Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

IS3220 NETWORK SECURITY, FIREWALLS, & VPNS > IS3220 CHAPTER 7 > Flashcards

IS3220 CHAPTER 7 Flashcards

1
Q

Mechanism defining traffic or an event to apply an authorization control of allow or deny against is called ___?
Often used interchangeably with the terms rule and filter in relation to firewalls.

A

ACCESS CONTROL LIST (ACL)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

A notification from a firewall that a specific event or packet was detected is called ___?
These notify administrators of events that may need real-time human response or attention.

A

ALERT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

A security stance that allows all communications except those prohibited by specific deny exceptions is called ___? AKA default allow.

A

ALLOW BY DEFAULT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

A form of Intrusion Detection System/Intrusion Prevention System (IDS/IPS) detection based on a defined normal, often defined using rules similar to firewall rules is called ___?
All traffic or events that fail to match defined normal are considered anomalies and potentially malicious.

A

ANOMALY-BASED DETECTION

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A form of IDS/IPS detection based on a recording of real-world traffic as a baseline for normal is called ___?
All traffic or events that fail to match the normal baselines are considered abnormal and potentially malicious.

A

BEHAVIORAL-BASED DETECTION

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

____ by a proxy server is the retention of Internet content. Various internal clients may access this content and provide it to subsequent requesters without the need to retrieve the same content from the Internet repeatedly.

A

CACHING

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

This mechanism is used to create a redundant copy of all log files in a single warehousing location is called ___?
A technique of storing or copying log events. One common example of this is syslog.

A

CENTRALIZED LOGGING SYSTEM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

A form of IDS/IPS detection based on a collection of samples, patterns, signatures, and so on stored in a database of known malicious traffic and events is called ___?
All traffic or events that match an item in the database is considered abnormal and potentially malicious. AKA signature, knowledge, and pattern-matching based detection.

A

DATABASE-BASED DETECTION

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

A security stance that allows all communications except those prohibited by specific deny exceptions and is called ___?

A

DEFAULT ALLOW

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

A security stance that prevents all communications except those enabled by specific allow exceptions is called ___?

A

DENY BY DEFAULT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

A technique of load balancing that operates by sending the next transaction to the firewall with the least current workload is called ___?

A

FAIR QUEUING

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

An event that does not trigger an alarm but should have, due to the traffic or event actually being abnormal and/or malicious is called ___?
This is the unwanted non-detection of a malicious event.

A

FALSE NEGATIVE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

An event that triggers an alarm but should not have, due to the traffic or event actually being benign is called ___? This is the unwanted false alarm that wastes time and resources pursuing a non-malicious event.

A

FALSE POSITIVE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

A written expression of an item of concern (protocol, port, service, application, user, IP address) and one or more actions to take when the item of concern appears in traffic is called ___?
This expresses the intention to block or deny unwanted items of concern. AKA a rule or ACL.

A

FILTERS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

A hacking technique used against static packet filtering firewalls to discover the rules or filters controlling inbound traffic is called ___?

A

FIREWALKING

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

A networking mechanism to hand off or pass off the task of authentication to a third-party dedicated authentication system is called ___?
AKA port authentication, portal authentication, or port-based network access (admission) control (PNAC).

A

IEEE 802.1x

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

A form of IDS/IPS detection based on a collection of samples, patterns, signatures, and so on stored in a database of known malicious traffic and events is called ___?
All traffic or events that match an item in the database is considered abnormal and potentially malicious. AKA signature, database, and pattern-matching-based detection.

A

KNOWLEDGE BASED DETECTION

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

A network traffic management technique to spread the workload or traffic levels across multiple devices to maintain availability is called ___?

A

LOAD BALANCING

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

The command line or graphical interface used to control and configure a device is called ___?
Often accessible through a console (CON) port on the device or through a logical interface across the network.

A

MANAGEMENT INTERFACE

20
Q

Used on individual network access devices, such as firewalls, VPN gateways, and wireless routers, to offload authentication to a dedicated authentication server/service is called ___?
Only after valid authentication are communications with or across the network device allowed.

A

PORT-BASED NETWORK ACCESS (ADMISSION) CONTROL (PNAC)

21
Q

A form of load balancing which hands out tasks in a repeating non-priority sequence is called ___?

A

ROUND ROBIN

22
Q

The list of rules on a firewall (or router or switch) that determine what traffic is and is not allowed to cross the filtering device is called ___?
Most employ a first-match-apply-action process.

A

RULE SETS

23
Q

A written expression of an item of concern (protocol, port, service, application, user, IP address) and one or more action(s) to take when the item of concern appears in traffic is called ___? AKA a filter or ACL.

A

RULE(S)

24
Q

A form of IDS/IPS detection based on a collection of samples, patterns, signatures, and so on stored in a database of known malicious traffic and events is called ___?
All traffic or events that match an item in the database is considered abnormal and potentially malicious. AKA database, knowledge, and pattern-matching-based detection.

A

SIGNATURE-BASED DETECTION

25
Q

The deployment of firewall as an all-encompassing primary gateway security solution is called ___?
The idea behind this is a single device can be designed to perform firewall filtering, IPS, antivirus scanning, anti-spam filtering, VPN end-point hosting, content filtering, load-balancing, detailed logging, and potentially other security services, performance enhancements, or extended capabilities.

A

UNIFIED THREAT MANAGEMENT (UTM)

26
Q

The maximum communication or transmission capability of a network segment is called ___?
Often used to describe a network device’s ability to perform tasks on traffic, while being able to maintain overall network transmission speeds without introducing delay, lag or latency.

A

WIRESPEED

27
Q

A form of storage device that can be written to once, but once written cannot be electronically altered is called ___?

A

WRITE-ONCE READ-MANY (WORM)

28
Q
  1. Which of the following is a firewall rule that prevents internal users from accessing public FTP sites?
  2. TCP ANY ANY ANY FTP Deny
  3. TCP 192.168.42.0/24 ANY ANY 21 Deny
  4. TCP 21 192.168.42.0/24 ANY ANY Deny
  5. TCP ANY ANY 192.168.42.0/24 ANY Deny
  6. TCP FTP ANY ANY Deny
A

TCP 192.168.42.0/24 ANY ANY 21 Deny

29
Q
  1. Which of the following is a default deny rule?
  2. TCP ANY ANY ANY ANY Deny
  3. TCP 192.168.42.0/24 ANY ANY ANY Deny
  4. TCP ANY 192.168.42.0/24 ANY ANY Deny
  5. TCP ANY ANY 192.168.42.0/24 ANY Deny
  6. DENY TCP ANY ANY ANY ANY
A

TCP ANY ANY ANY ANY Deny

30
Q
  1. The default deny rule appears where in the rule set?
  2. First
  3. After any explicit allows
  4. Anywhere
  5. Last
  6. After any explicit denies
A

Last

31
Q
  1. What mechanism allows a firewall to hand off authentication to a dedicated service hosted on a different system?
  2. IEEE 802.11
  3. RFC 1918
  4. IEEE 802.1x
  5. RFC 1492
  6. IEE 802.3
A

IEEE 802.1x

32
Q
  1. When an organization first deploys a firewall and chooses to begin logging activity, what should you include in the log file?
  2. Only malicious traffic
  3. Only DoS traffic
  4. Only dropped packets
  5. Only allowed packets
  6. All events
A

All events

33
Q
  1. You can use firewall logging to perform all of the following activities EXCEPT:
  2. Discover new methods or techniques of attack
  3. Create a historical record of activity used for traffic and trend analysis
  4. Track usage levels and times for load balancing
  5. Stop intrusions
  6. Create legally admissible evidence for use in prosecution
A

Stop intrusions

34
Q
  1. All the following events appearing in a firewall log warrant investigation by an administrator EXCEPT:
  2. Firewall host reboot
  3. A connection attempt to the firewall host
  4. Detection of an attack attempt
  5. Inbound packets with spoofed internal source addresses
  6. An internal user accessing a public Web site
A

An internal user accessing a public Web site

35
Q
  1. Which of the following is a highly recommended method or technique for keeping firewall logs secure and uncorrupted?
  2. Storing then in binary form
  3. Using 15,000 RPM hard drives
  4. Recording only important events
  5. Centralized logging
  6. Using timestamps
A

Centralized logging

36
Q
  1. Which of the following is an event found in a firewall log file that is a symptom of a rogue host operating within the private network?
  2. Packets from a known malicious address
  3. Packets from an unassigned internal address
  4. Packets to an unknown port on an internal host
  5. Packet in a serial grouping that attempt to access a sequential sequence of ports
  6. Packets in a very large grouping that are all exactly the same directed toward a single target
A

Packets from an unassigned internal address

37
Q
  1. What is the biggest issue or problem with an IDS?
  2. False positive
  3. Failing to operate at wirespeed
  4. False negative
  5. Keeping the pattern database current
  6. Using anomaly detection
A

False negative

38
Q
  1. Which of the following is NOT a limitation or potential weakness of a firewall?
  2. Firewalking
  3. Software bugs or flaws
  4. Using first match apply rule systems
  5. Fragmentation attacks
  6. Internal code connecting to an external service
A

Using first match apply rule systems

39
Q
  1. When a firewall is able to process packets, filtering malicious code, and transmit authorized communications onward to their destination without introducing latency or lag, this is known as operating at ___.
A

wirespeed

40
Q
  1. Which of the following is NOT related to improving or maintaining performing of a firewall?
  2. Native antivirus scanning
  3. Round-robin task assignment
  4. Caching
  5. Fair queuing session management
  6. Load balancing
A

Native antivirus scanning

41
Q
  1. What form of encryption allows a firewall to filter based on original source and destination address (assume the firewall is located along the path between session endpoints)?
  2. Tunnel mode
  3. VPN remote access encryption
  4. Transport mode
  5. VPN LAN to LAN encryption
  6. Header encryption
A

Transport mode

42
Q
  1. What type of communication session can be performance improved using caching on a firewall?
  2. Instant messaging
  3. Remote access
  4. Email
  5. Time synchronization
  6. Web
A

Web

43
Q
  1. Which of the following limitations or potential weaknesses of a firewall cannot be fixed or corrected wit the application of an update or patch?
  2. Programming bug or flaw
  3. Firewalking
  4. Buffer overflow vulnerability
  5. Fragmentation
  6. Denial of service due to traffic from external sources
A

Denial of service due to traffic from external sources

44
Q
  1. What is the primary factor used to distinguish a great firewall enhancement from a marketing gimmick used to drive up sales?
  2. Does the enhanced firewall cost the same or less than separate products
  3. Does the enhancement affect the operating speed of the firewall
  4. Does the enhancement operate as good as or better than the original firewall
  5. Does the enhancement require the purchase of a new firewall, or can it be added to existing products already deployed
  6. Does the enhancement have a reoccurring license or subscription fee
A

Does the enhancement operate as good as or better than the original firewall

45
Q
  1. What is the name of a single device that is based on a firewall but which has been expanded and improved to perform a wide variety of services, such as filtering, IPS, antivirus scanning, anti-spam filtering, VPN end-point hosting, content filtering, load-balancing, and detailed logging?
  2. Load balanced filtering
  3. Port based network access (admission) control
  4. Unified threat management
  5. Multi-factor authentication
  6. IEEE 802.1x
A

Unified threat management

46
Q
  1. The most important configuration element in related to a firewall’s management interface is:
  2. Access over wireless is prevented
  3. Access through a network interface is enabled
  4. Access is encrypted
  5. Access through a CON port is allowed
  6. Access to the device physically is controlled
A

Access is encrypted

47
Q
  1. All the following avenues of accessing a firewall’s management interface should be limited, restricted, or disabled EXCEPT:
  2. Wireless
  3. Telnet
  4. Public facing NIC interface
  5. Port 80 Web
  6. Private network NIC interface
A

Private network NIC interface

IS3220 NETWORK SECURITY, FIREWALLS, & VPNS (15 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions