Network Security Flashcards
0
Q
What do most firewalls use as the last rule?
A
Implicit deny rule
1
Q
What type of cloud-based service is webmail?
A
Software as a Service (SaaS)
2
Q
What type of attack can a flood guard help prevent?
A
SYN flood attack
3
Q
What can a company use to distribute web-based requests to several web servers hosting the same content?
A
Load balancer
4
Q
What are two common protocols used to secure FTP?
A
File Transfer Protocol Secure (FTPS) and Secure FTP (SFTP)
5
Q
A network is using CAT 5 cable. What can prevent data loss?
A
Shielding
6
Q
What protocol does SFTP use?
A
Secure FTP (SFTP) uses Secure Shell (SSH) over port 22.
Provides restarting and continuing interrupted transfers
Listing directories
Removing remote files
7
Q
What is a wireless device that provides unauthorized access to a network?
A
Rogue access point
8
Q
What is a wireless device that provides unauthorized access to a network and uses the same SSID as an authorized wireless access point?
A
Evil twin
9
Q
What is needed to use WPA2 with an 802.1X server instead of using pre-shared keys?
A
Remote Authentication Dial-in User Service (RADIUS)
10
Q
What should be used to prevent wireless users from accessing other wireless computers through a wireless access point?
A
Isolation mode
11
Q
You want to reduce the success of war driving. What can you do to the WAP?
A
Reduce the power output of the WAP (or adjust the antenna placement)
12
Q
What protocol provides the best security for a wireless network?
A
WPA2
13
Q
What wireless security protocol has been hacked and should not be used?
A
WEP
14
Q
What should be done with the SSID for security?
A
Change default name
15
Q
What can you do with the SSID to hide a wireless network from casual users (but not informed attackers)?
A
Disable said broadcasting
16
Q
What can be used to prevent specific wireless computers from accessing a wireless network?
A
MAC filtering
17
Q
What protocol is used to monitor network devices?
A
Simple Network Management Protocol (SNMP)
18
Q
An organization wants to allow 300 employees to remotely access the corporate network. What is a good choice?
A
Virtual private network (VPN) concentrator
19
Q
What would an organization create to host Internet-based servers but protect servers on an internal network?
A
Demilitarized zone (DMZ)
20
Q
What port would you block to prevent Telnet traffic?
A
Port 23
21
Q
What port does TFTP use?
A
Trivial File Transfer Protocol (TFTP) uses port 69
22
Q
Between UDP and TCP, what does FTP use?
A
File Transfer Protocol (FTP) uses TCP
23
Q
Between UDP and TCP, what does TFTP use?
A
Trivial File Transfer Protocol (TFTP) uses UDP
24
What port does SCP use?
Secure Copy (SCP) uses port 22
25
What port does SMTP use?
Simple Mail Transfer Protocol (SMTP) uses port 25
26
What port does HTTPS use?
Port 443
27
What can an attacker check to determine the services running on a server?
Open ports
28
What should you do with unused ports on a switch for better security?
Disable them
29
```
Your organization uses switches for connectivity. Of the following choices, what will protect the switch?
(A)Disable unused MAC addresses
(B)Disable unused ports
(C)Disable unused IPv4 addresses
(D)Disable unused IPv6 addresses
```
Disabling unused ports is a part of basic port security.
30
```
Of the following choices, what represents the best choice to prevent intrusions on an individual computer?
(A)HIDS
(B)NIDS
(C)Host-based firewall
(D)Network-based firewalls
```
A host-based firewall can help prevent intrusions on individual computers such as a server or desktop computer.
31
```
Of the following choices, what controls traffic between networks?
(A)A firewall
(B)Load balancer
(C)VPN concentrator
(D)Protocol analyzer
```
A firewall controls traffic between networks using rules within an ACL.
32
```
An organization has a web security gateway installed. What function is this performing?
(A)MAC filtering
(B)Caching content
(C)Hiding internal IP addresses
(D)Content filtering
```
A web security gateway performs content filtering (including filtering for malicious attachments, malicious code, blocked URLs and more).
33
```
Your organization hosts a large web site served by multiple servers. They need to optimize the workload and distribute it equally among all the servers. What should they use?
(A)Proxy server
(B)Load balancer
(C)Web security gateway
(D)Security appliance
```
A load balancer can optimize and distribute data loads across multiple computers or multiple networks.
34
```
Of the following choices, what is the best choice for a device to filter and cache content from web pages?
(A)Web security gateway
(B)VPN concentrator
(C)Proxy server
(D)MAC filtering
```
A proxy server includes the ability to filter and cache content from web pages.
35
```
What can an administrator use to detect malicious activity after it occurred?
(A)Firewall
(B)Sniffer
(C)Port scanner
(D)IDS
```
An intrusion detection system (IDS) detects malicious activity after it has occurred.
36
```
Of the following choices, what would detect compromises on a local server?
(A)HIDS
(B)NIPS
(C)Firewall
(D)Protocol analyzer
```
A host-based intrusion detection system (HIDS) can detect attacks (including successful attacks resulting in compromises) on local systems such as workstations and servers.
37
```
Of the following choices, what represents the best choice for a system to detect attacks on a network, but not block them?
(A)NIDS
(B)NIPS
(C)HIDS
(D)HIPS
```
A network-based intrusion detection system (NIDS) will detect attacks, but will not necessarily block them (unless it is an active NIDS).
38
```
Your organization is using a NIDS. The NIDS vendor regularly provides updates for the NIDS to detect known attacks. What type of NIDS is this?
(A)Anomaly-based
(B)Signature-based
(C)Prevention-based
(D)Honey-based
```
Signature-based, network-based intrusion detection systems (NIDS) use signatures similar to antivirus software, which are downloaded regularly as updates.
39
```
You are preparing to deploy an anomaly-based detection system to monitor network activity. What would you create first?
(A)Flood guards
(B)Signatures
(C)Baseline
(D)Honeypot
```
An anomaly-based (also called heuristic or behavior-based) detection system compares current activity with a previously created baseline to detect any anomalies or changes.
40
Of the following choices, what best describes the function of an IPS?
(A)Detect attacks
(B)Stop attacks in progress
(C)Prevent attackers from attacking
(D)Notify appropriate personnel of attacks
The primary purpose of an intrusion prevention system (IPS) is to stop attacks in progress.
41
```
Of the following choices, what provides active protection for an operating system?
(A)NIDS
(B)NIPS
(C)HIDS
(D)HIPS
```
A host-based intrusion prevention system (HIPS) provides active protection for an individual host, including its operating system.
42
Of the following choices, what most accurately describes a NIPS?
(A)Detects and takes action against threats
(B)Provides notification of threats
(C)Detects and eliminates threats
(D)Identifies zero day vulnerabilities
A network-based intrusion prevention system (NIPS) attempts to detect and mitigate threats by taking action to block them.
43
```
An IPS is monitoring data streams looking for malicious behavior. When it detects malicious behavior, it blocks the traffic. What is this IPS using?
(A)Smurf detection
(B)Honeypot
(C)Content inspection
(D)Port scanner
```
Many intrusion prevention systems (IPSs) use content inspection techniques to monitor data streams in search of malicious code or behaviors.
44
```
A user plugged a cable into two RJ-45 wall jacks connected to unused ports on a switch. In a short period, this disrupted the overall network performance. What should you do to protect against this problem in the future?
(A)Enable loop protection on the switch
(B)Disable port security
(C)Create DMZ
(D)Use a VLAN
```
Loop protection such as Spanning Tree Protocol (STP) protects against the switching loop problem described in the scenario.
45
```
What can you use to logically separate computers in two different departments within a company?
(A)A hub
(B)A VLAN
(C)NAT
(D)A flood guard
```
A virtual local area network (VLAN) can group several different computers into a virtual network, or logically separate the computers in two different departments.
46
```
Most firewalls have a default rule placed at the end of the firewalls ACL. Which of the following is the most likely default rule?
(A)Deny any any
(B)Deny ICMP all
(C)Allow all all
(D)Allow TCP all
```
A deny any any or drop all statement is placed at the end of an ACL and enforces an implement deny strategy.
47
```
Of the following choices, what best describes a method of managing the flow of network traffic by allowing or denying traffic based on ports, protocols, and addresses?
(A)Implicit deny
(B)Firewall rules
(C)Proxy server content filter
(D)Firewall logs
```
Firewalls use firewall rules (or rules within an ACL) to identify what traffic is allowed and what traffic is denied. A basic packet filtering firewall can filter traffic based on ports, protocols, and addresses.
48
Your network includes a subnet that hosts accounting servers with sensitive data. You want to ensure that users in the Marketing department (on a separate subnet) cannot access these servers. Of the following choices, what would be the easiest to achieve the goal?
(A)Enable load balancing
(B)Enable port security
(C)Use an ACL
(D)Add a host-based firewall to each server.
An access control list (ACL) on a router can block access to the subnet from another subnet.
49
```
You are deploying a remote access server for your organization. Employees will use this to access the network while on the road. Of the following choices, what must you configure?
(A)NAC
(B)ACLs
(C)MACs
(D)NAT-T
```
Access control lists within a firewall must include rules to open the appropriate ports.
50
```
You are reviewing a firewall's ACL and see the following statement: drop all. What security principle does this enforce?
(A)Least privilege
(B)Integrity
(C)Availability
(D)Implicit deny
```
A drop all or deny any any statement is placed at the end of an access control list (ACL) and enforces an implement deny strategy.
51
```
Firewalls include rules in an ACL. Which of the following would block network traffic that isn't in any of the previously defined rules?
(A)Explicit allow
(B)Implicit allow
(C)Explicit deny
(D)Implicit deny
```
Most firewalls have an implicit deny statement (such as drop all or deny any any) at the end of an access control list (ACL) to block all traffic not previously allowed.
52
```
An organization recently created a security policy. Of the following choices, what is a technical implementation of security policy?
(A)Training
(B)Acceptable use acknowledgement
(C)Implicit deny rule in a firewall
(D)Job rotation
```
Firewall rules (including the implicit deny rule) provide technical implementation of security policies. The other choices are not technical controls.
53
```
Which of the following IP addresses are on the same subnet?
I. 192.168.1.50, 255.255.255.192
II. 192.168.1.100, 255.255.255.192
III. 192.168.1.165, 255.255.255.192
IV. 192.168.1.189, 255.255.255.192
(A)I and II
(B)II and III
(C)III and IV
(D)All of them
```
Both 192.168.1.165 and 192.168.1.189 are on the same subnet since bits 25 and 26 are the same (10). If a calculator is needed on the exam (such as for a problem like this), it will be available.
54
```
Of the following choices, what can be used to allow access to specific services from the Internet while protecting access to an internal network?
(A)SSH
(B)Implicit deny
(C)DMZ
(D)Port security
```
A demilitarized zone (DMZ) can provide access to services (hosted on servers) from the Internet while providing a layer of protection for the internal network.
55
```
Of the following choices, what hides the IP addresses of computers inside a network from computers outside the network?
(A)Web security gateway
(B)Replacing all hubs with switches
(C)WAF
(D)NAT
```
Network Address Translation (NAT) translates public IP addresses to private IP addresses, and private back to public and hides addresses on the internal network.
56
```
Your organization is creating a site-to-site VPN tunnel between the main business location and a remote office. What can they use to create the tunnel?
(AWPA2-Enterprise
(B)RADIUS
(C)NAC
(D)IPsec
```
IPsec is one of many tunneling protocols the organization can use to create a VPN tunnel.
57
```
You are planning to deploy a VPN with IPsec. Users will use the VPN to access corporate resources while they are on the road. How should you use IPsec?
(A)With AH in tunnel mode
(B)With AH in transport mode
(C)With ESP in tunnel mode
(D)With ESP in transport mode
```
Encapsulating Security Payload (ESP) in tunnel mode encapsulates the entire IP packets and provides confidentiality, integrity, and authentication.
58
An employee connects to the corporate network using a VPN. However, the client is not able to access internal resources, but instead receives a warning indicating their system is not up-to-date with current patches. What is causing this behavior?
(A)The VPN is using IPsec
(B)The VPN is not using IPsec
(C)NAC is disabled on the network and remediation must take place before the client can access internal resources
(D)NAC is enabled on the network and remediation must take place before the client can access internal resources
Network access control (NAC) inspects clients for specific health conditions and can redirect access to a remediation network for unhealthy clients.
59
```
What technology can an organization use to assist with computing requirements in heavily utilized systems?
(A)ISP
(B)DLP
(C)Cloud computing
(D)Remote wipe
```
Cloud computing is very useful for heavily utilized systems and networks, and cloud providers provide the services.
60
```
Employees in your organization access web-based email using cloud-based technologies. What type of technology is this?
(A)IaaS
(B)PaaS
(C)SaaS
(D)Network-based DLP
```
Applications such as web-based email provided over the Internet are Software as a Service (SaaS) cloud-based technologies.
61
Of the following choices, what is the best explanation of what a PaaS provides to customers?
(A)Web-based applications provided over the Internet.
(B)A device that reduces the risk of employees emailing confidential information outside the organization
(C)Protection against VM escape attacks
(D)An easy-to-configure operating system and on-demand computing capabilities
Platform as a Service (PaaS) provides cloud customers with an easy-to-configure operating system and on-demand computing capabilities.
62
```
An organization is considering using virtualization in their datacenter. What benefits will this provide?
I. Increased footprint
II. Decreased footprint
III. Reduction in physical equipment needing security
IV. Elimination of VM escape attacks
(A)I and II
(B)II and III
(C)III and IV
(D)All of them
```
Virtualization can reduce the footprint of a datacenter, eliminate wasted resources, and result in less physical equipment needing physical security.
63
```
An organization wants to hide addresses it uses on its internal network. What can assist with this goal?
(A)MAC filtering
(B)NAC
(C)NAT
(D)DMZ
```
Network Address Translation (NAT) translates public IP addresses to private, private IP addresses back to public, and hides addresses on the internal network.
64
You have been tasked by your manager to perform an evaluation of the benefits of using virtualization in your QA testing environment. Which of the following is an advantage of using virtual machines in terms of security and cost efficiency?
A. It reduces the need to install OS software updates.
B.Multiple operating systems can be installed and run in their own separate, secure area on a single hardware device.
C. It helps secure the hardware from unauthorized access.
D. Antivirus and other security software only have to be installed once.
B. Virtual machines all run in their own separate and isolated area on the system as if they were on a separate physical machine. This greatly increases security, as any issues arising in one virtual machine will not affect another virtual system. This also allows multiple operating systems to be installed on the same physical hardware, which saves money by avoiding the need to buy multiple hardware systems.
65
After a security review, it is recommended that your organization install a network intrusion prevention system (NIPS). Based on the current budget, your manager recommends that you install a less-costly network detection system (NIDS). What is the primary security difference between a network intrusion detection system (NIDS) and a network intrusion prevention system (NIPS) that you can use to justify the additional costs?
A. A NIDS system only detects TCP/IP attacks.
B. The NIPS system actively tries to mitigate an incoming intrusion rather than just detect it.
C. The NIDS system can raise alarms when it detects an intrusion.
D. A NIPS system is only host based, not network based.
B. The NIPS system actively tries to mitigate an incoming intrusion rather than just detect it. A network intrusion detection system actively monitors for intrusions and will alert the administrator when one is detected. A network intrusion prevention system goes a step further and tries to actively prevent the intrusion as it is occurring.
66
You must install and secure your organization’s Internet services, including web, FTP, and e-mail servers, within your current network topology, which uses a network firewall to protect your internal networks. In which security zone of your network should these servers be installed to isolate them from the Internet and your internal networks?
A. DMZ
B. VLAN
C. Internal network
D. Intranet
A. The demilitarized zone (DMZ) is a network that typically contains Internet servers and services that are accessible from the outside world but should be isolated from your internal network. The DMZ ensures incoming connections for these services are routed to the DMZ and never reach the internal LAN.
67
You are configuring your network to ensure that all details of internal IP addresses in your network are hidden from outside networks. You must also allow several internal hosts to be able to use an external IP address when communicating outside the network. Which of the following network security methods should you use?
A. NAT
B.VPN
C.VLAN
D. IP spoofing
A. Network address translation (NAT) allows internal hosts with nonroutable Internet addresses to access the Internet using an external address. NAT also hides the IP information of the internal network from the outside world.
68
Your organization is growing fast, and the number of clients and devices on your network has doubled in size over the last year. To help better partition and secure your network, which networking technology could you use?
A. NAT
B. NAC
C. VPN
D. VLAN
D. A virtual LAN (VLAN) is used to segment a network into smaller logical units to aid in security and performance. The virtual LANs are logically isolated from each other to prevent network traffic and unauthorized access.
69
Your organization has a large remote user base, and it is becoming difficult to enable them to access a legacy local application server and share and collaborate on project documents. Which of the following technologies could you use to provide secure, centralized access to these resources?
A. VLAN
B. Web-based cloud computing application
C. Virtualization
D. VPN
B. You could convert your legacy application to a secure, cloud-based web resource that allows clients to remotely access the application and its data from any Internet connection. The data can be easily shared, and multiple users can collaborate on projects.
70
You need to implement a solution that allows your users to browse web content safely, and also protect the company from legal liabilities in regard to the downloading of inappropriate and offensive content. Which of the following security devices would you install?
A. Antispam filter
B. Firewall
C. Web proxy
D. Web security gateway
D. A web security gateway device is specifically engineered to content-filter HTTP web traffic and prevent attacks on web clients via the HTTP protocol. A network firewall, web proxy, or antispam filter would not prevent security issues specifically for HTTP applications.
71
Many of your users are downloading MP3 music files from the Internet and using up the company’s valuable bandwidth resources. Which technology could you implement to help block the transfer of these files from the Internet?
A. Content filter
B. Antispam filter
C. Protocol analyzer
D. Intrusion detection system
A. A content filtering server can analyze network traffic and block specific file types, such as MP3 music files, from being downloaded. The end users will receive an error when they try to access blocked files.
72
Your users are complaining that web browsing is very slow, but your small office cannot afford a faster Internet connection. Which of the following technologies would help improve web browsing performance?
A. Web proxy
B. Firewall
C. Authentication proxy
D. Intrusion detection system
A. Web proxy servers are used primarily for their caching capability, which boosts web browsing performance by storing content retrieved from an external web serve
73
You have discovered there may be a networking security issue between your network firewall and e-mail server, which is accepting connections from an unauthorized external e-mail server. Which of the following network security tools would be best used for examining network traffic between your firewall and your e-mail server?
A. Intrusion detection system
B. Proxy server
C. Protocol analyzer
D. Firewall server
C. A protocol analyzer is best suited for examining and capturing network packets and frames between the two devices. You would be able to examine the network traffic to determine the details of the unauthorized connection and use firewall rules to block it.
74
You need to set up a secure FTP server to allow your company’s clients to upload their files. Which of the following FTP protocols would you use?
A, SFTP
B. FTP
C. TFTP
D. FTP over HTTP
A. SFTP is used to encrypt FTP sessions with SSH (Secure Shell). The other methods such as FTP, TFTP, or FTP over HTTP are not secure and communicate in clear text.
75
You want to secure one of your network switch segments to only allow access from specific clients on the development network. Which of the following should you implement?
A. Use a VPN for the development network.
B. Create a firewall rule to restrict access to the switch ports.
C. Create a VLAN for the entire development network.
D. Restrict the switch port access to the MAC addresses of the clients.
D. You should enable MAC address security on your switch ports to only allow the hardware addresses of the specific clients on the development network to access those ports.
76
You need to secure one of your routers (IP address 10.1.5.25) to prevent access to the SNMP port. On your firewall, which of the following access rules will block SNMP access to the router?
A. permit 10.1.5.25 udp port 53
B. deny 10.1.5.25 tcp port 143
C. deny 10.1.5.25 udp port 161
D. permit 10.1.5.25 udp port 389
C. The access rule should be set to deny the SNMP UDP port 161 for the specified IP address.
77
It is discovered that your primary router has a serious software vulnerability that makes it susceptible to denial-of-service attacks. What should you do to resolve the issue?
A. Disable SNMP
B. Disable ICMP
C. Enable flood protection.
D. Update the firmware.
D. In the event that a documented vulnerability is found in a network device firmware or operating system, it should be updated or a patch applied to fix the bug to prevent the device from being compromised.
78
Your web server is being flooded by a denial-of-service attack. Using a network analyzer, you see that there are IP broadcast replies being sent back to the address of your server from multiple addresses. Which type of network attack is this?
A. Man-in-the-middle
B. Back door
C. Smurf
D. DNS poisoning
C. A smurf attack uses a spoof attack combined with a DDoS attack to exploit the use of IP broadcast addressing and ICMP. By spoofing the address of the web server in an IP broadcast, the attacker causes the replies from other systems on the network to the broadcast all to be sent back to the web server, causing a denial of service.
79
When creating firewall rules, which of the following principles should be applied to maximize security by blocking all traffic and only allowing access as
required?
A. Implicit deny
B. Explicit deny
C. Unauthenticated deny
D. Denial of service
A. Implicit deny means that anything that is not explicitly defined in an access rule is denied. This denies all access by default until you apply access rules for only the specific services required.
80
During a denial-of-service attack, a network administrator blocks the source IP with the firewall, but the attack continues. What is the most likely cause of the problem?
A. The denial-of-service worm has already infected
the firewall locally.
B. The attack is coming from multiple, distributed
hosts.
C. A firewall can’t block denial-of-service attacks.
D. Antivirus software needs to be installed.
B. A distributed denial-of-service (DDoS) attack comes from multiple, geographically distributed hosts, making it difficult for the network administrator to block it.
81
You have just performed a security port scan on your e-mail server. Which of the following services and ports that appeared in the test as open and accepting connections should be disabled?
A. TCP port 21
B. TCP port 25
C. TCP port 110
D. TCP port 143
A. TCP port 21 (FTP) is not required on your e-mail server, and it should be disabled to prevent hackers from connecting to the e-mail server on this port.
82
Your network router has the ability to be remotely configured through a web browser. Which of the following would be the most secure method for remote access?
A. FTP over HTTP connection
B. HTTP connection
C. Telnet
D. HTTPS connection
D. To securely administer your router remotely with a web browser, you should make sure you are using an HTTPS connection that is encrypted via SSL. Other methods send their communications in clear text.
83
You have just installed a new SNMP monitoring system for all your network devices. Which of the following should you do to enhance security for the implementation?
A. Change the password of the network monitor.
B. Disable SNMP access on all inbound network ports.
C. Change the default SMTP community string.
D. Enable ICMP.
C. The default SNMP community string is “public.” This is a basic type of password used between all systems being monitored by SNMP. This should be changed to a more secure value.
84
You have connected to a free, open Wi-Fi hotspot at your local coffee shop. Which of the following security measures should you use to secure your session?
A. Only use HTTPS sites secured with SSL.
B. Set up MAC address filtering.
C. Use a packet sniffer.
D. Reconnect at regular intervals to refresh the encryption key.
A. When using an open wireless access point and browsing personal web sites such as your e-mail and banking sites, make sure you use secure, encrypted websites via SSL, or use a VPN connection. This ensures that your session with the web server is encrypted. Any hacker on the same open network can use a packet sniffer to view unencrypted communications.
85
You have set up a wireless network for your small office of 50 users. Which of the following encryption protocols would you implement to ensure the highest level of encryption security?
A. WAP
B. WPA
C. WEP-128 bit
D. WPA2
D. WPA2 is currently the strongest level of encryption security available for a wireless network. WPA2 replaces the weaker WPA and adds Robust Security Network (RSN) support that includes added protection for ad hoc networks, key caching, preroaming authentication, and CCMP, which utilizes the AES cipher to replace TKIP
86
You are connecting to a secure, encrypted wireless network. During the initial connection phase, you are asked to enter a passphrase. Which WPA encryption method is in use on the network?
A. WPA-EAP
B. WPA-TKIP
C. WPA-PSK
D. WPA-Enterprise
C. WPA-PSK uses a preshared key passphrase that requires all devices on the wireless network to use the same passphrase to access the network. WPA-Enterprise uses an authentication server to perform key management and exchange for all wireless clients.
87
You are setting up new Bluetooth-enabled mobile phones for your executive team. Which of the
following security features do you enable to prevent Bluesnarfing?
A. Enable link-level security.
B. Disable the IR port.
C. Disable wireless access.
D. Set an SSID.
A. Bluesnarfing is a hacking method in which an unauthorized user can connect to unprotected Bluetooth devices and access any data stored on the device. Link-level security authenticates the actual communications link before data transmission begins. Data encryption can also be performed when the link is authenticated
88
You are setting up a new wireless security network for your small office. You have set the SSID of the network to a secure value. Which other feature can you enable to enhance SSID security?
A. Enable SSID broadcast.
B. Enable SSID tunneling.
C. Disable SSID snarfing.
D. Disable SSID broadcast.
D. By disabling SSID broadcast, you assure your access points will not advertise the SSID they are using for wireless clients to connect. A user would require prior knowledge of the SSID before he could access the network.
89
Which of the following types of wireless attacks utilizes a weakness in WEP key generation and encryption to decrypt WEP encrypted data?
A. IV attack
B. War driving
C. PSK attack
D. Eavesdropping
A. The IV (initialization vector) attack uses the weakness in the 24-bit generated IV that is paired with the WEP encryption key. The IV can be discovered over time on busy networks that use repeat IV values, and used to decrypt the cipher stream without knowing the WEP key.
90
To further secure your wireless network, you implement MAC address filtering. Which of the following statements describes the wireless network behavior after you enable MAC address filtering?
A. It allows wireless access only for specified MAC addresses.
B. It prevents wireless access only from specified MAC addresses.
C. It encrypts only specified wireless device MAC addresses.
D. It encrypts only MAC addresses not specified.
A. A list of authorized client MAC addresses must be configured on each access point for the network. If any client tries to communicate with the access point and its MAC address isn’t in the list, it will be denied access.
91
After checking the signal strength of a specific floor of your building, you realize that two of the farthest offices on the floor have very poor signal strength. Which of the following actions can you perform to provide a cost-effective solution to increase signal strength to that part of the building?
A. Disable encryption to speed up the network.
B. Add an additional access point.
C. Use a cable to extend the antenna range of the closest access point.
D. Switch to the 5 GHz band instead of 2.4 GHz.
B. You can use a cable and an external antenna to extend the range of your closest access point to the office with the low signal. This is an easy and inexpensive solution rather than purchasing and installing a new access point.
92
You are installing a wireless network in a manufacturing facility. Which of the following aspects of the wireless network do you concentrate on to prevent security issues with EMI?
A. Use of WPA2 encryption
B. Use of 802.11g or 802.11n
C. SSID network name
D. Access point and antenna placement
D. Antenna and access point placement is important to make sure that it is not close to any other electrical wires or devices (especially those that broadcast on a similar frequency) where electrical interference can cause a loss of wireless signal.
93
Your company is moving to a new facility, and you are responsible for installing a wireless network for the new office building. Which of the following should you perform to prepare for a secure implementation?
A. Back up the current wireless configuration.
B. Check for war chalking at the new site.
C. Perform a site survey.
D. Perform a radio frequency sweep.
C. An initial site survey should be performed before installation of a wireless network to ensure the environment will be conducive to wireless communications. The survey can also help determine the best placement and coverage for your wireless access points.
94
Name the 4 Monitoring Methodologies
1. Signature-Based
2. Behavior/Anomaly-Based
3. Heuristic-Based
4. Rule-Based
95
What is Signature-Based Monitoring?
| What are the Pros/Cons?
It works by using a predefined db of known attacks that have appeared previously. Each type can be recognized by its unique chars, and signature.
Pros- Powerful and efficient because it relys on the collective knowledge of security vendors.
Cons - Must keep db continually updated.
Unable to detect very new attacks whose signatures are not yet availble.
96
What is Behavior/Anomaly-Based Monitoring?
| What are the Pros/Cons?
A baseline of normal behavior and then monitor network traffic based on these performance profiles to recognize behavioral anomalies that exceed the thresholds of the normal baseline.
Pros - More effient as time goes on (more data collected)
Easily and quickly adapt to the current environment and can detect new variants of attacks that a signature or rule-based might not.
97
```
Which authentication protocol is commonly used in WLAN and LAN implementation?
A. CHAP
B. PAP
C. PPP
D. EAP
```
D. EAP
98
Five users in an organization require concurrent access to a medical application that requires expensive licensing, what can be done to ensure that the employees can access the application, reduce costs, and promote an ethical office?
A. Obtain a platform as a service agreement with a cloud computing provider
B. Obtain a software as a service agreement with a cloud computing verndor
C. Obtain one license for th software and provide access to clients using thin client software
D. Obtain an infastructure as a service agreement with a cloud computing agreement
B. Obtain a software as a service agreement with a cloud computing verndor
99
Why is it not recommended to sending credit card infomation in an instant message?
A. traffic is easily sniffed
B. may have spyware installed
C. It is not an official form of payment, as it requiresa signature
D. It could have a trojan virus
A. traffic is easily sniffed
100
```
In the past, there have been some cases of virus infected computers from subnet A attempting connections with computers on subnet B using port 5959. To prevent infection of subnet B computers, a security solution is required. What can be implemented on the router to prevent traffic on that specific port?
A. VLAN management
B. Access control list
C. Loop protection
D. Port security
```
B. Access control list
101
```
Which port does HTTPS use?
A. 23
B. 21
C. 80
D. 443
```
D. 443
102
Name the Classes and address ranges of the private IPs
```
class A network - 10.0.0.0 - 10.255.255.255
class B network - 172.16.0.0 - 172.31.255.255
class C network - 192.168.0.0 - 192.168.255.255
```
103
What is a Web security gateway?
It is a device that is specifically engineered to content-filter HTTP web traffic and prevent attacks on web clients via the HTTP protocol.
Used for safe web-browsing and block certain content downloading.
104
What is a web-proxy used for?
Servers(s) primarily used for caching capability, which boosts web browsing performance by storing content retrieved from tan external web server.
105
What is a protocol analyzer used for?
It is best suited for examining and capturing network packets and frames between the firewall and the email server.
106
List the 13 common internet based network and application protocols.
1. TCP/IP
2. ICMP
3. HTTP/HTTPS
4. Telnet
5. SSH
6. FTP
7. TFTP
8. FTPS/SFTP
9. SCP
10. DNS
11. SNMP
12. IPsec
13. NetBIOS
107
What protocols send data as plain text?
| What does this make them vulnerable to?
```
TCP
UDP
HTTP
FTP
Packet sniffing and Spoofing because they don't use authentication functions.
```
108
What is the difference between IPv4 and IPv6 and what are they used for?
They are used for the IP or address of a computer.
IPv4 -
IPv6 -
109
Name the 7 layers of the OSI model.
| What are the data item (PDU) referred to at each layer?
7. Application - Data
6. Presentation - Data
5. Session - Data
4. Transport - Segments
3. Network - packets
2. Data Link - frames
1. Physical - Bits
110
What is the OSI Application Layer? Give examples of protocols used at this layer.
7th layer: It provides services needed by software applications to help users interact with the network.
Protocols:
HTTP,FTP, SMTP, DHCP, NFS, Telnet, SNMP, POP3, NNTP and IRC
111
What is the OSI Presentation layer?
| Give examples of protocols used at this layer.
6th layer: is responsible for data presentation, ensuring that the data sent from the application layer can be read by the corresponding application layer on the receiving end.
It defines protocols that provide coding and data conversion function - transition, (de)compression, encryption and decryption. These are applied to the application level data to make it transparent to the layers around it.
Protocols:
SSL
112
What is the OSI Session layer?
| Give examples of protocols used at this layer.
5th layer: Required for inter-host communication. Establish, maintain and terminate communication sessions between the software application on different networks. Attaches header information to data packets and coordination data transfer for providing dialog control between devices and determine if data is to be sent as simplex, half-duplex or full-duplex messages.
Protocols:
PPTP
113
What is the OSI Transport layer?
| Give examples of protocols used at this layer.
4th layer: Provides the services required for end-to-end connectivity and ensuring that data is delivered error-free and in the proper sequence.
Provides process-level addressing, multiplexing and e-multiplexing, and segmentation, packaging and reassembly of data. Includes protocols for establishing , managing, and termination of connections for acknowledgement and retransmission of lost data, flow control, error checking and recovery.
Protocols:
TCP, UDP
114
What is the OSI Network layer?
| Give examples of protocols used at this layer.
3rd layer: Enable multiple individual networks to be combined into an internetwork.. Handles logical addressing. It provides path determination- routing messages using the best path available and is responsible for creating virtual circuits between network devices. Performs datagram and encapsulation, packet fragmentation and reassembly, and error handling and diagnostics.
Protocol:
IP
115
What is the OSI Data Link layer?
2nd Layer: Provides services for the various protocols at the network layer. Divided into 2 sub layers: logical link control (LLC) and media access control (MAC).
LLC - takes the packets from the network layer and breaks them into frames using synchronization flow control and error checking functions.
MAC - provides control for accessing the transmission medium at the physical layer. It converts the data into binary digits and prepares them for the physical layer.
116
What is the OSI Physical layer?
1st layer: defines the networks hardware specs and physical topology. Defines the encoding and signaling functions required to transmit data across the transmission medium and physically transmits and receives data.
117
List the DARPA (DoD) Model layers and the protocols it uses.
4. Application - mail, file transfer, login applications
3. Transport (Host-to-Host) TCP or UDP
2. Internet - package, route, transmit via IP
1. Network Access (Link) physical data delivery
Uses TCP/IP protocols (TCP/IP Model)
118
What is the TCP/IP protocol suite?
A set of network protocols that specifies how computers communicate, and provides a set of conversions for interconnection networks and routing traffic. Fucntions independent of the underlying network tech. Includes and integrated addressing system (IP). Operates at OSI layers Application, Transport, Internet and Network Interface.
2 Main Transport Protocols:
TCP - connection-oriented delivery
UDP- connectionless delivery. No error checking
119
What is an ICMP protocol?
Is used to transmit control messages between systems. Used for diagnostics (ping)
120
Which DoD model layer is responsible for packaging, addressing, and routing data so it can be transmitted?
Internet Layer
121
What is ICMP
Control Message Protocol - used to send management messages between systems.
122
What port allows for the exchange of data through a channel made secure by Secure Shell (SSH)
port 22
123
What port is used to transmit email retrieved from a server via Post office protocol version 3 (POP3)?
Port 110
124
Which port handles Simple Mail Transfer protocol (SMTP), which is used to send email
port 25
125
Which port is the Domain Name Service (DNS), which translates domain names into IP addresses
port 53 (TCP or UDP)
126
Which port is HTTP over Secure Sockets layer or HTTPS, which
port 443
127
Which port is used for Telnet, which provides login capabilities on a remote host
port 23
128
Which port is used for Transmitting data on a diskless workstation via the Bootstrap Protocol or BOOTP
port 67
129
Which port is used for Network Time Protocol (NTP) to synchronize the clock times of computer?
port 123
130
Which port is used for Exchange management information via Simple Network Management Protocol, or SNMP
port 161
131
Which port is used for Transferring files via Trivial File Transfer Protocol (TFTP)
port 69
132
Which port is used for SSH File Transfer Protocol (SFTP), which provides additional function to control files.
port 22
133
Which port is used for Hyper Transfer Protocol (HTTP), which web servers and clients use to communicate
port 80
134
Which port is used for FTP over SSL (FTPS), which transfers data between a client and server
port989
135
Which port is used for Message Access Protocol (IMAP), which retrieves email messages
port 143
136
Name the NetBIOS service and tis port
Name Service - 137
Datagram Service - 138
Session Service - 139
137
Name the NetBIOS services and their ports
1. Name Service - TCP/UDP 137 usually UDP
2. Datagram Service used to send small msgs - UDP 138
3. Session Service allow 2 computers communicate lrg msgs via a connection with error detection and recovery - TCP 139
138
What are the 2 Protocols for TCP/IP at the Transport layer?
TCP Transmission Control Protocol
| UDP User Datagram Protocol
139
What is Telnet
Telnet allows a user to remotely connect to a host server and login. Telnet does not encrypt data.
140
What is UDP
User Datagram Protocol is a TCP/IP protocol.
Simple and fast connectionless and best used when speed is required to broad cast data or multicast. Message is not guaranteed to arrive with no error checking.
141
Which Transport protocol can be used for multicasting?
UPD
TCP can not broadcast or multicast since it enables communication between a specific sender and receiver. It is for unicast communication.
142
What communication does TCP provide?
| What communication does UPD provide?
TCP - unicast
| UDP - broadcast or multicast
143
What Transport protocol is lossless?
| TCP or UDP
TCP - establishes and manages a connection between the source and destination devices. It sequences messages, retransmits messages lost in transmit and implements data flow and congestion control.
144
What is an ephemeral port (TCP or UDP)?
Ephemeral ports are assigned only temporarily to client processes. Port numbers range from 1024 - 65535, and can be used by user-developed programs on most systems. The IP/port combination must be unique for data to be transported.
145
What is SSH?
Provides a secure channel for data exchange on port 22. Provides encryption and authentication. It ensures that the entire flow of information between the machine and other devices (router/firewall) are encrypted.
146
What are the 3 protocols used for email?
SMTP on port 25 (Send email)
POP3 on port 110 (retrieve email, can be used with SMTP)
IMAP on port 143 (retrieve email)
147
What is NetBIOS?
It is used on LANs to enable software on individual computers to communicate.
148
List protocols that user UDP and their ports
1. BOOTP used via DHCP to determine its IP. Allows a file to be loaded into memory so a machine can be boot without a disk drive. UPD 67
2. TFTP is a basic file transfer for small data transfers, boot computers, x-terminals and diskless workstations. UPD 69
3. NTP used to synch clock times on computers. UPD 123
4. SNMP (Simple Network Mng Protocol) enables network devices to exchange mng information. UPD 161
149
What error checking does UDP provide?
Limited via a checksum with no recovery.
150
What would you use to determine points of weakness in a network by identifying unused ports and determine which services are running by identifying open ports?
Port Scanner
151
When would you use a protocol analyzer as part of a vulnerability assessment?
To capture, analyze and transmit data packets
| When performing traffic analysis to detect patterns
152
List the 3 frameworks in NAC
1. CNAC
2. TNC
3. NAP
153
What is a Christmas Tree attack?
A specific TCP packet is sent to a particular device on a network, usually a router. The packet has the flags turned on for the URG,PUSH and FIN. These flags being turned on looks like a Christmas Tree.
154
```
Which of the following are functions of an intrusion detection system? (Select all correct answers.)
A. Prevent attacks
B. Analyze data
C. Identify attacks
D. Respond to attacks
```
B, C,D
Intrusion detection systems are designed to analyze data, identify attacks, and respond to the intrusion. Answer A is incorrect because preventing attacks is associated with an intrusion prevention system.
155
Which of the following best describes the difference between an intrusion detection system and a firewall?
A. IDSs control the information coming in and out of the
network, whereas firewalls actually prevent attacks.
B. Firewalls control the information coming in and out
of the network, whereas IDSs identify unauthorized
activity.
C. Firewalls control the information coming in and out of
the network, whereas IDSs actually prevent attacks.
D. IDSs control the information coming in and out of
the network, whereas firewalls identify unauthorized
activity.
B
IDSs are different from firewalls in that firewalls control the information that gets in and out of the network, whereas IDSs can identify unauthorized activity.
IDSs are also designed to catch attacks in progress within the network, not just on the boundary between private and public networks. Intrusion prevention differs from intrusion
detection in that it actually prevents attacks instead of only detecting the occurrence of an attack.
156
Which of the following best describes a host intrusion detection system?
A. Examines the information exchanged between
machines
B. Attempts to prevent attacks in real-time
C. Controls the information coming in and out of the
network
D. Collects and analyzes data that originates on the local machine.
D
| A HIDS collects and analyzes data that originates on the local machine.
157
Which of the following best describes a network intrusion detection system?
A. Examines the information exchanged between
machines
B. Attempts to prevent attacks in real-time
C. Controls the information coming in and out of the
network
D. Collects and analyzes data that originates on the local machine
A
A NIDS tries to locate packets not allowed on the network that the firewall
missed and looks at the information exchanged between machines.
158
Which of the following best describes a network intrusion prevention system?
A. Examines the information exchanged between
machines
B. Attempts to prevent attacks in real-time
C. Controls the information coming in and out of the
network
D. Collects and analyzes data that originates on the local machine
B
Intrusion prevention differs from intrusion detection in that it actually prevents
attacks in real-time instead of only detecting the occurrence.
159
```
Which of the following are servers that distribute IP traffic to multiple copies of a TCP/IP service and are configured in a cluster to provide scalability and high availability?
A. Virtual machine hosts
B. VPN Concentrators
C. Storage area networks
D. Load balancers
```
D
Network Load Balancers are servers configured in a cluster to provide scalability and high availability. Load Balancing distributes IP traffic to multiple copies of a TCP/IP service, such as a web server, each running on a host within the cluster.
160
Which of the following is true when implementing a NIPS? (Select all correct answers.)
A. The sensors must be placed on domain controllers to
function properly.
B. The sensors must be physically inline to function
properly.
C. It adds single points of failure to the network.
D. It adds additional redundancy to the network.
B,C
When implementing a NIPS, keep in mind that the sensors must be physically inline to function properly. This adds single points of failure to the network.
161
Which of the following best describes fail-open technology in reference to the implementation of NIPS?
A. If the device fails, it provides application redundancy.
B. If the device fails, it will prevents a fire from starting.
C. If the device fails, it causes a complete network
outage.
D. If the device fails, a complete network outage will be
avoided.
D
When implementing a NIPS, keep in mind that the sensors must be physically
inline to function properly. This adds single points of failure to the network. A good way to prevent this issue is to use fail-open technology. This means that if the
device fails, it does not cause a complete network outage; instead, it acts like a patch cable.
162
Which of the following best describes a firewall?
A. Examines the information exchanged between
machines
B. Attempts to prevent attacks in real-time
C. Controls the information coming in and out of the
network
D. Collects and analyzes data that originates on the local machine
C
A firewall is a component placed on computers and networks to help eliminate undesired access by the outside world. It can be composed of hardware, software, or a combination of both.
163
What purpose does an application–level gateway serve?
An application-level gateway understands services and protocols. All traffic is examined to check for OSI application layer (Layer 7) protocols that are allowed. Examples of this type of traffic are File Transfer Protocol
(FTP), Simple Mail Transfer Protocol (SMTP), and Hypertext Transfer Protocol (HTTP). Because the filtering is application-specific, it adds over-head to the transmissions but is more secure than packet filtering.
164
When an insider threat is detected and you want to implement a solution that monitors the internal network activity as well as incoming external traffic, what two types of devices could you use?
1. Network-based intrusion-detection systems monitor the packet flow and try to locate packets that are not allowed for one reason or another and might have gotten through the firewall.
2. Host-based intrusion-detection systems monitor communications on a host-by-host basis and try to filter malicious data. These types of IDSs are good at detecting unauthorized file modifications and user activity
165
Explain the functions that a proxy server can perform
Proxy servers can be placed between the private network and the Internet for Internet connectivity or internally for web content caching. If the organization is using the proxy server for both Internet connectivity and web content caching, the proxy server should be placed between the internal network and the Internet, with access for users who are requesting the web content. In some proxy server designs, the proxy server is placed in
parallel with IP routers. This allows for network load balancing by forwarding of all HTTP and FTP traffic through the proxy server and all other IP traffic through the router.
166
What is a firewall?
A firewall is a component placed on computers and networks to help eliminate undesired access by the outside world. It can be composed of hardware, soft-
ware, or a combination of both. A firewall is the first line of defense for the network. The primary function of a firewall is to mitigate threats by monitoring all traffic entering or leaving a network.
167
```
Which of the following are servers that distribute IP traffic to multiple copies of a TCP/IP service and are configured in a cluster to provide scalability and high availability?
A. VPN Concentrators
B. Load balancers
C. Virtual machine hosts
D. Storage area networks
```
A
A VPN concentrator is used to allow multiple users to access network resources using secure features that are built in to the device and are deployed where the requirement is for a single device to handle a very large number of VPN tunnels.
168
Which of the following best describes a packet-filtering firewall?
A. Relies on algorithms to process application layer data
B. Operates at the OSI network layer
C. Operates at the OSI session layer
D. Examines traffic for application layer protocols
B
A packet-filtering firewall is typically a router. Packets can be filtered based on IP addresses, ports, or protocols. They operate at the network layer (Layer 3) of
the OSI model. Packet-filtering solutions are generally considered less-secure firewalls because they still allow packets inside the network, regardless of communication pattern within the session.
169
Which of the following best describes a stateful -inspection firewall?
A. Relies on algorithms to process application layer data
B. Operates at the OSI network layer
C. Operates at the OSI session layer
D. Examines traffic for application layer protocols
A
A stateful-inspection firewall is a combination of all types of firewalls. This firewall relies on algorithms to process application layer data.
170
Which of the following best describes a circuit-level firewall?
A. Relies on algorithms to process application layer data
B. Operates at the OSI network layer
C. Operates at the OSI session layer
D. Examines traffic for application layer protocols
C
circuit-level gateway operates at the OSI session layer (Layer 5) by monitoring the TCP packet flow to determine whether the session requested is a legitimate one.
171
Which of the following best describes an application-level firewall?
A. Relies on algorithms to process application layer data
B. Operates at the OSI network layer
C. Operates at the OSI session layer
D. Examines traffic for application layer protocols
D
With an application-level gateway, all traffic is examined to check for OSI application layer (Layer 7) protocols that are allowed. Examples of this type of traffic are File Transfer Protocol (FTP), Simple Mail Transfer Protocol (SMTP), and Hypertext Transfer Protocol (HTTP).
172
```
Which of the following are functions of proxy servers? (Select all correct answers.)
A. Caching
B. Logging
C. Addressing
D. Filtering
```
A,B,D
Proxy servers are used for security, logging, and caching. When the proxy server receives a request for an Internet service, it passes through filtering
requirements and checks its local cache of previously downloaded web pages.
173
```
Which of the following are examples of a bastion host? (Select all correct answers.)
A. Web server
B. Email server
C. Database server
D. DHCP server
```
A,B
An exposed server that provides public access to a critical service, such as a web or email server, may be configured to isolate it from an organization’s network
and to report attack attempts to the network administrator. Such an isolated server is referred to as a bastion host, named for the isolated towers that were used to provide castles advanced notice of pending assault.
174
```
Which of the following should be implemented if the organization wants to substantially reduce Internet traffic?
A. Content filter
B. Proxy server
C. Protocol analyzer
D. Packet-filtering firewall
```
B
When a proxy server receives a request for an Internet service, it passes through filtering requirements and checks its local cache of previously downloaded
web pages. Because web pages are stored locally, response times for web pages are faster, and traffic to the Internet is substantially reduced.
175
```
Which of the following should be implemented if the organization wants a simple, good first line of defense?
A. Content filter
B. Proxy server
C. Protocol analyzer
D. Packet-filtering firewall
```
D
A packet-filtering firewall filters packets based on IP addresses, ports, or protocols and is a simple, good first line of defense.
176
```
Which of the following should be implemented if the organization wants to monitor unauthorized transfer of confidential information?
A. Content filter
B. Proxy server
C. Protocol analyzer
D. Packet-filtering firewall
```
A
Internet content filters use a collection of terms, words, and phrases that are compared to content from browsers and applications. This type of software can filter content from various types of Internet activity and applications, such as instant messaging, email, and office documents. It can be used to monitor and stop the disclosure of the organization’s proprietary or confidential information.
177
```
Which of the following should be implemented if the organization wants to troubleshoot network issues?
A. Content filter
B. Proxy server
C. Protocol analyzer
D. Packet-filtering firewall
```
C
Protocol analyzers help you troubleshoot network issues by gathering packet-level information across the network. These applications capture packets and decode the information into readable data for analysis.
178
```
Which of the following should be implemented if the organization wants to capture proper documentation for forensic investigations and litigation purposes?
A. Content filter
B. Proxy server
C. Protocol analyzer
D. Packet-filtering firewall
```
A
Internet content filters use a collection of terms, words, and phrases that are compared to content from browsers and applications. Because content filtering
uses screen captures of each violation with time-stamped data, it provides proper documentation
for forensic investigations and litigation purposes.
179
```
Content filtering is integrated at which of the following levels?
A. Network level
B. Application level
C. System kernel level
D. Operating system level
```
D
Content filtering is integrated at the operating system level so that it can monitor events such as opening files via Windows Explorer. It can be used to monitor
and stop the disclosure of the organization’s proprietary or confidential information.
180
```
Which of the following is the biggest drawback of using content filtering?
A. Network bandwidth is reduced.
B. Daily updates are required.
C. Terminology must be defined.
D. Opens the system to DoS attacks.
```
C
Unlike antivirus and antispyware applications, content monitoring does not require daily updates to keep the database effective and current. On the downside,
content filtering needs to be “trained.” For example, to filter non-pornographic material, the terminology must be input and defined in the database.
181
Which of the following are functions of a protocol analyzer? (Select all correct answers.)
A. Monitor for unexpected traffic
B. Identify unnecessary protocols
C. Prevent SMTP relay from being exploited
D. Prevent DoS attacks by unauthorized parties
A,B
Protocol analyzers can do more than just look at packets. They prove useful in many other areas of network management, such as monitoring the network
for unexpected, unwanted, and unnecessary traffic. For example, if the network is running slowly, a protocol analyzer can tell you whether necessary protocols are running on the network.
182
Which of the following is true about the use of content filtering?
A. It will report all violations identified in one group of
applications.
B. It will report only violations identified in the specified
applications.
C. It will report only violations identified in one applica-
tion at a time.
D. It will report all violations identified in all applications.
B
Content filtering will report only on violations identified in the specified applications listed for the filtering application. In other words, if the application will filter only Microsoft Office documents and a user chooses to use open Office, the content will not be filtered.
183
Which of the following most accurately describes personal firewall design?
A. Closes off systems by integrity checking
B. Closes off systems by blocking port access
C. Closes off systems by blacklisting applications
D. Closes off systems by blocking BIOS access
B
Like most other solutions, firewalls have strengths and weaknesses. By design, firewalls close off systems to scanning and entry by blocking ports or nontrusted services and applications. However, they require proper configuration.
184
```
Which of the following types of detection does a host intrusion detection system use? (Select all correct answers.)
A. Anomaly detection
B. Misuse detection
C. Blacklist detection
D. Outbound detection
```
A,B
A host intrusion detection system uses either misuse detection or anomaly detection. A HIDS monitors events for suspicious activity. This can be
done by using either misuse detection or anomaly detection. In misuse detection, a database of signatures is used, and the information monitored is compared to the database. This is similar to the way antivirus software works
185
Which of the following is the most appropriate reason for firewalls to monitor outbound connections?
A. To track the collection of personal data
B. To track users going to inappropriate sites
C. To monitor excessive user bandwidth usage
D. To catch malware that transmits information
D
Monitoring outbound connections is important in the case of malware that “phones home.” Without this type of protection, the environment is not properly protected.
186
Which of the following best describes the characteristics of host-based IDSs? (Select all correct answers.)
A. Good at detecting unauthorized user activity
B. Good at detecting unauthorized file modifications
C. Good at detecting denial of service attacks
D. Good at detecting unauthorized user access
A,B
HIDSs monitor communications on a host-by-host basis and try to filter malicious data. These types of IDSs are good at detecting unauthorized file modifications
and user activity. NIDSs monitor the packet flow and try to locate packets that may have gotten through misconfigured firewalls and are not allowed for one reason or another. They are best at detecting DoS attacks and unauthorized user access.
187
Which of the following is the main purpose of a host-based IDS?
A. Prevent attacks in real-time
B. Locate packets not allowed on the network
C. Proactively protect machines against attacks
D. Analyze data that originates on the local machine
D
NIDSs try to locate packets not allowed on the network. HIDSs collect and analyze data that originate on the local machine or a computer hosting a service. NIDSs tend to be more distributed.
188
```
The organization requires email traffic in a DMZ segment; which of the following TCP ports will be open? (Select all correct answers.)
A.110
B.21
C.25
D.443
```
A, C
| Port 110 is used for POP3 incoming mail and port 25 is used for SMTP mail.
189
```
Which of the following UDP ports must be open to allow SNMP traffic through the router?
A.161
B.162
C.443
D.4445
```
A, B.
| UDP ports 161 and 162 are used by SNMP
190
Which of the following best describes a demilitarized zone (DMZ)?
A. A small network between the database servers and file servers
B. A small network between the internal network and the
Internet
C. A portion of the internal network that uses web-based
technologies
D. A portion of the internal infrastructure used in
business-to-business relationships
B.
A demilitarized zone (DMZ) is a small network between the internal network and the Internet that provides a layer of security and privacy.
191
Which of the following best describes a virtual local-area network (VLAN)?
A. A method to allow multiple computers to connect to
the Internet using one IP address
B. A method to unite network nodes physically into the
same broadcast domain
C. A method to split one network into two using routers
to connect them together
D. A method to unite network nodes logically into the
same broadcast domain
D.
The purpose of a virtual local-area network (VLAN) is to unite network
nodes logically into the same broadcast domain regardless of their physical attachment to the network. VLANs provide a way to limit broadcast traffic in a switched network.
192
Which of the following best describes Network Address
Translation (NAT)?
A. A method to allow multiple computers to connect to
the Internet using one IP address
B. A method to unite network nodes physically into the
same broadcast domain
C. A method to split one network into two using routers
to connect them together
D. A method to unite network nodes logically into the
same broadcast domain
A.
NAT allows multiple computers to connect to the Internet using one IP
address.
193
Which of the following best describes subnetting?
A. A method to allow multiple computers to connect to
the Internet using one IP address
B. A method to unite network nodes physically into the
same broadcast domain
C. A method to split one network into two using routers
to connect them together
D. A method to unite network nodes logically into the
same broadcast domain
C.
Subnetting splits one network into two or more, using routers to connect each subnet. Answer A is incorrect. NAT allows multiple computers to connect to the
Internet using one IP address.
194
Which of the following is the most important security aspect of using Network Address Translation (NAT)?
A. It unites network nodes logically into the same
broadcast domain.
B. It hides the internal network from the outside world.
C. It allows users to be grouped by department rather
than location.
D. It allows external users to access necessary
information.
B.
Network Address Translation (NAT) acts as a liaison between an internal network and the Internet. It allows multiple computers to connect to the Internet using
one IP address. An important security aspect of NAT is that it hides the internal network from the outside world.
195
Which of the following is the most common reason networks are subnetted?
A. To allow logical division on the same broadcast
domain
B. To hide the internal network from the outside world
C. For easier application of security policies
D. To control network traffic
D.
Subnetting can be done for several reasons. If you have a Class C address and 1,000 clients, you will have to subnet the network or use a custom subnet mask
to accommodate all the hosts. The most common reason networks are subnetted is to control network traffic by limiting broadcast domains, which limits broadcast storms.
196
```
Which of the following private IP address ranges should be used for the internal network when there are 100 host systems?
A.10.x.x.x
B.172.16.x.x
C.192.168.1.x
D.224.1.1.x
```
C.
There are specific reserved private IP addresses for use on an internal network. In a Class C network, valid nonroutable host IDs are from 192.168.0.1 to
192.168.255.254. Network addresses with the first byte between 192 and 223 are Class C and can have about 250 hosts. Answer A is incorrect because it is a Class A
address. Valid host IDs are from 10.0.0.1 to 10.255.255.254. Network addresses with the first byte between 1 and 126 are Class A and can have about 17 million hosts each.
197
When a client machine receives an IP address of 169.254.0.15, it is an indication of which of the following?
A. The client cannot contact the DHCP server.
B. The client has a corrupt routing table.
C. The client has a manually configured address.
D. The client cannot contact the DNS server.
```
A.
Another address range to keep in mind when designing IP address space is Automatic Private IP Addressing (APIPA). In the event that no Dynamic Host
Configuration Protocol (DHCP) server is available at the time that the client issues a DHCP lease request, the client is automatically configured with an address from the169.254.0.1 through 169.254.255.254 range.
```
198
```
Automatic Private IP Addressing (APIPA) is denoted by which of the following IP addresses?
A.192.168.1.10
B.169.254.0.5
C.224.223.10.1
D.172.16.15.84
```
B.
In the event that no Dynamic Host Configuration Protocol (DHCP) server is available at the time the client issues a DHCP lease request, the client is automatically configured with an address from the 169.254.0.1 through 169.254.255.254 range.
199
Which of the following best describes network access control (NAC)?
A. A method to allow multiple computers to connect to the Internet using one IP address
B. A method to split one network into two using routers
to connect them together
C. A method to unite network nodes logically into the
same broadcast domain
D. A method of enforcement that helps ensure computers are properly configured
D.
One of the most effective ways to protect the network from malicious hosts is to use network access control (NAC). NAC offers a method of enforcement
that helps ensure that computers are properly configured. The premise behind NAC is to secure the environment by examining the user’s machine and, based on the results,
grant access accordingly.
200
```
Which of the following IP address ranges can be used for the internal network when using NAT? (Select all correct answers.)
A. 10.x.x.x
B. 172.16.x.x
C. 192.168.1.x
D. 224.1.1.x
```
A, B, C.
In a Class A network, valid nonroutable host IDs are from 10.0.0.1 to 10.255.255.254. In a Class B network, valid nonroutable host IDs are from 172.16.0.1
through 172.31.255.254. In a Class C network, valid nonroutable host IDs are from 192.168.0.1 to 192.168.255.254.
201
```
Which of the following are basic components of NAC? (Select all correct answers.)
A. Access requestor
B. Network redirector
C. Policy enforcement point
D. Policy decision point
```
A, C, D.
The basic components of NAC products are the Access requestor (AR), which is the device that requests access; the policy decision point (PDP), which
is the system that assigns a policy based on the assessment; and the policy enforcement point (PEP), which is the device that enforces the policy.
202
```
Which of the following devices can be a policy enforcement point in NAC? (Select all correct answers.)
A. Hub
B. Switch
C. Firewall
D.Router
```
B, C, D.
| The policy enforcement point is the device that enforces the policy. This device may be a switch, firewall, or router.
203
```
Which of the following best describes the NAC method that performs an assessment as hosts come online, and then grants appropriate access?
A. Inline
B. Out-of-band
C. Switch based
D. Host based
```
B.
The four ways NAC systems can be integrated into the network are inline, out-of-band, switch based, and host based. An out-of-band intervenes and performs an assessment as hosts come online, and then grants appropriate access.
204
```
Which of the following is a business benefit associated with the use of NAC? (Select all correct answers.)
A. Compliance
B. Separation of duties
C. Improved security posture
D. Operational cost management
```
A, C, D.
In addition to providing the capability to enforce security policy, contain noncompliant users, and mitigate threats, NAC offers a number of business benefits. The business benefits include compliance, a better security posture, and operational cost management.
205
Which of the following are ways to mitigate vulnerabilities associated with a PBX? (Select all correct answers.)
A. Changing any default passwords that have been set
B. Physically securing the area where the PBX resides
C. Implementing an encryption solution
D. Putting a data-validation system in place
A, B.
To protect your network, make sure the PBX is in a secure area, any default passwords have been changed, and only authorized maintenance is done.
Many times, hackers can gain access to the phone system via social engineering because this device is usually serviced through a remote maintenance port.
206
```
Which of the following type of attack is associated with the use of a PBX?
A. Man-in-the-middle
B. Buffer overflows
C. Denial of service
D. Social engineering
```
D.
Many times, hackers can gain access to the phone system via social engineering because this device is usually serviced through a remote maintenance port. To
protect your network, make sure the Private Branch Exchange (PBX) is in a secure area, any default passwords have been changed, and only authorized maintenance is done
207
```
Which of the following type of attack is associated with the use of VoIP? (Select all correct answers.)
A. Man-in-the-middle
B. Buffer overflows
C. Denial of service
D. Social engineering
```
A, B, C.
Man-in-the-middle attacks are executed between the SIP phone and a SIP proxy, allowing the audio to be manipulated, causing dropped, rerouted, or playback
calls. VoIP PBX servers are susceptible to the same type of exploits as other network servers. These attacks include DoS and buffer overflows, with DoS being the
most prevalent.
208
Which of the following is an inherent security risk associated with using SIP as an alternative for VoIP?
A. It leaves the network open to long-distance toll fraud.
B. It leaves the network open to war-dialing attacks.
C. It leaves the network open to unauthorized transport
of data.
D. It leaves the network open to war-driving attacks.
C. Session Initiation Protocol (SIP) is commonly used in instant messaging, but it can also be used as an alternative for VoIP. Using SIP can leave VoIP networks
open to unauthorized transport of data.
209
Which of the following is an inherent security risk associated with using a PBX?
A. It leaves the network open to long-distance toll fraud.
B. It leaves the network open to war-dialing attacks.
C. It leaves the network open to unauthorized transport
of data.
D. It leaves the network open to war-driving attacks.
A.
For years, PBX-type systems have been targeted by hackers, mainly to get free long-distance service. The vulnerabilities that phone networks are subject to
include social engineering, long-distance toll fraud, and breach of data privacy.
210
Which of the following is an inherent security risk associated with using a modem pool?
A. It leaves the network open to long-distance toll fraud.
B. It leaves the network open to war-dialing attacks.
C. It leaves the network open to unauthorized transport
of data.
D. It leaves the network open to war-driving attacks.
B.
Leaving modems open for incoming calls with little to no authentication for users dialing in can be a clear security vulnerability in the network. For example,
war-dialing attacks take advantage of this situation. War-dialing is the process by which an automated software application is used to dial numbers in a given range to
determine whether any of the numbers are serviced by modems that accept dial-in requests. Answer
211
```
Which of the following solutions can help mitigate the risks and vulnerabilities associated with VoIP? (Select all correct answers.)
A. Authentication
B. Setting the callback features
C. Data validation
D. Implementing a firewall solution
```
A, C. Implementing the following solutions can help mitigate the risks and vulnerabilities associated with VoIP: encryption, authentication, data validation, and
nonrepudiation. VoIP is basically based on a TCP/IP network; therefore, technologies that are used to secure IP networks can be used for VoIP, too.
212
```
Which of the following solutions can help mitigate the risks and vulnerabilities associated with modems? (Select all correct answers.)
A. Authentication
B. Setting the callback features
C. Data validation
D. Implementing a firewall solution
```
B, D
Setting the callback features to have the modem call the user back at a preset number and using encryption and firewall solutions will help keep the environment
safe from attacks.
213
```
Which of the following is used to prevent STP issues?
A. Loop protection
B. Flood guard
C. Implicit deny
D. Port security
```
A.
| The loop guard feature makes additional checks in Layer 2 switched networks.
214
```
Which of the following is a firewall feature used to mitigate denial of service attacks?
A. Loop protection
B. Flood guard
C. Implicit deny
D. Port security
```
B.
| A flood guard is a firewall feature to control network activity associated with denial of service attacks (DoS).
215
```
Which of the following is a Layer 2 traffic control feature?
A. Loop protection
B. Flood guard
C. Implicit deny
D. Port security
```
D.
Port security is a Layer 2 traffic control feature on Cisco Catalyst switches. It enables individual switch ports to be configured to allow only a specified number of
source MAC addresses coming in through the port.
216
```
Which of the following would best mitigate the risks associated with allowing network access to a business partner?
A. Log analysis
B. Access Control Lists
C. Network segmentation
D. Proper VLAN management
```
C.
With interconnected networks, the potential for damage greatly increases because one compromised system on one network can easily spread to other networks.
Networks that are shared by partners, vendors, or departments should have clear separation boundaries.
217
```
Which of the following would be the best solution to create multiple, isolated local networks on one switch?
A. Port security
B. Access Control Lists
C. Network segmentation
D. Proper VLAN management
```
D.
VLANs provide a way to limit broadcast traffic in a switched network. This creates a boundary and, in essence, creates multiple, isolated LANs on one switch.
VLANs are a logical separation of a physical network.
218
Which of the following best describes system logging?
A. The process of measuring the performance of a
network
B. The process of collecting data to be used for
monitoring
C. The process of tracking users and actions on the
network
D. The process of observing the state of a system
B.
| Logging is the process of collecting data to be used for monitoring and auditing purposes
219
```
To get an accurate view of a network, which of the following must precede logging?
A. Baselining
B. Auditing
C. Monitoring
D. Archiving
```
A.
Logging procedures and evaluation are an important part of keeping your network safe. However, before you can configure logging, it is essential to identify what is typical behavior for your network
220
Which of the following best describes the way logging should be implemented?
A. Only the user events should be logged.
B. Only pertinent events should be logged.
C. All events should be logged so nothing is missed.
D. Nothing should be logged until there is a need for it.
B.
When choosing what to log, be sure you choose carefully. Logs take up disk space and use system resources. They also have to be read, and if you log too
much, will bog down the system; it will take a long time to weed through the log files to determine what is important
221
```
Application logging standards should be implemented for the types of events the organization logs based on which of the following? (Select all correct answers.)
A. User requirements
B. Vendor requirements
C. Business requirements
D. Regulatory requirements
```
C, D.
Standards should be implemented for the types of events you want to log based on business, technical, and regulatory requirements, and the threats the
organization faces.
222
```
Which of the following is pertinent in addition to reading the log files?
A. Knowing how to correlate events
B. Knowing how to parse log files
C. Knowing how to delete events
D. Knowing how to export log files
```
A.
| Not only do you need to read the logs, you may also have to know how to correlate events examining output
223
Which of the following are objectives for the placement of firewalls? (Select all correct answers.)
A. Identify unnecessary protocols
B. Allow only traffic that is necessary
C. Provide notification of suspicious behavior
D. Monitor unauthorized transfer of information
B, C.
The main objective for the placement of firewalls is to allow only traffic that the organization deems necessary and provide notification of suspicious behavior.
224
Which of the following is the most likely placement of each firewall when an organization is deploying only two of them?
A. One behind the DMZ and one between the intranet and the extranet
B. One in front of the DMZ and one between the intranet
and the extranet
C. One in front of the DMZ and one between the DMZ
and the internal network
D. One in front of the DMZ and one between the financial data and the user data
C.
Most organizations deploy, at a minimum, two firewalls. The first firewall is placed in front of the DMZ to allow requests destined for servers in the DMZ or to
route requests to an authentication proxy. The second firewall is placed to allow outbound requests. All initial necessary connections are located on the DMZ machines.
For example, a RADIUS server may be running in the DMZ for improved performance and enhanced security, even though its database resides inside the company intranet.
225
Which of the following best describes the reason packet-filtering firewalls are considered unsecure as compared to other types of firewalls?
A. They allow packets regardless of communication
patterns.
B. Because of physical placement, they are very
accessible.
C. It is impossible to create a secure password for them.
D. They can be compromised with very little effort.
A.
A packet-filtering firewall is typically a router. Packets can be filtered based on IP addresses, ports, or protocols. They operate at the network layer (Layer 3) of
the Open Systems Interconnection (OSI) model. Packet-filtering solutions are generally considered less secure firewalls because they still allow packets inside the network, regardless of communication patterns within the session
226
Which of the following best describes why an organization would implement a proxy service firewall?
A. To prevent DoS attacks by unauthorized parties
B. To monitor unauthorized transfer of confidential
information
C. To capture proper documentation for forensic
investigations
D. To prevent user computers from directly accessing
the Internet
D.
Proxy service firewalls are go-betweens for the network and the Internet. They can be used to hide the internal addresses from the outside world through NAT.
This does not allow the computers on the network to directly access the Internet.
227
```
Which of the following best describes what governs the traffic of proxy service firewalls?
A. Settings
B. Rules
C. Policies
D. Guidelines
```
B.
Proxy service firewalls are go-betweens for the network and the Internet. They hide the internal addresses from the outside world and don’t allow the computers
on the network to directly access the Internet. This type of firewall has a set of rules that the packets must pass to get in or out. Because the firewall check traffic
against a set of rules, setting, policies, and guidelines are incorrect.
228
```
Which of the following technologies would you implement when setting up a switched network and you want to group users by department?
A.VPN
B.NAT
C.VLAN
D.DMZ
```
C.
The purpose of a VLAN is to unite network nodes logically into the same broadcast domain regardless of their physical attachment to the network.
229
```
Where would an organization place a web server that needs to be accessed by both the employees and by external customers?
A.VPN
B.NAT
C.VLAN
D.DMZ
```
```
D.
A DMZ is a small network between the internal network and the Internet that provides a layer of security and privacy. Answer A is incorrect because a virtual
private network (VPN) is a network connection that allows you access via a secure tunnel created through an Internet connection
```
230
```
Which of the following would an organization implement to monitor the internal network and external traffic when the source of recent security breaches is unknown? (Select all correct answers.)
A. Firewall
B. Content filter
C. Host-based IDS
D. Network-based IDS
```
C, D.
Because you want to monitor both types of traffic, the IDSs should be used together. Network-based intrusion detection systems monitor the packet flow and
try to locate packets that are not allowed for one reason or another and may have gotten through the firewall. Host-based intrusion detection systems monitor communications on a host-by-host basis and try to filter malicious data. These types of IDSs are good at detecting unauthorized file modifications and user activity. A firewall protects computers and networks from undesired access by the outside world
231
Which of the following is the most likely placement of a proxy server when a small organization is deploying it for Internet connectivity?
A. On the internal network
B. Between the internal network and the Internet
C. Between the web server and file server
D. In parallel with IP routers
B.
Proxy servers can be placed between the private network and the Internet for Internet connectivity. If the organization is using the proxy server for both Internet
connectivity and web content caching, the proxy server should be placed between the internal network and the Internet, with access for users who are requesting the web content.
232
Which of the following is the most likely placement of a proxy server when a small organization is deploying it for content caching?
A. On the internal network
B. Between the internal network and the Internet
C. Between the web server and file server
D. In parallel with IP routers
A.
| Proxy servers are usually placed internally for web content caching.
233
Which of the following is the most likely placement of a proxy server when a small organization is deploying it for both Internet connectivity and web content caching?
A. On the internal network
B. Between the internal network and the Internet
C. Between the web server and file server
D. In parallel with IP routers
B.
Proxy servers can be placed between the private network and the Internet for Internet connectivity. If the organization is using the proxy server for both Internet
connectivity and web content caching, the proxy server should be placed between the internal network and the Internet, with access for users who are requesting the web
content.
234
Which of the following is the most likely placement of a proxy server when a large organization is deploying it for Internet connectivity?
A. On the internal network
B. Between the internal network and the Internet
C. Between the web server and file server
D. In parallel with IP routers
D.
In some proxy server designs, such as for a large organization, the proxy server is placed in parallel with IP routers. This design allows for network load balancing
by forwarding of all HTTP and FTP traffic through the proxy server and all other IP traffic through the router.
235
Which of the following best describes the mechanics of Internet content filtering?
A. Analyzes data against a database contained in the
software
B. Analyzes data by scanning against a vendor provided
rule base
C. Analyzes data against preset rules contained in the
software
D. Analyzes data by matching against predefined traffic
patterns
A.
Internet content filtering works by analyzing data against a database contained in the software. Content filtering reports only on violations identified in the
specified applications listed for the filtering application. In other words, if the application will only filter Microsoft Office documents and a user chooses to use Open Office,
the content will not be filtered
236
Which of the following would be likely placements of a hardware network Internet content filtering device? (Select all correct answers.)
A. Behind the proxy/NAT point
B. On the individual user machines
C. In a DMZ with public addresses behind a packet-
filtering router
D. Connected to the same network segment as the users
monitored
A, C, D.
Network Internet content filters can be hardware or software. Many network solutions combine both. Hardware appliances are usually connected to the
same network segment as the users they will monitor. Other configurations include being deployed behind a firewall or in a DMZ, with public addresses behind a packet filtering router. These appliances use access control filtering software on the dedicated filtering appliance. The device monitors every packet of traffic that passes over a network.
237
Which of the following is the most likely reason to place a proxy server in parallel with IP routers?
A. To allow for better content caching
B. To prevent direct access to the Internet
C. To allow for network load balancing
D. To prevent unauthorized transfer of data
C.
In some proxy server designs, the proxy server is placed in parallel with IP routers. This design allows for network load balancing by forwarding of all HTTP and
FTP traffic through the proxy server and all other IP traffic through the router.
238
Which of the following are most likely placements of a network protocol analyzer? (Select all correct answers.)
A. Inline
B. On the outside of the DMZ
C. On the outside the Internet router
D. Between the devices of the traffic capture
A, D.
Protocol analyzers can be placed inline or in between the devices from which you want to capture the traffic. If you are analyzing SAN traffic, the analyzer can
be placed outside the direct link with the use of an optical splitter. The analyzer is placed to capture traffic between the host and the monitored device
239
Which of the following is the most likely placement of a packet filtering firewall?
A. In the DMZ, between it and the internal network
B. On the internal network between servers
C. Between the Internet and the protected network
D. Securing the main perimeter
C.
A packet-filtering firewall is best suited for simple networks or used to protect a network that is used mainly for Internet access. The placement of a packet filtering firewall is between the Internet and the protected network. It filters all traffic entering or leaving the network.
240
Which of the following is the most common unintended
consequence when deploying multiple firewalls?
A. Legitimate traffic gets blocked.
B. Increased network latency.
C. Increased attack vector.
D. Troubleshooting becomes complex.
B.
When deploying multiple firewalls, you might experience network latency. If you do, check the placement of the firewalls and possibly reconsider the topology to be sure you get the most out of the firewalls
241
Which of the following is the most likely placement of a proxy service firewall?
A. In the DMZ, between it and the internal network
B. On the internal network between servers
C. Between the Internet and the protected network
D. Securing the main perimeter
A.
Proxy service firewalls allow organizations to offer services securely to Internet users. All servers hosting public services are placed in the demilitarized zone
(DMZ) with the proxy firewall between the DMZ and the internal network
242
Which of the following is the most likely placement of a statefulinspection firewall?
A. In the DMZ, between it and the internal network
B. On the internal network between servers
C. Between the Internet and the protected network
D. Securing the main perimeter
D.
A stateful-inspection firewall is suited for main perimeter security. Stateful-inspection firewalls can thwart port scanning by closing off ports until a connection to the specific port is requested.
243
Which of the following is an inherent security risk in using virtual machines?
A. The BIOS can easily be compromised.
B. The boot order can be easily changed.
C. Security measures are nonexistent.
D. The entire machine can be compromised.
D.
If attackers can compromise the virtual machines, they will likely have control of the entire machine. Most virtual machines run with very high privileges on
the host because a virtual machine needs access to the host’s hardware so that it can map the physical hardware into virtualized hardware.
244
Which of the following would be the most effective method to protect a virtual environment hosting medical data?
A. Using segmented physical hardware for the virtual
servers
B. Using shared physical hardware with virtual machines
for testing
C. Using segmented physical hardware for each virtual
server
D. Using shared physical hardware with virtual machines
for web applications
A.
Segmenting virtual machines by the information they handle will keep highly sensitive data from being on the same physical hardware as virtual machines
used for testing or lower security applications. The organization should have a policy in place that states that high-security virtual machines containing vital information never share the same hardware as virtual machines for testing.
245
```
Which of the following are appropriate reasons to use virtualized environments? (Select all correct answers.)
A. Reduces threat risk
B. Allows isolation of applications
C. Reduces equipment costs
D. Allows environments on USB devices
```
B, C.
Virtual environments can be used to improve security by allowing unstable applications to be used in an isolated environment and providing better disaster
recovery solutions. Virtual environments are used for cost-cutting measures, too. One well-equipped server can host several virtual servers. This reduces the need for power and equipment. Forensic analysts often use virtual environments to examine environments that may contain malware or as a method of viewing the environment the same way the criminal did.
246
```
Which of the following controls how access to a computer’s processors and memory is shared in a virtual environment?
A. BIOS
B. Hypervisor
C. Operating system
D. Virtual machine applications
```
B.
The hypervisor controls how access to a computer’s processors and memory is shared. A hypervisor or virtual machine monitor (VMM) is a virtualization platform that provides more than one operating system to run on a host computer at the
same time.
247
In which of the following ways would a forensic analyst most likely use a virtual environment? (Select all correct answers.)
A. To view the environment the same way the criminal
did
B. To load multiple cases at once
C. To image hard drives and removable media
D. To examine environments that may contain malware
A, D.
Forensic analysts often use virtual environments to examine environments that may contain malware or as a method of viewing the environment the same
way the criminal did.
248
Which of the following is true in regard to a compromised virtual machine environment?
A. It is contained in its own environment.
B. It can provide access to the network.
C. Any threat can easily be addressed by deletion.
D. It can be replaced by a backup copy immediately
B.
Virtualized environments, if compromised, can provide access to not only the network, but also any virtualization infrastructure. This puts a lot of data at risk.
Security policy should address virtual environments
249
Which of the following is true about virtual machine environments? (Select all correct answers.)
A. They are susceptible to the same issues as a host
operating system.
B. They do not need antivirus or malware protection.
C. They need to be patched just like host environments.
D. They are contained environments that do not need
patching.
A, C.
Vulnerabilities also come into play in virtual environments. For example,a few years ago, VMware’s NAT service had a buffer-overflow vulnerability that allowed remote attackers to execute malicious code by exploiting the virtual machine itself.Virtual machine environments need to be patched just like host environments and are susceptible to the same issues as a host operating system. You should be cognizant of
share files among guest and host operating systems
250
```
In which of the following areas should the vulnerabilities of existing virtual environments be addressed?
A. Change management policy
B. Business continuity plan
C. Organizational security policy
D. Disaster recovery plan
```
C.
Security policy should address virtual environment vulnerabilities. Any technology software without a defined business need should not be allowed on systems. This applies to all systems, including virtual environments
251
Which of the following are areas where virtual environments can be used to improve security? (Select all correct answers.)
A. Scanning for malicious software
B. Reducing internal data aggregation
C. Allowing unstable applications to be isolated
D. Providing better disaster recovery solutions
C, D.
Hardware vendors are rapidly embracing virtualization and developing new features to simplify virtualization techniques. Virtual environments can be used to
improve security by allowing unstable applications to be used in an isolated environment and providing better disaster recovery solutions
252
Which of the following is the most effective method to reduce server power consumption?
A. Replacing older servers with newer low-wattage
servers
B. Combining all physical hardware into one virtualized
server
C. Using segmented physical hardware for like-kind
virtual servers
D. Using shared physical hardware for all virtual servers
C.
With more emphasis being placed on going green and power becoming more expensive, virtualization offers cost benefits by decreasing the number of physical
machines required within an environment; however, the security of the VMs must be considered. Segmenting virtual machines by the information they handle will keep
highly sensitive data from being on the same physical hardware as virtual machines used for testing or lower security applications. The organization should have a policy in place that states that high-security virtual machines containing vital information never share the same hardware as virtual machines for testing.
253
```
On which of the following types of technology can virtual environments be run? (Select all correct answers.)
A. Servers
B. Desktops
C. USB drives
D. Routers
```
A, B, C, D.
| Virtual environments are available to run on just about everything from servers and routers to USB thumb drives.
254
Which of the following best describes a hypervisor?
A. Acts as an intermediary between the kernel and the OS
B. Provides multiple hardware systems to run one OS
C. Acts as an intermediary between the kernel and the
hardware
D. Provides more than one operating system to run on a
computer
D.
A hypervisor or virtual machine monitor (VMM) is a virtualization platform that provides more than one operating system to run on a host computer at the same
time.
255
```
Security concerns of virtual environments begin with which of the following?
A. The underlying hardware
B. The guest operating system
C. The host operating system
D. The virtual machine files
```
B.
The security concerns of virtual environments begin with the guest operating system. If a virtual machine is compromised, an intruder can gain control of all the
guest operating systems. In addition, because hardware is shared, most virtual machines run with very high privileges. This can allow an intruder who compromises a virtual machine to compromise the host machine, too
256
Which of the following is an unintended security risk in using virtual machines?
A. The BIOS can easily be compromised.
B. Disaster recovery becomes more complex.
C. Most virtual machines run with high privileges.
D. Technology is advancing faster than security
C.
The security concerns of virtual environments begin with the guest operating system. If a virtual machine is compromised, an intruder can gain control of all the
guest operating systems. In addition, because hardware is shared, most virtual machines run with very high privileges. This can allow an intruder who compromises a virtual machine to compromise the host machine, too
257
Which of the following is the most effective method to secure a virtualized environment?
A. Using encryption for all communication
B. Locking down the host machine as tightly as possible
C. Hosting as many virtual machines per server as
possible
D. Segmenting by the sensitivity of the contained
information
D.
To secure a virtualized environment, machines should be segmented by the sensitivity of the information they contain. A policy should be in place that specifies
that hardware is not shared for test environments and sensitive data.
258
```
Google Apps are examples of which of the following?
A. SaaS
B. IaaS
C. PaaS
D. DaaS
```
C.
Platform-as-a-Service (PaaS) is the delivery of a computing platform, often an operating system with associated services, that is delivered over the Internet
without downloads or installation.
259
```
Which of the following creates an on-demand licensing environment without the up-front costs and maintenance associated with traditional software purchases?
A. SaaS
B. IaaS
C. PaaS
D. DaaS
```
A.
Software-as-a-Service (SaaS) is the delivery of a licensed application to customers over the Internet for use as a service on demand. Answer B is incorrect
because Infrastructure-as-a-Service (IaaS) is the delivery of computer infrastructure in a hosted service model over the Internet.
261
```
Which of the following implementations typically have Internet connectivity, computer networking, grid computing, and hardware virtualization?
A. SaaS
B. IaaS
C. PaaS
D. DaaS
```
B.
Infrastructure-as-a-Service (IaaS) is the delivery of computer infrastructure in a hosted service model over the Internet. This method of cloud computing
allows the client to literally outsource everything that would normally be in a typical IT department
262
```
Which of the following methods of cloud computing allows the client to literally outsource everything that would normally be in a typical IT department?
A. SaaS
B. IaaS
C. PaaS
D. DaaS
```
B.
Infrastructure-as-a-Service (IaaS) is the delivery of computer infrastructure in a hosted service model over the Internet. This method of cloud computing
allows the client to literally outsource everything that would normally be in a typical IT department.
263
```
Which of the following are the most commonly used cryptographic protocols for managing secure communication between a client and server over the Web? (Select all correct answers.)
A.SSL
B.TLS
C.PPTP
D.WEP
```
A, B
Both essentially serve the same purpose
with TLS being the successor to SSL.
264
```
An organization wants to use an encapsulated tunneling protocol that does not send authentication information in cleartext to support the creation of VPNs. Which of the following meets this requirement?
A. HTTP
B. PPTP
C. MIME
D. L2TP
```
D.
Layer 2 Tunneling Protocol (L2TP) is an encapsulated tunneling protocol often used to support the creation of virtual private networks (VPNs).
265
```
An organization wants to use a network protocol that enables the secure transfer of data from a remote client to a private enterprise server. Which of the following meets this requirement?
A. HTTP
B. PPTP
C. MIME
D. L2TP
```
B.
Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables the secure transfer of data from a remote client to a private enterprise server by creating a virtual private network (VPN) across TCP/IP-based data networks.
266
```
Which of the following supports on-demand, multiprotocol, and virtual private networking over public networks?
A.HTTP
B.PPTP
C.MIME
D.L2TP
```
B.
Point Tunneling Protocol (PPTP) is a network protocol that enables the secure transfer of data from a remote client to a private enterprise server by creating
a virtual private network (VPN) across TCP/IP-based data networks.
267
```
Which of the following cryptographic methods is used by SSH?
A.RSA
B.ECC
C.OTP
D.PGP
```
```
A.
Secure Shell (SSH) utilizes the asymmetric (public key) Rivest, Shamir,Adleman (RSA) cryptography method to provide both connection and authentication.
```
268
Which of the following algorithms can SSH use for data
encryption? (Select all correct answers.)
A. IDEA
B. Blowfish
C. DES
D. Diffie-Hellman
A, B, C.
Data encryption with SSH is accomplished using one of the following algorithms: International Data Encryption Algorithm (IDEA), Blowfish, or Data Encryption Standard (DES).
269
```
Which of the following secure utilities are encapsulated in the SSH suite? (Select all correct answers.)
A. slogin
B. rlogin
C. rsh
D. scp
```
A, D.
Secure Shell (SSH) provides an authenticated and encrypted data stream, as opposed to the cleartext communications of a Telnet session. The SSH
suite encapsulates three secure utilities: slogin, ssh, and scp.
270
```
Which of the following protocols does IPsec use to provide authentication services, as well as encapsulation of data?
A.HTTP
B.PPTP
C. IKE
D.PKI
```
C.
IPsec provides authentication services, as well as encapsulation of data through support of the Internet Key Exchange (IKE) protocol
271
```
An organization wants to use a protocol that has connectionless integrity and data origin authentication for IP packets. Which of the following meets this requirement?
A. IKE
B.SSH
C. IP
D.AH
```
```
D.
Authentication Header (AH) provides connectionless integrity and data origin authentication for IP packets
```
272
```
If IPsec is configured to use AH only, which of the following protocol traffic must be permitted to pass through the firewall?
A. Protocol 255
B. Protocol 51
C. Protocol 50
D. Protocol 2
```
B.
If IPsec is configured to do authentication header only (AH), you must permit protocol 51 traffic to pass through the stateful firewall or packet filter.
273
```
If IPsec is configured to use ESP only, which of the following protocol traffic must be permitted to pass through the firewall?
A. Protocol 255
B. Protocol 51
C. Protocol 50
D. Protocol 2
```
C.
Encapsulating Security Payload (ESP) provides encryption and limited traffic flow confidentiality, or connectionless integrity, data origin authentication, and
an anti-replay service. In an IP header, ESP can be identified as IP protocol number 50
274
```
If IPsec is configured for nested AH and ESP, IP can be configured to let only which of the following protocol’s traffic to pass through the firewall?
A. Protocol 255
B. Protocol 51
C. Protocol 50
D. Protocol 2
```
B.
If IPsec uses nested Authentication Header (AH) and Encapsulating Security Payload (ESP), IP can be configured to let only protocol 51 (AH) traffic pass
through the stateful firewall or packet filter.
275
```
Which of the following encryption schemes does S/MIME use?
A.RSA
B.ECC
C.OTP
D.PGP
```
A.
S/MIME utilizes the Rivest, Shamir, Adleman (RSA) asymmetric encryption scheme to encrypt electronic mail transmissions over public networks
276
```
Which of the following protocols was developed to support connectivity for banking transactions and other secure web communications, but is not commonly used?
A.HTTP
B.PPTP
C.S-HTTP
D.S/MIME
```
C.
An alternative to HTTPS is the Secure Hypertext Transport Protocol (SHTTP),which was developed to support connectivity for banking transactions and
other secure web communications
277
```
Which of the following is a specification that provides email privacy using encryption and authentication via digital signatures?
A.HTTP
B.PPTP
C.S-HTTP
D.S/MIME
```
D.
S/MIME utilizes the Rivest, Shamir, Adleman (RSA) asymmetric encryption scheme to encrypt electronic mail transmissions and provides email privacy using
encryption and authentication via digital signatures s.
278
```
Which of the following encrypts and decrypts email messages using asymmetric encryptions schemes such as RSA?
A.S/MIME
B.PGP/MIME
C.HTTP
D.PPTP
```
B.
PGP/MIME derives from the Pretty Good Privacy application and is an alternative to S/MIME. Basically, it encrypts and decrypts email messages using asymmetric
encryptions schemes such as RSA.
279
```
Which of the following TLS protocols allows the client and server to authenticate to one another?
A. Record protocol
B. Alert protocol
C. Application protocol
D. Handshake protocol
```
D.
Transport Layer Security (TLS) consist of two additional protocols: the TLS record protocol and the TLS handshake protocol. The handshake protocol allows
the client and server to authenticate to one another and the record protocol provides connection security
280
```
Which of the following TLS protocols provides connection security?
A. Record protocol
B. Alert protocol
C. Application protocol
D. Handshake protocol
```
A.
Transport Layer Security (TLS) consist of two additional protocols: the TLS record protocol and the TLS handshake protocol. The handshake protocol allows
the client and server to authenticate to one another and the record protocol provides connection security
281
```
An organization is concerned about web-based connections and wants to implement encryption and authentication. Which of the following ports will the organization typically use for secured communication?
A.8080
B.80
C.443
D.445
```
C.
| Hypertext Transfer Protocol Secure (HTTPS) traffic typically occurs over port 443.
282
```
An organization is concerned about the cleartext communications of a Telnet session. Which of the following will the organization implement to authenticate and encrypt the data stream?
A.SSL
B.TLS
C.WEP
D.SSH
```
```
D.
Secure Shell (SSH) provides an authenticated and encrypted data stream, as opposed to the cleartext communications of a Telnet session
```
283
```
Which of the following protocols supports DES, 3DES, RC2, and RSA2 encryption, along with CHAP authentication but was not widely adopted?
A.S/MIME
B.HTTP
C.PPTP
D.S-HTTP
```
D.
An alternative to HTTPS is the Secure Hypertext Transport Protocol (S-HTTP), which was developed to support connectivity for banking transactions and other secure web communications
284
```
Which of the following is a program that uses SSH to transfer files?
A.SFTP
B.S/MIME
C.HTTPS
D.S-HTTP
```
A.
SFTP, or secure FTP, is a program that uses SSH to transfer files. Unlike standard FTP, it encrypts both commands and data, preventing passwords and
sensitive information from being transmitted in the clear over the network
285
```
Which of the following is a network protocol that combines RCP and SSH but also supports file transfers?
A.SFTP
B.SCP
C.HTTPS
D. FTPS
```
B.
The Secure Copy Protocol (SCP) is a network protocol that supports file transfers. SCP is a combination of RCP and SSH. It uses the BSD RCP protocol tunneled
through the Secure Shell (SSH) protocol to provide encryption and authentication.
286
```
There are reports that the FTP ports that are required for contract worker functionality are inaccessible. Which of the following ports would you check?
A.137/138/139
B.161/162
C.20/21
D.25/110/143
```
C
287
```
Several organizational users are experiencing network and Internet connectivity issues. Which of the following protocols would be used for troubleshooting the connectivity problems?
A. SSL
B. ICMP
C. IPsec
D.SNMP
```
B.
| Traceroute uses an ICMP echo request packet to find the path between two addresses.
288
```
Which of the following services/protocols operate on Port 22?
A.DNS
B.SCP
C.HTTPS
D.SMB
```
B
289
```
Which of the following services/protocols operate on Port 443?
A.DNS
B.SCP
C.HTTPS
D.SMB
```
C
290
```
Which of the following services/protocols operate on Port 53?
A.DNS
B.SCP
C.HTTPS
D.SMB
```
A
291
```
Which of the following services/protocols operate on Port 445?
A.DNS
B.SCP
C.HTTPS
D.SMB
```
D
292
```
Which of the following services/protocols operate on Port 23?
A.SMTP
B.TFTP
C.Telnet
D.POP3
```
C
293
```
Which of the following services/protocols operate on Port 110?
A.SMTP
B.TFTP
C.Telnet
D.POP3
```
D
294
```
Which of the following ports will need to be opened to allow SMTP traffic?
A.22
B.21
C.25
D.23
```
C
295
```
Which of the following ports will need to be blocked to filter SNMP traffic? (Select two answers.)
A.161
B.1812
C.443
D.162
```
A,D
296
```
Which of the following services/protocols operate on Port 1812?
A. NetBios
B. RADIUS
C. Portmap
D. HTTPS
```
B
297
```
Which of the following ports will need to be opened to allow HTTP and HTTPS traffic? (Select two answers.)
A.110
B.80
C.443
D.25
```
B,C
298
```
Which of the following services/protocols operate on Port 990?
A. FTPS
B.SCP
C.HTTPS
D.SMB
```
A
299
```
Which of the following services/protocols operate on Port 15?
A.NetBios
B.Portmap
C.Telnet
D.Netstat
```
D
300
```
Which of the following ports will need to be opened to allow incoming and outgoing email traffic? (Select two answers.)
❍ A.443
❍ B.110
❍ C.23
❍ D.25
```
B,D
301
```
Which of the following services/protocols operate on Port 137?
A. NetBios
B. Portmap
C. Telnet
D. Netstat
```
A
302
```
Which of the following services/protocols operate on Port 111?
A.NetBios
B.Portmap
C.Telnet
D.Netstat
```
B
303
```
Which of the following ports will need to be blocked to filter NetBios traffic? (Select three answers.)
A.137
B.445
C.138
D.139
```
A, C, D
304
```
Which of the following services/protocols operate on Port 22? (Select three answers.)
A.SSH
B.SCP
C.SFTP
D.TFTP
```
A, B, C
305
```
Which of the following services/protocols operate on Port 69?
A.FTP
B.TFTP
C.SFTP
D.SSL
```
B
306
```
Which of the following services/protocols operate on Port 21?
A.SFTP
B.SSL
C. FTP
D.TFTP
```
C
307
```
Which standard port will be used to establish a web connection using the 40-bit RC4 encryption protocol?
A.110
B.445
C.138
D.443
```
D
| A connection using the HTTP protocol over SSL (HTTPS) will be made using the RC4 cipher and will be made using port 443
308
```
Which of the following encryption standards currently is the most secure for Wi-Fi connections?
A.WAP
B.WPA2
C.WEP2
D.WEP
```
B
309
When a client attempts to make an 802.1x-compliant connection, which of the following best describes how the AP authenticates the client?
A. Users provide a shared password.
B. Through hardware token authentication.
C. Through a basic challenge-response method.
D. Users provide an identifier along with a password.
C
When a client attempts to make an 802.1x-compliant connection, the client attempts to contact a wireless access point (AP). The AP authenticates the client
through a basic challenge-response method, and then provides connectivity to a wired network or serves as a bridge to a secondary wireless AP.
310
```
Using the Temporal Key Integrity Protocol (TKIP) or Wi-Fi Protected Access (WPA/WPA2) standards would be most useful in preventing which of the following attacks?
A. Weak encryption
B. Data emanation
C. Bluejacking
D. War-driving
```
A
311
Which of the following is the most basic form of encryption that can be used on 802.11-based wireless networks to provide privacy of data sent between a wireless client and its access point?
A. Wireless Application Environment (WAE)
B. Wireless Session Layer (WSL)
C. Wireless Transport Layer Security (WTLS)
D. Wired Equivalent Privacy (WEP)
D
312
```
The Wi-Fi Protected Access standards were developed by the Wi-Fi Alliance to replace which of the following?
A.DES
B.WAP
C.AES
D.WEP
```
D
313
```
Which of the following are non-vendor-specific strong authentication protocols for wireless communications? (Select two.)
A.EAP
B.PEAP
C.LEAP
D.WEP
```
A,C
314
```
Which of the following reduces vulnerability to replay attacks through 128-bit keys and a 48-bit initialization vector (IV)?
A.WEP
B. ICMP
C.WPA
D.CCMP
```
D
315
```
Which of the following combines centralized two-way authentication with dynamically generated wireless equivalent privacy keys or WEP keys?
A.EAP
B.PEAP
C.LEAP
D.WEP
```
C
316
```
Which of the following can be used to mitigate the security risk on an antenna that is too strong?
A. Antenna placement
B. Power level controls
C. SSID broadcast
D. MAC filtering
```
B
317
```
Which of the following is a wireless security measure that permits and denies network access through the use of blacklists and whitelists?
A. Antenna placement
B. Power level controls
C. SSID broadcast
D. MAC filtering
```
D
318
```
Which of the following are ways to mitigate the vulnerabilities of wireless networks? (Select all correct answers.)
A. Requiring WPA2 encryption
B. Turning off SSID broadcast
C. Turning on DHCP on the WAP
D. Restricting access by MAC addresses
```
A,B,D
319
```
Which of the following is most closely linked to packet sniffing?
A. SSID broadcast
B. Application flaws
C. Application development
D. Automated attacks
```
A
320
Which of the following best describes the result of adding a MAC address to the approved list?
A. It is considered part of the whitelist.
B. It is considered part of the blacklist.
C. It is considered part of the graylist.
D. It is considered part of the brownlist
A
321
```
You have a network on which there are mixed vendor devices and are required to implement a strong authentication solution for wireless communications. Which of the following would best meet your requirements? (Select two.)
A.PEAP
B.WEP
C.LEAP
D.EAP
```
A,D
322
```
Which of the following includes a packet number (PN) field and produces a message integrity code (MIC) providing data origin authentication and data integrity for the packet payload data?
A.WPA
B.WEP
C.CCMP
D. ICMP
```
C
323
Which of the following is an IPv6 address?
(A) 192.168.1.100
(B) 192.168.1.100 /128
(C) FE80: 20D4: 3FF7: 003F: DE62
(D) FE80: 0000: 0000: 0000: 20D4: 3FF7: 003F: DE62
D
An IPv6 address uses 128-bit IP addresses and includes eight groups of four hexadecimal characters. Double colons indicate no compression so the zeros must be shown
324
What are 3 common attacks against switches?
Mac Flooding
ARP poisoning
Spanning Tree attacks
325
What is a Mac flooding attack?
Involves sending a switch lots of Ethernet frames with different source MAC addresses. The switch caches the MAC addresses against the port they arrive on. If too many are sent the cache is overloaded. This forces the switch to broadcast to all the ports, thus acting like a hub. This allows hackers to sniff out ALL the ports using dsniff or ettercap.
326
What is ARP poisoning?
The attacker enters false MAC-IP address mapping into the switch's Address Resolution Protocol table. This false mapping sets up the attacker as the subnets default gateway and all traffic is sent to him. This allows them to receive and send data masquerading as an authorized user.
327
What is Spanning Tree attacks?
A form of DoS attacks that target the Spanning Tree Protocol (STP). The STP prevents looped broadcast traffic between switches. The attack mimics the root bridge and the traffic storms may crash the network.
328
What can you do to secure a switch against attacks?
1. configure port security - restrict the number of MAC address and configure authentication at the port level.
disable unused ports - place unused ports in a vLAN that is not allowed to connect to the network.
2. keep the switch updated - firmware updates
3. mitigate spanning tree attacks - enable features to prevent attacks, such as Loop Guard, Root Guard and portfast. Use IEEE 802.iD protocol
4. Secure the management console - use ACL to restrict hoses.
329
What is the difference of a Switch and a router?
Switches divide a network into different collision domains.
| Routers divide networks into subnets.They connect switches to one another and to the internet.
330
What OSI layer does a router work at?
Layer 3 - network layer.
They provide complex signaling and packet translations and allow for some security filtering such the blocking of specific ports, broadcast traffic, and traffic without a correct network address.
331
What OSI model layer doe the switch work at?
Layer 2 - Data link
Used to divide a network into separate segments (logically-VLAN or physically). Each port is a separate collision domain.
332
How does a switch limit the network traffic within each segment?
It checks the destination of the received traffic against the media access control or MAC address table residing in the switch. It then forwards the traffic to the specific port for that address.
333
What is the primary difference between a switch and a hub?
A hub broadcasts the message to ALL ports while a switch uses the MAC address table to determine which port to send the message(P2P).
334
How do you implement Switch separation/Isolation?
Physical - Use separate switches with it own routers that do not connect.
Logical (VLAN) on switches using routers.
335
What protocol do you use to prevent looping of packets on a switch?
Spanning Tree Protocol (STP).
336
What switch IEEE MAC bridges standard was designed to allow for looping for redundancy but prevents packets from being looped?
802.1D and the most common protocol that is based on this is STP
337
How do routers optimize data transmission?
monitor active paths between source and destination networks and select the best routes for information in response to traffic loads and line speeds.
338
What protocols do dynamic routers use to communicate with each other?
Open Shortest Path First (OSPF)
Routing Information Protocol (RIP)
Border Gateway Protocol (BGP)
339
What secure protocols should be used for router communication?
SSH
HTTPS
SCP
340
How do you make a router a packet filtering firewall?
By using ACL traffic is allow/disallowed based on IP and port number, source and destination.
341
What are the private IP ranges?
10. 0.0.1 - 10.255.255.254
172. 16.0.1 - 172.31.255.254
192. 168.0.1 - 192.168.255.254
342
What is Trunking?
When 2 computers are on the same VLAN but are on different physical switches (different buildings). They can still talk to each other without having to be routed.
343
How does trunking work if you are on the same switch but different VLANs?
The request is sent out the switch to the trunking router to check the ACL. If it passes then it goes back to the switch to the destination port.
344
What devices can NAT be used?
On border devices:
| Firewalls and proxy servers
345
How does NATP work (Port Address Translation)?
maps multiple private IPs to a single public IP using different ports
346
What is Dynamic NAT
Uses a pool of public IPs and binds a private IP to one of the IPs in the public pool. The address translation is held until the connection ends. This is limited to the number of public IPs in the pool.
347
What is port forwarding?
Also known as Destination NAT. It is when inbound traffic is requesting a resource by its public IP and port which is translated to the private IP. Ex a user requesting a web page requests the public IP for the web server and the NAT will translate it to the internal private IP for the web server.
348
How does NAT work?
1. maps a public IP on inbound traffic to an internal IP (Destination NAT)
2. maps multiple internal IP to a single public IP via port mapping (Source NAT)
3. maps internal IP addresses to a public address for internal requests made by internal users (Source NAT)
