SEM 2, WEEK 7

Match each type of switch on the left with its corresponding characteristics on the right. Each switch type may be used once, more than once, or not at all. 1) Commonly sold at retail stores. 2) Provides port security features. 3) Supports VLANs. 4) Provides very few configuration options. 5) Can be configured over a network connection. 6) Can be configured over a dedicated communication channel.

1) Unmanaged switch 2) Managed switch 3) Managed switch 4) Unmanaged switch 5) Managed switch 6) Managed switch

Match each switch management method on the left with its corresponding characteristics on the right. Each method may be used once, more than once, or not at all. 1) Competes with normal network traffic for bandwidth. 2) Uses a dedicated communication channel. 3) Must be encrypted to protect communications from sniffing. 4) Does not compete with normal network traffic for bandwidth. 5) Affected by network outages.

1) in-band Management 2) Out-of-Band management 3) In-band management 4) Out-of-Band management 5) In-band management

Your Cisco router has three network interfaces configured. S0/1/0 is a WAN interface that is connected to an ISP. F0/0 is connected to an Ethernet LAN segment with a network address of 192.168.1.0/24. F0/1 is connected to an Ethernet LAN segment with a network address of 192.168.2.0/24. You have configured an access control list on this router using the following rules: deny ip 192.168.1.0 0.0.0.255 any deny ip 192.168.2.0 0.0.0.255 any These rules will be applied to the WAN interface on the router. Your goal is to block any IP traffic coming in on the WAN interface that has a spoofed source address that makes it appear to be coming from the two internal networks. However, when you enable the ACL, you find that no traffic is being allowed through the WAN interface. What should you do? A) Add a permit statement to the bottom of the access list. B) Use the out parameter instead of the in parameter within each ACL rule. C) Apply the access list to the Fa0/1 interface instead of the S0/1/0 interface. D) Apply the access list to the Fa0/0 interface instead of the S0/1/0 interface.

A) Add a permit statement to the bottom of the access list.

Which of the following is true about an intrusion detection system? A) An intrusion detection system maintains an active security role within the network. B) An intrusion detection system monitors data packets for malicious or unauthorized traffic. C) An intrusion detection system can terminate or restart other processes on the system. D) An intrusion detection system can block malicious activities.

B) An intrusion detection system monitors data packets for malicious or unauthorized traffic.

Listen to exam instructions Which of the following uses access control lists (ACLs) to filter packets as a form of security? A) Screened-host gateway B) Screened router C) Dual-homed gateway D) Screened subnet

B) Screened router

Listen to exam instructions Which of the following are true about routed firewalls? (Select two.) A) Easily introduced to an existing network. B) Supports multiple interfaces. C) Internal and external interfaces connect to the same network segment. D) Counts as a router hop. E) Operates at Layer 2.

B) Supports multiple interfaces. D) Counts as a router hop.

Which of the following is a communication device that connects other network devices through cables and receives and forwards data to a specified destination within a LAN? A) Router B) Switch C) Hub D) Access point

B) Switch

Which of the following combines several layers of security services and network functions into one piece of hardware? A) Circuit-level gateway B) Unified Threat Management (UTM) C) Firewall D) Intrusion detection system (IDS)

B) Unified Threat Management (UTM)

Your company has an internet connection. You also have a web server and an email server that you want to make available to your internet users, and you want to create a screened subnet for these two servers. Which of the following should you use? A) A host-based firewall B) An IPS C) A network-based firewall D) An IDS

C) A network-based firewall

Which of the following describes how access control lists can improve network security? A) An access control list filters traffic based on the frame header, such as source or destination MAC address. B) An access control list looks for patterns of traffic between multiple packets and takes action to stop detected attacks. C) An access control list filters traffic based on the IP header information, such as source or destination IP address, protocol, or socket number. D) An access control list identifies traffic that must use authentication or encryption.

C) An access control list filters traffic based on the IP header information, such as source or destination IP address, protocol, or socket number.

Listen to exam instructions Which of the following is required to establish a new network switch and configure its IP address for the first time? A) Site-to-site VPN B) Client-to-site VPN C) Out-of-band management D) In-band management

C) Out-of-band management

Which of the following is a firewall function? A) Encrypting B) FTP hosting C) Packet filtering D) Frame filtering

C) Packet filtering

Which IDS method searches for intrusion or attack attempts by recognizing patterns or identifying entities listed in a database? A) Anomaly analysis-based IDS B) Stateful inspection-based IDS C) Signature-based IDS D) Heuristics-based IDS

C) Signature-based IDS

Listen to exam instructions Which of the following are specific to extended Access control lists? (Select two.) A) Identify traffic based on the destination address. B) Should be placed as close to the destination as possible. C) Use the number ranges 100-199 and 2000-2699. D) Are used by route maps and VPN filters. E) Are the most used type of ACL.

C) Use the number ranges 100-199 and 2000-2699. E) Are the most used type of ACL.

Which of the following is the BEST solution to allow access to private resources from the internet? A) Subnet B) Packet filters C) VPN D) FTP

C) VPN

Which of the following is a device that can send and receive data simultaneously? A) Honeypot B) Unmanaged C) Managed D) Full-duplex

D) Full-duplex

As a security precaution, you've implemented IPsec to work between any two devices on your network. IPsec provides encryption for traffic between devices. You would like to implement a solution that can scan the contents of the encrypted traffic to prevent any malicious attacks. Which solution should you implement? A) VPN concentrator B) Port scanner C) Network-based IDS D) Host-based IDS E) Protocol analyzer

D) Host-based IDS

You're concerned about attacks directed at your network firewall. You want to be able to identify and be notified of any attacks. In addition, you want the system to take immediate action to stop or prevent the attack, if possible. Which tool should you use? A) IDS B) Port scanner C) Packet sniffer D) IPS

D) IPS

On your network, you have a VLAN for the sales staff and a VLAN for the production staff. Both need to be able to communicate over the network. Which of the following devices would work BEST for communication between VLANs? A) Load balancer B) Repeater C) Layer 2 switch D) Layer 3 switch

D) Layer 3 switch

Which IDS type can alert you to trespassers? A) VMIDS B) NIDS C) HIDS D) PIDS

D) PIDS

Which of the following describes the worst possible action by an IDS? A) The system identified harmless traffic as offensive and generated an alarm. B) The system detected a valid attack and the appropriate alarms and notifications were generated. C) The system correctly deemed harmless traffic as inoffensive and let it pass. D) The system identified harmful traffic as harmless and allowed it to pass without generating any alerts.

D) The system identified harmful traffic as harmless and allowed it to pass without generating any alerts.

Which IDS method defines a baseline of normal network traffic and then looks for anything that falls outside of that baseline? A) Anomaly-based B) Misuse detection C) Pattern matching D) Dictionary recognition

A) Anomaly-based

Which of the following terms describes a network device that is exposed to attacks and has been hardened against those attacks? A) Bastion B) Multi-homed C) Kernel proxy D) Circuit proxy

A) Bastion

Which IDS traffic assessment indicates that the system identified harmless traffic as offensive and generated an alarm or stopped the traffic? A) False positive B) False negative C) Negative D) Positive

A) False positive

Which of the following is true about an unmanaged switch? A) It can connect to all devices in a small area. B) It supports link aggregation. C) It allows port configuration. D) It is capable of VLAN creation.

A) It can connect to all devices in a small area.

Which of the following is true about an NIDS? A) It detects malicious or unusual incoming and outgoing traffic in real time. B) It can monitor changes that you've made to applications and systems. C) It can analyze fragmented packets. D) It can access encrypted data packets.

A) It detects malicious or unusual incoming and outgoing traffic in real time.

As a network administrator, you have 10 VLANs on your network that need to communicate with each other. Which of the following network devices is the BEST choice for allowing communication between 10 VLANs? A) Layer 3 switch B) Layer 2 switch C) Repeater D) Load balancer

A) Layer 3 switch

What do you need to configure on a firewall to allow traffic directed to the public resources on the screened subnet? A) Packet filters B) FTP C) VPN D) Subnet

A) Packet filters

You have used firewalls to create a screened subnet. You have a web server that needs to be accessible to internet users. The web server must communicate with a database server to retrieve product, customer, and order information. How should you place devices on the network to best protect the servers? (Select two.) A) Put the web server inside the screened subnet. B) Put the database server on the private network. C) Put the database server inside the screened subnet. D) Put the web server on the private network. E) Put the database server outside the screened subnet.

A) Put the web server inside the screened subnet. B) Put the database server on the private network.

Which of the following can serve as a buffer zone between a private, secured network and an untrusted network? A) Screened subnet B) Padded cell C) Intranet D) Extranet

A) Screened subnet

Listen to exam instructions Which of the following is another name for a firewall that performs router functions? A) Screening router B) Screened-host gateway C) Screened subnet D) Dual-homed gateway

A) Screening router

You have a company network that is connected to the internet. You want all users to have internet access, but you need to protect your private network and users. You also need to make a web server publicly available to the internet users. Which solution should you use? A) Use firewalls to create a screened subnet. Place the web server inside the screened subnet and the private network behind the screened subnet. B) Use a single firewall. Put the server and the private network behind the firewall. C) Use a single firewall. Put the web server in front of the firewall and the private network behind the firewall. D) Use firewalls to create a screened subnet. Place the web server and the private network inside the screened subnet.

A) Use firewalls to create a screened subnet. Place the web server inside the screened subnet and the private network behind the screened subnet.

Which level of the OSI model does a Layer 2 switch operate at? A) Session layer B) Data Link layer C) Transportation layer D) Network layer

B) Data Link layer

Which of the following BEST describes a stateful inspection? A) Designed to sit between a host and a web server and communicate with the server on behalf of the host. B) Determines the legitimacy of traffic based on the state of the connection from which the traffic originated. C) Allows all internal traffic to share a single public IP address when connecting to an outside entity. D) Offers secure connectivity between many entities and uses encryption to provide an effective defense against sniffing.

B) Determines the legitimacy of traffic based on the state of the connection from which the traffic originated.

Which of the following are characteristics of a packet-filtering firewall? (Select two.) A) Stateful B) Filters IP address and port C) Stateless D) Filters based on sessions E) Filters based on URL

B) Filters IP address and port C) Stateless

Which of the following methods is best to have when a network goes down? A) Site-to-site VPN B) Out-of-band management C) In-band management D) Client-to-site VPN

B) Out-of-band management

You are managing a network and have used firewalls to create a screened subnet. You have a web server that internet users need to access. It must communicate with a database server to retrieve product, customer, and order information. How should you place devices on the network to best protect the servers? (Select two.) A) Put the web server on the private network. B) Put the database server on the private network. C) Put the web server inside the screened subnet. D) Put the database server and the web server inside the screened subnet. E) Put the database server inside the screened subnet.

B) Put the database server on the private network. C) Put the web server inside the screened subnet.

You've just installed a new network-based IDS system that uses signature recognition. What should you do on a regular basis? A) Generate a new baseline. B) Update the signature files. C) Check for backdoors. D) Modify clipping levels.

B) Update the signature files.

In which of the following situations would you MOST likely implement a screened subnet? A) You want to encrypt data sent between two hosts using the internet. B) You want to protect a public web server from attack. C) You want users to see a single IP address when they access your company network. D) You want to detect and respond to attacks in real time.

B) You want to protect a public web server from attack.

Listen to exam instructions How many network interfaces does a dual-homed gateway typically have? A) two B) three C) one D) four

B) three