happen on the same NFV deployment Power management of the same NFV deployment Extra hardening of the external environment of the NFV deployment Defragmentation of the NFV environment - ,,,,,answer,,,,,,..Workload migrations that happen on the same NFV deployment Which potential attack target would result in a vulnerability that allows attackers to obtain cryptographic keys from other virtual network functions (VNFs)? Virtualized infrastructure manager Virtualization layer VNF components VNF manager - ,,,,,answer,,,,,,..VNF manager What is a key concept in host routing? A single gateway exiting a location is preferred for a specific type of traffic. A single gateway exiting a location is preferred for all traffic. A single gateway exiting a location is preferred for only traffic marked for null 0. A single gateway exiting a location is preferred for traffic with double encryption. - ,,,,,answer,,,,,,..A single gateway exiting a location is preferred for a specific type of traffic. Which program should be used in the process of vulnerability scanning? Nessus Acunetix McAfee Antivirus Windows Defender Firewall - ,,,,,answer,,,,,,..Nessus Which firewall type in a network is configured to withstand attacks and is often placed in the DMZ? Circuit-level gateway Bastion Stateful inspection Packet filtering - ,,,,,answer,,,,,,..Bastion Which SDN plane was developed for telemetry? Data Northbound Control Application - ,,,,,answer,,,,,,..Application Which harware end-of-life (EOL) problem has to do with reduced or eliminated support for security fixes, patches, firmware updates by the manufacturer? Problems with scalability High maintenance costs Compromised data security Decreased productivity - ,,,,,answer,,,,,,..Compromised data security Network Functions Virtualization (NFV) Moved network functions from stand-alone appliances to software running on any server, reducing the time-to-market for products. Software-Defined Networks (SDN) This architecture decouples the network control and forwarding functions enabling the network control to become directly programmable and the underlying infrastructure to be abstracted for applications and network services. NFV Components Virtual Network Functions (VNFs) Network Functions Virtualization Infrastructure (NFVI) NFV Management and Orchestration (NFV-MANO) NFV Management and Orchestration (NFV-MANO) Consists of all functional blocks, data repositories, reference points, and interfaces that are used for managing and orchestrating VNFs and the NFVI. Network Functions Virtualization Infrastructure (NFVI) Is the entirety of the hardware and software components that build the environment where VNFs are deployed. Virtual Network Functions (VNFs) Are the software implementations of network functions. Open Platform for NFV (OPNFV) Created by the Linux Foundation in 2014 and is a collaborative opensource platform that seeks to develop NFV and shape its evolution. OpenStack An open-source cloud computing platform that has high market penetration that includes a collection of interoperable modules that are used to orchestrate large pools of compute, storage, and networking resources. Nova OpenStack compute module, is used to create and delete compute instances as required. Glance OpenStack module that synchronizes and maintains VM images across the com pute cluster. Keystone Module that provides authentication for accessing all OpenStack services. Cinder OpenStack module that provides block storage used as storage volumes for VMs. Swift OpenStack module that provides object storage that is used to store large amounts of static data in a cluster. Neutron or networking, OpenStack module that allows the different compute instances and storage nodes to communicate with each other. Horizon OpenStack module provides a GUI dashboard, and is by far the most widely deployed management module. Heat OpenStack module that helps expedite orchestration of applications across multiple compute instances by using templates. Celiometer OpenStack module that monitors the NFVI and helps identify bottlenecks and resource optimization opportunities. Ironic OpenStack module that is a provisioning tool for baremetal installation of compute capabilities instead of VMs in OpenStack. Congress OpenStack module that is a policy management framework for the OpenStack environment. Designate OpenStack module that is used to point applications in the OpenStack environment to a trusted DNS source. Barbican OpenStack module that works with Keystone authentication to manage internal application security by behaving as a key manager. Murano OpenStack module that provides a white list repository of applications. Trove OpenStack module that provides a distributed database service and enables users to deploy relational and non-relational database engines. Sahara OpenStack module formerly called Savanna, provides big data services by providing Elastic MapReduce and ability to provision Hadoop. Manila Openstack module that provides Network Area Storage (NAS) solutions for an OpenStack deployment. Zaqar OpenStack module that provides a multi-tenant cloud messaging service. Magnum OpenStack module that is an umbrella project that provides containerization assistance. This module is still in development. Dynamic Host Configuration Protocol (DHCP) A network management protocol used to dynamically assign an Internet Protocol (IP) address to any device, or node, on a network so they can communicate using IP. UDP port number 67 Destination port of a DHCP server UDP port number 68 Destination port of a DHCP client ioctl interface Linux Bridge Configuration offers an interface that can be used to create and destroy bridges in the operating system, and it can also add network interfaces and remove existing network interfaces to / from the bridge. sysfs-based interface Linux Bridge Configuration allows the management of bridge and bridge port specific parameters. Virtual Network a mapping of the entire or subset of networking resources to a specific protocol layer. Network Virtualization (NV) Defined by the ability to create logical, virtual networks that are decoupled from the underlying network hardware to ensure the network can better integrate with and support increasingly virtual environments. Two most common forms of NVs Protocol-based virtual networks Virtual networks that are based on virtual devices Virtual Private Networks (VPNs) protocol-based virtual networks usually built on tunneling protocols, which consists of multiple remote end-points (typically routers, VPN gateways of software clients) joined by some sort of tunnel over another network, usually a third-party net work. Virtual LANs (VLANs) Protocol-based virtual networks that are logical local area networks (LANs) based on physical LANs Virtual Private LAN Services (VPLS) A specific type of Multipoint VPN that is divided into Trans parent LAN Services (TLS) and Ethernet Virtual Connection Services. Virtualization Refers to the act of creating a virtual (rather than actual) version of something, including virtual computer hardware platforms, storage devices, and computer network resources. Replication To create multiple instances of the resource Isolation To separate the uses which clients make of the underlying resources Overlay network It describes a computer network that is built on top of another network. Virtual Network Embedding (VNE) problem How to optimally allocate virtual networks and their associated networking resources. hub a physical-layer device where a frame is passed along or broadcast to every one of its ports. It does not matter that the frame is only destined for one port. switch Responsible for connecting several network links to each other, creating a Local Area Network (LAN). a data-link layer device that keeps a record of the MAC addresses of all the devices connected to it and with this information it can identify which system is sitting on which port. As the result, when a frame is received, it knows exactly which port to send the frame to, without significantly increasing network response times. bridge A device that separates two or more network segments within one logical network. Open vSwitch (OVS) A multi-layer software switch licensed under the open source Apache 2 license. Linux bridge A native function on Linux kernel with layer-2 capabilities, which can be considered as an Ethernet Hub OpenFlow Allows a controller to add, remove, update, monitor, and obtain statistics on flow tables and their flows, as well as to divert selected packets to the controller and to inject packets from the controller into the switch. L2TP (Layer 2 Tunneling Protocol) a tunneling protocol used to support VPNs or as part of the delivery of services by ISPs. It does not provide any encryption or confidentiality by itself. Rather, it relies on an encryption protocol that it passes within the tunnel to provide privacy. PPP (Point-to-Point Protocol) A data link (layer 2) protocol used to establish a direct connection between two nodes. It connects two routers directly without any host or any other networking device in between. It can provide connection authentication, transmission encryption, and compression. VXLAN (Virtual Extensible LAN) Network virtualization technology that attempts to improve the scalability problems associated with large cloud computing deployments. It uses a VLAN-like encapsulation technique to encapsulate layer 2 Ethernet frames within layer 4 UDP packets Generic Routing Encapsulation (GRE) A communication protocol used to establish a direct, point-to-point connection between network nodes. Being a simple and effective method of transporting data over a public network, such as the Internet, it lets two peers share data they will not be able to share over the public network itself. SSL (Secure Socket Layer) A standard security technology for estab lishing an encrypted link between a server and a client - typically a web server (website) and a browser, or a mail server and a mail client (e.g., Outlook) by encrypting data above the transport layer. IPSec A network protocol suite that authenticates and encrypts the packets of data sent over a network at the IP layer. IPsec includes protocols for establishing mutual authentication between agents at the beginning of the session and negotiation of cryptographic keys for use during the session. IEEE 802.1Q A protocol for carrying VLAN traffic on Ethernet. Maximum Transmission Unit (MTU) The size of the largest block of data that can be sent as a single unit. Southbound Interface (SBI) Allows the controller to communicate, interact and manage the forwarding elements. East / Westbound interfaces Are meant for communication between groups or federations of controllers. Northbound Interface (NBI) Enables applications in the application layer to program the controllers by making abstract data models and other functionalities available to them. Unified control plane of an SDN Consists of one or more SDN con trollers that use open APIs to exert control over the underlying vSwitches or forwarding devices. Data plane in SDN Tasked with enabling the transfer of data from the sender to the receiver(s). OpenFlow Defined by the ONF, is a protocol between the control and forwarding layers of an SDN architecture, and is by far the most widespread implementation of SDN. SDN Controllers The brains of the SDN operation that lies between the data plane devices on one end, and high level applications on the other. Takes the responsibility of establishing every flow in the network by installing flow entries on switch devices. NOX Was among the fi rst publicly available OpenFlow controller. OpenDaylight (ODL) An open-source SDN controller that has been available since 2014. It is a modular multi-protocol SDN control ler that is widely deployed in the industry. Open Virtual Switch (OVS) Open-source implementation of a distributed programmable virtual multilayer switch. Generally consist of flow tables, with each flow entry having match conditions and associated actions. Communicates with the controller using a secure channel, and generally uses the OpenFlow protocol. Routing Control Platform (RCP) Proposed in for the provisioning of inter-domain routing over a BGP network. Routing is done as a separate entity. Control from physically distributed entities in a domain is logically centralized in a control plane. SoftRouter Presented with the aim of separation of control and forwarding elements called Control Element (CE) and Forwarding Element (FE), respectively. The control functionality is provided by using a centralized server, i.e., a CE that might be many hops away from the FE. RouteFlow Project initially named as QuagFlow, which aimed to provide IP routing as Router-as-a-Service in a virtualized environment. Considered the basic architecture to control routing in SDNs. Virtual Router System (VRS) Virtual router instances communicate with a Point-Of-Presence (POP) and follow a star topology, in which a single core node is connected to Customer Edge Gateways (CEG) linked through Intermediate Nodes (INs). Vulnerability A weakness or gap in a security system that can be either exploited by attackers or caused by malfunctioning system components. Threat The possibility of exploration of vulnerabilities that can lead to something bad happening, and it emphasizes the qualitative of potential damages due to explored vulnerabilities. Attack An action triggered by deploying an attacking method, when a vulnerability is exploited to actually realize a threat. Risk The quantifiable likelihood of loss due to a realized threat, and it emphasizes the quantitative of potential damages. The source of attacks Two types of attackers based on their origins called inside attacker (or insider) and outside attacker (or out sider). The method of attacks There are two types of attack methods based on the intention of the attacker called passive attacks and active attacks. The target of attacks The objective of attackers to try to compromise. The consequence of attacks Describes outcomes by successfully deploying an attack. It is a multifaceted consequence. Defense in depth Also known as Castle Approach is the concept of protecting a computer network with a series of defensive mechanisms such that if one mechanism fails, another will already be in place to thwart an attack. Defense in depth framework The first layer is a prevention mechanism that stops attacks from getting into the networking system. The second layer is detection and response mechanisms that watch activities on systems and networks to detect attacks and repair the damage The third layer is attack-resilient technologies that enable the core elements, or, the most valuable systems, on the network to survive attacks and continue to function. Cyber Kill Chain Adopts the concept of a procedural step-by-step attacking method consisting of target identification, force dispatch to target, decision and order to attack the target, and finally the destruction of the target. Reconnaissance The attacker gathers information on the target before the actual attack starts. Weaponization Cyber attackers do not interact with the intended victim, instead they create their attack. Delivery Transmission of the attack to the intended victim(s). Exploitation This implies actual detonation of the attack, such as the exploit running on the system. Installation The attacker may install malware on the victim. Command & Control (C&C) This implies that once a system is compromised and / or infected, the system has to call home. Actions on Objectives Once the cyber attackers establish access to the organization, they then execute actions to achieve their objectives / goal. Network mapping The study of the connectivity of networks at the layer 3 on a TCP / IP network. Vulnerability scanning An inspection of the potential points of exploit on a computer or network to identify security holes. Penetration testing Attempts to identify insecure business processes, insecure system settings, or other weaknesses. Frewall (FW) A component or set of components that restricts access between a protected network and the Internet, or between other sets of networks. Host A computer system attached to a network. Network Address Translation (NAT) A procedure by which a router changes data in packets to modify the network addresses. This allows a router to conceal the addresses of network hosts on one side of it. Perimeter network A network added between a protected network and an external network in order to provide an additional layer of security. A perimeter network is sometimes called a DMZ. Proxy A program that deals with external servers on behalf of internal clients Intrusion Prevention System (IPS) a network security / threat prevention technology that examines network traffic flows to detect and prevent vulner ability exploits. Intrusion Detection System (IDS) a network security technology originally built for detecting vulnerability exploits against a target application or computer. host-based logging This approach minimizes the network traffic by transfer ring logs into a centralized log server; however, it incurs significant manage ment overhead to retrieve logging data from individual hosts. centralized logging Individual hosts or networking devices send their logs to a centralized logging service for log management and analysis. decentralized logging Usually built on centralized logging solutions, in which multiple centralized-logging systems can be established to handle specific applications to address the scalability issues. Centralized logging interdependent services Collect logs Transport Store Analyze Alerting Log Collection Centralized logging interdendent service that uses one of two basic approaches 1. The replication approach, where files are replicated to a central server on a fixed schedule. 2. Direct remote logging protocol to send log data when generated from the system without a delay such as syslog. Log Transport frameworks One way is directly plug input sources and framework can start collecting logs and another way is to send log data via API. Log storage factors Time - for how long should logged data be stored? Volume - how huge would the logged data be? Access - how will you access the logs? IEEE 1588 Standard for a Precision Time Protocol (PTP) that enables precise synchronization of clocks in measurement and control systems implemented with technologies such as network communication, local computing, and distributed objects. SDLC 5 phases Initiation Acquisition and development Implementation Operations and maintenance Disposition SDLC Initiation Phase Security categorization Preliminary risk assessment SDLC Acquisition and Development Phase Risk assessment Security functional requirements analysis Security assurance requirements analysis Cost considerations and reporting Security planning Security control development Developmental security test and evaluation Other planning components SDLC Implementation Phase Inspection and acceptance System integration Security certification Security accreditation SDLC Operations and Maintenance Phase Configuration management and control Continuous monitoring SDLC Disposition Phase Information preservation Media sanitization Hardware and software disposal Secure Boot technology that can help maintain validation and assurance of Boot Integrity. Provides assurance that the code loaded in VNF execution environment is authentic, and has not been tampered with. TAP or SPAN port IDS solutions will often use to analyze a copy of the inline traffic stream (and thus ensuring that IDS does not impact inline network performance). Resource isolation methods physical segregation of hardware resources rate-limiting the usage of VNF resources Divide resources scheduling mechanism (round-robin/fair-queue) bastion host Attached to the perimeter network and this host is the main point of contact for incoming connections from the outside world. SDN Security mechanisms Replication Diversity Automated Recovery Dynamic Device Association Controller-Switch trust Controller-App plane trust Security domains Side-channel attacks Data-plane attack where the attacker can observe the processing time of the control plane in order to learn the network configuration. VM-FW-R1 NIST 800-125B recommendation that states in virtualized environments with VMs running delay sensitive applications, virtual firewalls should be deployed for traffic flow control instead of physical fi rewalls VM-FW-R2 NIST 800-125B recommendation that states in virtualized environments with VMs running I / O intensive applications, kernel-based virtual firewalls should be deployed instead of subnet-level virtual firewalls, VM-FW-R3 NIST 800-125B recommendation that states for both subnet-level and kernel-based virtual firewalls, it is preferable if the firewall is integrated with a virtualization management platform rather than being accessible only through a stand alone console. VM-FW-R4 NIST 800-125B recommendation that states for both subnet-level and kernel-based virtual firewalls, it is preferable that the firewall supports rules using higher-level components or abstractions (e.g., security group) in addition to the basic 5-tuple (source / destination IP address, source / destination ports, protocol). Chef a configuration management tool written in Ruby and uses a pure Ruby, domain-specific language (DSL) for writing system configuration "recipes" These recipes which are grouped together and called a cookbook for easier management, describe a series of resources in an optimal state Ansible An open-source suite of tools for software provisioning, configuration management, and application deployment agentless and relies on temporary remote connections (over standard SSH by default) without installing agents on the controlled node. Works with "playbooks" which are configuration files written in YAML and are used to store automation instructions. Puppet Most well-known and matured configuration management tool Uses specific modules written in either using its own declarative language or a Ruby DSL (domain-specific language) for configuration management. Apstra Juniper software that automates and validates your data center network design, deployment, and operations across a wide range of vendors. Benefits of NFV Automating the orchestration and management lets an NFVI be more scalable and achieve better resource utilization. Using generic server hardware that can act as any number of network devices instead of specialized hardware that perform singular functions helps reduce both operational and capital expenditures. virtualization offers carriers the ability to offer pay-as-you-go services without huge up-front investment. Avoiding proprietary hardware empowers administrators with a streamlined provisioning process. Domain Name System (DNS) a hierarchical decentralized naming system for computers, services, or other resources connected to the Internet or a private network. PREROUTING NAT table chain that is done at first when a packet is received and is thus routed based on where it is going (destination). POSTROUTING After all other routing rules have been applied, the NAT chain that will determine where it goes based on where it came from (source). iptables The basic firewall software most commonly used in Linux netfilter framework The iptables firewall works by interacting with the packet filtering hooks in the Linux kernel's networking stack. It is a command-line interface to the packet filtering functionality in netfilter. Application layer Contains the typical network applications or functions organizations use and talk to control layer via NBI Control layer Represents the centralized SDN controller software that acts as the brain of the software-defined network. Communicates with Application layer via NBI and the Infrastructure layer via SBI. Infrastructure layer is made up of the physical switches in the network. These switches forward the network traffic to their destinations and communicates with control layer via SBI. physical network Visible and physically presented to connect physical computers. logical network A virtual representation of a network that appears to the user as an entirely separate and self-contained network even though it might physically be only a portion of a larger network or a local area network. overlay network A virtual network of nodes and logical links that are built on top of an existing network with the purpose of implementing a net work service that is not available in the existing network. Address Resolution Protocol (ARP) A communication protocol used for discovering the link layer address, such as a MAC address, associated with a given network layer address, typically an IPv4 address. Role-based access control (RBAC) Concept that is used to create differentiated access based on entitlement to administer a network device or controller VNFM (VNF Manager) Responsible for basic lifecycle management operations such as create / update / delete, platform aware NFV load optimization, health monitoring, auto-scaling and VNF configuration management operations. NFV Catalog Consists of VNF Descriptors, Network Service Descriptors and VNF Forwarding Graph Descriptors NFVO (NFV Orchestrator) Responsible for VIM resource check and allocation, SFC management using VNF Forwarding Graph descriptor, VNF placement policy, network service deployment using decomposed VNFs. Security mechanism - Replication Can help in dealing with cases of controller or application failures due to a high volume of traf fi c or software vulnerabilities. Security mechanism - Diversity Improves the robustness and intrusion tolerance. The use of diverse controllers can help reduce lateral movement of an attacker and cascading system failures caused by common vulnerabilities. Security mechanism - Automated Recovery In the case of security attacks, leading to service disruption, the proactive and reactive security recovery mecha nisms can help in maintaining optimal service availability. Security mechanism - Dynamic Device Association Helps in dealing with faults (crash or Byzantine). Other advantages include load balancing feature provided by diverse controllers (reduced service latency). Security mechanism - Controller-Switch Trust A trust establishment mechanism between the controller and switch is important to deal with cases of fake flows being inserted by malicious switches. Security mechanism - Controller-App Plane Trust Controller and application plane components should use autonomic trust management mecha nisms based on mutual-trust and delegated trust (3rd part such as the Certi fi cate Authority to establish trust). Security mechanism - Security Domains Help in segmenting the network into different levels of trust, and containment of the threats to only the affected section in the SDN framework. Clustering Adds a layer of defense against the controller being a single point of failure by having one or more controllers in an active / standby scenario. MTD - Shuffling Involves rearrangement of resources at various layers. Some examples include migration of VM from one physical server to another, application migration, instruction set randomization (ISR), etc. MTD - Diversification Modify the network function or software responsible for the functioning of an application or the underlying compiler to diversify the attack surface. MTD - Redundancy Creates multiple replicas of a network component in order to maintain an optimal level of service in case of network attacks like DDoS attacks. Another benefit is that we can create decoys in the network for increasing the discovery time of the actual target. Network Level MTD Requires a change in the network parameters, such as network con fi guration, network connection obfuscation and Routing Randomization. Host Level MTD Requires a change in host resources, OS, and renaming of con fi gurations. Application Level MTD Involves a change in the application required, source code, memory mapping, and software version. Common Vulnerability Scoring System (CVSS) An open-source framework that defines characteristics of software vulnerabilities. Proactive security Refers to a new paradigm of security management, where instead of defending the network infrastructure by detecting, preventing, tracking and remediation of threats, attack surface is changed over time. asset Anything of value to an organization