CH.3 EXPLORING NETWORK TECHNOLOGIES Flashcards
An outside consultant performed an audit of the Municipal House of Pancakes network. She identified a legacy protocol being used to access browser-based interfaces on switches and routers within the network. She recommended replacing the legacy protocol with a secure protocol to access these network devices using the same interface. Which of the following protocols should be implemented?
A. The newest fully supported version of SSL
B. The newest fully supported version of TLS
C. The newest fully supported version of LDAPS
D. The newest fully supported version of SNMP
B is correct. The newest version of Transport Layer Security (TLS) should be implemented to access the network devices. Because the scenario says the same interface is needed, the only possible choices are TLS or Secure Sockets Layer (SSL). However, SSL has been deprecated and should not be used. Lightweight Directory Access Protocol Secure (LDAPS) is used to communicate with directories such as Microsoft Active Directory. Simple Network Management Protocol version 3 (SNMPv3) adds security to SNMP and encrypts the credentials sent to and from the network devices, but it doesn’t support access via a browser interface.
Your organization’s security policy requires that confidential data transferred over the internal network must be encrypted. Which of the following protocols would BEST meet this requirement?
A. FTP
B. SSH
C. SNMPv3
D. SRTP
B is correct. You can use Secure Shell (SSH) to encrypt confidential data when transmitting it over the network. Secure File Transfer Protocol (SFTP) uses SSH to encrypt File Transfer Protocol (FTP) traffic, but FTP is unencrypted. Simple Network Management Protocol version 3 (SNMPv3) is used to monitor and manage network devices, not transmit data over a network. Secure Real-Time Transport Protocol (SRTP) provides encryption, message authentication, and integrity for voice and video, but not all data.
Maggie needs to collect network device configuration information and network statistics from devices on the network. She wants to protect the confidentiality of credentials used to connect to these devices. Which of the following protocols would BEST meet this need?
A. SSH
B. FTPS
C. SNMPv3
D. TLS
Correct Answer: C) SNMPv3
SNMPv3 (Simple Network Management Protocol version 3) allows Maggie to collect configuration information and network statistics while ensuring the confidentiality of credentials. It supports authentication and encryption, making it secure for managing network devices.
A) SSH: Secures remote access to devices but is not designed for collecting network configuration information or statistics.
B) FTPS: Secures file transfers, not network management tasks.
D) TLS: Provides encryption for various protocols but is not specifically used for managing or collecting statistics from network devices.
Which one of the following components would not be able to communicate on the data plane of a zero trust network?
A. Subject
B. Enterprise resource
C. Policy enforcement point
D. Policy administrator
D is correct. The Policy Administrator (PA) exists entirely on the control plane. It sends decisions to the Policy Enforcement Point (PEP), which is able to communicate on both the control plane and the data plane. The subject and the enterprise resource that the subject wishes to access communicate only on the data plane and may not access the control plane.
You are configuring a web server that will contain information about your organization and receive orders from your customers. Which one of the following network locations is the best placement for this server?
A. Screened subnet
B. Intranet
C. Extranet
D. Internet
A is correct. Systems that must be accessed by the general public should always be placed on the screened subnet. This network is designed to house systems that require public access but still must be secured. Organizations should almost never place systems directly on the Internet because they would not be protected by the firewall. The intranet and extranet are private networks with limited access and would not be appropriate locations for a public web server.
Maggie is examining traffic on a network searching for signs of insecure protocol use. She sees communications taking place on several different network ports. Which one of these ports most likely contains insecure traffic?
A. 22
B. 80
C. 443
D. 587
B is correct. Port 80 is used by the unencrypted Hypertext Transfer Protocol (HTTP). Secure web communications should take place using the encrypted HTTP Secure (HTTPS) on port 443. Port 22 is used by Secure Shell (SSH) for encrypted administrative connections and data transfers. Port 587 is used by the Simple Mail Transfer Protocol Secure (SMTPS) to transfer email messages between servers over an encrypted connection.
You are tasked with enabling NTP on some servers within your organization’s screened subnet. Which of the following use cases are you MOST likely supporting with this action?
A. Encrypting voice and video transmissions
B. Providing time synchronization
C. Enabling email usage
D. Encrypting data in transit
B is correct. The Network Time Protocol (NTP) provides time synchronization services, so enabling NTP on servers in the screened subnet (sometimes called a demilitarized zone or DMZ) would meet this use case. The Secure Real-time Transport Protocol (SRTP) provides encryption, message authentication, and integrity for audio and video over IP networks. Protocols such as Simple Mail Transfer Protocol (SMTP), Post Office Protocol v3 (POP3), and Internet Message Access Protocol version 4 (IMAP4) are used for email. Encrypting data isn’t relevant to time synchronization services provided by NTP.
Your organization has several switches in use throughout the internal network. Management wants to implement a security control to prevent unauthorized access to these switches within the network. Which of the following choices would BEST meet this need?
A. Disable unused ports.
B. Disable STP.
C. Enable SSH.
D. Enable DHCP.
A is correct. You can prevent unauthorized access by disabling unused physical ports on the switches as an overall port security practice. This prevents the connection if someone plugs their computer into an unused disabled ports. Spanning Tree Protocol (STP) prevents switching loop problems and should be enabled. Secure Shell (SSH) encrypts traffic and can be used to connect to network devices for management, but it doesn’t directly protect a switch. Dynamic Host Configuration Protocol (DHCP) is used to dynamically issue IP addresses and is unrelated to this scenario.
Network administrators manage network devices remotely. However, a recent security audit discovered they are using a protocol that allows them to send credentials over the network in cleartext. Which of the following is the best method to be adopted to eliminate this vulnerability?
A. Use SNMPv2c.
B. Use SSH.
C. Use SSL.
D. Use TLS.
Correct Answer: B) Use SSH
SSH (Secure Shell) is the best method to eliminate the vulnerability of transmitting credentials in cleartext. SSH encrypts the communication, including credentials, ensuring secure remote management of network devices.
A) Use SNMPv2c: Still sends community strings (used as credentials) in cleartext, which does not address the issue. SNMPv3 would be required for encryption.
C) Use SSL: SSL can secure some communications, but it is not specifically designed for managing network devices remotely. Additionally, SSL is outdated, and TLS is the modern replacement.
D) Use TLS: While TLS provides encryption for many protocols (e.g., HTTPS), it is not designed for direct remote management of network devices.
Which of the following devices would MOST likely have the following entries used to define its operation?
o permit IP any any eq 80
o permit IP any any eq 443
o deny IP any any
A. Firewall
B. Proxy server
C. Web server
D. Jump server
Correct Answer: A) Firewall
A firewall uses rules like “permit” and “deny” to control traffic flow based on IP addresses, protocols, and ports. The entries in the question represent a typical access control list (ACL) configuration on a firewall, allowing traffic for HTTP (port 80) and HTTPS (port 443) while denying all other traffic.
B) Proxy server: Acts as an intermediary for client-server communication but does not use ACLs to define its operation in this manner.
C) Web server: Hosts websites and responds to HTTP/HTTPS requests but does not control traffic using permit/deny rules.
D) Jump server: Provides secure remote access to other servers but does not use ACL rules like those shown.
The Springfield Nuclear Power Plant has several stand-alone computers used for monitoring. Employees log on to these computers using a local account to verify proper operation of various processes. The CIO of the organization has mandated that these computers cannot be connected to the organization’s network or have access to the Internet. Which of the following would BEST meet this requirement?
A. Air gap the computers.
B. Place the computers in a screened subnet.
C. Create a separate isolated network for these computers.
D. Place the computers within a VLAN.
A is correct. The best choice of the available answers is to air gap the computers. An air gap provides physical isolation, indicating that there is a gap of air between an isolated system and other systems. A screened subnet (sometimes called a demilitarized zone or DMZ) provides a buffer between the Internet and an internal network and would connect these computers to both the internal network and the Internet. The scenario doesn’t indicate the computers need to be connected, so a separate isolated network is not needed. Placing the computers within a virtual local area network (VLAN) would connect the computers to a network.
You have added another router in your network. This router provides a path to a limited access network that isn’t advertised. However, a network administrator needs to access this network regularly. Which of the following could he do to configure his computer to access this limited network?
A. Implement QoS technologies.
B. Add a VLAN.
C. Use the route command.
D. Open additional ports on the router.
C is correct. The route command can be used to display and manipulate the routing table on a Linux computer. Using this, you can provide another gateway path through this router to the limited access network. None of the other choices can add routing paths.
Quality of Service (QoS) technologies allow administrators to give priority of some network traffic over other network traffic.
A virtual local area network (VLAN) is used to segment or isolate a network, so configuring one won’t grant access to a network.
A router doesn’t have ports that can be opened for individual users.
Several servers in your organization’s screened subnet were recently attacked. After analyzing the logs, you discover that many of these attacks used TCP, but the packets were not part of an established TCP session. Which of the following devices would provide the BEST solution to prevent these attacks in the future?
A. Stateless firewall
B. Stateful firewall
C. Network firewall
D. Web application firewall
Answer: B) Stateful firewall
A stateful firewall inspects the state of every TCP connection, ensuring that only packets belonging to a properly established session (e.g., via a valid TCP three-way handshake) are allowed, blocking those that are not part of an established session.
A) Stateless firewall: Filters packets based on static rules like IP, port, or protocol but does not track the state of TCP sessions, making it ineffective against such attacks.
C) Network firewall: A general term that can refer to either stateless or stateful firewalls, lacking specificity to address the problem.
D) Web application firewall (WAF): Protects web applications by filtering HTTP/HTTPS traffic at the application layer, not TCP traffic at the transport layer.
Your network currently has a dedicated firewall protecting access to a web server. It is currently configured with only the following two rules in the ACL:
PERMIT TCP ANY ANY 443
PERMIT TCP ANY ANY 80
You have detected DNS requests and DNS zone transfer requests coming through the firewall and you need to block them. Which of the following would meet this goal? (Select TWO. Each answer is a full solution.)
A. Add the following rule to the firewall: DENY TCP ALL ALL 53.
B. Add the following rule to the firewall: DENY UDP ALL ALL 53.
C. Add the following rule to the firewall: DENY TCP ALL ALL 25.
D. Add the following rule to the firewall: DENY IP ALL ALL 53.
E. Add an implicit deny rule at the end of the ACL.
D and E are correct. The easiest way is to add an implicit deny rule at the end of the access control list (ACL) and all firewalls should have this to block all unwanted traffic. You can also deny all IP traffic using port 53 with DENY IP ALL ALL 53.
Domain Name System (DNS) requests use UDP port 53, and DNS zone transfers use TCP port 53, so blocking only TCP 53 or UDP 53 does not block all DNS traffic.
Port 25 is for Simple Mail Transfer Protocol (SMTP) and unrelated to this question.
Which layer of the OSI model is responsible for handling IP addresses and routing traffic between networks?
A) Physical
B) Data Link
C) Network
D) Application
C) Network
Explanation: The Network layer (Layer 3) handles IP addressing and routing traffic between different networks.
The process of establishing a TCP connection involves which of the following steps?
A) SYN, SYN/ACK, ACK
B) HELLO, SYN, ACK
C) ACK, FIN, SYN
D) SYN, ACK, FIN
Answer: A) SYN, SYN/ACK, ACK
Explanation: A TCP connection is established through a three-way handshake: SYN (synchronize), SYN/ACK (synchronize/acknowledge), and ACK (acknowledge).
Which port does Secure Shell (SSH) use to encrypt and secure connections?
A) 21
B) 80
C) 22
D) 443
Answer: C) 22
Explanation: SSH operates on TCP port 22 and encrypts connections, often used for secure remote administration.
To secure HTTP traffic, which protocol is used, and on what port does it operate?
A) HTTPS on port 443
B) HTTP on port 80
C) FTP on port 21
D) IMAP on port 143
Answer: A) HTTPS on port 443
Explanation: HTTPS uses SSL/TLS to secure HTTP traffic, and it operates on TCP port 443.
Which protocol is used to synchronize time across network devices?
A) DHCP
B) DNS
C) NTP
D) RDP
Answer: C) NTP
Explanation: NTP (Network Time Protocol) is used to synchronize time across devices within a network, which is critical for security and logging.
Which layer of the OSI model is responsible for managing MAC addresses and ensuring data is properly framed?
A) Physical
B) Data Link
C) Transport
D) Application
Answer: B) Data Link
The Data Link layer (Layer 2) is responsible for managing MAC (Media Access Control) addresses, ensuring proper framing of data, and handling error detection for frames transmitted over a local network.
A) Physical: Handles raw bit transmission over the physical medium but does not deal with MAC addresses or data framing.
C) Transport: Manages end-to-end communication, reliability, and port numbers but not MAC addressing or framing.
D) Application: Provides network services to applications and user interfaces but is not involved in MAC address handling or framing.
What is the primary purpose of DNS within a network?
A) Assigning IP addresses dynamically
B) Resolving hostnames to IP addresses
C) Encrypting network traffic
D) Monitoring network devices
Answer: B) Resolving hostnames to IP addresses
Explanation: DNS (Domain Name System) resolves hostnames to IP addresses, enabling users to connect to websites using domain names.
Which port is used by the Simple Mail Transfer Protocol (SMTP) for sending email securely?
A) 25
B) 110
C) 587
D) 443
Answer: C) 587
Explanation: SMTP uses port 587 for encrypted connections via TLS, while port 25 is typically used for unencrypted connections.
What is the purpose of ARP (Address Resolution Protocol) in a network?
A) Resolving domain names to IP addresses
B) Encrypting network traffic
C) Resolving IP addresses to MAC addresses
D) Routing data across different networks
Answer: C) Resolving IP addresses to MAC addresses
Explanation: ARP maps IP addresses to MAC addresses on a local network, enabling devices to communicate directly on the same network.
Which OSI layer ensures communication between applications by managing connections and maintaining sessions?
A) Network
B) Transport
C) Presentation
D) Session
Answer: D) Session
The Session layer (Layer 5) is responsible for establishing, managing, and terminating sessions between applications on different devices.
A) Network: Handles routing and forwarding based on IP addresses at Layer 3 but does not manage sessions.
B) Transport: Ensures reliable delivery of data using protocols like TCP but does not manage application-level sessions.
C) Presentation: Focuses on data formatting, encryption, and compression, not session management.
Which protocol replaces SSL for securing web traffic?
A) FTP
B) IMAP
C) TLS
D) DHCP
Answer: C) TLS
Explanation: TLS (Transport Layer Security) is the secure successor to SSL, providing encryption and security for web traffic and other protocols.
What does the “implicit deny” rule in an access control list (ACL) signify?
A) All traffic is allowed unless specified
B) All traffic is blocked unless explicitly allowed
C) Only secure traffic is allowed
D) Only unencrypted traffic is allowed
Answer: B) All traffic is blocked unless explicitly allowed
Explanation: “Implicit deny” means that any traffic not explicitly allowed by the ACL is automatically denied as a default security measure.
What is the purpose of DHCP in a network?
A) Resolving domain names to IP addresses
B) Automatically assigning IP addresses
C) Encrypting traffic
D) Blocking malicious websites
Answer: B) Automatically assigning IP addresses
Explanation: DHCP (Dynamic Host Configuration Protocol) assigns IP addresses to devices on a network dynamically, reducing manual configuration.
Which OSI layer is primarily concerned with encryption and data formatting?
A) Session
B) Data Link
C) Presentation
D) Application
Correct Answer: C) Presentation
The Presentation Layer (Layer 6) is primarily concerned with encryption, data formatting, and ensuring that data is presented in a readable and standardized format for the application layer. It handles tasks such as compression, translation, and encryption/decryption of data.
A) Session: Manages sessions or connections between devices but does not handle encryption or data formatting.
B) Data Link: Ensures reliable data transfer within a network segment and handles MAC addressing but does not deal with encryption or formatting.
D) Application: Interfaces directly with the user and applications, relying on the presentation layer for data formatting and encryption.
What is the primary purpose of a firewall in network security?
A) Monitoring device performance
B) Filtering traffic to control access
C) Assigning IP addresses
D) Resolving domain names
Answer: B) Filtering traffic to control access
Explanation: Firewalls filter incoming and outgoing traffic based on defined security rules, controlling access to and from a network.
Which protocol is commonly used for secure file transfer and uses TCP port 22?
A) FTP
B) SFTP
C) SMTP
D) TFTP
Answer: B) SFTP
SFTP (Secure File Transfer Protocol) is used for secure file transfer and operates over TCP port 22, utilizing SSH for encryption and authentication.
A) FTP: File Transfer Protocol, insecure, uses TCP ports 20 and 21.
C) SMTP: Simple Mail Transfer Protocol, used for sending emails, operates on ports 25 (unsecure) or 587(secure).
D) TFTP: Trivial File Transfer Protocol, insecure, uses UDP port 69.
In which OSI layer does the Spanning Tree Protocol (STP) operate to prevent network loops?
A) Physical
B) Data Link
C) Network
D) Transport
Answer: B) Data Link
Explanation: The Data Link layer (Layer 2) hosts protocols like STP that help prevent network loops in switches and bridges.
Which of the following protocols is commonly used for domain name resolution and operates over UDP?
A) SMTP
B) ICMP
C) HTTP
D) DNS
Answer: D) DNS (Domain Name System)
DNS resolves domain names to IP addresses and commonly uses UDP for queries on port 53.
A) SMTP (Simple Mail Transfer Protocol): Used for sending emails, operates on TCP ports 25 (insecure) and 587 (secure with STARTTLS).
B) ICMP (Internet Control Message Protocol): Used for network diagnostics (e.g., ping), doesn’t use TCP or UDP, operates at the network layer.
C) HTTP (Hypertext Transfer Protocol): Used for web traffic, operates over TCP port 80 (insecure).
Which protocol enables administrators to monitor and manage network devices and uses UDP ports 161 and 162?
A) SSH
B) SNMP
C) SMTP
D) DHCP
Answer: B) SNMP (Simple Network Management Protocol)
SNMP enables administrators to monitor and manage network devices, using UDP port 161 for sending requests and UDP port 162 for receiving traps (alerts from devices).
A) SSH (Secure Shell): Used for secure remote command-line access and file transfer, operates over TCP port 22.
C) SMTP (Simple Mail Transfer Protocol): Used for sending emails, operates on TCP ports 25 (insecure) and 587 (secure with STARTTLS).
D) DHCP (Dynamic Host Configuration Protocol): Used for assigning IP addresses dynamically, operates over UDP ports 67 (server) and 68 (client).Answer:
A network administrator needs to secure communication between two remote sites over the internet. Which protocol should they implement to ensure encryption for data in transit?
A) HTTPS
B) IPsec
C) FTP
D) Telnet
Answer: B) IPsec (Internet Protocol Security)
IPsec ensures encryption and secure communication for data in transit over the internet by providing confidentiality, integrity, and authentication at the network layer.
A) HTTPS (Hypertext Transfer Protocol Secure): Secures web traffic over TCP port 443 but is specific to browser-based communication, not general site-to-site communication.
C) FTP (File Transfer Protocol): Used for file transfers over TCP ports 20 and 21 but does not provide encryption.
D) Telnet (Teletype Network): Provides remote access over TCP port 23 but transmits data, including credentials, in plaintext, making it insecure.
You are troubleshooting a connectivity issue between two systems on the same local network. You suspect there’s an issue with resolving IP addresses to MAC addresses. Which tool would best assist in diagnosing this issue?
A) Ping
B) ARP
C) Tracert
D) Netstat
Answer: B) ARP
Explanation: The ARP (Address Resolution Protocol) table can be checked to see if IP addresses are correctly mapped to MAC addresses, which is critical for local network communication.
A) Ping: Tests basic connectivity between devices but does not directly address IP-to-MAC resolution issues.
C) Tracert (Trace Route): Tracks the path packets take to reach a remote system, used for diagnosing routing issues, not local address resolution.
D) Netstat (Network Statistics): Displays active network connections and listening ports but does not address IP-to-MAC resolution.
A company wants to limit access to certain network resources based on the employees’ department. Which network device and configuration should they use to ensure departments are isolated on the same switch?
A) Router with ACLs
B) Firewall with rules
C) VLANs on a managed switch
D) Hub with port mirroring
Answer: C) VLANs (Virtual Local Area Networks) on a managed switch
VLANs isolate network traffic by logically separating devices on the same physical switch based on departments, ensuring each VLAN has distinct access to resources.
A) Router with ACLs (Access Control Lists): Filters traffic between networks but does not isolate devices on the same switch.
B) Firewall with rules: Controls traffic between networks or zones but isn’t used to separate departments on a single switch.
D) Hub with port mirroring: Hubs broadcast traffic to all connected devices and do not support segmentation or traffic isolation.
An organization’s mail server uses SMTP to send emails securely. Which port is typically used to provide this secure transmission?
A) 25
B) 110
C) 443
D) 587
Answer: D) 587
Port 587 is used for secure email transmission with SMTP (Simple Mail Transfer Protocol). It employs STARTTLS to encrypt the connection.
A) 25: Used for SMTP but primarily for relaying emails between servers; it does not inherently support secure transmission.
B) 110: Used for retrieving emails via POP3 (Post Office Protocol version 3), not for sending.
C) 443: Used for HTTPS (Hypertext Transfer Protocol Secure), not related to email communication.
A user is experiencing delays when accessing a remote web server. You need to determine the network path taken and identify any delays at specific points. Which command should you use?
A) Ping
B) ARP
C) Netstat
D) Tracert
Answer: D) Tracert
Explanation: The Tracert (or Traceroute) command maps the path taken to reach a destination and highlights delays (latency) at each hop, aiding in network troubleshooting.
Which protocol uses port 161 and is essential for monitoring and managing network devices?
A) LDAP
B) SNMP
C) HTTPS
D) ICMP
Answer: B) SNMP
Explanation: SNMP (Simple Network Management Protocol) uses port 161 to manage network devices, allowing centralized monitoring and control of network health.
A network technician is configuring a firewall to block all traffic except web traffic and email. Which ports should be allowed to enable only HTTP, HTTPS, SMTP, and IMAP communications?
A) 80, 443, 25, 143
B) 80, 21, 22, 110
C) 23, 53, 443, 993
D) 110, 443, 22, 143
Answer: A) 80, 443, 25, 143
Explanation: HTTP uses port 80, HTTPS uses 443, SMTP (unsecured) uses port 25, and IMAP (unsecured) uses port 143.
During a forensic investigation, a security analyst needs to determine the IP address associated with a particular MAC address on a local network. Which protocol provides this resolution?
A) DNS
B) ICMP
C) ARP
D) DHCP
Answer: C) ARP
Explanation: ARP (Address Resolution Protocol) resolves IP addresses to MAC addresses within a local network, aiding forensic analysis.
An administrator wants to securely manage several routers and switches across the network from a central location. Which protocol provides secure remote command-line access to these devices?
A) Telnet
B) SSH
C) SNMP
D) RDP
Answer: B) SSH (Secure Shell)
SSH provides secure remote command-line access to routers and switches by encrypting the communication and operating over TCP port 22.
A) Telnet: Provides remote command-line access over TCP port 23, but transmits data in plaintext, making it insecure.
C) SNMP (Simple Network Management Protocol): Used for monitoring and managing network devices, not for interactive command-line access. Operates on UDP ports 161 and 162.
D) RDP (Remote Desktop Protocol): Provides secure graphical remote access, not command-line, and operates on TCP port 3389.
An organization wants to implement network redundancy to ensure continuous availability of critical systems in the event of a single switch failure. Which protocol should they use to prevent network loops?
A) OSPF
B) ARP
C) STP
D) RIP
Answer: C) STP (Spanning Tree Protocol)
STP prevents network loops by dynamically disabling redundant paths in a network until they are needed, ensuring continuous availability without loops.
A) OSPF (Open Shortest Path First): A routing protocol used to determine the best path for data between routers, not for preventing loops within a local network.
B) ARP (Address Resolution Protocol): Resolves IP addresses to MAC addresses but doesn’t address redundancy or loop prevention.
D) RIP (Routing Information Protocol): An older routing protocol for finding the best path between networks, not designed for loop prevention in switched networks.
A technician is setting up a web server for external access and wants to ensure the data exchanged with users is encrypted. Which protocol and port should they use?
A) HTTP on port 80
B) FTP on port 21
C) HTTPS on port 443
D) Telnet on port 23
Answer: C) HTTPS on port 443
Explanation: HTTPS secures web traffic by encrypting it using TLS and operates on port 443, ensuring secure communication with users.
A company’s security team notices an unusual amount of ICMP traffic from an external IP address. What type of attack might this indicate?
A) Phishing
B) DDoS
C) Brute Force
D) Man-in-the-Middle
Answer: B) DDoS (Distributed Denial of Service)
Excessive ICMP traffic, such as a ping flood or ICMP-based DDoS attack (e.g., Smurf attack), is commonly used to overwhelm a network or system, disrupting its availability.
A) Phishing: Involves fraudulent emails or messages to steal sensitive information, not related to ICMP traffic.
C) Brute Force: Focuses on guessing passwords or keys by systematically trying combinations, not associated with ICMP.
D) Man-in-the-Middle: Involves intercepting and manipulating communication between two parties, typically unrelated to ICMP traffic.
An organization needs to enforce security policies on devices connected to the network based on MAC addresses. Which configuration should be implemented on the network switch to control access?
A) Port Security
B) Firewall ACLs
C) IPsec Tunneling
D) DHCP Reservations
Answer: A) Port Security
Port Security on network switches restricts access by allowing only specific MAC addresses on a port, preventing unauthorized devices from connecting.
B) Firewall ACLs (Access Control Lists): Filter traffic based on IP addresses, ports, and protocols, not MAC addresses.
C) IPsec (Internet Protocol Security) Tunneling: Encrypts and secures network traffic, but it doesn’t control access based on MAC addresses.
D) DHCP (Dynamic Host Configuration Protocol) Reservations: Assigns specific IP addresses to devices based on MAC addresses but doesn’t enforce access control.
Which of the following protocols is connection-oriented and ensures the reliable transmission of data across a network?
A) UDP
B) IP
C) TCP
D) HTTP
Answer: C) TCP
Explanation: TCP (Transmission Control Protocol) is connection-oriented, meaning it establishes a connection and ensures data is reliably transmitted, unlike UDP.
To diagnose issues with DNS resolution, a network administrator decides to check the DNS cache on a Windows computer. Which command should they use?
A) Ping
B) Nslookup
C) Ipconfig /displaydns
D) Tracert
Answer: C) Ipconfig /displaydns
The ipconfig /displaydns command shows the contents of the DNS cache on a Windows computer, helping diagnose DNS resolution issues.
A) Ping: Tests connectivity to a host but doesn’t provide DNS cache information.
B) Nslookup: Queries DNS servers directly for resolving domain names but doesn’t display the local DNS cache.
D) Tracert (Trace Route): Maps the path packets take to reach a destination but doesn’t interact with the DNS cache.
A network administrator is configuring a VLAN on a switch to segregate the accounting department’s traffic. What is the primary security benefit of this configuration?
A) Prevents IP address spoofing
B) Limits broadcast traffic within the VLAN
C) Blocks internet access
D) Encrypts traffic within the VLAN
Answer: B) Limits broadcast traffic within the VLAN
Configuring a VLAN (Virtual Local Area Network) isolates traffic by department, limiting broadcast traffic to the VLAN and preventing it from reaching other parts of the network.
A) Prevents IP address spoofing: VLANs do not inherently prevent IP spoofing; additional security measures like ACLs are needed.
C) Blocks internet access: VLANs do not block internet access by default; this requires routing or firewall rules.
D) Encrypts traffic within the VLAN: VLANs segment traffic but do not encrypt it; encryption requires protocols like IPsec or TLS.
An attacker sends falsified ARP messages on a local network to redirect traffic to their device. What type of attack is this?
A) DoS Attack
B) ARP Spoofing
C) ARP Poisoning
D) Brute Force Attack
Correct Answer: B) ARP Spoofing
ARP Spoofing involves sending falsified ARP messages to associate the attacker’s MAC address with the IP address of another device, redirecting traffic to the attacker’s device.
A) DoS Attack: Denial of Service attacks overwhelm a system or network to make it unavailable, not by falsifying ARP messages.
C) ARP Poisoning: Refers to the result of ARP spoofing, where devices have incorrect ARP table entries. ARP spoofing is the specific method used to achieve this.
D) Brute Force Attack: Involves attempting many combinations of credentials or keys to gain unauthorized access, unrelated to ARP messages.
Which OSI layer is responsible for error checking and reliable delivery of data between two devices on a network?
A) Physical
B) Data Link
C) Transport
D) Application
Answer: C) Transport
The Transport layer (Layer 4 of the OSI model) is responsible for error checking and ensuring reliable delivery of data through protocols like TCP (Transmission Control Protocol).
A) Physical: Handles the transmission of raw bits over a physical medium (e.g., cables, radio waves). No error checking at this layer.
B) Data Link: Provides error detection for frames within a local network but does not handle end-to-end reliability.
D) Application: Supports network services and interfaces for user applications but relies on lower layers for error checking and delivery.
An organization wants to ensure only authenticated users can send emails on behalf of its domain. Which email security protocol should they implement to verify sender identity?
A) SPF
B) TLS
C) HTTPS
D) SSH
Answer: A) SPF (Sender Policy Framework)
SPF allows the organization to specify which mail servers are authorized to send emails on behalf of its domain, helping verify the sender’s identity and prevent email spoofing.
B) TLS (Transport Layer Security): Encrypts email communication but does not verify sender identity.
C) HTTPS (Hypertext Transfer Protocol Secure): Secures web traffic, not related to email communication or sender verification.
D) SSH (Secure Shell): Provides secure remote command-line access, unrelated to email sender verification.
A network administrator wants to block incoming traffic from specific IP addresses suspected of malicious activity. Which type of security control should they configure on the firewall?
A) Implicit Deny
B) Access Control List (ACL)
C) Stateful Inspection
D) NAT
Answer: B) Access Control List (ACL)
Explanation: ACLs on a firewall can specify rules to block or allow traffic from specific IP addresses, making them useful for controlling access.
To prevent unauthorized devices from connecting to a wireless network, an organization uses MAC address filtering. What is a key limitation of this approach?
A) Complex configuration
B) Limited range
C) Susceptibility to MAC spoofing
D) Slower connection speeds
Answer: C) Susceptibility to MAC spoofing
Explanation: Attackers can use MAC spoofing to bypass MAC address filtering by imitating an authorized device’s MAC address.
