Network Security Basics Practice Questions

Man-in-the-Middle (MITM) attack: the attacker positions themselves between two communicating parties (Alice and Bob), intercepting and potentially modifying all communication. Alice thinks she is talking to Bob; Bob thinks he is talking to Alice. The attacker can: read confidential messages (eavesdropping), modify messages (data tampering), inject false messages, relay legitimate messages with slight modifications. MITM attacks against Diffie-Hellman: attacker intercepts A and B, establishes separate DH exchanges with Alice and Bob. Prevention: digital certificates and PKI (Public Key Infrastructure) bind public keys to identities, preventing MITM. B describes DoS/DDoS; C describes brute force/dictionary attack; D describes SQL injection.

TLS (the successor to SSL) provides: A: Confidentiality - after the handshake, a symmetric session key (e.g., AES) is used to encrypt all data. B: Server authentication - the server presents a digital certificate (signed by a Certificate Authority) containing its public key; the client verifies the certificate chain. Client authentication is optional. C: Integrity - each record is protected with a MAC (HMAC) to detect tampering. TLS handshake: (1) Client Hello (cipher suites, random nonce). (2) Server Hello + Certificate. (3) Key exchange (RSA or Diffie-Hellman). (4) Change Cipher Spec. (5) Finished (verified with master secret). D is FALSE - TLS operates at the Application/Transport layer boundary (between Layer 4 and Layer 7), not the Network Layer.

Digital signatures provide: A: Authentication - only the entity with the private key could have created the signature; the recipient verifies using the sender's public key. B: Non-repudiation - since only the sender has the private key, they cannot deny signing the message (unlike a MAC which requires a shared secret key that both parties know). C: Integrity - the signature is computed over the message (typically its hash); any modification to the message invalidates the signature. D: Confidentiality - digital signatures do NOT provide confidentiality; the message is still sent in plaintext (or separately encrypted). To add confidentiality, the message must also be encrypted.

Firewall types: A: Packet filter (stateless): examines each packet independently based on ACL rules (src/dst IP, src/dst port, protocol). Fast but cannot track connection state. B: Stateful inspection: maintains a state table of active TCP/UDP connections. Allows return traffic for established connections without explicit rules. More secure than stateless - can detect port scanning, invalid TCP flags. C: Application layer firewall (proxy/WAF): operates at Layer 7, can inspect HTTP content, detect SQL injection, cross-site scripting, malware. Next-generation firewalls (NGFW) combine all three. D is FALSE - firewalls typically log traffic and generate alerts for suspicious patterns (IDS/IPS functionality).

A digital signature provides authentication (verifies the sender's identity) and non-repudiation (the sender cannot deny sending the message). It does not provide confidentiality (the message is not encrypted by the signature).

A digital certificate (X.509 format) contains: subject (entity name/domain), subject's public key, issuer (CA name), validity period (not before/not after), serial number, and CA's digital signature over all fields. The CA's signature (using CA's private key) allows anyone with the CA's public key to verify the certificate's authenticity. Problem solved: without certificates, how does Alice know that the public key she received is truly Bob's? A CA vouches for this binding: CA's signature = 'I, the CA, certify that this public key belongs to Bob'. Certificate chains: leaf certificate → intermediate CA → root CA. Root CAs are pre-installed in browsers/OS as trust anchors.

Collision resistance means it is computationally infeasible to find two distinct messages $m_1 \neq m_2$ such that $H(m_1) = H(m_2)$. By the birthday paradox, $2^{n/2}$ attempts suffice for an $n$-bit hash.

AES (Advanced Encryption Standard) is a symmetric key algorithm - the same key is used for both encryption and decryption. RSA, Diffie-Hellman, and ECC are asymmetric (public-key) algorithms.

A packet filter (stateless) firewall examines each packet independently based on header information (source/destination IP, ports, protocol) without tracking connection state.

MAC (Message Authentication Code): computed using a shared secret key K - MAC = H(K || m) or HMAC(K, m). Provides: integrity (detects tampering) and authentication (only parties with key K can create/verify). Does NOT provide non-repudiation - since both parties share K, either could have created the MAC. Digital Signature: computed using sender's private key. Provides: integrity, authentication, AND non-repudiation - only the sender has the private key, so the sender cannot deny signing. Trade-off: MACs are faster (symmetric operations); signatures enable non-repudiation and don't require pre-shared keys but are slower (asymmetric operations).

VPN (Virtual Private Network): creates a secure, encrypted tunnel between a remote user/site and a private network over the public internet. How it works: (1) Authentication - user authenticates to VPN gateway using credentials/certificates. (2) Tunnel establishment - IPsec or TLS/SSL creates an encrypted tunnel. (3) Encapsulation - private network packets are encapsulated (and encrypted) inside public network packets. (4) The remote user appears to be on the private network with a private IP address. Types: Remote Access VPN (road warrior to corporate), Site-to-Site VPN (branch office to HQ using IPsec). Technologies: IPsec VPN, SSL VPN, OpenVPN, WireGuard. VPN provides confidentiality, integrity, and authentication for traffic over untrusted networks.

HTTPS (HTTP Secure): HTTP over TLS/SSL. Default port: 443 (HTTP uses port 80). Differences from HTTP: (1) Confidentiality - all HTTP data (headers, body, URLs) is encrypted using symmetric key negotiated in TLS handshake. (2) Server authentication - server presents TLS certificate; browser verifies against trusted CAs - prevents visiting fake sites. (3) Integrity - TLS MAC protects each record from tampering. The green padlock/lock icon in browsers indicates HTTPS. HSTS (HTTP Strict Transport Security) forces HTTPS on subsequent visits. TLS operates between TCP (Layer 4) and HTTP (Layer 7), providing a secure channel while HTTP runs unchanged above it.

For confidentiality, the sender encrypts with the recipient's public key. Only Bob can decrypt it using his private key. If Alice used her private key, anyone with Alice's public key could decrypt it (this is used for digital signatures, not confidentiality).