Security 1.1 – 6.2.6 – 6.3.8 – 6.4.9 – 6.5.8 – 6.6.5 – 6.7.5 – 6.8.4 Questions with Explanation

You have been using SNMP on your network for monitoring and management. You are concerned about the security of this configuration. What should you do?
Implement version 3 of SNMP

SNMP is a protocol designed for managing complex networks, SNMP lets network hosts exchange configuration and status information. The original version of SNMP has several vulnerabilities. For added security, implement version 3 of SNMP.

SSH allows for secure interactive control fo remote systems, but does not provide the same features as SNMP. RADIUS is used to control remote access authentication, authorization, and accounting from a centralized server.

You want to implement a protocol on your network that allows computers to find the IP address of a host from a logical name. What protocol should you implement?
DNS

DNS is a system that is distributed throughout the inter-network to provide address/name resolution. For example, the name www.mydomain.com would be identified with a specific IP address.

ARP is a protocol for finding the IP address from a known MAC address. DHCP is a protocol used to assign IP addresses to hosts. Telnet is a remote management utility.

Which of the following protocols allows hosts to exchange messages to indicate problems with packet delivery?
ICMP

The Internet Control Message Protocol (ICMP) allows hosts to exchange messages to indicate the status of a packet as it travels through the network.

You are configuring a network firewall to allow SMTP outbound email traffic, and POP3 inbound email traffic. Which of the following TCP/IP ports should you open on the firewall? (Select Two)
25,110

SMTP uses TCP/IP port 25. POP3 uses TCP/IP port 110.

FTP uses 21. IMAP uses 143. TCP/IP port 443 is used by SSL

Which port number is used by SNMP?
161

SMTP uses port 25
POP3 uses port 110
NNTP uses port 119
IMAP4 uses port 143

Which of the following ports does FTP use to establish sessions and manage traffic?
FTP

FTP uses ports 20 and 21 to establish sessions and manage traffic. Once sessions are established, FTP uses random higher order port to perform the actual file transfers.

Port 80 is used by HTTP and TLS, port 443 is used by SSL and TLS. Port 25 is used by SMTP and port 110 is used by POP3. Ports 125-129 are used by NetBIOS.

Using the Netstat command you notice that a remote system has made a connection to your Windows server 2003 system using TCP/IP port 21. Which of the following actions is the remote system most likely to be performing ?
Downloading a file

Port 21 is used by FTP which is used to download files.

To increase security on your company’s internal network, the administrator has disabled as many ports as possible. Now, however, though you can browse the Internet, you are unable to perform some secure credit card transactions.
443

To perform secure transactions, SSL on port 443 needs to be enabled. HTTPS uses port 443 by default.

Which of the following network services or protocols uses TCP/IP port 22?
SSH

SSH uses port 22
TFTP uses port 69
NNTP uses port 119
IMAP4 uses port 143.

Which two of the following lists accurately describes TCP and UDP?
TCP: Connection-oriented, reliable, sequenced, high overhead

UDP: connection-less, unreliable, unsequenced, low overhead

You are an application developer creating applications for a wide variety of customers. In which two of the following situations would you select a connectionless protocol?(Select 2
A company connects two networks through an expensive WAN link. The communication media is reliable, but very expensive. They want to minimize connection times.

A gaming company wants to create a networked version of its latest game. Communication speed and reducing packet overhead are more important than error-free delivery.

Matching ports to associated services
SNMP = 161 TCP and UDP
SSH = 22 TCP and UDP
TFTP = 69 UDP
SCP = 22 TCp and UDP
Telnet = 23 TCP
HTTPS = 443 TCP and UDP
HTTP = 80 TCP
FTP = 20 TCP
SMTP = 25 TCP
POP3 = 110 TCP
You want to maintain tight security on your internal network so you restrict access to the network through certain port numbers. If you want to allow users to continue to use DNS, which port should you enable?
53

The DNS service uses port 53.

Your company’s network provides HTTP, HTTPS, and SSH access to remote employees. Which ports must be opened on the firewall to allow this traffic to pass?
80,443,22

Port 80 for traditional HTTP Web
Port 443 for HTTPS
Port 22 for Secure Shell(SSH)

Your network recently experienced a series of attacks at the Telnet and FTP services. You have rewritten the security policy to abolish the unsecured services, and now you must secure the network using your firewall and routers. Which ports must be closed to prevent traffic directed to these two services?
23,21
Close port 23 to prevent Telnet traffic and port 21 for FTP. Both protocols pass user credentials in clear text and represent a serious vulnerability toyour network.
What is the main difference between a DoS attack and a DDoS attack?
The DDos attack uses zombie computers.

In a DDos attack:
The attacker identifies one of the computers as the master
The master uses zombies/bots to attack
The master directs the zomvies to attack the same target

DoS is a generic term meaning many different types of attacks, in a DoS attack, a single attacker directs an attack against a single target, sending packets directly to the target.

An attacker sets up 100 drone computers that flood a DNS server with invalid requests. This is an example of which kind of attack?
DDos

Spamming is just a traffic generation form of attack.
Replay and backdoor attacks are just flaw exploitation forms of attack. Replay attacks exploit software flaws by capturing traffic, possibly editing it, then replaying the traffic in an attempt to gain access to a system.

You suspect that an Xmas tree attack is occurring on a system. Which of the following could result if you do not stop the attack? (Select two.)
The system will unavailable to respond to legitimate requests.
The threat agent will obtain information about open ports on the system.

A Christmas tree attack conducts reconnaissance by scanning for open ports. It also conducts a DoS attack if sent in large amounts.

You need to enumerate the devices on your network and display the configuration details of the network. Which of the following utilities should you use?
NMAP

Nmap is an open source security scanner used for network enumeration and to create a map of configuration details of a network. Nmap sends specially crafted packets to the target host and then analyzes the responses to create the map.

An attacker is conducting passive reconnaissance on a targeted company. Which of the following could he be doing?
Browsing the organization’s Website

Other forms include putting a sniffer on the wire or eavesdroppiong on employee conversations.

Which type of active scan turns off all flags in a TCP header?
Null

A null scan turns off all flags in a TCP header, creating a lack of TCP flags that should never occur in the real world.

Which of the following Denial of Service (DoS) attacks uses ICMP packets and will only be successful if the victim has less bandwidth than the attacker?
Ping Flood

A ping flood is where the attacker overwhelms the victim with ICMP Echo Request (ping) packets. In a ping flood, the attack succeeds only if the attacker has more bandwidth than the victim.

In which of the following Denial of Service (DoS) attacks does the victim’s system rebuild invalid UDP packets, causing the system to crash or reboot?
Teardrop

In the Teardrop attac, fragmented UDP packets with overlapping offsets are sent. Then when the victim system re-builds the packets, an invalid UDP packet is created, causing the system to crash or reboot.

A SYN packet is received by a server. The SYN packet has the exact same address for both the sender and receiver addresses, which is the address of the server. This is an example of what type of attack?
Land Attack

A land attack is the form of attack where the SYN packet has the exact same address for both the sender and receiver addresses, which is the address of the server.

Which of the following is a form of denial of service attack that subverts the TCP three-way handshake process by attempting to open numerous sessions on a victim server but intentionally falling to complete the session by not sending the final required packet?
SYN flood

A SYN attack or a SYN flood is a form of denial of service attack that subverts the TCP three-way handshake process by attempting to open numerous sessions on a victim server but intentionally failing to complete the session by not sending the final required packet.

Which of the following is a form of denial of service attack uses spoofed ICMP packets to flood a victim with echo requests using a bounce/amplification network?
Smurf

Smurf is a form of denial of service attack which uses spoofed ICMP packets to flood a civtim with echo requests using a bounce/amplification network.

A SYN attack or a SYN flood exploits or alters which element of the TCP three-way handshake?
ACK

A Syn attack or SYN flood exploits or attacks the ACK packet of the TCP-three-way handshake. By not sending the final ACK packet, the server holds open an incomplete session, thus consuming system resources.

When a Syn flood is altered so that the SYN packets are spoofed in order to define the source and destination address as a single victim IP address, the attack is now called what?
Land Attack

A land attack is a SYN flood where the source and destination address of the SYN packets are both defined as the victim’s IP address.

A surf attack requires all but which of the following elements to be implemented?
Padded Cell

A smurf attack does not require a padded cell to be implemented. It requires an attack system, an amplification network, and a victim computer or network.

A padded cell is a type of intrusion enticement mechanism similar to a honey pot. A padded cell is a simulated network environment that is created when an intruder is detected.

Which of the following best describes the ping of death?
An ICMP packet that is larger than 65,536 bytes.
Which of the following is the best countermeasure against man-in-the-middle attacks?
IPSec

IPSec is the best countermeasure against man-in-the middle attacks. Use IPSec to encrypt data in a VPN tunnel as it passes between two communication partners. Even if someone intercepts the traffic, they will be unable to extract the contents of the messages because they are encrypted.

What is modified in the most common form of spoofing on a typical IP Packet?
Source Address

In this way, the correct source device address is hidden.

Which type of Denial of Service (DoS) attack occurs when a name server receives malicious or misleading data that the incorrectly maps host names and IP Addresses?
DNS poisoning

In a DNS poisoning attack:
Incorrect DNS data is introduced into a primart DNS server.
The incorrect mapping is made available to client applications through the resolver.
Traffic is directed to incorrect sites.

Which of the following describes a man-in-the-middle attack?
A false server intercepts communications from a client by impersonating the intended server
Capturing packets as they travel from one host to another with the intent of altering the contents of the packets is a form of which security concerns?
Man-in-the-middle attack
When the TCP/IP session state is manipulated so that a third party is able to insert alternate packets into the communications stream, what type of attack has occurred?
Hijacking

A hijacking attack is one where the TCP/IP session state is manipulated so that a third party is able to insert alternate packets into the communication stream. Session hijacking has become difficult to accomplish due to the use of time stamps and randomized packet squencing rules employed by modern operating systems.

What is the goal of a TCP/IP hijacking attack?
Executing commands or accessing resources on a system the attacker does not otherwise have authorization to access
Which of the following is NOT a protection against session hijacking?
DHCP reservations

Not a protection against session hijacking as if a valid MAC address can be discovered, then an IP address is handed out freely to the spoofed client by the DHCP server.

Which of the following is the most effective protection against IP packet spoofing on a private network?
Ingress and egress filters

Ingress filters examine packets coming into the network
Egress filters examine packets going out of the network.

While using the internet, you type the URL of one of your favorite sites in the browser. Instead of going to the correct site, however, the browser displays a completely different website. When you use the IP address of the Web server, the correct site displayed. Which type of attack has likely occurred.
DNS poisoning
Which of the following attacks tries to associate an incorrect MAC address with a known IP address?
ARP poisoning

Arp spoofing/poisoning associates the attacker’s MAC address with the IP address of victim devices. When computers send an ARP request to get the MAC address of a known IP address, the attacker’s system responds with its MAC address.

What are the most common network traffic captured and used in a reply attack?
Authentication

Authentication traffic is the most commonly captured type of network traffic packets used in replay attacks. If someone is able to replay the stream of authentication packets successfully, they can gain the same access to the system or network as the original user.

When a malicious user captures authentication traffic and replays it against the network later, what is the security problem you are most concerned about?
An unauthorized user gained access to sensitive resources
A router on the border of your network detects a packet with a source address that is from an internal client but the packet was received in the Internet-facing interface. This is an example of what form of attack?
Spoofing
An attacker uses an exploit to push a modified host file to clients systems. This host file redirects traffic from legitimate tax preparation sites to malicious sites to gather personal and financial information. What kind of exploit has been used.
DNS poisoning
Pharming
Which of the following is a privately controlled portion of a network that is accessible to some specific external entities?
Extranet

An extranet is a privately controlled portion of a network that is accessible to some specific external entities. Often those external entities are business partners, suppliers, distributors, vendors, or possibly customers.

You are the office manager of a small financial credit business. Your company handles personal, financial information for clients seeking small loans over the Internet. You are aware of your obligation to secure clients records, but budget is an issue. Which item would provide the best security for this situation?
All-in-one security appliance

Would provide the best overall protection. The all-in-one security appliance takes up the least amount of space and requires the least amount of technical assistance for setup and maintenance.

You are implementing security at a local high school that is concerned with student accessing inappropriate material on the Internet from the library’s computers. The students will use the computers to search the Internet for research paper content. The school budget is limited. Which content filtering option would you choose?
Restrict content based on content categories.
Match the application-aware network device on the right with the appropriate description on the left.
Application-aware proxy
Improves application performance

Application-aware firewall
Enforces security rules based on the application that is generating network traffic, instead of the traditional port and protocol

Application-aware IDS
Analyzes network packets to detect malicious payloads targeted at application-layer services

Your company has a connection to the internet that allows users to access the internet. You also have a web server and an email server that you want to make available to the internet users. You want to create a DMZ for these two servers. Which type of device should you use to create the DMZ?
Network-based firewall

DMZ is a buffer network that sits between the private network and an untrusted network. To create a DMZ, use two network-based firewall devices: one connected ot the public network and one connected to the private network.

You have a company network that is connected to the Internet. You want all users to have Internet access, but need to protect your private network and users. You also need to make a Web server publicly available to Internet users. Which solution should you use?
Use firewalls to create a DMZ.
Place the Web server inside the DMZ,
and the private network behind the DMZ.
You have used firewalls to create a demilitarized zone. You have a Web server that needs to be accessible to Internet users. The Web server must communicate with a database server for retrieving product, customer, and order information. How should you place devices on the network to best protect the servers? (Select two.)
Put the database server on the private network.
Put the Web server inside the DMZ
Of the following security zones, which one can serve as a buffer network between a private secured network and the untrusted Internet?
DMZ
Servers as a buffer network
Which of the following is likely to be located in a DMZ?
FTP Server
Members of the Sales team use laptops to connect to the company network. While travelling, they connect their laptops to the Internet through airport and hotel networks. You are concerned that these computers will pick up viruses that could spread to your private network. You would like to implement a solution that prevents the laptops from connecting to your network unless anti-virus software and the latest operating system patches have been installed. Which solution should you use?
NAC
Network Access Control controls access to the network by not allowing computers to access network resources unless they meet certain predefined security requirements.
In which of the following situations would you most likely implement a demilitarized zone (DMZ)?
You want to protect public Web Server from attack.
Which of the following terms describes a network device that is exposed to attacks and has been hardened against those attacks?
Bastion or sacrificial host

A bastion or sacrificial host is one that is unprotexted by a firewall. The term bastion host can be used to describe any device fortified against attack, such as a firewall. A sacrificial host might be a device interntionally exposed to attack, such as a honey pot.

Which of the following is a firewall function?
Packet Filtering
Which of the following are characteristics of a circuit-level gateway?(Select two)
Filters based on sessions

Stateful

Which of the following are characteristics fo a packet filtering firewall?
Stateless

Filters IP address and port

You want to install a firewall that can reject packets that are not part of an active session. Which type of firewall should you use?
Circuit- Level
You provide Internet access for a local school. You want to control Internet access based on user, and prevent access to specific URLs. Which type of firewall should you install?
Application Level
Which of the following is the best device to deploy to protect your private network from a public untrusted network?
Firewall
You have been given a laptop to use for work. You connect the laptop to your company network, use it from home, and use it while traveling. You want to protect the laptop from Internet-bases attacks. What solution should you use?
Host Based Firewall
You connect your computer to a wireless network available at the local library. You find that you can access all web sites you want on the Internet except two. What might be causing the problem?
A proxy server is blocking access to the web sites.
Which of the following functions are performed by proxies?(Select two)
Cache web pages

Block employees from accessing certain Web sites

Which of the following are true of a circuit proxy filter firewall?(Select two)
Operates at the Session Layer AND Verifies sequencing of session packets
Which of the following does a router acting as a firewall use to control which packets are forwarded or dropped?
ACL
You have a router that is configured as a firewall. The router is a layer 3 device only. Which of the following does the router use for identifying allowed or denied packets?
IP Address
You have just installed a packet-filtering firewall on your network. What options will you be able to set on your firewall? Select all that apply.
Source address of a packet, Destination address of a packet, AND Port Number
When designing a firewall, what is the recommended approach for opening and closing ports?
Close all ports; open only ports required by applications inside the DMZ
Which of the following firewall types can be a proxy between servers and clients?(Select two)
Application layer firewall AND Circuit proxy filtering firewall
You have a small network at home that is connected to the internet. On your home network you have a server with the IP address of 192.168.55.199/16. You have a single public address that is shared by all hosts on your private network. You want to configure the server as a web server and allow Internet hosts to contact the server to browse a persona Web site. What should you use to allow access?
Static NAT
You are the network administrator for a small company that implements NAT to access the Internet. However, you recently acquired 5 servers that must be accessible from outside your network. Your ISP has provided you with 5 additional registered IP addresses to support these new servers but you don’t want the public to access these servers directly. You want to place these servers behind your firewall on the inside network yet still allow them to be accessible to the public from the outside. Which method of NAT translation should you implement for these 5 servers?
Static
YOU want to connect your small company network to the Internet. Your ISP provides you with a single IP address that is to be shared between all hosts on your private network. You do not want external hosts to be able to initiate connection to internal hosts. What type of NAT should you implement?
Dynamic
Which of the following in NOT one of the ranges of IP addresses define in RFC 1918 that are commonly used behind a NAT server?
169.254.0.0-169.254.255.255
Which of the following network devices or services prevent the use of IPsec in most cases?
NAT
Which of the following is NOT a benefit of NAT?
Improving the throughput rate of traffic
You have a group of salesmen who would like to access your private network through the Internet while they are traveling. You want to control access to the private network through a single server. Which solution should you implement?
VPN Concentrator
A VPN is used primary for what purpose?
Support secured communications over an untrusted network
Which VPN protocol typically employs IPsec as its data encryption mechanism?
L2TP
Which statement best describes IPSec when used in tunnel mode?
The entire data packet, including headers, is encapsulated
Which IPSec subprotocol provides data encryption?
ESP
Which is the best countermeasure for someone attempting to view your network traffic?
VPN
PPTP is quickly becoming obsolete because of what VPN protocol?
L2TP
What is the primary use of tunneling?
Supporting private traffic through a public communication medium
In addition to Authentication Header (AH), IPSec is comprised of what other service?
ESP
A salesperson in your organization spends most of her time traveling between customer sites. After a customer visit, she must complete various managerial tasks, such as updating your organization’s order database. Because she rarely comes back to your home office, she usually accesses the network from her notebook computer using WiFi access provided by hotels, restaurants, and airports. Many of these locations provide unencrypted public WiFi access, and you are concerned that sensitive data could be exposed. To remedy this situation, you decide to configure her notebook
Configure the VPN connection to use IPsec

Configure the browser to send HTTPS requests through the VPN connection.

Which of the following is a valid security measure to protect e-mail from viruses?
Use blockers on e-mail gateways
Which of the following prevents access based on website ratings and classifications?
Content Filter
Drag the Web threat protection method on the left to the correct definition on the right.
Prevents visiting malicious Web sites.
Web threat filtering.

Prevents outsided attempts to access confidential information.
Antiphishing software.

Identifies and disposes of infected content.
Virus blockers.

Prevents unwanted email from reaching your network.
Gateway email spam blockers.

Prevents visiting restricted Web sites.
URL content filtering

You are investigating the use of Web site and URL content filtering to prevent users from visiting
certain Web sites.
Which benefits are the result of implementing this technology in your organization? (Choose
two.)
You have a company network with a single switch. All devices connect to the network through the switch. You want to control which devices will be able to connect to your network. For devices that do not have the latest operating system patches, you want to prevent access to all network devices except for a special server that holds the patches that the computers need to download. Which of the following components will be part of your solution?(Select two)
Remediation Servers

802.1x Authentication

Which step is required to configure a NAP on a Remote Desktop(RD) Gateway server?
Edit the properties for the server and select Request clients to send a statement of health.
In a NAP system, what is the function of the System Health Validator?
Compare the statement of health submitted by the client to the health requirements
How does IPsec NAP enforcement differ from other NAP enforcement methods?
Clients must be issued a valid certificate before a connection to the private network is allowed.
A user copies files from her desktop computer to a USB flash device and puts the device into her pocket. Which of the following security goals is most at risk?
Confidentiality
Smart phones with cameras and Internet capabilities pose a risk to which security goal?
Confindentiality
By definition, which security concept ensures that only authorized parties can access data?
Confidentiality
You computer system is a participant in an asymmetric cryptography system. You’ve crafted a message to be sent to another user. Before transmission, you hash the message, then encrypt the hash using your private key. You then attach this encrypted hash to your message as a digital signature before sending it to the other user.
Integrity
Which of the following is an example of an internal threat?
A user accidentally deletes the new product designs
What is the greatest threat to the confidentiality of data in most secure organizations?
USB Devices
Which of the following the correct definition of a threat?
Any potential danger to the confidentiality, integrity, or availability of information systems.
Which of the following is an example of a vulnerability
Misconfigured Server
Which of the following is not a valid concept to associate with integrity?
Control access to resources to prevent unwanted access
When a cryptographic system is used to protect the confidentiality of data, what is actually protected?
Unauthorized users are prevented from view or accessing the resource.
By definition, which security concept uses the ability to prove that a sender sent an excrypted message
Non-Repudiation
The company network is protected by a firewall, an ids, and tight access controls. All of the files on this protexted network are copied to tape every 24 hours. the backup solution imposed on this network is designed to provide protection for what security service?
Availability