CH 13 FIREWALL QUESTIONS

Question 1

Security on the Internet was considered as a priority and was designed from the start.

True

False

Answer 1

False

Question 2

The Linux packet filter and firewall infrastructure is referred to as _________.

A) Packfilter

B) Netflix

C) Netpackets

D) Netfilter

Answer 2

D) Netfilter

Question 3

The main principle of Netfilter is:

A) to act only as a firewall.

B) to make decisions on how and when packets should flow.

C) to filter inappropriate websites from being viewed in a web browser.

D) to capture packets and release them only when the administrator allows.

Answer 3

B) to make decisions on how and when packets should flow.

Question 4

The iptables command specifically manages traffic over the _______ protocol(s).

A) IPv4 AND IPv6

B) IPv4

C) IPv6

D) TCP

Answer 4

B) IPv4

Question 5

The command to modify Netfilter’s IPv6 configuration is ________:

A) ip

B) ip6tables

C) iptablesv6

D) ipv6tables

Answer 5

B) ip6tables

Question 6

The _________ is responsible for handling network address translation.

A) NAT table

B) raw table

C) filter table

D) mangle table

Answer 6

A) NAT table

Question 7

The most common use of the NAT table is to:

A) IP masking.

B) Doman Name Server translation.

C) allow multiple systems to access another network.

D) DHCP aliasing.

Answer 7

C) allow multiple systems to access another network.

Question 8

The _____ table is responsible for altering or marking packets.

A) mangle

B) NAT

C) filter

D) raw

Answer 8

A) mangle

Question 9

The raw table is used mainly for dealing with packets at a very _____________.

A) low level

B) even flow

C) high level

D) fast pace

Answer 9

A) low level

Question 10

The _____ table is responsible for providing basic packet filtering.

A) mangle

B) raw

C) NAT

D) filter

Answer 10

D) filter

Question 11

Network Address Translation (NAT) allows administrators to hide hosts ______________________.

A) only on the source side of a packet

B) on chesnuts roasting on an open fire

C) on both sides of a router

D) only on the destination side of a packet

Answer 11

C) on both sides of a router

Question 12

DNAT is also known as the “demilitarized zone.”

True

False

Answer 12

False

Question 13

SNAT changes the source IP address and port number so it appears different to the ‘outside world.’

True

False

Answer 13

True

Question 14

Masquerading is really just a special case of_______________.

Answer 14

SNAT

Question 15

Netfilter’s ability to ensure that packet headers are examined to be sure they are safe to route is referred to as

A) NAT monitoring

B) Stateless connection tracking

C) Stateful connection tracking

D) Internet connection tracking

Answer 15

C) Stateful connection tracking

Question 16

NAT alone is sufficient to provide network security

True

False

Answer 16

False

Question 17

________ are a list of rules that acts on a packet flowing through a Linux system.

A) Chains

B) Routes

C) Ropes

D) Channels

Answer 17

A) Chains

Question 18

There are_________pre-defined chains in Netfilter.

Answer 18

5

PREROUTING - the first chain that is fired when a packet enters the system. Can invoke rules in filter, mangle and NAT tables. Allows for immediate exclusion of packets before any other processing is done.

FORWARD - fired when IP forwarding is enabled and the packet’s destination IP address is on another host. This would be a situation if the Linux server is configured as a gateway server.

INPUT - fired only when packet is destined for host itself. Can call rules in the filter and mangle tables. Final step for inbound packets. From here, applications at layer 4 and above can begin to interact with transmitted data.

OUTPUT - Fired when a packet is being sent FROM the host itself to a destination address. Simialr to PREROUTING but for data leaving the host. Can run rules in the filter, mangle, and NAT tables.

POSTROUTING - generally the SNAT actions (changing the source IP address/port) are done here for outbound packets. Stateful connection tracking can also be enabled here.

Question 19

Besides OUTPUT, which two of the default chains also uses the NAT table?

A) POSTROUTING

B) OUTPUT

C) INPUT

D) FORWARD

E) PREROUTING

Answer 19

A) POSTROUTING

E) PREROUTING