Network Operations (5) Flashcards
Which of the following statements best describes a baseline?
A baseline is an estimation of expected performance levels, based on manufacturers’ specifications.
A baseline is a record of performance levels captured under actual workload conditions.
A baseline is a record of performance levels captured under simulated workload conditions.
A baseline is a record of performance levels captured under actual workload conditions.
A baseline is a record of a system’s performance under real-world operating conditions, captured for later comparison as conditions change. The workload during a baseline capture should be genuine, not simulated or estimated
Programs such as FTP and Telnet are widely criticized because they transmit all data as clear text, including usernames and passwords. Which of the following types of tools might unscrupulous individuals use to read those passwords?
Packet sniffer
Terminal emulator
Packet analyzer
Packet analyzer
A packet analyzer is capable of looking at the data inside packets, which in the case of packets generated by Telnet and FTP, can contain passwords in clear text. Packet sniffers analyzer traffic patterns, and vulnerability scanners search for open ports. Telnet is itself a terminal emulator and does not display packet contents
When monitoring performance metrics on one of your servers, you notice that the server is utilizing 100 percent of the network bandwidth available to it. What modification could you make to the server that will most likely address the problem?
Add memory to the system
Install a second network adapter
Update the network adapter’s firmware
Install a second network adapter
If a server is using all of its network bandwidth, then the most logical solution is to add more. You can do this by installing a second network adapter and connecting it to a different subnet. The other solutions could conceivably address the problem, but their success is less likely
Which of the following best states the potential security threat inherent in running a protocol analyzer?
A protocol analyzer can display the application data in packets captured from the network.
A protocol analyzer can display the IP addresses of the systems on the network.
A protocol analyzer can decrypt protected information in packets captured from the network.
A protocol analyzer can display the application data in packets captured from the network.
Protocol analyzers capture packets from the network and interpret their contents, which includes displaying the application layer payload, which can include confidential information. Protocol analyzers can display the IP addresses of systems on the network, but this is not a great security threat. Protocol analyzers cannot decrypt the protected information it finds in captured packets. Vulnerability scanners detect open ports and launch attacks against them; protocol analyzers do not do this
Which of the following syslog message severity levels indicates that a system is unusable?
0
1
2
0
Every syslog message includes a single-digit severity code. The code 0 is the most severe, indicating an emergency that has rendered the system unusable. Severity code 1 is an alert message, indicating that immediate action is needed. Severity code 2 is a critical condition message, and code 3 is an error condition. Code 4 is a warning message
Which of the following syslog message severity levels indicates that the message is purely informational?
2
4
6
6
Every syslog message includes a single-digit severity code. The code 6 indicates that the message is purely informational. The code 0 is the most severe, indicating an emergency that has rendered the system unusable. Severity code 2 is a critical condition message, and code 4 is a warning message. Code 7 is used strictly for debugging
A Simple Network Management Protocol (SNMP) console can inform administrators when a managed device requires attention. For this to occur, the agent in the device first has to send a message to the console. What is the term used for a message sent by an SNMP agent to the central console?
Ping
Alert
Trap
Trap
Messages that SNMP agents send to consoles when an event needing attention occurs are called traps. Alerts and notifications are terms for the messages that the console sends to administrators. A ping is an ICMP echo request message sent from one TCP/IP computer to another
Which of the following metrics would you typically not find displayed by an interface monitor?
Error rate
Packet drops
Rollbacks
Rollbacks
The term rollback refers to the process of uninstalling or downgrading an update patch; it has nothing to do with monitoring a network interface. An interface monitor does typically display the number of transmission errors that occur on an interface, the amount of the available bandwidth that the interface is using, and the number of packets that have been dropped due to errors or discards
Which of the following are reasons contributing to the number of packet drops displayed by an interface monitor? (Choose all correct answers.)
Resets
Discards
Errors
Overflows
Discards
Errors
The packet drops displayed by an interface monitor are caused by errors, such as malformed or unreadable packets, or discards, packets that are dropped because they are destined for another interface. Resets and overflows are not reasons for packet drops
Which of the following is not a statistic that you would typically find in a server performance baseline?
CPU utilization
Disk transfer rate
OS update history
OS update history
Performance baselines characterize hardware performance, so the OS update history would be of little or no use for future comparisons. A baseline typically consists of CPU, memory, disk, and network performance statistics
Log management typically consists of which of the following tasks? (Choose all correct answers.)
Rollback
Utilization
Security
Cycling
Security
Cycling
Logs frequently contain sensitive information, so securing them with the appropriate permissions is an essential part of log management. Logs also can grow to overwhelm the storage medium on which they are stored, so cycling is a technique for managing log size by configuring them to delete the oldest record each time a new one is added. Rollback and utilization are not log management tasks
Which of the following is not a tool that provides vulnerability scanning capabilities?
Nessus
MAP Toolkit
Nmap
MAP Toolkit
Microsoft Assessment and Planning Toolkit (MAP Toolkit) is a free application that performs an agentless inventory of a network and uses the information to create reports on specific scenarios, such as whether computers are prepared for an operating system upgrade. Nessus, Nmap, and Microsoft Baseline Security Analyzer (MBSA) are all tools that include vulnerability scanning but that have other capabilities as well
Which of the following is a function typically classified as vulnerability scanning?
Remediation
Penetration testing
Port scanning
Port scanning
Port scanning, the process of looking for open TCP and UDP ports that are exploitable by attackers, is one of the many functions that qualifies as a type of vulnerability scanning. Network mapping, the remediation of vulnerabilities, and penetration testing, which is the process of deliberately performing a planned attack, are not considered vulnerability scanning techniques
Which of the following Security Information and Event Management (SIEM) processes performs searches for specific criteria, during specific time frames, in logs located on different computers?
Data aggregation
Forensic analysis
Correlation
Forensic analysis
In SIEM, forensic analysis is a process of searching logs on multiple computers for specific information based on set criteria and time periods. Data aggregation is a process of consolidating log information from multiple sources. Correlation is the process of linking logged events with common attributes together. Retention is the long-term storage of log data
Which of the following virtual private networking protocols is generally considered to be obsolete?
IPsec
L2TP
PPTP
PPTP
Point-to-Point Tunneling Protocol (PPTP) is considered to be obsolete for VPN use because of several serious security vulnerabilities that have been found in it. IPsec, Layer 2 Tunneling Protocol (L2TP), and Secure Sockets Layer/Transport Layer Security (SSL/TLS) are all still in use
