Chapter 2. Domain 2.0: Network Infrastructure

The network infrastructure is subject to myriad internal and external attacks through services, protocols, and open ports. It is imperative that you understand how to eliminate nonessential services and protocols, especially if the network has been in existence for some period of time and some services are no longer needed or have been forgotten. To stop many would-be attackers, you must understand the different types of attacks that can happen, along with how to implement a network design, components, and tools that can protect the infrastructure. Be sure to give yourself plenty of time to review all of these concepts. The following list identifies the key areas from Domain 2.0 (which counts as 20% of the exam) that you need to master:

image Differentiate between the different ports and protocols, their respective threats and mitigation techniques.

image Distinguish between network design elements and components.

image Determine the appropriate use of network security tools to facilitate network security.

image Apply the appropriate network tools to facilitate network security.

image Explain the vulnerabilities and mitigations associated with network devices.

image Explain the vulnerabilities and mitigations associated with various transmission media.

image Explain the vulnerabilities and implement mitigations associated with wireless networking.

Practice Questions

Objective 2.1: Differentiate between the different ports & protocols, their respective threats, and mitigation techniques.

1. Which of the following ports should be blocked when it has been determined that an intruder has been using Telnet for unauthorized access?

image A. 110

image B. 21

image C. 23

image D. 443

Quick Answer: 107

Detailed Answer: 110

2. Which of the following ports should be blocked when it has been determined that an intruder has been using SNMP for unauthorized access? (Select all correct answers.)

image A. 161

image B. 162

image C. 443

image D. 4445

Quick Answer: 107

Detailed Answer: 110

3. Which of the following best describes TCP/IP hijacking?

image A. Providing false identity information to gain unauthorized access

image B. An established connection without specifying a username or password

image C. An attacker takes control of a session between the server and a client

image D. Redirecting traffic by changing the IP record for a specific domain

Quick Answer: 107

Detailed Answer: 110

4. Which of the following best describes spoofing?

image A. Providing false identity information to gain unauthorized access

image B. An established connection without specifying a username or password

image C. An attacker takes control of a session between the server and a client

image D. Redirecting traffic by changing the IP record for a specific domain

Quick Answer: 107

Detailed Answer: 110

5. Which of the following best describes a null session?

image A. Providing false identity information to gain unauthorized access

image B. An established connection without specifying a username or password

image C. An attacker takes control of a session between the server and a client

image D. Redirecting traffic by changing the IP record for a specific domain

Quick Answer: 107

Detailed Answer: 110

6. Which of the following best describes DNS poisoning?

image A. Providing false identity information to gain unauthorized access

image B. An established connection without specifying a username or password

image C. An attacker taking control of a session between the server and a client

image D. Redirecting traffic by changing the IP record for a specific domain

Quick Answer: 107

Detailed Answer: 110

7. Which of the following best describes a man-in-the-middle attack?

image A. An attacker takes advantage of the add/grace period to monopolize names without ever paying for them.

image B. Packets are captured, the pertinent information is extracted, and then packets are placed back on the network.

image C. An attack that typically involves flooding a listening port on a machine with packets to disrupt service.

image D. An attacker intercepts traffic and then tricks the parties at both ends into believing that they are communicating with each other.

Quick Answer: 107

Detailed Answer: 111

8. Which of the following best describes a relay attack?

image A. An attacker takes advantage of the add/grace period to monopolize names without ever paying for them.

image B. Packets are captured, the pertinent information is extracted, and then packets are placed back on the network.

image C. An attack that typically involves flooding a listening port on a machine with packets to disrupt service.

image D. An attacker intercepts traffic and then tricks the parties at both ends into believing that they are communicating with each other.

Quick Answer: 107

Detailed Answer: 111

9. Which of the following best describes a DDoS attack?

image A. An attacker takes advantage of the add/grace period to monopolize names without ever paying for them.

image B. Packets are captured, the pertinent information is extracted, and then packets are placed back on the network.

image C. An attack that typically involves flooding a listening port on a machine with packets to disrupt the resources.

image D. An attacker intercepts traffic and then tricks the parties at both ends into believing that they are communicating with each other.

Quick Answer: 107

Detailed Answer: 111

10. Which of the following best describes DNS kiting?

image A. An attacker takes advantage of the add/grace period to monopolize names without ever paying for them.

image B. Packets are captured, the pertinent information is extracted, and then packets are placed back on the network.

image C. An attack that typically involves flooding a listening port on a machine with packets to disrupt the resources.

image D. An attacker intercepts traffic and then tricks the parties at both ends into believing that they are communicating with each other.

Quick Answer: 107

Detailed Answer: 111

11. Which of the following methods can be used to mitigate DDoS attacks? (Select all correct answers.)

image A. Setting up filters on external routers to drop all ICMP packets

image B. Reducing the amount of time before the reset of an unfinished TCP connection

image C. Increasing the amount of time before the reset of an unfinished TCP connection

image D. Setting up a filter that denies traffic originating from the Internet that shows an internal network address

Quick Answer: 107

Detailed Answer: 111

12. Which of the following best describes the practice of deleting a domain name during the five-day AGP and immediately re-registering it for another five-day period?

image A. TCP/IP hijacking

image B. DNS tasting

image C. DNS kiting

image D. Domain spoofing

Quick Answer: 107

Detailed Answer: 112

13. Which of the following best describes ARP poisoning?

image A. Broadcasting a fake or reply to an entire network

image B. Changing the IP record for a specific domain

image C. Sending fragmented UDP packets

image D. Distributing zombie software

Quick Answer: 107

Detailed Answer: 112

14. Which of the following attacks is associated with services using an interprocess communication share such as network file and print sharing services?

image A. DNS spoofing

image B. Null sessions

image C. ARP poisoning

image D. DNS kiting

Quick Answer: 107

Detailed Answer: 112

15. Which of the following hundreds of ICMP packets have been sent to the host?

image A. DNS spoofing

image B. ARP poisoning

image C. Man-in-the-middle

image D. Denial of service

Quick Answer: 107

Detailed Answer: 112

16. Which of the following type of attacks is most likely being executed when an unauthorized service is relaying information to a source outside the network?

image A. DNS spoofing

image B. ARP poisoning

image C. Man-in-the-middle

image D. Denial of service

Quick Answer: 107

Detailed Answer: 112

17. Which of the following best describes the primary security issue with null sessions?

image A. The sessions are not terminated properly.

image B. The connection is not authenticated.

image C. The connection is not encrypted.

image D. The sessions are remotely controlled.

Quick Answer: 107

Detailed Answer: 112

18. Which of the following is most effective way to reduce null session vulnerability?

image A. Reducing the reset time of an unfinished TCP connection

image B. Using the signing capabilities of certificates

image C. Setting up filters to drop all ICMP packets

image D. Disabling NetBIOS over TCP/IP

Quick Answer: 107

Detailed Answer: 113

19. Which of the following are effective ways to mitigate spoofing attacks? (Select all correct answers.)

image A. Editing the Registry on Windows-based computers to restrict anonymous access

image B. Using IPsec to secure transmissions between critical servers and clients

image C. Denying traffic originating from the Internet that shows an internal network address

image D. Using the signing capabilities of certificates on servers and clients

Quick Answer: 107

Detailed Answer: 113

20. Running which of the following commands is the quickest way to tell which ports are open and which services are running on the machine?

image A. netstat

image B. nbtstat

image C. ipconfig

image D. msconfig

Quick Answer: 107

Detailed Answer: 113

21. Which of the following protocols is used for monitoring the health of network equipment, computer equipment, and devices?

image A. SNAP

image B. SMTP

image C. SDLC

image D. SNMP

Quick Answer: 107

Detailed Answer: 113

22. Which of the following are effective ways to protect the network infrastructure from attacks aimed at antiquated or unused ports and protocols? (Select all correct answers.)

image A. Keeping only protocols installed by default

image B. Allowing traffic only on necessary ports

image C. Removing any unnecessary protocols

image D. Allowing only traffic requested by users

Quick Answer: 107

Detailed Answer: 113

23. Which of the following sessions can typically result in TCP/IP hijacking? (Select all correct answers.)

image A. Telnet

image B. Web

image C. Email

image D. Samba

Quick Answer: 107

Detailed Answer: 113

24. Which of the following is the most effective method to mitigate session hijacking?

image A. Denying traffic originating from the Internet that shows an internal network address

image B. Forcing users to re-authenticate before allowing transactions to occur

image C. Reducing the amount of time before the reset of an unfinished TCP connection

image D. Setting up filters on external routers to drop all incoming ICMP packets

Quick Answer: 107

Detailed Answer: 113

25. When mitigating null session vulnerability, which of the following ports should be closed? (Select all correct answers.)

image A. 161

image B. 162

image C. 139

image D. 445

Quick Answer: 107

Detailed Answer: 114

26. When editing the Registry on Windows-based computers to restrict anonymous access, which of the following key values is restrictive without interfering with application functionality?

image A. 0

image B. 1

image C. 2

image D. 3

Quick Answer: 107

Detailed Answer: 114

27. Which of the following sessions can typically result in a man-in-the-middle attack? (Select all correct answers.)

image A. Telnet

image B. Wireless

image C. Email

image D. Samba

Quick Answer: 107

Detailed Answer: 114

28. Which of the following are issues associated with kited domains? (Select all correct answers.)

image A. Search engines return more-relevant results.

image B. Search engines return less-relevant results.

image C. Capitalization on slight variations of website addresses.

image D. Domain names that legitimate businesses use may be tied up.

Quick Answer: 107

Detailed Answer: 114

29. Which of the following are ways to minimize the effects of DNS poisoning when hosting your own DNS? (Select all correct answers.)

image A. Checking that the hosting server is not open-recursive

image B. Running operating systems from an account with lesser privileges

image C. Using different servers for authoritative and recursive lookups

image D. Disabling recursive access for networks to resolve names that are not in zone files

Quick Answer: 107

Detailed Answer: 114

30. Which of the following are the most effective methods to mitigate ARP poisoning on a large network? (Select all correct answers.)

image A. Using equipment that offers port security

image B. Using static mapping for IP addresses and ARP tables

image C. Using script-based mapping for IP addresses and ARP tables

image D. Deploying monitoring tools or an intrusion detection system (IDS)

Quick Answer: 107

Detailed Answer: 114

Objective 2.2: Distinguish between network design elements and components.

1. The organization requires email traffic in a DMZ segment, which of the following TCP ports will be open? (Select all correct answers.)

image A. 110

image B. 21

image C. 25

image D. 443

Quick Answer: 107

Detailed Answer: 114

2. Which of the following UDP ports must be open to allow SNMP traffic through the router?

image A. 161

image B. 162

image C. 443

image D. 4445

Quick Answer: 107

Detailed Answer: 114

3. Which of the following best describes a demilitarized zone (DMZ)?

image A. A small network between the database servers and file servers

image B. A small network between the internal network and the Internet

image C. A portion of the internal network that uses web-based technologies

image D. A portion of the internal infrastructure used in business-to-business relationships

Quick Answer: 107

Detailed Answer: 114

4. Which of the following best describes a virtual local-area network (VLAN)?

image A. A method to allow multiple computers to connect to the Internet using one IP address

image B. A method to unite network nodes physically into the same broadcast domain

image C. A method to split one network into two using routers to connect them together

image D. A method to unite network nodes logically into the same broadcast domain

Quick Answer: 107

Detailed Answer: 115

5. Which of the following best describes Network Address Translation (NAT)?

image A. A method to allow multiple computers to connect to the Internet using one IP address

image B. A method to unite network nodes physically into the same broadcast domain

image C. A method to split one network into two using routers to connect them together

image D. A method to unite network nodes logically into the same broadcast domain

Quick Answer: 107

Detailed Answer: 115

6. Which of the following best describes subnetting?

image A. A method to allow multiple computers to connect to the Internet using one IP address

image B. A method to unite network nodes physically into the same broadcast domain

image C. A method to split one network into two using routers to connect them together

image D. A method to unite network nodes logically into the same broadcast domain

Quick Answer: 107

Detailed Answer: 115

7. Which of the following is the most important security aspect of using Network Address Translation (NAT)?

image A. It unites network nodes logically into the same broadcast domain.

image B. It hides the internal network from the outside world.

image C. It allows users to be grouped by department rather than location.

image D. It allows external users to access necessary information.

Quick Answer: 107

Detailed Answer: 115

8. Which of the following is the most common reason networks are subnetted?

image A. To allow logical division on the same broadcast domain

image B. To hide the internal network from the outside world

image C. For easier application of security policies

image D. To control network traffic

Quick Answer: 107

Detailed Answer: 116

9. Which of the following private IP address ranges should be used for the internal network when there are 100 host systems?

image A. 10.x.x.x

image B. 172.16.x.x

image C. 192.168.1.x

image D. 224.1.1.x

Quick Answer: 107

Detailed Answer: 116

10. When a client machine receives an IP address of 169.254.0.15, it is an indication of which of the following?

image A. The client cannot contact the DHCP server.

image B. The client has a corrupt routing table.

image C. The client has a manually configured address.

image D. The client cannot contact the DNS server.

Quick Answer: 107

Detailed Answer: 116

11. Automatic Private IP Addressing (APIPA) is denoted by which of the following IP addresses?

image A. 192.168.1.10

image B. 169.254.0.5

image C. 224.223.10.1

image D. 172.16.15.84

Quick Answer: 107

Detailed Answer: 116

12. Which of the following best describes network access control (NAC)?

image A. A method to allow multiple computers to connect to the Internet using one IP address

image B. A method to split one network into two using routers to connect them together

image C. A method to unite network nodes logically into the same broadcast domain

image D. A method of enforcement that helps ensure computers are properly configured

Quick Answer: 107

Detailed Answer: 116

13. Which of the following IP address ranges can be used for the internal network when using NAT? (Select all correct answers.)

image A. 10.x.x.x

image B. 172.16.x.x

image C. 192.168.1.x

image D. 224.1.1.x

Quick Answer: 107

Detailed Answer: 116

14. Which of the following are basic components of NAC? (Select all correct answers.)

image A. Access requestor

image B. Network redirector

image C. Policy enforcement point

image D. Policy decision point

Quick Answer: 107

Detailed Answer: 117

15. Which of the following devices can be a policy enforcement point in NAC? (Select all correct answers.)

image A. Hub

image B. Switch

image C. Firewall

image D. Router

Quick Answer: 107

Detailed Answer: 117

16. Which of the following best describes the NAC method that performs an assessment as hosts come online, and then grants appropriate access?

image A. Inline

image B. Out-of-band

image C. Switch based

image D. Host based

Quick Answer: 107

Detailed Answer: 117

17. Which of the following is a business benefit associated with the use of NAC? (Select all correct answers.)

image A. Compliance

image B. Separation of duties

image C. Improved security posture

image D. Operational cost management

Quick Answer: 107

Detailed Answer: 117

18. Which of the following are ways to mitigate vulnerabilities associated with a PBX? (Select all correct answers.)

image A. Changing any default passwords have been change

image B. Physically securing the area where the PBX resides

image C. Implementing an encryption solution

image D. Putting a data-validation system in place

Quick Answer: 107

Detailed Answer: 117

19. Which of the following type of attacks is associated with the use of a PBX?

image A. Man-in-the-middle

image B. Buffer overflows

image C. Denial of service

image D. Social engineering

Quick Answer: 107

Detailed Answer: 117

20. Which of the following type of attacks are associated with the use of VoIP? (Select all correct answers.)

image A. Man-in-the-middle

image B. Buffer overflows

image C. Denial of service

image D. Social engineering

Quick Answer: 107

Detailed Answer: 118

21. Which of the following is an inherent security risk associated with using SIP as an alternative for VoIP?

image A. It leaves the network open to long-distance toll fraud.

image B. It leaves the network open to war-dialing attacks.

image C. It leaves the network open to unauthorized transport of data.

image D. It leaves the network open to war-driving attacks.

Quick Answer: 107

Detailed Answer: 118

22. Which of the following is an inherent security risk associated with using a PBX?

image A. It leaves the network open to long-distance toll fraud.

image B. It leaves the network open to war-dialing attacks.

image C. It leaves the network open to unauthorized transport of data.

image D. It leaves the network open to war-driving.

Quick Answer: 107

Detailed Answer: 118

23. Which of the following is an inherent security risk associated with using a modem pool?

image A. It leaves the network open to long-distance toll fraud.

image B. It leaves the network open to war-dialing attacks.

image C. It leaves the network open to unauthorized transport of data.

image D. It leaves the network open to war-driving.

Quick Answer: 107

Detailed Answer: 118

24. Which of the following solutions can help mitigate the risks and vulnerabilities associated with VoIP? (Select all correct answers.)

image A. Authentication

image B. Setting the callback features

image C. Data validation

image D. Implementing a firewall solution

Quick Answer: 107

Detailed Answer: 118

25. Which of the following solutions can help mitigate the risks and vulnerabilities associated with modems? (Select all correct answers.)

image A. Authentication

image B. Setting the callback features

image C. Data validation

image D. Implementing a firewall solution

Quick Answer: 107

Detailed Answer: 118

Objective 2.3: Determine the appropriate use of network security tools to facilitate network security.

1. Which of the following are functions of an intrusion detection system? (Select all correct answers.)

image A. Prevent attacks

image B. Analyze data

image C. Identify attacks

image D. Respond to attacks

Quick Answer: 108

Detailed Answer: 119

2. Which of the following best describes the difference between an intrusion detection system and a firewall?

image A. IDSs control the information coming in and out of the network, whereas firewalls actually prevent attacks.

image B. Firewalls control the information coming in and out of the network, whereas IDSs identifies unauthorized activity.

image C. Firewalls control the information coming in and out of the network, whereas IDSs actually prevent attacks.

image D. IDSs control the information coming in and out of the network, whereas firewalls identifies unauthorized activity.

Quick Answer: 108

Detailed Answer: 119

3. Which of the following best describes a host intrusion detection system?

image A. Examines the information exchanged between machines

image B. Attempts to prevent attacks in real time

image C. Controls the information coming in and out of the network

image D. Collects and analyzes data that originates on the local machine

Quick Answer: 108

Detailed Answer: 119

4. Which of the following best describes a network intrusion detection system?

image A. Examines the information exchanged between machines

image B. Attempts to prevent attacks in real time

image C. Controls the information coming in and out of the network

image D. Collects and analyzes data that originates on the local machine

Quick Answer: 108

Detailed Answer: 119

5. Which of the following best describes a network intrusion prevention system?

image A. Examines the information exchanged between machines

image B. Attempts to prevent attacks in real time

image C. Controls the information coming in and out of the network

image D. Collects and analyzes data that originates on the local machine

Quick Answer: 108

Detailed Answer: 119

6. Which of the following best describes an inline NIPS?

image A. Sits inside the network to detect attacks after they occur

image B. Sits outside of the network to detect attacks after they occur

image C. Sits between the network and the Internet

image D. Sits between the protected systems and the rest of the network

Quick Answer: 108

Detailed Answer: 119

7. Which of the following is true when implementing a NIPS? (Select all correct answers.)

image A. The sensors must be placed on domain controllers to function properly.

image B. The sensors must be physically inline to function properly.

image C. It adds single points of failure to the network.

image D. It adds additional redundancy to the network.

Quick Answer: 108

Detailed Answer: 119

8. Which of the following best describes fail-open technology in reference to the implementation of NIPS?

image A. If the device fails, it provides application redundancy.

image B. If the device fails, it will prevents a fire from starting.

image C. If the device fails, it causes a complete network outage.

image D. If the device fails, a complete network outage will be avoided.

Quick Answer: 108

Detailed Answer: 120

9. Which of the following best describes a firewall?

image A. Examines the information exchanged between machines

image B. Attempts to prevent attacks in real time

image C. Controls the information coming in and out of the network

image D. Collects and analyzes data that originates on the local machine

Quick Answer: 108

Detailed Answer: 120

10. Which of the following firewall technologies can distinguish between FTP commands?

image A. Application-level gateway

image B. Circuit-level gateway

image C. Proxy gateway

image D. SOCKS proxy

Quick Answer: 108

Detailed Answer: 120

11. Which of the following best describes a packet-filtering firewall?

image A. Relies on algorithms to process application layer data

image B. Operates at the OSI network layer

image C. Operates at the OSI session layer

image D. Examines traffic for application layer protocols

Quick Answer: 108

Detailed Answer: 120

12. Which of the following best describes a stateful-inspection firewall?

image A. Relies on algorithms to process application layer data

image B. Operates at the OSI network layer

image C. Operates at the OSI session layer

image D. Examines traffic for application layer protocols

Quick Answer: 108

Detailed Answer: 120

13. Which of the following best describes a circuit-level firewall?

image A. Relies on algorithms to process application layer data

image B. Operates at the OSI network layer

image C. Operates at the OSI session layer

image D. Examines traffic for application layer protocols

Quick Answer: 108

Detailed Answer: 120

14. Which of the following best describes an application-level firewall?

image A. Relies on algorithms to process application layer data

image B. Operates at the OSI network layer

image C. Operates at the OSI session layer

image D. Examines traffic for application layer protocols

Quick Answer: 108

Detailed Answer: 121

15. Which of the following are functions of proxy servers? (Select all correct answers.)

image A. Caching

image B. Logging

image C. Addressing

image D. Filtering

Quick Answer: 108

Detailed Answer: 121

16. Which of the following are examples of a bastion host? (Select all correct answers.)

image A. Web server

image B. Email server

image C. Database server

image D. DHCP server

Quick Answer: 108

Detailed Answer: 121

17. Which of the following should be implemented if the organization wants to substantially reduce Internet traffic?

image A. Content filter

image B. Proxy server

image C. Protocol analyzer

image D. Packet-filtering firewall

Quick Answer: 108

Detailed Answer: 121

18. Which of the following should be implemented if the organization wants a simple, good first line of defense?

image A. Content filter

image B. Proxy server

image C. Protocol analyzer

image D. Packet-filtering firewall

Quick Answer: 108

Detailed Answer: 122

19. Which of the following should be implemented if the organization wants to monitor unauthorized transfer of confidential information?

image A. Content filter

image B. Proxy server

image C. Protocol analyzer

image D. Packet-filtering firewall

Quick Answer: 108

Detailed Answer: 122

20. Which of the following should be implemented if the organization wants to troubleshoot network issues?

image A. Content filter

image B. Proxy server

image C. Protocol analyzer

image D. Packet-filtering firewall

Quick Answer: 108

Detailed Answer: 122

21. Which of the following should be implemented if the organization wants to capture proper documentation for forensic investigations and litigation purposes?

image A. Content filter

image B. Proxy server

image C. Protocol analyzer

image D. Packet-filtering

Quick Answer: 108

Detailed Answer: 122

22. Content filtering is integrated at which of the following levels?

image A. Network level

image B. Application level

image C. System kernel level

image D. Operating system level

Quick Answer: 108

Detailed Answer: 123

23. Which of the following is the biggest drawback of using content filtering?

image A. Network bandwidth is reduced.

image B. Daily updates required.

image C. Terminology must be defined.

image D. Opens the system to DoS attacks.

Quick Answer: 108

Detailed Answer: 123

24. Which of the following are functions of a protocol analyzer? (Select all correct answers.)

image A. Monitor for unexpected traffic

image B. Identify unnecessary protocols

image C. Prevent SMTP relay from being exploited

image D. Prevent DoS attacks by unauthorized parties

Quick Answer: 108

Detailed Answer: 123

25. Which of the following is true about the use of content filtering?

image A. It will report all violations identified in one group of applications.

image B. It will report only violations identified in the specified applications.

image C. It will report only violations identified in one application at a time.

image D. It will report all violations identified in all applications.

Quick Answer: 108

Detailed Answer: 123

Objective 2.4: Apply the appropriate network tools to facilitate network security.

1. Which of the following are objectives for the placement of firewalls? (Select all correct answers.)

image A. Identify unnecessary protocols

image B. Allow only traffic that is necessary

image C. Provide notification of suspicious behavior

image D. Monitor unauthorized transfer of information

Quick Answer: 108

Detailed Answer: 123

2. Which of the following is the most likely placement of each firewall when an organization is deploying only two of them?

image A. One behind the DMZ and one between the intranet and the extranet

image B. One in front of the DMZ and one between the intranet and the extranet

image C. One in front of the DMZ and one between the DMZ and the internal network

image D. One in front of the DMZ and one between the financial data and the user data

Quick Answer: 108

Detailed Answer: 124

3. Which of the following best describes the reason packet-filtering firewalls are considered unsecure as compared to other types of firewalls?

image A. They allow packets regardless of communication patterns.

image B. Due to physical placement, they are very accessible.

image C. It is impossible to create a secure password for them.

image D. They can be compromised with very little effort.

Quick Answer: 108

Detailed Answer: 124

4. Which of the following best describes why an organization would implement a proxy service firewall?

image A. To prevent DoS attacks by unauthorized parties

image B. To monitor unauthorized transfer of confidential information

image C. To capture proper documentation for forensic investigations

image D. To prevent user computers from directly accessing the Internet

Quick Answer: 108

Detailed Answer: 124

5. Which of the following best describes what governs the traffic of proxy service firewalls?

image A. Settings

image B. Rules

image C. Policies

image D. Guidelines

Quick Answer: 108

Detailed Answer: 124

6. Which of the following technologies would you implement when setting up a switched network and want to group users by department?

image A. VPN

image B. NAT

image C. VLAN

image D. DMZ

Quick Answer: 108

Detailed Answer: 124

7. Where would an organization place a web server that needs to be accessed by both the employees and by external customers?

image A. VPN

image B. NAT

image C. VLAN

image D. DMZ

Quick Answer: 108

Detailed Answer: 124

8. Which of the following would an organization implement to monitor the internal network and external traffic when the source of recent security breaches is unknown? (Select all correct answers.)

image A. Firewall

image B. Content filter

image C. Host-based IDS

image D. Network-based IDS

Quick Answer: 108

Detailed Answer: 125

9. Which of the following is the most likely placement of a proxy server when a small organization is deploying it for Internet connectivity?

image A. On the internal network

image B. Between the internal network and the Internet

image C. Between the web server and file server

image D. In parallel with IP routers

Quick Answer: 108

Detailed Answer: 125

10. Which of the following is the most likely placement of a proxy server when a small organization is deploying it for content caching?

image A. On the internal network

image B. Between the internal network and the Internet

image C. Between the web server and file server

image D. In parallel with IP routers

Quick Answer: 108

Detailed Answer: 125

11. Which of the following is the most likely placement of a proxy server when a small organization is deploying it both Internet connectivity and web content caching?

image A. On the internal network

image B. Between the internal network and the Internet

image C. Between the web server and file server

image D. In parallel with IP routers

Quick Answer: 108

Detailed Answer: 125

12. Which of the following is the most likely placement of a proxy server when a large organization is deploying it for Internet connectivity?

image A. On the internal network

image B. Between the internal network and the Internet

image C. Between the web server and file server

image D. In parallel with IP routers

Quick Answer: 108

Detailed Answer: 126

13. Which of the following best describes the mechanics of Internet content filtering?

image A. Analyzes data against a database contained in the software

image B. Analyzes data by scanning against a vendor provided rule base

image C. Analyzes data against preset rules contained in the software

image D. Analyzes data by matching against predefined traffic patterns

Quick Answer: 108

Detailed Answer: 126

14. Which of the following would be likely placements of a hardware network Internet content filtering device? (Select all correct answers.)

image A. Behind the proxy/NAT point

image B. On the individual user machines

image C. In a DMZ with public addresses behind a packet-filtering router

image D. Connected to the same network segment as the users monitored

Quick Answer: 108

Detailed Answer: 126

15. Which of the following is the most likely reason to place a proxy server in parallel with IP routers?

image A. To allow for better content caching

image B. To prevent direct access to the Internet

image C. To allow for network load balancing

image D. To prevent unauthorized transfer of data

Quick Answer: 108

Detailed Answer: 126

16. Which of the following are most likely placements of a network protocol analyzer? (Select all correct answers.)

image A. Inline

image B. On the outside of the DMZ

image C. On the outside the Internet router

image D. Between the devices of the traffic capture

Quick Answer: 108

Detailed Answer: 126

17. Which of the following is the most likely placement of placement of a packet-filtering firewall?

image A. In the DMZ, between it and the internal network

image B. On the internal network between servers

image C. Between the Internet and the protected network

image D. Securing the main perimeter

Quick Answer: 108

Detailed Answer: 127

18. Which of the following is the most common unintended consequence when deploying multiple firewalls?

image A. Legitimate traffic gets blocked.

image B. Increased network latency.

image C. Increased attack vector.

image D. Troubleshooting becomes complex.

Quick Answer: 108

Detailed Answer: 127

19. Which of the following is the most likely placement of placement of a proxy service firewall?

image A. In the DMZ, between it and the internal network

image B. On the internal network between servers

image C. Between the Internet and the protected network

image D. Securing the main perimeter

Quick Answer: 108

Detailed Answer: 127

20. Which of the following is the most likely placement of placement of a stateful-inspection firewall?

image A. In the DMZ, between it and the internal network

image B. On the internal network between servers

image C. Between the Internet and the protected network

image D. Securing the main perimeter

Quick Answer: 108

Detailed Answer: 127

Objective 2.5: Explain the vulnerabilities and mitigations associated with network devices.

1. Which of the following best describes privilege escalation?

image A. A default set of user credentials

image B. Data transmitted that can be easily sniffed

image C. Accidental or intentional access to resources

image D. Application code functions allowing unauthorized access

Quick Answer: 108

Detailed Answer: 128

2. Which of the following best describes a back door?

image A. A default set of user credentials

image B. Data transmitted that can be easily sniffed

image C. Accidental or intentional access to resources

image D. Application code functions allowing unauthorized access

Quick Answer: 108

Detailed Answer: 128

3. Which of the following satisfies organizational requirements for password complexity based on best practices?

image A. Derived from common words found in the dictionary

image B. A mixture of character case, numbers, and/or symbols

image C. A random-generated password created by a program

image D. Derived from personal information such as birthdates

Quick Answer: 108

Detailed Answer: 128

4. In a corporate environment, which of the following is most vulnerable to DoS attacks?

image A. Internal user systems

image B. Network resources

image C. Network storage

image D. Internal servers

Quick Answer: 108

Detailed Answer: 128

5. Which of the following best describes a denial-of-service (DoS) attack?

image A. Intentional access to resources not intended for access by the user

image B. Application code functions that allow unauthorized access to network resources

image C. Attempt to block access attempt to block access by overwhelming network availability

image D. Attempt to directly access the resources through unauthorized means

Quick Answer: 108

Detailed Answer: 128

6. Which of the following will reduce the vulnerability of a broadcast packet sniffer readily identifying a WAP?

image A. Requiring WPA2 encryption

image B. Turning off SSID broadcast

image C. Turning off DHCP on the WAP

image D. Restricting access by MAC addresses

Quick Answer: 108

Detailed Answer: 129

7. Which of the following is the best method to mitigate attacks against networking devices and services installed with a default set of user credentials?

image A. Replacing them on an as-needed basis

image B. Replacing them when an attack has been detected

image C. Replacing them with unique strong logon credentials

image D. Replacing them with the same strong logon credential

Quick Answer: 108

Detailed Answer: 129

8. Which of the following are ways to mitigate the vulnerabilities of wireless networks? (Select all correct answers.)

image A. Requiring WPA2 encryption

image B. Turning off SSID broadcast

image C. Turning on DHCP on the WAP

image D. Restricting access by MAC addresses

Quick Answer: 108

Detailed Answer: 129

9. Which of the following is the most common origin of back doors?

image A. Created during application development

image B. Created during system certification

image C. Created during user interface testing

image D. Created during implementation

Quick Answer: 108

Detailed Answer: 129

10. Which of the following should be performed when implementing distributed wireless network configurations spanning multiple buildings or open natural areas?

image A. Land survey

image B. Building inspection

image C. OSHA inspection

image D. Site survey

Quick Answer: 108

Detailed Answer: 130

11. Which of the following is most closely linked to privilege escalation?

image A. SSID broadcast

image B. Application flaws

image C. Application development

image D. Automated attacks

Quick Answer: 108

Detailed Answer: 130

12. Which of the following is most closely linked to packet sniffing?

image A. SSID broadcast

image B. Application flaws

image C. Application development

image D. Automated attacks

Quick Answer: 108

Detailed Answer: 130

13. Which of the following is most closely linked to weak passwords?

image A. SSID broadcast

image B. Application flaws

image C. Application development

image D. Automated attacks

Quick Answer: 108

Detailed Answer: 130

14. Which of the following is most closely linked to back doors?

image A. SSID broadcast

image B. Application flaws

image C. Application development

image D. Automated attacks

Quick Answer: 108

Detailed Answer: 131

15. Which of the following is most closely linked to default accounts?

image A. Network resources

image B. Application flaws

image C. Network credentials

image D. Automated attacks

Quick Answer: 108

Detailed Answer: 131

16. Which of the following is most closely linked to denial of service?

image A. Network resources

image B. SSID broadcast

image C. Network credentials

image D. Application development

Quick Answer: 108

Detailed Answer: 131

17. Which of the following best describes the situation where User A can read User B’s email without specific authorization?

image A. Privilege escalation

image B. Default accounts

image C. Weak passwords

image D. Back door

Quick Answer: 108

Detailed Answer: 132

18. Which of the following best describes the situation where a software designer puts in shortcut entry points to allow rapid code evaluation and testing?

image A. Privilege escalation

image B. Default accounts

image C. Weak passwords

image D. Back door

Quick Answer: 108

Detailed Answer: 132

19. Which of the following attacks are associated with weak passwords? (Select all correct answers.)

image A. Packet sniffing

image B. Automated attacks

image C. Social engineering

image D. Denial of service

Quick Answer: 108

Detailed Answer: 132

20. Which of the following attacks are associated with fringe service industries such as online casinos?

image A. Packet sniffing

image B. Automated attacks

image C. Social engineering

image D. Denial of service

Quick Answer: 108

Detailed Answer: 132

Objective 2.6: Explain the vulnerabilities and mitigations associated with various transmission media.

1. Which of the following is best defense against vampire taps?

image A. Mandatory access control

image B. Logical access control

image C. Physical access control

image D. Network access control

Quick Answer: 109

Detailed Answer: 133

2. Which of the following is the most critical in protecting switched networks?

image A. Mandatory access control

image B. Logical access control

image C. Physical access control

image D. Network access control

Quick Answer: 109

Detailed Answer: 133

3. Which of the following is true with regard to the use of hubs?

image A. Hubs do not provide data isolation between endpoint ports.

image B. Hubs provide data isolation between endpoint ports.

image C. Hubs provide packet forwarding for routable addresses.

image D. Hubs provide copying of packets to a monitoring connection.

Quick Answer: 109

Detailed Answer: 133

4. Which of the following is an inherent security risk associated with using hubs?

image A. They allow any node to manage traffic to and from all other nodes on the same device.

image B. They allow any node to observe data traffic to and from all other nodes on the same device.

image C. They allow any node to examine encryption traffic to and from all other nodes on the same device.

image D. They allow any node to encrypt traffic to and from all other nodes on the same device.

Quick Answer: 109

Detailed Answer: 133

5. In which of the following allows interception of data traffic without a detectable presence on the network?

image A. Keylogger

image B. Back door

image C. Logic bomb

image D. Vampire tap

Quick Answer: 109

Detailed Answer: 134

Objective 2.7: Explain the vulnerabilities and implement mitigations associated with wireless networking.

1. Which of the following best describes a major security issue when implementing WAPs?

image A. WEP is the default encryption.

image B. The SSID is broadcast in plain text.

image C. They are hard to physically locate.

image D. Any node can view the data of another node.

Quick Answer: 109

Detailed Answer: 134

2. Which of the following best describes why data emanation is a security risk in wireless networks? (Select all correct answers.)

image A. It uses 802.1x transmissions that generate detectable radio-frequency signals funneled into one direction.

image B. Sniffing the data may use many solutions to increase the distance over which detection is possible.

image C. Sniffing the data may use many solutions to reduce the distance over which transmission is possible.

image D. It uses 802.1x transmissions that generate detectable radio-frequency signals in all directions.

Quick Answer: 109

Detailed Answer: 134

3. Which of the following is the primary method to mitigate the vulnerabilities associated with communication over an 802.1x wireless link?

image A. Authorization

image B. Authentication

image C. Encryption

image D. Identification

Quick Answer: 109

Detailed Answer: 134

4. Which of the following type of attacks are associated with the use of wireless communication? (Select all correct answers.)

image A. Packet sniffing

image B. Session hijacking

image C. Man-in-the-middle

image D. Spam relaying

Quick Answer: 109

Detailed Answer: 134

5. Which of the best describes why session hijacking is possible in wireless communication?

image A. There is no authorization mechanism.

image B. There is no authentication mechanism.

image C. The authentication mechanism is one-way.

image D. The authorization mechanism is one-way.

Quick Answer: 109

Detailed Answer: 135

6. Which of the following best describes why a man-in-the-middle attack is possible in wireless communication?

image A. The request for connection by the client is a bidirectional open broadcast.

image B. The request for connection by the access point is a bidirectional open broadcast.

image C. The request for connection by the access point is an omnidirectional open broadcast.

image D. The request for connection by the client is an omnidirectional open broadcast.

Quick Answer: 109

Detailed Answer: 135

7. Which of the following best describes war-driving?

image A. Driving around with a laptop system configured to listen for open access points

image B. Dialing a large range of telephone numbers in search of devices that can be exploited

image C. Marking landmarks to indicate the presence of an available access point

image D. Accessing an open public WAP for a monthly fee or commission from the end user

Quick Answer: 109

Detailed Answer: 135

8. Which of the following best describes war-chalking?

image A. Driving around with a laptop system configured to listen for open access points

image B. Dialing a large range of telephone numbers in search of devices that can be exploited

image C. Marking landmarks to indicate the presence of an available access point

image D. Accessing an open public for a monthly fee or commission from the end user

Quick Answer: 109

Detailed Answer: 135

9. Which of the following best describes bluejacking?

image A. Driving around system configured to listen for open access points

image B. Sending broadcast spam from a nearby Bluetooth-enabled device

image C. Deleting data on a Bluetooth device that has opened a connection

image D. Marking landmarks to indicate an available open access point

Quick Answer: 109

Detailed Answer: 135

10. Which of the following best describes bluesnarfing?

image A. Driving around system configured to listen for open access points

image B. Sending broadcast spam from a nearby Bluetooth-enabled device

image C. Deleting data on a Bluetooth device that has opened a connection

image D. Marking landmarks to indicate an available open access point

Quick Answer: 109

Detailed Answer: 135

11. Which of the following is the bandwidth commonly associated with 802.11b communications?

image A. 1.5MBps

image B. 11Mbps

image C. 100Mbps

image D. 19.2Kbps

Quick Answer: 109

Detailed Answer: 136

12. Which of the following best describes a WLAN technology that uses Ethernet protocols?

image A. Wi-Fi

image B. i-Mode

image C. Bluetooth

image D. WAP

Quick Answer: 109

Detailed Answer: 136

13. Which of the following encryption standards currently is the most secure for Wi-Fi connections?

image A. WAP

image B. WPA2

image C. WEP2

image D. WEP

Quick Answer: 109

Detailed Answer: 136

14. Which of the following best describes the situation that allows using reflective tube waveguides such as a Pringle’s can to capture data?

image A. Weak encryption

image B. Session hijacking

image C. War-driving

image D. Data emanation

Quick Answer: 109

Detailed Answer: 136

15. Which of the following best describes the situation that allows a hijacker to wait until the authentication cycle is completed, then generate a signal that causes the client to think it has been disconnected from the access point?

image A. Weak encryption

image B. Session hijacking

image C. War-driving

image D. Data emanation

Quick Answer: 109

Detailed Answer: 136

16. Which of the following best describes what might allow data transacted over an 802.1x wireless link to be passed in clear form?

image A. Weak encryption

image B. Session hijacking

image C. War-driving

image D. Data emanation

Quick Answer: 109

Detailed Answer: 137

17. Which of the following best describes the situation where an attack is aimed at pairing with the attacker’s device for unauthorized access, modification, or deletion of data?

image A. Bluejacking

image B. Bluesnarfing

image C. War-driving

image D. War-chalking

Quick Answer: 109

Detailed Answer: 137

18. Which of the following best describes the situation that allows an attack aimed at the identification of existing wireless networks, the SSID used, and any known WEP keys?

image A. Weak encryption

image B. Session hijacking

image C. War-driving

image D. Data emanation

Quick Answer: 109

Detailed Answer: 137

19. Which of the following best describes the situation where an attack is aimed at generating messages that appear to be from the device itself?

image A. Bluejacking

image B. Bluesnarfing

image C. War-driving

image D. War-chalking

Quick Answer: 109

Detailed Answer: 138

20. In which of the following attacks would the implementation of a rogue AP with stronger signal strength than more remote permanent installations be found?

image A. Weak encryption

image B. Man-in-the-middle

image C. War-driving

image D. Data emanation

Quick Answer: 109

Detailed Answer: 138

21. When a client attempts to make an 802.1x-compliant connection, which of the following best describes how the AP authenticates the client?

image A. Users provide a shared password.

image B. Through hardware token authentication.

image C. Through a basic challenge-response method.

image D. Users provide an identifier along with a password.

Quick Answer: 109

Detailed Answer: 138

22. Using the Temporal Key Integrity Protocol (TKIP) or Wi-Fi Protected Access (WPA/WPA2) standards would be most useful in preventing which of the following attacks?

image A. Weak encryption

image B. Data emanation

image C. Bluejacking

image D. War-driving

Quick Answer: 109

Detailed Answer: 138

23. Which of the following are standard specifications included in the WAP standard?

image A. Wireless Application Environment (WAE)

image B. Wireless Session Layer (WSL)

image C. Wireless Transport Layer Security (WTLS)

image D. Wired Equivalent Privacy (WEP)

Quick Answer: 109

Detailed Answer: 138

24. The Wi-Fi Protected Access standards were developed by the Wi-Fi Alliance to replace which of the following?

image A. DES

image B. WAP

image C. AES

image D. WEP

Quick Answer: 109

Detailed Answer: 139

25. WSL is equivalent to which of the following layers of the OSI model?

image A. Session

image B. Transport

image C. Network

image D. Presentation

Quick Answer: 109

Detailed Answer: 139

Quick-Check Answer Key

Objective 2.1: Differentiate between the different ports & protocols, their respective threats, and mitigation techniques.

1. C

2. A, B

3. C

4. A

5. B

6. D

7. D

8. B

9. C

10. A

11. A, B, D

12. C

13. A

14. B

15. D

16. C

17. B

18. D

19. B, C, D

20. C

21. D

22. B, C

23. A, B

24. B

25. C, D

26. B

27. A, B

28. B, C, D

29. A, C, D

30. A, D

Objective 2.2: Distinguish between network design elements and components.

1. A, C

2. A, B

3. B

4. D

5. A

6. C

7. B

8. D

9. C

10. A

11. B

12. D

13. A, B, C

14. A, C, D

15. B, C, D

16. B

17. A, C, D

18. A, B

19. D

20. A, B, C

21. C

22. A

23. B

24. A, C

25. B, D

Objective 2.3: Determine the appropriate use of network security tools to facilitate network security.

1. B, C, D

2. B

3. D

4. A

5. B

6. D

7. B, C

8. D

9. C

10. A

11. B

12. A

13. C

14. D

15. A, B, C

16. A, B

17. B

18. D

19. A

20. C

21. A

22. D

23. C

24. A, B

25. B

Objective 2.4: Apply the appropriate network tools to facilitate network security.

1. B, C

2. C

3. A

4. D

5. B

6. C

7. D

8. C, D

9. B

10. A

11. B

12. D

13. A

14. A, C, D

15. C

16. A, D

17. C

18. B

19. A

20. D

Objective 2.5: Explain the vulnerabilities and mitigations associated with network devices.

1. C

2. D

3. B

4. B

5. C

6. B

7. C

8. A, B, D

9. A

10. D

11. B

12. A

13. D

14. C

15. C

16. A

17. A

18. D

19. B, C

20. D

Objective 2.6: Explain the vulnerabilities and mitigations associated with various transmission media.

1. C

2. C

3. A

4. B

5. D

Objective 2.7: Explain the vulnerabilities and implement mitigations associated with wireless networking.

1. B

2. D

3. C

4. A, B, C

5. C

6. D

7. A

8. C

9. B

10. C

11. B

12. A

13. B

14. D

15. B

16. A

17. B

18. C

19. A

20. B

21. C

22. A

23. A

24. D

25. A

Answers and Explanations

Objective 2.1: Differentiate between the different ports & protocols, their respective threats, and mitigation techniques.

1. Answer: C. Telnet uses port 23. Answer A is incorrect because port 110 is used for POP3 incoming mail. Answer B is incorrect because port 21 is used for FTP. Port 443 is used by HTTPS; therefore, answer D is incorrect.

2. Answer: A, B. UDP ports 161 and 162 are used by SNMP. Answer C is incorrect because port 443 is used by HTTPS. Answer D is incorrect because port 4445 uses TCP/UDP for service type upnotifyp.

3. Answer: C. TCP/IP hijacking is the term used when an attacker takes control of a session between the server and a client. This can occur due to the TCP three-way handshake. The three-way handshake is the method used to establish and tear down network connections. Answer A is incorrect because it describes spoofing. Spoofing is a method of providing false identity information to gain unauthorized access. Answer B is incorrect because it describes a null session. A null session is a connection without specifying a username or password. Answer D is incorrect because it describes DNS poisoning. DNS poisoning allows a perpetrator to redirect traffic by changing the IP record for a specific domain, thus permitting the attacker to send legitimate traffic anywhere they choose.

4. Answer: A. Spoofing is a method of providing false identity information to gain unauthorized access. Answer B is incorrect because it describes a null session. A null session is a connection without specifying a username or password. Answer C is incorrect because it describes TCP/IP hijacking. TCP/IP hijacking is the term used when an attacker takes control of a session between the server and a client. Answer D is incorrect because it describes DNS poisoning. DNS poisoning allows a perpetrator to redirect traffic by changing the IP record for a specific domain, thus permitting the attacker to send legitimate traffic anywhere they choose.

5. Answer: B. A null session is a connection without specifying a username or password. Answer A is incorrect because it describes spoofing. Spoofing is a method of providing false identity information to gain unauthorized access. Answer C is incorrect because it describes spoofing. TCP/IP hijacking is the term used when an attacker takes control of a session between the server and a client. Answer D is incorrect because it describes DNS poisoning. DNS poisoning allows a perpetrator to redirect traffic by changing the IP record for a specific domain, thus permitting the attacker to send legitimate traffic anywhere they choose.

6. Answer: D. DNS poisoning allows a perpetrator to redirect traffic by changing the IP record for a specific domain. Query results that are forged and returned to the requesting client or recursive DNS query can poison the DNS records, thus permitting the attacker to send legitimate traffic anywhere they choose. Answer A is incorrect because it describes spoofing. Spoofing is a method of providing false identity information to gain unauthorized access. Answer B is incorrect because it describes a null session. A null session is a connection without specifying a username or password. Answer C is incorrect because it describes TCP/IP hijacking. TCP/IP hijacking is the term used when an attacker takes control of a session between the server and a client.

7. Answer: D. The man-in-the-middle attack takes place when an attacker intercepts traffic and then tricks the parties at both ends into believing that they are communicating with each other. Answer A is incorrect; it describes DNS kiting. DNS kiting refers to the practice of taking advantage of the add/grace period (AGP) to monopolize domain names without ever paying for them. Answer B is incorrect; it describes a replay attack. In a replay attack, packets are captured by using sniffers. After the pertinent information is extracted, the packets are placed back on the network. Answer C is incorrect; it describes a denial-of-service attack. The purpose of a DoS attack is to disrupt the resources or services that a user would expect to have access to.

8. Answer: B. In a replay attack, packets are captured by using sniffers. After the pertinent information is extracted, the packets are placed back on the network. Answer A is incorrect; it describes DNS kiting. DNS kiting refers to the practice of taking advantage of the AGP to monopolize domain names without ever paying for them. Answer C is incorrect; it describes a denial-of-service attack. The purpose of a DoS attack is to disrupt the resources or services that a user would expect to have access to. Answer D is incorrect; it describes a man-in-the-middle attack. The man-in-the-middle attack takes place when an attacker intercepts traffic and then tricks the parties at both ends into believing that they are communicating with each other.

9. Answer: C. The purpose of a denial of service (DoS) attack is to disrupt the resources or services that a user would expect to have access to. Answer A is incorrect; it describes DNS kiting. DNS kiting refers to the practice of taking advantage of the AGP to monopolize domain names without ever paying for them. Answer B is incorrect; it describes a replay attack. In a replay attack, packets are captured by using sniffers. After the pertinent information is extracted, the packets are placed back on the network. Answer D is incorrect; it describes a man-in-the-middle attack. The man-in-the-middle attack takes place when an attacker intercepts traffic and then tricks the parties at both ends into believing that they are communicating with each other.

10. Answer: A. DNS kiting refers to the practice of taking advantage of the AGP to monopolize domain names without ever paying for them. Answer B is incorrect; it describes a replay attack. In a replay attack, packets are captured by using sniffers. After the pertinent information is extracted, the packets are placed back on the network. Answer C is incorrect; it describes a denial-of-service attack. The purpose of a DoS attack is to disrupt the resources or services that a user would expect to have access to. Answer D is incorrect; it describes a man-in-the-middle attack. The man-in-the-middle attack takes place when an attacker intercepts traffic and then tricks the parties at both ends into believing that they are communicating with each other.

11. Answer: A, B, D. To help protect your network, you can set up filters on external routers to drop packets involved in these types of attacks. You should also set up another filter that denies traffic originating from the Internet that shows an internal network address. If the operating system allows it, reduce the amount of time before the reset of an unfinished TCP connection. Doing so makes it harder to keep resources unavailable for extended periods of time. Answer C is incorrect; increasing the amount of time before the reset of an unfinished TCP connection makes the resources unavailable for a longer period of time.

12. Answer: C. DNS kiting refers to the practice of taking advantage of the AGP to monopolize domain names without ever paying for them. How domain kiting works is that a domain name is deleted during the five-day AGP and immediately re-registered for another five-day period. Answer A is incorrect. TCP/IP hijacking is the term used when an attacker takes control of a session between the server and a client. Answer B is incorrect. Besides automatically registering domain names and placing advertising, domain kiters can track the amount of revenue generated. This is called domain tasting. It is used to test the profitability of domain names. Answer D is incorrect. Spoofing is a method of providing false identity information to gain unauthorized access.

13. Answer: A. Because ARP does not require any type of validation, as ARP requests are sent, the requesting devices believe that the incoming ARP replies are from the correct devices. This can allow a perpetrator to trick a device into thinking any IP is related to any MAC address. Answer B is incorrect because it describes DNS poisoning. Answer C is incorrect. A Teardrop attack sends fragmented UDP packets. Answer D is incorrect. In a DDoS attack, the attacker distributes zombie software that allows the attacker partial or full control of the infected computer system.

14. Answer: B. A null session is a connection without specifying a username or password. Null sessions are a possible security risk because the connection is not really authenticated. Answer A is incorrect because spoofing involves modifying the source address of traffic or source of information. Answer C is incorrect because ARP poisoning allows a perpetrator to trick a device into thinking that an incorrect IP address is related to a MAC address. The implementation of the ARP protocol is simple. The receipt of an ARP reply at any time causes the receiving computer to add the newly received information to its ARP cache without any type of verification. Answer D is incorrect because domain kiting refers to the practice of taking advantage of this AGP period to monopolize domain names without ever paying for them.

15. Answer: D. A denial-of-service (DoS) attack that attempts to block service or reduce activity on a host by sending ping requests directly to the victim using ICMP is called a ping flood. Answer A is incorrect because spoofing involves modifying the source address of traffic or source of information. Answer C is incorrect because a man-in-the middle attack is commonly used to gather information in transit between two hosts. Answer B is incorrect because the purpose of a DoS attack is to disrupt the resources or services that a user would expect to have access to.

16. Answer: C. A man-in-the-middle attack is commonly used to gather information in transit between two hosts. Answer A is incorrect because spoofing involves modifying the source address of traffic or source of information. ARP poisoning allows a perpetrator to trick a device into thinking any IP is related to any MAC address; therefore, Answer B is incorrect. Because the purpose of a DoS attack is to deny use of resources or services to legitimate users, answer D is incorrect.

17. Answer: B. A null session is a connection without specifying a username or password. Null sessions are a possible security risk because the connection is not really authenticated. Answer A is incorrect because the session is not abnormally terminated. Although answer C may be a concern, it is not the primary issue. Answer D is incorrect because null sessions are direct connections and are not remote controlled.

18. Answer: D. The most effective way to reduce null session vulnerability is by disabling NetBIOS over TCP/IP. Editing the Registry to restrict anonymous access is another method used to control null session access. After you have done this, verify that ports 139 and 445 are closed. Answer A is incorrect; reducing the amount of time before the reset of an unfinished TCP connection deals with DoS attacks. Answers B and C are incorrect; using the signing capabilities of certificates and denying traffic originating from the Internet that shows an internal network address are protective measures against spoofing.

19. Answer: B, C, D. To mitigate the effects of spoofing, you should set up a filter that denies traffic originating from the Internet that shows an internal network address. Using the signing capabilities of certificates on servers and clients allows web and email services to be more secure. The use of IPsec can secure transmissions between critical servers and clients. Answer A is incorrect because editing the Registry to restrict anonymous access is a method used to control null session access.

20. Answer: A. The quickest way to tell which ports are open and which services are running is to do a netstat operation on the machine. Answer B is incorrect; nbtstat is designed to help troubleshoot NetBIOS name resolution problems. Answer C is incorrect; ipconfig is used to troubleshoot IP address configuration. Answer D is incorrect; msconfig is used to configure startup services and on Windows computers.

21. Answer: D. SNMP is used for monitoring the health of network equipment, computer equipment, and devices like uninterruptible power supplies (UPS). Answer A is incorrect because SubNetwork Access Protocol (SNAP) defines how data is formatted for transmission and how access to the network is controlled. Answer B is incorrect because SMTP is used for email. Answer C is incorrect because The Synchronous Data Link Control (SDLC) protocol was developed by IBM to be used as the Layer 2 of the SNA hierarchical network.

22. Answer: B, C. The best way to protect the network infrastructure from attacks aimed at antiquated or unused ports and protocols is to remove any unnecessary protocols and create access control lists to allow traffic on necessary ports only. By doing so, you eliminate the possibility of unused and antiquated protocols being exploited and minimize the threat of an attack. Answer A is incorrect. It is not always necessary to keep protocols installed by default. Answer D is incorrect. Users should never control what goes in and out of the network.

23. Answer: A, B. TCP/IP hijacking commonly happens during Telnet and web sessions where security is lacking or when session timeouts are not configured properly. Answer C is incorrect because email is susceptible to spoofing not hijacking. Answer D is incorrect. Samba provides file and print services to SMB/CIFS clients for Linux-based operating systems.

24. Answer: B. Forcing a user to re-authenticate before allowing transactions to occur could help prevent this type of attack. Protection mechanisms include the use of unique initial sequence numbers (ISNs) and web session cookies. Answer A is incorrect because to mitigate the effects of spoofing, you should set up a filter that denies traffic originating from the Internet that shows an internal network address. Answers C and D are incorrect; to mitigate the vulnerability of DDoS attacks, reduce the amount of time before the reset of an unfinished TCP connection and set up filters on external routers.

25. Answer: C, D. The most effective way to reduce null session vulnerability is by disabling NetBIOS over TCP/IP. After you have this, verify that ports 139 and 445 are closed. Answers A and B are incorrect; Simple Network Management Protocol (SNMP) is often overlooked when checking for vulnerabilities because it uses User Datagram Protocol (UDP) ports 161 and 162.

26. Answer: B. The key default value is 0. Changing this value to 1, which is more restrictive, keeps a null session from seeing user accounts and admin shares. Changing the value to 2 is the most restrictive. This disables null session without explicit permissions. However, this setting may conflict with some applications that rely on null sessions. Keep in mind that even though you can change the Registry settings to try to prevent this type of attack, some tools sidestep this measure. If security is a major concern, you might have to consider not allowing any null sessions on your public and private networks. Based on this information, answers A, C, and D are incorrect.

27. Answer: A, B. The man-in-the-middle attack takes place when an attacker intercepts traffic and then tricks the parties at both ends into believing that they are communicating with each other. This attack is common in Telnet and wireless technologies. Answer C is incorrect because email is susceptible to spoofing not hijacking. Answer D is incorrect. Samba provides file and print services to SMB/CIFS clients for Linux-based operating systems.

28. Answer: B, C, D. Kited domains present several issues. They force search engines to return less-relevant results, tie up domain names that legitimate businesses may want to use, and capitalize on slight variations of personal or business website addresses. Answer A is incorrect; kiting has just opposite effect.

29. Answer: A, C, D. To minimize the effects of DNS poisoning, check the DNS setup if you are hosting your own DNS. Be sure the DNS server is not open-recursive. An open-recursive DNS server responds any lookup request, without checking where it originates. Disable recursive access for other networks to resolve names that are not in your zone files. You can also use different servers for authoritative and recursive lookups and require that caches discard information except from the .com servers, and the root servers. Answer B is incorrect because it describes an effective way to deal with rootkits.

30. Answer: A, D. ARP poisoning is limited to attacks that are local based, so an intruder needs either physical access to your network or control of a device on your local network. To mitigate ARP poisoning on a small network, you can use static or script-based mapping for IP addresses and ARP tables. For large networks, use equipment that offers port security. Answers B and C are incorrect; they are solutions for small networks, not large networks.

Objective 2.2: Distinguish between network design elements and components.

1. Answer: A, C. Port 110 is used for POP3 incoming mail and port 25 is used for SMTP mail. Answer B is incorrect because port 21 is used for FTP. Port 443 is used by HTTPS; therefore, answer D is incorrect.

2. Answer: A, B. UDP ports 161 and 162 are used by SNMP. Answer C is incorrect because port 443 is used by HTTPS. Answer D is incorrect because port 4445 uses TCP/UDP for service type upnotifyp.

3. Answer: B. A demilitarized zone (DMZ) is a small network between the internal network and the Internet that provides a layer of security and privacy. Answer A is incorrect it describes a separate subnetwork. Answer C is incorrect because it describes an intranet. An intranet is a portion of the internal network that uses web-based technologies. The information is stored on web servers and accessed using browsers. Answer D is incorrect because it describes an extranet. An extranet is the public portion of the company’s IT infrastructure that allows resources to be used by authorized partners and resellers that have proper authorization and authentication. This type of arrangement is commonly used for business-to-business relationships.

4. Answer: D. The purpose of a virtual local-area network (VLAN) is to unite network nodes logically into the same broadcast domain regardless of their physical attachment to the network. VLANs provide a way to limit broadcast traffic in a switched network. Answer A is incorrect because it describes NAT, which allows multiple computers to connect to the Internet using one IP address. Answer B is incorrect; a switch is used to unite network nodes physically into the same broadcast domain. Answer C is incorrect because subnetting splits one network into two or more, using routers to connect each subnet.

5. Answer: A. NAT allows multiple computers to connect to the Internet using one IP address. Answer B is incorrect; a switch is used to unite network nodes physically into the same broadcast domain Answer C is incorrect because subnetting splits one network into two or more, using routers to connect each subnet. Answer D is incorrect because the purpose of a virtual local-area network (VLAN) is to unite network nodes logically into the same broadcast domain regardless of their physical attachment to the network. VLANs provide a way to limit broadcast traffic in a switched network.

6. Answer: C. Subnetting splits one network into two or more, using routers to connect each subnet. Answer A is incorrect. NAT allows multiple computers to connect to the Internet using one IP address. Answer B is incorrect; a switch is used to unite network nodes physically into the same broadcast domain. Answer D is incorrect because the purpose of a virtual local-area network (VLAN) is to unite network nodes logically into the same broadcast domain regardless of their physical attachment to the network. VLANs provide a way to limit broadcast traffic in a switched network.

7. Answer: B. Network Address Translation (NAT) acts as a liaison between an internal network and the Internet. It allows multiple computers to connect to the Internet using one IP address. An important security aspect of NAT is that it hides the internal network from the outside world. Answers A and C are incorrect because the purpose of a virtual local-area network (VLAN) is to unite network nodes logically into the same broadcast domain regardless of their physical attachment to the network. VLANs provide a way to limit broadcast traffic in a switched network. Answer D is incorrect; a DMZ allows external users to access information that the organization deems necessary.

8. Answer: D. Subnetting can be done for several reasons. If you have a Class C address and 1,000 clients, you will have to subnet the network or use a custom subnet mask to accommodate all the hosts. The most common reason networks are subnetted is to control network traffic by limiting broadcast domains, which limits broadcast storms. Answers A and C are incorrect because the purpose of a virtual local-area network (VLAN) is to unite network nodes logically into the same broadcast domain regardless of their physical attachment to the network. VLANs provide a way to limit broadcast traffic in a switched network. Answer B is incorrect; an important security aspect of NAT is that it hides the internal network from the outside world.

9. Answer: C. There are specific reserved private IP addresses for use on an internal network. In a Class C network, valid nonroutable host IDs are from 192.168.0.1 to 192.168.255.254. Network addresses with the first byte between 192 and 223 are Class C and can have about 250 hosts. Answer A is incorrect because it is a Class A address. Valid host IDs are from 10.0.0.1 to 10.255.255.254. Network addresses with the first byte between 1 and 126 are Class A and can have about 17 million hosts each. Answer B is incorrect because it is a Class B addresses; valid host IDs are from 172.16.0.1 through 172.31.255.254. Network addresses with the first byte between 128 and 191 are Class B and can have about 65,000 hosts each. Answer D is incorrect because network addresses with the first byte between 224 and 239 are Class D and are used for multicasting.

10. Answer: A. Another address range to keep in mind when designing IP address space is Automatic Private IP Addressing (APIPA). In the event that no Dynamic Host Configuration Protocol (DHCP) server is available at the time that the client issues a DHCP lease request, the client is automatically configured with an address from the 169.254.0.1 through 169.254.255.254 range. Answer B is incorrect because if the client has a corrupt routing table will not be able to reach the proper destination. Answer C is incorrect because if the client has a manually configured address it is not usually in the 169.254.x.x address range. If the client cannot contact the DNS server, the message displayed is “Cannot contact DNS server, therefore Answer D is incorrect.”

11. Answer: B. In the event that no Dynamic Host Configuration Protocol (DHCP) server is available at the time that the client issues a DHCP lease request, the client is automatically configured with an address from the 169.254.0.1 through 169.254.255.254 range. Answer A is incorrect because it is a Class C internal address. Answer C is incorrect because it is a Class D address. Answer D is incorrect because it is a Class B internal address.

12. Answer: D. One of the most effective ways to protect the network from malicious hosts is to use network access control (NAC). NAC offers a method of enforcement that helps ensure that computers are properly configured. The premise behind NAC is to secure the environment by examining the user’s machine and, based on the results, grant access accordingly. Answer A is incorrect because it describes the function of NAT. Answer B is incorrect because it describes the function of subnetting. Answer C is incorrect because it describes the function of a VLAN.

13. Answer: A, B, C. In a Class C network, valid nonroutable host IDs are from 192.168.0.1 to 192.168.255.254. Network addresses with the first byte between 192 and 223 are Class C and can have about 250 hosts. Answer A is incorrect because it is a Class A address. Valid host IDs are from 10.0.0.1 to 10.255.255.254. Network addresses with the first byte between 1 and 126 are Class A and can have about 17 million hosts each. Answer B is incorrect because it is a Class B addresses; valid host IDs are from 172.16.0.1 through 172.31.255.254. Network addresses with the first byte between 128 and 191 are Class B and can have about 65,000 hosts each. Answer D is incorrect because network addresses with the first byte between 224 and 239 are Class D and are reserved for multicasting.

14. Answer: A, C, D. The basic components of NAC products are the Access requestor (AR), which is the device that requests access; the policy decision point (PDP), which is the system that assigns a policy based on the assessment; and the policy enforcement point (PEP), which is the device that enforces the policy. Answer B is incorrect. The network redirector, or redirector, is an operating system driver that sends data to and receives data from a remote device.

15. Answer: B, C, D. The policy enforcement point is the device that enforces the policy. This device may be a switch, firewall, or router. Answer A is incorrect; a hub cannot enforce policy.

16. Answer: B. The four ways NAC systems can be integrated into the network are inline, out-of-band, switch based, and host based. An out-of-band intervenes and performs an assessment as hosts come online, and then grants appropriate access. Answer A is incorrect. An appliance in the line usually sits between the access and the distribution switches. Answer C is incorrect. Switch based is similar to in-band NAC except enforcement occurs on the switch itself. Answer D is incorrect. Host based relies on an installed host agent to assess and enforce access policy devices.

17. Answer: A, C, D. In addition to providing the ability to enforce security policy, contain noncompliant users, and mitigate threats, NAC offers a number of business benefits. The business benefits include compliance, a better security posture, and operational cost management. Answer B is incorrect. Separation of duties is one of the key concepts of internal controls. It is not a business benefit. It is the most difficult and sometimes the most costly one to achieve.

18. Answer: A, B. To protect your network, make sure the PBX is in a secure area, any default passwords have been changed, and only authorized maintenance is done. Many times, hackers can gain access to the phone system via social engineering because this device is usually serviced through a remote maintenance port. Answers C and D are incorrect because these are solution associated with mitigating vulnerabilities associated with VoIP.

19. Answer: D. Many times, hackers can gain access to the phone system via social engineering because this device is usually serviced through a remote maintenance port. To protect your network, make sure the Private Branch Exchange (PBX) is in a secure area, any default passwords have been changed, and only authorized maintenance is done. Answer A is incorrect. Man-in-the-middle attacks are executed between the SIP phone and a SIP proxy, allowing the audio to be manipulated, causing dropped, rerouted, or playback calls. Answers B and C are incorrect; they are associated with VoIP. VoIP PBX servers are susceptible to the same type of exploits as other network servers. These attacks include DoS and buffer overflows, with DoS being the most prevalent.

20. Answer: A, B, C. Man-in-the-middle attacks are executed between the SIP phone and a SIP proxy, allowing the audio to be manipulated, causing dropped, rerouted, or playback calls. VoIP PBX servers are susceptible to the same type of exploits as other network servers. These attacks include DoS and buffer overflows, with DoS being the most prevalent. Answer D is incorrect. Many times, hackers can gain access to the phone system via social engineering because this device is usually serviced through a remote maintenance port.

21. Answer: C. Session Initiation Protocol (SIP) is commonly used in instant messaging, but it can also be used as an alternative for VoIP. Using SIP can leave VoIP networks open to unauthorized transport of data. Answer A is incorrect because long-distance toll fraud is associated with a PBX. Answer B is incorrect; war-dialing attacks take advantage of unsecure modems. Answer D is incorrect because war-driving attacks take advantage of wireless networks.

22. Answer: A. For years, PBX-type systems have been targeted by hackers, mainly to get free long-distance service. The vulnerabilities that phone networks are subject to include social engineering, long-distance toll fraud, and breach of data privacy. Answer B is incorrect war-dialing attacks take advantage of unsecure modems. Answer C is incorrect. Session Initiation Protocol (SIP) is commonly used in instant messaging, but it can also be used as an alternative for VoIP. Using SIP can leave VoIP networks open to unauthorized transport of data. Answer D is incorrect. War-driving is used to intercept wireless communications by driving around looking for unsecured wireless networks.

23. Answer: B. Leaving modems open for incoming calls with little to no authentication for users dialing in can be a clear security vulnerability in the network. For example, war-dialing attacks take advantage of this situation. War-dialing is the process by which an automated software application is used to dial numbers in a given range to determine whether any of the numbers are serviced by modems that accept dial-in requests. Answer A is incorrect because long-distance toll fraud is associated with a PBX. Answer C is incorrect; using SIP can leave VoIP networks open to unauthorized transport of data. Answer D is incorrect because war-driving attacks take advantage of wireless networks.

24. Answer: A, C. Implementing the following solutions can help mitigate the risks and vulnerabilities associated with VoIP: encryption, authentication, data validation, and nonrepudiation. VoIP is basically based on a TCP/IP network, and Therefore, technologies that are used to secure IP networks can be used for VoIP, too. Answer B is incorrect because callback features are associated with the use of modems. Answer D is incorrect because encryption and firewall solutions are associated with the use of cable modems.

25. Answer: B, D. Setting the callback features to have the modem call the user back at a preset number and using encryption and firewall solutions will help keep the environment safe from attacks. Answers A and C are incorrect; implementing encryption, authentication, data validation, and nonrepudiation can help mitigate the risks and vulnerabilities associated with VoIP.

Objective 2.3: Determine the appropriate use of network security tools to facilitate network security.

1. Answer: B, C, D. The three basic areas of hardening are operating system, network, and application intrusion detection systems are designed to analyze data, identify attacks, and respond to the intrusion. Answer A is incorrect because preventing attacks is associated with an intrusion prevention system.

2. Answer: B. IDSs are different from firewalls in that firewalls control the information that gets in and out of the network, whereas IDSs can identify unauthorized activity. IDSs are also designed to catch attacks in progress within the network, not just on the boundary between private and public networks. Intrusion prevention differs from intrusion detection in that it actually prevents attacks instead of only detecting the occurrence of an attack. Based on this information, answers A, C, and D are incorrect.

3. Answer: D. A HIDS collects and analyzes data that originates on the local machine. Answer A is incorrect; a NIDS tries to locate packets not allowed on the network that the firewall missed and looks at the information exchanged between machines. Answer B is incorrect; intrusion prevention differs from intrusion detection in that it actually prevents attacks in real time instead of only detecting the occurrence. Answer C is incorrect because firewalls control the information that gets in and out of the network.

4. Answer: A. A NIDS tries to locate packets not allowed on the network that the firewall missed and looks at the information exchanged between machines. Answer B is incorrect; intrusion prevention differs from intrusion detection in that it actually prevents attacks in real time instead of only detecting the occurrence. Answer C is incorrect because firewalls control the information that gets in and out of the network. Answer D is incorrect; a HIDS collects and analyzes data that originates on the local machine.

5. Answer: B. Intrusion prevention differs from intrusion detection in that it actually prevents attacks in real time instead of only detecting the occurrence. Answer A is incorrect; a NIDS tries to locate packets not allowed on the network that the firewall missed and looks at the information exchanged between machines. Answer C is incorrect because firewalls control the information that gets in and out of the network. Answer D is incorrect; a HIDS collects and analyzes data that originates on the local machine.

6. Answer: D. An inline NIPS works like a Layer 2 bridge. It sits between the systems that need to be protected and the rest of the network. They proactively protect machines against damage from attacks that signature-based technologies cannot detect, as most NIPS solutions have the ability to look at application layer protocols such as HTTP, FTP, and SMTP. Answers A and B are incorrect because a NIPS detects attacks as they are occurring not after they occur. This is more of a function of an IDS. Answer C is incorrect because it describes a firewall.

7. Answer: B, C. When implementing a NIPS, keep in mind that the sensors must be physically inline to function properly. This adds single points of failure to the network. Answer A is incorrect because sensors are not placed on domain controllers. Answer D is incorrect because the sensors add single points of failure to the network, not redundancy.

8. Answer: D. When implementing a NIPS, keep in mind that the sensors must be physically inline to function properly. This adds single points of failure to the network. A good way to prevent this issue is to use fail-open technology. This means that if the device fails, it does not cause a complete network outage; instead, it acts like a patch cable. Answer A is incorrect because fail open has nothing to do with application redundancy. Answer B is incorrect; a NIPS fail-open has nothing to do with fire. Answer C is incorrect because it does not cause a complete network outage; instead, it acts like a patch cable.

9. Answer: C. A firewall is a component placed on computers and networks to help eliminate undesired access by the outside world. It can be composed of hardware, software, or a combination of both. Answer A is incorrect; a NIDS tries to locate packets not allowed on the network that the firewall missed and looks at the information exchanged between machines. Answer B is incorrect because intrusion prevention actually prevents attacks in real time instead of only detecting the occurrence. Answer D is incorrect; a HIDS collects and analyzes data that originates on the local machine.

10. Answer: A. An application-level gateway understands services and protocols. Answer C is too generic to be a proper answer. Answer B is incorrect because a circuit-level gateway’s decisions are based on source and destination addresses. Answer D is incorrect because SOCKS proxy is an example of a circuit-level gateway.

11. Answer: B. A packet-filtering firewall is typically a router. Packets can be filtered based on IP addresses, ports, or protocols. They operate at the network layer (Layer 3) of the OSI model. Packet-filtering solutions are generally considered less-secure firewalls because they still allow packets inside the network, regardless of communication pattern within the session. Answer A is incorrect because it describes the function of a stateful- inspection firewall. A stateful-inspection firewall is a combination of all types of firewalls. This firewall relies on algorithms to process application layer data. Answer C is incorrect; a circuit-level gateway operates at the OSI session layer (Layer 5) by monitoring the TCP packet flow to determine whether the session requested is a legitimate one. Answer D is incorrect. With an application-level gateway, all traffic is examined to check for OSI application layer (Layer 7) protocols that are allowed. Examples of this type of traffic are File Transfer Protocol (FTP), Simple Mail Transfer Protocol (SMTP), and Hypertext Transfer Protocol (HTTP).

12. Answer: A. A stateful-inspection firewall is a combination of all types of firewalls. This firewall relies on algorithms to process application layer data. Answer B is incorrect. A packet-filtering firewall is typically a router. Packets can be filtered based on IP addresses, ports, or protocols. They operate at the network layer (Layer 3) of the OSI model. Packet-filtering solutions are generally considered less-secure firewalls because they still allow packets inside the network, regardless of communication pattern within the session. Answer C is incorrect; a circuit-level gateway operates at the OSI session layer (Layer 5) by monitoring the TCP packet flow to determine whether the session requested is a legitimate one. Answer D is incorrect. With an application-level gateway, all traffic is examined to check for OSI application layer (Layer 7) protocols that are allowed. Examples of this type of traffic are File Transfer Protocol (FTP), Simple Mail Transfer Protocol (SMTP), and Hypertext Transfer Protocol (HTTP).

13. Answer: C. A circuit-level gateway operates at the OSI session layer (Layer 5) by monitoring the TCP packet flow to determine whether the session requested is a legitimate one. Answer A is incorrect. A stateful-inspection firewall is a combination of all types of firewalls. This firewall relies on algorithms to process application layer data. Answer B is incorrect; a packet-filtering firewall is typically a router. Packets can be filtered based on IP addresses, ports, or protocols. They operate at the network layer (Layer 3) of the OSI model. Packet-filtering solutions are generally considered less-secure firewalls because they still allow packets inside the network, regardless of communication pattern within the session. Answer D is incorrect. With an application-level gateway, all traffic is examined to check for OSI application layer (Layer 7) protocols that are allowed. Examples of this type of traffic are File Transfer Protocol (FTP), Simple Mail Transfer Protocol (SMTP), and Hypertext Transfer Protocol (HTTP).

14. Answer: D. With an application-level gateway, all traffic is examined to check for OSI application layer (Layer 7) protocols that are allowed. Examples of this type of traffic are File Transfer Protocol (FTP), Simple Mail Transfer Protocol (SMTP), and Hypertext Transfer Protocol (HTTP). Answer A is incorrect. A stateful-inspection firewall is a combination of all types of firewalls. This firewall relies on algorithms to process application layer data. Answer B is incorrect. A packet-filtering firewall is typically a router. Packets can be filtered based on IP addresses, ports, or protocols. They operate at the network layer (Layer 3) of the OSI model. Packet-filtering solutions are generally considered less-secure firewalls because they still allow packets inside the network, regardless of communication pattern within the session. Answer C is incorrect; a circuit-level gateway operates at the OSI session layer (Layer 5) by monitoring the TCP packet flow to determine whether the session requested is a legitimate one.

15. Answer: A, B, D. Proxy servers are used for security, logging, and caching. When the proxy server receives a request for an Internet service, it passes through filtering requirements and checks its local cache of previously downloaded web pages. Answer C is incorrect. Addressing is a function of a DHCP server.

16. Answer: A, B. An exposed server that provides public access to a critical service, such as a web or email server, may be configured to isolate it from an organization’s network and to report attack attempts to the network administrator. Such an isolated server is referred to as a bastion host, named for the isolated towers that were used to provide castles advanced notice of pending assault. Answer C is incorrect. Database servers are generally contained on the internal network. Answer D is incorrect. DHCP servers give out IP addresses on the internal network.

17. Answer: B. When a proxy server receives a request for an Internet service, it passes through filtering requirements and checks its local cache of previously downloaded web pages. Because web pages are stored locally, response times for web pages are faster, and traffic to the Internet is substantially reduced. Answer A is incorrect. Internet content filters use a collection of terms, words, and phrases that are compared to content from browsers and applications. This type of software can filter content from various types of Internet activity and applications, such as instant messaging, email, and office documents. It can be used to monitor and stop the disclosure of the organization’s proprietary or confidential information. Answer C is incorrect. Protocol analyzers help you troubleshoot network issues by gathering packet-level information across the network. These applications capture packets and decode the information into readable data for analysis. Answer D is incorrect; a packet-filtering firewall filters packets based on IP addresses, ports, or protocols and is a simple, good first line of defense.

18. Answer: D. A packet-filtering firewall filters packets based on IP addresses, ports, or protocols and is a simple, good first line of defense. Answer A is incorrect. Internet content filters use a collection of terms, words, and phrases that are compared to content from browsers and applications. This type of software can filter content from various types of Internet activity and applications, such as instant messaging, email, and office documents. It can be used to monitor and stop the disclosure of the organization’s proprietary or confidential information. Answer B is incorrect. When a proxy server receives a request for an Internet service, it passes through filtering requirements and checks its local cache of previously downloaded web pages. Because web pages are stored locally, response times for web pages are faster, and traffic to the Internet is substantially reduced. Answer C is incorrect. Protocol analyzers help you troubleshoot network issues by gathering packet-level information across the network. These applications capture packets and decode the information into readable data for analysis.

19. Answer: A. Internet content filters use a collection of terms, words, and phrases that are compared to content from browsers and applications. This type of software can filter content from various types of Internet activity and applications, such as instant messaging, email, and office documents. It can be used to monitor and stop the disclosure of the organization’s proprietary or confidential information. Answer B is incorrect. When a proxy server receives a request for an Internet service, it passes through filtering requirements and checks its local cache of previously downloaded web pages. Because web pages are stored locally, response times for web pages are faster, and traffic to the Internet is substantially reduced. Answer C is incorrect. Protocol analyzers help you troubleshoot network issues by gathering packet-level information across the network. These applications capture packets and decode the information into readable data for analysis. Answer D is incorrect; a packet-filtering firewall filters packets based on IP addresses, ports, or protocols and is a simple, good first line of defense.

20. Answer: C. Protocol analyzers help you troubleshoot network issues by gathering packet-level information across the network. These applications capture packets and decode the information into readable data for analysis. Answer A is incorrect. Internet content filters use a collection of terms, words, and phrases that are compared to content from browsers and applications. This type of software can filter content from various types of Internet activity and applications, such as instant messaging, email, and office documents. It can be used to monitor and stop the disclosure of the organization’s proprietary or confidential information. Answer B is incorrect. When a proxy server receives a request for an Internet service, it passes through filtering requirements and checks its local cache of previously downloaded web pages. Because web pages are stored locally, response times for web pages are faster, and traffic to the Internet is substantially reduced. Answer D is incorrect; a packet-filtering firewall filters packets based on IP addresses, ports, or protocols and is a simple, good first line of defense.

21. Answer: A. Internet content filters use a collection of terms, words, and phrases that are compared to content from browsers and applications. Because content filtering uses screen captures of each violation with time-stamped data, it provides proper documentation for forensic investigations and litigation purpose. Answer B is incorrect. When a proxy server receives a request for an Internet service, it passes through filtering requirements and checks its local cache of previously downloaded web pages. Because web pages are stored locally, response times for web pages are faster, and traffic to the Internet is substantially reduced. Answer C is incorrect. Protocol analyzers help you troubleshoot network issues by gathering packet-level information across the network. These applications capture packets and decode the information into readable data for analysis. Answer D is incorrect; a packet-filtering firewall filters packets based on IP addresses, ports, or protocols and is a simple, good first line of defense.

22. Answer: D. Content filtering is integrated at the operating system level so that it can monitor events such as opening files via Windows Explorer. It can be used to monitor and stop the disclosure of the organization’s proprietary or confidential information. Based on the previous information, answers A, B, and C are incorrect because content filtering is integrated at the operating system level.

23. Answer: C. Unlike antivirus and antispyware applications, content monitoring does not require daily updates to keep the database effective and current. On the downside, content filtering needs to be “trained.” For example, to filter nonpornographic material, the terminology must be input and defined in the database. Answer A is incorrect because content filtering helps control bandwidth costs. Answer B is incorrect based on the previous stated information. Answer D is incorrect. Packet-filtering solutions are generally considered less-secure firewalls because they still allow packets inside the network, regardless of communication pattern within the session. This leaves the system open to DoS attacks.

24. Answer: A, B. Protocol analyzers can do more than just look at packets. They prove useful in many other areas of network management, such as monitoring the network for unexpected, unwanted, and unnecessary traffic. For example, if the network is running slowly, a protocol analyzer can tell you whether necessary protocols are running on the network. Answers C and D are incorrect; attack prevention is a function of an intrusion prevention system not a protocol analyzer.

25. Answer: B. Content filtering will report only on violations identified in the specified applications listed for the filtering application. In other words, if the application will filter only Microsoft Office documents and a user chooses to use open Office, the content will not be filtered. Based on the above information, answers A, C, and D are incorrect; content filtering will report only on violations identified in the specified applications listed for the filtering application.

Objective 2.4: Apply the appropriate network tools to facilitate network security.

1. Answer: B, C. The main objective for the placement of firewalls is to allow only traffic that the organization deems necessary and provide notification of suspicious behavior. Answer A is incorrect because this is the function of a protocol analyzer. Answer D is incorrect because Internet content filters monitor unauthorized transfer of confidential information.

2. Answer: C. Most organizations deploy, at a minimum, two firewalls. The first firewall is placed in front of the DMZ to allow requests destined for servers in the DMZ or to route requests to an authentication proxy. The second firewall is placed to allow outbound requests. All initial necessary connections are located on the DMZ machines. For example, a RADIUS server may be running in the DMZ for improved performance and enhanced security, even though its database resides inside the company intranet. Answer A is incorrect; the first firewall should be deployed in front of the DMZ, not behind it. Answer B is incorrect; although the extranet would be located in the DMZ, and the intranet is located on the internal network, it is between the DMZ and the internal network where the firewall should be placed. Answer D is incorrect; although you may have a firewall between the user data and financial data, if you are only deploying two, the second one should go between the DMZ and the internal network.

3. Answer: A. A packet-filtering firewall is typically a router. Packets can be filtered based on IP addresses, ports, or protocols. They operate at the Network layer (Layer 3) of the Open Systems Interconnection (OSI) model. Packet-filtering solutions are generally considered less secure firewalls because they still allow packets inside the network, regardless of communication patterns within the session. Answer B is incorrect; all firewalls should be physically secure. Answer C is incorrect because secure passwords for firewalls can easily be created. Answer D is incorrect because compromising a secure router takes quite a bit of effort.

4. Answer: D. Proxy service firewalls are go-betweens for the network and the Internet. They can be used hide the internal addresses from the outside world through NAT. This does not allow the computers on the network to directly access the Internet. Answer A is incorrect because it describes the function of an intrusion detection system. Answers B and C are incorrect because they describe functions associated with an Internet content filtering system not a proxy service firewall.

5. Answer: B. Proxy service firewalls are go-betweens for the network and the Internet. They hide the internal addresses from the outside world and don’t allow the computers on the network to directly access the Internet. This type of firewall has a set of rules that the packets must pass to get in or out. Because the firewall check traffic against a set of rules, setting, policies and guidelines are incorrect. Therefore, answers A, C, and D are incorrect.

6. Answer: C. The purpose of a VLAN is to unite network nodes logically into the same broadcast domain regardless of their physical attachment to the network. Answer A is incorrect because a virtual private network (VPN) is a network connection that allows you access via a secure tunnel created through an Internet connection. Answer B is incorrect because NAT acts as a liaison between an internal network and the Internet. Answer D is incorrect because a DMZ is a small network between the internal network and the Internet that provides a layer of security and privacy.

7. Answer: D. A DMZ is a small network between the internal network and the Internet that provides a layer of security and privacy. Answer A is incorrect because a virtual private network (VPN) is a network connection that allows you access via a secure tunnel created through an Internet connection. Answer B is incorrect because NAT acts as a liaison between an internal network and the Internet. Answer C is incorrect. The purpose of a VLAN is to unite network nodes logically into the same broadcast domain regardless of their physical attachment to the network.

8. Answer: C, D. Because you want to monitor both types of traffic, the IDSs should be used together. Network-based intrusion detection systems monitor the packet flow and try to locate packets that are not allowed for one reason or another and may have gotten through the firewall. Host-based intrusion detection systems monitor communications on a host-by-host basis and try to filter malicious data. These types of IDSs are good at detecting unauthorized file modifications and user activity. A firewall protects computers and networks from undesired access by the outside world; therefore, answer A is incorrect. Answer B is incorrect because Internet content filters use a collection of terms, words, and phrases that are compared to content from browsers and applications. Because content filtering uses screen captures of each violation with time-stamped data, it provides proper documentation for forensic investigations and litigation purpose.

9. Answer: B. Proxy servers can be placed between the private network and the Internet for Internet connectivity. If the organization is using the proxy server for both Internet connectivity and web content caching, the proxy server should be placed between the internal network and the Internet, with access for users who are requesting the web content. Answer A is incorrect; proxy servers are usually placed internally for web content caching. Answer C is incorrect. A firewall is usually placed between a web server and an internal file server. Answer D is incorrect. In some proxy server designs, such as for a large organization, the proxy server is placed in parallel with IP routers. This design allows for network load balancing by forwarding of all HTTP and FTP traffic through the proxy server and all other IP traffic through the router.

10. Answer: A. Proxy servers are usually placed internally for web content caching. Answer B is incorrect; Proxy servers can be placed between the private network and the Internet for Internet connectivity. If the organization is using the proxy server for both Internet connectivity and web content caching, the proxy server should be placed between the internal network and the Internet, with access for users who are requesting the web content. Answer C is incorrect. A firewall is usually placed between a web server and an internal file server. Answer D is incorrect. In some proxy server designs, such as for a large organization, the proxy server is placed in parallel with IP routers. This design allows for network load balancing by forwarding of all HTTP and FTP traffic through the proxy server and all other IP traffic through the router.

11. Answer: B. Proxy servers can be placed between the private network and the Internet for Internet connectivity. If the organization is using the proxy server for both Internet connectivity and web content caching, the proxy server should be placed between the internal network and the Internet, with access for users who are requesting the web content. Answer A is incorrect; proxy servers are usually placed internally for web content caching. Answer C is incorrect. A firewall is usually placed between a web server and an internal file server. Answer D is incorrect. In some proxy server designs, such as for a large organization, the proxy server is placed in parallel with IP routers. This design allows for network load balancing by forwarding of all HTTP and FTP traffic through the proxy server and all other IP traffic through the router.

12. Answer: D. In some proxy server designs, such as for a large organization, the proxy server is placed in parallel with IP routers. This design allows for network load balancing by forwarding of all HTTP and FTP traffic through the proxy server and all other IP traffic through the router. Answer A is incorrect; proxy servers are usually placed internally for web content caching. Answer C is incorrect. A firewall is usually placed between a web server and an internal file server. Answer B is incorrect. Proxy servers can be placed between the private network and the Internet for Internet connectivity. If the organization is using the proxy server for both Internet connectivity and web content caching, the proxy server should be placed between the internal network and the Internet, with access for users who are requesting the web content.

13. Answer: A. Internet content filtering works by analyzing data against a database contained in the software. Content filtering reports only on violations identified in the specified applications listed for the filtering application. In other words, if the application will only filter Microsoft Office documents and a user chooses to use Open Office, the content will not be filtered. Answers B and C are incorrect; they describe functions associated with firewalls. Answer D is incorrect; analyzing traffic patterns is associated with an intrusion detection systems.

14. Answer: A, C, D. Network Internet content filters can be hardware or software. Many network solutions combine both. Hardware appliances are usually connected to the same network segment as the users they will monitor. Other configurations include being deployed behind a firewall or in a DMZ, with public addresses behind a packet-filtering router. These appliances use access control filtering software on the dedicated filtering appliance. The device monitors every packet of traffic that passes over a network. Answer B is incorrect; network Internet content filters would not be placed on the individual systems. If this were true, they would become host-based content filters.

15. Answer: C. In some proxy server designs, the proxy server is placed in parallel with IP routers. This design allows for network load balancing by forwarding of all HTTP and FTP traffic through the proxy server and all other IP traffic through the router. Answer A is incorrect; proxy servers are usually placed internally for content caching not in parallel with IP routers. Answer B is incorrect; Proxy servers can be placed between the private network and the Internet for Internet connectivity. Answer D is incorrect because it describes Internet content filters. This type of software can filter content from various types of Internet activity and applications, such as instant messaging, email, and office documents. It can be used to monitor and stop the disclosure of the organization’s proprietary or confidential information.

16. Answer: A, D. Protocol analyzers can be placed inline or in between the devices from which you want to capture the traffic. If you are analyzing SAN traffic, the analyzer can be placed outside the direct link with the use of an optical splitter. The analyzer is placed to capture traffic between the host and the monitored device. Answers B and C are incorrect because protocol analyzers are used to troubleshoot internal network issues and Therefore, they would not be placed outside the network.

17. Answer: C. A packet-filtering firewall is best suited for simple networks or used to protect a network that is used mainly for Internet access. The placement of a packet-filtering firewall is between the Internet and the protected network. It filters all traffic entering or leaving the network. Answer A is incorrect because proxy service firewalls allow organizations to offer services securely to Internet users. All servers hosting public services are placed in the demilitarized zone (DMZ) with the proxy firewall between the DMZ and the internal network. Answer B is incorrect; firewalls are not usually placed in between servers on the internal network, VLANs are used to separate resources. Answer D is incorrect because a stateful-inspection firewall is suited for main perimeter security. Stateful-inspection firewalls can thwart port scanning by closing off ports until a connection to the specific port is requested.

18. Answer: B. When deploying multiple firewalls, you might experience network latency. If you do, check the placement of the firewalls and possibly reconsider the topology to be sure you get the most out of the firewalls. Answer A is incorrect. If the access lists are configured correctly, legitimate traffic should not be blocked. This is true whether you are using 1 firewall or 10 firewalls. Answer C is incorrect, using multiple firewalls will reduce the attack vector, not increase it. Answer D is incorrect. Troubleshooting should become less complex because each firewall is configured for the traffic it will filter.

19. Answer: A. Proxy service firewalls allow organizations to offer services securely to Internet users. All servers hosting public services are placed in the demilitarized zone (DMZ) with the proxy firewall between the DMZ and the internal network. Answer B is incorrect; firewalls are not usually placed in between servers on the internal network, VLANs are used to separate resources. Answer C is incorrect because A packet-filtering firewall is best suited for simple networks or used to protect a network that is used mainly for Internet access. The placement of a packet-filtering firewall is between the Internet and the protected network. It filters all traffic entering or leaving the network. Answer D is incorrect because a stateful-inspection firewall is suited for main perimeter security. Stateful-inspection firewalls can thwart port scanning by closing off ports until a connection to the specific port is requested.

20. Answer: D. A stateful-inspection firewall is suited for main perimeter security. Stateful-inspection firewalls can thwart port scanning by closing off ports until a connection to the specific port is requested. Answer A is incorrect because proxy service firewalls allow organizations to offer services securely to Internet users. All servers hosting public services are placed in the demilitarized zone (DMZ) with the proxy firewall between the DMZ and the internal network. Answer B is incorrect; firewalls are not usually placed in between servers on the internal network, VLANs are used to separate resources. Answer C is incorrect because a packet-filtering firewall is best suited for simple networks or used to protect a network that is used mainly for Internet access. The placement of a packet-filtering firewall is between the Internet and the protected network. It filters all traffic entering or leaving the network.

Objective 2.5: Explain the vulnerabilities and mitigations associated with network devices.

1. Answer: C. Privilege escalation is a vulnerability represented by the accidental or intentional access to resources not intended for access by the user. Application flaws can allow a normal user access to administrative functions reserved for privileged accounts, or to access features of an application reserved for other users. An example of the latter would be if User A could read User B’s email without specific authorization. Answer A is incorrect because it describes default accounts. Answer B is incorrect because data transmitted over a wireless network using 802.1x that can be easily “sniffed” is referred to as data emanations. Answer D is incorrect because a back door is an application code function created intentionally or unintentionally, which allow unauthorized access to networked resources.

2. Answer: D. A back door is an application code function created intentionally or unintentionally, which allow unauthorized access to networked resources. Answer A is incorrect because it describes default accounts. Answer B is incorrect because data transmitted over a wireless network using 802.1x that can be easily “sniffed” is referred to as data emanations. Answer C is incorrect. Privilege escalation is a vulnerability represented by the accidental or intentional access to resources not intended for access by the user. Application flaws can allow a normal user access to administrative functions reserved for privileged accounts, or to access features of an application reserved for other users. An example of the latter would be if User A could read User B’s email without specific authorization.

3. Answer: B. Complexity means a mixture of character case, numbers, and/or symbols. Answers A and D are incorrect because automated and social-engineering assaults on passwords are easier when a password is short, and lacking in complexity, such as those derived from a common word found in the dictionary, or derived from easily guessable personal information such as birthdates, family names, pet names, and similar details. Answer C is incorrect because random generated passwords created by a program and often too complex for users to remember. This causes the users to write down the passwords and store them somewhere easily accessible. This goes against best practices.

4. Answer: B. Unlike resources located on the local system, network resources are much more vulnerable to DoS attacks. These attacks attempt to block access to resources by overwhelming network availability, instead of attempting to directly access the resources through unauthorized means. By blocking access to a website or network resource, the attacker effectively prevents authorized availability. Answer A is incorrect because a DoS focuses on network resources not local resources. Answer C is incorrect; viruses and worms ranked the highest for sheer number of attacks against network storage. Answer D is incorrect; DoS attacks are launched against servers in the DMZ, not the internal network, unless there is not a DMZ in place. However, corporate networks usually have some type of segmentation keeping the internal network and DMZ separated making this answer choice incorrect.

5. Answer: C. Unlike resources located on the local system, network resources are much more vulnerable to DoS attacks. These attacks attempt to block access to resources by overwhelming network availability, instead of attempting to directly access the resources through unauthorized means. By blocking access to a website or network resource, the attacker effectively prevents authorized availability. Answer A is incorrect because privilege escalation is the intentional access to resources not intended for access by the user. Answer B is incorrect; a back door is an application code function created intentionally or unintentionally, which allow unauthorized access to networked resources. Answer D is incorrect; attempting to directly access the resources through unauthorized means would fall along the lines of a spoofing attack.

6. Answer: B. Wireless networks often announce their service set identifier (SSID) to allow mobile devices to discover available WAPs. Turning off this broadcast can reduce the vulnerability of a broadcast packet sniffer readily identifying a WAP, but is not truly secure because the SSID is broadcast in plain text whenever a client connects to the network. As long as the SSID broadcast is turned on the WAP will be identifiable. Therefore, answers A, C, and D are incorrect. These solutions can help mitigate the risks associated with using wireless communication, but they will reduce the vulnerability associated with identifying the WAP.

7. Answer: C. Many networking devices and services are initially installed with a default set of user credentials, such as Oracle’s Scott/Tiger and IBM’s qsecofr/qsecofr. Unless these credentials are removed and replaced with unique strong logon credentials, they present an avenue for network attack because they are known to potential attackers. Answer A is incorrect because replacing them on an as-needed basis is not proper policy. Answer B is incorrect; replacing them when an attack has been detracted is reactive instead of proactive. Answer D is incorrect because using the same logon credential for all devices and services leaves them all vulnerable should the password be compromised.

8. Answer: A, B, D. Wireless networks often announce their service set identifier (SSID) to allow mobile devices to discover available WAPs. Turning off this broadcast can reduce the vulnerability of a broadcast packet sniffer readily identifying a WAP, but is not truly secure because the SSID is broadcast in plain text whenever a client connects to the network. Turning off SSID broadcast should be considered a “best practice,” along with conducting the site survey, selecting channels not already in use in the area, requiring WPA2 (or newer) encryption, and restricting access to a known list of Wi-Fi MAC addresses where possible. Answer C is incorrect because turning on DHCP will allow a rogue client to automatically connect. Therefore, it increases the vulnerability.

9. Answer: A. Back doors are application code functions created intentionally or unintentionally that enable unauthorized access to networked resources. Many times during application development, software designers put in shortcut entry points to allow rapid code evaluation and testing. If not removed before application deployment, such entry points can present the means for an attacker to gain unauthorized access later. Other back doors may be inserted by the application designers purposefully, presenting later threats to the network if applications are never reviewed by another application designer before deployment. Answer B is incorrect because back doors are associated with code development not system certification. Answer C is incorrect because during user interface testing, the users do not have access to the code and cannot create back doors. Answer D is incorrect because the code has already been developed and tested during the implementation phase. At this point, there is not access to the code itself.

10. Answer: D. To optimize network layout within each unique location, a site survey is necessary before implementing any WLAN solution. This is particularly important in distributed wireless network configurations spanning multiple buildings or open natural areas, where imposing structures and tree growth may affect network access in key areas. Answers A, B, and C are incorrect. Land surveys, building inspections, and OSHA inspections are agency-related functions and cannot be conducted by the organization.

11. Answer: B. Privilege escalation is a vulnerability represented by the accidental or intentional access to resources not intended for access by the user. Application flaws can allow a normal user access to administrative functions reserved for privileged accounts, or to access features of an application reserved for other users. Answer A is incorrect because it describes the vulnerability of a broadcast packet sniffer readily identifying a WAP. Answer C is incorrect. Back doors represent application code functions created intentionally or unintentionally, which allow unauthorized access to networked resources. Answer D is incorrect because automated and social-engineering assaults on passwords are easier when a password is short, lacking in complexity, derived from a common word found in the dictionary, or derived from easily guessable personal information such as birthdays, family names, pet names, and similar details.

12. Answer: A. Wireless networks often announce their service set identifier (SSID) to allow mobile devices to discover available WAPs. Turning off this broadcast can reduce the vulnerability of a broadcast packet sniffer readily identifying a WAP, but is not truly secure because the SSID is broadcast in plain text whenever a client connects to the network. Answer B is incorrect. Privilege escalation is a vulnerability represented by the accidental or intentional access to resources not intended for access by the user. Application flaws can allow a normal user access to administrative functions reserved for privileged accounts, or to access features of an application reserved for other users. Answer C is incorrect. Back doors represent application code functions created intentionally or unintentionally, which allow unauthorized access to networked resources. Answer D is incorrect because automated and social-engineering assaults on passwords are easier when a password is short, lacking in complexity, derived from a common word found in the dictionary, or derived from easily guessable personal information such as birthdays, family names, pet names, and similar details.

13. Answer: D. Automated and social-engineering assaults on passwords are easier when a password is short, lacking in complexity, derived from a common word found in the dictionary, or derived from easily guessable personal information such as birthdays, family names, pet names, and similar details. Answer A is incorrect because it describes the vulnerability of a broadcast packet sniffer readily identifying a WAP. Answer B is incorrect. Privilege escalation is a vulnerability represented by the accidental or intentional access to resources not intended for access by the user. Application flaws can allow a normal user access to administrative functions reserved for privileged accounts, or to access features of an application reserved for other users. Answer C is incorrect. Back doors represent application code functions created intentionally or unintentionally, which allow unauthorized access to networked resources.

14. Answer: C. Back doors represent application code functions created intentionally or unintentionally, which allow unauthorized access to networked resources. Many times during application development, software designers put in shortcut entry points to allow rapid code evaluation and testing. If not removed before application deployment, such entry points can present the means for an attacker to gain unauthorized access later. Answer A is incorrect because it describes the vulnerability of a broadcast packet sniffer readily identifying a WAP. Answer B is incorrect. Privilege escalation is a vulnerability represented by the accidental or intentional access to resources not intended for access by the user. Application flaws can allow a normal user access to administrative functions reserved for privileged accounts, or to access features of an application reserved for other users. Answer D is incorrect because automated and social-engineering assaults on passwords are easier when a password is short, lacking in complexity, derived from a common word found in the dictionary, or derived from easily guessable personal information such as birthdays, family names, pet names, and similar details.

15. Answer: C. Many networking devices and services are initially installed with a default set of user credentials, such as Oracle’s Scott/Tiger and IBM’s qsecofr/qsecofr. Unless these credentials are removed and replaced with unique strong logon credentials, they present an avenue for network attack. Answer A is incorrect. Network resources are much more vulnerable to DoS attacks. These attacks attempt to block access to resources by overwhelming network availability, instead of attempting to directly access the resources through unauthorized means. Answer B is incorrect. Privilege escalation is a vulnerability represented by the accidental or intentional access to resources not intended for access by the user. Application flaws can allow a normal user access to administrative functions reserved for privileged accounts, or to access features of an application reserved for other users. Answer D is incorrect because automated and social-engineering assaults on passwords are easier when a password is short, lacking in complexity, derived from a common word found in the dictionary, or derived from easily guessable personal information such as birthdays, family names, pet names, and similar details.

16. Answer: A. Network resources are much more vulnerable to DoS attacks. These attacks attempt to block access to resources by overwhelming network availability, instead of attempting to directly access the resources through unauthorized means. Answer B is incorrect. Privilege escalation is a vulnerability represented by the accidental or intentional access to resources not intended for access by the user. Application flaws can allow a normal user access to administrative functions reserved for privileged accounts, or to access features of an application reserved for other users. Answer C is incorrect. Many networking devices and services are initially installed with a default set of user credentials. Unless these credentials are removed and replaced with unique strong logon credentials, they present an avenue for network attack. Answer D is incorrect because automated and social-engineering assaults on passwords are easier when a password is short, lacking in complexity, derived from a common word found in the dictionary, or derived from easily guessable personal information such as birthdays, family names, pet names, and similar details.

17. Answer: A. Privilege escalation represents the accidental or intentional access to resources not intended for access by the user. Application flaws can allow a normal user access to administrative functions reserved for privileged accounts, or to access features of an application reserved for other users. An example of the latter is if User A can read User B’s email without specific authorization. Answer B is incorrect. Many networking devices and services are initially installed with a default set of user credentials. Unless these credentials are removed and replaced with unique strong logon credentials, they present an avenue for network attack. Answer C is incorrect. Any resource exposed on a network may be attacked to gain unauthorized access. The most common form of authentication and user access control is the username/password combination, which can be significantly weakened as a security measure if a “weak” password is selected. Answer D is incorrect. Back doors are application code functions created intentionally or unintentionally that enable unauthorized access to networked resources. Many times during application development, software designers put in shortcut entry points to allow rapid code evaluation and testing. If not removed before application deployment, such entry points can present the means for an attacker to gain unauthorized access later.

18. Answer: D. Back doors are application code functions created intentionally or unintentionally that enable unauthorized access to networked resources. Many times during application development, software designers put in shortcut entry points to allow rapid code evaluation and testing. If not removed before application deployment, such entry points can present the means for an attacker to gain unauthorized access later. Answer A is incorrect. Privilege escalation represents the accidental or intentional access to resources not intended for access by the user. Application flaws can allow a normal user access to administrative functions reserved for privileged accounts, or to access features of an application reserved for other users. An example of the latter is if User A can read User B’s email without specific authorization. Answer B is incorrect. Many networking devices and services are initially installed with a default set of user credentials. Unless these credentials are removed and replaced with unique strong logon credentials, they present an avenue for network attack. Answer C is incorrect. Any resource exposed on a network may be attacked to gain unauthorized access. The most common form of authentication and user access control is the username/password combination, which can be significantly weakened as a security measure if a “weak” password is selected.

19. Answer: B, C. Automated and social-engineering assaults on passwords are easier when a password is short, lacking in complexity (complexity here meaning a mixture of character case, numbers, and symbols), derived from a common word found in the dictionary, or derived from easily guessable personal information such as birthdays, family names, pet names, and similar details. Answer A is incorrect because it is attack associated with WAPs announcing their service set identifier (SSID). Answer D is incorrect because DoS attacks are often used for Internet extortion schemes, where an attacking botnet of tens of thousands of zombied client systems can be used to consume all available connections to a business website.

20. Answer: D. DoS attacks are often used for Internet extortion schemes, where an attacking botnet of tens of thousands of zombied client systems can be used to consume all available connections to a business website. Many fringe service industries, such as online casinos, are regularly targeted with this type of attack. Answer A is incorrect because it is attack associated with WAPs announcing their service set identifier (SSID). Answers B and C are incorrect; automated and social-engineering assaults on passwords are easier when a password is short, lacking in complexity (complexity here meaning a mixture of character case, numbers, and symbols), derived from a common word found in the dictionary, or derived from easily guessable personal information such as birthdays, family names, pet names, and similar details.

Objective 2.6: Explain the vulnerabilities and mitigations associated with various transmission media.

1. Answer: C. Data traffic over coaxial network cabling can be intercepted and inspected by an attacker through the use of a vampire tap, which pierces the cable at an arbitrary point and allows direct connection to the data transport wiring. Similar technologies can be applied to modern fiber optic media, allowing interception of data traffic without a detectable presence on the network. Physical access control to areas where network media is exposed is critical to protecting against unauthorized taps. Vampire taps are physical in nature. Answers A, B, and D are incorrect because they controls that are configured using software and are not physical in nature.

2. Answer: C. Physical access control to the networking closet is critical to protect switched networks against any exposed supervisory ports that can be exploited by an attacker. Although answers A, B, and D are possible methods to control access, if physical access in not secured, the controls will not do any good. Therefore, these answers are incorrect.

3. Answer: A. Before the development of network switches, hubs were commonly used to distribute data packets to endpoint ports. Hubs do not provide data isolation between endpoint ports, allowing any node to observe data traffic to and from all other nodes on the same device. Answer B is incorrect because switches provide data isolation between endpoint ports, not hubs. Answer C is incorrect because routers provide packet forwarding for routable addresses, not hubs. Answer D is incorrect because in port mirroring the switch sends a copy of network packets to a monitoring network connection.

4. Answer: B. Certain types of networking equipment provide attackers with access to inspect network traffic for interception of user credentials, security encryption traffic, and other forms of sensitive transmitted data. Hubs do not provide data isolation between endpoint ports, allowing any node to observe data traffic to and from all other nodes on the same device. Answer A is incorrect because a network hub is a fairly unsophisticated broadcast device and it does not manage any of the traffic that comes through it. The BIOS holds information necessary to boot the computer. Answers C and D are incorrect; hubs operate at Layer 2 of the OSI model and know nothing about encryption.

5. Answer: D. Data traffic over coaxial network cabling can be intercepted and inspected by an attacker through the use of a vampire tap, which pierces the cable at an arbitrary point and allows direct connection to the data transport wiring. Similar technologies can be applied to modern fiber-optic media, allowing interception of data traffic without a detectable presence on the network. Answer A is incorrect; good antivirus software will find commercial keyloggers. Answer B is incorrect; there are applications available to find back doors, especially those created by malware. Answer B is incorrect; checks for unauthorized modification of code would prevent logic bombs.

Objective 2.7: Explain the vulnerabilities and implement mitigations associated with wireless networking.

1. Answer: B. Wireless networks often announce their service set identifier (SSID) to allow mobile devices to discover available Wireless Access Points (WAPs). Turning off this broadcast can reduce the vulnerability of a wireless packet sniffer detecting broadcasts that readily identify a WAP. In this particular instance, the WAP is not secure because the SSID is broadcast in plain text whenever a client connects to the network. Answer A is incorrect because WAPs by default do not have encryption enabled. Answer C is incorrect because if physical access is limited, the risk is mitigated. Answer D is incorrect because it describes the characteristics of a hub.

2. Answer: D. 802.1x transmissions generate detectable radio-frequency signals in all directions. Persons who wanting to “sniff” the data transmitted over the network may use many solutions to increase the distance over which detection is possible, including the use of reflective tube waveguides. Answer A is incorrect because the radio-frequency signals are generated in all directions not is one direction. Answers B and D are incorrect because data emanation is what allows for the sniffing of the data, not why data emanation is a risk.

3. Answer: C. Without the use of a mandated encryption standard, data transmitted over an 802.1x wireless link may be passed in clear form. Additional forms of encryption may be implemented, such as the Wired Equivalent Privacy (WEP) and the Advanced Encryption Standard (AES), but transport encryption mechanisms suffer from the fact that a determined listener can obtain enough traffic data to calculate the encoding key in use. Answers A, B, and D are incorrect because authorization, authentication, and identification are access control methods, not methods to mitigate data transmissions.

4. Answer: A, B, C. Wireless communications are susceptible to data emanation, weak encryption, session hijacking, man-in-the-middle attacks, and war-driving. Answer D is incorrect because spam relaying is associated open SMTP relays in email servers.

5. Answer: C. Because the authentication mechanism is one-way, it is easy for a hijacker to wait until the authentication cycle is completed and then generate a signal to the client that causes the client to think it has been disconnected from the access point, while at the same time beginning to transmit data traffic pretending to be from the original client. Answers A and D are incorrect. Both of these answers deal with authorization and session hijacking deals with authentication. Answer B is incorrect because it is not true that an authentication mechanism is not there. It exists and is one-way.

6. Answer: D. The request for connection by the client is an omnidirectional open broadcast. It is possible for a hijacker to act as an access point to the client, and as a client to the true network access point, allowing the hijacker to follow all data transactions with the ability to modify, insert, or delete packets at will. Answer A is incorrect because request for connection by the client is an omnidirectional open broadcast. Answers B and C are incorrect; the connection request is made by the client not the access point.

7. Answer: A. A popular pastime involves driving around with a laptop system configured to listen for open 802.1x access points announcing their SSID broadcasts, which is known as war-driving. Answer B is incorrect because it describes war dialing. Answer C is incorrect because it describes war-chalking. Answer D incorrect because it describes a hotspot.

8. Answer: C. War-chalking utilizes a set of symbols and shorthand details to provide specifics needed to connect using a business access point. This is done by marking buildings, curbs, and other landmarks to indicate the presence of an available access point and its connection details. Answer A is incorrect. A popular pastime involves driving around with a laptop system configured to listen for open 802.1x access points announcing their SSID broadcasts, which is known as war-driving. Answer B is incorrect because it describes war dialing. Answer D incorrect because it describes a hotspot.

9. Answer: B. Mobile devices equipped for Bluetooth short-range wireless connectivity, such as laptops, cell phones, and PDAs, are subject to receiving text and message broadcast spam sent from a nearby Bluetooth-enabled transmitting device in an attack referred to as bluejacking. Answer A is incorrect. A popular pastime involves driving around with a laptop system configured to listen for open 802.1x access points announcing their SSID broadcasts, which is known as war-driving. Answer C is incorrect because it describes bluesnarfing. Answer D is incorrect. War-chalking utilizes a set of symbols and shorthand details to provide specifics needed to connect using a business access point. This is done by marking buildings, curbs, and other landmarks to indicate the presence of an available access point and its connection details.

10. Answer: C. Although typically benign, attackers use bluejacking to generate messages that appear to be from the device itself. This leads users to follow obvious prompts and establish an open Bluetooth connection to the attacker’s device. Once paired with the attacker’s device, the user’s data becomes available for unauthorized access, modification, or deletion, which is an attack referred to as bluesnarfing. Answer B is incorrect. Mobile devices equipped for Bluetooth short-range wireless connectivity, such as laptops, cell phones, and PDAs, are subject to receiving text and message broadcast spam sent from a nearby Bluetooth-enabled transmitting device in an attack referred to as bluejacking. Answer A is incorrect. A popular pastime involves driving around with a laptop system configured to listen for open 802.1x access points announcing their SSID broadcasts, which is known as war-driving. Answer D is incorrect. War-chalking utilizes a set of symbols and shorthand details to provide specifics needed to connect using a business access point. This is done by marking buildings, curbs, and other landmarks to indicate the presence of an available access point and its connection details.

11. Answer: B. The 802.11b WLAN specification allows up to 11Mbps wireless connectivity. Answer A is incorrect because 1.5MBps is a common speed for cable modem and T1 connectivity. Answer C is incorrect because 100Mbps is a common wired LAN data transfer rate. Answer D is incorrect because 19.2Kbps specifies a common modem bandwidth limit.

12. Answer: A. The 802.11b (Wi-Fi) standard uses the CSMA/CA connectivity methods commonly found in Ethernet connectivity. Answers B and D are incorrect because both WAP and i-Mode are standards used by mobile devices such as cell phones, pagers, and PDAs and are not used to specify WLAN standards. Answer C is incorrect because Bluetooth is based on a different transmission protocol.

13. Answer: B. The WPA2 standard implements the 802.11i-2004 protocols, and is currently the highest standard for Wi-Fi communication security. Answer A is incorrect because a WAP refers to both handheld devices as well as wireless access points. Answer C is incorrect because WEP2 is a stopgap enhancement to WEP present in some of the early 802.11i drafts. Answer D is incorrect because the WEP standard was proven to be unsecure and has been replaced by the newer WPA standards.

14. Answer: D. Data emanation happens because 802.1x transmissions generate detectable radio-frequency signals in all directions. Persons wanting to sniff the data transmitted over the network may use many solutions to increase the distance over which detection is possible, including the use of reflective tube waveguides (such as the popular Pringle’s can) and flying devices overhead to increase detection range without interference from building structures. Answer A is incorrect because without the use of a mandated encryption standard, data transacted over an 802.1x wireless link may be passed in clear form and attackers can take advantage of this weak or nonexistent encryption. Answer B is incorrect because the wireless authentication mechanism is one-way, allowing session hijacking. Answer C is incorrect because a popular pastime involves driving around with a laptop system configured to listen for open 802.1x access points announcing their SSID broadcasts, which is known as war-driving.

15. Answer: B. Because the authentication mechanism is one-way, it is easy for a hijacker to wait until the authentication cycle is completed and then generate a signal to the client that causes the client to think it has been disconnected from the access point, while at the same time beginning to transact data traffic pretending to be the original client. Answer A is incorrect because without the use of a mandated encryption standard, data transacted over an 802.1x wireless link may be passed in clear form, and attackers can take advantage of this weak or nonexistent encryption. Answer C is incorrect because a popular pastime involves driving around with a laptop system configured to listen for open 802.1x access points announcing their SSID broadcasts, which is known as war-driving. Answer D is incorrect. Persons wanting to “sniff” the data transmitted over the wireless network may use many solutions to increase the distance over which detection is possible, including the use of reflective tube waveguides (such as the popular Pringle’s can) and flying devices overhead to increase detection range without interference from building structures.

16. Answer: A. Without the use of a mandated encryption standard, data transacted over an 802.1x wireless link may be passed in clear form and attackers can take advantage of this weak or nonexistent encryption. Answer B is incorrect because the wireless authentication mechanism is one-way, allowing session hijacking. Answer C is incorrect because a popular pastime involves driving around with a laptop system configured to listen for open 802.1x access points announcing their SSID broadcasts, which is known as war-driving. Answer D is incorrect. Persons wanting to “sniff” the data transmitted over the wireless network may use many solutions to increase the distance over which detection is possible, including the use of reflective tube waveguides (such as the popular Pringle’s can) and flying devices overhead to increase detection range without interference from building structures.

17. Answer: B. Although typically benign, attackers can use bluejacking to generate messages that appear to be from the device itself, leading users to follow obvious prompts and establish an open Bluetooth connection to the attacker’s device. Once paired with the attacker’s device, the user’s data becomes available for unauthorized access, modification, or deletion, which is a more aggressive attack referred to as bluesnarfing. Answer A is incorrect. Mobile devices equipped for Bluetooth short-range wireless connectivity, such as laptops, cell phones, and PDAs, are subject to receiving text and message broadcast spam sent from a nearby Bluetooth-enabled transmitting device in an attack referred to as bluejacking. Answer C is incorrect. A popular pastime involves driving around with a laptop system configured to listen for open 802.1x access points announcing their SSID broadcasts, which is known as war-driving. Answer D is incorrect. War-chalking utilizes a set of symbols and shorthand details to provide specifics needed to connect using a business access point. This is done by marking buildings, curbs, and other landmarks to indicate the presence of an available access point and its connection details.

18. Answer: C. War-driving is aimed at identification of existing wireless networks, the service set identifier (SSID) used to identify the wireless network, and any known WEP keys. Answer A is incorrect because without the use of a mandated encryption standard, data transacted over an 802.1x wireless link may be passed in clear form and attackers can take advantage of this weak or nonexistent encryption. Answer B is incorrect because the wireless authentication mechanism is one way, allowing session hijacking. Answer D is incorrect. Persons wanting to “sniff” the data transmitted over the wireless network may use many solutions to increase the distance over which detection is possible, including the use of reflective tube waveguides (such as the popular Pringle’s can) and flying devices overhead to increase detection range without interference from building structures.

19. Answer: A. Mobile devices equipped for Bluetooth short-range wireless connectivity, such as laptops, cell phones, and PDAs, are subject to receiving text and message broadcast spam sent from a nearby Bluetooth-enabled transmitting device in an attack referred to as bluejacking. Answer B is incorrect. Although typically benign, attackers can use bluejacking to generate messages that appear to be from the device itself, leading users to follow obvious prompts and establish an open Bluetooth connection to the attacker’s device. Once paired with the attacker’s device, the user’s data becomes available for unauthorized access, modification, or deletion, which is a more aggressive attack referred to as bluesnarfing. Answer C is incorrect. A popular pastime involves driving around with a laptop system configured to listen for open 802.1x access points announcing their SSID broadcasts, which is known as war-driving. Answer D is incorrect. War-chalking utilizes a set of symbols and shorthand details to provide specifics needed to connect using a business access point. This is done by marking buildings, curbs, and other landmarks to indicate the presence of an available access point and its connection details.

20. Answer: B. Because the request for connection by the client is an omnidirectional open broadcast, it is possible for a hijacker to act as an access point to the client, and as a client to the true network access point, allowing the hijacker to follow all data transactions with the ability to modify, insert, or delete packets at will. By implementing a rogue AP with stronger signal strength than more remote permanent installations, the attacker can cause a wireless client to preferentially connect to their own stronger nearby connection using the wireless device’s standard roaming handoff mechanism. Answer A is incorrect. Without the use of a mandated encryption standard, data transacted over an 802.1x wireless link may be passed in clear form and attackers can take advantage of this weak or nonexistent encryption. Answer C is incorrect because a popular pastime involves driving around with a laptop system configured to listen for open 802.1x access points announcing their SSID broadcasts, which is known as war-driving. Answer D is incorrect. Persons wanting to “sniff” the data transmitted over the wireless network may use many solutions to increase the distance over which detection is possible, including the use of reflective tube waveguides (such as the popular Pringle’s can) and flying devices overhead to increase detection range without interference from building structures.

21. Answer: C. When a client attempts to make an 802.1x-compliant connection, the client attempts to contact a wireless access point (AP). The AP authenticates the client through a basic challenge-response method, and then provides connectivity to a wired network or serves as a bridge to a secondary wireless AP. Answers A and D are incorrect because there is no user interaction in the authentication process. Answer B is incorrect because a hardware token is a security token that is used in multifactor authentication. It has nothing to do with how a client authenticates to a WAP.

22. Answer: A. New standards that involve time-changing encryption keys may help with weal key encryption, such as the Temporal Key Integrity Protocol (TKIP) and Wi-Fi Protected Access (WPA/WPA2) standard. Answer B is incorrect. Persons wanting to “sniff” the data transmitted over the wireless network may use many solutions to increase the distance over which detection is possible, including the use of reflective tube waveguides (such as the popular Pringle’s can) and flying devices overhead to increase detection range without interference from building structures. Answer C is incorrect. Mobile devices equipped for Bluetooth short-range wireless connectivity, such as laptops, cell phones, and PDAs, are subject to receiving text and message broadcast spam sent from a nearby Bluetooth-enabled transmitting device in an attack referred to as bluejacking. D is incorrect because a popular pastime involves driving around with a laptop system configured to listen for open 802.1x access points announcing their SSID broadcasts, which is known as war-driving.

23. Answer: A. Wireless Application Environment (WAE) specifies the framework used to develop applications for mobile devices, including cell phones, data pagers, and PDAs. Answers B and C are incorrect. Wireless Session Layer (WSL), Wireless Transport Layer (WTL), and Wireless Transport Layer Security (WTLS) are the specifications that are included in the WAP standard. Answer D is incorrect because specifications for the Wired Equivalent Privacy (WEP) standard are detailed within the 802.11b (Wi-Fi) specification. This specification details a method of data encryption and authentication that may be used to establish a more secured wireless connection.

24. Answer: D. The Wi-Fi Protected Access (WPA and later WPA2) standards were developed by the Wi-Fi Alliance to replace the WEP protocol while the 802.11i standard was being developed. The WPA includes many of the functions of the 802.11i protocol but relies on the Rivest Cipher 4 (RC4), which is considered vulnerable to keystream attacks. The later WPA2 standard was certified to include the full 802.11i standard after its final approval. Answers A and C are incorrect because they are encryptions standards are not associated with the Wi-Fi Alliance. Answer C is incorrect because a WAP refers to both handheld devices as well as wireless access points.

25. Answer: A. Wireless Session Layer (WSL) is equivalent to the session layer of the Open Systems Interconnection (OSI) model. Based on this information, answers B, C, and D are incorrect.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.138.35.193