Network Defense Security Ch. 1
What tool do you use to secure remote access by users who utilize the Internet?
VPN
A ______________ is reserved for a program that runs in the background to listen for requests for the service it offers.
port
An area in random access memory (RAM) reserved for the use of a program that "listens" for requests for the service it provides
port
Which security tool works by recognizing signs of a possible attack and sending notification to an administrator?
IDPS
______________________ is the capability to prevent a participant in an electronic transaction from denying that it performed an action.
Nonrepudiation
An access control method that establishes organizational roles to control access to information
RBAC
Which type of attack causes the operating system to crash because it is unable to handle arbitrary data sent to a port?
RPC attacks
________________ events usually track the operations of the firewall or IDPS, making a log entry whenever it starts or shuts down.
System
______________ do not require user intervention to be launched; they are self-propagating.
Worms
Defense in depth can best be described as which of the following?
a layered approach to security
Which type of firewall policy calls for a firewall to deny all traffic by default?
restrictive policy
Signs of possible attacks that include an IP address, a port number, and the frequency of access attempts; an IDPS uses signatures to detect possible attacks
signatures
Why might you want your security system to provide nonrepudiation?
so a user can't deny sending or receiving a communication
Which term is best described as an attack that relies on the gullibility of people?
social engineering
A network connection consisting of a port number combined with a computer's IP address
socket
What is a VPN typically used for?
secure remote access
What is a program that appears to do something useful but is actually malware?
Trojan
An attack in which many computers are hijacked and used to flood the target with so many false requests that the server cannot process them all, and normal traffic is blocked
DDoS attack
A semitrusted subnet that lies outside the trusted internal network but is connected to the firewall to make services publicly available while still protecting the internal LAN
DMZ
__________________ are spread by several methods, including running executable code, sharing disks or memory sticks, opening e-mail attachments, and viewing infected or malicious Web pages.
Viruses
The process of recording which computers are accessing a network and what resources are being accessed, and then recording the information in a log file
auditing
Which security layer verifies the identity of a user, service, or computer?
authentication
A method of authenticating a user using physical information, such as retinal scans, fingerprints, or voiceprints
biometrics
Malware that creates networks of infected computers that can be controlled from a central station is referred to as which of the following?
botnet
In which form of authentication does the authenticating device generate a random code and send it to the user who wants to be authenticated?
challenge/response
Which of the following is NOT information that a packet filter uses to determine whether to block a packet?
checksum
Which of the following is NOT one of the three primary goals of information security?
impartiality
Which of the following is a type of script that automates repetitive tasks in an application such as a word processor but can also be programmed to be a virus?
macro
Which type of attack works by an attacker operating between two computers in a network and impersonating one computer to intercept communications?
man-in-the-middle
With which access control method do system administrators establish what information users can share?
mandatory access control
What can an attacker use a port scanner to test for on a target computer?
open sockets
Hardware or software tools that allow or deny packets based on specified criteria, such as port, IP address, or protocol.
packet filters
What is the name of a storage area where viruses are placed by antivirus software so they cannot replicate or do harm to other files?
quarantine
A hactivist can best be described as which of the following?
use DoS attacks on Web sites with which they disagree
Computer files that copy themselves repeatedly and consume disk space or other resources
worm