Intro To Security

Front 1

Firewalls can be categorized by processing mode, development era, or structure.

Back 1

True

Front 2

The firewall can often be deployed as a separate network containing a number of supporting devices.

Back 2

True

Front 3

Packet filtering firewalls scan network data packets looking for compliance with or violation of the rules of the firewall’s database.

Back 3

True

Front 4

A packet’s structure is independent from the nature of the packet.

Back 4

False

Front 5

The ability to restrict a specific service is now considered standard in most routers and is invisible to the user.

Back 5

True

Front 6

The application firewall runs special software that acts as a proxy for a service request.

Back 6

True

Front 7

A Web server is often exposed to higher levels of risk when placed in the DMZ than when it is placed in the untrusted network.

Back 7

False

Front 8

Circuit gateway firewalls usually look at data traffic flowing between one network and another.

Back 8

False

Front 9

The Cisco security kernel contains three component technologies: the Interceptor/Packet Analyzer, the Security Verification ENgine (SVEN), and Kernel Proxies.

Back 9

True

Front 10

Internal computers are always visible to the public network.

Back 10

False

Front 11

The SMC Barricade residential broadband router does not have an intrusion detection feature.

Back 11

False

Front 12

One method of protecting the residential user is to install a software firewall directly on the user’s system.

Back 12

True

Front 13

There are limits to the level of configurability and protection that software firewalls can provide.

Back 13

True

Front 14

All organizations with an Internet connection have some form of a router at the boundary between the organization’s internal networks and the external service provider.

Back 14

False

Front 15

The DMZ cannot be a dedicated port on the firewall device linking a single bastion host.

Back 15

False

Front 16

The screened subnet protects the DMZ systems and information from outside threats by providing a network of intermediate security.

Back 16

True

Front 17

Good policy and practice dictates that each firewall device, whether a filtering router, bastion host, or other firewall implementation, must have its own set of configuration rules.

Back 17

True

Front 18

Syntax errors in firewall policies are usually difficult to identify.

Back 18

False

Front 19

When Web services are offered outside the firewall, HTTP traffic should be blocked from internal networks through the use of some form of proxy access or DMZ architecture.

Back 19

True

Front 20

Firewall Rule Set 1 states that responses to internal requests are not allowed.

Back 20

False

Front 21

Some firewalls can filter packets by protocol name.

Back 21

True

Front 22

It is important that e-mail traffic reach your e-mail server and only your e-mail server.

Back 22

True

Front 23

Though not used much in Windows environments, Telnet is still useful to systems administrators on Unix/Linux systems.

Back 23

True

Front 24

A content filter is technically a firewall.

Back 24

False

Front 25

A content filter is essentially a set of scripts or programs that restricts user access to certain networking protocols and Internet locations.

Back 25

True

Front 26

Internet connections via dial-up and leased lines are becoming more popular.

Back 26

False

Front 27

The Extended TACACS version uses dynamic passwords and incorporates two-factor authentication.

Back 27

False

Front 28

Even if Kerberos servers are subjected to denial-of-service attacks, a client can request additional services.

Back 28

False

Front 29

A VPN allows a user to use the Internet into a private network.

Back 29

True

Front 30

On the client end, a user with Windows 2000 or XP can establish a VPN by configuring his or her system to connect to a VPN server.

Back 30

True

Front 31

Intrusion detection consists of procedures and systems that identify system intrusions and take action when an intrusion is detected.

Back 31

False

Front 32

A false positive is the failure of an IDPS system to react to an actual attack event.

Back 32

False

Front 33

The process by which attackers change the format and/or timing of their activities to avoid being detected by the IDPS is known as a false attack stimulus.

Back 33

False

Front 34

In DNS cache poisoning, valid packets exploit poorly configured DNS servers to inject false information to corrupt the servers’ answers to routine DNS queries from other systems on the network.

Back 34

True

Front 35

NIDPSs can reliably ascertain if an attack was successful or not.

Back 35

False

Front 36

HIDPSs are also known as system integrity verifiers.

Back 36

True

Front 37

A HIDPS can monitor systems logs for predefined events.

Back 37

True

Front 38

An HIDPS can detect local events on host systems and also detect attacks that may elude a network-based IDPS.

Back 38

True

Front 39

A HIDPS is optimized to detect multihost scanning, and it is able to detect the scanning of non-host network devices, such as routers or switches.

Back 39

False

Front 40

The statistical anomaly-based IDPS collects statistical summaries by observing traffic that is known to be normal.

Back 40

True

Front 41

IDPS responses can be classified as active or passive.

Back 41

True

Front 42

A passive response is a definitive action automatically initiated when certain types of alerts are triggered.

Back 42

False

Front 43

The Simple Network Management Protocol contains trap functions, which allow a device to send a message to the SNMP management console indicating that a certain threshold has been crossed, either positively or negatively.

Back 43

True

Front 44

An IDPS can be configured to dial a phone number and produce an alphanumeric page or a modem noise.

Back 44

True

Front 45

In order to determine which IDPS best meets an organization’s needs, first consider the organizational environment in technical, physical, and political terms.

Back 45

True

Front 46

Your organization’s operational goals, constraints, and culture should not affect the selection of the IDPS and other security tools and technologies to protect your systems.

Back 46

False

Front 47

All IDPS vendors target users with the same levels of technical and security expertise.

Back 47

False

Front 48

Intrusion detection and prevention systems perform monitoring and analysis of system events and user behaviors.

Back 48

True

Front 49

Intrusion detection and prevention systems can deal effectively with switched networks.

Back 49

False

Front 50

A fully distributed IDPS control strategy is the opposite of the centralized strategy.

Back 50

True

Front 51

A strategy based on the concept of defense in depth is likely to include intrusion detection systems, active vulnerability scanners, passive vulnerability scanners, automated log analyzers, and protocol analyzers.

Back 51

True

Front 52

To assist in the footprint intelligence collection process, you can use an enhanced Web scanner that, among other things, can scan entire Web sites for valuable pieces of information, such as server names and e-mail addresses.

Back 52

True

Front 53

Services using the TCP/IP protocol can run only on port 80.

Back 53

False

Front 54

Once the OS is known, all of the vulnerabilities to which a system is susceptible can easily be determined.

Back 54

True

Front 55

Nmap uses incrementing Time-To-Live packets to determine the path into a network as well as the default firewall policy.

Back 55

False

Front 56

A starting scanner is one that initiates traffic on the network in order to determine security holes.

Back 56

False

Front 57

The Metasploit Framework is a collection of exploits coupled with an interface that allows the penetration tester to automate the custom exploitation of vulnerable systems.

Back 57

True

Front 58

A sniffer cannot be used to eavesdrop on network traffic.

Back 58

False

Front 59

Passive scanners are advantageous in that they require vulnerability analysts to get approval prior to testing.

Back 59

False

Front 60

Most of the technologies that scan human characteristics convert these images to some form of minutiae.

Back 60

True

Front 61

An alert or intrusion is an indication that a system has just been attacked or is under attack.

Back 61

F, alarm

Front 62

The confidence value, which is based upon false logic, helps an administrator determine how likely it is that an IDPS alert or alarm indicates an actual attack in progress.

Back 62

F, fuzzy

Front 63

Alarm filtering is alarm clustering that may be based on combinations of frequency, similarity in attack signature, similarity in attack target, or other criteria that are defined by the system administrators.

Back 63

F, compaction

Front 64

The activities that gather information about the organization and its network activities and assets is called fingerprinting

Back 64

F, footprinting

Front 65

A(n) server-based IDPS protects the server or host’s information assets.

Back 65

F, host-based

Front 66

In the process of protocol application verification, the NIDPSs look for invalid data packets.

Back 66

F, stack

Front 67

A(n) NIDPS functions on the host system, where encrypted traffic will have been decrypted and is available for processing

Back 67

F, HIDPS

Front 68

Preconfigured, predetermined attack patterns are called signatures.

Back 68

True

Front 69

A(n) log file monitor is similar to a NIDPS.

Back 69

True

Front 70

The IDPS console includes the management software, which collects information from the remote sensors, analyzes the systems or networks, and determines whether the current situation has deviated from the preconfigured baseline.

Back 70

True

Front 71

A(n) partially distributed IDPS control strategy combines the best of the other two strategies.

Back 71

True

Front 72

When a collection of honeypots connects several honeypot systems on a subnet, it may be called a(n) honeynet.

Back 72

True

Front 73

A padded cell is a hardened honeynet

Back 73

F, honeypot

Front 74

The trace usually consists of a honeypot or padded cell and an alarm.

Back 74

F, trap

Front 75

The trap is a process by which the organization attempts to identify an entity discovered in unauthorized areas of the network or systems.

Back 75

F, trace

Front 76

Enticement is the action of luring an individual into committing a crime to get a conviction.

Back 76

F, Entrapment

Front 77

Fingerprinting is the organized research of the Internet addresses owned or controlled by a target organization.

Back 77

F, Footprinting

Front 78

For Linux or BSD systems, there is a tool called “scanner” that allows a remote individual to “mirror” entire Web sites.

Back 78

F, wget

Front 79

Port fingers are tools used by both attackers and defenders to identify (or fingerprint) the computers that are active on a network, as well as the ports and services active on those computers, the functions and roles the machines are fulfilling, and other useful information.

Back 79

F, scanners

Front 80

A(n) port is a network channel or connection point in a data communications system.

Back 80

True

Front 81

A(n) listener vulnerability scanner is one that listens in on the network and determines vulnerable versions of both server and client software.

Back 81

F, passive

Front 82

A wireless security toolkit should include the ability to sniff wireless traffic, scan wireless hosts, and assess the level of privacy or confidentiality afforded on the wireless network.

Back 82

True

Front 83

Minutiae are unique points of reference that are digitized and stored in an encrypted format when the user’s system access credentials are created.

Back 83

True

Front 84

The false error rate is the percentage of identification instances in which authorized users are denied access a result of a failure in the biometric device

Back 84

F, reject

Front 85

The false detect rate is the percentage of identification instances in which unauthorized users are allowed access to systems or areas as a result of a failure in the biometric device.

Back 85

F, accept

Front 86

Access control is achieved by means of a combination of policies, programs, and technologies.

Back 86

True

Front 87

The outside world is known as the trusted network (e.g., the Internet)

Back 87

F, untrusted

Front 88

Address grants prohibit packets with certain addresses or partial addresses from passing through the device.

Back 88

F, restrictions

Front 89

Static filtering is common in network routers and gateways.

Back 89

True

Front 90

The static packet filtering firewall allows only a particular packet with a particular source, destination, and port address to enter through the firewall.

Back 90

F, dynamic

Front 91

Circuit gateway firewalls prevent direct connections between one network and another.

Back 91

True

Front 92

First generation firewalls are application-level firewalls

Back 92

F, Second

Front 93

SOHO assigns non-routing local addresses to the computer systems in the local area network and uses the single ISP-assigned address to communicate with the Internet.

Back 93

F, NAT

Front 94

In addition to recording intrusion attempts, a(n) router can be configured to use the contact information to notify the firewall administrator of the occurrence of an intrusion attempt.

Back 94

True

Front 95

When a dual-homed host approach is used, the bastion host contains four NICs.

Back 95

False, two

Front 96

A benefit of a(n) dual-homed host is its ability to translate between many different protocols at their respective data link layers, including Ethernet, token ring, Fiber Distributed Data Interface, and asynchronous transfer mode.

Back 96

True

Front 97

In a DMZ configuration, connections into the trusted internal network are allowed only from the DMZ bastion host servers.

Back 97

True

Front 98

A(n) perimeter is a segment of the DMZ where additional authentication and authorization controls are put into place to provide services that are not available to the general public.

Back 98

F, extranet

Front 99

When Web services are offered outside the firewall, SMTP traffic should be blocked from internal networks through the use of some form of proxy access or DMZ architecture.

Back 99

F, HTTP

Front 100

Most firewalls use packet header information to determine whether a specific packet should be allowed to pass through or should be dropped.

Back 100

True

Front 101

Best practices in firewall rule set configuration state that the firewall device is never accessible directly from the public network.

Back 101

True

Front 102

Traces, formally known as ICMP Echo requests, are used by internal systems administrators to ensure that clients and servers can communicate.

Back 102

F, Pings

Front 103

The presence of external requests for Telnet services can indicate a potential attack.

Back 103

True

Front 104

In order to keep the Web server inside the internal network, direct all HTTP requests to the proxy server and configure the internal filtering router/firewall only to allow the proxy server to access the internal Web server.

Back 104

True

Front 105

The filtering component of a content filter is like a set of firewall rules for Web sites, and is common in residential content filters.

Back 105

F, rating

Front 106

An attacker who suspects that an organization has dial-up lines can use a device called a(n) war dialer to locate the connection points.

Back 106

True

Front 107

Kerberos uses asymmetric key encryption to validate an individual user to various network resources.

Back 107

F, symmetric

Front 108

SESAME may be obtained free of charge from MIT.

Back 108

F, Kerberos

Front 109

Secure VPNs use security protocols and encrypt traffic transmitted across unsecured public networks like the Internet

Back 109

True

Front 110

The popular use for tunnel mode VPNs is the end-to-end transport of encrypted data.

Back 110

F, transport