312-50v12 Practice Test

Kismet

Explanation:
https://en.wikipedia.org/wiki/Kismet_(software)
Kismet is a network detector, packet sniffer, and intrusion detection system for 802.11
wireless LANs. Kismet will work with any wireless card which supports raw monitoring
mode, and can sniff 802.11a, 802.11b, 802.11g, and 802.11n traffic

Brute force

Explanation: Brute-force attack when an attacker uses a set of predefined values to attack
a target and analyze the response until he succeeds. Success depends on the set of
predefined values. It will take more time if it is larger, but there is a better probability of
success. In a traditional brute-force attack, the passcode or password is incrementally
increased by one letter/number each time until the right passcode/password is found.

Application

Explanation:
https://en.wikipedia.org/wiki/Internet_Relay_Chat
Internet Relay Chat (IRC) is an application layer protocol that facilitates communication in
text. The chat process works on a client/server networking model. IRC clients are computer
programs that users can install on their system or web-based applications running either
locally in the browser or on a third-party server. These clients communicate with chat
servers to transfer messages to other clients.
IRC is a plaintext protocol that is officially assigned port 194, according to IANA. However,
running the service on this port requires running it with root-level permissions, which is
inadvisable. As a result, the well-known port for IRC is 6667, a high-number port that does
not require elevated privileges. However, an IRC server can also be configured to run on
other ports as well.
You can't tell if an IRC server is designed to be malicious solely based on port number.
Still, if you see an IRC server running on port a WKP such as 80, 8080, 53, 443, it's almost
always going to be malicious; the only real reason for IRCD to be running on port 80 is to
try to evade firewalls.
https://en.wikipedia.org/wiki/Application_firewall
An application firewall is a form of firewall that controls input/output or system calls of an
application or service. It operates by monitoring and blocking communications based on a
configured policy, generally with predefined rule sets to choose from. The application
firewall can control communications up to the OSI model's application layer, which is the
highest operating layer, and where it gets its name. The two primary categories of
application firewalls are network-based and host-based.
Application layer filtering operates at a higher level than traditional security appliances. This
allows packet decisions to be made based on more than just source/destination IP
Addresses or ports. It can also use information spanning across multiple connections for
any given host.
Network-based application firewalls
Network-based application firewalls operate at the application layer of a TCP/IP stack.
They can understand certain applications and protocols such as File Transfer Protocol (FTP), Domain Name System (DNS), or Hypertext Transfer Protocol (HTTP). This allows it
to identify unwanted applications or services using a non-standard port or detect if an
allowed protocol is being abused.
Host-based application firewalls
A host-based application firewall monitors application system calls or other general system
communication. This gives more granularity and control but is limited to only protecting the
host it is running on. Control is applied by filtering on a per-process basis. Generally, prompts are used to define rules for processes that have not yet received a connection.
Further filtering can be done by examining the process ID of the owner of the data packets.
Many host-based application firewalls are combined or used in conjunction with a packet
filter.

Educate everyone with books, articles and training on risk analysis, vulnerabilities and
safeguards.

Administrative safeguards