IDS / Firewalls / Honeypots Flashcards
What is a Stateful Firewall?
A firewall that always keeps track of the state of network connections.
What is a Stateless Firewall?
A firewall that makes use of data packet’s source, destination, and other parameters to figure out whether the data presents a threat.
Which type of intrusion detection system can monitor and alert on attacks, but cannot stop them?
Passive
You are working at the service desk as a network security technician and just received the following email from an end-user who believes a phishing campaign is being attempted.
*****
From: user@diontraining.com
To: abuse@diontraining.com
Subject: You won a free iPhone!
Dear Susan,
You have won a brand new iPhone!
Just click the following link to provide your address so we can ship it out to you this afternoon: (http://www.freephone.io:8080/winner.php)
*********
What should you do to prevent any other employees from accessing the link in the email above while still allowing them access to any other webpages at the domain freephone.io?
A. Add DENY IP ANY ANY EQ 8080 to the IPS filter
B. Add DENY TCP http://www.freephone.io ANY EQ 8080 to the firewall ACL
C. Add http://www.freephone.io:8080/winner.php to the browser’s group policy block list
D. Add http://www.freephone.io:8080/winner.php to the load balancer
C. Add http://www.freephone.io:8080/winner.php to the browser’s group policy block list
What is the effective IDS evasion method called where the attacker sends large amount of packets to the target IDS that generates alerts, which enables the attack to hide the real traffic?
False Positive Generation
What is the way to decide how a packet will move from an untrusted outside host to a protected inside that is behind a firewall, which permits the hacker to determine which ports are open and if the packets can pass through the packet-filtering of the firewall?
Firewalking
In IPSEC, what is the purpose of AH tunnel mode?
Provides authentication and integrity, but does not encrypt the packets.
In IPSEC, what is the purpose of ESP Transport Mode?
Encryption of packets to ensure security and confidentiality.
What is a Remote Access Policy?
Serves as a guide for remote users connecting to the network, including via VPN.
What is Access Control Policy?
Set of policies, instructions, and restrictions who can access what data.
What does a VLAN do?
It groups collection of device connections from different LANs.
What is meant by single homed network?
Single connection to the ISP
What is meant by dual homed networks?
Two links out towards the ISP
What is meant by Multi-homed network?
Having at least two links out towards two ISPs
4 different types of honeypots?
- Pure
- High-Interaction
- Mid-Interaction
- Low-Interaction
