Review 6 Flashcards
week 22
A firewall can use NAT and packet filters.
True—Firewalls can use packet filtering, NAT filtering, application level gateways, and circuit level gateways.
NAT filtering accepts or rejects packets based on rules.
False—NAT filtering filters traffic according to ports such as TCP or UDP. A firewall that incorporates packet filtering inspects each packet passing through the firewall and accepts or rejects it based on rules.
A stateless packet filter is vulnerable to IP spoofing attacks.
True—Stateless packet filters are vulnerable to IP spoofing attacks. Firewalls running stateful packet inspection are not vulnerable because they keep track of the state of network connections.
Circuit level gateways work at the Session Layer of the OSI model.
True—Circuit level gateways do work at the Session Layer of the OSI model and apply security mechanisms whenever TCP or UDP connections are established.
NAT filtering matches incoming traffic to corresponding outbound IP connections by matching the IP address and port.
True—NAT filtering matches incoming and outgoing traffic by way of IP addresses and port numbers.
An IP proxy serves client requests by caching HTTP information.
False—IP proxies secure networks by keeping the machines behind it anonymous. Caching proxies serve client requests such as caching hypertext information among other types of information.
An IP proxy can be the victim of denial-of-service attacks.
True—IP proxies can indeed be the victim of denial-of-service attacks and should be monitored periodically and updated regularly.
A honeypot is a device that caches information for hackers.
False—Honeypots are usually single computers that are used to attract and trap potential attackers. Normally, you would not cache information for a hacker, but you would cache information for legitimate users by way of a caching proxy.
Honeynets are one or more computers or servers used to counteract attempts at unauthorized access to a network.
True—A honeynet is one or more computers, servers, or an area of a network; these are used when a single honeypot is not sufficient to trap potential attackers.
A NIDS can inspect traffic and possibly remove, detain, or redirect malicious traffic.
False—A NIDS attempts to detect malicious network activities by monitoring network traffic and alerts the administrator in the case that it finds any. A NIPS can inspect traffic and remove, detain, or redirect that traffic.
Where would a NIDS sit on a network? (Select the best answer.) A. Inline B. On the extranet C. On the DMZ D. Back to back
A. A NIDS normally sits inline on the network. It could be before or after the firewall but more commonly is on the side closer to the Internet. Although it is possible to put a NIDS on the extranet or on a DMZ, it is far less common. Back to back is a phrase used when an organization implements to firewalls.
What are Snort and Bro examples of? A. Firewalls B. Proxy servers C. IDS D. SPI
C. Snort and Bro are examples of IDS.
Which of the following are examples of protocol analyzers? (Select the two best answers.) A. Wireshark B. HTTP proxy C. NAT filter D. Network Monitor
A and D. Wireshark and Network Monitor are examples of protocol analyzers. HTTP proxies cache information for client computers. NAT filtering is a type of filtering that firewalls can accomplish if configured.
James has detected an intrusion in his company. What should he check first? A. DNS logs B. Firewall logs C. Event Viewer D. Performance logs
B. If there were an intrusion, the first thing you should check are the firewall logs. DNS logs in the event viewer and the performance logs will most likely not show intrusions to the company. The best place to look first is the firewall logs.
Which of the following can detect malicious packets and discard them? A. Proxy server B. NIDS C. NIPS D. PAT
C. NIPS, or a network intrusion prevention system, can detect and discard
malicious packets. A NIDS only detects them and alerts the administrator. A proxy server acts as a go-between for clients sending data to systems on the Internet. PAT is a port-based address translation.
