Network Scanners

Question 1

What 5 tools come under the term network scanners?

Answer 1

1) packet sniffers
2) IPS/IDS devices
3) Port scanners
4) wi-fi analyzers
5) Bandwidth speedtesters

Question 2

What type of network scanner allows you to capture traffic on a segment, to identify router/switch interfaces (interface monitoring) and identify sources of broadcast storms?

Answer 2

packet sniffer

Question 3

Snort is a popular type of what product? Why

Answer 3

IDS/IPS. It runs on both Windows and Linux and it’s free

Question 4

What is an Adaptive Security Appliance (ASA)?

Answer 4

Cisco’s enterprise IDS/IPS solution

Question 5

Within Snort, what displays and reports intrusions and attacks logged in the Snort database?

Answer 5

The Basic Analysis and Security Engine (BASE)

Question 6

What security devices should typically placed between the internal router and the DMZ firewall?

Answer 6

IPS/IDS

Question 7

What is the differences between a port scan and a port sweep?

Answer 7

1) Port scan scans for TCP/UDP open ports on a single target host
2) Port sweep scans multiple hosts. Typically used to identify SQL for injection attacks

Question 8

what happens in half-open scanning?>

Answer 8

a syn packet is sent to listen for a syn-ack reply telling the querying host that the port is open. The scanner closes the connection with a RST (reset) packet

Question 9

name two port scanning software

Answer 9

Angry IP and Nmap (Nmap available on both Windows and Unix)

Question 10

What are the 4 ways in which wi-fi analyzers work?

Answer 10

1) passively collect packets
2) detect standard named networks
3) detect hidden networks
4) infer the presence of nonbeaconing networks via data traffic

Question 11

What tool is used to perform end-user experience measures and also locates sources of RF interference so improvements to the wireless network can be implemented?

Answer 11

wireless survey tool with spectrum analyzer

Question 12

what can you use to certify the wireless network for design/application requirements?

Answer 12

Using pass/fail assessment reports based on wireless survey tool output

Question 13

When baselining the network, what 3 things do you need to ensure are verified for future network admins to follow?

Answer 13

1) the network confirms to all regulations
2) clear management procedures
3) clear security policies

Question 14

What are the 4 key baseline components?

Answer 14

1) processor utilization
2) memory utilization
3) hard-disk utilization
4) wired/wireless utilization

Question 15

On what two occasions should baselining be redone?

Answer 15

1) one a year

2) after major upgrades to network infra

Question 16

Which vulnerability scanner works across all devices and operating systems?

Answer 16

Nessus

Question 17

Why must you be careful when using Nessus?

Answer 17

It simulates a network attack and can crash operating systems.

Question 18

Wire shark can decode data from layer 2, layer 3, layer 4 and layer 7 and even reproduce voice streams from VoiP calls - TRUE or FALSE?

Answer 18

TRUE

Question 19

OpenNMS, Nagios and PRTG Network Monitor are examples of what type of application?

Answer 19

Automated network event management and alerting systems.

Question 20

OSSIM by AlienVault is an example of what type of application?

Answer 20

Network Security Information and Event Management tool (SIEM).

Question 21

Port scanning works at what OSI layer?

Answer 21

Transport layer. Ports can be thought of as transport layer addresses used to send messages to an application!

Question 22

List two protocol analyzers that also provide packet sniffing capabilities

Answer 22

Wireshark and MS Message Analyzer