• Shuffle
    Toggle On
    Toggle Off
  • Alphabetize
    Toggle On
    Toggle Off
  • Front First
    Toggle On
    Toggle Off
  • Both Sides
    Toggle On
    Toggle Off
  • Read
    Toggle On
    Toggle Off
Reading...
Front

Card Range To Study

through

image

Play button

image

Play button

image

Progress

1/247

Click to flip

Use LEFT and RIGHT arrow keys to navigate between flashcards;

Use UP and DOWN arrow keys to flip the card;

H to show hint;

A reads text to speech;

247 Cards in this Set

  • Front
  • Back
Define the internetwork.
An internetwork is a set of networks that are connected with routers.
What does a heterogeneous network environment consist of?
Heterogeneous network environments consist of computer systems from different vendors that run
different operating systems and communication protocols.
A network of components from the same vendor or compatible equipment that all run under the same OS or NOS is what kind of network?
Homogenous network
Which type of network (homogenous vs heterogeneous) is more common?
Heterogeneous network
What is a communications network that serves users within a confined geographical area?
LAN
What type of network usually provides services for 2 to 10 users?
Peer-to-peer
How many users does a single server network normally service?
10-50 users
What type of network can service 1000 or more users?
Enterprise network
What is used for addressing on a physically connected network to identify network nodes?
MAC (media access control)
What is the numbering system that computers use to represent data?
Binary
Within IP addressing, how many bits are used and how are they broken down?
32 bits; 4 sets of 8 bits
What mechanism is used to designate a part of an IP address as the network address, and other parts as the host address?
Subnet mask
What is the primary reason for subnetting in IPv4?
Improve efficiency in using a limited number of available address spaces, and to improve security.
What bits in an IP address are routers mainly concerned with.
Ones tagged with "1". A "0" means don't look.
What is the Air Force instruction series that covers NM (network management)?
AFI 33 series
What does AFPD 33-1, Information Resources Management, establishes policy on?
AFPD 33–1 establishes AF policy for responsibly acquiring, planning, and
managing its information resources.
AFI 33-104, Base-Level Planning and Implemenation, outlines what actions?
Outlines standardized management practices and tells how to manage
planning and implementation of communications and information systems and
the base-level infrastructure.
What three areas of distributed responsibility does the DIICC (Defense Information Infrastructure Control Concept) consist of?
Global, Regional, & Local
What is NM?
Systems
management provides mechanisms for monitoring, control, and coordination of resources within the
open systems interconnection (OSI) environment, and OSI protocol standards for communicating
information pertinent to those resources.
What is a NM server?
A network management server is defined as a bundle of application software designed to significantly
improve network efficiency and productivity. The network management server is essentially a
network server that specifically runs simple network management protocol (SNMP)-based
management applications.
Where should the NM server be located?
In an area that is strictly controlled by the NCC.
Briefly describe the three most common NM architectures.
Centralized - NM platform on one computer system at a location that is responsible
for all NM duties
Hierachical- Multiple systems, with one system acting as a central server and the
others working as clients
Distributed- Combines the centralized and hierarchical architectures
What is the primary reason for subnetting in IPv4?
Improve efficiency in using a limited number of available address spaces, and to improve security.
What bits in an IP address are routers mainly concerned with.
Ones tagged with "1". A "0" means don't look.
What is the Air Force instruction series that covers NM (network management)?
AFI 33 series
What does AFPD 33-1, Information Resources Management, establishes policy on?
AFPD 33–1 establishes AF policy for responsibly acquiring, planning, and
managing its information resources.
AFI 33-104, Base-Level Planning and Implemenation, outlines what actions?
Outlines standardized management practices and tells how to manage
planning and implementation of communications and information systems and
the base-level infrastructure.
What three areas of distributed responsibility does the DIICC (Defense Information Infrastructure Control Concept) consist of?
Global, Regional, & Local
What is NM?
Systems
management provides mechanisms for monitoring, control, and coordination of resources within the
open systems interconnection (OSI) environment, and OSI protocol standards for communicating
information pertinent to those resources.
What is a NM server?
A network management server is defined as a bundle of application software designed to significantly
improve network efficiency and productivity. The network management server is essentially a
network server that specifically runs simple network management protocol (SNMP)-based
management applications.
Where should the NM server be located?
In an area that is strictly controlled by the NCC.
Briefly describe the three most common NM architectures.
Centralized - NM platform on one computer system at a location that is responsible
for all NM duties
Hierachical- Multiple systems, with one system acting as a central server and the
others working as clients
Distributed- Combines the centralized and hierarchical architectures
Briefly describe each of the four levels of activity that one must understand before applying
management to specific services or devices?
(1) Inactive —This is the case when no monitoring is accomplished.
(2) Reactive— This is where network support personnel react to a problem after it has occurred yet no
monitoring has been applied.
(3) Interactive— This is where you are monitoring components, but must interactively troubleshoot to
eliminate the side-effect alarms and isolate to a root cause.
(4) Proactive— This is where the automated monitoring components provide interactive problem
analysis, giving a root cause alarm for the problem at-hand, and automatic restorative processes are
in-place wherever possible to minimize downtime.
What is configuration management?
The process of obtaining data from the network and using that data to manage the setup of all managed
network devices.
What are the two features built into an NMS that alleviate manually configuring a network’s
devices?
(1) Automatic discovery.
(2) Auto-mapping features.
What does performance management consist of?
The facilities needed to evaluate the behavior of network objects and the effectiveness of communications
activities.
List the steps that you must take to provide accurate performance management.
(1) Gather statistical information (trend analysis).
(2) Maintain and examine logs of system state (history).
(3) Determine system performance under natural and artificial conditions.
(4) Alter system modes of operation for the purpose of conducting performance management.
What are the two functional categories of performance management? Describe each.
(1) Monitoring –The function that tracks historical data by tracking activities on the network.
(2) Tuning–Deals strictly with the adjustment of the parameters on the network devices to improve their
overall operation.
What is security management?
The protection of sensitive information on devices attached to a data network by controlling access points
to that information.
What are the two subsections of security management?
(1) Network security.
(2) NMS security.
What is fault management?
The process of identifying, locating and correcting network problems.
What is the difference between a fault and an error?
Faults are abnormal conditions that require NCC personnel to take action to correct or repair. Errors
sometimes arise on a normal functioning of the network and do not necessarily require attention.
What are some drawbacks to ICMP pinging as a NM tool?
Unreliable delivery of packets, need for polling (user intensive), and limited information derived from
responses.
What is a MIB?
A hierarchical, structured format that defines the NM information available from network devices.
What are the two parts of the labeled node?
(1) An object identifier.
(2) A short text description.
What are the two types of nodes that make up the MIB tree?
(1) Labeled nodes.
(2) Leaf nodes.
What are the differences between the two types of nodes that make of the MIB tree?
Labeled nodes may or may not have subordinate nodes, leaf nodes never have subordinate nodes. Word
formatted (labeled) nodes allow people to read and understand what the label is pointing to, while the
decimal (leaf) nodes are how the NMS tracks the information.
Briefly describe each of the four levels of activity that one must understand before applying
management to specific services or devices?
(1) Inactive —This is the case when no monitoring is accomplished.
(2) Reactive— This is where network support personnel react to a problem after it has occurred yet no
monitoring has been applied.
(3) Interactive— This is where you are monitoring components, but must interactively troubleshoot to
eliminate the side-effect alarms and isolate to a root cause.
(4) Proactive— This is where the automated monitoring components provide interactive problem
analysis, giving a root cause alarm for the problem at-hand, and automatic restorative processes are
in-place wherever possible to minimize downtime.
What is configuration management?
The process of obtaining data from the network and using that data to manage the setup of all managed
network devices.
What are the two features built into an NMS that alleviate manually configuring a network’s
devices?
(1) Automatic discovery.
(2) Auto-mapping features.
What does performance management consist of?
The facilities needed to evaluate the behavior of network objects and the effectiveness of communications
activities.
List the steps that you must take to provide accurate performance management.
(1) Gather statistical information (trend analysis).
(2) Maintain and examine logs of system state (history).
(3) Determine system performance under natural and artificial conditions.
(4) Alter system modes of operation for the purpose of conducting performance management.
What are some examples of what a node in SNMP can represent?
A node can represent a workstation, client, network user, personal computer, server, printer, or other device
attached to a data network.
Briefly describe each of the two categories of SNMP.
(1) Managers—Typically a computer that is used to run one or more NMS applications (suite).
(2) Agents—Responsible for monitoring, collecting and reporting management data to the management
system.
What does the Get operation do?
The Get query retrieves the value of one instance of management information.
What does the Set operation do?
Modifies the value of one or more instances of management information.
What is a trap?
An unsolicited message from an agent to the manager; it does not have a corresponding request message.
What are community names?
Each SNMP community is a group that contains at least one agent and one management system. The logical
name assigned to such a group we call the community name.
Describe each of the two types of community names.
(1) Read—Community names as implied define a community that is read only.
(2) Write—Community names are defined to allow the manager to remotely change configuration
information from the management station or server.
What do the two hierarchies provided by the CIM describe?
Physical hierarchies describe the real-world components, while Logical hierarchies are visible through
network protocols.
What are the three methods for creating a representation of a network topology within the domain
managers repository?
(1) Auto-discovery.
(2) Manual discovery.
(3) Topology import.
What are the three main components of SMARTS?
(1) Domain manager(s).
(2) A broker.
(3) Clients.
List the five different map types that can be accessed through the map console?
(1) Physical Connectivity.
(2) IP Network Connectivity.
(3) IP Network Membership.
(4) VLAN Connectivity.
(5) VLAN Membership.
What is the primary console in SMARTS and what does it display?
Monitoring console; it is used to display the results of the domain manager’s correlation alarms.
Briefly describe the differences between the two types of polling used by SMARTS to gather
information?
Fault and performance data is collected using SNMP while device connectivity is monitored using CMP.
What two factors determine if a SMARTS map is opened with read-write access or with readonly
access?
(1) Only one user can have a specific map opened with read-write access at anyone time.
(2) You can use the file system (FAT or NTFS) to purposely allow specific users to read-write or readonly
access to a map by setting permission to the files.
What are the three types of notifications used in SMARTS?
(1) Problem.
(2) Compound event.
(3) Symptomatic event.
List eight of the objects that can be tracked through the Windows performance monitor.
Browser Network Interface Server
Cache Objects Server Work Queues
ICMP (PING) Paging File System
IP Physical Disk TCP
Logical Disk Process Telephony
Memory Processor Thread
NBT Connection Redirector UDP0
What are the primary capabilities provided by a protocol analyzer?
Digital network diagnostics and developing communications software.
What is the difference between a protocol analyzer NIC and other NICs?
The NIC in a protocol analyzer is configured to process all frames, whereas other NICs only process
broadcast frames and frames with its MAC address.
What is the recommended minimum amount of time to acquire network information to establish a
performance baseline?
24 hours.
What function of the protocol analyzer excludes specific types of frames?
The Capture filters option allows you to display and store only the data you are interested in analyzing. You
may also use a capture filter to exclude specific types of frames.
List four types of specific occurrences that can be displayed by counters in the protocol analyzer.
(1) Packets transmitted.
(2) CRC errors.
(3) Undersize packets.
(4) Oversize packets.
(5) ARP requests.
(6) Data frame collisions.
(7) Bit errors.
On the protocol analyzer, what menu is best used to report errors that occur at the physical layer
such as bad FCS, short frames, and jabbers?
MAC node statistics.
On the protocol analyzer, what kind of information does the connection statistics menu provide?
Information concerning the bandwidth utilization and the number of connections that are related to specific
nodes.
What are the three types of active tests that are conducted with a protocol analyzer?
(1) PING.
(2) Trace route.
(3) Traffic generator.
(001) What is the minimum number of computers needed for a computer network?
a. 1.
B. 2.
c. 5.
d. 10.
(001) What is a privately-owned network whose access is restricted to authorized personnel is
called?
a. Homogeneous network.
b. Internetwork.
C. Intranetwork.
d. Local area network (LAN).
(001) What type of network environments consist of computer systems from different vendors that run different operating systems and communication protocols?
a. Internetwork.
b. Intranetwork.
c. Homogeneous network.
D. Heterogeneous network.
(001) What type of network is made up of components from the same vendor or compatible equipment that all run under the same operating system or network operating system?
a. Internetwork.
b. Intranetwork.
C. Homogeneous network.
d. Heterogeneous network.
(001) What is a communications network that serves users within a confined geographical area?
a. Global area network (GAN).
B. Local area network (LAN).
c. Metropolitan area network. (MAN).
d. Wide area network. (WAN).
(001) What type of communications network links a broad geographical region?
a. Global area network (GAN).
b. Local area network (LAN).
C. Metropolitan area network. (MAN).
d. Wide area network. (WAN).
(001) What type of communications network links different interconnected networks over an
unlimited geographical region?
A. Global area network (GAN).
b. Local area network (LAN).
c. Metropolitan area network. (MAN).
d. Wide area network. (WAN).
(001) How many users are normally in a peer-to-peer network?
A. 2-10.
b. 10-50.
c. 50-250.
d. 250-1,000.
(001) How many users are in a single-server network?
a. 2-10.
B. 10-50.
c. 50-250.
d. 250-1,000.
(001) How many users are in a multi-server network?
a. 2-10.
b. 10-50.
C. 50-250.
d. 250-1,000.
(001) How many users are in a multi-server high-speed backbone network?
a. 2-10.
b. 10-50.
c. 50-250.
D. 250-1,000.
(001) What type of communications network links geographically dispersed offices in other cities
or around the globe?
a. Local area network (LAN).
b. Metropolitan area network (MAN).
c. Multi-server high-speed backbone network.
D. Enterprise network.
(002) What is used to identify network nodes on a physically connected network?
A. Media access control address.
b. Network server name.
c. Subnet mask address.
d. Node serial number.
(002) How many octets is the standard internet protocol broken down into?
a. 2.
B. 4.
c. 6.
d. 8.
(002) What is the binary equivalent to the dotted decimal number 96?
A. 01100000.
b. 01100110.
c. 00001100.
d. 10000001.
(002) What is the network id of internet protocol (IP) address 131.10.230.120/24?
a. 0.0.0.120.
b. 0.10.230.0.
C. 131.10.230.0.
d. 255.255.255.0.
(002) What is the host id of internet protocol (IP) address 131.10.230.120/24?
A. 0.0.0.120.
b. 0.10.230.0.
c. 131.10.230.0.
d. 255.255.255.0.
(002) How many bits are typically covered in an internet protocol version 6 (IPv6) subnet mask?
a. 24.
b. 48.
C. 64.
d. 128.
(003) What series of Air Force instruction series covers communications and information?
a. 10.
b. 29.
c. 30.
D. 33.
(003) What Air Force instruction provides policy, direction, and structure for the Air Force global information grid (AF-GIG)?
a. AFPD 33–1.
b. AFI 33–112.
C. AFI 33–115v1.
d. AFI 29–2603v2.
(003) According to the Air Force network structure, what tier is the Air Force network operations center (AFNOSC)?
A. 1.
b. 2.
c. 3.
d. 4.
(003) What network entity provides reliable, secure networks and network services for base level customers?
A. Network control center (NCC).
b. Network control center-deployable (NCC-D).
c. Network operations center (NOSC).
d. Air Force network operations center (AFNOSC).
(004) What is defined as a bundle of application software designed to significantly improve network efficiency and productivity?
a. Fault management server.
B. Network management server.
c. Performance management server.
d. Security management server.
(004) Which of the following are the three most common network management architectures?
A. Centralized, hierarchical, and distributed.
b. Centralized, hybrid and distributed.
c. Centralized, hierarchical, and hybrid.
d. Hybrid, hierarchical, and distributed.
(004) What network architecture has a network management platform on one computer system at a location that is responsible for all network management duties?
A. Centralized.
b. Distributed.
c. Hierarchical.
d. Hybrid.
(004) What network architecture uses multiple systems for network management, with one system acting as a central server and the others working as clients?
a. Centralized.
b. Distributed.
C. Hierarchical.
d. Hybrid.
(004) What level of network management activity are you working at when you as the network manager are monitoring and troubleshooting components to eliminate the side-effect alarms and isolate problems to a root cause?
a. Inactive.
B. Interactive.
c. Proactive.
d. Reactive.
(004) What level of network management activity are you working at when the automated monitoring of components provides problem analysis, giving a root cause alarm for the problem at-hand?
a. Inactive.
b. Reactive.
c. Interactive.
D. Proactive.
(005) Performance management can be broke into what two separate functional categories?
a. Monitoring and analyzing.
b. Monitoring and replacing.
C. Monitoring and tuning.
d. Analyzing and tuning.
(005) Which function of performance management tracks historical data by tracking activities on the network?
a. Tuning.
b. Analyzing.
c. Gathering.
D. Monitoring.
(005) What network management area is concerned with controlling access points to information?
a. Configuration.
b. Performance.
c. Accounting.
D. Security.
(005) What is the established to distinguish between errors that fall within a normal range and excessive errors because of a fault?
a. Fault parameters.
B. Tolerance parameters.
c. Low-level software alarms.
d. Low-level hardware alarms.
(006) Network management protocols are designed (in most cases) to reside above what layer of the operational system interface (OSI) model?
A. Session.
b. Transport.
c. Presentation.
d. Application.
(006) What is a hierarchical structured format that defines the network management information available from network devices?
a. Object identifier.
b. Network device map.
c. Network protocol list.
D. Management information base.
(006) What area of the simple network management protocol (SNMP) tree structure is reserved for vendors related label and leaf objects associated with specific manufactured equipment?
a. Management.
B. Private.
c. Directory.
d. Experimental.
(006) What simple network management protocol (SNMP) node is responsible for monitoring, collecting and reporting management data to the management system?
a. Primary domain controller (PDC).
b. Backup domain controller.
c. Manager.
D. Agent.
(006) What operational simple network management protocol (SNMP) message asks for a specific instance of management information?
A. Get.
b. Set.
c. Trap.
d. GetNext.
(006) What operational simple network management protocol (SNMP) message is used to retrieve multiple pieces of information with minimal overhead?
a. Get.
b. Set.
c. Trap.
D. GetNext.
(006) What operational simple network management protocol (SNMP) message is used to modify the value of one or more instances of management information?
a. Get.
B. Set.
c. Trap.
d. GetNext.
(006) What operational simple network management protocol (SNMP) message is an unsolicited message from an agent to the manager?
a. Get.
b. Set.
C. Trap.
d. GetNext.
(007) What is the type of probe that collects inter-device connectivity information using proprietary topology management information bases (MIB)?
a. Virtual local area network (VLAN) probe.
B. Neighbor probe.
c. Containment probe.
d. System information probe.
(007) What is the centerpiece of a systems management automated report tracking system (SMARTS) application?
a. Broker.
b. Clients.
c. Map console.
D. Domain manager.
(007) What component of the systems management automated report tracking system (SMARTS) application contains knowledge of available domain managers?
A. Broker.
b. Clients.
c. Probes.
d. Consoles.
(007) What are the three types of systems management automated report tracking system (SMARTS) notifications?
a. Compound events, alarm, and trend.
b. Compound events, problems, and network.
c. Auto-discovery, compound, and symptomatic events.
D. Compound events, problems, and symptomatic events.
(007) What color on the systems management automated report tracking system (SMARTS) alarm log indicates one or more events?
a. Blue.
b. Orange.
C. Purple.
d. Yellow.
(008) How many different categories of information does the performance monitor provide you about your network?
a. 7.
b. 14.
c. 19.
D. 21.
(008) What device provides a capability for digital network diagnostics and developing communications software?
a. Systems management automated report tracking system (SMARTS).
B. Protocol analyzer.
c. Network root router.
d. Windows advanced server.
(008) What provides information concerning the network utilization and frame errors that are related to a specific protocol?
a. Media access control (MAC) node statistics.
b. Connection statistics.
C. Protocol statistics.
d. Node discovery.
(008) What reports errors that occur at the physical layer such as bad frame check sequence (FCS), short frames, and jabbers?
A. Media access control (MAC) node statistics.
b. Connection statistics.
c. Protocol statistics.
d. Node discovery.
(008) What automatically runs in the background when the protocol analyzer application is activated?
a. Media access control (MAC)
b. Connection statistics.
c. Protocol statistics.
D. Node discovery.
(008) What provides information concerning the bandwidth utilization and the number of connections that are related to specific nodes?
a. Media access control (MAC)
B. Connection statistics.
c. Protocol statistics.
d. Node discovery.
What is identification as it pertains to information protection?
Process of proving that a subject (e.g., a user or a system) is what the subject claims to be.
What is authentication as it pertains to information protection?
Authentication is defined as a measure used to verify the eligibility of a subject and the ability of the subject to access certain information.
What are the three primary ways to authenticate oneself on the network?
1) Knowledge based.
(2) Possession-based.
(3) Biometrics based, or to put it another way, something you know, something you have, and/or something you are.
On an Air Force network, what is your password required to have in it?
The Air Force requires a network password to be at least nine characters long, to have at least two upperand
lower-case letters (A/a, B/b, etc.), two numbers (0–9), and two special characters.
Where are biometrics based authentication and identification generally used, and why?
While biometric based systems provide very high levels of security (unique physical characteristics are
generally harder to counterfeit), they tend to be much more expensive, and are reserved for area’s that
require a very high level of security.
What is the biggest risk with a possession based system for identifying and authenticating
yourself?
Risk of counterfeiting, (creating a fake token).
Why would you use a combination of methods for identifying and authenticating yourself?
It substantially increases the security of an I &A system.
What are the three methods of providing strong authentication?
(1) Biometric and possession based methods.
(2) Cryptographically protected authentication (encrypted).
(3) Using one time passwords.
Where can you find specific guidance concerning remanence security?
AFSSI 8580, Remanence Security.
What is remanence security?
Remanence security is the use of prescribed safeguards and controls to prevent reconstruction or disclosure
of sensitive or classified information to persons who do not have the proper clearance or need to know for this information.
When something is sanitized, is it automatically declassified?
Sanitization does not automatically declassify media.
Until when must you retain classification controls?
Unit the media is sanitized and declassified, or destroyed in an approved manner.
When does the information owner of storage media declassify the media?
After the information owner provides evidence that no information resides on the media, the information
owner can declassify the media.
When is destroying storage media NOT necessary?
Physical destruction is not required if the media is sanitized and declassified.
What must you ensure when you are degaussing storage media?
You must ensure that the coercivity strength of the magnetic field generated by the degausser is strong
enough to return the magnetic media to its zero state.
Which AFI governs the AFCAP?
AFI 33–210, Air Force Certification and Accreditation Program (AFCAP).
What is the biggest difference between DIACAP and previous processes?
In previous processes, the C&A was usually accomplished as a separate process accomplished just prior to
connecting an IS to the network. DIACAP takes a different approach. It is a “cradle to grave” process
meant to track every IS and network from inception to retirement.
What are the five phases of the DIACAP process?
(1) Initiate and plan IA C&A.
(2) Implement and validate assigned IA controls.
(3) Make certification determination and accreditation decision.
(4) Maintain authorization to operate and conduct reviews.
(5) Decommission.
What two publications provide the basic framework of the C&A process?
(1) The IT lean reengineering process.
(2) AFI 33–210.
What is the SISSU checklist?
The SISSU checklist is a consolidated list of requirements covering each of those areas that a program
office must adhere to when developing and fielding a system.
What are the most common Air Force circuit-enclaves?
The base networks.
What are the SIPRNET, and NIPRNET, and how does the SIPRNET differ from the NIPRNET?
NIPRNet is an Unclassified but Sensitive IP Router Network. SIPRNET is also a long-haul IP based network, but it supports data classified up to secret. Unlike the NIPRNET, the SIPRNET does not provide access to the internet or any other lower classification networks.
What is the name of the concept that DOD uses in network defense?
Defense in depth.
What are some examples of computer security incidents?
(1) Compromise of integrity—A macro virus infects an application or a serious system vulnerability is
discovered.
(2) Denial of service—An attacker disables a system or a worm saturates network bandwidth.
(3) Misuse—An intruder (or insider) makes unauthorized use of an account.
(4) Damage— Data destruction by a virus.
(5) Intrusions—An intruder penetrates system security.
(6) Alterations—Data is changed to affect system performance.
Where would a network monitoring device such as an ASIM be placed in relation to the network?
An integrated network monitoring device, such as the ASIM, is placed outside the network boundary
protection mechanism to monitor all attempted attacks.
Describe tunneling.
This is the practice of encapsulating a message (that would be rejected by the firewall) inside a second
message that will pass through the firewall.
What kind of servers would typically be found in a DMZ?
(1) Web servers.
(2) SMTP (e-mail) servers.
(3) DNS servers.
(4) Proxy servers.
(5) Dial-up servers.
(6) Web Mail servers.
What is the simplest and least expensive type of firewall, and what is its purpose?
A packet filtering; it stops messages with inappropriate network addresses.
What type of firewall is used to separate secure sites, networks, or network segments from less
secure areas?
Bastion host.
Describe the two categories that security related access controls fall into?
(1) Technical controls, such as passwords and encryption that are part of normal network security.
(2) Administrative controls, such as segregation of duties and security screening of users.
Regardless of the source of the threat, what is it usually targeting?
The vulnerability or weakness in the network.
How does a virus activate?
For the virus to execute, the infected program must execute, activating the virus.
Describe botnets.
The term botnet refers to a group of computers that have been infected by bots under the control of a person or group.
How is a Trojan horse different from a regular virus?
It acts as a cover or disguise for something else. It does not replicate itself, so it technically is not a virus.
What step is taken before an IS is connected to the AFGIG?
All ISs on the AFGIG have a baseline configuration applied to them prior to being connected to the network.
What does the PKI enable users of basically unsecured public networks to do?
It enables users of basically unsecured public networks, such as the Internet, to securely and privately
exchange data through the use of public and private cryptographic key pairs obtained and shared through a
trusted authority.
What are the components that compose a PKI?
(1) A certificate policy management system.
(2) A registration authority verifies user requests for digital certificates and tells the certificate authority
to issue them.
(3) A CA that is responsible managing certificates.
(4) One or more directories or repositories are created where the certificates are held.
Describe a symmetric central server architecture.
A symmetric-cipher-based central server architecture is where each entity in the community shares a secret
key with the central server (usually called a Key Distribution Center or KDC).
Why are PKI keys said to by asymmetric?
The key for encryption and the key for decryption were related but conspicuously different. These keys would be so different, in fact, that it would be possible to publicize one without danger of anyone being able to derive or compute the other.
How do digital signatures work?
A digital signature functions similar to a hand-written signature because a single entity can sign some data,
but any number of entities can read the signature and verify its accuracy with the public key.
What do users use to verify that a particular public key belongs to a particular user?
Users can use that PKI certificate to verify that a particular public key belongs to a particular individual.
What is a CA responsible for?
Establishing, authenticating, maintaining, and, when needed, revoking certificates and hardware.
What are the two ways that key establishment can occur?
(1) By key transfer.
(2) Key agreement.
Describe key transfer.
In key transfer, one entity generates the symmetric key and sends it to the other entity.
Describe key agreement.
In key agreement, both entities jointly contribute to the generation of the symmetric key.
How long should ECDSA and ECDH keys be to provide adequate security for the medium-tolong
term?
The current state of research with respect to discrete logarithms over EC points suggests that ECDH and
ECDSA keys should be at least 192 bits long to provide adequate security for the medium-to-long term.
What was the fundamental premise in the original formulation of public-key cryptography?
The original formulation of public-key cryptography was that two strangers should be able to communicate securely.
What does the PKI user population trust CA authorities to do?
To perform the function of binding a public key pair to a given identity.
What are the four configurations for CA servers?
(1) Enterprise root CA.
(2) Enterprise subordinate CA.
(3) Stand alone root CA.
(4) Stand alone subordinate CA.
What happens when a certificate on a CRL is used?
If a certificate on the CRL is used for any reason, it will be rejected.
Describe a “user’s key history.”
This collection of certificates and corresponding private keys is known as the user’s key history.
What is the difference between a software token and a hardware token?
The hardware token has built in security of some sort, such as a code or password that must be entered to use the certificates and keys; a software token has no security other then what is provided by the host
system.
List the three types of certificates and what they are used for.
Those certificates are the public and private versions of three types of certificates:
(1) Identity—Used for digital signature and authentication functions. Examples would be signing on to the network or digitally signing an EPR.
(2) E-mail signing—Used to sign e-mail. This supports non-repudiation as you must type in your pin prior to the e-mail being sent.
(3) Encryption—To support data confidentiality. This allows for encryption of your e-mail. Note, certificates are set to expire every three years.
What does the global directory service provide for?
The ability to search for individuals, access information about them such as what their work phone number is or what their e-mail address is. It also contains the public key encipherment certificates, which allow other users to encrypt a message for that person that only they will be able to decipher.
What does middleware allow the use of?
In the case of PKI, middleware refers to the software that resides on the users system that allows the use of the CAC and the certificates contained on the CAC.
What does combat-ready communications and information forces provide?
The first-in and sustaining capabilities to support peacetime through combat operations worldwide.
Who plans, engineers, deploys, and employs support for all air and space forces?
Communications and information professionals.
What will disappear as personnel become adept in the standardized expeditionary C&I skill sets
needed to support Expeditionary Air and Space Forces throughout the entire
predeployment/deployment cycle?
The dividing line between “fixed” and “tactical” C&I.
Why do we have quicker response times, an efficient use of resources, and more effective training than previous Air and Space Expeditionary Force deployments?
Versatility and flexibility of certain systems utilized during both initial and sustained deployments.
Initial communications support is a major player in what area?
They provide the communicating link between forces securing the area and setting up support facilities as
well as providing messaging capabilities back to the garrison units.
Within what time frames are initial communications support designed to provide basic
communications to a bare base operation?
Within 24 to 72 hours of deployment notification and remain in place for up to 30 days.
What are the three major components in the TDC program and what does it provide?
(1) The LMST. It provides easily deployable, long haul communications.
(2) The ICAP. It provides switched voice and data traffic.
(3) The NCC-D. It provides radio, voice, record, and data communications; visual information services;
and information protections.
What is the mission of the sustained communications support teams?
To ensure AEF and AEW commanders have connectivity and an uninterrupted flow of mission critical information to field units, in-garrison units, and to command structures for the duration of the contingency
What program is a state-of-the-art ground communications infrastructure that is designed to replace existing older communication systems?
TDC program.
Is TDC-ICAP used in initial communications support or sustained communications support?
Both.
What is the TDC-ICAP network designed to provide and to what network area?
The TDC-ICAP network is a scalable network providing telephone, data, and switched message service to
customers at various locations within a metropolitan area.
What concept allows planners to scale the network to meet the needs of deployments ranging from a few subscribers to a full wing, or even a Joint Air Force Command Component?
Building block concept.
What is the conduit that ties all the LANs together and provides the interface to other networks?
The base hub (MAN) is the conduit that ties all the LANs together and provides the interface to other networks.
Which phase of the deployment cycle is all the preparation done?
The pre-deployment phase.
What order indicates that your unit may deploy?
Warning order.
Which phase in the deployment cycle do you enter after disembarking from your transportation?
Establish services.
Reconstitution.
In which phase of the deployment cycle do you replace and or repair worn equipment and replenish supplies?
(009) What is a measure used to verify the eligibility of a subject and the ability of the subject to access certain information?
a. Authentication.
(009) What are three primary ways to authenticate one-self?
d. Something you know, something you have, or something are.
(009) Knowledge-based identification and authentication methods require the user to provide
something you
a. know.
(009) The Air Force requires a network password to be at least how many characters long?
d. 9.
(010) What regulation covers remanence security?
b. AFSSI 8580.
(010) Storage media that retains data after power is removed is considered
c. sensitive.
(010) Which standard form is used to annotate storage media has been sanitized?
c. 711.
(010) Who can declassify storage media that has been sanitized?
d. Information owner.
(010) What is the process of physically damaging the media to render it unusable in a computer and render the data on the media irretrievable by any known exploitation methods?
a. Destroying.
(010) What is the process of erasing magnetic media by reducing the magnetic flux to virtual zero by applying a reverse magnetizing field?
b. Degaussing.
(010) What is the preferred method of sanitizing magnetic media?
a. Degaussing.
(011) What is a comprehensive evaluation and validation of an Air Force information system (IS)
to establish the degree to which it complies with assigned information assurance (IA) controls
based on standardized procedures?
d. Certification.
(011) What is a formal declaration by a designated approving official (DAA) that an information
system is approved to operate in a particular security mode using a prescribed set of safeguards at an acceptable level of risk?
c. Accreditation.
(011) What is the Department of Defense process for certifying and accrediting information systems to operate on the global information grid (GIG)?
d. Department of Defense Information Assurance Certification and Accreditation Process (DIACAP).
(011) What documentation is required to permanently connect to the global information grid (GIG) system?
a. Denial of authorization to operation (DATO).
(011) What process, along with AFI 33–210, Air Force Certification and Accreditation (C&A) Program (AFCAP), provides the basic framework of the certification & accreditation (C&A)?
a. Information technology (IT) lean reengineering.
(011) What do you call the consolidated list of requirements that a program office must adhere to
when fielding a system?
b. Security, interoperability, supportability, sustainability, and usability (SISSU).
(011) What is the database of record for registering all systems and applications?
b. Enterprise information technology data repository (EITDR).
(011) What is a collection of computing environments connected by one or more internal networks under the control of a single approval authority and security policy?
a. Enclave.
(011) How many non-secure internet protocol router network (NIPRNet) gateways does the Air Force possess?
b. 16.
(012) Which agency must approve all information protection tools prior to their use?
d. Headquarters United States Air Force (HQ USAF).
(012) What device is placed outside the boundary protection mechanism to monitor all attempted
attacks?
a. Intrusion detection system (IDS).
(012) What are examples of network attacks that bypass the firewall?
b. Tunneling and application-based attacks.
(012) What is the intrusion practice of encapsulating a message that would be rejected by the firewall inside a second message that will pass through the firewall?
a. Tunneling.
(012) A base web-server that interfaces with the public must be placed in what area of a base network?
d. De-militarized zone (DMZ).
(012) What is the simplest and least expensive way to stop inappropriate network addresses?
c. Packet filtering.
(012) What type of firewall consists of a screening router and a set of rules that accept or reject a message based on information in the message’s header (a packet): the source address, the destination address, and the port?
c. Packet filtering.
(012) What type of firewall is used to separate secure sites, networks, or network segments from less secure areas?
b. Bastion host.
(012) What type of firewall generates audit trails of all network-related activity for monitoring and intrusion detection purposes?
c. Bastion host.
(012) What network device performs rigorous examinations of systems to identify weaknesses that might allow security violations?
c. Vulnerability scanners.
(012) What action represents one of the greatest vulnerabilities to internal networks?
d. Network-connected computer systems with modems that make calls to and accept calls from
the public-switched network.
(012) What do you call a current and perceived capability, intention, or attack, directed to cause denial of service?
b. Threat.
(012) An information system on your network that is not set to require the use of a common
access card (CAC) or password would be considered a
b. vulnerability.
(012) A program that replicates by attaching itself to a program is a
a. virus.
(012) What type of malicious logic can form large networks that can be used to launch a variety of attacks without an information system owner’s knowledge?
d. Bot.
(012) What type of malicious logic can become active on an information system without the need to infect a file?
c. Worm.
(013) What is a cryptographic key and certificate delivery system that makes possible secure electronic transactions and exchanges of sensitive information between relative strangers?
b. Public key infrastructure (PKI).
(014) What can be used to encrypt a message so that it can only be decrypted by the recipient?
b. Public key.
(014) What is a file that is kept with you and will allow you to decrypt files encrypted specifically for you using your openly available encryption code?
c. Private key.
(014) What is an electronic document that officially links together a user’s identity with his public key?
d. Public key infrastructure (PKI) certificate.
(014) Which component of the public key infrastructure (PKI) is responsible for establishing,
authenticating, maintaining, and revoking certificates?
c. Certificate authority.
(015) The two ways key establishment can occur are key
a. transfer and agreement.
(015) Which public key algorithm is exclusively a key establishment protocol?
b. Diffie and Hellman.
(016) What is the primary unclassified public key infrastructure (PKI) token for individual PKI keys and certificates in the Air Force?
c. Common access card.
(017) Which team provides a communication link between forces securing the area and setting up support facilities?
c. Initial communications support teams.
(018) Sustained communications support becomes a part of the deployment if it exceeds
b. 30 days.
(018) Who provides uninterrupted flow of mission critical information to field and in-garrison units for the duration of a contingency?
d. Sustained communications support teams.
(018) What program is known as a state of the art ground-to-ground communications
infrastructure designed to provide base level full spectrum communications to the commander and all agencies on base?
c. Theater deployable communications (TDC).