Securing Your Network Flashcards
What can an administrator use to detect malicious activity after it occurred? A. Firewall B. Sniffer C. Port scanner D. IDS
D. An intrusion detection system (IDS) detects malicious activity after it has occurred. A firewall attempts to prevent attacks. A sniffer can capture and analyze packets to read data or inspect IP headers. A port scanner looks for open ports on a system to determine running services and protocols.
Of the following choices, what would detect compromises on a local server? A. HIDS B. NIPS C. Firewall D. Protocol analyzer
A. A host-based intrusion detection system (HIDS) can detect attacks (including successful attacks resulting in compromises) on local systems such as workstations and servers. A NIPS detects and mitigates attacks on a network, not local systems. A firewall attempts to prevent attacks not detect them. A protocol analyzer can capture and analyze packets, but it will not detect attacks.
Of the following choices, what represents the best choice for a system to detect attacks on a network, but not block them? A. NIDS B. NIPS C. HIDS D. HIPS
A. A network-based intrusion detection system (NIDS) will detect attacks, but will not necessarily block them (unless it is an active NIDS). In contrast, a network-based intrusion prevention system will detect and block attacks. Host-based systems (HIDS and HIPS) provide protection for hosts, not networks.
Your organization is using a NIDS. The NIDS vendor regularly provides updates for the NIDS to detect known attacks. What type of NIDS is this? A. Anomaly-based
B. Signature-based
C. Prevention-based
D. Honey-based
B. Signature-based, network-based intrusion detection systems (NIDS) use signatures similar to antivirus software which are downloaded regularly as updates. An anomaly-based (also called heuristic or behavior-based) detection system compares current activity with a previously created baseline to detect any anomalies or changes. An IPS is prevention based, but an IDS is detection based. There is no such thing as honey based.
You are preparing to deploy an anomaly-based detection system to monitor network activity. What would you create first? A. Flood guards B. Signatures C. Baseline D. Honeypot
C. An anomaly-based (also called heuristic or behavior-based) detection system compares current activity with a previously created baseline to detect any anomalies or changes. Flood guards help protect against SYN flood attacks. Signature-based systems use signatures similar to antivirus software. A honeypot is a server designed to look valuable to an attacker and can divert attacks.
Of the following choices, what can you use to divert malicious attacks on your network away from valuable resources to relatively worthless resources? A. IDS B. Proxy server C. Web application firewall D. Honeypot
D. A honeypot can divert malicious attacks to a harmless area of your network, away from production servers. An IDS can detect attacks, but only an active IDS (or an IPS) will take action, and it usually blocks the attack instead of diverting it. A proxy server can filter and cache content from web pages, but doesn’t divert attacks. A web application firewall (WAF) is an additional firewall designed to protect a web application.
Of the following choices, what best describes the function of an IPS?
A. Detect attacks
B. Stop attacks in progress
C. Prevent attackers from attacking
D. Notify appropriate personnel of attacks
B. The primary purpose of an intrusion prevention system (IPS) is to stop attacks in progress. While an IPS detects attacks just as an IDS does, a distinguishing factor between an IDS and an IPS is that an IPS can also stop attacks in progress. It’s not possible to prevent attackers from attacking, but an IPS can reduce the impact they have on a system. Both IDSs and IPSs provide notifications.
Of the following choices, what provides active protection for an operating system? A. NIDS B. NIPS C. HIDS D. HIPS
D. A host-based intrusion prevention system (HIPS) provides active protection for an individual host, including its operating system. In contrast, HIDS is passive by default. Network based IDSs and IPSs monitor and protect network traffic.
Of the following choices, what most accurately describes a NIPS?
A. Detects and takes action against threats B. Provides notification of threats
C. Detects and eliminates threats
D. Identifies zero day vulnerabilities
A. A network-based intrusion prevention system (NIPS) attempts to detect and mitigate threats by taking action to block them. While a NIPS does provide notification, a distinguishing difference between a NIDS and a NIPS is that a NIPS takes action to stop the attack. Threats can’t be eliminated. An anomaly-based IDS or IPS may be able to identify zero day vulnerabilities, though honeypots are used more often to detect zero day vulnerabilities.
You’ve recently completed a wireless audit and realize that the wireless signal from your company’s WAP reaches the parking lot. What can you do to ensure that the signal doesn’t reach outside your building?
A. Increase the WAP’s power level
B. Decrease the WAP’s power level
C. Enable SSID broadcasting
D. Disable SSID broadcasting
B. You can decrease the wireless access point’s (WAP’s) power level to reduce the footprint and ensure the WAP’s signal doesn’t reach outside the parking lot (or reposition the WAP’s antenna). Increasing the WAP’s power level increases the footprint. SSID broadcasting won’t have an impact on the footprint.
Which one of the following secure protocols did WEP implement incorrectly, allowing attackers to crack it? A. SSL B. RC4 C. CCMP D. AES 12.
B. Wired Equivalent Privacy (WEP) implemented RC4 with small initialization vectors (IVs), allowing an IV attack to discover the key. SSL uses RC4 successfully to encrypt and decrypt traffic, but WEP does not use SSL. CCMP is a strong encryption protocol based on AES that overcomes problems with TKIP, and WEP did not use CCMP. AES is a strong encryption standard. WEP did not use AES.
Which of the following authentication mechanisms can provide centralized authentication for a wireless network? A. WPA2 B. RADIUS C. Multifactor authentication D. Kerberos
D. Wi-Fi Protected Access version 2 (WPA2) provides the strongest security for an 802.11n (wireless) network of the given choices. FTPS secures FTP traffic with SSL. SSL encrypts other types of traffic, but not wireless network traffic. WEP is weak and should not be used.
Which of the following authentication mechanisms can provide centralized authentication for a wireless network? A. WPA2 B. RADIUS C. Multifactor authentication D. Kerberos
B. Remote Authentication Dial-in user Service (RADIUS) can provide centralized authentication for wireless networks as an 802.1X server in Enterprise mode. WPA2 provides security for a wireless network. Multifactor authentication uses two or more factors of authentication but does not provide centralized authentication. Kerberos provides authentication in Microsoft networks.
You want to ensure that only specific wireless clients can access your wireless networks. Of the following choices, what provides the best solution?A. MAC filtering
B. Content filtering
C. NAT
D. NIPS
A. MAC filtering allows you to restrict access to the wireless networks to devices with specified MAC addresses (though an attacker can circumvent this method). Content filtering can filter traffic for malware and more, but it doesn’t restrict clients. NAT translates IP addresses and can hide internal private IP addresses, but it doesn’t restrict access. NIPS can detect and block attacks but not filter wireless clients.
You recently completed a wireless audit of your company’s wireless network. You’ve identified several unknown devices connected to the network and realize they are devices owned by company employees. What can you use to prevent these devices from connecting?
A. MAC filtering
B. Enable SSID broadcast
C. Enable isolation mode on the WAP
D. Reduce the power levels on the WAP
A. MAC filtering can restrict the devices’ connectivity based on their MAC address and prevent the employees’ devices from connecting. Enabling SSID broadcast won’t prevent the devices from connecting. Isolation mode prevents wireless users from connecting to each other, not the WAP. Reducing the power levels reduces access for all devices, not just the employee owned devices.
