Copy and Edit

Midterm review Chapters 1-5

Description

Information Technology Quiz on Midterm review Chapters 1-5, created by Mary Sunseri on 03/03/2018.
Mary Sunseri
Quiz by Mary Sunseri, updated more than 1 year ago
Mary Sunseri
Created by Mary Sunseri over 6 years ago
232
1
0

Resource summary

Question 1

Question
Which of the following is the best definition for war-driving?
Answer
  • Driving and seeking rival hackers
  • Driving while hacking and seeking a computer job
  • Driving looking for wireless networks to hack
  • Driving while using a wireless connection to hack

Question 2

Question
In addition to mandating federal agencies to establish security measures, the Computer Security Act of 1987 defined important terms such as:
Answer
  • security information
  • private information
  • unauthorized access
  • sensitive information

Question 3

Question
What are the three approaches to security?
Answer
  • High security, medium security, and low security
  • Perimeter, layered, and hybrid
  • Internal, external, and hybrid
  • Perimeter, complete, and none

Question 4

Question
An attack characterized by an explicit attempt by attackers to prevent legitimate users from accessing a system is called:
Answer
  • war-dialing
  • spoofing
  • denial of service
  • social engineering

Question 5

Question
The first computer incident response team is affiliated with what university?
Answer
  • Harvard University
  • Princeton
  • Carnegie-Mellon University
  • Yale

Question 6

Question
The process of reviewing logs, records, and procedures to determine whether they meet appropriate standards is called:
Answer
  • auditing
  • filtering
  • authenticating
  • sneaking

Question 7

Question
Which of the following best defines the primary difference between a sneaker and an auditor?
Answer
  • There is no difference
  • The sneaker tends to be less skilled
  • The sneaker tends to use more unconventional methods
  • The auditor tends to be less skilled

Question 8

Question
Which of the following types of privacy laws affect computer security?
Answer
  • Any privacy law applicable to your organization
  • Any privacy law
  • Any federal privacy law
  • Any state privacy law

Question 9

Question
An intrusion-detection system is an example of:
Answer
  • Proactive security
  • Perimeter security
  • Good security practices
  • Hybrid security

Question 10

Question
Which of the following is the best definition of “sensitive information”?
Answer
  • Any information that is worth more than $1,000
  • Any information that has monetary value and is protected by any privacy laws
  • Any information that, if accessed by unauthorized personnel, could damage your organization in any way
  • Military or defense related information

Question 11

Question
Which of the following maintains a repository for information on virus outbreaks and detailed information about specific viruses?
Answer
  • F-Secure Corporation
  • CERT
  • SANS Institute
  • Microsoft Security Advisor

Question 12

Question
Which is a technique used to provide false information about data packets?
Answer
  • Phreaking
  • Social engineering
  • Hacking
  • Spoofing

Question 13

Question
What is the term for hacking a phone system?
Answer
  • phreaking
  • Cracking
  • Hacking
  • Telco-hacking

Question 14

Question
Which is NOT one of the three broad classes of security threats?
Answer
  • Preventing or blocking access to a system
  • Gaining unauthorized access into a system
  • Malicious software
  • Disclosing contents of private networks

Question 15

Question
Are there any reasons not to take an extreme view of security, if that view errs on the side of caution?
Answer
  • No, there is no reason not to take such an extreme view.
  • Yes, if you are going to err, assume there are few if any realistic threats.
  • Yes, that can lead to wasting resources on threats that are not likely.
  • Yes, that can require that you increase your security skills in order to implement more rigorous defenses.

Question 16

Question
A text file that is downloaded to a computer by a Web site to provide information about the Web site and online access is called a:
Answer
  • cookie
  • Trojan horse
  • script kiddy
  • key logger

Question 17

Question
Which of the following is the most basic security activity?
Answer
  • Installing a firewall
  • Controlling access to resources
  • Authenticating users
  • Using a virus scanner

Question 18

Question
Which of the following is NOT a connectivity device used to connect machines on a network?
Answer
  • Network interface card
  • Hub
  • Proxy server
  • Switch

Question 19

Question
The process of determining whether the credentials given by a user are authorized to access a particular network resource is called:
Answer
  • auditing
  • accessing
  • authorization
  • authentication

Question 20

Question
Which approach to security is proactive in addressing potential threats before they occur?
Answer
  • Layered security approach
  • Passive security approach
  • Dynamic security approach
  • Hybrid security approach

Question 21

Question
Those who exploit systems for harm such as to erase files, change data, or deface Web sites are typically called:
Answer
  • gray hat hackers
  • black hat hackers
  • white hat hackers
  • red hat hackers

Question 22

Question
Encryption and virtual private networks are techniques used to secure which of the following?
Answer
  • Connection points
  • Data
  • Firewalls
  • Proxy servers

Question 23

Question
Which of the following is the best definition for the term sneaker?
Answer
  • An amateur hacker
  • A person who hacks a system to test its vulnerabilities
  • A person who hacks a system by faking a legitimate password
  • An amateur who hacks a system without being caught

Question 24

Question
Which of the following is not one of the three major classes of threats?
Answer
  • Online auction fraud
  • Denial of Service attacks
  • A computer virus or worm
  • Actually intruding on a system

Question 25

Question
Which is NOT one of the three broad classes of security threats?
Answer
  • Disclosing contents of private networks
  • Malicious software
  • Preventing or blocking access to a system
  • Gaining unauthorized access into a system

Question 26

Question
What is a computer virus?
Answer
  • Any program that can change your Windows registry.
  • Any program that self replicates
  • Any program that causes harm to your system
  • Any program that is downloaded to your system without your permission

Question 27

Question
When assessing threats to a system, what three factors should you consider?
Answer
  • How much traffic the system gets, the security budget, and the skill level of the security team
  • The system’s attractiveness, the information contained on the system, and how much traffic the system gets
  • The skill level of the security team, the system’s attractiveness, and how much traffic the system gets
  • The system’s attractiveness, the information contained on the system, and the security budget

Question 28

Question
Which of the following would most likely be classified as misuses of systems?
Answer
  • Using your business computer to conduct your own (non-company) business
  • Getting an occasional personal email
  • Looking up information on a competitor using the Web
  • Shopping on the web during lunch

Question 29

Question
What is a technique used to determine if someone is trying to falsely deny that they performed a particular action?
Answer
  • Non-repudiation
  • Access Control Authorization
  • Audiiting
  • Sneaking

Question 30

Question
Which approach to security addresses both the system perimeter and individual systems within the network?
Answer
  • Perimeter security approach
  • Layered security approach
  • Hybrid aecurity approach
  • Dynamic security approach

Question 31

Question
Which of the following gives the best definition of spyware?
Answer
  • Any software that monitors which Web sites you visit
  • Any software or hardware that monitors your system
  • Any software that logs keystrokes
  • Any software used to gather intelligence

Question 32

Question
Which of the following is the best definition for non-repudiation?
Answer
  • It is another term for user authentication
  • Processes that verify which user performs what action
  • Security that does not allow the potential intruder to deny his attack
  • Access control

Question 33

Question
Blocking attacks seek to accomplish what?
Answer
  • Prevent legitimate users from accessing a system
  • Breaking into a target system
  • Shut down security measures
  • Install a virus on the target machine

Question 34

Question
Which term is generally used by hackers to refer to attempts at intrusion into a system without permission and usually for malevolent purposes?
Answer
  • Social engineering
  • Blocking
  • Hacking
  • Cracking

Question 35

Question
The most desirable approach to security is one which is:
Answer
  • Layered and dynamic
  • Perimeter and static
  • Layered and static
  • Perimeter and dynamic

Question 36

Question
Which of the following activities do security professionals recommend to limit the chances of becoming a target for a Trojan horse?
Answer
  • Prevent employees from downloading and installing any programs
  • Download and install Windows updates and patches monthly
  • Only open e-mail attachments from friends or co-workers
  • Only download jokes, animated Flash files, or utility programs from popular sites

Question 37

Question
Which method of defense against a SYN flood involves altering the response timeout?
Answer
  • Micro blocks
  • SYN cookies
  • RST cookies
  • Stack tweaking

Question 38

Question
Which created a buffer overflow attack against a Windows flaw called the DCOM RPC vulnerability?
Answer
  • Blaster
  • MyDoom
  • SoBig
  • Slammer

Question 39

Question
What do many analysts believe was the reason for the MyDoom virus/worm?
Answer
  • A DoS attack against Microsoft.com
  • A DoS attack targeting Microsoft Windows IIS servers
  • An e-mail attack targeting Bill Gates
  • A DDoS attack targeting Santa Cruz Operations

Question 40

Question
Which is NOT true about a buffer overflow attack?
Answer
  • Susceptibility to a buffer overflow is entirely contingent on software flaws.
  • A hacker does not need a good working knowledge of some programming language to create a buffer overflow.
  • A buffer overflow can load malicious data into memory and run it on a target machine.
  • A careful programmer will write applications so the buffer will truncate or reject data that exceeds the buffer length.

Question 41

Question
What is the name for a DoS defense that is dependent on sending back a hash code to the client?
Answer
  • Server reflection
  • RST cookie
  • Stack tweaking
  • SYN cookie

Question 42

Question
What is the best way to defend against a buffer overflow?
Answer
  • Stopping all ICMP traffic
  • Using a robust firewall
  • Keeping all software patched and updated
  • Blocking TCP packets at the router

Question 43

Question
The spread of viruses can be minimized by all of the following EXCEPT:
Answer
  • using a code word with friends to determine if attachments are legitimate
  • using a virus scanner
  • immediately following instructions in security alerts e-mailed to you from Microsoft
  • never opening attachments you are unsure of

Question 44

Question
Which of the following is NOT a denial of service attack?
Answer
  • Ping of Death
  • SYN flood
  • Smurf attack
  • Stack tweaking

Question 45

Question
Which of the following is the best definition for IP spoofing?
Answer
  • Sending packets that are misconfigured
  • Sending a packet that appears to come from a trusted IP
  • Setting up a fake Web site that appears to be a different site
  • Rerouting packets to a different IP

Question 46

Question
Which attack relies on broadcast packets to cause a network to actually flood itself with ICMP packets?
Answer
  • Smurf attack
  • SYN flood
  • Tribal flood
  • ICMP flood

Question 47

Question
Which attack occurs by sending packets that are too large for the target machine to handle?
Answer
  • SYN flood
  • ICMP flood
  • Ping of death
  • Stack tweaking

Question 48

Question
One of the most common types of attacks via the Internet is:
Answer
  • Buffer overflow
  • IP spoofing
  • Session hacking
  • Denial of service

Question 49

Question
Which of the following virus attacks initiated a DoS attack?
Answer
  • Walachi
  • MyDoom
  • Bagle
  • Faux

Question 50

Question
Which router configuration is potentially least vulnerable to an attack?
Answer
  • Routers that filter packets with source addresses in the local domain
  • Proxy firewalls where the proxy applications use the source IP address for authentication
  • Routers to external networks that support multiple internal interfaces
  • Routers with two interfaces that support subnetting on the internal network

Question 51

Question
What is a technical weakness of the Stack tweaking defense?
Answer
  • It only decreases time out but does not actually stop DoS attacks
  • It is complicated and requires very skilled technicians to implement
  • It is resource intensive and can degrade server performance.
  • It is ineffective against DoS attacks

Question 52

Question
Which created a domestic “cyber terrorism” attack against a Unix distributor?
Answer
  • MyDoom
  • W32.Storm.Worm
  • Blaster
  • Slammer

Question 53

Question
What is the name for a DoS attack that causes machines on a network to initiate a DoS against one of that network’s servers?
Answer
  • Smurf attack
  • Distributed Denial of Service
  • SYN flood
  • Ping of Death

Question 54

Question
Which of the following would be the best defense if your Web server had limited resources but you needed a strong defense against DoS?
Answer
  • Stack tweaking
  • A firewall
  • SYN cookies
  • RST cookies

Question 55

Question
What was the greatest damage from the Bagle virus?
Answer
  • It deleted system files
  • It corrupted the Windows registry
  • It was difficult to detect
  • It shut down antivirus software

Question 56

Question
How does the SYN cookie work?
Answer
  • Replaces cookies left by virus/worm programs.
  • Causes server to send wrong SYNACK to the client.
  • Prevents memory allocation until third part of SYN ACK handshaking.
  • Enables encryption of outbound packets.

Question 57

Question
From the attacker’s point of view, what is the primary weakness in a DoS attack?
Answer
  • The attack does not cause actual damage
  • The attack must be sustained.
  • The attack is difficult to execute
  • The attack is easily thwarted

Question 58

Question
Shutting down router and firewall ports 5554 and 9996 will block most damage from which of these?
Answer
  • Sobig
  • Trojan horses
  • Bagle
  • Sasser

Question 59

Question
Which attack causes Internet routers to attack the target systems without actually compromising the routers themselves?
Answer
  • ICMP flood
  • SYN flood
  • Tribal Flood Network
  • Distributed Reflection Denial of Service

Question 60

Question
Which attack relies on broadcast packets to cause a network to actually flood itself with ICMP packets?
Answer
  • Tribal flood
  • SYN flood
  • Smurf attack
  • ICMP flood

Question 61

Question
What DoS attack is based on leaving connections half open?
Answer
  • SYN flood
  • Smurf Attack
  • Ping of Death
  • Distributed Denial of Service

Question 62

Question
What is the best method of defending against IP spoofing?
Answer
  • Installing a router/firewall that blocks packets that appear to be originating within the network
  • Blocking all incoming TCP traffic
  • Blocking all incoming ICMP traffic
  • Installing a router/firewall that blocks packets that appear to be originating from outside the network

Question 63

Question
Which of the following best describes session hacking?
Answer
  • Taking over a target machine via a Trojan horse
  • Taking control of the login session
  • Taking control of a target machine remotely
  • Taking control of the communication link between two machines

Question 64

Question
Which of the following is a recommended configuration of your firewall to defend against DoS attacks?
Answer
  • Block TCP packets that originate outside your network
  • Block all incoming packets
  • Block ICMP packets that originate outside your network
  • Block all ICMP packets

Question 65

Question
Which copies itself into the Windows directory and creates a registry key to load itself at startup?
Answer
  • Slammer
  • MyDoom
  • Sasser
  • Bagle

Question 66

Question
Which presented itself as an e-mail from the system administrator informing the user of a virus infection and gave directions to open an e-mail attachment which would then scan for e-mail addresses and shared folders?
Answer
  • Sobig
  • Sasser
  • Minmail
  • Bagle

Question 67

Question
Which of the following best describes a buffer overflow attack?
Answer
  • An attack that attempts to put misconfigured data into a memory buffer
  • An attack that attempts to send oversized TCP packets
  • An attack that attempts to put too much data in a memory buffer
  • An attack that overflows the target with too many TCP packets

Question 68

Question
What is a Trojan horse?
Answer
  • Software that deletes system files then infects other machines
  • Software that self replicates
  • Software that causes harm to your system
  • Software that appears to be benign but really has some malicious purpose

Question 69

Question
Which of the following denial of service attacks results from a client’s failure to respond to the server’s reply to a request for connection?
Answer
  • ICMP flood
  • SYN flood
  • Tribal flood
  • UDP flood

Question 70

Question
What is the danger inherent in IP spoofing attacks?
Answer
  • Many of these attacks open the door for other attacks
  • Many firewalls don’t examine packets that seem to come from within the network.
  • They can be difficult to stop
  • They are very damaging to target systems

Question 71

Question
Which is NOT a typical adverse result of a virus?
Answer
  • Increased network traffic
  • Changing system settings
  • Increased network functionality and responsiveness
  • Deletion of files

Question 72

Question
What type of firewall is Check Point Firewall-1?
Answer
  • Packet filtering/application gateway hybrid
  • SPI/application gateway hybrid
  • Circuit level gateway
  • Application gateway

Question 73

Question
What implementation is Check Point Firewall-1?
Answer
  • Switch based
  • Host based
  • Network based
  • Router based

Question 74

Question
Which is a hardware firewall vendor manufacturing Stateful Packet Inspection units with NAT and DES especially for small offices?
Answer
  • Cisco
  • Wolverine
  • D-Link
  • Check Point

Question 75

Question
Should a home user with ICF block port 80, and why or why not?
Answer
  • She should not because it would prevent her from using Web Pages
  • She should not because that will prevent her from getting updates and patches
  • She should unless she is running a Web server on her machine.
  • She should because port 80 is a common attack point for hackers

Question 76

Question
Why is an SPI firewall more resistant to flooding attacks?
Answer
  • It requires user authentication
  • It examines each packet in the context of previous packets
  • It automatically blocks large traffic from a single IP
  • It examines the destination IP of all packets

Question 77

Question
Snort is which type of IDS?
Answer
  • Client-based
  • Router-based
  • OS-based
  • Host-based

Question 78

Question
Snort is which type of IDS?
Answer
  • Client-based
  • Router-based
  • OS-based
  • Host-based

Question 79

Question
What is one complexity found in enterprise environements that is unlikely in small networks or SOHO environments?
Answer
  • Diverse user groups
  • Web vulnerabilities
  • Multiple operating systems
  • Users running different applications

Question 80

Question
Which type of IDS is the Cisco Sensor?
Answer
  • Anomaly detection
  • Intrusion deterrence
  • Intrusion deflection
  • Anomaly deterrence

Question 81

Question
It should be routine for someone in the IT security staff to
Answer
  • Physically inspect the firewall
  • Review firewall logs
  • Reboot the firewall
  • Test the firewall by attempting a ping flood

Question 82

Question
Using a server running the Linux operating system with its built-in firewall as the network firewall is one example of which firewall configuration?
Answer
  • router-based
  • dual-homed host
  • network host-based
  • screened host

Question 83

Question
What is an advantage of an enterprise environment?
Answer
  • Skilled technical personnel available
  • Multiple operating systems to deal with
  • IDS systems not needed
  • Lower security needs

Question 84

Question
Which is true about SonicWALL firewall solutions?
Answer
  • They work on Linux, Unix, Solaris, and Windows platforms.
  • They are relatively inexpensive.
  • All models contain built-in encryption.
  • They include built-in proxy server capabilities.

Question 85

Question
In which mode of operation does Snort display a continuous stream of packet contents to the console?
Answer
  • Heuristic mode
  • Network intrusion-detection mode
  • Packet logger mode
  • Packet sniffer mode

Question 86

Question
In comparing a packet filter firewall with a stateful packet inspection firewall (SPI), the SPI firewall is:
Answer
  • LESS susceptible to ping and SYN floods but MORE susceptible to IP spoofing
  • LESS susceptible to ping and SYN floods and LESS susceptible to IP spoofing.
  • MORE susceptible to ping and SYN floods and MORE susceptible to IP spoofing
  • MORE susceptible to ping and SYN floods and LESS susceptible to IP spoofing

Question 87

Question
Which of the following are four basic types of firewalls?
Answer
  • Screening, bastion, dual-homed, circuit level
  • Packet filtering, application gateway, circuit level, stateful packet inspection
  • Stateful packet inspection, gateway, bastion, screening
  • Application gateway, bastion, dual-homed, screening

Question 88

Question
In many typical configurations with multiple firewalls, e-mail servers and FTP servers are located in the:
Answer
  • internal corporate network
  • demilitarized zone
  • corporate intranet
  • external network

Question 89

Question
Which of the following is not an advantage of the Fortigate firewall?
Answer
  • Built-in encryption
  • Built-in virus scanning
  • Content filtering
  • Low cost

Question 90

Question
Should a home user block ICMP traffic, and why or why not?
Answer
  • It should be blocked because such traffic is often used to transmit a virus
  • It should be blocked because such traffic is often used to do port scans and flood attacks
  • It should not be blocked because it is necessary for network operations
  • It should not be blocked because it is necessary for using the Web

Question 91

Question
Why might a proxy gateway be susceptible to a flood attack?
Answer
  • It does not require user authentication
  • It allows multiple simultaneous connections
  • It does not properly filter packets
  • Its authentication method takes more time and resources

Question 92

Question
A standalone technology that hides internal addresses from the outside and only allows connections that originate from inside the network is called:
Answer
  • TFTP
  • HTTP
  • DMZ
  • NAT

Question 93

Question
What is another term for preemptive blocking?
Answer
  • Banishment vigilance
  • Intruder blocking
  • Intrusion deflection
  • User deflection

Question 94

Question
Which serves as a single contact point between the Internet and the private network?
Answer
  • Bastion host
  • DMZ
  • Screened host
  • Dual-homed host

Question 95

Question
One type of intrusion-detection and avoidance which involves identifying suspect IP addresses and preventing intrusions is called:
Answer
  • anomaly detection
  • intrusion deterrence
  • preemptive blocking
  • intrusion deflection

Question 96

Question
NAT is a replacement for what technology?
Answer
  • Proxy server
  • Firewall
  • IDS
  • Antivirus software

Question 97

Question
Which is a robust commercial software firewall solution for Linux operating systems?
Answer
  • SonicWALL
  • Wolverine
  • McAfee Personal Firewall
  • Symantec Norton Firewall

Question 98

Question
Which is true about Windows XP Internet Connection Firewall (ICF)?
Answer
  • It has a logging feature enabled by default.
  • It works best in conjunction with a perimeter firewall.
  • It blocks incoming and outgoing packets.
  • It is a screened host firewall.

Question 99

Question
Which of the following is not a profiling strategy used in anomaly detection?
Answer
  • Executable profiling
  • Threshold monitoring
  • Resource profiling
  • System monitoring

Question 100

Question
Which type of intrusion-detection relies on people rather than software or hardware?
Answer
  • Banishment vigilance
  • Intrusion deterrence
  • Infiltration
  • Anomaly detection

Question 101

Question
Which type of firewall is included in Windows XP and many distributions of Linux operating systems?
Answer
  • Stateful packet inspection
  • User authentication
  • Packet filter
  • Application proxy

Question 102

Question
What is one complexity found in enterprise environements that is unlikely in small networks or SOHO environments?
Answer
  • Users running different applications
  • Multiple operating systems
  • Diverse user groups
  • Web vulnerabilities

Question 103

Question
What type of firewall requires individual client applications to be authorized to connect?
Answer
  • Stateful packet inspection
  • Dual-homed
  • Application gateway
  • Screened gateway

Question 104

Question
Which of the following is not one of Snort’s modes?
Answer
  • Network intrusion-detection
  • Sniffer
  • Packet logger
  • Packet filtering

Question 105

Question
What tool does McAfee Personal Firewall offer?
Answer
  • A visual tool to trace attacks
  • NAT
  • Strong encryption
  • Vulnerability scanning

Question 106

Question
An open source software circuit level gateway is available from which of the following?
Answer
  • Watchguard Technologies
  • SonicWALL
  • Teros
  • Amrita Labs

Question 107

Question
Which of the following are four basic types of firewalls?
Answer
  • Application gateway, bastion, dual-homed, screening
  • Packet filtering, application gateway, circuit level, stateful packet inspection
  • Stateful packet inspection, gateway, bastion, screening
  • Screening, bastion, dual-homed, circuit level

Question 108

Question
Which type of firewall creates a private virtual connection with the client?
Answer
  • Circuit level gateway
  • Dual-homed
  • Application gateway
  • Bastion

Question 109

Question
Which type of firewall negotiates between the server and client to permit or deny connection based on the type of software and connection requested?
Answer
  • Circuit level gateway
  • Application gateway
  • Packet filter
  • Stateful packet inspection

Question 110

Question
Which firewall configuration would be appropriate within a network to separate and protect various subnets of a network to provide greater security?
Answer
  • bastion host
  • demilitarized zone
  • router-based
  • dual-homed host

Question 111

Question
Which of the following is not a common feature of most single PC firewalls?
Answer
  • Packet filtering
  • Software-based
  • Ease of use
  • Built-in NAT

Question 112

Question
It should be routine for someone in the IT security staff to
Answer
  • Reboot the firewall
  • Physically inspect the firewall
  • Review firewall logs
  • Test the firewall by attempting a ping flood

Question 113

Question
A firewall designed to secure an individual personal computer is a:
Answer
  • screened host firewall
  • single machine firewall
  • simple hardware firewall
  • combination hardware/software firewall

Question 114

Question
What type of firewall is SonicWALL TI70?
Answer
  • Application gateway
  • Circuit-level gateway
  • Packet screening
  • Stateful Packet Inspection

Question 115

Question
Which of the following is an advantage of the network host-based configuration?
Answer
  • It is resistant to IP spoofing
  • It has user authentication
  • It is inexpensive or free
  • It is more secure

Question 116

Question
Which of the following is a benefit of Cisco firewalls?
Answer
  • Very low cost
  • Built-in virus scanning on all products
  • Built-in IDS on all products
  • Extensive training available on the product

Question 117

Question
Once a circuit level gateway verifies the user’s logon, it creates a virtual circuit between:
Answer
  • the internal client and the external server
  • the external server and the proxy server
  • the external server and the firewall
  • the internal client and the proxy server

Question 118

Question
At what OSI layer do packet filters function?
Answer
  • Physical layer
  • Transport layer
  • Network layer
  • Data link layer

Question 119

Question
Which is NOT a function of an intrusion-detection system?
Answer
  • Inspect all inbound and outbound port activity
  • Notify the system administrator of suspicious activity
  • Infiltrate the illicit system to acquire information
  • Look for patterns in port activity

Question 120

Question
What might one see in an implementation of intrusion deterrence?
Answer
  • Real resources with fake names
  • Fake resources with legitimate-sounding names
  • Blocking of legitimate users by mistake
  • Profiling of users, resources, groups, or applications

Question 121

Question
A system that is set up for attracting and monitoring intruders is called what?
Answer
  • Fly paper
  • Honey pot
  • Hacker cage
  • Trap door

Question 122

Question
A device that hides internal IP addresses is called
Answer
  • Dual-homed host
  • Bastion firewall
  • Proxy server
  • A screened host

Question 123

Question
Medium-sized networks have what problem?
Answer
  • Low budgets
  • Diverse user group
  • Need to connect multiple LANs into a single WAN
  • Lack of skilled technical personnel

Question 124

Question
A firewall that uses a combination of approaches rather than a single approach to protect the network is called:
Answer
  • multi-homed
  • dual-homed
  • open source
  • hybrid

Question 125

Question
How can vulnerability to flooding attacks be reduced with an application gateway?
Answer
  • Packets are continually checked during the connection
  • Vulnerability to flooding attacks with an application gateway cannot be mitigated
  • Authenticating users
  • External systems never see the gateway

Question 126

Question
Identifying abnormal activity on a firewall requires that one establish a:
Answer
  • baseline
  • screened host
  • bastion host
  • proxy server

Question 127

Question
An intrusion-detection system detecting a series of ICMP packets sent to each port from the same IP address might indicate:
Answer
  • scanning of the system for vulnerabilities prior to an attack
  • Trojan horse/virus infection sending information back home
  • a Distributed Denial of Service attack in progress
  • the system has been infiltrated by an outsider

Question 128

Question
Why is an SPI firewall less susceptible to spoofing attacks?
Answer
  • It requires user authentication
  • It requires client application authentication
  • It automatically blocks spoofed packets
  • It examines the source IP of all packets

Question 129

Question
What is ICF?
Answer
  • Windows XP Internet Connection Firewall
  • Windows 2000 Internet Connection Firewall
  • Windows 2000 Internet Control Firewall
  • Windows XP Internet Control Firewall

Question 130

Question
Which is a firewall vendor manufacturing a host-based firewall for Windows 2000 Server, Sun Solaris, and Red Hat Linux environments?
Answer
  • D-Link
  • Wolverine
  • Check Point
  • Cisco

Question 131

Question
Which of the following is not a reason to avoid choosing infiltration as part of an IDS strategy?
Answer
  • It can be time consuming
  • It requires knowledge of the target group
  • It can be expensive
  • The group may retaliate

Question 132

Question
A series of ICMP packets sent to your ports in sequence might indicate what?
Answer
  • A packet sniffer
  • A port scan
  • A DoS attack
  • A ping flood

Question 133

Question
An intrusion-detection method that measures and monitors how programs use system resources is called:
Answer
  • user/group profiling.
  • resource profiling.
  • executable profiling.
  • threshold monitoring.

Question 134

Question
Which strategy is used in the implementation of intrusion deterrence?
Answer
  • Installing honey pots to pose as important system
  • Monitoring connection attempts to identify IP addresses of attackers
  • Using fake names to camouflage important systems
  • Infiltrating online hacker groups

Question 135

Question
Which method of intrusion-detection develops historic usage levels to measure activity against?
Answer
  • Threshold monitoring
  • Application profiling
  • Resource profiling
  • Infiltration profiling

Question 136

Question
What is the greatest danger in a network host-based configuration?
Answer
  • SYN flood attacks
  • IP spoofing
  • Operating System Security flaws
  • Ping flood attacks

Question 137

Question
Which type of firewall is generally the simplest and least expensive?
Answer
  • Circuit level gateway
  • Application gateway
  • Packet filter
  • Stateful packet inspection

Question 138

Question
Implementation of intrusion deflection as a strategy requires the use of:
Answer
  • fake targets
  • blocking software
  • warnings to intruders to leave
  • innocuous names for sensitive targets

Question 139

Question
Which of the following is found in Norton’s personal firewall but not in ICF?
Answer
  • Strong encryption
  • Vulnerability scanning
  • A visual tool to trace attacks
  • NAT

Question 140

Question
Which of the following is a common problem when seeking information on firewalls?
Answer
  • Unbiased information may be hard to find.
  • It is difficult to find information on the Web.
  • Information often emphasizes price rather than features.
  • Documentation is often incomplete

Question 141

Question
Which of the following can be shipped preconfigured?
Answer
  • Router-based firewalls
  • Stateful packet inspection firewalls
  • Dual-homed firewalls
  • Network host-based firewalls

Question 142

Question
Which is a term used to refer to the process of authentication and verification?
Answer
  • Filtering
  • Negotiation
  • Connecting
  • Screening

Question 143

Question
Which type of firewall negotiates between the server and client to permit or deny connection based on the type of software and connection requested?
Answer
  • Circuit level gateway
  • Stateful packet inspection
  • Application gateway
  • Packet filter

Question 144

Question
Which intrusion detection strategy monitors and compares activity against preset acceptable levels?
Answer
  • Threshold monitoring
  • Infiltration monitoring
  • Application monitoring
  • Resource profiling

Question 145

Question
Which of the following is a problem with the approach of a profiling strategy that is used in anomaly detection?
Answer
  • It misses many attacks
  • It is resource intensive
  • It yields many false positives
  • It is difficult to configure

Question 146

Question
What is the purpose of the warning configuration for Specter’s email file?
Answer
  • To scare off at least novice hackers
  • To keep your normal users honest
  • To deter highly skilled hackers
  • To track hackers back to their source IPs

Question 147

Question
Regarding the Firewall-1 firewall, which of the following is NOT true?
Answer
  • It is particularly vulnerable to SYN floods.
  • It is a packet filtering, application gateway hybrid.
  • It uses Stateful Packet Inspection.
  • It automatically blocks and logs oversized packets.

Question 148

Question
IDS is an acronym for:
Answer
  • Intrusion deterrence service
  • Intrusion-detection service
  • Intrusion deterrence system
  • Intrusion-detection system

Question 149

Question
What is the most important security advantage to NAT?
Answer
  • It hides internal network addresses
  • By default it blocks all ICMP packets
  • It blocks incoming ICMP packets
  • By default it only allows outbound connections

Question 150

Question
Which is true about the Wolverine firewall solution?
Answer
  • It includes built-in VPN capabilities.
  • It works on Linux, Unix, Solaris, and Windows platforms.
  • Encryption can be added with a free Web download.
  • It is expensive.

Question 151

Question
What four rules must be set for packet filtering firewalls?
Answer
  • Username, password, protocol type, destination IP
  • Source IP, destination IP, username, password
  • Protocol type, source port, destination port, source IP
  • Protocol version, destination IP, source port, username

Question 152

Question
Setting up parameters for acceptable use, such as the number of login attempts, and watching to see if those levels are exceeded is referred to as what?
Answer
  • Resource profiling
  • Executable profiling
  • System monitoring
  • Threshold monitoring

Question 153

Question
Attempts by an intruder to determine information about a system prior to the start of an intrusion attack is called:
Answer
  • foot printing
  • infiltration
  • deflecting
  • detecting

Question 154

Question
Which is NOT a service included in the Norton single machine firewall?
Answer
  • Data recovery
  • Popup ad blocking
  • Blocking of outgoing traffic
  • Privacy protection

Question 155

Question
Banishment vigilance is another name for:
Answer
  • anomaly detection
  • intrusion deflection
  • intrusion deterrence
  • preemptive blocking

Question 156

Question
Which type of encryption is included with the T170?
Answer
  • PGP and AES
  • WEP and DES
  • WEP and PGP
  • AES and DES

Question 157

Question
Which is a unique feature of the McAfee Personal Firewall that is not found on most personal firewalls?
Answer
  • Blocking incoming traffic on selected ports
  • Online scanning of system for vulnerabilities
  • Performing traceroute to show the source of incoming packets
  • Recording a log of all attempts at incoming packets

Question 158

Question
Why might you run Specter in strange mode?
Answer
  • It will be difficult to determine the system is a honey pot
  • It will deter novice hackers
  • It may fascinate hackers and keep them online long enough to catch them
  • It may confuse hackers and deter them from your systems

Question 159

Question
A firewall configuration using a server as a router and running multiple network interfaces with automatic routing disabled is an example of a:
Answer
  • dual-homed host
  • screened host
  • router-based
  • network host-based

Question 160

Question
Why might a proxy gateway be susceptible to a flood attack?
Answer
  • Its authentication method takes more time and resources
  • It does not properly filter packets
  • It allows multiple simultaneous connections
  • It does not require user authentication

Question 161

Question
Which intrusion-detection method measures activity levels against known short-term and/or long-term work profiles?
Answer
  • Threshold monitoring
  • User/group work profiling
  • Executable profiling
  • Resource profiling

Question 162

Question
Why might a circuit level gateway be inappropriate for some situations?
Answer
  • It blocks web traffic
  • It is simply too expensive
  • It has no user authentication
  • It requires client side configuration

Question 163

Question
Which is NOT true about enterprise networks and firewall solutions?
Answer
  • They are likely to be supported by multiple network administrators.
  • They are usually made up of several interconnected networks.
  • They are usually easier to manage and secure.
  • They are likely to contain several different operating systems.

Question 164

Question
Attempting to make your system appear less appealing is referred to as what?
Answer
  • Intrusion deterrence
  • System deterrence
  • System camouflage
  • Intrusion deflection

Question 165

Question
Which of the following is an important feature of D-Link DFL 300?
Answer
  • Vulnerability scanning
  • Liberal licensing policy
  • WEP encryption
  • Built-in IDS

Question 166

Question
Which firewall solution would be best for a large enterprise running Windows XP Professional and Linux operating systems, using the Internet, and requiring remote access to their Intranet server for field sales people?
Answer
  • Check Point Firewall-1
  • Cisco PIX 515E
  • Fortigate 3600
  • Windows XP Internet Connection Firewall

Question 167

Question
Why is an SPI firewall more resistant to flooding attacks?
Answer
  • It automatically blocks large traffic from a single IP
  • It requires user authentication
  • It examines each packet in the context of previous packets
  • It examines the destination IP of all packets

Question 168

Question
A profiling technique that monitors how applications use resources is called what?
Answer
  • Application monitoring
  • Resource profiling
  • System monitoring
  • Executable profiling

Question 169

Question
Symantec Decoy Server does all of the following EXCEPT:
Answer
  • simulate incoming mail server functions
  • record all traffic related to an intrusion attack
  • simulate outgoing mail server functions
  • track attacking packets to their source

Question 170

Question
Attempting to attract intruders to a system set up to monitor them is called what?
Answer
  • Intrusion routin
  • Intrusion deterrence
  • Intrusion banishment
  • Intrusion deflection

Question 171

Question
Which type of firewall is considered the most secure?
Answer
  • Circuit-level gateway
  • Stateful packet inspection
  • Dual-homed
  • Packet screening

Question 172

Question
Following rules and learning from experience as part of the process to identify and notify an administrator about an intrusion are typical when Snort is operating in which mode?
Answer
  • Network intrusion-detection mode
  • Packet logger mode
  • Sniffer mode
  • Command mode

Question 173

Question
Using a server running the Linux operating system with its built-in firewall as the network firewall is one example of which firewall configuration?
Answer
  • screened host
  • network host-based
  • router-based
  • dual-homed host

Question 174

Question
Which of the following solutions is actually a combination of firewalls?
Answer
  • Dual-homed firewalls
  • Router-based firewalls
  • Screened firewalls
  • Bastion host firewalls

Question 175

Question
Which is NOT one of the basic premises under which a honey pot functions?
Answer
  • Intruders will tend to go for easy targets with valuable data
  • Any traffic to the honey pot is suspicious
  • Security must allow attackers inside
  • Only legitimate users have a reason to connect to it

Question 176

Question
In many typical configurations with multiple firewalls, e-mail servers and FTP servers are located in the:
Answer
  • demilitarized zone
  • internal corporate network
  • corporate Intranet
  • external network
Show full summary Hide full summary

Want to create your own Quizzes for free with GoConqr? Learn more.

Similar

CCNA Security 210-260 IINS - Exam 3
Mike M
Application of technology in learning
Jeff Wall
Innovative Uses of Technology
John Marttila
Ch1 - The nature of IT Projects
mauricio5509
The Internet
Gee_0599
CCNA Answers – CCNA Exam
Abdul Demir
SQL Quiz
R M
Professional, Legal, and Ethical Issues in Information Security
mfundo.falteni
System Analysis
R A
Flash Cards Networks
JJ Pro Wrestler
EDUC260- Multimodal Literacies for a Digital Age
angelwoo2002
Browse Library