Final Exam Flashcards
Firewalls can stop hackers from breaking into your system
true
Firewalls can stop internet traffic that appears to be from a legitimate source
false
Firewalls can stop viruses and worms that spread through the internet
true
Firewalls can stop spyware being put on your system
false
Firewalls can stop viruses and worms that are spread through email
false
Lists the types of traffic authorized to pass through the firewall
Firewall access policy
________ is developed from the organization’s information security risk assessment and policy, and a broad specification of which traffic types the organization needs to support
Firewall access policy
Firewalls cannot protect when
____ or ____
Traffic that does not cross it (routing around, internal traffic)
when misconfigured
Malware can disable:
A) Software Firewalls
B) Hardware Firewalls
C) Antivirus checkers
A & C
Firewalls can stop/control
A) Pings
B) Packet sniffing
C) Outbound network traffic
A & C
This type of firewall filtering makes decisions on a packet-by-packet basis
Packet Filtering (no state information is saved)
________ is the simplest and most efficient type of firewall filtering
Packet Filtering
What are packet filtering rules based on?
Information contained in the network packet
- Source IP
- Destination IP
- Source & Dest transport level address
- IP protocol field
- interface
What are the 2 default policies of firewall packet filtering?
Discard (prohibit unless explicitly allowed)
Forward (permit unless explicitly forbidden) -> easier to manage, but less secure
What are the advantages of a Packet Filtering firewall?
- Simplicity
* Typically transparent to users and very fast
What are the disadvantages of a Packet Filtering firewall?
- Cannot protect against attacks that use application specific vulnerabilities
- Limited logging functionality
- Vulnerable to attacks and exploits that take advantage of TCP/IP
- Susceptible to security breaches caused by improper configuration
Packet filtering countermeasure:
_____ discard packets with an inside source address if the packet arrives on an external interface
IP Address spoofing countermeasure
Packet filtering countermeasure:
____ discard all packets in which the source destination specifies the route
Source routing attacks countermeasure
Packet filtering countermeasure:
_____ enforcing a rule that the first fragment of a packet must contain a predefined minimum amount of the transport header
Tiny fragment attack countermeasure
Packet Filtering
In order for a fragmented packet to be successfully reassembled at the destination, each fragment must obey the following rules:
A) Must not share a common fragment identification number
B) Each fragment must say what place or offset is in the original unfragmented packet
C) Each fragment must tell the length of the data carried in the fragment
D) The fragment does not need to know whether more fragments follow this one
B & C
a _______ firewall uses a connection state table
stateful inspection firewall
______ acts as a relay of application level traffic (basically a man or system in the middle)
Application-level gateway (or application proxy)
Application level gateways tend to be more secure than packet filters
true
Application level gateways may restrict application features supported
true
An Application level gateway can generically filter traffic for any application
False; must have proxy code for specific applications
A packet filtering firewall is typically configured to filter packets going in both directions
true
A prime disadvantage of an application-level gateway is the additional processing overhead on each connection
true
A packet filtering firewall can decide if the current packet is allowed based on another packet it has just examined
false
A stateful inspection firewall needs to keep track of information of an active connection in order to decide on the current packet
true
A _______ serves as a platform for an application-level gateway, and is a system identified as a critical strong point in the network’s securty
bastion host
__________ firewalls are used to secure an individual host
host based firewalls
The primary role of a personal firewall is to ___________
deny unauthorized remote access
______ hides the system from the internet by dropping unsolicited communication packets
stealth mode
A company has a conventional firewall in place on its network. Which (if any) of these situations requires an additional personal firewall:
A) An employee uses a laptop on the company network and at home
B) An employee uses a desktop on the company network to access websites worldwide
C) A remote employee uses a desktop to create a VPN on the company’s secure network
D) None of the above, in each case the employee’s computer is protected by the company firewall
A & C
Typically the systems in the _____ require or foster external connectivity such as the corporate web site, an e-mail server, or a DNS server
A) DMZ
B) IP protocol field
C) boundary firewall
D) VPN
A) DMZ
A _______ configuration involves stand-alone firewall devices plus host-based firewalls working together under a central administrative control
A) packet filtering firewall
B) distributed firewall
C) Boundary firewall
D) VPN
B) distributed firewall
Technology and other safeguards for cyber security are largely defensive in nature. The only way they can impact a threat source is by increasing the work factor for an attacker. Can laws be used to reduce the magnitude of threats?
A) YES, laws can provide criminal sanctions agains those who commit cyber crime
B) NO, cyber crime has increased even as new laws have been put in place
A) YES
P3L3
Cyber crime is a big problem. According to a recent report, what is an estimate of the cost of cybercrime for the United States?
A) 10 billion dollars
B) over 100 billion dollars
B) Over 100 billion dollars
P3L3
The Computer Fraud and Abuse Act (CFAA) was used to prosecute the creator of the Melissa virus and he was sentenced in a federal prison and fined by using its provisions. What abuse was perpetrated by the Virus?
A) Data stored on computers was destroyed
B) Denial of service attacks that made computers unusable
B) Denial of service attacks that make computers unusable
P3L3
Several people have argued about the overly general and vague language of the CFAA. For example, how exactly is unauthorized access defined? In one case, a company sued its competitor because the competitor’s employees create a trial subscription and downloaded data that was available to its subscribers. Do you think this is a violation of unauthorized access?
A) No, because the data was publicly available
B) Yes, because it potentially can cause financial loss to the company that sued its competition
A) No, because the data was publicly available
P3L3
The DCMA includes exclusions for researchers, but companies have threatened to sue researchers who wanted to publish work related to circumvention of anti-piracy technologies. Which of these is an example of such a threat under the DCMA:
A) Prof. Ed Felten’s research on audio watermarking removal by RIAA
B) A research project done by MIT students that found vulnerabilities in the MBTA
A) Prof. Ed Felten’s research on audio watermarking removal by RIAA
P3L3
By mistake, a friend sends sensitive health data in an email to you (wrong attachment). You should not read the information in the attached document because:
A) Professional code of ethics requires you to respect the privacy of others
B) You can be liable under CFAA
A) Professional code of ethics requires you to respect privacy of others
P3L3
US_CERT follows a responsible disclosure process for vulnerabilities reported to it. Such a process must:
A) Make vulnerability information available to everyone who may be affected by it immediately
B) Provide a certain period of time for the vendor of the vulnerable system to develop a patch
B) Provide a certain period of time for the vendor of the vulnerable system to develop a patch
A 2015 Pew survey of American adults’ attitudes about privacy. What percentage feel that it is important that they be able to control who gets information about them
A) 50%
B) 25%
C) 90%
C) 90%
P3L3
In 2014, the European Court of Justice ruled that EU citizens have the “right to be forgotten” on the internet. For example, Google must not return links to information that can be shown to be “inaccurate, inadequate, irrelevant, or excessive”. Which one of the following is an example of information that Google decided not to return as a search result to meet the ECJ ruling?
A) Story about criminal conviction that was quashed on appeal
B) A doctor requesting removal of links to newspaper stories about botched procedures performed by him
A) Story about criminal conviction that was quashed on appeal
P3L3
The Electronic Frontier Foundation (EFF) ranks websites with privacy scores based on how they deal with issues related to privacy. It gate AT&T one of the lowest scores (1 out of 5 scores). What explains this low score?
A) Does not disclose data retention policies
B) Does not use industry best-practices
C) Does not tell users about government data demands
A) does not disclose data retention policies
and
C) Does not tell users about government data demands
P3L3
Does Google’s privacy policy disclose data retention policy?
No
P3L3
Poor privacy is good for bad guys because they can use information about you to craft:
A) targeted phishing attacks
B) Gain access to your online accounts
A & B
P3L3
The FTC charged Fandango, the online move ticket purchasing company, for not protecting user privacy. This action was taken because Fandango:
A) Shared user data without informing users
B) Did not secure user data
B) did not secure user data
P3L3
If a company tracks your activities based on your machine’s IP address, on possible defense against it is to:
A) Disable cookies
B) Use Tor
B) Use Tor
P3L3
Cyber security planning and management in an enterprise must define allowed computer and network use by employees. Georgia Tech’s computer and network use policy strives to do this for students, faculty, and staff. What is required by this policy
A) Georgia tech passwords should be changed periodically
B) A compromise of a computer should be reported to someone responsible for cyber security at Georgia Tech
C) Georgia Tech computers cannot be used to download illegal content (e.g. child porm)
A) Georgia tech passwords should be changed periodically
B) A compromise of a computer should be reported to someone responsible for cyber security at Georgia Tech
C) Georgia Tech computers cannot be used to download illegal content (e.g. child porm)
P3L1
A botnet operator compromises a number of computers in a company. The malware executed by the bots only sends large amounts of spam email but does not exfiltrate sensitive data or interfere with legitimate activities. What is the appropriate action:
A) The company should detect and prevent abuse of its resources by unauthorized parties
B) Since it poses no risk to company’s sensitive data or normal ops it can be ignored
A) the company should detect and prevent abuse of its resources by unauthorized parties
P3L1
A news story in 2014 reported that an inspector general’s report gave the VA a failing grade for the 16th straight year. The CIO of VA discussed a number of challenges that could explain this grade. What are some possible reasons?
A) The need to manage cyber security for over a million devices, each running many services
B) lack of sense of urgency in fixing cyber vulnerabilities
C) Choosing to support key functions even when this could introduce vulnerabilities
A) the need to manage cyber security for over a million devices, each running many services
and
C) Choosing to support key functions even when this could introduce vulnerabilities
P3L1
Chief Information Security Officer (CISO) is the executive who is responsible for information security in a company. Did target, the major retailer, have a CISO when it suffered the serious breach?
No.
P3L1
Does Georgia Tech’s computer and network use policy prohibit personal use of university resources?
No.
P3L1
GATech systems store student data such as grades. The Institute must protect such data due to:
A) Regulatory reasons (FERPA)
B) Because the data is sensitive it can only be disclosed to the student and his/her family
A) Regulatory reasons (FERPA)
P3L1
Anthem suffered a breach in 2015. Based on an analysis of its response to the breach, did Anthem respond well?
Yes.
P3L1
A company stores sensitive customer data. The impact of a breach of such data must include:
A) Cost of purchasing identity theft protection for customers
B) Loss of business due to reduced customer confidence
C) Compensation for new cyber security personnel the company hires to better manage cyber security in the future
A) Cost of purchasing identity theft protection for customers
and
B) loss of business due to reduced customer confidence
P3L1
A company is considering 2 possible IDS solutions to reduce its exposure to attacks on its network. The first one costs $100K and reduces risk exposure by $150K. The second costs $250K but reduces exposure by $500K. Which would you recommend?
The more expensive one.
P3L1
Risk leverage =
(Risk exposure without control - Risk exposure with control)/ cost of control
P3L1
Cyber insurance is not very popular. Based on a 2014 survey, what percentage of customers of major insurance brokers were interested in buying cyber insurance?
A) Less than 25%
B) over 50%
A) less than 25%
P3L1
Are cyber security budgets increasing as the number of reported incidents increase?
No.
P3L1
An example of a proactive security measure is:
A) Making sure the company complies with all regulatory requirements
B) Chief risk officer (CRO) of the company addressing cyber risk regularly at highest level (eg board) when other risks are discussed
B) Chief risk officer addressing the board
P3L1
Cookies are created by ads that run on websites
true
P3L2
Cookies are created by websites a user is visiting
true
P3L2
Cookies are compiles pieces of code
false
P3L2
Cookies can be used as a form of virus
false
P3L2
Cookies can be used as a form of spyware
true
P3L2
A web browser can be attacked by any website that it visits
true
P3L2
Even if a browser of compromised, the rest of the computer is still secure
false
P3L2
Web servers can be compromised because of exploits on web applications
true
P3L2
When a user’s browser visits a compromised or malicious site, a malicious script is returned
true
P3L2
To prevent XSS, any user input must be checked and preprocessed before it is used
true
P3L2
Checking the HTTP referrer header to see if the request comes from an authorized page can protect against XSRF
true
P3L2
Using a synchronizer token pattern where a token for each request is embedded by the web application in all HTML forms and verified on the server side can protect agains XSRF
true
P3L2
Logging off immediately after using a web application can protect against XSRF
true
P3L2
Not allowing the browser to save username/password and not allowing web sites to remember user login can protect against XSRF
true
P3L2
Not using the same browser to access sensitive web sites and to surf the web freely can protect against XSRF
true
P3L2
________ is the better way to prevent SQL injection
Whitelisting to allow only well-defined set of safe values
P3L2
Eavesdropping is a security threat to WiFi security
true
P2 L11
Injecting bogus messages is a threat to WiFi security
true
P2 L11
Replaying previously recorded messages is a threat to WiFi security
true
P2 L11
Illegitimate access to the network and its services is a threat to WiFi securty
true
P2 L11
Denial-of-service is a threat to Wifi security
true
P2 L11
What are the security threats to WiFi?
Eavesdropping injecting bogus messages replaying previously recorded messages illegitimate access to the network and its services denial of service
P2 L11
_____ is the security standard that should be used for WiFi
WPA2
P2 L11
What are the 3 operating systems with the most vulnerabilities in 2014?
Apple Mac OS X
Apple iOS
Linux Kernel
In iOS, all cryptographic keys are stored in flash memory
false
P2 L11
in iOS, trusted boot can verify the kernel before it is run
true
P2 L11
in iOS, all files of an app are encrypted using the same key
false
P2 L11
How were researches able to bypass Apple’s App Store security in 2013?
Uploaded an app that morphed into malware after it passed the review process.
P2 L11
What weakness were exploited by researchers in the Apple apps security in 2015?
The malware was uploadable to the Apple Apps store
The malware was able to bypass Sandbox security
The malware was able to hijack browser extensions and collect passwords
P2 L11
in iOS, each app runs in a sandbox and has its own home directory for its files
true
P2 L11
All iOS apps must be reviewed and approved by Apple
true
P2 L11
iOS apps can be self-signed by app developers
false
P2 L11
Android apps can be self-signed
true
P2 L11
Android apps can have more powerful permissions than iOS apps
true
P2 L11
IP spoofing is useful for ____________ communication
unidirectional
P2 L10
IPsec can assure that ___________________
A router advertisement comes from an authorized router
a routing update is not forged
a redirect message comes from the router to which the initial packet was sent
P2 L10
Encapsulated Security Payload (ESP) can be used in
A) encryption only mode
B) authentication only mode
C) encryption and authentication mode
A, B, and C
P2 L10
Encapsulated Security Payload (ESP) can provide both confidentiality and integrity protection
true
P2 L10
If the authentication option of ESP is chosen, message integrity code is computed before encryption
false
P2 L10
To protect the confidentiality and integrity of the whole original IP packet, we can use ESP with the authentication option in tunnel mode
true
P2 L10
In Authentication Header, the integrity hash covers the IP header
true
P2 L10
The security association, SA, specifies a two-way security arrangements between the sender and receiver
false
P2 L10
Security Parameter Index (SPI) is used to help receiver identify the Security Association (SA) to unprocess the IPSec packet
true
P2 L10
If the sequence number of the IPSec header is greater than the largest number of the current anti-reply window the packet is rejected
false
P2 L10
If the sequence number in the IPSec header is smaller than the smallest umber of the current anti-replay window the packet is rejected
true
P2 L10
The Diffie-Hellman key exchange is restricted to two party communication only
false
P2 L10
An IKE SA needs to be established before IPSec SAs can be negotiated
true
P2 L10
The identity of the responder and receiver and the messages they have exchanged need to be authenticated
(authentication and key exchange)
true
P2 L10
With perfect forward secrecy, the IPSec SA keys are based on the IKE shared secret established in phase I.
false
P2 L10
Most browsers come equipped with SSL and most web servers have implemented the protocol
true
P2 L10
Since TLS is for the transport later, it relies on IPSec, which is for the IP later
false
P2 L10
In most applications of TLS or SSL, public keys are used for authentication and key exchange
true
P2 L10
The challenge values used an an authentication protocol can be repeatedly used in multiple sessions
false
P2 L9
The authentication messages can be captured and replayed by an adversary
true
P2 L9
Authentication can be one-way, e.g. only authenticating Alice to Bob
true
P2 L9
A reflection attack is a form of man-in-the-middle-attack
true
P2 L9
To defeat a reflection attack, we can use an odd number as a challenge from the initiator and an even number from the responder
true
P2 L9
We can use signing with public keys to achieve mutual authentication
true
P2 L9
A session key should be a secret and unique to the session
true
P2 L9
Authentication should be accomplished before the session key exchange
true
P2 L9
A key benefit of using KDC (Key distribution center) is scalability
true
P2 L9
In order to for Bob to verify Alice’s public key, the certificate authority must be online
false (just need the CA’s public key, which may be cached)
P2 L9
Signing the message exchanges in Diffie-Helman eliminates the man-in-the-middle attack during session key exchange.
true
P2 L9
Kerberos provides authentication and access control
true
P2 L9
Kerberos distributes session keys
true
P2 L9
To avoid over-exposure of a user’s master key, Kerberos uses a per-day key and a ticket-granting-ticket
true
P2 L9
The authenticators used in requests to KDC and application server can be omitted in Kerberos
false
P2 L9
Access to any network resource requires a ticket issued by the KDC in Kerberos
true
P2 L9
if the length of a hash is 128 bits, then how many messages does an attack need to search in order to find two that share the same hash?
2^64 (the square root of 2 to the 128th)
P2 L8
