Module 19 - Technologies and protocols

Question 1

Which logging standard allows devices from various vendors to send event messages to a centralized log server?

Answer 1

Syslog

Question 2

Which type of attack might target syslog servers to conceal data exfiltration or tamper with detection logs?

Answer 2

Blocking log transmission

Question 2

Which port must be open on a syslog server to receive log messages from clients?

Answer 2

UDP port 514

Question 3

Which syslog implementation enhances security against exploits targeting traditional syslog?

Answer 3

syslog-ng

Question 4

Which protocol ensures synchronized timestamps across network devices to support accurate event correlation?

Answer 4

NTP (Network Time Protocol)

Question 5

Which port does NTP use to synchronize time across network devices?

Answer 5

UDP port 123

Question 6

Which technique allows attackers to hide data in DNS queries to evade security measures?

Answer 6

DNS data Exfiltration

Question 7

Which encoded formats are commonly used in malicious DNS subdomains to mask stolen data? (3)

Answer 7

Base64, Hex and 8-bit binary

Question 7

Which DNS request behavior may indicate the presence of hidden exfiltration activities?

Answer 7

Long, random looking subdomains

Question 8

Which type of DNS service can detect and block communications to known CnC or exploit domains?

Answer 8

Cisco Umbrella

Question 8

Which web protocol transmits all data in plaintext, making it vulnerable to interception and alteration?

Answer 8

HTTP

Question 9

Which log source can analysts examine to detect anomalies in DNS request lengths and subdomain patterns?

Answer 9

DNS proxy logs

Question 10

Which method allows security appliances to inspect encrypted HTTPS traffic for threats?

Answer 10

SSL decryption and inspection

Question 10

Which common attack involves inserting hidden malicious content in a webpage that redirects browsers to malware?

Answer 10

iFrame injection attack

Question 10

Which protocol protects HTTP traffic during transmission by encrypting it with SSL/TLS?

Answer 10

HTTPS

Question 11

Which email protocol is used to send data between mail servers and can be exploited for data exfiltration?

Answer 11

SMTP

Question 12

Which email protocols are commonly used to download messages from a server and may deliver malware attachments?

Answer 12

POP3 and IMAP

Question 13

Which protocol is used for diagnostic and control messages but can be exploited for mapping, DoS, or tunneling?

Answer 13

ICMP

Question 14

Which exploit method uses crafted ICMP packets to covertly transfer data from a compromised system?

Answer 14

ICMP tunneling

Question 15

Which network control mechanism filters traffic based on IPs, protocols, and ports but can create a false sense of security if overly relied upon?

Answer 15

ACLs

Question 16

What are some ways attackers can bypass ACLs by manipulating protocol traffic?

Answer 16

By spoofing IP address

Question 17

Which popular P2P application uses distributed ledger sharing and is commonly associated with cryptocurrency transactions?

Answer 17

Bitcoin

Question 18

Which security solutions can address limitations of static ACL-based filtering by using behavior and context-based analysis?

Answer 18

Cisco AMP (advanced malware protection)

Question 19

Which version of NAT allows many internal devices to share one public IP by assigning unique source port numbers?

Answer 19

PAT (Port address translation)

Question 20

Which technology hides internal IP addresses from external visibility by translating them to public-facing addresses?

Answer 20

NAT (Network address translation)

Question 21

Which networking model allows hosts to act as both client and server, and includes file sharing, processor sharing, and instant messaging?

Answer 21

P2P (Peer to peer) networkinng

Question 22

Which messaging service type is classified under P2P and can pose risks unless specialized secure applications are used?

Answer 22

IM (Instant messaging)

Question 23

Which form of P2P networking distributes computational tasks, often for scientific research or charitable purposes?

Answer 23

P2P processor sharing

Question 24

Which anonymizing network uses layered encryption (onion routing) to conceal the source and destination of internet traffic?

Answer 24

Tor

Question 25

Which feature of Tor ensures that no single router knows the full traffic route, enhancing anonymity?

Answer 25

Layered encryption

Question 26

Which network process distributes traffic between devices or paths to prevent overwhelming a single resource?

Answer 26

Load balancing

Question 27

Which domain-based technique allows load balancing by associating a single domain name with multiple IP addresses?

Answer 27

DNS based Load balancing

Question 28

Which component sends probes to test server health and path performance to ensure traffic isn't routed to unavailable resources?

Answer 28

LBM (Load balancing manager)