Security Plus Chapter 8

Front 1

A Stateful Packet-Filtering Firewall filters traffic based on?

Back 1

Stateful Packet-Filtering Firewall filters traffic based on fields in the header of the packet, such as the source and destination IP address and the source and destination port numbers and what packets there needs to be in a three-way handshake.

Front 2

A Packet-Filtering Firewall filters traffic based on?

Back 2

Packet-Filtering Firewall filters traffic based on fields in the header of the packet, such as the source and destination IP address and the source and destination port numbers.

Front 3

An Application Firewall filters traffic based on?

Back 3

Application Firewall filters Stateful/Packet-filtering and payload data.

Front 4

What Home Router are multifunctional devices. What are the features it has?

Back 4

Network Address Translation (NAT), Firewall and URL-Filtering.

Front 5

What is the Dual-Homed Firewall Topology do?

Back 5

A single computer with two physical network interfaces that acts as a gateway between the networks. Software is used as firewalls and

Internet <-> Firewall <-> Internal Network

Front 6

What is the Screen-Host Firewall Topology do?

This is not a Firewall it is hardware.

Back 6

A Dual-Homed host with a screening router in between the host and the public network this allows packet filtering before packets reach the host.
Internet <-> Screen Router <-> Screened-Host
Firewall <-> Internal Network

Front 7

What is the Screened-Subnet Firewall Topology do?

Back 7

Internet <-> Screen Router <-> Screened-Host Firewall <-> Screen Router

<-> Internal Network

Front 8

What does a Private LAN firewall do?

Back 8

Ensures that no traffic from any other network is sent through the firewall.

Front 9

What is the DMZ?

Back 9

An area between two firewalls that allows selected traffic from the Internet to pass through the external firewall into the system withing the DMZ.

Front 10

What four servers are normally placed in the DMZ?

Back 10

1. DNS
2. Web
3. FTP
4. SMTP
   

Front 11

An Intrusion Detection System (IDS) is?

Back 11

Is responsible for monitoring activity on a system or network and then logging or notifying the administrator of any suspicious activity.

Front 12

Name three IDS System types?

Back 12

1. Signature-Based uses signature file
2. Anomaly-Based looks for abnormal traffic
3. Heuristic Based on the IDS past experiences used with anti-virus
   

Front 13

Name two methods of implementing IDS?

Back 13

1. Host-Based (HIDS) is installed on a single system and monitors suspicious activity on that system i.e. memory, system files, log files and connections
2. Network-Based (NIDS) can be installed as its own network device or software system. Analyzes all traffic across the network logs the details of the activity and sends out admin alerts. DOES NOT WORK ON ENCRYPTED NETWORKS.
   

Front 14

What are the components of a NIDS?

Back 14

1. Sensor: on each network segment collecting traffic and forwarding to the analysis engine.
2. Analysis Engine: receives sensor packets and determine if they are suspicious.
3. Console: Used to configure NIDS and is where alerts and notifications are typically sent.
   

Front 15

What are the two Classes of IDSes?

Back 15

1. Passive IDS: monitors suspicious activity logs it to a file and sends notifications to admin.
2. Active IDS and IPS: monitors suspicious activity logs it to a file and sends notifications to admin and takes protective measures. Now known as intrusion prevention system (IPS).
   

Front 16

What is the promiscuous mode of a network card?

Back 16

Means the network card will receive all traffic.

Front 17

What are two common methods of bypassing the filtering feature on a switch?

Back 17

1. Port mirroring: where a port is configured to receive all network traffic.
2. Network Tap: a device connected to the network which has ports used to connect a monitoring system to the device.

Front 18

Name three types of network designs?

Back 18

1. Subnetting: manipulates the subnet mask scheme to create different subnets
   
2. Segments: Creates Multiple collision domains and using bridges, switches, routers. Broadcast domains are created using different router ACL.
   
3. VLANs: Uses a single router divided into different broadcast domains.
   

Front 19

What is Network Address Translation (NAT)?

Back 19

A device that allows private address ranges on the inside of a network to be translated to public address thereby hiding the private network,

Front 20

What is Network Access Control (NAC)?

Back 20

Technology that allows you to control who can access your network based on specific conditions. If the conditions are not met then the device can be send to a restricted network, which allows them to remedy their situation.

Front 21

SIP and RTP are generally used with VoIP and it is common security practice to use a ____________ ________ should be set to separate them?

Back 21

to use a VLAN to separate them from other network traffic.