Perimeter Defense Flashcards
Which of these is true regarding router ACL creation?
a. All deny rules should precede all permit rules. b. All permit rules should precede all deny rules. c. Rule ordering is irrelevant. d. Rules are tested in order from top to bottom.
d. Rules are tested in order from top to bottom.
Which of these best expresses the “Principle of Least Privilege”?
a. Deny/disable all but what is required to complete the mission. b. Apply multiple layers—by type and within type—security controls. c. Never rely upon “security through obscurity”. d. Ensure any security control is developed with open/public scrutiny.
a. Deny/disable all but what is required to complete the mission.
The “Principle of Least Privilege” (POLP for short) is also directly related to two other expressions you heard your instructor mention (and common to the security community); what are they?
- ___________________
Hint: it’s a personnel security issue - ___________________
Hint: what is the over-all purpose for pursuing POLP whenever/wherever possible?
- Need-to-Know
2. Reduce Target Surface
What is this: You should have blocked (filtered) something bad but you did not.
a. True-positive b. True-negative c. False-positive d. False-negative
d. False-negative
did correctly = true, should have (but didn’t) = false
What is the semantic meaning of the ACL TCP rule pro-word established ?
a. Causes rule to check that the TCP Syn flag is set.
b. Causes the router to ignore packets until the 3-way handshake is completed.
c. Causes rule to check that the TCP Ack flag is set.
d. Causes router to verify that there is matching (socket-pair) traffic in opposite direction.
c. Causes rule to check that the TCP Ack flag is set.
Generally, the structure of an individual ACL rule follows…
a. permit or deny followed by “socket-pair” formatted information.
b. no particular order or format whatsoever.
c. permit or deny followed by port information followed by IP address information.
d. a target protocol followed by a “bad” field/value whose existence (or not) in a packet
will determine if it gets denied or permitted.
a. permit or deny followed by “socket-pair” formatted information.
When an ACL involves both permit and deny rules, the general/typical approach is to…
a. list denies, then permits, then deny all b. list permits, then denies, then deny all c. list denies, then permits, then permit all d. list permits, then denies, then permit all
a. list denies, then permits, then deny all
Which ACL rule would permit traffic from a DNS client to the DNS server with IP address 1.2.3.4?
a. permit udp any gt 1023 host 1.2.3.4 eq 53 b. permit tcp host 1.2.3.4 any eq 53 any c. permit udp host 1.2.3.4 eq 53 any gt 1023 d. permit dns any gt 1023 1.2.3.4 eq 53
a. permit udp any gt 1023 host 1.2.3.4 eq 53
Two criteria were given regarding what should be filtered (blocked); which of these best expresses those two?
a. Known malicious traffic -AND- unencrypted traffic.
b. Non-protocol-compliant traffic -AND- suspicious traffic.
c. Known malicious traffic -AND- traffic for services that aren’t supported/offered.
d. Non-protocol-compliant traffic -AND- un-authenticated traffic.
c. Known malicious traffic -AND- traffic for services that aren’t supported/offered.
Which of these represents the correct IP-spoof protection strategy for traffic arriving-to and departing-from Your Network (YN). Assume “YN” below means Your Network’s IP space?
a. Deny arriving traffic if source IP = YN, only permit departing traffic if source IP = YN
b. Deny arriving traffic if source IP = YN, deny departing traffic if source IP = YN
c. Only permit arriving traffic if destination IP = YN, only permit departing traffic if source
IP = YN
d. Only permit arriving traffic if source IP = YN, only permit departing traffic if source IP = YN
a. Deny arriving traffic if source IP = YN, only permit departing traffic if source IP = YN
Assume you host a Web server with IP = 1.2.3.4 in your DMZ. Your inbound permit rule is: permit any gt 1023 host 1.2.3.4 eq 80. What “corresponding” outbound rule should you have to support traffic FROM this Web server to clients on the Internet?
a. permit any eq 80 any eq 80-1023 established b. permit host 1.2.3.4 eq 80 any gt 1023 established c. permit host 1.2.3.4 any any gt 1023 established d. permit any gt 1023 client any eq 80 established
b. permit host 1.2.3.4 eq 80 any gt 1023 established
What is TRUE regarding cyber “defense-in-depth”, as presented in lecture?
a. It is alive and well as the term of trade for a “layered” defense that entails multiple security control types. b. Defense-in-depth (DID) has been disproven as an effective methodology with which to pursue cyber protection. c. Though DoD continues to embrace the defense-in-depth concept, most non-DoD organizations have evolved to something more sophisticated. d. Defense-in-depth is largely a joke, and you should nod along with everyone else should you ever attend a seminar where the speaker makes this joke.
a. It is alive and well as the term of trade for a “layered” defense that entails multiple security control types.
Which statement best describes a DMZ?
a. A network intended only for internal, trusted users. b. A highly protected network intended only for external users. c. A publicly accessible service network that is “moderately” protected relative to the more internal employee “private” network(s). d. A network that has no perimeter protection at all, relying instead upon the hardening of the servers in the network/zone.
c. A publicly accessible service network that is “moderately” protected relative to the more internal employee “private” network(s).
When a packet is delivered to a server, the destination port number in the packet…
a. tells the receiving computer which device driver to use. b. serves as a reliable indicator of what application layer data is in the packet. c. does not necessarily indicate what application layer data is actually in the packet. d. indicates which layer 4 protocol is carried in the IP datagram.
c. does not necessarily indicate what application layer data is actually in the packet.
Assume you want to deny any packet with Malicious item M in it. Assume you want to permit any packet with Legitimate item L in it. Assume that denial of malicious items takes precedence over the permitting of legitimate traffic. What is true of an ACL that has only these two ACL rules?
Permit L Deny M a. This could result in false-negative (aka a “false accept” error) b. This could result in a false-positive (aka a “false reject” error) c. This could result in either a false-negative OR a false-positive depending on which item (L or M) occurs first in a packet. d. This kind of overlap must be avoided when creating ACLs, or else the router/firewall may exhibit unknown results/behavior.
a. This could result in false-negative (aka a “false accept” error)
