Network Operations (4) Flashcards
Which of the following processes scans multiple computers on a network for a particular open TCP or UDP port?
Port scanning
War driving
Port sweeping
Port sweeping
Port scanning identifies open ports on a single computer, whereas port sweeping scans multiple computers for a single open port. War driving and bluejacking are methods of attacking wireless networks
Which of the following statements best explains the difference between a protocol analyzer and a sniffer?
Analyzers examine the contents of packets, whereas sniffers analyze traffic trends.
Analyzers are software products, whereas sniffers are hardware products.
Analyzers connect to wired networks, whereas sniffers analyze wireless traffic.
Analyzers examine the contents of packets, whereas sniffers analyze traffic trends.
The difference between analyzers and sniffers is that analyzers read the internal contents of the packets they capture, parse the individual data units, and display information about each of the protocols involved in the creation of the packet. Sniffers look for trends and patterns in the network traffic without examining the contents of each packet. Both analyzers and sniffers can be implemented as hardware or software. Analyzers and sniffers are available for wired and wireless networks
After starting work as the network administrator of Wingtip Toys, you discover that all of the switches in the company’s datacenter have support for remote management, with built-in SNMP agents in each port. Which of the following tasks must you perform to be able to gather information from the agents on those switches and display it on a central console? (Choose all correct answers.)
Install the network management software on a network computer.
Install a management information base (MIB) on each of the switches.
Install an agent on the console computer.
Install an MIB on the console computer.
Purchase a network management product.
Install the network management software on a network computer.
Purchase a network management product.
An SNMP-based network management system consists of three components: a management console software product installed on a network computer, agents installed on the devices you want to manage, and MIBs for each of the agents. Because the switches support SNMP management and already have agents, they have MIBs also. Therefore, all you have to do is purchase the network management software and install the console on a network computer
Which of the following software releases is a fix designed to address one specific issue?
A patch
An update
An upgrade
A patch
A patch is a relatively small update that is designed to address a specific issue, often a security exploit or vulnerability. Patches do not add features or new capabilities; they are fixes targeted at a specific area of the operating system. Updates, upgrades, and service packs are larger packages that might include new features and/or many different fixes
Which of the following statements about protocol analyzers is not true?
Protocol analyzers can be a network security risk.
Some network monitoring products are both analyzers and sniffers.
All Windows operating systems include a protocol analyzer.
All Windows operating systems include a protocol analyzer.
A protocol analyzer captures frames and displays their contents, including the header fields created by the protocols at the various OSI model layers. To interpret the exchanges between the computers on the network, you must be familiar with the protocols and how they operate. Protocol analyzers are useful tools in the hands of experienced network administrators, but they can also be used for malicious purposes, such as displaying unencrypted passwords and other confidential information in the captured packets. The difference between analyzers and sniffers is that analyzers read the internal contents of the packets they capture, parse the individual data units, and display information about each of the protocols involved in the creation of the packet. Sniffers look for trends and patterns in the network traffic without examining the contents of each packet.
Which versions of the Simple Network Management Protocol do not include any security protection other than a clear text community string? (Choose all correct answers.)
SNMPv1
SNMPv2
SNMPv2c
SNMPv3
SNMPv1
SNMPv2c
SNMP version 1, the original version, used an unencrypted community string. SNMPv2 added better security, but it was not backward compatible with the version 1 community string. A revised version, SNMP2c, added backward compatibility. SNMPv3, the one most often seen today, includes more advanced security and does not use a community string
Which of the following types of patches is most typically applied to a hardware device?
Firmware updates
Driver updates
Feature changes
Firmware updates
Firmware is a type of software permanently written to the memory built into a hardware device. A firmware overrides the read-only nature of this memory to update the software. Driver updates, feature updates, and vulnerability patches are typically applied to software products, such as applications and operating systems
When can Microsoft Windows users expect to receive automatic downloads of operating system patches?
Weekly, on Mondays
Monthly, on the second Tuesday of the month
Quarterly, on the first day of January, April, July, and October
Monthly, on the second Tuesday of the month
For Windows users, the second Tuesday of every month is “Patch Tuesday,” when Microsoft releases the latest operating system patches for automatic download
Unlike individual users, who usually have their operating system patches downloaded and installed automatically, corporate IT departments typically evaluate new patches before deploying them. Which of the following is not a common step in this evaluation process?
Testing
Researching
Rolling back
Rolling back
Rolling back, the process of uninstalling a patch to revert to the previous version of the software, is not part of the patch evaluation process. The evaluation process for new patches in a corporate environment usually consists of a research stage, in which you examine the need and purpose for the patch, a testing stage, in which you install the patch on a lab machine, and a backup of the production systems to which you will apply the patch
Which of the following types of patches is most likely to be released outside of the normal schedule for the product?
Vulnerability patch
Feature change
Driver update
Vulnerability patch
Vulnerability patches are usually updates that address severe issues that have been recently discovered. When the vulnerability is severe, the software manufacturer might release a patch as soon as it is available, rather than wait for the next scheduled release. Feature changes, driver updates, and firmware updates are usually not time sensitive and are released on schedule
Which of the following types of patches are IT personnel least likely to install unless there is a specific reason to do so?
Feature change
Driver update
Operating system update
Driver update
If a device driver is functioning properly, many administrators would prefer not to update it, believing that “if it ain’t broke, don’t fix it.” Unless a device driver update addresses a specific bug or an incompatibility that the system is experiencing, there might be no need to install it. Feature changes, operating system updates, and especially vulnerability patches are more likely to be recommended installs
Which of the following statements about the Simple Network Management Protocol (SNMP) are not true? (Choose all correct answers.)
To effectively monitor a network using SNMP, you must be sure that all of the equipment you purchase when designing and building your network supports the protocol.
SNMP is not only the name of a protocol; it is also the name of a network management product.
SNMPv1 and SNMPv2 rely on a community string as their only means of security.
Most of the network management products on the market today support SNMPv3.
SNMP is not only the name of a protocol; it is also the name of a network management product.
SNMPv1 and SNMPv2 rely on a community string as their only means of security.
SNMP is not the name of a network management product; it is just the name of the protocol that provides a framework for the interaction of the various components in a network management product. SNMPv1 uses a community string, but SNMPv2 does not. The interim version SNMPv2c retains the community string from version 1 in place of the new version 2 security system. When you see a network interface adapter, switch, router, access point, or other device that purports to be managed or that claims to have network management capabilities, this usually means that the device includes an SNMP agent. Most of today’s network management products do support SNMPv3. In addition, many network management products that implement SNMPv3 also include support for the earlier, unprotected versions, such as SNMPv1 and SNMPv2c
Which of the following terms refers to the process of uninstalling a recently released patch to resume using the previous version?
Downgrade
Reset
Rollback
Rollback
Rollback is a term used in change management to describe the process of reversing a change that has been made, to restore the original configuration. In the case of patch management, a rollback is the process of uninstalling a recently installed software update. The terms backslide, downgrade, and reset are not used to describe this procedure
Which of the following was created to provide logging services for the Unix sendmail program?
syslog
netstat
SNMP
syslog
Syslog is a standard designed to facilitate the transmission of log entries generated by a device or process, such as the sendmail SMTP server, across an IP network to a message collector, called a syslog server. Netstat is a program that displays status information about a system’s network connections; it does not provide logging services. SNMP is a protocol that carries network management information from agents to a central console; it was not created specifically for sendmail. The Cache Array Routing Protocol (CARP) enables proxy servers to exchange information; it does not provide logging services
After switching from a standard PSTN telephone system to a Voice over IP system, users are complaining of service interruptions and problems hearing callers at certain times of the day. After examining the network traffic, you determine that traffic levels on the Internet connection are substantially higher during the first and last hours of the day, the same times when most of the users experienced their problems. Which of the following solutions can provide more reliable VoIP service during peak usage times?
Implement traffic shaping.
Implement load balancing.
Upgrade the LAN from Fast Ethernet to Gigabit Ethernet.
Implement traffic shaping.
Traffic shaping is a technique for prioritizing packets by buffering packets that are not time sensitive for later transmission. You can use this technique to give VoIP packets priority over other types of traffic. Load balancing can conceivably improve the performance of a server, but it cannot help to relieve traffic congestion on the Internet link. The traffic congestion is on the Internet connection, not the LAN, so upgrading to Gigabit Ethernet will not help. SNMP is a protocol used by network management products; it will not relieve the traffic congestion problem
