Network+ Flashcards
Computers need to know only the IP address of a destination computer in order to communicate
with it across a network.
A. True
B. False
B. False
Explanation: Computers must know both the IP address and MAC address in order to
communicate across a network.
The acronym ARP means \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_. A. Address Reservation Protocol B. Abbreviated Routing Protocol C. Addressable Routed Packet D. Address Resolution Protocol
D. Address Resolution Protocol
Explanation: ARP is the Address Resolution Protocol.
ARP is used to find the MAC address of a host when the IP address is known.
A. True
B. False
A. True
Explanation: ARP is used to find the MAC address of a host when the IP address is known.
Another way to say this is that ARP is used to resolve IP Addresses into MAC addresses.
An ARP table (or ARP cache) contains a list of known IP address and MAC address relationships.
A. True
B. False
A. True
Explanation: The ARP cache is a table that is kept on computers which contains all the IP address
and MAC address relationships that the computer has learned about. This way if the computer
needs to communicate with a specific IP address it is able to build a Frame with the associated
MAC address as it communicates out onto the network. Otherwise, the computer must first
send out an ARP request to learn the MAC address which it will then place into the ARP cache.
The term Malware includes viruses, worms, trojan horses, spyware, adware, ransomware and other
types of malicious software written specifically to harm and infect a host system.
A. True
B. False
A. True
Explanation: The term Malware encompasses all malicious software designed to harm and infect
a host system. If a network node becomes infected with any form of Malware it is called a
“compromised system”. Compromised systems can give away the fact that they are compromised
by generating traffic on the network that is abnormal and otherwise unexplainable.
When a server or system is attacked in such a way that it is flooded with traffic and unable to respond
to legitimate requests is referred to as a _______________ attack
A. Session Hijacking
B. Brute Force
C. Main-in-the-middle
D. Denial of Service
D. Denial of Service
Explanation: A Denial of Service (DoS) attack is an attack that overburdens the target with a flood
of traffic/requests until all of its resources are completely tapped out and it becomes unable to
respond to legitimate traffic.
Which of the following is a type of man-in-the-middle attack in which the communicating devices on a
company LAN have their layer 2 frames redirected to the attacker who also resides on the same LAN.
A. VLAN Hopping
B. ARP Poisoning
C. Session Hijacking
D. Smurf Attack
B. ARP Poisoning
Explanation: In an ARP Poisoning attack the attacker must be on the same network as the targets.
This is because the attacker uses forged ARP messages to poison the target computer’s ARP
cache with the MAC address of the attacker. After the ARP cache has bee poisoned all future
communications (layer 2 frames) will be sent to the attacker’s computer instead of to the
intended destination.
Which of the following types of attacks is a type of Denial of Service attack in which spoofed ICMP
messages are sent as an IP directed broadcast to flood a target host with ICMP traffic?
A. VLAN Hopping
B. ARP Poisoning
C. Session Hijacking
D. Smurf Attack
D. Smurf Attack
Explanation: Smurf attacks were a very common type of attack until router manufacturers started
disabling the IP directed broadcast feature on routers by default. With IP directed broadcast
turned on a simple ping message can be sent through a router and it will enter the network as a
broadcast message in which all the hosts who receive the broadcasted ping would reply to it. In
this case the smurfed victim’s IP address is known and is spoofed (forged) into the ping packets
making it seem like the pings came from the victim. This causes all the hosts that received the IP
directed broadcast ping to reply to the ping sending large amounts of ICMP traffic to the victim
all at the same time effectively taking it offline.
End User Awareness training is the worst way for a company to defend against social engineering
attacks.
A. True
B. False
B. False
Explanation: Because people/employees/end users are the targets of social engineering attacks
the best way to defend against them is to make sure users are properly trained in User/Security
Awareness. If users understand the different ways they can be manipulated by social engineering
then they will be more aware of the events when they manifest and much more likely not to fall
for them.
One major vulnerability in networks is the usage of unsecure protocols such as Telnet and SNMPv2.
A. True
B. False
A. True
Explanation: Unsecure protocols like Telnet and SNMPv2 send information in clear text and don’t
require password challenges or message digests. In these cases organizations should be sure to
use the secure versions of these protocols such as SSH and SNMPv3.
It’s okay to have well known ports such as TCP 80 opened up from the outside of a firewall to the inside
of the network.
A. True
B. False
B. False
Explanation: Unnecessary open TCP ports are a huge vulnerability and the network perimeter
devices such as firewalls must be managed meticulously to make sure the network edge is secure
and there are no ports opened in a such a way that it exposes the internal network to the
Internet.
How many bits are in a Byte? A. 32 B. 8 C. 48 D. 12
B. 8
Explanation: There are 8 bits in a Byte.
Select the correct short form of representing the data rate of 1 bit per second A. 1 MB B. 1Bps C. 1 bit D. 1bps
D. 1bps
Explanation: the short form a bits per second is bps. When you see a lowercase “b” is always
means bits. When you see an upper case “B” is always represents Bytes.
Bytes use a lower-case b in the shorthand notation.
A. True
B. False
B. False
Explanation: bits uses the lowercase “b” while Bytes uses the uppercase “B”.
An ordinary Frame payload is how many Bytes in length? A. 1500 B. 9000 C. 1000 D. 500
A. 1500
Explanation: The standard maximum payload of an Ethernet Frame is 1500 Bytes. With
overhead such as the MAC Header, VLAN tag and CRC a standard Frame can exceed 1500 Bytes,
however the actual payload (which contains the data) is still a maximum of1500 Bytes.
Frames are created in the Network Interface Card (NIC).
A. True
B. False
A. True
Explanation: The Network Interface Card is where Frames are assembled before being placed
on the network media and disassembled after being retrieved from the network media.
How many bits are there in 512 Bytes. A. 1024b B. 2048b C. 4096b D. 8192b
C. 4096
Explanation: To find the number of bits in a certain number of Bytes simply multiply the number
of Bytes times eight (512 * 8 = 4096). To perform the reverse is to find the number bytes in a
certain number of bits. In that case simply divide the number of bits by eight (4096 bits / 8 = 512
Bytes)
A unicast is sent from a single sender to multiple receivers.
A. True
B. False
B. False
Explanation: A Unicast is sent from a single sender to a single receiver while a Multicast is sent
from either a single sender or multiple senders to multiple receivers.
What does a MAC Broadcast Address look like in hexadecimal format? A. FF-FF-FF-FF-FF-FF B. EE-EE-EE-EE-EE-EE C. AA-AA-AA-AA-AA-AA D. 00-00-00-00-00-00
A. FF-FF-FF-FF-FF-FF
Explanation: A MAC address destination of all Fs is a message to all hosts which is also known as
a Broadcast. All Fs in the hexadecimal notation of a MAC address is also the equivalent of all 1s
in the 48 bit binary format( 111111111111111111111111-111111111111111111111111)
Routers separate Broadcast Domains.
A. True
B. False
A. True
Explanation: Routers keep broadcast domains separated from each other. One default router
interface (without VLANs) is the equivalent to one broadcast domain or network
By default routers pass Broadcast traffic from one network to another network.
A. True
B. False
B. False
Explanation: Routers do not pass Broadcast traffic by default. If routers did pass normal
Broadcast traffic then that Broadcast traffic would have the potential to spread around the
entire global internet without restriction. We can see how this would be a problem! Broadcast
traffic is intended to stay within a local network which is also know as a Broadcast Domain.
A software company uses a hosted service to build a web application in the cloud. The hosting
provider maintains all the hardware that the web application is built on and the software
company can simply build their web application without worrying about anything else. This is an
example of ___________.
A. IaaS
B. PaaS
C. SaaS
D. Private Cloud
B. PaaS
Explanation: PaaS (Platform as a Service) providers take care of everything that’s needed to
build software in the cloud so that companies can easily build web applications and other
software in the cloud without needing to maintain any of their own servers and hardware.
A company hosts a portion of their network infrastructure in the cloud which it accesses via VPN.
The company is able to move workloads and servers between their on-premise private network
and their network in the cloud creating a Hybrid cloud environment. What type of cloud service is
this referring to?
A. IaaS
B. PaaS
C. SaaS
D. Private Cloud
A. IaaS
Explanation: IaaS (Infrastructure as a Service) providers offer complete network infrastructures
in the cloud where companies can set up their own servers and network storage and only pay
for the resources that are used on a monthly basis.
Any type of software that is hosted in the cloud and accessed as a service via the internet by customers refers to \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_. A. Hybrid IaaS B. Private SaaS C. Hybrid Cloud D. Public SaaS
D. Public SaaS
Explanation: Public SaaS (Software as a Service) is a software offering that runs in the public
cloud and is accessed by customers over the Internet. Public SaaS is available to anyone who
wishes to use or pay for the software as a monthly recurring service. Some companies build
Private SaaS within their own private cloud which would be a software applications strictly used
by the internal employees and would not be available to the public or accessible via a public
cloud.
A virtualized network and network infrastructure that is hosted privately, publicly, or both, but is
shared amongst multipole organizations that have similar interests and compliance requirements
is called a ______________.
A. Private Cloud
B. Public Cloud
C. Community Cloud
D. Hybrid Cloud
C. Community Cloud
What is the command used to display the system IP address and MAC address on a Windows computer? A. ipconfig B. ipconfig /all C. ipconfig /mac D. ipconfig /ip
B. ipconfig /all
Explanation: From Windows command prompt the “ipconfig /all” command will reveal all of the
IP settings and the MAC address. If only “ipconfig” is used it will only reveal the IP address,
subnet mask, and default gateway.
What is the command we can use on any system to test IP reachability status to a network node? A. arp B. nslookup C. netstat D. ping
D. ping
Explanation: ping is a universal command/application that can be used on any bash terminal or
windows command prompt to test IP reachability status to another node.
To check the layer 3 routing hops from a Windows computer to a remote destination which command can you use? A. nslookup B. nbtstat C. tracert D. ping
C. tracert
Explanation: From a Windows computer the “tracert” command reports back each individual
layer 3 hop on the way from the source to the destination. On other systems such and MAC OS
X and Linux as well as on routers and switches the command is “traceroute”. Only in Windows is
the command “tracert”.
This command is similar to traceroute, but it shows even more statistics about each hop. A. ping B. ipconfig C. pathping D. tracert
C. pathping
Explanation: In addition to tracing the route from source to destination, “pathping” also
calculates a percentage of packet loss and latency of each hop. Pathping is really a combination
of both the traceroute and ping utilities and the packet loss percentage is gathered by sending
multiple pings to each hop in the path.
To check the domain name to ip address resolution from a computer which command can be used? A. nslookup B. nbtstat C. netstat D. arp
A. nslookup
Explanation: The “nslookup” command performs a domain name server (DNS) lookup on a
hostname to find the ip address. The same command can be used to perform a reverse lookup
which is done by inputting the ip address after the nslookup command rather than the
hostname.
The following protocols allow for command line access to network devices. (choose all that apply) A. ICMP B. SSH C. RDP D. Telnet
B. (SSH), D. (Telnet)
Explanation: SSH (Secure Shell) and Telnet are both protocols for remote access to the
command line interface of network devices. SSH uses encryption while Telnet does not; all
Telnet traffic is completely clear text. SSH or Telnet could be used to access a remote router,
firewall, or switch to make configuration changes from a remote location.
Telnet should be used instead of SSH for security purposes.
A. True
B. False
B. False
Explanation: Using Telnet is a security concern for companies because all communications over
Telnet are in clear text, even usernames and passwords. SSH should be used instead in order to
increase security with remote access to network devices.
Which of the following TCP ports are used by SSH. (choose all that apply) A. 20 B. 21 C. 22 D. 23
C. 22
Explanation: SSH (Secure Shell) uses TCP port 22
Which of the following TCP ports are used by Telnet. (choose all that apply) A. 20 B. 21 C. 22 D. 23
D. 23
Explanation: Telnet uses TCP port 23.
\_\_\_\_\_\_\_\_\_\_\_\_\_\_ is the protocol responsible for ping and traceroute. A. ICMP B. RDP C. TFTP D. Ping
A. ICMP
Explanation: ICMP (Internet Control Message Protocol) is used by applications such as Ping and
Traceroute to produce IP based reachability outputs. With the Ping application in particular the
ICMP Echo and ICMP Echo reply are used to check IP reachability status of a network node.
Which of the following TCP ports are used by FTP. (choose all that apply) A. 20 B. 21 C. 22 D. 23
A. (20), B. (21)
Explanation: FTP (File Transfer Protocol) uses TCP port 20 (FTP data transfer) & 21 (FTP control).
Port 21 use used to manage the FTP sessions and port 20 is the port which the data actually
transfers over during the file transfer.
Trivial File Transfer Protocol (TFTP) uses UDP port 69 and is considered to be connectionoriented.
A. True
B. False
B. False
Explanation: TFTP (Trivial File Transfer Protocol) does use UDP port 69, but because it uses UDP
is considered to be connection-less. FTP on the other hand uses TCP and is connection-oriented.
Which DNS record needs to be setup to point the outside world to a company’s E-Mail server? A. An A Record B. NS Record C. CNAME D. MX Record
D. MX Record
Explanation: MX records are Mail Exchanger records which are used for Mail servers.
A user is having problems accessing websites. You step in to troubleshoot and you are able to
send pings to the default gateway and out to public internet IP addresses just fine. However,
when you try to ping to a Fully Qualified Domain Name (FQDN) such as www.google.com it does
not go through and says “could not find host www.google.com”. Also, when you attempt to
browse to a website using a web browser you get an error stating the site can’t be reach and the
DNS address could not be found. What is most likely the cause of this problem?
A. The DNS Server is down
B. The user has an incorrect IP address in TCP/IP settings
C. The user has an incorrect DNS server address in TCP/IP settings
D. DHCP Server is down
C. The user has an incorrect DNS server address in TCP/IP settings
Explanation: When an bad DNS entry has been input into the TCP/IP settings of a computer it
will not be able to perform DNS lookups. It will seem to the user as if the connection to the
internet is down, but in reality the computer just can’t perform DNS lookups. To correct this a
valid DNS server should be input into the TCP/IP settings of the computer.
The Domain Name System provides translation from Fully Qualified Domain Names (FQDNs) into
IP addresses.
A. True
B. False
A. True
Explanation: The purpose of DNS is to make things like web services and server addresses much
easier to manage. It’s not easy to remember IP addresses (even for techs and engineers) and
also, what if we need the IP addresses to change? Then, everyone would need to remember a
new number! DNS allows us to use names instead of IP addresses and assists with making
management of public and even private servers much easier. With DNS we can always keep the
same names for our websites and servers and simply translate those names into whatever IP
addresses we need to. DNS resolves FQDNs into IP addresses and vice versa.
A FQDN (Fully Qualified Domain Name) contains the following levels. (choose all that apply) A. Root Domain B. Top-level Domain C. Second-level Domain D. Host
A. (Root Domain), B. (Top-level Domain), C. (Second-level Domain), D. (Host)
Explanation: FQDNs are made up of all of the above. For example in the FQDN
www.google.com, www is the Host, .google is the Second-level, .com is the Top-leve, and the
Root Domain is an invisible “.” at the end of the FQDN.
This type of service allows once to use a dynamically assigned public IP address with a public DNS record. A. SOA B. DHCP C. SRV D. DDNS
D. DDNS
Explanation: DDNS (Dynamic DNS) is a service that allows you to publish a public DNS record
even if you have a dynamically assigned public IP address from your service provider. Most
companies use static IP addresses on their internet gateways and use their own DNS, so in those
situations DDNS is not necessary. However, for home users or SOHO companies that don’t have
a static IP address DDNS is a good option for setting a standard public DNS name that doesn’t
change and will always translate to your public IP address even when it changes.
Which of the following is a physical piece of hardware installed on the edge of a network that protects the
network by permitting or denying traffic that attempts to enter or leave it?
A. Host-based firewall
B. Network-based firewall
C. VPN Concentrator
D. Anti-malware
B. Network-based firewall
Explanation: A network-based firewall is a physical hardware device while a host-based firewall is
software that is installed on an individual host computer. Network-based firewalls are able to provide
security for an entire network by being placed in-line at the edge between the private network and the
public internet connection.
Which of the following is a list of rules on layer 3 switches, routers and firewalls that is used to permit
and/or deny traffic based on where the traffic is coming from and where it is going to?
A. ACL
B. UTM
C. GRE
D. VPN
A. ACL
Explanation: An ACL (Access Control List) is a list created to match specific criteria such as the protocol
(IP), source address/network, destination address/network, and the TCP/UP port number. Once an ACL is
created it can be applied to an interface on a layer 3 switch, router, or firewall to permit or deny inbound
or outbound traffic that passes through the interface.
This type of firewall keeps track of connections that originate from inside the network and go out to the
internet. It tracks the outgoing connection and allows legitimate return traffic to enter the network while
still blocking non-legitimate traffic from the outside.
A. Stateful host-based firewall
B. Stateless network-based firewall
C. Stateless host-based firewall
D. Stateful network-based firewall
D. Stateful network-based firewall
Explanation: Stateful hardware firewalls perform Stateful packet inspection which allows them to keep
track of connections that are leaving the firewall and going out to the internet. The purpose of this is to
allow the return traffic associated with the the outgoing connection as it is legitimate traffic. However,
the firewall will still block other non-legitimate connections that come from the internet. This is different
from Stateless packet inspection as Stateless inspection does not keep track of the outgoing connections
and simple permits or denies traffic based on the criteria found in the ACLs (Access Control Lists) that are
applied to the device.
Most modern firewalls are either stateful or stateless, but never both.
A. True
B. False
B. False
Explanation: Most modern firewalls use Access Control Lists for permitting or denying traffic in a
stateless manner and also track connections in a stateful manner. In this way, most modern firewalls use
both stateful and stateless packet inspection.
This type of firewall is able to perform deep-packet inspection and inspect traffic that passes through it up to OSI layer 7. A. Stateful firewall B. VPN Concentrator C. Application aware firewall D. Stateless firewall
C. Application aware firewall
Explanation: Application aware firewalls (aka context aware firewalls) are able to inspect traffic up to the
Application layer and make decisions based on the context of the layer 7 traffic.
UTM firewalls provide multiple security services and in addition to stateless and stateful firewalling can
also provide things like VPN services, Anti-malware and Content Filtering. The term UTM means
___________________.
A. Unmanaged Tactical Monitoring
B. Unlimited Tactical Mitigation
C. Unilateral Trojan Monitoring
D. Unified Threat Management
D. Unified Threat Management
Explanation: Unified Threat Management Firewalls (or UTM Firewalls) include multiple security services
and act as a strong safeguard for many types of network security threats.
This type of VPN (Virtual Private Network) connects one location to another location via an encrypted tunnel over the internet. A. Host-to-Site VPN B. PPTP VPN C. IPSec Site-to-Site VPN D. Remote VPN
C. IPSec Site-to-Site VPN
Explanation: A Site-to-Site VPN is a VPN tunnel that connects two locations over a private tunnel. VPN
tunnels are encrypted with protocols such as IPSec or SSL to make them secure and viable over the
internet. In some instances a site-to-site VPN can be the primary connection for a location to connect
into the private network, but in other instances a site-to-site VPN may be used as a back-up or alternate
connection to the primary private WAN. Another type of VPN is a Host-to-Site VPN which is also referred
to as a Remote VPN. A Host-to-Site VPN connects a single host into the main network with an encrypted
IPSec or SSL VPN tunnel and is established by using client software on a computer or an SSL vpn webportal.
IPSec provides the following encryption algorithms. (choose all that apply) A. DES B. 3DES C. Blowfish D. AES
A. (DES), B. (3DES), C. (Blowfish), D. (AES).
Explanation: IPSec includes all of the above algorithms by default and IPSec tunnels use the 3DES
algorithm by default. However, most network engineers prefer to use the stronger AES encryption to
encrypt the traffic in IPSec VPN tunnels.
A VPN Concentrator is a device that is designed specifically to handle many VPN connections. As it’s sole
function.
A. True
B. False
A. True
An IDS is a device that is placed on the edge of the network.
A. True
B. False
B. False
Explanation: Firewalls run on the edge of a network whereas IDS and IPS devices run from inside
the network to identify and prevent unauthorized traffic that makes it through the firewall.
A \_\_\_\_\_\_\_\_\_\_\_\_\_\_ actively defends a network by both detecting and preventing attacks. A. Host-based IDS B. Network-based IDS C. Host-based IPS D. Network-based IPS
D. Network-based IPS
Explanation: Switches learn the MAC address of connected hosts and keep them stored in the
MAC address table.
