Explain the purpose of Data Link Layer and also draw the diagram for the same.

The Data Link layer is responsible for 

• Communications between end-device network interface cards.
• It allows upper layer protocols to access the physical layer media and encapsulates Layer 3 packets (IPv4 and IPv6) into Layer 2 Frames.
• It also performs error detection and rejects corrupts frames.

The Data Link Layer consists of two sublayers. 

1. Logical Link Control (LLC) and 
2. Media Access Control (MAC).

The LLC sublayer communicates between the networking software at the upper layers and the device hardware at the lower layers.

The MAC sublayer is responsible for data encapsulation and media access control.

What do you mean by Frame in Data Link Layer? Write about the frame fields.

 

Data is encapsulated by the data link layer with a header and a trailer to form a frame.

A data link frame has three parts:

1. Header 
2. Data
3. Trailer

The fields of the header and trailer vary according to data link layer protocol.

The amount of control information carried with in the frame varies according to access control information and logical topology.

Frame Fields: 

Write the definition for the given terms.

Topology - The topology of a network is the arrangement and relationship of the network devices and the interconnections between them. 

Physical topology – shows physical connections and how devices are interconnected.

Logical topology – identifies the virtual connections between devices using device interfaces and IP addressing schemes.

Explain Physical LAN Topologies.

 

End devices on LANs are typically interconnected using a star or extended star topology. Star and extended star topologies are easy to install, very scalable and easy to troubleshoot.

Early Ethernet and Legacy Token Ring technologies provide two additional topologies:

Bus – All end systems chained together and terminated on each end.

Ring – Each end system is connected to its respective neighbors to form a ring.

Keep Yourself Connected

 

Chapter 5.1: Common Equipment Problems: 

Exploring the Human Network

 

Chapter 4.1: Virtual Communities: 

Chapter 4.2: Opportunities for Study and Work: 

Chapter 4.3: Social Networks: 

Chapter 4.4: Tools on the Web: 

All About the Internet

 

Chapter 3.1: Computer Networks: 

Chapter 3.2: Internet: 

Chapter 3.3: Surfing the Internet: 

Chapter 3.4: ISPs and Connection Types: 

Chapter 3.5: Search: 

Chapter 3.6: Email: 

Files and Directories

Chapter 2.1: Exploring the folders, files, and programs:  

Chapter 2.2: Editing a document:  

Introduction to Computer - Basic Level [Get Connected: Couse from Cisco Network Academy]

Introductory course for students interested in learning the basics of IT, including the Internet, social media, and the relevance to everyone.

Introduction to the Course: 

Module of the chapter is given below. 

1. Computer Basics - Click Here
2. Files and Directories - Click Here
3. All About the Internet - Click Here
4. Exploring the Human Network - Click Here - Click Here
5. Keep Yourself Connected - Click Here

1	Computer Basics - Click Here	Identify different types of computer systems, internal components, and peripherals.
2	Files and Directories - Click Here	Understand the directory structure of Microsoft Windows and how to work with files and folders using a text editor.
3	All About the Internet - Click Here	Understand computer networking, how to browse and search the Internet, and how to use email.
4	Exploring the Human Network - Click Here - Click Here	Create and use various types of social media accounts, including Facebook, LinkedIn, and YouTube.
5	Keep Yourself Connected - Click Here	Identify common problems and implement simple solutions for hardware, software, and networks.

Computer Basics

Chapter 1.1: Types of Equipment:  

Chapter 1.2: Starting a Piece of Equipment: 

Chapter 1.3: Mouse: 

Chapter 1.4: Keyboard: 

Chapter 1.5: Icon:  

Chapter 1.6: Operating System: 

Module 11 IPv4 Addressing - Question

 Module 11 IPv4 Addressing

1. Find the Network Address for given host address.

1. 172.19.1.208
2. 172.31.102.209
3. 10.219.116.14
4. 172.30.183.116
5. 10.160.70.240
6. 172.18.62.105

2. You are given the number of hosts that are needed. Determine the subnet mask that would support the number of hosts as specified. Enter your answers in binary, decimal, and prefix notation format in the fields provided.

3. Tick public or private below each address to choose the correct network type.

4.  Do the FLSM for requirement of 50 host in Class C IP Address. 

5.  Do the FLSM for requirement of 30 host in Class C IP Address. 

6.  Do the FLSM for requirement of 20 host in Class C IP Address. 

7.  Do the FLSM for requirement of 1000 host in Class B IP Address. 

8.  Do the FLSM for requirement of 16000 host in Class A IP Address. 

Module 6 Data Link Layer - Question

 Module 6 Data Link Layer

1. Write the definition for the given terms. - Click Here

2. Explain Physical LAN Topologies. - Click Here

3. What do you mean by Frame in Data Link Layer? Write about the frame fields. - Click Here

4. Explain the purpose of Data Link Layer and also draw the diagram for the same. - Click Here

Module 5 Number Systems - Question

 Module 5 Number Systems

What do you mean by Amazon Macie, Amazon Inspector and Amazon GuardDuty?

 

Amazon Macie is a security service that uses machine learning to automatically discover, classify, and protect sensitive data in AWS. Amazon Macie recognizes sensitive data such as personally identifiable information (PII) or intellectual property. It provides you with dashboards and alerts that give visibility into how this data is being accessed or moved. Amazon Macie is a fully managed service that continuously monitors data access activity for anomalies, and it generates detailed alerts when it detects risk of unauthorized access or inadvertent data leaks. Amazon Macie is currently available to protect data that is stored in Amazon S3.

Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications that are deployed on AWS. Amazon Inspector automatically assesses applications for exposure, vulnerabilities, and deviations from best practices. After performing an assessment, Amazon Inspector produces a detailed list of security findings that are listed by level of severity. These findings can be reviewed directly or as part of detailed assessment reports that are available via the Amazon Inspector console or the API.

Amazon GuardDuty is a threat-detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads. With the cloud, the collection and aggregation of account and network activities is simplified, but it can be time consuming for security teams to continuously analyze event log data for potential threats. GuardDuty uses machine learning, anomaly detection, and integrated threat intelligence to identify and rank potential threats. GuardDuty analyzes tens of billions of events across multiple AWS data sources, such as AWS CloudTrail, Amazon VPC Flow Logs, and Domain Name System(DNS) logs.

How AWS is securing their data at rest and at transit?

 

Data encryption is an essential tool to use when your objective is to protect digital data. Data encryption takes data that is legible and encodes it so that it is unreadable to anyone who does not have access to the secret key that can be used to decode it. Thus, even if an attacker gains access to your data, they cannot make sense of it.

Data at rest refers to data that is physically stored on disk or on tape.

You can create encrypted file systems on AWS so that all your data and metadata is encrypted at rest by using the open standard Advanced Encryption Standard (AES)-256 encryption algorithm. When you use AWS KMS, encryption and decryption are handled automatically and transparently, so that you do not need to modify your applications. If your organization is subject to corporate or regulatory policies that require encryption of data and metadata at rest, AWS recommends enabling encryption on all services that store your data. You can encrypt data stored in any service that is supported by AWS KMS.

Data in transit refers to data that is moving across the network. Encryption of data in transit is accomplished by using Transport Layer Security (TLS) 1.2 with an open standard AES-256  cipher. TLS was formerly called Secure Sockets Layer (SSL).

AWS Certificate Manager is a service that enables you to provision, manage, and deploy SSL or TLS certificates for use with AWS services and your internal connected resources. SSL or TLS certificates are used to secure network communications and establish the identity of websites over the internet, and also resources on private networks. With AWS Certificate Manager, you can request a certificate and then deploy it on AWS resources (such as load balancers or CloudFront distributions). AWS Certificate Manager also handles certificate renewals.

Web traffic that runs over HTTP is not secure. However, traffic that runs over Secure HTTP (HTTPS) is encrypted by using TLS or SSL. HTTPS traffic is protected against eavesdropping and man-in-the-middle attacks because of the bidirectional encryption of the communication.

What is AWS Key Management Service (AWS KMS), Amazon Cognito, and AWS Shield?

 

AWS Key Management Service (AWS KMS) is a service that enables you to create and manage encryption keys, and to control the use of encryption across a wide range of AWS services and your applications. AWS KMS is a secure and resilient service that uses hardware security modules (HSMs) that were validated under Federal Information Processing Standards (FIPS) 140-2 (or are in the process of being validated) to protect your keys. AWS KMS also integrates with AWS CloudTrail to provide you with logs of all key usage to help meet your regulatory and compliance needs.

Customer master keys (CMKs) are used to control access to data encryption keys that encrypt and decrypt your data. You can create new keys when you want, and you can manage who has access to these keys and who can use them. You can also import keys from your own key management infrastructure into AWS KMS. AWS KMS integrates with most AWS services, which means that you can use AWS KMS CMKs to control the encryption of the data that you store in these services.

Amazon Cognito provides solutions to control access to AWS resources from your application. You can define roles and map users to different roles so your application can access only the resources that are authorized for each user.

Amazon Cognito uses common identity management standards, such as Security Assertion Markup Language (SAML) 2.0. SAML is an open standard for exchanging identity and security information with applications and service providers. Applications and service providers that support SAML enable you to sign in by using your corporate directory credentials, such as your username and password from Microsoft Active Directory. With SAML, you can use single sign-on (SSO) to sign in to all of your SAML-enabled applications by using a single set of credentials.

Amazon Cognito helps you meet multiple security and compliance requirements, including requirements for highly regulated organizations such as healthcare companies and merchants.

AWS Shield is a managed distributed denial of service (DDoS) protection service that safeguards applications that run on AWS. It provides always-on detection and automatic inline mitigations that minimize application downtime and latency, so there is no need to engage AWS Support to benefit from DDoS protection.

AWS Shield helps protects your website from all types of DDoS attacks, including Infrastructure layer attacks (like User Datagram Protocol—or UDP—floods), state exhaustion attacks (like TCP SYN floods), and application-layer attacks (like HTTP GET or POST floods)

What do you mean by IAM role? Give one example of IAM role.

 

An IAM role is an IAM identity you can create in your account that has specific permissions. An IAM role is similar to an IAM user because it is also an AWS identity that you can attach permissions policies to, and those permissions determine what the identity can and cannot do in AWS. However, instead of being uniquely associated with one person, a role is intended to be assumable by anyone who needs it. Also, a role does not have standard long-term credentials such as a password or access keys associated with it. Instead, when you assume a role, the role provides you with temporary security credentials for your role session.

You can use roles to delegate access to users, applications, or services that do not normally have access to your AWS resources. For example, you might want to grant users in your AWS account access to resources they don't usually have, or grant users in one AWS account access to resources in another account. Or you might want to allow a mobile app to use AWS resources, but you do not want to embed AWS keys within the app (where the keys can be difficult to rotate and where users can potentially extract them and misuse them). Also, sometimes you may want to grant AWS access to users who already have identities that are defined outside of AWS, such as in your corporate directory. Or, you might want to grant access to your account to third parties so that they can perform an audit on your resources. For all of these example use cases, IAM roles are an essential component to implementing the cloud deployment.

Example:

In the diagram, a developer runs an application on an EC2 instance that requires access to the S3 bucket that is named photos. An administrator creates the IAM role and attaches the role to the EC2 instance. The role includes a permissions policy that grants read-only access to the specified S3 bucket. It also includes a trust policy that allows the EC2 instance to assume the role and retrieve the temporary credentials. When the application runs on the instance, it can use the role's temporary credentials to access the photos bucket. The administrator does not need to grant the application developer permission to access the photos bucket, and the developer never needs to share or manage credentials.

What do you mean by IAM groups? What are the Important characteristics of IAM groups?

 

An IAM group is a collection of IAM users. IAM groups offer a convenient way to specify permissions for a collection of users, which can make it easier to manage the permissions for those users.

For example, you could create an IAM group that is called Developers and attach an IAM policy or multiple IAM policies to the Developers group that grant the AWS resource access permissions that developers typically need. Any user that you then add to the Developer group will automatically have the permissions that are assigned to the group. In such a case, you do not need to attach the IAM policy or IAM policies directly to the user. If a new user joins your organization and should be granted developer privileges, you can simply add that user to the Developers group. Similarly, if a person changes jobs in your organization, instead of editing that user's permissions, simply remove the user from the group.

Important characteristics of IAM groups:

• A group can contain many users, and a user can belong to multiple groups.

• Groups cannot be nested. A group can contain only users, and a group cannot contain other groups.

• There is no default group that automatically includes all users in the AWS account. If you want to have a group with all account users in it, you need to create the group and add each new user to it.

What do you mean by IAM policy? What are the types of IAM policies?

 

An IAM policy is a formal statement of permissions that will be granted to an entity. Policies can be attached to any IAM entity. Entities include users, groups, roles, or resources. For example, you can attach a policy to AWS resources that will block all requests that do not come from an approved Internet Protocol (IP) address range. Policies specify what actions are allowed, which resources to allow the actions on, and what the effect will be when the user requests access to the resources.

The order in which the policies are evaluated has no effect on the outcome of the evaluation. All policies are evaluated, and the result is always that the request is either allowed or denied. When there is a conflict, the most restrictive policy applies.

There are two types of IAM policies. 

1. Identity-based policies are permissions policies that you can attach to a principal (or identity) such as an IAM user, role, or group. These policies control what actions that identity can perform, on which resources, and under what conditions. Identity-based policies can be further categorized as:

    • Managed policies – Standalone identity-based policies that you can attach to multiple users,             groups, and roles in your AWS account

    • Inline policies – Policies that you create and manage, and that are embedded directly into a                 single user group or role.

2. Resource-based policies are JSON policy documents that you attach to a resource, such as an S3 bucket. These policies control what actions a specified principal can perform on that resource, and under what conditions.

What do you mean by Authorization? Explain IAM – Authorization.

 

Authorization is the process of determining what permissions a user, service or application  should be granted. After a user has been authenticated, they must be authorized to access AWS services. 

By default, IAM users do not have permissions to access any resources or data in an AWS account. Instead, you must explicitly grant permissions to a user, group, or role by creating a policy, which is a document in JavaScript Object Notation (JSON) format. A policy lists permissions that allow or deny access to resources in the AWS account.

To assign permission to a user, group or role, you must create an IAM policy (or find an existing policy in the account). There are no default permissions. All actions in the account are denied to the user by default (implicit deny) unless those actions are explicitly allowed. Any actions that you do not explicitly allow are denied. Any actions that you explicitly deny are always denied.

The principle of least privilege is an important concept in computer security. It promotes that you grant only the minimal user privileges needed to the user, based on the needs of your users. When you create IAM policies, it is a best practice to follow this security advice of granting least privilege. Determine what users need to be able to do and then craft policies for them that let the users perform only those tasks. Start with a minimum set of permissions and grant additional permissions as necessary. Doing so is more secure than starting with permissions that are too broad and then later trying to lock down the permissions granted.

Note that the scope of the IAM service configurations is global. The settings are not defined at an AWS Region level. IAM settings apply across all AWS Regions.