Section 4.5

Question 1

Provide the protocol and ports used for Web Servers

Answer 1

tcp/80 (HTTP)
tcp/443 (HTTPs)

Question 2

Provide the protocol and port used for SSH server

Answer 2

tcp/22

Question 3

Provide the protocol and port used for Microsoft Remote Desktop (RDP)

Answer 3

tcp/3389

Question 4

Provide the protocol and port used for DNS query

Answer 4

udp/53

Question 5

Provide the protocol and port used for NTP (Network Time Protocol)

Answer 5

udp/123

Question 6

What is an Implicit deny?

Answer 6

Implicit deny means that if traffic is coming through the firewall and none of the rules set on the firewall match this incoming traffic, then the traffic is automatically denied.

Question 7

What is a screened subnet?

Answer 7

Screened subnet is an additional layer of security between you and the internet to provide a public access point to public resources from the internal network.

Question 8

What is content filtering?

Answer 8

A Content filter is a URL filtering or website category filtering.
Mostly used in corporates to block access to sensitive materials or control access to websites non appropriate for work, etc.

Question 9

Provide examples of some unsecure protocols and their secure counterparts

Answer 9

Remote Console: Insecure\Telnet , secure\SSH
Web Browsing: Insecure\HTTP, secure\HTTPs
Email Client Access: Insecure\IMAP, secure\IMAPS
File Transfer: Insecure\FTP, secure\SFTP

Question 10

What is SPF?

Answer 10

Sender Policy Framework (SPF) defines which email servers are authorized to send emails on your behalf. A list of authorized mail servers are added to a DNS TXT record to check if the incoming mail really did come from an authorized host.

Question 11

What is DKIM?

Answer 11

Domain Keys Identified Mail (DKIM) digitally signs all outgoing mail using a public key in the DKIM TXT record.

Question 12

What is a DMARC?

Answer 12

Domain-based Message Authentication, Reporting and Conformance (DMARC) is an extension of SPF and DKIM, which decided what receiving email servers should do with emails not validated using SPF and DKIM. DMARC can be set to accept all mail, send to spam or reject.

Question 13

What is a FIM?

Answer 13

File Integrity Monitoring (FIM) monitors important operating system and application files in case a change in the file occurs.
In Windows this is done using SFC (System File Checker)
In Linux this is done using Tripwire.