Chapter 10

What is NOT a service commonly offered by unified threat management (UTM) devices? A. URL filtering B. Wireless network access C. Malware inspection D. Content inspection

B. Wireless network access: Unified Threat Management Explanation: UTM devices offer URL filtering, content inspection, and malware inspection.

What firewall approach is shown in the figure? A. Border firewall B. Bastion host C. Screened subnet D. Multilayered firewall

C. Screened subnet: Firewall-Deployment Techniques Explanation: In a screened subnet approach, the firewall has three network cards. Two are set up identically to a border firewall, with one connected to the Internet and another connected to the private network. The third card connects to a special network known as the screened subnet, or DMZ.

Hilda is troubleshooting a problem with the encryption of data. At which layer of the OSI Reference Model is she working? A. Application B. Presentation C. Session D. Data Link

B. Presentation: The Open Systems Interconnection Reference Model Explanation: Encryption is a function of the Presentation layer of the OSI model. This layer also includes file formats and character representations.

What is the maximum value for any octet in an IPv4 IP address? A. 65 B. 129 C. 255 D. 513

C. 255: IP Addressing Explanation: Each of the four octets in an IPv4 address may contain any integer value between 0 and 255.

Karen would like to use a wireless authentication technology similar to that found in hotels where users are redirected to a webpage when they connect to the network. What technology should she deploy? A. Remote Authentication Dial-In User Service (RADIUS) B. Lightweight Extensible Authentication Protocol (LEAP) C. Captive portal D. Protected Extensible Authentication Protocol (PEAP)

C. Captive portal: Additional Wireless Security Techniques Explanation: A captive portal is a webpage that is displayed for all new connections. Your wireless device can redirect all traffic to the captive portal until the connection is authenticated. The most common use of a captive portal is to provide a logon page for your wireless network.

Barbara is investigating an attack against her network. She notices that the Internet Control Message Protocol (ICMP) echo replies coming into her network far exceed the ICMP echo requests leaving her network. What type of attack is likely taking place? A. Teardrop B. Land C. Smurf D. Cross-site scripting (XSS)

C. Smurf: Common Protocols Explanation: Smurf attacks use ICMP to create a denial of service attack against a network. They work by sending spoofed ICMP echo request packets to a broadcast address on a network, hoping that the hosts on that network will all respond.

What type of firewall security feature limits the volume of traffic from individual hosts? A. Loop protection B. Network separation C. Stateful inspection D. Flood guard

D. Flood guard: Firewalls Explanation: Flood guard rules can limit traffic bandwidth from hosts, reducing the ability for any one host to flood a network.

What protocol is responsible for assigning IP addresses to hosts on most networks? A. Dynamic Host Configuration Protocol (DHCP) B. Transport Layer Security (TLS) C. Virtual LAN (VLAN) D. Simple Mail Transfer Protocol (SMTP)

A. Dynamic Host Configuration Protocol (DHCP) IP Addressing Explanation: DHCP allows each computer to get its configuration information dynamically from the network instead of the network administrator providing the configuration information to the computer. DHCP provides a computer with an IPv4 address, subnet mask, and other essential communication information.

Gary is configuring a smartphone and is selecting a wireless connectivity method. Which approach will provide him with the highest speed wireless connectivity? A. Wi-Fi B. 3G C. 4G D. Digital subscriber line (DSL)

A. Wi-Fi: Connectivity Options Explanation: Wi-Fi networks generally provide much faster connectivity than the cellular connections possible over 3G and 4G networks. DSL is a wired networking technology.

What type of network connects systems over the largest geographic area? A. Wide area network (WAN) B. Metropolitan area network (MAN) C. Local area network (LAN) D. Storage area network (SAN)

A. Wide area network (WAN): Wide Area Networks Explanation: WANs connect systems over a very large geographic area. The most common example of a WAN is the Internet.

What wireless security technology contains significant flaws and should never be used? A. Wired Equivalent Privacy (WEP) B. Wi-Fi Protected Access (WPA) C. WPA2 D. Remote Authentication Dial-In User Service (RADIUS)

A. Wired Equivalent Privacy (WEP): Wireless Encryption Explanation: Since its release, security analysts have discovered significant flaws in WEP that make it insecure. With software freely available on the Internet, it is simple to break the encryption on a WEP network in a matter of seconds. In fact, using WEP on a wireless network is probably worse than using no encryption at all because it provides a false sense of security.

Henry is creating a firewall rule that will allow inbound mail to the organization. What TCP port must he allow through the firewall? A. 22 B. 25 C. 53 D. 80

B. 25: Common Protocols Explanation: Inbound email uses the Simple Mail Transfer Protocol (SMTP), which relies upon connections over Transmission Control Protocol (TCP) port 25.

Norm recently joined a new organization. He noticed that the firewall technology used by his new firm opens separate connections between the devices on both sides of the firewall. What type of technology is being used? A. Packet filtering B. Application proxying C. Stateful inspection D. Network address translation

B. Application proxying: Firewall Types Explanation: An application proxy firewall goes further than a stateful inspection firewall. It doesn't actually allow packets to travel directly between systems on opposite sides of the firewall. The firewall opens separate connections with each of the two communicating systems and then acts as a broker (or proxy) between the two.

Terry is troubleshooting a network that is experiencing high traffic congestion issues. Which device, if present on the network, should be replaced to alleviate these issues? A. Firewall B. Hub C. Switch D. Router

B. Hub: LAN Devices: Hubs and Switches Explanation: A hub creates a lot of network congestion by retransmitting everything it hears. This reduces the network bandwidth for all devices. The network would benefit by replacing the hub with a switch.

Val would like to isolate several systems belonging to the product development group from other systems on the network, without adding new hardware. What technology can she use? A. Firewall B. Virtual LAN (VLAN) C. Virtual private network (VPN) D. Transport Layer Security (TLS)

B. Virtual LAN (VLAN): Virtual LANs Explanation: VLANs create separate broadcast domains that isolate systems from each other. This can be used to both reduce network traffic and increase security.

Henry would like to create a different firewall rule that allows encrypted web traffic to reach a web server. What port is used for that communication? A. 80 B. 143 C. 443 D. 3389

C. 443: Common Protocols Explanation: Encrypted web traffic uses the Hypertext Transport Protocol over TLS/SSL (HTTPS) protocol, which runs over Transmission Control Protocol (TCP) port 443.

David would like to connect a fibre channel storage device to systems over a standard data network. What protocol can he use? A. Internet Small Computer System Interface (iSCSI) B. Fibre Channel (FC) C. Fibre Channel over Ethernet (FCoE) D. Secure Shell (SSH)

C. Fibre Channel over Ethernet (FCoE): Ethernet Networks Explanation: Fibre channel was originally used in supercomputers to connect storage devices but has since spread into common use across many types of computers. The FCoE protocol makes it even easier to connect fibre channel-capable devices to an Ethernet network.

Henry's last firewall rule must allow inbound access to a Windows Terminal Server. What port must he allow? A. 143 B. 443 C. 989 D. 3389

D. 3389: Common Protocols Explanation: Windows Terminal Services uses the Remote Desktop Protocol (RDP) to communicate over TCP port 3389.

What type of network device normally connects directly to endpoints and uses MAC-based filtering to limit traffic flows? A. Router B. Hub C. Access point D. Switch

D. Switch: LAN Devices: Hubs and Switches Explanation: Switches are a much better alternative to hubs. A switch performs the same basic function as a hub: connecting multiple systems to the network. However, switches have one major added feature: They can perform intelligent filtering based upon MAC addresses.

Bob has a high-volume virtual private network (VPN). He would like to use a device that would best handle the required processing power. What type of device should he use? A. Firewall B. Unified threat management (UTM) C. Router D. VPN concentrator

D. VPN concentrator: Virtual Private Networks and Remote Access Explanation: VPNs require your gateway equipment to have a lot of processing power to handle encryption algorithms. You can offload this processing power to another device by using a dedicated VPN concentrator rather than having your router or firewall terminate the VPN.