Network Defense Mid Term Study Guide

Collision

A _________ occurs when computing the MD5 algorithm with two different initialization vectors produces the same hash value.

Hash

A __________ value is a fixed-size string representing the original input's contents.

Signature

A ____________ is made up of IP numbers and options, TCP flags, and port number that define a type of network activity.

FIN packet

Lets the other computer know it is finished sending data

Ciphertext

Unreadable text, programs that do not execute, and graphics you cannot view

Scan Throttling

Used by attackers to delay the progression of a scan

D. IDPS

Which security tool works by recognizing signs of possible attack and sending notification to an administrator? A. DiD B. DMZ C. VPN D. IDPS

B. mandatory access control

With which access control method do system administrators establish what information users can share? A. discretionary access control B. mandatory access control C. administrative access control D. role-based access control

Anycast

__________ IPv6 addresses are used for one-to-one or one-to-many communication.

Viruses

___________ are spread by several methods, including running executable code, sharing disks or memory sticks, opening e-mail attachments, and viewing infected or malicious Web pages.

Null

A TCP packet with no flags set is referred to as a _______ packet.

XOR function

A cryptographic primitive based on binary bit logic and used as a linear mixing function, combining values for use in further computations

Stateless Autoconfiguration

A feature of IPv6 in which a computer can connect to a network by determining its own IP address based on the addressing of neighboring nodes

C. use DoS attack on Web sites with which they disagree

A hactivist can best be described as which of the following? A. an unskilled programmer that spreads malicious scripts B. consider themselves seekers of knowledge C. use DoS attack on Web sites with which they disagree D. deface Web sites by leaving message for their friends to read

Biometrics

A method of authenticating a user using physical information, such as retinal scans, fingerprints, or voiceprints

Socket

A network connection consisting of a port number combined with a computer's IP address

DMZ

A semi trusted subnet that lies outside the trusted internal network but is connected to the firewall to make services publicly available while still protecting the internal LAN

Ping Sweep

A series of ICMP echo request packets in a range of IP addresses

Multicast

A transmission used for one-to-many communication, in which a single host can send packets to a group of recipients

Key Management

A way to prevent keys from being discovered and used to decipher encrypted messages

Port

An area in random access memory (RAM) reserved for the use of a program that "listens" for requests for the service it provides

DES

An older protocol composed of a 16-round Feistel network with XOR functions, permutation functions, 64 S-box functions, and fixed key schedules

Back Door

An undocumented hidden opening through which an attacker can access a computer

Signature

Digital ____________ security vulnerabilities are mostly associated with the IT infrastructure required to support interoperability.

Multicast Listener Discovery

Enables IPv6 routers to discover multicast listeners on a directly connected link and to decide which multicast addresses are of interest to those nodes

Packet Filters

Hardware or software tools that allow or deny packets based on a specified criteria, such as port, IP address, or protocol

Spoof

In an RPC _________, a targeted host receives an RPC set request from a source IP address of 127.0.0.1.

SYN

In the three-way handshake, the first packet in the sequence has the ______ flag set.

A. botnet

Malware that creates networks of infected computers that can be controlled from a central station is referred to as which of the following? A. botnet B. Trojan C. logic bomb D. packet monkey

C. multiple-packet attack

Of what category of attack is a DoS attack and example? A. bad header information B. single-packet attack C. multiple-packet attack D. suspicious data payload

Netstat

The __________ command shows current sessions with associated port numbers.

Flag

The ___________ field in an IP header is a 3-bit value indicating whether a datagram is a fragment

Payload

The ___________ part of a packet is the actual data sent from an application on one computer to an application on another.

Fragmentation

The division of packets into smaller sizes to accommodate routers with frame size limitations

MTU

The maximum packet size that can be transmitted

Network Identifier

The part of an IP address that a computer has in common with other computers in its subnet

Cryptanalysis

The study of breaking encryption methods

C. the source of the public keys

What is the most likely weak link when using asymmetric encryption for verifying message integrity and nonrepudiation? A. the use of the sender's private key B. the hashing algorithm used to generate a message digest C. the source of the public keys D. the integrity of the private keys

C. SYN, SYN ACK, ACK

What is the sequence of packets for a successful three-way handshake? A. SYN, ACK, ACK B. SYN, SYN ACK, RST C. SYN, SYN ACK, ACK D. SYN, ACK, FIN

A. false negative

What is the term used when an IDPS doesn't recognize that an attack is underway? A. false negative B. true positive C. negative activity D. positive signature

A. disable zone transfers

What should you do when configuring DNS servers that are connected to the Internet in order to improve security? A. disable zone transfers B. delete the DNS cache C. disable DNS buffers D. setup DNS proxy

A. IKE

Which component of IPsec enables computers to exchange keys to make an SA? A. IKE B. ISAKMP C. Oakley D. IPsec driver

D. 21,20

Which of the following correctly represents the port used by FTP control traffic and FTP file transfer traffic respectively? A. 20, 25 B. 21, 23 C. 20, 23 D. 21, 20

B. scalability

Which of the following is NOT a critical goal of information security? A. confidentiality B. scalability C. authentication D. nonrepudiation

A. the local host source address occurs in the packet

Which of the following is the description of a land attack? A. the local host source address occurs in the packet B. source and destination IP address/port are the same C. an illegal TCP flag is found in the segment header D. the attacker uses an undefined protocol number

A. they are not completely random

Which of the following is true about PRNGs? A. they are not completely random B. their state is measured in bytes C. the shorter the state, the longer the period D. they can never produce the same value

B. Message Digest 5

Which of the following makes a single pass on data and generates a 128-bit hash value displayed as a 32-characer hexadecimal number and is used in VPNs? A. RSA B. Message Digest 5 C. RC4 D. Twofish

Integral

___________ cryptanalysis is applicable to block ciphers that use a substitution-permutation network including Rijndael, Twofish, and IDEA.

Nonrepudiation

____________ is achieved when neither party can plausibly deny its participation in message exchanges.

Non-repudiation

____________ is the capability to prevent a participant in an electronic transaction from denying that it is performed an action.