Chapter 10 Flashcards by W R

Proxy servers and ACLs on network devices are examples of non-security devices with security features, while firewalls and IDS/IPS systems are the network’s specialized security devices.

T/F

How well did you know this?

Not at all

Perfectly

A stateless firewall inspects each incoming packet to determine whether it belongs to a currently active connection.

T/F

How well did you know this?

Not at all

Perfectly

The Spanning Tree Protocol operates at the Network layer of the OSI model.

T/F

How well did you know this?

Not at all

Perfectly

The storm-control command is a type of flood guard that is available on most major network switch vendor platforms.

T/F

How well did you know this?

Not at all

Perfectly

User access to network resources falls into one of these two categories: 1) the privilege or right to execute, install, and uninstall software, and 2) permission to read, modify, create, or delete data files and folders.

T/F

How well did you know this?

Not at all

Perfectly

Of the three methods of access control (RBAC, DAC, and MAC), RBAC is the least secure of the options.

T/F

How well did you know this?

Not at all

Perfectly

By default, Active Directory is configured to use the Kerberos protocol, but can be configured to use LDAP or a combination of LDAP and Kerberos.

T/F

How well did you know this?

Not at all

Perfectly

When utilizing Kerberos, an access granting ticket is the same as a key.

T/F

How well did you know this?

Not at all

Perfectly

The supplicant is an EAP entity responsible for requesting authentication, such as a smartphone or laptop.

T/F

How well did you know this?

Not at all

Perfectly

The PEAP standard creates an encrypted TLS tunnel between the supplicant and the server before proceeding with the usual EAP process.

T/F

How well did you know this?

Not at all

Perfectly

Which of the following is an example of proxy server software?

Squid

BIND

Snort

Apache

Squid

How well did you know this?

Not at all

Perfectly

What is NOT a variable that an network access control list can filter traffic with?

The Network layer protocol used for the packet.

The Transport layer protocol used for the packet.

The source or destination TCP/UDP port number in the packet.

The operating system used by the source or destination device.

How well did you know this?

Not at all

Perfectly

In ACL statements, using the “any” keyword is equivalent to using a wildcard mask of what value?

0.0.0.0

255.255.255.255

255.255.0.0

0.0.255.255

255.255.255.255

How well did you know this?

Not at all

Perfectly

What kind of firewall can block designated types of traffic based on application data contained within packets?

stateful firewall

stateless firewall

content-filtering firewall

packet-filtering firewall

content-filtering firewall

How well did you know this?

Not at all

Perfectly

On a Linux system, which command allows you to modify settings used by the built-in packet filtering firewall?

ipf

modfire

iptables

netwall

iptables

How well did you know this?

Not at all

Perfectly

What is a SIEM (Security Information and Event Management) system utilized for?

It is an advanced intrusion protection system with a GUI-frontend.

It is a system used to evaluate data from security devices and generate alerts.

It is an intellectual property protection software that prevents data links, and generates alerts.

It is a system that monitors security device hardware availability.

It is a system used to evaluate data from security devices and generate alerts.

How well did you know this?

Not at all

Perfectly

When using Spanning Tree Protocol, what is the first step in selecting paths through a network?

STP must first select the root bridge, or master bridge.

STP examines the possible paths between all other bridges.

STP disables links that are not part of a shortest path.

STP begins to block BPDUs on non-designated ports.

STP must first select the root bridge, or master bridge.

In order to prevent ports that are serving network hosts from being considered as best paths, what should be enabled to block BPDUs?

BPDU filter

BPDU guard

root guard

BPDU drop

BPDU guard

Which protocol designed to replace STP operates at Layer 3 of the OSI model?

Rapid Spanning Tree Protocol (RSTP)

Transparent Interconnection of Lots of Links (TRILL)

Shortest Path Bridging (SPB)

Multiple Spanning Tree Protocol (MSTP)

Shortest Path Bridging (SPB)

You have been tasked with the configuration of a Juniper switch, and have been told to restrict the number of MAC addresses allowed in the MAC address table. What command should you use?

set max-mac

set total-macs

mac-address limit

mac-limit

Enforcing a virtual security perimeter using a client’s geographic location is known by what term?

geohashing

geofencing

geolocating

geolocking

geofencing

When using Kerberos, what is the purpose of a ticket?

It is the name for a Kerberos client or user.

It is a key used by the client to gain access to services that are protected by the key on the network.

It is a temporary set of credentials that a client uses to prove to other servers that its identity has been validated.

It is the event that is generated when auditing a resource and unauthorized access is attempted.

It is a temporary set of credentials that a client uses to prove to other servers that its identity has been validated.

Which legacy authentication protocol requires mutual authentication?

Password Authentication Protocol (PAP)

Challenge Handshake Authentication Protocol (CHAP)

Microsoft Challenge Handshake Authentication Protocol (MS-CHAP)

Microsoft Challenge Handshake Authentication Protocol, version 2 (MS-CHAPv2)

By far the most popular AAA service, what open-source service runs in the Application layer and can use UDP or TCP in the Transport layer?

Google Authenticator

RADIUS

TACACS+

Kerberos

RADIUS

Which adaptation of EAP utilizes EAP-MSCHAPv2 inside of an encrypted TLS tunnel? EAP-TLS Protected EAP (PEAP) EAP-FAST LEAP

Protected EAP (PEAP)

What IEEE standard includes an encryption key generation and management scheme known as TKIP? 802.11i 802.11h 802.1X 802.11j

802.11i

What descendant of the Spanning Tree Protocol is defined by the IEEE 802.1W standard, and can detect as well as correct for link failures in milliseconds? Transparent Interconnection of Lots of Links (TRILL) Shortest Path Bridging (SPB) Rapid Spanning Tree Protocol (RSTP) Multiple Spanning Tree Protocol (MSTP)

Rapid Spanning Tree Protocol (RSTP)

You have been asked by your superior to configure all Cisco network switches to allow only acceptable MAC addresses through switch access ports. How is this accomplished? Use the switchport port-security command to enable MAC filtering. Use the mac-limit command to prevent more than one MAC from being accepted. Use the allowed-mac command to filter by MAC address. Use the secure port mac-address command to limit the port to learned addresses only.

Use the switchport port-security command to enable MAC filtering.

What aspect of AAA is responsible for determining what a user can and cannot do with network resources? authentication authorization accounting accessibility

authorization

What statement regarding role-based access control is accurate? RBAC allows a network administrator to base privileges and permissions around a detailed description of a user's roles or jobs. RBAC allows users to decide for themselves who has access to that user's resources. RBAC organizes resources into hierarchical classifications, such as "confidential" or "top secret". RBAC is the most restrictive method of access control.

RBAC allows a network administrator to base privileges and permissions around a detailed description of a user's roles or jobs.

Which encryption standard was originally utilized with WPA's TKIP? Advanced Encryption Standard (AES) Rivest Cipher 4 (RC4) Blowfish Data Encryption Standard (DES)

Rivest Cipher 4 (RC4)

The Wired Equivalent Privacy standard had what significant disadvantage? It did not allow the use of a password for access to the network. It provided no encryption for traffic sent over the air. It used a shared encryption key for all clients, and the key might never change. It only encrypted the initial connection authentication, but did not encrypt subsequent traffic.

It used a shared encryption key for all clients, and the key might never change.

In Open System Authentication, how does authentication occur? The client sends a pre-shared key along with the access point's SSID. The client requests an encrypted tunnel, after which, the client's MAC serves as the authentication. The access point forces the client to authenticate via a captive portal, after which all communication is encrypted. The client "authenticates" using only the SSID name. In other words, no real authentication occurs.

The client "authenticates" using only the SSID name. In other words, no real authentication occurs.

The Group Policy utility can be opened by typing what name into a Run box? secpol.msc gpedit.msc grouppol.msc grppol.msc

gpedit.msc

When using Spanning Tree Protocol, which port on non-root bridges can forward traffic toward the root bridge? Only one root port, which is the bridge's port that is closest to the root bridge, can forward. Only one root port, which is the bridge's port that is furthest from the root bridge, can forward. All ports can forward frames to the root bridge, provided they are not in a down state. All ports will forward frames to the root bridge, unless a BPDU is received back on that same port.

Only one root port, which is the bridge's port that is closest to the root bridge, can forward.

Which of the following terms is used to describe the configuration of a port to copy all traffic passing through the switch to the device at the other end of the port? port supertrunking port mirroring port shadowing port lurking

port mirroring

In regards to the use of local authentication, what statement is accurate? Local authentication provides the most security. Local authentication is scalable for large networks. Local authentication is network and server failure tolerant. Local authentication does not allow for strong enough passwords.

Local authentication is network and server failure tolerant.

What scenario might be ideal for the use of root guard in configuring a switch? You wish to block BPDUs on an access port serving network hosts. You wish to disable STP on a port connected to a partnered company's switch. You wish to prevent switches beyond a certain port from becoming the root bridge, but still wish to use STP. You wish to prevent a rogue switch or computer from hijacking the network's STP paths.

You wish to prevent switches beyond a certain port from becoming the root bridge, but still wish to use STP.

When using a host-based intrusion detection system, what additional feature might be available to alert the system of any changes made to files that shouldn't change? file integrity monitoring (FIM) file change management (FCM) file access auditing (FAA) file checksum watching (FCW)

file integrity monitoring (FIM)

What statement correctly describes a stateless firewall? A stateless firewall manages each incoming packet as a stand-alone entity, without regard to currently active connections. A stateless firewall inspects each incoming packet to determine whether it belongs to a currently active connection. A stateless firewall blocks designated types of traffic based on application data contained within packets. A stateless firewall filters packets based on source and destination IP addresses.

A stateless firewall manages each incoming packet as a stand-alone entity, without regard to currently active connections.