Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security + SY0-301 > Network Security > Flashcards

Network Security Flashcards

0
Q

What do most firewalls use as the last rule?

A

Implicit deny rule

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
1
Q

What type of cloud-based service is webmail?

A

Software as a Service (SaaS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What type of attack can a flood guard help prevent?

A

SYN flood attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What can a company use to distribute web-based requests to several web servers hosting the same content?

A

Load balancer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are two common protocols used to secure FTP?

A

File Transfer Protocol Secure (FTPS) and Secure FTP (SFTP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A network is using CAT 5 cable. What can prevent data loss?

A

Shielding

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What protocol does SFTP use?

A

Secure FTP (SFTP) uses Secure Shell (SSH) over port 22.
Provides restarting and continuing interrupted transfers
Listing directories
Removing remote files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a wireless device that provides unauthorized access to a network?

A

Rogue access point

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a wireless device that provides unauthorized access to a network and uses the same SSID as an authorized wireless access point?

A

Evil twin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is needed to use WPA2 with an 802.1X server instead of using pre-shared keys?

A

Remote Authentication Dial-in User Service (RADIUS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What should be used to prevent wireless users from accessing other wireless computers through a wireless access point?

A

Isolation mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

You want to reduce the success of war driving. What can you do to the WAP?

A

Reduce the power output of the WAP (or adjust the antenna placement)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What protocol provides the best security for a wireless network?

A

WPA2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What wireless security protocol has been hacked and should not be used?

A

WEP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What should be done with the SSID for security?

A

Change default name

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What can you do with the SSID to hide a wireless network from casual users (but not informed attackers)?

A

Disable said broadcasting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What can be used to prevent specific wireless computers from accessing a wireless network?

A

MAC filtering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What protocol is used to monitor network devices?

A

Simple Network Management Protocol (SNMP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

An organization wants to allow 300 employees to remotely access the corporate network. What is a good choice?

A

Virtual private network (VPN) concentrator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What would an organization create to host Internet-based servers but protect servers on an internal network?

A

Demilitarized zone (DMZ)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What port would you block to prevent Telnet traffic?

A

Port 23

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What port does TFTP use?

A

Trivial File Transfer Protocol (TFTP) uses port 69

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Between UDP and TCP, what does FTP use?

A

File Transfer Protocol (FTP) uses TCP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Between UDP and TCP, what does TFTP use?

A

Trivial File Transfer Protocol (TFTP) uses UDP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What port does SCP use?

A

Secure Copy (SCP) uses port 22

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What port does SMTP use?

A

Simple Mail Transfer Protocol (SMTP) uses port 25

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What port does HTTPS use?

A

Port 443

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What can an attacker check to determine the services running on a server?

A

Open ports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What should you do with unused ports on a switch for better security?

A

Disable them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q 
Your organization uses switches for connectivity. Of the following choices, what will protect the switch?
(A)Disable unused MAC addresses
(B)Disable unused ports
(C)Disable unused IPv4 addresses
(D)Disable unused IPv6 addresses
A

Disabling unused ports is a part of basic port security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q 
Of the following choices, what represents the best choice to prevent intrusions on an individual computer?
(A)HIDS
(B)NIDS
(C)Host-based firewall
(D)Network-based firewalls
A

A host-based firewall can help prevent intrusions on individual computers such as a server or desktop computer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q 
Of the following choices, what controls traffic between networks?
(A)A firewall
(B)Load balancer
(C)VPN concentrator
(D)Protocol analyzer
A

A firewall controls traffic between networks using rules within an ACL.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q 
An organization has a web security gateway installed. What function is this performing?
(A)MAC filtering
(B)Caching content
(C)Hiding internal IP addresses
(D)Content filtering
A

A web security gateway performs content filtering (including filtering for malicious attachments, malicious code, blocked URLs and more).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q 
Your organization hosts a large web site served by multiple servers. They need to optimize the workload and distribute it equally among all the servers. What should they use?
(A)Proxy server
(B)Load balancer
(C)Web security gateway
(D)Security appliance
A

A load balancer can optimize and distribute data loads across multiple computers or multiple networks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q 
Of the following choices, what is the best choice for a device to filter and cache content from web pages?
(A)Web security gateway
(B)VPN concentrator
(C)Proxy server
(D)MAC filtering
A

A proxy server includes the ability to filter and cache content from web pages.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q 
What can an administrator use to detect malicious activity after it occurred?
(A)Firewall
(B)Sniffer
(C)Port scanner
(D)IDS
A

An intrusion detection system (IDS) detects malicious activity after it has occurred.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q 
Of the following choices, what would detect compromises on a local server?
(A)HIDS
(B)NIPS
(C)Firewall
(D)Protocol analyzer
A

A host-based intrusion detection system (HIDS) can detect attacks (including successful attacks resulting in compromises) on local systems such as workstations and servers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q 
Of the following choices, what represents the best choice for a system to detect attacks on a network, but not block them?
(A)NIDS
(B)NIPS
(C)HIDS
(D)HIPS
A

A network-based intrusion detection system (NIDS) will detect attacks, but will not necessarily block them (unless it is an active NIDS).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q 
Your organization is using a NIDS. The NIDS vendor regularly provides updates for the NIDS to detect known attacks. What type of NIDS is this?
(A)Anomaly-based
(B)Signature-based
(C)Prevention-based
(D)Honey-based
A

Signature-based, network-based intrusion detection systems (NIDS) use signatures similar to antivirus software, which are downloaded regularly as updates.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q 
You are preparing to deploy an anomaly-based detection system to monitor network activity. What would you create first?
(A)Flood guards
(B)Signatures
(C)Baseline
(D)Honeypot
A

An anomaly-based (also called heuristic or behavior-based) detection system compares current activity with a previously created baseline to detect any anomalies or changes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Of the following choices, what best describes the function of an IPS?
(A)Detect attacks
(B)Stop attacks in progress
(C)Prevent attackers from attacking
(D)Notify appropriate personnel of attacks

A

The primary purpose of an intrusion prevention system (IPS) is to stop attacks in progress.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q 
Of the following choices, what provides active protection for an operating system?
(A)NIDS
(B)NIPS
(C)HIDS
(D)HIPS
A

A host-based intrusion prevention system (HIPS) provides active protection for an individual host, including its operating system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Of the following choices, what most accurately describes a NIPS?
(A)Detects and takes action against threats
(B)Provides notification of threats
(C)Detects and eliminates threats
(D)Identifies zero day vulnerabilities

A

A network-based intrusion prevention system (NIPS) attempts to detect and mitigate threats by taking action to block them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q 
An IPS is monitoring data streams looking for malicious behavior. When it detects malicious behavior, it blocks the traffic. What is this IPS using?
(A)Smurf detection
(B)Honeypot
(C)Content inspection
(D)Port scanner
A

Many intrusion prevention systems (IPSs) use content inspection techniques to monitor data streams in search of malicious code or behaviors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q 
A user plugged a cable into two RJ-45 wall jacks connected to unused ports on a switch. In a short period, this disrupted the overall network performance. What should you do to protect against this problem in the future?
(A)Enable loop protection on the switch
(B)Disable port security
(C)Create DMZ
(D)Use a VLAN
A

Loop protection such as Spanning Tree Protocol (STP) protects against the switching loop problem described in the scenario.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q 
What can you use to logically separate computers in two different departments within a company?
(A)A hub
(B)A VLAN
(C)NAT
(D)A flood guard
A

A virtual local area network (VLAN) can group several different computers into a virtual network, or logically separate the computers in two different departments.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q 
Most firewalls have a default rule placed at the end of the firewalls ACL. Which of the following is the most likely default rule?
(A)Deny any any
(B)Deny ICMP all
(C)Allow all all
(D)Allow TCP all
A

A deny any any or drop all statement is placed at the end of an ACL and enforces an implement deny strategy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q 
Of the following choices, what best describes a method of managing the flow of network traffic by allowing or denying traffic based on ports, protocols, and addresses?
(A)Implicit deny
(B)Firewall rules
(C)Proxy server content filter
(D)Firewall logs
A

Firewalls use firewall rules (or rules within an ACL) to identify what traffic is allowed and what traffic is denied. A basic packet filtering firewall can filter traffic based on ports, protocols, and addresses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Your network includes a subnet that hosts accounting servers with sensitive data. You want to ensure that users in the Marketing department (on a separate subnet) cannot access these servers. Of the following choices, what would be the easiest to achieve the goal?
(A)Enable load balancing
(B)Enable port security
(C)Use an ACL
(D)Add a host-based firewall to each server.

A

An access control list (ACL) on a router can block access to the subnet from another subnet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q 
You are deploying a remote access server for your organization. Employees will use this to access the network while on the road. Of the following choices, what must you configure?
(A)NAC
(B)ACLs
(C)MACs
(D)NAT-T
A

Access control lists within a firewall must include rules to open the appropriate ports.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q 
You are reviewing a firewall's ACL and see the following statement: drop all. What security principle does this enforce?
(A)Least privilege
(B)Integrity
(C)Availability
(D)Implicit deny
A

A drop all or deny any any statement is placed at the end of an access control list (ACL) and enforces an implement deny strategy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q 
Firewalls include rules in an ACL. Which of the following would block network traffic that isn't in any of the previously defined rules?
(A)Explicit allow
(B)Implicit allow
(C)Explicit deny
(D)Implicit deny
A

Most firewalls have an implicit deny statement (such as drop all or deny any any) at the end of an access control list (ACL) to block all traffic not previously allowed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q 
An organization recently created a security policy. Of the following choices, what is a technical implementation of security policy?
(A)Training
(B)Acceptable use acknowledgement
(C)Implicit deny rule in a firewall
(D)Job rotation
A

Firewall rules (including the implicit deny rule) provide technical implementation of security policies. The other choices are not technical controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q 
Which of the following IP addresses are on the same subnet?
   I. 192.168.1.50, 255.255.255.192
   II. 192.168.1.100, 255.255.255.192
   III. 192.168.1.165, 255.255.255.192
   IV. 192.168.1.189, 255.255.255.192
(A)I and II
(B)II and III
(C)III and IV
(D)All of them
A

Both 192.168.1.165 and 192.168.1.189 are on the same subnet since bits 25 and 26 are the same (10). If a calculator is needed on the exam (such as for a problem like this), it will be available.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q 
Of the following choices, what can be used to allow access to specific services from the Internet while protecting access to an internal network?
(A)SSH
(B)Implicit deny
(C)DMZ
(D)Port security
A

A demilitarized zone (DMZ) can provide access to services (hosted on servers) from the Internet while providing a layer of protection for the internal network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q 
Of the following choices, what hides the IP addresses of computers inside a network from computers outside the network?
(A)Web security gateway
(B)Replacing all hubs with switches
(C)WAF
(D)NAT
A

Network Address Translation (NAT) translates public IP addresses to private IP addresses, and private back to public and hides addresses on the internal network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q 
Your organization is creating a site-to-site VPN tunnel between the main business location and a remote office. What can they use to create the tunnel?
(AWPA2-Enterprise
(B)RADIUS
(C)NAC
(D)IPsec
A

IPsec is one of many tunneling protocols the organization can use to create a VPN tunnel.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q 
You are planning to deploy a VPN with IPsec. Users will use the VPN to access corporate resources while they are on the road. How should you use IPsec?
(A)With AH in tunnel mode
(B)With AH in transport mode
(C)With ESP in tunnel mode
(D)With ESP in transport mode
A

Encapsulating Security Payload (ESP) in tunnel mode encapsulates the entire IP packets and provides confidentiality, integrity, and authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

An employee connects to the corporate network using a VPN. However, the client is not able to access internal resources, but instead receives a warning indicating their system is not up-to-date with current patches. What is causing this behavior?
(A)The VPN is using IPsec
(B)The VPN is not using IPsec
(C)NAC is disabled on the network and remediation must take place before the client can access internal resources
(D)NAC is enabled on the network and remediation must take place before the client can access internal resources

A

Network access control (NAC) inspects clients for specific health conditions and can redirect access to a remediation network for unhealthy clients.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q 
What technology can an organization use to assist with computing requirements in heavily utilized systems?
(A)ISP
(B)DLP
(C)Cloud computing
(D)Remote wipe
A

Cloud computing is very useful for heavily utilized systems and networks, and cloud providers provide the services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q 
Employees in your organization access web-based email using cloud-based technologies. What type of technology is this?
(A)IaaS
(B)PaaS
(C)SaaS
(D)Network-based DLP
A

Applications such as web-based email provided over the Internet are Software as a Service (SaaS) cloud-based technologies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Of the following choices, what is the best explanation of what a PaaS provides to customers?
(A)Web-based applications provided over the Internet.
(B)A device that reduces the risk of employees emailing confidential information outside the organization
(C)Protection against VM escape attacks
(D)An easy-to-configure operating system and on-demand computing capabilities

A

Platform as a Service (PaaS) provides cloud customers with an easy-to-configure operating system and on-demand computing capabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q 
An organization is considering using virtualization in their datacenter. What benefits will this provide?
   I. Increased footprint
   II. Decreased footprint
   III. Reduction in physical equipment needing security
   IV. Elimination of VM escape attacks
(A)I and II
(B)II and III
(C)III and IV
(D)All of them
A

Virtualization can reduce the footprint of a datacenter, eliminate wasted resources, and result in less physical equipment needing physical security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q 
An organization wants to hide addresses it uses on its internal network. What can assist with this goal?
(A)MAC filtering
(B)NAC
(C)NAT
(D)DMZ
A

Network Address Translation (NAT) translates public IP addresses to private, private IP addresses back to public, and hides addresses on the internal network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

You have been tasked by your manager to perform an evaluation of the benefits of using virtualization in your QA testing environment. Which of the following is an advantage of using virtual machines in terms of security and cost efficiency?

A. It reduces the need to install OS software updates.
B.Multiple operating systems can be installed and run in their own separate, secure area on a single hardware device.
C. It helps secure the hardware from unauthorized access.
D. Antivirus and other security software only have to be installed once.

A

B. Virtual machines all run in their own separate and isolated area on the system as if they were on a separate physical machine. This greatly increases security, as any issues arising in one virtual machine will not affect another virtual system. This also allows multiple operating systems to be installed on the same physical hardware, which saves money by avoiding the need to buy multiple hardware systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

After a security review, it is recommended that your organization install a network intrusion prevention system (NIPS). Based on the current budget, your manager recommends that you install a less-costly network detection system (NIDS). What is the primary security difference between a network intrusion detection system (NIDS) and a network intrusion prevention system (NIPS) that you can use to justify the additional costs?

A. A NIDS system only detects TCP/IP attacks.
B. The NIPS system actively tries to mitigate an incoming intrusion rather than just detect it.
C. The NIDS system can raise alarms when it detects an intrusion.
D. A NIPS system is only host based, not network based.

A

B. The NIPS system actively tries to mitigate an incoming intrusion rather than just detect it. A network intrusion detection system actively monitors for intrusions and will alert the administrator when one is detected. A network intrusion prevention system goes a step further and tries to actively prevent the intrusion as it is occurring.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

You must install and secure your organization’s Internet services, including web, FTP, and e-mail servers, within your current network topology, which uses a network firewall to protect your internal networks. In which security zone of your network should these servers be installed to isolate them from the Internet and your internal networks?

A. DMZ
B. VLAN
C. Internal network
D. Intranet

A

A. The demilitarized zone (DMZ) is a network that typically contains Internet servers and services that are accessible from the outside world but should be isolated from your internal network. The DMZ ensures incoming connections for these services are routed to the DMZ and never reach the internal LAN.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

You are configuring your network to ensure that all details of internal IP addresses in your network are hidden from outside networks. You must also allow several internal hosts to be able to use an external IP address when communicating outside the network. Which of the following network security methods should you use?

A. NAT
B.VPN
C.VLAN
D. IP spoofing

A

A. Network address translation (NAT) allows internal hosts with nonroutable Internet addresses to access the Internet using an external address. NAT also hides the IP information of the internal network from the outside world.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

Your organization is growing fast, and the number of clients and devices on your network has doubled in size over the last year. To help better partition and secure your network, which networking technology could you use?

A. NAT
B. NAC
C. VPN
D. VLAN

A

D. A virtual LAN (VLAN) is used to segment a network into smaller logical units to aid in security and performance. The virtual LANs are logically isolated from each other to prevent network traffic and unauthorized access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

Your organization has a large remote user base, and it is becoming difficult to enable them to access a legacy local application server and share and collaborate on project documents. Which of the following technologies could you use to provide secure, centralized access to these resources?

A. VLAN
B. Web-based cloud computing application
C. Virtualization
D. VPN

A

B. You could convert your legacy application to a secure, cloud-based web resource that allows clients to remotely access the application and its data from any Internet connection. The data can be easily shared, and multiple users can collaborate on projects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

You need to implement a solution that allows your users to browse web content safely, and also protect the company from legal liabilities in regard to the downloading of inappropriate and offensive content. Which of the following security devices would you install?

A. Antispam filter
B. Firewall
C. Web proxy
D. Web security gateway

A

D. A web security gateway device is specifically engineered to content-filter HTTP web traffic and prevent attacks on web clients via the HTTP protocol. A network firewall, web proxy, or antispam filter would not prevent security issues specifically for HTTP applications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Many of your users are downloading MP3 music files from the Internet and using up the company’s valuable bandwidth resources. Which technology could you implement to help block the transfer of these files from the Internet?

A. Content filter
B. Antispam filter
C. Protocol analyzer
D. Intrusion detection system

A

A. A content filtering server can analyze network traffic and block specific file types, such as MP3 music files, from being downloaded. The end users will receive an error when they try to access blocked files.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

Your users are complaining that web browsing is very slow, but your small office cannot afford a faster Internet connection. Which of the following technologies would help improve web browsing performance?

A. Web proxy
B. Firewall
C. Authentication proxy
D. Intrusion detection system

A

A. Web proxy servers are used primarily for their caching capability, which boosts web browsing performance by storing content retrieved from an external web serve

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

You have discovered there may be a networking security issue between your network firewall and e-mail server, which is accepting connections from an unauthorized external e-mail server. Which of the following network security tools would be best used for examining network traffic between your firewall and your e-mail server?

A. Intrusion detection system
B. Proxy server
C. Protocol analyzer
D. Firewall server

A

C. A protocol analyzer is best suited for examining and capturing network packets and frames between the two devices. You would be able to examine the network traffic to determine the details of the unauthorized connection and use firewall rules to block it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

You need to set up a secure FTP server to allow your company’s clients to upload their files. Which of the following FTP protocols would you use?

A, SFTP
B. FTP
C. TFTP
D. FTP over HTTP

A

A. SFTP is used to encrypt FTP sessions with SSH (Secure Shell). The other methods such as FTP, TFTP, or FTP over HTTP are not secure and communicate in clear text.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

You want to secure one of your network switch segments to only allow access from specific clients on the development network. Which of the following should you implement?

A. Use a VPN for the development network.
B. Create a firewall rule to restrict access to the switch ports.
C. Create a VLAN for the entire development network.
D. Restrict the switch port access to the MAC addresses of the clients.

A

D. You should enable MAC address security on your switch ports to only allow the hardware addresses of the specific clients on the development network to access those ports.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

You need to secure one of your routers (IP address 10.1.5.25) to prevent access to the SNMP port. On your firewall, which of the following access rules will block SNMP access to the router?

A. permit 10.1.5.25 udp port 53
B. deny 10.1.5.25 tcp port 143
C. deny 10.1.5.25 udp port 161
D. permit 10.1.5.25 udp port 389

A

C. The access rule should be set to deny the SNMP UDP port 161 for the specified IP address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

It is discovered that your primary router has a serious software vulnerability that makes it susceptible to denial-of-service attacks. What should you do to resolve the issue?

A. Disable SNMP
B. Disable ICMP
C. Enable flood protection.
D. Update the firmware.

A

D. In the event that a documented vulnerability is found in a network device firmware or operating system, it should be updated or a patch applied to fix the bug to prevent the device from being compromised.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

Your web server is being flooded by a denial-of-service attack. Using a network analyzer, you see that there are IP broadcast replies being sent back to the address of your server from multiple addresses. Which type of network attack is this?

A. Man-in-the-middle
B. Back door
C. Smurf
D. DNS poisoning

A

C. A smurf attack uses a spoof attack combined with a DDoS attack to exploit the use of IP broadcast addressing and ICMP. By spoofing the address of the web server in an IP broadcast, the attacker causes the replies from other systems on the network to the broadcast all to be sent back to the web server, causing a denial of service.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

When creating firewall rules, which of the following principles should be applied to maximize security by blocking all traffic and only allowing access as
required?

A. Implicit deny
B. Explicit deny
C. Unauthenticated deny
D. Denial of service

A

A. Implicit deny means that anything that is not explicitly defined in an access rule is denied. This denies all access by default until you apply access rules for only the specific services required.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

During a denial-of-service attack, a network administrator blocks the source IP with the firewall, but the attack continues. What is the most likely cause of the problem?

A. The denial-of-service worm has already infected
the firewall locally.
B. The attack is coming from multiple, distributed
hosts.
C. A firewall can’t block denial-of-service attacks.
D. Antivirus software needs to be installed.

A

B. A distributed denial-of-service (DDoS) attack comes from multiple, geographically distributed hosts, making it difficult for the network administrator to block it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

You have just performed a security port scan on your e-mail server. Which of the following services and ports that appeared in the test as open and accepting connections should be disabled?

A. TCP port 21
B. TCP port 25
C. TCP port 110
D. TCP port 143

A

A. TCP port 21 (FTP) is not required on your e-mail server, and it should be disabled to prevent hackers from connecting to the e-mail server on this port.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

Your network router has the ability to be remotely configured through a web browser. Which of the following would be the most secure method for remote access?

A. FTP over HTTP connection
B. HTTP connection
C. Telnet
D. HTTPS connection

A

D. To securely administer your router remotely with a web browser, you should make sure you are using an HTTPS connection that is encrypted via SSL. Other methods send their communications in clear text.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

You have just installed a new SNMP monitoring system for all your network devices. Which of the following should you do to enhance security for the implementation?

A. Change the password of the network monitor.
B. Disable SNMP access on all inbound network ports.
C. Change the default SMTP community string.
D. Enable ICMP.

A

C. The default SNMP community string is “public.” This is a basic type of password used between all systems being monitored by SNMP. This should be changed to a more secure value.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

You have connected to a free, open Wi-Fi hotspot at your local coffee shop. Which of the following security measures should you use to secure your session?

A. Only use HTTPS sites secured with SSL.
B. Set up MAC address filtering.
C. Use a packet sniffer.
D. Reconnect at regular intervals to refresh the encryption key.

A

A. When using an open wireless access point and browsing personal web sites such as your e-mail and banking sites, make sure you use secure, encrypted websites via SSL, or use a VPN connection. This ensures that your session with the web server is encrypted. Any hacker on the same open network can use a packet sniffer to view unencrypted communications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

You have set up a wireless network for your small office of 50 users. Which of the following encryption protocols would you implement to ensure the highest level of encryption security?

A. WAP
B. WPA
C. WEP-128 bit
D. WPA2

A

D. WPA2 is currently the strongest level of encryption security available for a wireless network. WPA2 replaces the weaker WPA and adds Robust Security Network (RSN) support that includes added protection for ad hoc networks, key caching, preroaming authentication, and CCMP, which utilizes the AES cipher to replace TKIP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

You are connecting to a secure, encrypted wireless network. During the initial connection phase, you are asked to enter a passphrase. Which WPA encryption method is in use on the network?

A. WPA-EAP
B. WPA-TKIP
C. WPA-PSK
D. WPA-Enterprise

A

C. WPA-PSK uses a preshared key passphrase that requires all devices on the wireless network to use the same passphrase to access the network. WPA-Enterprise uses an authentication server to perform key management and exchange for all wireless clients.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

You are setting up new Bluetooth-enabled mobile phones for your executive team. Which of the
following security features do you enable to prevent Bluesnarfing?

A. Enable link-level security.
B. Disable the IR port.
C. Disable wireless access.
D. Set an SSID.

A

A. Bluesnarfing is a hacking method in which an unauthorized user can connect to unprotected Bluetooth devices and access any data stored on the device. Link-level security authenticates the actual communications link before data transmission begins. Data encryption can also be performed when the link is authenticated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

You are setting up a new wireless security network for your small office. You have set the SSID of the network to a secure value. Which other feature can you enable to enhance SSID security?

A. Enable SSID broadcast.
B. Enable SSID tunneling.
C. Disable SSID snarfing.
D. Disable SSID broadcast.

A

D. By disabling SSID broadcast, you assure your access points will not advertise the SSID they are using for wireless clients to connect. A user would require prior knowledge of the SSID before he could access the network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

Which of the following types of wireless attacks utilizes a weakness in WEP key generation and encryption to decrypt WEP encrypted data?

A. IV attack
B. War driving
C. PSK attack
D. Eavesdropping

A

A. The IV (initialization vector) attack uses the weakness in the 24-bit generated IV that is paired with the WEP encryption key. The IV can be discovered over time on busy networks that use repeat IV values, and used to decrypt the cipher stream without knowing the WEP key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

To further secure your wireless network, you implement MAC address filtering. Which of the following statements describes the wireless network behavior after you enable MAC address filtering?

A. It allows wireless access only for specified MAC addresses.
B. It prevents wireless access only from specified MAC addresses.
C. It encrypts only specified wireless device MAC addresses.
D. It encrypts only MAC addresses not specified.

A

A. A list of authorized client MAC addresses must be configured on each access point for the network. If any client tries to communicate with the access point and its MAC address isn’t in the list, it will be denied access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

After checking the signal strength of a specific floor of your building, you realize that two of the farthest offices on the floor have very poor signal strength. Which of the following actions can you perform to provide a cost-effective solution to increase signal strength to that part of the building?

A. Disable encryption to speed up the network.
B. Add an additional access point.
C. Use a cable to extend the antenna range of the closest access point.
D. Switch to the 5 GHz band instead of 2.4 GHz.

A

B. You can use a cable and an external antenna to extend the range of your closest access point to the office with the low signal. This is an easy and inexpensive solution rather than purchasing and installing a new access point.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

You are installing a wireless network in a manufacturing facility. Which of the following aspects of the wireless network do you concentrate on to prevent security issues with EMI?

A. Use of WPA2 encryption
B. Use of 802.11g or 802.11n
C. SSID network name
D. Access point and antenna placement

A

D. Antenna and access point placement is important to make sure that it is not close to any other electrical wires or devices (especially those that broadcast on a similar frequency) where electrical interference can cause a loss of wireless signal.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

Your company is moving to a new facility, and you are responsible for installing a wireless network for the new office building. Which of the following should you perform to prepare for a secure implementation?

A. Back up the current wireless configuration.
B. Check for war chalking at the new site.
C. Perform a site survey.
D. Perform a radio frequency sweep.

A

C. An initial site survey should be performed before installation of a wireless network to ensure the environment will be conducive to wireless communications. The survey can also help determine the best placement and coverage for your wireless access points.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

Name the 4 Monitoring Methodologies

A
  1. Signature-Based
  2. Behavior/Anomaly-Based
  3. Heuristic-Based
  4. Rule-Based
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

What is Signature-Based Monitoring?

What are the Pros/Cons?

A

It works by using a predefined db of known attacks that have appeared previously. Each type can be recognized by its unique chars, and signature.
Pros- Powerful and efficient because it relys on the collective knowledge of security vendors.
Cons - Must keep db continually updated.
Unable to detect very new attacks whose signatures are not yet availble.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

What is Behavior/Anomaly-Based Monitoring?

What are the Pros/Cons?

A

A baseline of normal behavior and then monitor network traffic based on these performance profiles to recognize behavioral anomalies that exceed the thresholds of the normal baseline.
Pros - More effient as time goes on (more data collected)
Easily and quickly adapt to the current environment and can detect new variants of attacks that a signature or rule-based might not.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q 
Which authentication protocol is commonly used in WLAN and LAN implementation?
A. CHAP
B. PAP
C. PPP
D. EAP
A

D. EAP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

Five users in an organization require concurrent access to a medical application that requires expensive licensing, what can be done to ensure that the employees can access the application, reduce costs, and promote an ethical office?
A. Obtain a platform as a service agreement with a cloud computing provider
B. Obtain a software as a service agreement with a cloud computing verndor
C. Obtain one license for th software and provide access to clients using thin client software
D. Obtain an infastructure as a service agreement with a cloud computing agreement

A

B. Obtain a software as a service agreement with a cloud computing verndor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

Why is it not recommended to sending credit card infomation in an instant message?
A. traffic is easily sniffed
B. may have spyware installed
C. It is not an official form of payment, as it requiresa signature
D. It could have a trojan virus

A

A. traffic is easily sniffed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q 
In the past, there have been some cases of virus infected computers from subnet A attempting connections with computers on subnet B using port 5959. To prevent infection of subnet B computers, a security solution is required. What can be implemented on the router to prevent traffic on that specific port?
A.  VLAN management
B. Access control list
C. Loop protection
D. Port security
A

B. Access control list

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q 
Which port does HTTPS use?
A. 23
B. 21
C. 80
D. 443
A

D. 443

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

Name the Classes and address ranges of the private IPs

A 
class A network - 10.0.0.0 - 10.255.255.255
class B network - 172.16.0.0 - 172.31.255.255
class C network - 192.168.0.0 - 192.168.255.255
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

What is a Web security gateway?

A

It is a device that is specifically engineered to content-filter HTTP web traffic and prevent attacks on web clients via the HTTP protocol.
Used for safe web-browsing and block certain content downloading.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

What is a web-proxy used for?

A

Servers(s) primarily used for caching capability, which boosts web browsing performance by storing content retrieved from tan external web server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

What is a protocol analyzer used for?

A

It is best suited for examining and capturing network packets and frames between the firewall and the email server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

List the 13 common internet based network and application protocols.

A
  1. TCP/IP
  2. ICMP
  3. HTTP/HTTPS
  4. Telnet
  5. SSH
  6. FTP
  7. TFTP
  8. FTPS/SFTP
  9. SCP
  10. DNS
  11. SNMP
  12. IPsec
  13. NetBIOS
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

What protocols send data as plain text?

What does this make them vulnerable to?

A 
TCP
UDP
HTTP
FTP
Packet sniffing and Spoofing because they don't use authentication functions.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

What is the difference between IPv4 and IPv6 and what are they used for?

A

They are used for the IP or address of a computer.
IPv4 -
IPv6 -

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

Name the 7 layers of the OSI model.

What are the data item (PDU) referred to at each layer?

A
  1. Application - Data
  2. Presentation - Data
  3. Session - Data
  4. Transport - Segments
  5. Network - packets
  6. Data Link - frames
  7. Physical - Bits
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
110
Q

What is the OSI Application Layer? Give examples of protocols used at this layer.

A

7th layer: It provides services needed by software applications to help users interact with the network.

Protocols:
HTTP,FTP, SMTP, DHCP, NFS, Telnet, SNMP, POP3, NNTP and IRC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
111
Q

What is the OSI Presentation layer?

Give examples of protocols used at this layer.

A

6th layer: is responsible for data presentation, ensuring that the data sent from the application layer can be read by the corresponding application layer on the receiving end.
It defines protocols that provide coding and data conversion function - transition, (de)compression, encryption and decryption. These are applied to the application level data to make it transparent to the layers around it.

Protocols:
SSL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
112
Q

What is the OSI Session layer?

Give examples of protocols used at this layer.

A

5th layer: Required for inter-host communication. Establish, maintain and terminate communication sessions between the software application on different networks. Attaches header information to data packets and coordination data transfer for providing dialog control between devices and determine if data is to be sent as simplex, half-duplex or full-duplex messages.
Protocols:
PPTP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
113
Q

What is the OSI Transport layer?

Give examples of protocols used at this layer.

A

4th layer: Provides the services required for end-to-end connectivity and ensuring that data is delivered error-free and in the proper sequence.
Provides process-level addressing, multiplexing and e-multiplexing, and segmentation, packaging and reassembly of data. Includes protocols for establishing , managing, and termination of connections for acknowledgement and retransmission of lost data, flow control, error checking and recovery.
Protocols:
TCP, UDP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
114
Q

What is the OSI Network layer?

Give examples of protocols used at this layer.

A

3rd layer: Enable multiple individual networks to be combined into an internetwork.. Handles logical addressing. It provides path determination- routing messages using the best path available and is responsible for creating virtual circuits between network devices. Performs datagram and encapsulation, packet fragmentation and reassembly, and error handling and diagnostics.
Protocol:
IP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
115
Q

What is the OSI Data Link layer?

A

2nd Layer: Provides services for the various protocols at the network layer. Divided into 2 sub layers: logical link control (LLC) and media access control (MAC).
LLC - takes the packets from the network layer and breaks them into frames using synchronization flow control and error checking functions.
MAC - provides control for accessing the transmission medium at the physical layer. It converts the data into binary digits and prepares them for the physical layer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
116
Q

What is the OSI Physical layer?

A

1st layer: defines the networks hardware specs and physical topology. Defines the encoding and signaling functions required to transmit data across the transmission medium and physically transmits and receives data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
117
Q

List the DARPA (DoD) Model layers and the protocols it uses.

A
  1. Application - mail, file transfer, login applications
  2. Transport (Host-to-Host) TCP or UDP
  3. Internet - package, route, transmit via IP
  4. Network Access (Link) physical data delivery
    Uses TCP/IP protocols (TCP/IP Model)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
118
Q

What is the TCP/IP protocol suite?

A

A set of network protocols that specifies how computers communicate, and provides a set of conversions for interconnection networks and routing traffic. Fucntions independent of the underlying network tech. Includes and integrated addressing system (IP). Operates at OSI layers Application, Transport, Internet and Network Interface.
2 Main Transport Protocols:
TCP - connection-oriented delivery
UDP- connectionless delivery. No error checking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
119
Q

What is an ICMP protocol?

A

Is used to transmit control messages between systems. Used for diagnostics (ping)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
120
Q

Which DoD model layer is responsible for packaging, addressing, and routing data so it can be transmitted?

A

Internet Layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
121
Q

What is ICMP

A

Control Message Protocol - used to send management messages between systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
122
Q

What port allows for the exchange of data through a channel made secure by Secure Shell (SSH)

A

port 22

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
123
Q

What port is used to transmit email retrieved from a server via Post office protocol version 3 (POP3)?

A

Port 110

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
124
Q

Which port handles Simple Mail Transfer protocol (SMTP), which is used to send email

A

port 25

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
125
Q

Which port is the Domain Name Service (DNS), which translates domain names into IP addresses

A

port 53 (TCP or UDP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
126
Q

Which port is HTTP over Secure Sockets layer or HTTPS, which

A

port 443

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
127
Q

Which port is used for Telnet, which provides login capabilities on a remote host

A

port 23

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
128
Q

Which port is used for Transmitting data on a diskless workstation via the Bootstrap Protocol or BOOTP

A

port 67

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
129
Q

Which port is used for Network Time Protocol (NTP) to synchronize the clock times of computer?

A

port 123

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
130
Q

Which port is used for Exchange management information via Simple Network Management Protocol, or SNMP

A

port 161

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
131
Q

Which port is used for Transferring files via Trivial File Transfer Protocol (TFTP)

A

port 69

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
132
Q

Which port is used for SSH File Transfer Protocol (SFTP), which provides additional function to control files.

A

port 22

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
133
Q

Which port is used for Hyper Transfer Protocol (HTTP), which web servers and clients use to communicate

A

port 80

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
134
Q

Which port is used for FTP over SSL (FTPS), which transfers data between a client and server

A

port989

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
135
Q

Which port is used for Message Access Protocol (IMAP), which retrieves email messages

A

port 143

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
136
Q

Name the NetBIOS service and tis port

A

Name Service - 137
Datagram Service - 138
Session Service - 139

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
137
Q

Name the NetBIOS services and their ports

A
  1. Name Service - TCP/UDP 137 usually UDP
  2. Datagram Service used to send small msgs - UDP 138
  3. Session Service allow 2 computers communicate lrg msgs via a connection with error detection and recovery - TCP 139
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
138
Q

What are the 2 Protocols for TCP/IP at the Transport layer?

A

TCP Transmission Control Protocol

UDP User Datagram Protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
139
Q

What is Telnet

A

Telnet allows a user to remotely connect to a host server and login. Telnet does not encrypt data.

140
Q

What is UDP

A

User Datagram Protocol is a TCP/IP protocol.
Simple and fast connectionless and best used when speed is required to broad cast data or multicast. Message is not guaranteed to arrive with no error checking.

141
Q

Which Transport protocol can be used for multicasting?

A

UPD
TCP can not broadcast or multicast since it enables communication between a specific sender and receiver. It is for unicast communication.

142
Q

What communication does TCP provide?

What communication does UPD provide?

A

TCP - unicast

UDP - broadcast or multicast

143
Q

What Transport protocol is lossless?

TCP or UDP

A

TCP - establishes and manages a connection between the source and destination devices. It sequences messages, retransmits messages lost in transmit and implements data flow and congestion control.

144
Q

What is an ephemeral port (TCP or UDP)?

A

Ephemeral ports are assigned only temporarily to client processes. Port numbers range from 1024 - 65535, and can be used by user-developed programs on most systems. The IP/port combination must be unique for data to be transported.

145
Q

What is SSH?

A

Provides a secure channel for data exchange on port 22. Provides encryption and authentication. It ensures that the entire flow of information between the machine and other devices (router/firewall) are encrypted.

146
Q

What are the 3 protocols used for email?

A

SMTP on port 25 (Send email)
POP3 on port 110 (retrieve email, can be used with SMTP)
IMAP on port 143 (retrieve email)

147
Q

What is NetBIOS?

A

It is used on LANs to enable software on individual computers to communicate.

148
Q

List protocols that user UDP and their ports

A
  1. BOOTP used via DHCP to determine its IP. Allows a file to be loaded into memory so a machine can be boot without a disk drive. UPD 67
  2. TFTP is a basic file transfer for small data transfers, boot computers, x-terminals and diskless workstations. UPD 69
  3. NTP used to synch clock times on computers. UPD 123
  4. SNMP (Simple Network Mng Protocol) enables network devices to exchange mng information. UPD 161
149
Q

What error checking does UDP provide?

A

Limited via a checksum with no recovery.

150
Q

What would you use to determine points of weakness in a network by identifying unused ports and determine which services are running by identifying open ports?

A

Port Scanner

151
Q

When would you use a protocol analyzer as part of a vulnerability assessment?

A

To capture, analyze and transmit data packets

When performing traffic analysis to detect patterns

152
Q

List the 3 frameworks in NAC

A
  1. CNAC
  2. TNC
  3. NAP
153
Q

What is a Christmas Tree attack?

A

A specific TCP packet is sent to a particular device on a network, usually a router. The packet has the flags turned on for the URG,PUSH and FIN. These flags being turned on looks like a Christmas Tree.

154
Q 
Which of the following are functions of an intrusion detection system? (Select all correct answers.)
A. Prevent attacks
B. Analyze data
C. Identify attacks
D. Respond to attacks
A

B, C,D
Intrusion detection systems are designed to analyze data, identify attacks, and respond to the intrusion. Answer A is incorrect because preventing attacks is associated with an intrusion prevention system.

155
Q

Which of the following best describes the difference between an intrusion detection system and a firewall?
A. IDSs control the information coming in and out of the
network, whereas firewalls actually prevent attacks.
B. Firewalls control the information coming in and out
of the network, whereas IDSs identify unauthorized
activity.
C. Firewalls control the information coming in and out of
the network, whereas IDSs actually prevent attacks.
D. IDSs control the information coming in and out of
the network, whereas firewalls identify unauthorized
activity.

A

B
IDSs are different from firewalls in that firewalls control the information that gets in and out of the network, whereas IDSs can identify unauthorized activity.
IDSs are also designed to catch attacks in progress within the network, not just on the boundary between private and public networks. Intrusion prevention differs from intrusion
detection in that it actually prevents attacks instead of only detecting the occurrence of an attack.

156
Q

Which of the following best describes a host intrusion detection system?
A. Examines the information exchanged between
machines
B. Attempts to prevent attacks in real-time
C. Controls the information coming in and out of the
network
D. Collects and analyzes data that originates on the local machine.

A

D

A HIDS collects and analyzes data that originates on the local machine.

157
Q

Which of the following best describes a network intrusion detection system?
A. Examines the information exchanged between
machines
B. Attempts to prevent attacks in real-time
C. Controls the information coming in and out of the
network
D. Collects and analyzes data that originates on the local machine

A

A
A NIDS tries to locate packets not allowed on the network that the firewall
missed and looks at the information exchanged between machines.

158
Q

Which of the following best describes a network intrusion prevention system?
A. Examines the information exchanged between
machines
B. Attempts to prevent attacks in real-time
C. Controls the information coming in and out of the
network
D. Collects and analyzes data that originates on the local machine

A

B
Intrusion prevention differs from intrusion detection in that it actually prevents
attacks in real-time instead of only detecting the occurrence.

159
Q 
Which of the following are servers that distribute IP traffic to multiple copies of a TCP/IP service and are configured in a cluster to provide scalability and high availability?
A. Virtual machine hosts
B. VPN Concentrators
C. Storage area networks
D. Load balancers
A

D
Network Load Balancers are servers configured in a cluster to provide scalability and high availability. Load Balancing distributes IP traffic to multiple copies of a TCP/IP service, such as a web server, each running on a host within the cluster.

160
Q

Which of the following is true when implementing a NIPS? (Select all correct answers.)
A. The sensors must be placed on domain controllers to
function properly.
B. The sensors must be physically inline to function
properly.
C. It adds single points of failure to the network.
D. It adds additional redundancy to the network.

A

B,C
When implementing a NIPS, keep in mind that the sensors must be physically inline to function properly. This adds single points of failure to the network.

161
Q

Which of the following best describes fail-open technology in reference to the implementation of NIPS?
A. If the device fails, it provides application redundancy.
B. If the device fails, it will prevents a fire from starting.
C. If the device fails, it causes a complete network
outage.
D. If the device fails, a complete network outage will be
avoided.

A

D
When implementing a NIPS, keep in mind that the sensors must be physically
inline to function properly. This adds single points of failure to the network. A good way to prevent this issue is to use fail-open technology. This means that if the
device fails, it does not cause a complete network outage; instead, it acts like a patch cable.

162
Q

Which of the following best describes a firewall?
A. Examines the information exchanged between
machines
B. Attempts to prevent attacks in real-time
C. Controls the information coming in and out of the
network
D. Collects and analyzes data that originates on the local machine

A

C
A firewall is a component placed on computers and networks to help eliminate undesired access by the outside world. It can be composed of hardware, software, or a combination of both.

163
Q

What purpose does an application–level gateway serve?

A

An application-level gateway understands services and protocols. All traffic is examined to check for OSI application layer (Layer 7) protocols that are allowed. Examples of this type of traffic are File Transfer Protocol
(FTP), Simple Mail Transfer Protocol (SMTP), and Hypertext Transfer Protocol (HTTP). Because the filtering is application-specific, it adds over-head to the transmissions but is more secure than packet filtering.

164
Q

When an insider threat is detected and you want to implement a solution that monitors the internal network activity as well as incoming external traffic, what two types of devices could you use?

A
  1. Network-based intrusion-detection systems monitor the packet flow and try to locate packets that are not allowed for one reason or another and might have gotten through the firewall.
  2. Host-based intrusion-detection systems monitor communications on a host-by-host basis and try to filter malicious data. These types of IDSs are good at detecting unauthorized file modifications and user activity
165
Q

Explain the functions that a proxy server can perform

A

Proxy servers can be placed between the private network and the Internet for Internet connectivity or internally for web content caching. If the organization is using the proxy server for both Internet connectivity and web content caching, the proxy server should be placed between the internal network and the Internet, with access for users who are requesting the web content. In some proxy server designs, the proxy server is placed in
parallel with IP routers. This allows for network load balancing by forwarding of all HTTP and FTP traffic through the proxy server and all other IP traffic through the router.

166
Q

What is a firewall?

A

A firewall is a component placed on computers and networks to help eliminate undesired access by the outside world. It can be composed of hardware, soft-
ware, or a combination of both. A firewall is the first line of defense for the network. The primary function of a firewall is to mitigate threats by monitoring all traffic entering or leaving a network.

167
Q 
Which of the following are servers that distribute IP traffic to  multiple copies of a TCP/IP service and are configured in a cluster to provide scalability and high availability?
A. VPN Concentrators
B. Load balancers
C. Virtual machine hosts 
D. Storage area networks
A

A
A VPN concentrator is used to allow multiple users to access network resources using secure features that are built in to the device and are deployed where the requirement is for a single device to handle a very large number of VPN tunnels.

168
Q

Which of the following best describes a packet-filtering firewall?
A. Relies on algorithms to process application layer data
B. Operates at the OSI network layer
C. Operates at the OSI session layer
D. Examines traffic for application layer protocols

A

B
A packet-filtering firewall is typically a router. Packets can be filtered based on IP addresses, ports, or protocols. They operate at the network layer (Layer 3) of
the OSI model. Packet-filtering solutions are generally considered less-secure firewalls because they still allow packets inside the network, regardless of communication pattern within the session.

169
Q

Which of the following best describes a stateful -inspection firewall?
A. Relies on algorithms to process application layer data
B. Operates at the OSI network layer
C. Operates at the OSI session layer
D. Examines traffic for application layer protocols

A

A
A stateful-inspection firewall is a combination of all types of firewalls. This firewall relies on algorithms to process application layer data.

170
Q

Which of the following best describes a circuit-level firewall?
A. Relies on algorithms to process application layer data
B. Operates at the OSI network layer
C. Operates at the OSI session layer
D. Examines traffic for application layer protocols

A

C
circuit-level gateway operates at the OSI session layer (Layer 5) by monitoring the TCP packet flow to determine whether the session requested is a legitimate one.

171
Q

Which of the following best describes an application-level firewall?
A. Relies on algorithms to process application layer data
B. Operates at the OSI network layer
C. Operates at the OSI session layer
D. Examines traffic for application layer protocols

A

D
With an application-level gateway, all traffic is examined to check for OSI application layer (Layer 7) protocols that are allowed. Examples of this type of traffic are File Transfer Protocol (FTP), Simple Mail Transfer Protocol (SMTP), and Hypertext Transfer Protocol (HTTP).

172
Q 
Which of the following are functions of proxy servers? (Select all correct answers.)
A. Caching
B. Logging
C. Addressing
D. Filtering
A

A,B,D
Proxy servers are used for security, logging, and caching. When the proxy server receives a request for an Internet service, it passes through filtering
requirements and checks its local cache of previously downloaded web pages.

173
Q 
Which of the following are examples of a bastion host? (Select all correct answers.)
A. Web server
B. Email server
C. Database server
D. DHCP server
A

A,B
An exposed server that provides public access to a critical service, such as a web or email server, may be configured to isolate it from an organization’s network
and to report attack attempts to the network administrator. Such an isolated server is referred to as a bastion host, named for the isolated towers that were used to provide castles advanced notice of pending assault.

174
Q 
Which of the following should be implemented if the organization wants to substantially reduce Internet traffic?
A. Content filter
B. Proxy server
C. Protocol analyzer
D. Packet-filtering firewall
A

B
When a proxy server receives a request for an Internet service, it passes through filtering requirements and checks its local cache of previously downloaded
web pages. Because web pages are stored locally, response times for web pages are faster, and traffic to the Internet is substantially reduced.

175
Q 
Which of the following should be implemented if the organization wants a simple, good first line of defense?
A. Content filter
B. Proxy server
C. Protocol analyzer
D. Packet-filtering firewall
A

D
A packet-filtering firewall filters packets based on IP addresses, ports, or protocols and is a simple, good first line of defense.

176
Q 
Which of the following should be implemented if the organization wants to monitor unauthorized transfer of confidential information?
A. Content filter
B. Proxy server
C. Protocol analyzer
D. Packet-filtering firewall
A

A
Internet content filters use a collection of terms, words, and phrases that are compared to content from browsers and applications. This type of software can filter content from various types of Internet activity and applications, such as instant messaging, email, and office documents. It can be used to monitor and stop the disclosure of the organization’s proprietary or confidential information.

177
Q 
Which of the following should be implemented if the organization wants to troubleshoot network issues?
A. Content filter
B. Proxy server
C. Protocol analyzer
D. Packet-filtering firewall
A

C
Protocol analyzers help you troubleshoot network issues by gathering packet-level information across the network. These applications capture packets and decode the information into readable data for analysis.

178
Q 
Which of the following should be implemented if the organization wants to capture proper documentation for forensic investigations and litigation purposes?
A. Content filter
B. Proxy server
C. Protocol analyzer
D.  Packet-filtering firewall
A

A
Internet content filters use a collection of terms, words, and phrases that are compared to content from browsers and applications. Because content filtering
uses screen captures of each violation with time-stamped data, it provides proper documentation
for forensic investigations and litigation purposes.

179
Q 
Content filtering is integrated at which of the following levels?
A. Network level
B. Application level
C. System kernel level
D. Operating system level
A

D
Content filtering is integrated at the operating system level so that it can monitor events such as opening files via Windows Explorer. It can be used to monitor
and stop the disclosure of the organization’s proprietary or confidential information.

180
Q 
Which of the following is the biggest drawback of using content filtering?
A. Network bandwidth is reduced.
B. Daily updates are required.
C. Terminology must be defined.
D. Opens the system to DoS attacks.
A

C
Unlike antivirus and antispyware applications, content monitoring does not require daily updates to keep the database effective and current. On the downside,
content filtering needs to be “trained.” For example, to filter non-pornographic material, the terminology must be input and defined in the database.

181
Q

Which of the following are functions of a protocol analyzer? (Select all correct answers.)
A. Monitor for unexpected traffic
B. Identify unnecessary protocols
C. Prevent SMTP relay from being exploited
D. Prevent DoS attacks by unauthorized parties

A

A,B
Protocol analyzers can do more than just look at packets. They prove useful in many other areas of network management, such as monitoring the network
for unexpected, unwanted, and unnecessary traffic. For example, if the network is running slowly, a protocol analyzer can tell you whether necessary protocols are running on the network.

182
Q

Which of the following is true about the use of content filtering?
A. It will report all violations identified in one group of
applications.
B. It will report only violations identified in the specified
applications.
C. It will report only violations identified in one applica-
tion at a time.
D. It will report all violations identified in all applications.

A

B
Content filtering will report only on violations identified in the specified applications listed for the filtering application. In other words, if the application will filter only Microsoft Office documents and a user chooses to use open Office, the content will not be filtered.

183
Q

Which of the following most accurately describes personal firewall design?
A. Closes off systems by integrity checking
B. Closes off systems by blocking port access
C. Closes off systems by blacklisting applications
D. Closes off systems by blocking BIOS access

A

B
Like most other solutions, firewalls have strengths and weaknesses. By design, firewalls close off systems to scanning and entry by blocking ports or nontrusted services and applications. However, they require proper configuration.

184
Q 
Which of the following types of detection does a host intrusion detection system use? (Select all correct answers.)
A. Anomaly detection
B. Misuse detection
C. Blacklist detection
D. Outbound detection
A

A,B
A host intrusion detection system uses either misuse detection or anomaly detection. A HIDS monitors events for suspicious activity. This can be
done by using either misuse detection or anomaly detection. In misuse detection, a database of signatures is used, and the information monitored is compared to the database. This is similar to the way antivirus software works

185
Q

Which of the following is the most appropriate reason for firewalls to monitor outbound connections?
A. To track the collection of personal data
B. To track users going to inappropriate sites
C. To monitor excessive user bandwidth usage
D. To catch malware that transmits information

A

D
Monitoring outbound connections is important in the case of malware that “phones home.” Without this type of protection, the environment is not properly protected.

186
Q

Which of the following best describes the characteristics of host-based IDSs? (Select all correct answers.)
A. Good at detecting unauthorized user activity
B. Good at detecting unauthorized file modifications
C. Good at detecting denial of service attacks
D. Good at detecting unauthorized user access

A

A,B
HIDSs monitor communications on a host-by-host basis and try to filter malicious data. These types of IDSs are good at detecting unauthorized file modifications
and user activity. NIDSs monitor the packet flow and try to locate packets that may have gotten through misconfigured firewalls and are not allowed for one reason or another. They are best at detecting DoS attacks and unauthorized user access.

187
Q

Which of the following is the main purpose of a host-based IDS?
A. Prevent attacks in real-time
B. Locate packets not allowed on the network
C. Proactively protect machines against attacks
D. Analyze data that originates on the local machine

A

D
NIDSs try to locate packets not allowed on the network. HIDSs collect and analyze data that originate on the local machine or a computer hosting a service. NIDSs tend to be more distributed.

188
Q 
The organization requires email traffic in a DMZ segment; which of the following TCP ports will be open? (Select all correct answers.)
A.110
B.21
C.25
D.443
A

A, C

Port 110 is used for POP3 incoming mail and port 25 is used for SMTP mail.

189
Q 
Which of the following UDP ports must be open to allow SNMP traffic through the router?
A.161
B.162
C.443
D.4445
A

A, B.

UDP ports 161 and 162 are used by SNMP

190
Q

Which of the following best describes a demilitarized zone (DMZ)?
A. A small network between the database servers and file servers
B. A small network between the internal network and the
Internet
C. A portion of the internal network that uses web-based
technologies
D. A portion of the internal infrastructure used in
business-to-business relationships

A

B.
A demilitarized zone (DMZ) is a small network between the internal network and the Internet that provides a layer of security and privacy.

191
Q

Which of the following best describes a virtual local-area network (VLAN)?
A. A method to allow multiple computers to connect to
the Internet using one IP address
B. A method to unite network nodes physically into the
same broadcast domain
C. A method to split one network into two using routers
to connect them together
D. A method to unite network nodes logically into the
same broadcast domain

A

D.
The purpose of a virtual local-area network (VLAN) is to unite network
nodes logically into the same broadcast domain regardless of their physical attachment to the network. VLANs provide a way to limit broadcast traffic in a switched network.

192
Q

Which of the following best describes Network Address
Translation (NAT)?
A. A method to allow multiple computers to connect to
the Internet using one IP address
B. A method to unite network nodes physically into the
same broadcast domain
C. A method to split one network into two using routers
to connect them together
D. A method to unite network nodes logically into the
same broadcast domain

A

A.
NAT allows multiple computers to connect to the Internet using one IP
address.

193
Q

Which of the following best describes subnetting?
A. A method to allow multiple computers to connect to
the Internet using one IP address
B. A method to unite network nodes physically into the
same broadcast domain
C. A method to split one network into two using routers
to connect them together
D. A method to unite network nodes logically into the
same broadcast domain

A

C.
Subnetting splits one network into two or more, using routers to connect each subnet. Answer A is incorrect. NAT allows multiple computers to connect to the
Internet using one IP address.

194
Q

Which of the following is the most important security aspect of using Network Address Translation (NAT)?
A. It unites network nodes logically into the same
broadcast domain.
B. It hides the internal network from the outside world.
C. It allows users to be grouped by department rather
than location.
D. It allows external users to access necessary
information.

A

B.
Network Address Translation (NAT) acts as a liaison between an internal network and the Internet. It allows multiple computers to connect to the Internet using
one IP address. An important security aspect of NAT is that it hides the internal network from the outside world.

195
Q

Which of the following is the most common reason networks are subnetted?
A. To allow logical division on the same broadcast
domain
B. To hide the internal network from the outside world
C. For easier application of security policies
D. To control network traffic

A

D.
Subnetting can be done for several reasons. If you have a Class C address and 1,000 clients, you will have to subnet the network or use a custom subnet mask
to accommodate all the hosts. The most common reason networks are subnetted is to control network traffic by limiting broadcast domains, which limits broadcast storms.

196
Q 
Which of the following private IP address ranges should be used for the internal network when there are 100 host systems?
A.10.x.x.x
B.172.16.x.x
C.192.168.1.x
D.224.1.1.x
A

C.
There are specific reserved private IP addresses for use on an internal network. In a Class C network, valid nonroutable host IDs are from 192.168.0.1 to
192.168.255.254. Network addresses with the first byte between 192 and 223 are Class C and can have about 250 hosts. Answer A is incorrect because it is a Class A
address. Valid host IDs are from 10.0.0.1 to 10.255.255.254. Network addresses with the first byte between 1 and 126 are Class A and can have about 17 million hosts each.

197
Q

When a client machine receives an IP address of 169.254.0.15, it is an indication of which of the following?
A. The client cannot contact the DHCP server.
B. The client has a corrupt routing table.
C. The client has a manually configured address.
D. The client cannot contact the DNS server.

A 
A. 
Another address range to keep in mind when designing IP address space is Automatic Private IP Addressing (APIPA). In the event that no Dynamic Host
Configuration Protocol (DHCP) server is available at the time that the client issues a DHCP lease request, the client is automatically configured with an address from the169.254.0.1 through 169.254.255.254 range.
198
Q 
Automatic Private IP Addressing (APIPA) is denoted by which of the following IP addresses?
A.192.168.1.10
B.169.254.0.5
C.224.223.10.1
D.172.16.15.84
A

B.
In the event that no Dynamic Host Configuration Protocol (DHCP) server is available at the time the client issues a DHCP lease request, the client is automatically configured with an address from the 169.254.0.1 through 169.254.255.254 range.

199
Q

Which of the following best describes network access control (NAC)?
A. A method to allow multiple computers to connect to the Internet using one IP address
B. A method to split one network into two using routers
to connect them together
C. A method to unite network nodes logically into the
same broadcast domain
D. A method of enforcement that helps ensure computers are properly configured

A

D.
One of the most effective ways to protect the network from malicious hosts is to use network access control (NAC). NAC offers a method of enforcement
that helps ensure that computers are properly configured. The premise behind NAC is to secure the environment by examining the user’s machine and, based on the results,
grant access accordingly.

200
Q 
Which of the following IP address ranges can be used for the internal network when using NAT? (Select all correct answers.)
A. 10.x.x.x
B. 172.16.x.x
C. 192.168.1.x
D. 224.1.1.x
A

A, B, C.
In a Class A network, valid nonroutable host IDs are from 10.0.0.1 to 10.255.255.254. In a Class B network, valid nonroutable host IDs are from 172.16.0.1
through 172.31.255.254. In a Class C network, valid nonroutable host IDs are from 192.168.0.1 to 192.168.255.254.

201
Q 
Which of the following are basic components of NAC? (Select all correct answers.)
A. Access requestor
B. Network redirector
C. Policy enforcement point
D. Policy decision point
A

A, C, D.
The basic components of NAC products are the Access requestor (AR), which is the device that requests access; the policy decision point (PDP), which
is the system that assigns a policy based on the assessment; and the policy enforcement point (PEP), which is the device that enforces the policy.

202
Q 
Which of the following devices can be a policy enforcement point in NAC? (Select all correct answers.)
A. Hub
B. Switch
C. Firewall
D.Router
A

B, C, D.

The policy enforcement point is the device that enforces the policy. This device may be a switch, firewall, or router.

203
Q 
Which of the following best describes the NAC method that  performs an assessment as hosts come online, and then grants appropriate access?
A. Inline
B. Out-of-band
C. Switch based
D. Host based
A

B.
The four ways NAC systems can be integrated into the network are inline, out-of-band, switch based, and host based. An out-of-band intervenes and performs an assessment as hosts come online, and then grants appropriate access.

204
Q 
Which of the following is a business benefit associated with the use of NAC? (Select all correct answers.)
A. Compliance
B. Separation of duties
C. Improved security posture
D. Operational cost management
A

A, C, D.
In addition to providing the capability to enforce security policy, contain noncompliant users, and mitigate threats, NAC offers a number of business benefits. The business benefits include compliance, a better security posture, and operational cost management.

205
Q

Which of the following are ways to mitigate vulnerabilities associated with a PBX? (Select all correct answers.)
A. Changing any default passwords that have been set
B. Physically securing the area where the PBX resides
C. Implementing an encryption solution
D. Putting a data-validation system in place

A

A, B.
To protect your network, make sure the PBX is in a secure area, any default passwords have been changed, and only authorized maintenance is done.
Many times, hackers can gain access to the phone system via social engineering because this device is usually serviced through a remote maintenance port.

206
Q 
Which of the following type of attack is associated with the use of a PBX?
A. Man-in-the-middle
B. Buffer overflows
C. Denial of service
D. Social engineering
A

D.
Many times, hackers can gain access to the phone system via social engineering because this device is usually serviced through a remote maintenance port. To
protect your network, make sure the Private Branch Exchange (PBX) is in a secure area, any default passwords have been changed, and only authorized maintenance is done

207
Q 
Which of the following type of attack is associated with the use of VoIP? (Select all correct answers.)
A. Man-in-the-middle
B. Buffer overflows
C. Denial of service
D. Social engineering
A

A, B, C.
Man-in-the-middle attacks are executed between the SIP phone and a SIP proxy, allowing the audio to be manipulated, causing dropped, rerouted, or playback
calls. VoIP PBX servers are susceptible to the same type of exploits as other network servers. These attacks include DoS and buffer overflows, with DoS being the
most prevalent.

208
Q

Which of the following is an inherent security risk associated with using SIP as an alternative for VoIP?
A. It leaves the network open to long-distance toll fraud.
B. It leaves the network open to war-dialing attacks.
C. It leaves the network open to unauthorized transport
of data.
D. It leaves the network open to war-driving attacks.

A

C. Session Initiation Protocol (SIP) is commonly used in instant messaging, but it can also be used as an alternative for VoIP. Using SIP can leave VoIP networks
open to unauthorized transport of data.

209
Q

Which of the following is an inherent security risk associated with using a PBX?
A. It leaves the network open to long-distance toll fraud.
B. It leaves the network open to war-dialing attacks.
C. It leaves the network open to unauthorized transport
of data.
D. It leaves the network open to war-driving attacks.

A

A.
For years, PBX-type systems have been targeted by hackers, mainly to get free long-distance service. The vulnerabilities that phone networks are subject to
include social engineering, long-distance toll fraud, and breach of data privacy.

210
Q

Which of the following is an inherent security risk associated with using a modem pool?
A. It leaves the network open to long-distance toll fraud.
B. It leaves the network open to war-dialing attacks.
C. It leaves the network open to unauthorized transport
of data.
D. It leaves the network open to war-driving attacks.

A

B.
Leaving modems open for incoming calls with little to no authentication for users dialing in can be a clear security vulnerability in the network. For example,
war-dialing attacks take advantage of this situation. War-dialing is the process by which an automated software application is used to dial numbers in a given range to
determine whether any of the numbers are serviced by modems that accept dial-in requests. Answer

211
Q 
Which of the following solutions can help mitigate the risks and vulnerabilities associated with VoIP? (Select all correct answers.)
A. Authentication
B. Setting the callback features
C. Data validation
D. Implementing a firewall solution
A

A, C. Implementing the following solutions can help mitigate the risks and vulnerabilities associated with VoIP: encryption, authentication, data validation, and
nonrepudiation. VoIP is basically based on a TCP/IP network; therefore, technologies that are used to secure IP networks can be used for VoIP, too.

212
Q 
Which of the following solutions can help mitigate the risks and vulnerabilities associated with modems? (Select all correct answers.)
A. Authentication
B. Setting the callback features
C. Data validation
D. Implementing a firewall solution
A

B, D
Setting the callback features to have the modem call the user back at a preset number and using encryption and firewall solutions will help keep the environment
safe from attacks.

213
Q 
Which of the following is used to prevent STP issues?
A. Loop protection
B. Flood guard
C. Implicit deny
D. Port security
A

A.

The loop guard feature makes additional checks in Layer 2 switched networks.

214
Q 
Which of the following is a firewall feature used to mitigate denial of service attacks?
A. Loop protection
B. Flood guard
C. Implicit deny
D. Port security
A

B.

A flood guard is a firewall feature to control network activity associated with denial of service attacks (DoS).

215
Q 
Which of the following is a Layer 2 traffic control feature?
A. Loop protection
B. Flood guard
C. Implicit deny
D. Port security
A

D.
Port security is a Layer 2 traffic control feature on Cisco Catalyst switches. It enables individual switch ports to be configured to allow only a specified number of
source MAC addresses coming in through the port.

216
Q 
Which of the following would best mitigate the risks associated with allowing network access to a business partner?
A. Log analysis
B. Access Control Lists
C. Network segmentation
D. Proper VLAN management
A

C.
With interconnected networks, the potential for damage greatly increases because one compromised system on one network can easily spread to other networks.
Networks that are shared by partners, vendors, or departments should have clear separation boundaries.

217
Q 
Which of the following would be the best solution to create  multiple, isolated local networks on one switch?
A. Port security
B. Access Control Lists
C. Network segmentation
D. Proper VLAN management
A

D.
VLANs provide a way to limit broadcast traffic in a switched network. This creates a boundary and, in essence, creates multiple, isolated LANs on one switch.
VLANs are a logical separation of a physical network.

218
Q

Which of the following best describes system logging?
A. The process of measuring the performance of a
network
B. The process of collecting data to be used for
monitoring
C. The process of tracking users and actions on the
network
D. The process of observing the state of a system

A

B.

Logging is the process of collecting data to be used for monitoring and auditing purposes

219
Q 
To get an accurate view of a network, which of the following must precede logging?
A. Baselining
B. Auditing
C. Monitoring
D. Archiving
A

A.
Logging procedures and evaluation are an important part of keeping your network safe. However, before you can configure logging, it is essential to identify what is typical behavior for your network

220
Q

Which of the following best describes the way logging should be implemented?
A. Only the user events should be logged.
B. Only pertinent events should be logged.
C. All events should be logged so nothing is missed.
D. Nothing should be logged until there is a need for it.

A

B.
When choosing what to log, be sure you choose carefully. Logs take up disk space and use system resources. They also have to be read, and if you log too
much, will bog down the system; it will take a long time to weed through the log files to determine what is important

221
Q 
Application logging standards should be implemented for the types of events the organization logs based on which of the  following? (Select all correct answers.)
A. User requirements
B. Vendor requirements
C. Business requirements
D. Regulatory requirements
A

C, D.
Standards should be implemented for the types of events you want to log based on business, technical, and regulatory requirements, and the threats the
organization faces.

222
Q 
Which of the following is pertinent in addition to reading the log files?
A. Knowing how to correlate events
B. Knowing how to parse log files
C. Knowing how to delete events
D. Knowing how to export log files
A

A.

Not only do you need to read the logs, you may also have to know how to correlate events examining output

223
Q

Which of the following are objectives for the placement of firewalls? (Select all correct answers.)
A. Identify unnecessary protocols
B. Allow only traffic that is necessary
C. Provide notification of suspicious behavior
D. Monitor unauthorized transfer of information

A

B, C.
The main objective for the placement of firewalls is to allow only traffic that the organization deems necessary and provide notification of suspicious behavior.

224
Q

Which of the following is the most likely placement of each firewall when an organization is deploying only two of them?
A. One behind the DMZ and one between the intranet and the extranet
B. One in front of the DMZ and one between the intranet
and the extranet
C. One in front of the DMZ and one between the DMZ
and the internal network
D. One in front of the DMZ and one between the financial data and the user data

A

C.
Most organizations deploy, at a minimum, two firewalls. The first firewall is placed in front of the DMZ to allow requests destined for servers in the DMZ or to
route requests to an authentication proxy. The second firewall is placed to allow outbound requests. All initial necessary connections are located on the DMZ machines.
For example, a RADIUS server may be running in the DMZ for improved performance and enhanced security, even though its database resides inside the company intranet.

225
Q

Which of the following best describes the reason packet-filtering firewalls are considered unsecure as compared to other types of firewalls?
A. They allow packets regardless of communication
patterns.
B. Because of physical placement, they are very
accessible.
C. It is impossible to create a secure password for them.
D. They can be compromised with very little effort.

A

A.
A packet-filtering firewall is typically a router. Packets can be filtered based on IP addresses, ports, or protocols. They operate at the network layer (Layer 3) of
the Open Systems Interconnection (OSI) model. Packet-filtering solutions are generally considered less secure firewalls because they still allow packets inside the network, regardless of communication patterns within the session

226
Q

Which of the following best describes why an organization would implement a proxy service firewall?
A. To prevent DoS attacks by unauthorized parties
B. To monitor unauthorized transfer of confidential
information
C. To capture proper documentation for forensic
investigations
D. To prevent user computers from directly accessing
the Internet

A

D.
Proxy service firewalls are go-betweens for the network and the Internet. They can be used to hide the internal addresses from the outside world through NAT.
This does not allow the computers on the network to directly access the Internet.

227
Q 
Which of the following best describes what governs the traffic of proxy service firewalls?
A. Settings
B. Rules
C. Policies
D. Guidelines
A

B.
Proxy service firewalls are go-betweens for the network and the Internet. They hide the internal addresses from the outside world and don’t allow the computers
on the network to directly access the Internet. This type of firewall has a set of rules that the packets must pass to get in or out. Because the firewall check traffic
against a set of rules, setting, policies, and guidelines are incorrect.

228
Q 
Which of the following technologies would you implement when setting up a switched network and you want to group users by department?
A.VPN
B.NAT
C.VLAN
D.DMZ
A

C.
The purpose of a VLAN is to unite network nodes logically into the same broadcast domain regardless of their physical attachment to the network.

229
Q 
Where would an organization place a web server that needs to be accessed by both the employees and by external customers?
A.VPN
B.NAT
C.VLAN
D.DMZ
A 
D. 
A DMZ is a small network between the internal network and the Internet that provides a layer of security and privacy. Answer A is incorrect because a virtual
private network (VPN) is a network connection that allows you access via a secure tunnel created through an Internet connection
230
Q 
Which of the following would an organization implement to monitor the internal network and external traffic when the source of recent security breaches is unknown? (Select all correct answers.)
A. Firewall
B. Content filter
C. Host-based IDS
D. Network-based IDS
A

C, D.
Because you want to monitor both types of traffic, the IDSs should be used together. Network-based intrusion detection systems monitor the packet flow and
try to locate packets that are not allowed for one reason or another and may have gotten through the firewall. Host-based intrusion detection systems monitor communications on a host-by-host basis and try to filter malicious data. These types of IDSs are good at detecting unauthorized file modifications and user activity. A firewall protects computers and networks from undesired access by the outside world

231
Q

Which of the following is the most likely placement of a proxy server when a small organization is deploying it for Internet connectivity?
A. On the internal network
B. Between the internal network and the Internet
C. Between the web server and file server
D. In parallel with IP routers

A

B.
Proxy servers can be placed between the private network and the Internet for Internet connectivity. If the organization is using the proxy server for both Internet
connectivity and web content caching, the proxy server should be placed between the internal network and the Internet, with access for users who are requesting the web content.

232
Q

Which of the following is the most likely placement of a proxy server when a small organization is deploying it for content caching?
A. On the internal network
B. Between the internal network and the Internet
C. Between the web server and file server
D. In parallel with IP routers

A

A.

Proxy servers are usually placed internally for web content caching.

233
Q

Which of the following is the most likely placement of a proxy server when a small organization is deploying it for both Internet connectivity and web content caching?
A. On the internal network
B. Between the internal network and the Internet
C. Between the web server and file server
D. In parallel with IP routers

A

B.
Proxy servers can be placed between the private network and the Internet for Internet connectivity. If the organization is using the proxy server for both Internet
connectivity and web content caching, the proxy server should be placed between the internal network and the Internet, with access for users who are requesting the web
content.

234
Q

Which of the following is the most likely placement of a proxy server when a large organization is deploying it for Internet connectivity?
A. On the internal network
B. Between the internal network and the Internet
C. Between the web server and file server
D. In parallel with IP routers

A

D.
In some proxy server designs, such as for a large organization, the proxy server is placed in parallel with IP routers. This design allows for network load balancing
by forwarding of all HTTP and FTP traffic through the proxy server and all other IP traffic through the router.

235
Q

Which of the following best describes the mechanics of Internet content filtering?
A. Analyzes data against a database contained in the
software
B. Analyzes data by scanning against a vendor provided
rule base
C. Analyzes data against preset rules contained in the
software
D. Analyzes data by matching against predefined traffic
patterns

A

A.
Internet content filtering works by analyzing data against a database contained in the software. Content filtering reports only on violations identified in the
specified applications listed for the filtering application. In other words, if the application will only filter Microsoft Office documents and a user chooses to use Open Office,
the content will not be filtered

236
Q

Which of the following would be likely placements of a hardware network Internet content filtering device? (Select all correct answers.)
A. Behind the proxy/NAT point
B. On the individual user machines
C. In a DMZ with public addresses behind a packet-
filtering router
D. Connected to the same network segment as the users
monitored

A

A, C, D.
Network Internet content filters can be hardware or software. Many network solutions combine both. Hardware appliances are usually connected to the
same network segment as the users they will monitor. Other configurations include being deployed behind a firewall or in a DMZ, with public addresses behind a packet filtering router. These appliances use access control filtering software on the dedicated filtering appliance. The device monitors every packet of traffic that passes over a network.

237
Q

Which of the following is the most likely reason to place a proxy server in parallel with IP routers?
A. To allow for better content caching
B. To prevent direct access to the Internet
C. To allow for network load balancing
D. To prevent unauthorized transfer of data

A

C.
In some proxy server designs, the proxy server is placed in parallel with IP routers. This design allows for network load balancing by forwarding of all HTTP and
FTP traffic through the proxy server and all other IP traffic through the router.

238
Q

Which of the following are most likely placements of a network protocol analyzer? (Select all correct answers.)
A. Inline
B. On the outside of the DMZ
C. On the outside the Internet router
D. Between the devices of the traffic capture

A

A, D.
Protocol analyzers can be placed inline or in between the devices from which you want to capture the traffic. If you are analyzing SAN traffic, the analyzer can
be placed outside the direct link with the use of an optical splitter. The analyzer is placed to capture traffic between the host and the monitored device

239
Q

Which of the following is the most likely placement of a packet filtering firewall?
A. In the DMZ, between it and the internal network
B. On the internal network between servers
C. Between the Internet and the protected network
D. Securing the main perimeter

A

C.
A packet-filtering firewall is best suited for simple networks or used to protect a network that is used mainly for Internet access. The placement of a packet filtering firewall is between the Internet and the protected network. It filters all traffic entering or leaving the network.

240
Q

Which of the following is the most common unintended
consequence when deploying multiple firewalls?
A. Legitimate traffic gets blocked.
B. Increased network latency.
C. Increased attack vector.
D. Troubleshooting becomes complex.

A

B.
When deploying multiple firewalls, you might experience network latency. If you do, check the placement of the firewalls and possibly reconsider the topology to be sure you get the most out of the firewalls

241
Q

Which of the following is the most likely placement of a proxy service firewall?
A. In the DMZ, between it and the internal network
B. On the internal network between servers
C. Between the Internet and the protected network
D. Securing the main perimeter

A

A.
Proxy service firewalls allow organizations to offer services securely to Internet users. All servers hosting public services are placed in the demilitarized zone
(DMZ) with the proxy firewall between the DMZ and the internal network

242
Q

Which of the following is the most likely placement of a statefulinspection firewall?
A. In the DMZ, between it and the internal network
B. On the internal network between servers
C. Between the Internet and the protected network
D. Securing the main perimeter

A

D.
A stateful-inspection firewall is suited for main perimeter security. Stateful-inspection firewalls can thwart port scanning by closing off ports until a connection to the specific port is requested.

243
Q

Which of the following is an inherent security risk in using virtual machines?
A. The BIOS can easily be compromised.
B. The boot order can be easily changed.
C. Security measures are nonexistent.
D. The entire machine can be compromised.

A

D.
If attackers can compromise the virtual machines, they will likely have control of the entire machine. Most virtual machines run with very high privileges on
the host because a virtual machine needs access to the host’s hardware so that it can map the physical hardware into virtualized hardware.

244
Q

Which of the following would be the most effective method to protect a virtual environment hosting medical data?
A. Using segmented physical hardware for the virtual
servers
B. Using shared physical hardware with virtual machines
for testing
C. Using segmented physical hardware for each virtual
server
D. Using shared physical hardware with virtual machines
for web applications

A

A.
Segmenting virtual machines by the information they handle will keep highly sensitive data from being on the same physical hardware as virtual machines
used for testing or lower security applications. The organization should have a policy in place that states that high-security virtual machines containing vital information never share the same hardware as virtual machines for testing.

245
Q 
Which of the following are appropriate reasons to use virtualized environments? (Select all correct answers.)
A. Reduces threat risk
B. Allows isolation of applications
C. Reduces equipment costs
D. Allows environments on USB devices
A

B, C.
Virtual environments can be used to improve security by allowing unstable applications to be used in an isolated environment and providing better disaster
recovery solutions. Virtual environments are used for cost-cutting measures, too. One well-equipped server can host several virtual servers. This reduces the need for power and equipment. Forensic analysts often use virtual environments to examine environments that may contain malware or as a method of viewing the environment the same way the criminal did.

246
Q 
Which of the following controls how access to a computer’s processors and memory is shared in a virtual environment?
A. BIOS
B. Hypervisor
C. Operating system
D. Virtual machine applications
A

B.
The hypervisor controls how access to a computer’s processors and memory is shared. A hypervisor or virtual machine monitor (VMM) is a virtualization platform that provides more than one operating system to run on a host computer at the
same time.

247
Q

In which of the following ways would a forensic analyst most likely use a virtual environment? (Select all correct answers.)
A. To view the environment the same way the criminal
did
B. To load multiple cases at once
C. To image hard drives and removable media
D. To examine environments that may contain malware

A

A, D.
Forensic analysts often use virtual environments to examine environments that may contain malware or as a method of viewing the environment the same
way the criminal did.

248
Q

Which of the following is true in regard to a compromised virtual machine environment?
A. It is contained in its own environment.
B. It can provide access to the network.
C. Any threat can easily be addressed by deletion.
D. It can be replaced by a backup copy immediately

A

B.
Virtualized environments, if compromised, can provide access to not only the network, but also any virtualization infrastructure. This puts a lot of data at risk.
Security policy should address virtual environments

249
Q

Which of the following is true about virtual machine environments? (Select all correct answers.)
A. They are susceptible to the same issues as a host
operating system.
B. They do not need antivirus or malware protection.
C. They need to be patched just like host environments.
D. They are contained environments that do not need
patching.

A

A, C.
Vulnerabilities also come into play in virtual environments. For example,a few years ago, VMware’s NAT service had a buffer-overflow vulnerability that allowed remote attackers to execute malicious code by exploiting the virtual machine itself.Virtual machine environments need to be patched just like host environments and are susceptible to the same issues as a host operating system. You should be cognizant of
share files among guest and host operating systems

250
Q 
In which of the following areas should the vulnerabilities of existing virtual environments be addressed?
A. Change management policy
B. Business continuity plan
C. Organizational security policy
D. Disaster recovery plan
A

C.
Security policy should address virtual environment vulnerabilities. Any technology software without a defined business need should not be allowed on systems. This applies to all systems, including virtual environments

251
Q

Which of the following are areas where virtual environments can be used to improve security? (Select all correct answers.)
A. Scanning for malicious software
B. Reducing internal data aggregation
C. Allowing unstable applications to be isolated
D. Providing better disaster recovery solutions

A

C, D.
Hardware vendors are rapidly embracing virtualization and developing new features to simplify virtualization techniques. Virtual environments can be used to
improve security by allowing unstable applications to be used in an isolated environment and providing better disaster recovery solutions

252
Q

Which of the following is the most effective method to reduce server power consumption?
A. Replacing older servers with newer low-wattage
servers
B. Combining all physical hardware into one virtualized
server
C. Using segmented physical hardware for like-kind
virtual servers
D. Using shared physical hardware for all virtual servers

A

C.
With more emphasis being placed on going green and power becoming more expensive, virtualization offers cost benefits by decreasing the number of physical
machines required within an environment; however, the security of the VMs must be considered. Segmenting virtual machines by the information they handle will keep
highly sensitive data from being on the same physical hardware as virtual machines used for testing or lower security applications. The organization should have a policy in place that states that high-security virtual machines containing vital information never share the same hardware as virtual machines for testing.

253
Q 
On which of the following types of technology can virtual environments be run? (Select all correct answers.)
A. Servers
B. Desktops
C. USB drives
D. Routers
A

A, B, C, D.

Virtual environments are available to run on just about everything from servers and routers to USB thumb drives.

254
Q

Which of the following best describes a hypervisor?
A. Acts as an intermediary between the kernel and the OS
B. Provides multiple hardware systems to run one OS
C. Acts as an intermediary between the kernel and the
hardware
D. Provides more than one operating system to run on a
computer

A

D.
A hypervisor or virtual machine monitor (VMM) is a virtualization platform that provides more than one operating system to run on a host computer at the same
time.

255
Q 
Security concerns of virtual environments begin with which of the following?
A. The underlying hardware
B. The guest operating system
C. The host operating system
D. The virtual machine files
A

B.
The security concerns of virtual environments begin with the guest operating system. If a virtual machine is compromised, an intruder can gain control of all the
guest operating systems. In addition, because hardware is shared, most virtual machines run with very high privileges. This can allow an intruder who compromises a virtual machine to compromise the host machine, too

256
Q

Which of the following is an unintended security risk in using virtual machines?
A. The BIOS can easily be compromised.
B. Disaster recovery becomes more complex.
C. Most virtual machines run with high privileges.
D. Technology is advancing faster than security

A

C.
The security concerns of virtual environments begin with the guest operating system. If a virtual machine is compromised, an intruder can gain control of all the
guest operating systems. In addition, because hardware is shared, most virtual machines run with very high privileges. This can allow an intruder who compromises a virtual machine to compromise the host machine, too

257
Q

Which of the following is the most effective method to secure a virtualized environment?
A. Using encryption for all communication
B. Locking down the host machine as tightly as possible
C. Hosting as many virtual machines per server as
possible
D. Segmenting by the sensitivity of the contained
information

A

D.
To secure a virtualized environment, machines should be segmented by the sensitivity of the information they contain. A policy should be in place that specifies
that hardware is not shared for test environments and sensitive data.

258
Q 
Google Apps are examples of which of the following?
A. SaaS
B.  IaaS
C. PaaS
D. DaaS
A

C.
Platform-as-a-Service (PaaS) is the delivery of a computing platform, often an operating system with associated services, that is delivered over the Internet
without downloads or installation.

259
Q 
Which of the following creates an on-demand licensing environment without the up-front costs and maintenance associated with traditional software purchases?
A. SaaS
B. IaaS
C. PaaS
D. DaaS
A

A.
Software-as-a-Service (SaaS) is the delivery of a licensed application to customers over the Internet for use as a service on demand. Answer B is incorrect
because Infrastructure-as-a-Service (IaaS) is the delivery of computer infrastructure in a hosted service model over the Internet.

261
Q 
Which of the following implementations typically have Internet connectivity, computer networking, grid computing, and hardware virtualization?
A. SaaS
B. IaaS
C. PaaS
D. DaaS
A

B.
Infrastructure-as-a-Service (IaaS) is the delivery of computer infrastructure in a hosted service model over the Internet. This method of cloud computing
allows the client to literally outsource everything that would normally be in a typical IT department

262
Q 
Which of the following methods of cloud computing allows the client to literally outsource everything that would normally be in a typical IT department?
A. SaaS
B. IaaS
C. PaaS
D. DaaS
A

B.
Infrastructure-as-a-Service (IaaS) is the delivery of computer infrastructure in a hosted service model over the Internet. This method of cloud computing
allows the client to literally outsource everything that would normally be in a typical IT department.

263
Q 
Which of the following are the most commonly used cryptographic protocols for managing secure communication between a client and server over the Web? (Select all correct answers.)
A.SSL
B.TLS
C.PPTP
D.WEP
A

A, B
Both essentially serve the same purpose
with TLS being the successor to SSL.

264
Q 
An organization wants to use an encapsulated tunneling protocol that does not send authentication information in cleartext to  support the creation of VPNs. Which of the following meets this requirement?
A. HTTP
B. PPTP
C. MIME
D. L2TP
A

D.
Layer 2 Tunneling Protocol (L2TP) is an encapsulated tunneling protocol often used to support the creation of virtual private networks (VPNs).

265
Q 
An organization wants to use a network protocol that enables the secure transfer of data from a remote client to a private enterprise server. Which of the following meets this requirement?
A. HTTP
B. PPTP
C. MIME
D. L2TP
A

B.
Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables the secure transfer of data from a remote client to a private enterprise server by creating a virtual private network (VPN) across TCP/IP-based data networks.

266
Q 
Which of the following supports on-demand, multiprotocol, and virtual private networking over public networks?
A.HTTP
B.PPTP
C.MIME
D.L2TP
A

B.
Point Tunneling Protocol (PPTP) is a network protocol that enables the secure transfer of data from a remote client to a private enterprise server by creating
a virtual private network (VPN) across TCP/IP-based data networks.

267
Q 
Which of the following cryptographic methods is used by SSH?
A.RSA
B.ECC
C.OTP
D.PGP
A 
A.
 Secure Shell (SSH) utilizes the asymmetric (public key) Rivest, Shamir,Adleman (RSA) cryptography method to provide both connection and authentication.
268
Q

Which of the following algorithms can SSH use for data
encryption? (Select all correct answers.)
A. IDEA
B. Blowfish
C. DES
D. Diffie-Hellman

A

A, B, C.
Data encryption with SSH is accomplished using one of the following algorithms: International Data Encryption Algorithm (IDEA), Blowfish, or Data Encryption Standard (DES).

269
Q 
Which of the following secure utilities are encapsulated in the SSH suite? (Select all correct answers.)
A. slogin
B. rlogin
C. rsh
D. scp
A

A, D.
Secure Shell (SSH) provides an authenticated and encrypted data stream, as opposed to the cleartext communications of a Telnet session. The SSH
suite encapsulates three secure utilities: slogin, ssh, and scp.

270
Q 
Which of the following protocols does IPsec use to provide authentication services, as well as encapsulation of data?
A.HTTP
B.PPTP
C. IKE
D.PKI
A

C.
IPsec provides authentication services, as well as encapsulation of data through support of the Internet Key Exchange (IKE) protocol

271
Q 
An organization wants to use a protocol that has connectionless integrity and data origin authentication for IP packets. Which of the following meets this requirement?
A. IKE
B.SSH
C. IP
D.AH
A 
D. 
Authentication Header (AH) provides connectionless integrity and data origin authentication for IP packets
272
Q 
If IPsec is configured to use AH only, which of the following  protocol traffic must be permitted to pass through the firewall?
A. Protocol 255
B. Protocol 51
C. Protocol 50
D. Protocol 2
A

B.
If IPsec is configured to do authentication header only (AH), you must permit protocol 51 traffic to pass through the stateful firewall or packet filter.

273
Q 
If IPsec is configured to use ESP only, which of the following  protocol traffic must be permitted to pass through the firewall?
A. Protocol 255
B. Protocol 51
C. Protocol 50
D. Protocol 2
A

C.
Encapsulating Security Payload (ESP) provides encryption and limited traffic flow confidentiality, or connectionless integrity, data origin authentication, and
an anti-replay service. In an IP header, ESP can be identified as IP protocol number 50

274
Q 
If IPsec is configured for nested AH and ESP, IP can be configured to let only which of the following protocol’s traffic to pass through the firewall?
A. Protocol 255
B. Protocol 51
C. Protocol 50
D. Protocol 2
A

B.
If IPsec uses nested Authentication Header (AH) and Encapsulating Security Payload (ESP), IP can be configured to let only protocol 51 (AH) traffic pass
through the stateful firewall or packet filter.

275
Q 
Which of the following encryption schemes does S/MIME use?
A.RSA
B.ECC
C.OTP
D.PGP
A

A.
S/MIME utilizes the Rivest, Shamir, Adleman (RSA) asymmetric encryption scheme to encrypt electronic mail transmissions over public networks

276
Q 
Which of the following protocols was developed to support  connectivity for banking transactions and other secure web  communications, but is not commonly used?
A.HTTP
B.PPTP
C.S-HTTP
D.S/MIME
A

C.
An alternative to HTTPS is the Secure Hypertext Transport Protocol (SHTTP),which was developed to support connectivity for banking transactions and
other secure web communications

277
Q 
Which of the following is a specification that provides email  privacy using encryption and authentication via digital signatures?
A.HTTP
B.PPTP
C.S-HTTP
D.S/MIME
A

D.
S/MIME utilizes the Rivest, Shamir, Adleman (RSA) asymmetric encryption scheme to encrypt electronic mail transmissions and provides email privacy using
encryption and authentication via digital signatures s.

278
Q 
Which of the following encrypts and decrypts email messages using asymmetric encryptions schemes such as RSA?
A.S/MIME
B.PGP/MIME
C.HTTP
D.PPTP
A

B.
PGP/MIME derives from the Pretty Good Privacy application and is an alternative to S/MIME. Basically, it encrypts and decrypts email messages using asymmetric
encryptions schemes such as RSA.

279
Q 
Which of the following TLS protocols allows the client and server to authenticate to one another?
A. Record protocol
B. Alert protocol
C. Application protocol
D. Handshake protocol
A

D.
Transport Layer Security (TLS) consist of two additional protocols: the TLS record protocol and the TLS handshake protocol. The handshake protocol allows
the client and server to authenticate to one another and the record protocol provides connection security

280
Q 
Which of the following TLS protocols provides connection security?
A. Record protocol
B. Alert protocol
C. Application protocol
D. Handshake protocol
A

A.
Transport Layer Security (TLS) consist of two additional protocols: the TLS record protocol and the TLS handshake protocol. The handshake protocol allows
the client and server to authenticate to one another and the record protocol provides connection security

281
Q 
An organization is concerned about web-based connections and wants to implement encryption and authentication. Which of the following ports will the organization typically use for secured  communication?
A.8080
B.80
C.443
D.445
A

C.

Hypertext Transfer Protocol Secure (HTTPS) traffic typically occurs over port 443.

282
Q 
An organization is concerned about the cleartext communications of a Telnet session. Which of the following will the organization implement to authenticate and encrypt the data stream?
A.SSL
B.TLS
C.WEP
D.SSH
A 
D. 
Secure Shell (SSH) provides an authenticated and encrypted data stream, as opposed to the cleartext communications of a Telnet session
283
Q 
Which of the following protocols supports DES, 3DES, RC2, and RSA2 encryption, along with CHAP authentication but was not widely adopted?
A.S/MIME
B.HTTP
C.PPTP
D.S-HTTP
A

D.
An alternative to HTTPS is the Secure Hypertext Transport Protocol (S-HTTP), which was developed to support connectivity for banking transactions and other secure web communications

284
Q 
Which of the following is a program that uses SSH to transfer files?
A.SFTP
B.S/MIME
C.HTTPS
D.S-HTTP
A

A.
SFTP, or secure FTP, is a program that uses SSH to transfer files. Unlike standard FTP, it encrypts both commands and data, preventing passwords and
sensitive information from being transmitted in the clear over the network

285
Q 
Which of the following is a network protocol that combines RCP and SSH but also supports file transfers?
A.SFTP
B.SCP
C.HTTPS
D. FTPS
A

B.
The Secure Copy Protocol (SCP) is a network protocol that supports file transfers. SCP is a combination of RCP and SSH. It uses the BSD RCP protocol tunneled
through the Secure Shell (SSH) protocol to provide encryption and authentication.

286
Q 
There are reports that the FTP ports that are required for contract worker functionality are inaccessible. Which of the following ports would you check?
A.137/138/139
B.161/162
C.20/21
D.25/110/143
A

C

287
Q 
Several organizational users are experiencing network and Internet connectivity issues. Which of the following protocols would be used for troubleshooting the connectivity problems?
A. SSL
B. ICMP
C. IPsec
D.SNMP
A

B.

Traceroute uses an ICMP echo request packet to find the path between two addresses.

288
Q 
Which of the following services/protocols operate on Port 22?
A.DNS
B.SCP
C.HTTPS
D.SMB
A

B

289
Q 
Which of the following services/protocols operate on Port 443?
A.DNS
B.SCP
C.HTTPS
D.SMB
A

C

290
Q 
Which of the following services/protocols operate on Port 53?
A.DNS
B.SCP
C.HTTPS
D.SMB
A

A

291
Q 
Which of the following services/protocols operate on Port 445?
A.DNS
B.SCP
C.HTTPS
D.SMB
A

D

292
Q 
Which of the following services/protocols operate on Port 23?
A.SMTP
B.TFTP
C.Telnet
D.POP3
A

C

293
Q 
Which of the following services/protocols operate on Port 110?
A.SMTP
B.TFTP
C.Telnet
D.POP3
A

D

294
Q 
Which of the following ports will need to be opened to allow SMTP traffic?
A.22
B.21
C.25
D.23
A

C

295
Q 
Which of the following ports will need to be blocked to filter SNMP traffic? (Select two answers.)
A.161
B.1812
C.443
D.162
A

A,D

296
Q 
Which of the following services/protocols operate on Port 1812?
A. NetBios
B. RADIUS
C. Portmap
D. HTTPS
A

B

297
Q 
Which of the following ports will need to be opened to allow HTTP and HTTPS traffic? (Select two answers.)
A.110
B.80
C.443
D.25
A

B,C

298
Q 
Which of the following services/protocols operate on Port 990?
A. FTPS
B.SCP
C.HTTPS
D.SMB
A

A

299
Q 
Which of the following services/protocols operate on Port 15?
A.NetBios
B.Portmap
C.Telnet
D.Netstat
A

D

300
Q 
Which of the following ports will need to be opened to allow incoming and outgoing email traffic? (Select two answers.)
❍  A.443
❍  B.110
❍  C.23
❍  D.25
A

B,D

301
Q 
Which of the following services/protocols operate on Port 137?
A. NetBios
B. Portmap
C. Telnet
D. Netstat
A

A

302
Q 
Which of the following services/protocols operate on Port 111?
A.NetBios
B.Portmap
C.Telnet
D.Netstat
A

B

303
Q 
Which of the following ports will need to be blocked to filter NetBios traffic? (Select three answers.)
A.137
B.445
C.138
D.139
A

A, C, D

304
Q 
Which of the following services/protocols operate on Port 22? (Select three answers.)
A.SSH
B.SCP
C.SFTP
D.TFTP
A

A, B, C

305
Q 
Which of the following services/protocols operate on Port 69?
A.FTP
B.TFTP
C.SFTP
D.SSL
A

B

306
Q 
Which of the following services/protocols operate on Port 21?
A.SFTP
B.SSL
C. FTP
D.TFTP
A

C

307
Q 
Which standard port will be used to establish a web connection using the 40-bit RC4 encryption protocol?
A.110
B.445
C.138
D.443
A

D

A connection using the HTTP protocol over SSL (HTTPS) will be made using the RC4 cipher and will be made using port 443

308
Q 
Which of the following encryption standards currently is the most secure for Wi-Fi connections?
A.WAP
B.WPA2
C.WEP2
D.WEP
A

B

309
Q

When a client attempts to make an 802.1x-compliant connection, which of the following best describes how the AP authenticates the client?
A. Users provide a shared password.
B. Through hardware token authentication.
C. Through a basic challenge-response method.
D. Users provide an identifier along with a password.

A

C
When a client attempts to make an 802.1x-compliant connection, the client attempts to contact a wireless access point (AP). The AP authenticates the client
through a basic challenge-response method, and then provides connectivity to a wired network or serves as a bridge to a secondary wireless AP.

310
Q 
Using the Temporal Key Integrity Protocol (TKIP) or Wi-Fi Protected Access (WPA/WPA2) standards would be most useful in preventing which of the following attacks?
A. Weak encryption
B. Data emanation
C. Bluejacking
D. War-driving
A

A

311
Q

Which of the following is the most basic form of encryption that can be used on 802.11-based wireless networks to provide privacy of data sent between a wireless client and its access point?
A. Wireless Application Environment (WAE)
B. Wireless Session Layer (WSL)
C. Wireless Transport Layer Security (WTLS)
D. Wired Equivalent Privacy (WEP)

A

D

312
Q 
The Wi-Fi Protected Access standards were developed by the  Wi-Fi Alliance to replace which of the following?
A.DES
B.WAP
C.AES
D.WEP
A

D

313
Q 
Which of the following are non-vendor-specific strong authentication protocols for wireless communications? (Select two.)
A.EAP
B.PEAP
C.LEAP
D.WEP
A

A,C

314
Q 
Which of the following reduces vulnerability to replay attacks through 128-bit keys and a 48-bit initialization vector (IV)?
A.WEP
 B. ICMP
C.WPA
D.CCMP
A

D

315
Q 
Which of the following combines centralized two-way authentication with dynamically generated wireless equivalent privacy keys or WEP keys?
A.EAP
B.PEAP
C.LEAP
D.WEP
A

C

316
Q 
Which of the following can be used to mitigate the security risk on an antenna that is too strong?
A. Antenna placement
B. Power level controls
C. SSID broadcast
D. MAC filtering
A

B

317
Q 
Which of the following is a wireless security measure that permits and denies network access through the use of blacklists and whitelists?
A. Antenna placement
B. Power level controls
C. SSID broadcast
D. MAC filtering
A

D

318
Q 
Which of the following are ways to mitigate the vulnerabilities of wireless networks? (Select all correct answers.)
A. Requiring WPA2 encryption
B. Turning off SSID broadcast
C. Turning on DHCP on the WAP
D. Restricting access by MAC addresses
A

A,B,D

319
Q 
Which of the following is most closely linked to packet sniffing?
A. SSID broadcast
B. Application flaws
C. Application development
D. Automated attacks
A

A

320
Q

Which of the following best describes the result of adding a MAC address to the approved list?
A. It is considered part of the whitelist.
B. It is considered part of the blacklist.
C. It is considered part of the graylist.
D. It is considered part of the brownlist

A

A

321
Q 
You have a network on which there are mixed vendor devices and are required to implement a strong authentication solution for wireless communications. Which of the following would best meet your requirements? (Select two.)
A.PEAP
B.WEP
C.LEAP
D.EAP
A

A,D

322
Q 
Which of the following includes a packet number (PN) field and produces a message integrity code (MIC) providing data origin authentication and data integrity for the packet payload data?
A.WPA
B.WEP
C.CCMP
D. ICMP
A

C

323
Q

Which of the following is an IPv6 address?
(A) 192.168.1.100
(B) 192.168.1.100 /128
(C) FE80: 20D4: 3FF7: 003F: DE62
(D) FE80: 0000: 0000: 0000: 20D4: 3FF7: 003F: DE62

A

D
An IPv6 address uses 128-bit IP addresses and includes eight groups of four hexadecimal characters. Double colons indicate no compression so the zeros must be shown

324
Q

What are 3 common attacks against switches?

A

Mac Flooding
ARP poisoning
Spanning Tree attacks

325
Q

What is a Mac flooding attack?

A

Involves sending a switch lots of Ethernet frames with different source MAC addresses. The switch caches the MAC addresses against the port they arrive on. If too many are sent the cache is overloaded. This forces the switch to broadcast to all the ports, thus acting like a hub. This allows hackers to sniff out ALL the ports using dsniff or ettercap.

326
Q

What is ARP poisoning?

A

The attacker enters false MAC-IP address mapping into the switch’s Address Resolution Protocol table. This false mapping sets up the attacker as the subnets default gateway and all traffic is sent to him. This allows them to receive and send data masquerading as an authorized user.

327
Q

What is Spanning Tree attacks?

A

A form of DoS attacks that target the Spanning Tree Protocol (STP). The STP prevents looped broadcast traffic between switches. The attack mimics the root bridge and the traffic storms may crash the network.

328
Q

What can you do to secure a switch against attacks?

A
  1. configure port security - restrict the number of MAC address and configure authentication at the port level.
    disable unused ports - place unused ports in a vLAN that is not allowed to connect to the network.
  2. keep the switch updated - firmware updates
  3. mitigate spanning tree attacks - enable features to prevent attacks, such as Loop Guard, Root Guard and portfast. Use IEEE 802.iD protocol
  4. Secure the management console - use ACL to restrict hoses.
329
Q

What is the difference of a Switch and a router?

A

Switches divide a network into different collision domains.

Routers divide networks into subnets.They connect switches to one another and to the internet.

330
Q

What OSI layer does a router work at?

A

Layer 3 - network layer.
They provide complex signaling and packet translations and allow for some security filtering such the blocking of specific ports, broadcast traffic, and traffic without a correct network address.

331
Q

What OSI model layer doe the switch work at?

A

Layer 2 - Data link
Used to divide a network into separate segments (logically-VLAN or physically). Each port is a separate collision domain.

332
Q

How does a switch limit the network traffic within each segment?

A

It checks the destination of the received traffic against the media access control or MAC address table residing in the switch. It then forwards the traffic to the specific port for that address.

333
Q

What is the primary difference between a switch and a hub?

A

A hub broadcasts the message to ALL ports while a switch uses the MAC address table to determine which port to send the message(P2P).

334
Q

How do you implement Switch separation/Isolation?

A

Physical - Use separate switches with it own routers that do not connect.
Logical (VLAN) on switches using routers.

335
Q

What protocol do you use to prevent looping of packets on a switch?

A

Spanning Tree Protocol (STP).

336
Q

What switch IEEE MAC bridges standard was designed to allow for looping for redundancy but prevents packets from being looped?

A

802.1D and the most common protocol that is based on this is STP

337
Q

How do routers optimize data transmission?

A

monitor active paths between source and destination networks and select the best routes for information in response to traffic loads and line speeds.

338
Q

What protocols do dynamic routers use to communicate with each other?

A

Open Shortest Path First (OSPF)
Routing Information Protocol (RIP)
Border Gateway Protocol (BGP)

339
Q

What secure protocols should be used for router communication?

A

SSH
HTTPS
SCP

340
Q

How do you make a router a packet filtering firewall?

A

By using ACL traffic is allow/disallowed based on IP and port number, source and destination.

341
Q

What are the private IP ranges?

A
  1. 0.0.1 - 10.255.255.254
  2. 16.0.1 - 172.31.255.254
  3. 168.0.1 - 192.168.255.254
342
Q

What is Trunking?

A

When 2 computers are on the same VLAN but are on different physical switches (different buildings). They can still talk to each other without having to be routed.

343
Q

How does trunking work if you are on the same switch but different VLANs?

A

The request is sent out the switch to the trunking router to check the ACL. If it passes then it goes back to the switch to the destination port.

344
Q

What devices can NAT be used?

A

On border devices:

Firewalls and proxy servers

345
Q

How does NATP work (Port Address Translation)?

A

maps multiple private IPs to a single public IP using different ports

346
Q

What is Dynamic NAT

A

Uses a pool of public IPs and binds a private IP to one of the IPs in the public pool. The address translation is held until the connection ends. This is limited to the number of public IPs in the pool.

347
Q

What is port forwarding?

A

Also known as Destination NAT. It is when inbound traffic is requesting a resource by its public IP and port which is translated to the private IP. Ex a user requesting a web page requests the public IP for the web server and the NAT will translate it to the internal private IP for the web server.

348
Q

How does NAT work?

A
  1. maps a public IP on inbound traffic to an internal IP (Destination NAT)
  2. maps multiple internal IP to a single public IP via port mapping (Source NAT)
  3. maps internal IP addresses to a public address for internal requests made by internal users (Source NAT)

Security + SY0-301 (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions