Ch.7 Flashcards by Anthony E

a monitoring technique used by an intrusion detection system (IDS) that creates a baseline of normal activities and compares actions against the baseline. Whenever there is a significant deviation from this baseline, an alarm is raised

anomaly-based monitoring

How well did you know this?

Not at all

Perfectly

a firewall that can identify the applications that send packets through the firewall and then make decisions about the applications

application-aware firewall

How well did you know this?

Not at all

Perfectly

a specialized intrusion detection system (IDS) that is capable of using “contextual knowledge” in real time

application-aware IDS

How well did you know this?

Not at all

Perfectly

an intrusion prevention system (IPS) that knows information such as the applications that are running as well as the underlying operating systems

application-aware IPS

How well did you know this?

Not at all

Perfectly

a special proxy server that knows the application protocols that it supports

application-aware proxy

How well did you know this?

Not at all

Perfectly

a monitoring technique used by an IDS that uses the normal processes and actions as the standard and compares actions against it

behavior-based monitoring

How well did you know this?

Not at all

Perfectly

searching incoming web content to match keywords

content inspection

How well did you know this?

Not at all

Perfectly

a defense that uses multiple types of security devices to protect a network. Also called LAYERED SECURITY

defense in depth

How well did you know this?

Not at all

Perfectly

a separate network that rests outside the secure network perimeter: untrusted outside users can access the DMZ but cannot enter the secure network

demilitarized zone (DMZ)

How well did you know this?

Not at all

Perfectly

a set of individual instructions to control the actions of a firewall

firewall rules

How well did you know this?

Not at all

Perfectly

a monitoring technique used by an intrusion detection system (IDS) that uses an algorithm to determine if a threat exists

heuristic monitoring

How well did you know this?

Not at all

Perfectly

a software-based application that runs on a local host computer that can detect an attack as it occurs

host-based intrusion detection system (HIDS)

How well did you know this?

Not at all

Perfectly

a device that detects an attack as it occurs

intrusion detection system (IDS)

How well did you know this?

Not at all

Perfectly

a defense that uses multiple types of security devices to protect a network. Also called DEFENSE IN DEPTH

layered security

How well did you know this?

Not at all

Perfectly

a dedicated network device that can direct requests to different servers based on a variety of factors

load balancer

How well did you know this?

Not at all

Perfectly

searching for malware in incoming web content

malware inspection

How well did you know this?

Not at all

Perfectly

a technique that examines the current state of a system or network device before it is allowed to connect to the network

network access control (NAC)

How well did you know this?

Not at all

Perfectly

a technique that allows private IP addresses to be used on the public Internet

network address translation (NAT)

How well did you know this?

Not at all

Perfectly

a technology that monitors network traffic to immediately react to block a malicious attack

network intrusion prevention system (NIPS)

How well did you know this?

Not at all

Perfectly

hardware or software that captures packets to decode and analyze their contents

protocol analyzer

How well did you know this?

Not at all

Perfectly

a computer or an application program that intercepts user requests from the internal secure network and then processes those requests on behalf of the user

proxy server

How well did you know this?

Not at all

Perfectly

any combination of hardware and software that enables remote users to access a local internal network

remote access

a computer or an application program that routes incoming requests to the correct server

reverse proxy

a device that can forward packets across computer networks

router

a monitoring technique used by an intrusion detection system (IDS) that examines network traffic to look for well-known patterns and compares that activities against a predefined signature

signature-based monitoring

a technique that uses IP addresses to divide a network into network, subnet, and host

subnetting (subnet addressing)

a device that connects network segments and forwards only frames intended for that specific device or frames sent to all devices

switch

network hardware that provides multiple security functions

unified threat management (UTM)

restricting access to unapproved websites

URL filtering

a technology that allows scattered users to be logically grouped together even though they may be attached to different switches

virtual LAN (VLAN)

a technology that enables use of an unsecured public network as if it were a secure private network

virtual private network (VPN)

a device that aggregates VPN connections

VPN concentrator

a special type of application-aware firewall that looks at the applications using HTTP

web application firewall

a device that can block malicious content in real time as it appears (without first knowing the URL of a dangerous site).

web security gateway

1. Which secure feature does a load balancer NOT provide? a. hide HTTP error pages b. remove server identification headers from HTTP responses c. filter packets based on protocol settings d. block denial-of-service (DoS) attacks

2. Which of these would NOT be a filtering mechanism found in a firewall rule? a. source address b. date c. protocol d. direction

3. A(n)_____ can identify the application that send packets and then make decisions about filtering based on it. a. application-aware firewall b. reverse proxy c. Internet content filter d. web security gateway

4. Which function does an Internet content filter NOT perform? a. URL filtering b. malware inspection c. content inspection d. intrusion detection

5. How does network address translation (NAT) improve security? a. it discards unsolicited packets b. it filters based on protocol c. it masks the IP address of the NAT device d. NATs do not improve security

6. How does a virtual LAN (VLAN) allow devices to be grouped? a. based on subnets b. logically c. directly to hubs d. only around core switches

7. Which device is easiest for an attacker to take advantage of in order to capture and analyze packets? a. hub b. switch c. router d. load balancer

8. Which of these is NOT an attack against a switch? a. MAC address impersonation b. ARP poisoning c. MAC flooding d. ARP impersonation

9. Which statement regarding a demilitarized zone (DMZ) is NOT true? a. It can be configured to have one or two firewalls b. It provides an extra degree of security c. It typically includes an email or web server d. It contains servers that are used only by internal network users

10. Which statement about network address translation (NAT) is true? a. It can be stateful or stateless b. It substitutes MAC addresses for IP addresses c. It removes private addresses when the packet leaves the network d. It can be found only on core routers

11. Which of these is NOT an advantage of a load balancer? a. The risk of overloading a desktop client is reduced b. Network hosts can benefit from having optimized bandwidth c. Network downtime can be reduced d. DoS attacks can be detected and stopped

12. A (n)___________intercepts internal user requests and then processes those requests on behalf of the users. a. content filter b. host detection server c. proxy server d. Intrusion prevention device

13. A reverse proxy _____. a. only handles outgoing request b. is the same as a proxy server c. must be used together with a firewall d. routes incoming requests to the correct server

14. Which is the preferred location for installation of a spam filter? a. on the POP3 server b. with the SMTP server c. on the local host client d. on the proxy server

15. A _____ watches for attacks and sounds an alert only when one occurs. a. firewall b. network intrusion prevention system (NIPS) c. proxy intrusion device d. network intrusion detection system (NIDS)

16. A multipurpose security device is known as _____. a. Cohesive Attack Management System (Co-AMS) b. Proxy Security System (PSS) c. Intrusion Detection/Prevention (ID/P) d. Unified Threat Management (UTM)

17. Each of these can be used to hide information about the internal network EXCEPT _____. a. a protocol analyzer b. subnetting c. a proxy server d. network address translation (NAT)

18. What is the difference between a network intrusion detection system (NIDS) and a network intrusion prevention system (NIPS)? a. There is no difference; a NIDS and a NIPS are equal b. A NIPS can take actions more quickly to combat an attack c. A NIDS provides more valuable information about attacks d. A NIPS is much slower because it uses protocol analysis

19. If a device is determined to have an out-of-date virus signature file, then Network Access Control (NAC) can redirect that device to a network by ______. a. a Trojan horse b. TCP/IP hijacking c. Address Resolution Protocol (ARP) poisoning d. DHCP man-in-middle

20. A firewall using ______ is the most secure type of firewall. a. stateful packet filtering b. network intrusion detection system replay c. stateless packet filtering d. reverse proxy analysis