IT Infrastructure Fundamentals: Networking, Storage, and Security

Digital certificates for authentication must be installed on every computer the user wishes to work from. This is a significant disadvantage because it creates management overhead - users cannot easily work from new or temporary machines without certificate installation. Unlike passwords or tokens, certificates are tied to specific devices. The other options are not primary disadvantages - digital signatures are not resource-intensive relative to modern systems, certificates are economical to issue, and they are highly reliable when properly managed.

The Key Distribution Center (KDC) is the central trusted third party in Kerberos that issues all types of tickets. The KDC consists of two components: the Authentication Server (AS) which issues the initial Ticket Granting Ticket (TGT), and the Ticket Granting Server (TGS) which issues service tickets (session tickets) for specific resources. When a user needs to access a service, the KDC validates their TGT and issues a session ticket that grants access to that service. The Security Identifier (SID) is a Windows security concept unrelated to Kerberos ticket issuance.

Kerberos uses symmetric encryption for user authentication. When a user first authenticates, their password is used to derive a symmetric key that is shared with the KDC. This symmetric key encrypts the initial authentication request and subsequent ticket exchanges. The symmetric key allows both the user and KDC to encrypt and decrypt messages, establishing trust without transmitting the password itself. Digital signatures (asymmetric encryption) are used in some PKI-based systems but not in core Kerberos authentication.

CHAP (Challenge Handshake Authentication Protocol) uses a one-way hash function to authenticate the remote client without sending the actual password across the link. The server sends a random challenge, the client computes a hash of the challenge combined with their password using a one-way algorithm like MD5, and sends back the hash value. The server performs the same calculation and compares results. This prevents plaintext password transmission and protects against replay attacks since each challenge is unique. Digital signatures require asymmetric encryption which CHAP does not use.

When a buffer receives more data than its allocated capacity, the excess data overflows into adjacent memory locations, corrupting or overwriting whatever valid data or instructions are stored there. This is a buffer overflow vulnerability. Attackers can exploit this by carefully crafting the excess data to overwrite return addresses or inject malicious code, potentially taking control of the program. The other options are incorrect: buffers are physical memory allocations with no bounce-back mechanism, data is not absorbed by networks, and compilers do not automatically remove excess data at runtime.

In a flooding DoS attack, the attacker bombards a target resource with an overwhelming volume of data or TCP/IP packets that exceeds its processing capacity. This saturates the target's bandwidth, connection tables, or processing resources, making it unable to respond to legitimate traffic. Common flooding attacks include SYN floods, ICMP floods, and UDP floods. The terms saturating, inundation, and data-surge are not standard terminology for this attack type in cybersecurity.

IP spoofing is an attack where hackers forge the source IP address in packet headers to disguise their identity or impersonate a trusted system. By using forged IP addresses, attackers can bypass IP-based authentication, launch blind attacks, or make malicious traffic appear to come from a legitimate source. Backdoor attacks involve secret access points, birthday attacks exploit hash collisions, and man-in-the-middle attacks intercept communications (none of which primarily involve forging IP addresses).

A backdoor is a deliberately placed hidden access point in software that bypasses normal authentication mechanisms. As described in the scenario, a programmer could leave an opening during the build phase that allows unauthorized entry later. Attackers can discover and exploit these backdoors to gain unauthorized access to the application or system. Birthday attacks exploit hash collisions, man-in-the-middle attacks intercept communications, and spoofing involves forging identities - none of which match the scenario of a deliberate code opening.

SATAN (Security Administrator Tool for Analyzing Networks) is a well-known vulnerability scanning tool that probes hosts for security weaknesses. It systematically checks for known vulnerabilities, misconfigurations, and potential security issues across network services. Trojans are malicious programs hiding within legitimate software, demons are background processes in Unix, and Unix is an operating system - none of which are vulnerability scanners. Note: SATAN was developed in the 1990s and modern equivalents include Nessus or OpenVAS.

End user education is the most effective defense against social engineering attacks because these attacks target human psychology rather than technical vulnerabilities. Social engineering manipulates people into divulging sensitive information or performing actions through deception, often via phishing emails or phone calls. Training users to recognize manipulation tactics, verify requests, and follow security procedures is critical. Technical controls like firewalls, inbox rules, and intranets cannot prevent users from voluntarily revealing information or performing actions if they are deceived.

A hybrid attack combines dictionary attacks with brute-force techniques, making it most effective against a password like hello1. The attack starts with dictionary words (hello) and then systematically appends, prepends, or substitutes characters (1) to find the password. This is faster than pure brute-force which would try every character combination, and more effective than a pure dictionary attack which would miss simple modifications. A hash attack is not a standard password cracking term.

Striping (RAID 0) spreads data across multiple disks to improve performance through parallel read/write operations. By dividing data into blocks and writing them simultaneously to different disks, I/O bandwidth increases. Parity provides fault tolerance, mirroring provides redundancy, clustering is unrelated.

Mirroring (RAID 1) writes identical data to two (or more) disks, creating redundancy. If one disk fails, the data remains available on the mirror disk. This is a simple but effective redundancy technique. Striping is for performance, parity is for fault tolerance without full duplication.

Mirroring (RAID 1) provides fault tolerance through redundancy without performance degradation during a drive failure. Since both disks have identical data, reads continue normally from the surviving disk. Parity RAID (5/6) requires reconstruction and slows down during failure.

Parity RAID uses parity information to rebuild data if a drive fails, providing fault tolerance without requiring full data duplication. This makes it more storage-efficient than mirroring while still protecting against drive failure. Performance improvement comes from striping, not parity itself.

Data striping spreads data across multiple disks so different parts can be read or written simultaneously. This parallel access significantly improves performance compared to a single disk. Striping alone provides no redundancy.

RAID 5 needs at least 3 disks but uses only 1 disk's worth for parity, making it more storage-efficient than RAID 1 which requires 50% overhead for mirroring. RAID 5 has worse write performance than RAID 1 and similar redundancy levels.

A hot spare is a standby drive that automatically replaces a failed drive in the array, rebuilding data without manual intervention. Hot swap allows manual replacement while running, and cold swap requires system shutdown.

A LAN covers a small geographic area like a single building or campus. WAN spans large distances, MAN covers a city-sized area, and WLAN is wireless LAN. The single-building scope defines a LAN.

In a mesh topology, every node connects directly to every other node. This provides maximum redundancy and shortest paths but requires many connections. Linear, ring, star, and tree have more constrained connection patterns.