Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

IS3220 NETWORK SECURITY, FIREWALLS, & VPNS > IS3220 CHAPTER 2 > Flashcards

IS3220 CHAPTER 2 Flashcards

1
Q

This is a port or portal authentication. A mechanism commonly used by network devices, such as firewalls, routers, switches, and wireless access points, to perform authentication of users before allowing communication to continue across or through the device. The authentication can take place locally on the device or go to and authentications service, such as a credit card payment system, PKI, or directory service. This is called ___?

A

802.1x

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Malicious software programs distributed by hackers to take over control of victim’s computers. AKA bot or zombies. These are commonly used to construct botnets and are called ___?

A

AGENTS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

The calculation of the total loss potential across a year for a given asset and a specific threat. This is called ___?

A

ANNUALIZED LOSS EXPECTANCY (ALE)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

A probability prediction based on statistics and historical occurrences on the likelihood of how many times in the next year is a threat going to cause harm. This is called ___?

A

ANNUALIZED RATE OF OCCURRENCE (ARO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A hardened hardware firewall is called an ___?

A

APPLIANCE FIREWALL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

The top or seventh layer of the OSI model. This layer is responsible for enabling communications with host software, including the operating system. This layer is the interface between host software and the network protocol stack. the sub-protocols of this layer support specific applications or types of data and is called ___?

A

APPLICATION LAYER (LAYER 7)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

A type of firewall that filters on a specific application’s content and session information is called ___?

A

APPLICATION PROXY/FIREWALL/GATEWAY

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

The cumulative value of an asset based on both tangible and intangible values. This supports the SLE calculation and is called ___?

A

ASSET VALUE (AV)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

A firewall positioned at the initial entry point where a network interfaces with the Internet. It serves as the first line of defense for the network. AKA a sacrificial host and is called ___?

A

BASTION HOST

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

A description often applied to firewalls positioned on network zone transitions or gateway locations and is called ___?

A

BORDER SENTRY

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

A network of zombie/bot/agent-comprised systems controlled by a hacker is called ___?

A

BOTNETS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Malicious software programs distributed by hackers to take over control of victims’ computers. AKA agents or zombies. These are commonly used to construct botnets and are called ___?

A

BOTS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

A logical connection between a client and a resource server. May exist at Layer 3, 4, or 5 of the OSI model. AKA session or a state and is called ___?

A

CIRCUIT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

A filtering device that allows or denies the initial creation of a circuit, session, or state, but performs no subsequent filtering on the circuit once established and is called ___?

A

CIRCUIT PROXY/FIREWALL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

A type of software product that is pre-compiled and whose source code is undisclosed is called ___?

A

CLOSED SOURCE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

A firewall product designed for larger networks. Usually a commercial firewall is a hardware device and is called ___?

A

COMMERCIAL FIREWALL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

A form of filtering that focuses on traffic content. Application proxies perform most of these and are called ___?

A

CONTENT FILTERING

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

The final equation of risk analysis to assess the relative benefit of a countermeasure against the potential annual loss of a given asset exposed to a specific threat is called ___?

A

COST/BENEFIT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

The second layer of the OSI model responsible for physical addressing (MAC addresses) and supporting the network topology, such as Ethernet is called ___?

A

DATA LINK LAYER (LAYER 2)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

A form of auto-initian switch that triggers when the ongoing prevention mechanism fails. These often include firewalls and hand grenades. If the firewall stops functioning, the connection is severed. This is called ___?

A

DEAD-MAN SWITCH

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

The action of processing the contents of a header, removing that header, and sending the remaining payload up to the appropriate protocol in the next higher layer in the OSI model is called ___?

A

DE-ENCAPSULATION

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

A firewall that has two network interfaces. Each network interface is located in a uniques network segment. This allows for true isolation of the segments and forces the firewall to filter all traffic moving from one segment to another and is called ___?

A

DUAL-HOMED FIREWALL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

The process of automatically created temporary filters. In most cases, the filters allow inbound responses to previous outbound requests. AKA stateful inspection. This is called ___?

A

DYNAMIC PACKET FILTERING

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

The potential amount of harm from a specific threat stated as a percentage. Used in the calculation of SLE and is called ___?

A

EXPOSURE FACTOR (EF)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

A failure response resulting in a secured or safe level of access or communication is called ___?
A failure response resulting in a secured or safe level of access communication is called ___?
(2 answers)

A

FAIL-SAFE

FAIL-SECURE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

The process of inspecting content against a set of rules or restrictions to enforce allow-and-deny operations on the content. Firewalls and other security components use this. This is called ___?

A

FILTERING

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

A network security device or host software that filters communications, usually network traffic, is based on a set of predefined rules. Unwanted content is denied and authorized content is allowed. AKA a sentry device and is called ___?

A

FIREWALL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

The collection of data at the Data Link layer (Layer 2) of the OSI model, defined by the Ethernet IEEE802.3 standard, that consists of a payload from the Network layer (Layer 3) to which an Ethernet header and footer have been attached is called ___?

A

FRAME

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

An entrance or exit point to a controlled space. A firewall is often positioned at the is of a network to block unwanted traffic and is called ___?

A

GATEWAY

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

The physical address assigned to a network interface by the manufacturer. AKA the MAC address is called ___?

A

HARDWARE ADDRESS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

An appliance firewall. A hardened computer product that hosts firewall software exclusively is called ___?

A

HARDWARE FIREWALL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

The additional data added to the front of a payload at each layer of the OSI model that includes layer-specific information is called ___?

A

HEADER

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

A software firewall installed on a client or server is called a ___?

A

HOST FIREWALL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

These are not directly related to budgetary funds. They can include, but not limited to: research and development, marketing edge, competition value, first to market, intellectual property, public opinion, quality of service, name recognition, repeat customers, loyalty, honesty, dependability, assurance, reliability, trademarks, patents, privacy etc is called ___?

A

INTANGIBLE COST/VALUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

A commonly used protocol found in the Network layer (Layer 3). This rides as the payload of an IP packet. It supports network health and testing. commonly abused by hackers for flooding and probing attacks. This is called ___?

A

INTERNET CONTROL MESSAGE PROTOCOL (ICMP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

The temporary logical address assigned to hosts on a network. This is managed and controlled at the Network layer (Layer 3) of the OSI model and called ___?

A

IP ADDRESS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

A temporarily assigned address given to a host. IP address is a common example of this. Most of these exist a the Network layer (Layer 3) of the OSI model. This is called ___?

A

LOGICAL ADDRESS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

The physical address assigned to a network interface by the manufacturer. This is know as the Organizationally Unique Identifier (OUI) or vender ID, the last half is the unique serial number of the NIC and is called ___?

A

MAC ADDRESS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

This is the third layer of the OSI model. This layer is responsible for logical address (IP addresses and routing traffic. This is called ___?

A

NETWORK LAYER (LAYER 3)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

A type of software product that may or may not be pre-compiled and whose source code is freely disclosed and available for review and modification and is called ___?

A

OPEN SOURCE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

This is a standard conceptual tool used to discuss protocols and their functions. It has seven layers. Each layer can communicate with its peer layer on the other end of a communication session. While this helps to discuss protocols, mow protocols are not in full compliance with it. This is called ___?

A

OPEN SYSTEM INTERCONNECTION REFERENCE MODEL (OSI MODEL)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

The collection of data at the Network layer (Layer 3) of the OSI model. It consists of the payload from the Transport layer (Layer 4) above and the Network layer header. This is called ___?

A

PACKET

43
Q

The non-header component of a PDU/segment/packet/frame. This is the data received from the layer above that includes the above layer’s header and its ___.

A

PAYLOAD

44
Q

Typically a software host firewall installed on a home computer or network client. This can also refer to SOHO hardware firewalls such as those found on DSL and cable modems and wireless access point. This is called ___?

A

PERSONAL FIREWALL

45
Q

The hardware address assigned to a network interface by the manufacturer. AKA the MAC address is called ___?

A

PHYSICAL ADDRESS

46
Q

The bottom or first layer of the OSI model. This layer converts data into transmitted bits over the physical network medium and is called ___?

A

PHYSICAL LAYER (LAYER 1)

47
Q

The function of routing traffic from an external source received on a specific pre-defined IP address and port combination (AKA reverse proxy and static NAT). This is called ___?

A

PORT FORWARDING

48
Q

The addressing scheme used at the Transport layer (Layer 4) of the OSI model. There are 65,535 ports, each of which can in theory support a single simultaneous communication. This is called ___?

A

PORT NUMBER

49
Q

A combination of several cryptographic components to create a real-world solution that provides secure communications, storage, and identification services. This is called ___?

A

PUBLIC KEY INFRASTRUCTURE (PKI)

50
Q

The sixth layer of the OSI model translates the data received from host software into a format acceptable to the network. This layer also performs this task in reverse for data coming from the network to host software and is called ___?

A

PRESENTATION LAYER (LAYER 6)

51
Q

The function of routing traffic from an external source received on a specific pre-defined IP address and port combination (AKA a socket) to an internal resource server. AKA as port forwarding and static network address translation (NAT). This is called ___?

A

REVERSE PROXY

52
Q

This is the process of examining values, threat levels, likelihoods, and total cost of compromise versus the value of the resource and the cost of the protection. This involves the use of values and calculations, such as AV, EF, SLE, ARO, ALE, and the cost/benefit equation. This is called ___?

A

RISK ASSESSMENT

53
Q

Performing risk assessment, and then acting on the results to reduce or mitigate risk. Often risk assessment establishes a new security policy and then aids in revising it over time. This is called ___?

A

RISK MANAGEMENT

54
Q

The list of rules on a firewall (or router or switch) that determine what traffic is and is not allowed to cross the filtering device. Most rule sets employ a first-match-apply action process and is called ___?

A

RULE SET

55
Q

A written expression of an item of concern (protocol, port, service, application, user, IP address) and one or more actions to take when the item of concern appears in traffic. Also known as a filter or ACL and is called ___?

A

RULES

56
Q

A firewall positioned at the initial entry point where a network interfaces with the Internet serving as the first line of defense for the network. AKA a bastion host and is called ___?

A

SACRIFICIAL HOST

57
Q

A router that can perform basic static packet filtering services in addition to routing functions. This is the predecessor of modern firewalls and is called ___?

A

SCREENING ROUTER

58
Q

A security protocol that operates at the top of the Transport layer (Layer 4) and resides as the payload of a TCP session. Netscape designed in 1997 for secure Web commerce, but it can encrypt any traffic above the Transport layer. It uses public key certificates to identify the endpoints of session and uses symmetric encryption to protect transferred data and is called ___?

A

SECURE SOCKETS LAYER (SSL)

59
Q

The collection of data at the Transport layer (Layer 4) of the OSI model. It consists of the payload from the Session layer (Layer 5) above and the Transport layer header. TCP segments are a common example. This is called ___?

A

SEGMENT

60
Q

A logical connection between a client and a resource server. AKA a circuit or a state and is called ___?

A

SESSION

61
Q

The fifth layer of the OSI model. This layer manages the communication channel, known as a session, between the endpoints of the network communication. A single transport layer connection between two systems can support multiple simultaneous sessions and is called ___?

A

SESSION LAYER (LAYER 5)

62
Q

The calculation of the loss potential across a single incident for a given asset and a specific threat. This is called ___?

A

SINGLE LOSS EXPECTANCY (SLE)

63
Q

The combination of an IP address and a port number as a complete address is called ___?

A

SOCKET

64
Q

A host firewall installed on a client or server is called ___?

A

SOFTWARE FIREWALL

65
Q

The falsification of information. Often this is the attempt to hide the true identity of a user or the true origin of a communication and is called ___?

A

SPOOFING

66
Q

A logical connection between a client and a resource server. May exist at Layer 3, 4, or 5 of the OSI model. AKA a session or a circuit and is called ___?

A

STATE

67
Q

The process of automatically tracking sessions or states to allow inbound responses to previous outbound requests. AKA dynamic packet filtering and is called ___?

A

STATEFUL INSPECTION

68
Q

The static coding of a translation pathway across a NAT service. AKA port forwarding and reverse proxy and is called ___?

A

STATIC NAT

69
Q

A method of filtering using a static or fixed set of rules to filter network traffic. The rules can focus on source or destination IP address, source or destination port number. IP header protocol field value, ICMP types is called ___?

A

STATIC PACKET FILTERING

70
Q

Costs or values directly related to budgetary funds. They can include, but are not limit to: purchase, licenses, maintenance, management, administration, support, utilities, training, troubleshooting, hardware, software, update/upgrades, etc. This is called ___?

A

TANGIBLE COST/VALUE

71
Q

The connection-oriented protocol operating at the Transport layer (Layer 4) of the OSI model is called ___?

A

TRANSMISSION CONTROL PROTOCOL (TCP)

72
Q

This layer of the OSI model formats and handles data transportation. This transportation is independent of and transparent to the application. This is called ___?

A

TRANSPORT LAYER (LAYER 4)

73
Q

A security protocol that operates at the top of the Transport layer (Layer 4) and resides as the payload of a TCP session. It uses public key certificates to identify the endpoints of session and uses symmetric encryption to protect transferred data. This is called ___?

A

TRANSPORT LAYER SECURITY (TLS)

74
Q

A form of encryption AKA point-to-point or host-to-host encryption. This protects only the payload of traffic and leaves the header in plain-text original form. This is called ___?

A

TRANSPORT MODE ENCRYPTION

75
Q

A firewall that has three network interfaces. Each network interface is located in a unique network segment. This allows for true isolation of the segments and forces the firewall to filter all traffic traversing from one segment to another. This is called ___?

A

TRIPLE-HOMED FIREWALL

76
Q

A form of encryption AKA site-to-site LAN-to-LAN, gateway-to-gateway, host-to-LAN, and remote access encryption. This performs a complete encapsulation of the original traffic into a new tunneling protocol. The entire original header and payload are encrypted and a temporary link or tunnel header guides the data across the intermediary network and is called ___?

A

TUNNEL MODE ENCRYPTION

77
Q

The connectionless protocol operating at the Transport layer (Layer 4) of OSI and is called ___?

A

USER DATAGRAM PROTOCOL (UDP)

78
Q

Malicious software programs distributed by hackers to take over control of victims’ computers. AKA bots or agents. These are commonly used to construct botnets and are called ___?

A

ZOMBIES

79
Q

Any segment, subnet, network, or collection of networks that represent a certain level of risk. The higher the risk, the higher the security needed to protect against that risk. The less the risk of a zone, the lower the security needed because fewer threats exist or existing threats are less harmful. This is called ___?

A

ZONE OF RISK

80
Q

Any segment, subnet, network, or collection of networks that represent a certain level of trust. Highly trusted zones require less security, while low trusted zones require more security. This is called ___?

A

ZONE OF TRUST

81
Q
  1. What is another term for the individual rules in a firewall rule set?
  2. States
  3. Exceptions
  4. Policies
  5. Referrals
  6. Sentries
A

Exceptions

82
Q
  1. which of the following is NOT associated with a firewall?
  2. Fail-secure
  3. Sentry device
  4. Fail-open
  5. Choke point
  6. Filtering service
A

Fail-open

83
Q
  1. A firewall is designed to allow what type of traffic to traverse its interfaces?
  2. Authorized
  3. Non-benign
  4. Unknown
  5. Abnormal
  6. Malicious
A

Authorized

84
Q
  1. What is the first step in deploying a firewall?
  2. Determining the filtering process
  3. Defining rules
  4. Selecting a security stance
  5. Purchasing a license
  6. Writing a security policy
A

Writing a security policy

85
Q
  1. Which of the following is the best description of a firewall?
  2. An authentication service
  3. A remote access server
  4. Resource host
  5. A sentry device
  6. Malicious code scanner
A

A sentry device

86
Q
  1. A border firewall cannot protect against which of the following?
  2. Flooding attacks
  3. Inside attacking another internal target
  4. Protocol abuses
  5. Unauthorized inbound service requests
  6. Port scans
A

Inside attacking another internal target

87
Q
  1. All of the following are mistakes in firewall security EXCEPT:
  2. Managing security poorly
  3. Deploying too many firewalls
  4. Using firewalls to provide filtering for networks and hosts
  5. Not writing a security policy
  6. Failing to keep current with updates and patches
A

Using firewalls to provide filtering for networks and hosts

88
Q
  1. What is the primary reason a firewall is an essential security product?
  2. Low cost of deployment
  3. Threats exist
  4. High ROI
  5. Native protocol encryption
  6. Interoperability
A

Threats exist

89
Q
  1. What technique determines if firewall is the best countermeasure choice for a particular threat against a specific asset?
  2. Conducting a risk assessment
  3. Reading blogs
  4. Buying the least expensive option
  5. Only using open-source products
  6. Using products from a single vendor
A

Conducting a risk assessment

90
Q
  1. Which of the following is NOT a common zone of risk?
  2. An extranet
  3. A DMZ
  4. A private LAN
  5. The Internet
  6. Department subnets
A

Department subnets

91
Q
  1. Which of the following statements is true?
  2. A firewall can be deployed as a bastion host
  3. Firewalls protect resources
  4. Firewalls are often the first line of defense for a network
  5. Firewalls are part of an overall security strategy
  6. All the above
A

A firewall can be deployed as a bastion host
Firewalls protect resources
Firewalls are often the first line of defense for a network
Firewalls are part of an overall security strategy

ALL

92
Q
  1. When a one way or sieve firewall protecting you network allows external initiations of communications to occur over a specific socket, this is known as:
  2. Static NAT
  3. Traffic forwarding
  4. Port forwarding
  5. Reverse proxy
  6. All the above
A

Static NAT
Traffic forward
Port forwarding
Reverse proxy

ALL

93
Q
  1. What is ingress filtering?
  2. Restricting traffic to a specific subnet
  3. Preventing traffic from leaving a network
  4. Limiting host activities to that host
  5. Monitoring traffic on its way inbound
  6. Blocking access to external resource sockets
A

Monitoring traffic on its way inbound

94
Q
  1. Content filtering can focus on the following aspects of traffic EXCEPT:
  2. Source or destination IP address
  3. Keywords in the payload
  4. URLs
  5. File extensions
  6. Domain names
A

Source or destination IP address

95
Q
  1. Which of the following will prevent firewall filtering from blocking malicious content?
  2. Speed of the network
  3. User permissions
  4. Not being positioned at a choke point
  5. Encrypted traffic
  6. Cable type
A

Encrypted traffic

96
Q
  1. Which of the following is NOT a valid method for determining whether a source address is spoofed?
  2. Compare against a use table
  3. Verify the route of reception
  4. Check the DHCP logs
  5. Check against RFC 1918
  6. Perform ingress filtering
A

Check against RFC 1918

97
Q
  1. what form of filtering focuses on source or destination IP address and requires separate rules for inbound and outbound communications?
  2. Stateful inspection
  3. Static packet filtering
  4. Application proxy
  5. Circuit proxy
  6. Dynamic packet filtering
A

Static packet filtering

98
Q
  1. Dynamic packet filtering is alson known as:
  2. Static packet filtering
  3. Application proxy
  4. Stateful inspection
  5. Circuit proxy
  6. Deep packet inspection
A

Stateful inspection

99
Q
  1. What method of filtering automatically keeps track of sessions on a limited timeout basis to allow responses to queries to reach internal clients?
  2. Deep packet inspection
  3. Static packet filtering
  4. Application proxy
  5. Dynamic packet filtering
  6. Circuit proxy
A

Dynamic packet filtering

100
Q
  1. what form of filtering allows communications regardless of content once the session is established?
  2. Dynamic packet filtering
  3. Circuit proxy
  4. Stateful inspection
  5. Application proxy
  6. Deep packet inspection
A

Circuit proxy

101
Q
  1. What type of firewall requires the presence of a host operating system?
  2. Appliance firewall
  3. Personal firewall
  4. Software firewall
  5. Commercial firewall
  6. Screening router
A

Software firewall

102
Q

22.

A

.

103
Q
  1. What activity performed by a triple homed firewall cannot be performed by a dual homed firewall?
  2. Filter content
  3. Physically isolate
  4. Support NAT proxy services
  5. Be deployed as an appliance
  6. Route traffic from the Internet to either an intranet or DMZ
A

Route traffic from the Internet to either an intranet or DMZ

IS3220 NETWORK SECURITY, FIREWALLS, & VPNS (15 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions