Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Networking > SANS 503 > Flashcards

SANS 503 Flashcards

1
Q

What port would you see in a tcpdump capture indicating the machine was
running CIFS?

A

445

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is NBT?

A

NETBIOS over TCP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How do NetBIOS hosts discover other NetBIOS hosts when no domain is present?

A

Sending broadcasts over the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the SMB/CIFS protocol used for?

A

Access shared resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How will a Windows client resolve a NetBIOS name when no central naming
service is used?

A

Broadcast a NetBIOS name query using UDP port 137.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

MSRPC over SMB Session Setup

A 
Negotiate Protocol Request
Negotiate Protocol Response
Session Setup Request
Session Setup Response
Tree Connect Request
Tree Connect Response
Bind request
Bind response
LsarOpenPolicy request
LsarOpenPolicy response
LsarQueryInformationPolicy request
LsarQueryInformationPolicy response
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

MSRPC over TCP (DCOM)

A 
Connect EPM request   (Port 135)
EPM response
Connect high port from response
DCERPC bind request
DCERPC bind response
DRSUAPI DSbind request
DRSUAPI DSbind response
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

MSRPC Interfaces Request

A 
lsarpc - local security authority
samr - comm with security account mgr
netlogon - SAM authentication n replication
drsuapi - AD replication
dssetup - Dir Svc Setup in AD
eventlog - access window event log
pnp - plug and play
srvsvc - manage lanmanserver service
svcctrl - manage windows service control mgr
winreg - windows registry access
wkssvc - lanman workstation service
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

When utilizing SMB/CIFS, what mechanism is used to provide access to a
requested share?

A

tree connect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

DNS zones

A 
.com
.net
.com
.org
.mil
.jp
.edu
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Number of Names “root” servers

A

13 - actually are more doing any casting to load balance geographically

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Reverse DNS Domain

A

in-addr.arpa

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

In TCPdump DNS reply three fields are give (ie. 0/3/4) what do these mean

A

0 Answers
3 Authority Records
4 Additional Records

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

In TCPdump DNS server reply if + (plus) sign after DNS ID

A

Means recursion is desired. It means if DNS server doesn’t know answer then go find it for me

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

In TCPdump DNS server reply if * (asterisck) mean –>

A

Means that is the authoritative server for that zone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Max value TTL for DNS record cache

A

32 bit field = 2^32 or ~4.3 billion seconds

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Max TTL for IP

A

255

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

nslookup zone xfer

A

nslookup

Ls -d (list all data)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Largest reply of DNS by UDP by default

A

512 bytes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

In TCPdump DNS server reply if | (pipe) after DNS ID

A

truncated bit set; this tells the client to that 512 was exceeded so client should use TCP to get full set of info

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

EDNS extends DNS reply size to

A

4000 bytes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

DNSSEC does what

A

1) Ensure integrity and authenticity of DNS record
2) Use public key for digital signing
3) Adds new DNS records

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Current Problem with DNSSEC

A

Poor hash alg has collision

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

IPv6 new resource record type

A

AAAA (quad-A) for longer address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

IPv6 reverse DNS top level domain

A

ip6.arpa

26
Q

Version of DNS that supports IPv6

A

Bind 9, windows server 2003

27
Q

nslookup search name server for target

A

set type=ns

28
Q

nslookup search Source of Authority

A

set type=soa

29
Q

fast flux

A

bot net of multiple hosts change get rotated in DNS A records so that IP for same URL are actually different IP/Host

30
Q

DNS Cache poisoning

A

Change DNS to point to malicious host. www.amazon.com goes to compromised server.

31
Q

Prevent Old Cache Poinsoning

A

Bailiwick checking - domains in query and additional resource records have to match

32
Q

Snort Rules - Action: Alert

A

Create entry in alerts file

Logs packet header info as well

33
Q

Snort Rules - Action: Log

A

Log entry

No Alerts logged to alert file

34
Q

Snort Rules - Action: Pass

A

Drop packet and do nothing else

35
Q

Snort Rules - Action: drop

A

Inline only option; blocks and logs traffic

36
Q

Snort Rules - Action: sdrop

A

Inline only option; drops without logging

37
Q

Snort Rules - Action: reject

A

Inline only option: blocks, logs and attempts to terminate TCP or UDP session

38
Q

Which DNS record is a required DNS resource record for any DNS server to
indicate the zone for which it is authoritative?

A

Start of Authority

39
Q

What special level domain suffix is reserved for resolution of IP numbers
to hostnames at the top level?

A

arpa

40
Q

What does the ‘*’ indicate in the following packet capture?

dns. server.53 > host.1763: 1* 1/3/4 A
66. 35.45.201 (192)

A

It means dns.server IS the authoritative server for this zone

41
Q

Who sets the time to live value for cached DNS records?

A

client resolver – maybe! Check in book

42
Q

How can malicious attackers be prevented from performing a zone transfer from
your DNS servers?
A. Block inbound UDP port 53.
B. Block inbound TCP port 53.
C. Restrict the IP addresses that are allowed to perform zone transfers.
D. Remove all slave DNS servers.

A

B and C

43
Q

What does the DNSSEC resource record of RRKEY contains what?

A

Public key for DNS zone

44
Q

Based off of the following packet capture, what does the 4 indicate in
‘1/3/4’?

11:47:57.042470 IP 192.168.14.5.53 > 172.16.7.6.50702:
47543 1/3/4 A 10.1.1.5 (152)

A

4 additional records were returned.

45
Q

What is a set of domain names for which DNS is the authoritative
nameserver?

A

Zone Maps

46
Q

What are zone maps

A

The set of domain names for which DNS is the authoritative nameserver

47
Q

What type of call is made from the client resolver when a reverse lookup is
made?

A

gethostbyaddr

48
Q

Who maintains the zone maps?

A

Master Server

49
Q

How are DNS records stored in IPv6 compared to IPv4?

A

A quad A (AAAA) record stores Ipv6 address, and an A record stores IPv4 addresses.

50
Q

What value does DNS use in order to determine how long a cached record
stays on a DNS server?

A

Time To Live

51
Q

When is TCP used for DNS transactions? Choose the BEST answer.

A. For zone transfers.
B. After a UDP response is truncated.
C. When the DNS payload is less than 500 bytes.

A

A and B

52
Q

How are DNS records stored in IPv6 compared to IPv4?

A

A quad A (AAAA) record stores Ipv6 address, and an A record stores IPv4 addresses.

53
Q

What does the ‘+’ indicate in the following packet
capture?

06:19:16.427260 IP (tos 0x0, ttl 64, id 18411, offset 0,
flags [none], proto UDP (17), length 61) 10.0.0.6.50846 > 10.0.0.1.53: [udp
sum ok] 33620+ A? sans.org. (33)

A

Recursion Request or Recursion is desired

54
Q

Based off of the following packet capture, what does the 3 indicate in
‘1/3/4’?

11:47:57.042470 IP 192.168.14.5.53 > 172.16.7.6.50702:
47543 1/3/4 A 10.1.1.5 (152)

A

3 authoritative records were found.

55
Q

Slave server gets zones maps from

A

From Master via zone xfer

56
Q

what does | in tcpdump mean

A

truncated bit set.

57
Q

DNSSEC RRSIG record contains what

A

signature for resource record set

58
Q

IPv6 Features

A 
Autoconfiguration
Anycast Address
Mandatory Multicast Address
IPSec included via extension headers
Mobile IP
Jumbo Payloads
59
Q

What is Teredo

A

Tunnels IPv6 between IPv6 hosts using UDP packets. Microsoft way of using IPv6

60
Q

What is GRE

A

Generic Route Encapsulation: IPv6 over IPv4

Networking (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions