Practice test 6 Flashcards
A client is concerned about a hacker compromising a network in order to gain access to confidential research data. What could be implemented to redirect any attackers on the network? • DMZ • Content filter • Botnet • Honeypot
Explanation
A honeypot is a computer security mechanism set to detect, deflect, or in some manner counteract attempts at unauthorized use of information systems. Generally, a honeypot consists of data that appears to be a legitimate part of the site, but is actually isolated and monitored, and seems to contain information or a resource of value to attackers, who are then blocked.
After upgrading a fiber link from 1Gbps, a network technician ran a speed test of the link. The test shows the link is not operating at full speed and connectivity is intermittent. The two buildings are 1,476ft (450m) apart and are connected using CM4 fiber and 10G SR SFPs. The fiber runs through the electrical and boiler rooms of each building. Which of the following is the MOST likely cause of the connectivity issues?
•
The wrong SFPs are being used
• There is interference from the electrical room • CM1 fiber should be used instead • There is heat from the boiler room
Explanation
The process of elimination allows us to drop out interference from the electrical room and heat from the boiler room as the heat definitely doesn’t cause connectivity issues. There’s not much information on the CM1 fiber, however, SFPs will work but will not work in a GBIC port intended for SFP+.
A network administrator is noticing slow response times from the server to hosts on the network. After adding several new hosts, the administrator realizes that CSMA/CD results in network slowness due to congestion at the server NIC. What should the network administrator do?
•
Add a honeypot to reduce traffic to the server
•
Update the Ethernet drivers to use 802.3
•
Add additional network cards to the server
•
Disable CSMA/CD on the network
Explanation
Adding dual NICs to the server can increase the bandwidth at the server and minimize congestion.
A network technician is diligent about maintaining all system servers at the most current service pack level available. After performing upgrades, users experience issues with server-based applications. Which of the following should be used to prevent issues in the future?
•
Configure an automated patching server
•
Virtualize the servers and take daily snapshots
•
Configure a honeypot for application testing
•
Configure a test lab for updates
Explanation
To prevent the service pack issues, make sure to validate them in a test/lab environment first before going ahead and applying a new Service Pack in your production environment. While using an automated patching server is a good idea, no patches should be deployed prior to being tested in a lab first.
A firewall technician configures a firewall in order to allow HTTP traffic as follows: Source IP Zone Dest IP Zone Port ActionAny Untrust Any DMZ 80 Allow The organization should upgrade to what technology to prevent unauthorized traffic from traversing the firewall? • HTTPS • Stateless packet inspection • Intrusion detection system • Application aware firewall
Explanation
Application aware firewall can analyze and verify protocols all the way up to layer 7 of the OSI reference model. It has the advantage to be aware of the details at the application layer. Since we desired to allow HTTP traffic, we must deal with the traffic at the application layer. This will prevent an attacker from sending SSH traffic over port 80, for example. By using an application aware firewall, only HTTP traffic will be allowed over port 80.
What network device uses ACLs to prevent unauthorized access into company systems? • IDS • Firewall • Content filter • Load balancer
Explanation
A firewall is a network security device which is designed to prevent systems or traffic from unauthorized access. An ACL is a list that shows which traffic or devices should be allowed into or denied from accessing the network.
A software company is meeting with a car manufacturer to finalize discussions. In the signed document, the software company will provide the latest versions of its mapping application suite for the car manufacturer’s next generation of cars. In return, the car manufacturer will provide three specific vehicle analytics to the software company to enhance the software company’s mapping application suite. The software company can offer its enhanced mapping application to other car manufacturers but must pay the car manufacturer a royalty. Which of the following BEST describes the document used in this scenario? • MSA • SLA • MOU • AUP
Explanation
MOU is a memorandum of understanding. This is the most accurate description based on the choices given.
A disgruntled employee executes a man-in-the-middle attack on the company network. Layer 2 traffic destined for the gateway is redirected to the employee’s computer. This type of attack is an example of: • ARP cache poisoning • IP spoofing • Amplified DNS attack • Evil twin
Explanation
ARP poisoning reroutes data and allows an attacker to intercept packets of data intended for another recipient. ARP attacks can be sent from any host on the local area network and the goal is to associate the host so that any traffic meant for something else will instead go directly to the attacker’s PC.
Which storage network technology utilizes file-level storage to function properly? • iSCSI • FCoE • NAS • SAN
Explanation
A NAS uses file-level storage, while the others all use block-level storage. Block-level storage is a type of storage commonly deployed by larger businesses and enterprises in storage area networks (SANs) and similar large-scale storage systems. Each block in a block-level storage system can be controlled as an individual hard drive, and the blocks are managed by a server operating system. Block-level storage protocols like iSCSI, Fibre Channel and FCoE (Fibre Channel over Ethernet) are utilized to make the storage blocks visible and accessible by the server-based operating system.
A network technician is selecting the best way to protect a branch office from as many different threats from the Internet as possible using a single device. Which of the following should meet these requirements? • Configure a network-based firewall • Configure a firewall with UTM • Configure a host-based firewall • Configure a host-based intrusion detection system
Explanation
Since this is a branch office and you want to protect yourself from as many threats as possible, using a Unified Threat Management firewall would be best. It will protect you from the most things using a single device. A network-based firewall protects everything on the other side of the Internet (your network). Host-based firewalls are great too but the network-based firewall is configured once to protect all devices.
Today, your company's network started to experience network connectivity issues for various workstations around the company. As you begin troubleshooting, you identify that all the workstations receive their connectivity from a single switch on the 3rd floor of the office building. You start searching the 3rd floor for the cause of this issue and find a small wired router plugged into a network jack in the office of the Sales manager. From this small wired router, he has connected his workstation and a small Smart TV so he can watch Netflix while working. You ask the sales manager when he brought in the new router and he says he just hooked it up this morning. What type of issue did the sales manager accidentally introduced into the network by installing the router? • Evil twin • VLAN mismatch • Network loop • Rogue DHCP server
Explanation
Routers usually contain their own DHCP servers. When the sales manager installed the wired router, he inadvertently introduced a secondary DHCP server into the network. This could cause the same IP addresses to be assigned to two different workstations, resulting in connectivity issues for those workstations. Had the sales manager installed a simple hub or switch, this would not have caused any issues. Because this is a wired router, it cannot be an evil twin since evil twins are wireless access points. Also, we have no indication of a VLAN mismatch, since this would only affect the workstations connected to this router. Similarly, we have no indication of a network loop, so this network might already be implementing good practices by utilizing a STP to prevent them.
Your company has just installed a brand new email server, but during the initial tests you determined that the server is unable to send emails to another server. You decided to check the firewall's ACL to see if the server's outgoing email is being blocked. Which of the following ports should you ensure is open and not blocked by the firewall? • 143 • 995 • 25 • 110
Explanation
Port 25 is the designated port for the Simple Mail Transfer Protocol. SMTP is used for outbound email, including mail relay functionality.
The network install is failing redundancy testing at the MDF. The traffic being transported is a mixture of multicast and unicast signals. Which of the following devices would BEST handle the rerouting caused by the disruption of service? • Layer 3 switch • Proxy server • Layer 2 switch • Smart hub
Explanation
A layer 3 switch is the best option because in addition to its capability of broadcast traffic reduction, it provides fault isolation and simplified security management. This is achieved through the use of IP address information to make routing decisions when managing traffic between LANs.
During a business trip, Bobby connects to the wireless network at the hotel to send emails to some of his clients. The next day, Bobby notices that additional emails have been sent out from his account without consent. Which of the following protocols was MOST likely used to compromise the Bobby's email password utilizing a network sniffer? • SSL • HTTP • TFTP • DNS
Explanation
HTTP is an unsecured protocol and information is passed without encryption. If the user signed into their webmail over HTTP instead of HTTPS, a network sniffer could compromise the username and password. Additionally, if the user was using an email client, then the SMTP connection could have been compromised, but since that wasn’t an option in this question, we must assume Bobby used a webmail client over HTTP instead.
A desktop computer is connected to the network and receives an APIPA address but is unable to reach the VLAN gateway of 10.10.100.254. Other PCs in the VLAN subnet are able to reach the Internet. What is the MOST likely source of the problem? • 802.1q is configured on the switch port • APIPA has been misconfigured on the VLAN • Bad SFP in the PC's 10/100 NIC • OS updates have not been installed
Explanation
APIPA addresses are self-configured and are used when the client is unable to get proper IP configuration from a DHCP server. One possible source of this problem is a misconfigured switch port that the computer is connected to. The 802.1q protocol is used to configure VLAN trunking and should be configured on the trunk port, not the on switch port.
A technician is troubleshooting a desktop connectivity issue. The technician believes a static ARP may be causing the problem. What should the technician do NEXT according to the network troubleshooting methodology?
•
Remove the ARP entry on the user’s desktop
•
Identify a suitable time to resolve the issue on the affected desktop
•
Duplicate the issue in a lab by removing the ARP entry
•
Document the findings and provide a plan of action
Explanation
Based on the troubleshooting methodology, once you have come up with a probable cause (the static ARP entry), you should try to test your hypothesis. Since this issue has already cause the workstation to not be able to communicate, the best way to test your theory would be to remove the static ARP entry and see if the issue is resolved. If this doesn’t fix the issue, you would need to then come up with a new hypothesis, and test it as well.
Your company just moved into a beautiful new building. The building has been built with large glass windows that cover most of the walls and ceiling to provide natural light to be visible throughout the offices. You have noticed that your cell phone gets really poor cellular connectivity when inside the building. What is the MOST likely cause of the poor cellular service within the building? • Frequency mismatch • Channel overlap • Absorption • Reflection
Explanation
A cellular signal is comprised of radio waves. Just like light, radio waves can bounce off of certain surfaces and materials. Metal and glass are considered highly reflective materials which can cause poor cellular service and connectivity within office buildings that use intricately designed glass walls and ceilings. If a large amount of reflection occurs, signals can be weakened and also cause interference at the receiver’s device.
When a switch has multiple paths to reach the root bridge, what state is the port with the LEAST desirable path placed by the spanning tree protocol? • Forwarding • Bonding • Blocking • Listening
Explanation
Blocking is the state in the spanning tree protocol that prevents looping in the network.
Users are reporting extreme slowness across the network every Friday. What should the network technician review first to narrow down the root cause of the problem? • Baseline • Bottleneck • Utilization • Link status
Explanation
Reviewing the network utilization can help the technician identify why the slowness is being experienced every Friday, such as users placing additional load on the network by streaming videos or something similar.
Last night, your company's system administrators conducted a server upgrade. This morning, several users are having issues accessing the company's share drive on the network. You have been asked to troubleshoot the problem. What document should you look at first to create a probable theory for the cause of the issue? • Change management documentation • Release notes for the server software • Physical network diagram • Cable management plan
Explanation
Since everything worked before the server upgrade and doesn’t now, it would be a good idea to first look at the change management documentation that authorized the change/upgrade. This should include the specific details of what was changed and what things may have been affected by the change. This is the best place to start when determining what changed since yesterday.
Dion Training Solutions is launching their brand new website. The website needs to be continually accessible to our students and reachable 24x7. Which networking concept would BEST ensure that the website remains up at all times? • Snapshots • Warm site • Cold site • High availability
Explanation
High availability is a concept that uses redundant technologies and processes to ensure that a system is up and accessible to the end users at all times. Snapshots, warm sites, and cold sites may be useful for recovering from a disaster-type event, but they will not ensure high availability.
Which of the following concepts is the MOST important for a company's long-term health in the event of a disaster? • Vulnerability scanning • Implementing acceptable use policy • Offsite backups • Uninterruptible power supplies
Explanation
In case of a disaster, you must protect your data. Some of the most common strategies for data protection include backups made to tape and sent off site at regular intervals. All of the other options are good, too, but the MOST important is a good backup copy of your company’s data.
You work for a small company that wants to add a share drive to their network. They are looking for a simple solution that will easily integrate into the existing network, will be easy to configure, and can share files with all the network clients over TCP/IP. Which of the following is the BEST recommended storage solution for this network? • Fibre Channel • NAS • iSCSI • FCOE
Explanation
A network-attached storage (NAS) device is a self-contained computer that connects to a home or business network and can share files over TCP/IP. It is a rapidly growing choice for data storage and can provide data access to numerous users on a network. A NAS consists of hard disk for storage of files and usually utilizes a RAID system for redundancy and/or performance.
After an employee connected one of the switch ports on a SOHO router to the wall jack in the office, other employees in the building started losing network connectivity. Which of the following could be implemented on the company’s switch to prevent this type of loss of connection? • Loop prevention • ARP inspections • DHCP snooping • MAC address filtering
Explanation
It appears the connection of the SOHO router to the company network has caused a loop in the network, causing the loss of connectivity to other users. If the company network implements a loop prevention mechanism, such as Spanning Tree Protocol (STP), this will prevent a loop from occurring.
During a recent penetration test, it was discovered that your company's wireless network can be reached from the parking lot. The Chief Security Officer has submitted a change request to your network engineering team to solve this issue because he wants to ensure that the wireless network is only accessible from within the building. Based on these requirements, which of the following settings should be changed to ensure the wireless signal doesn't extend beyond the interior of your building while maintaining a high level of availability to your users? • Power level • Channel • Frequency • Encryption
Explanation
The power level should be reduced for the radio transmitted in the wireless access points. With a reduced power level, the signal will not travel as far and this can ensure the signal remains within the interior of the building only. The other options, if changed, would affect the availability of the network to the currently configured users and their devices.
A technician wants to implement a network for testing remote devices before allowing them to connect to the corporate network. What could the technician implement to meet this requirement? • High availability • MAN network • Quarantine • Honeynet
Explanation
Quarantine is where devices that do not meet the standards for the regular network can be placed. In this area, they can be checked before connecting to the main network.
Company policies require that all network infrastructure devices send system level information to a centralized server. Which of the following should be implemented to ensure the network administrator can review device error information from one central location? • TACACS+ server • Single sign-on • Syslog server • Wifi analyzer
Syslog is a protocol designed to send log entries generated by a device or process called a facility across an IP network to a message collector, called a syslog server. A syslog message consists of an error code and the severity of the error. A syslog server would enable the network administrator to view device error information from a central location.
