Testout Security Chapter 6 Practice Questions

Computer management Local users and groups >>Credential manager Key management service

A manager has told you she is concerned about her employee writing their password for websites, network files, and database resources on sticky notes. Your office runs exclusively in a Windows environment. Which tool could you use to prevent this behavior?

Digital signature Digital certificate Client-to-server ticket >>Ticket granting ticket

A user has just authenticated using Kerberos. Which object is issued to the user immediately following login?

>>RADIUS combines authentication and authorization into a single function, TACACS+ allows these services to be split between different servers RADIUS encrypts the entire packet contents; TACACS+ only encrypts the password RADIUS uses TCP; TACACS+ uses UDP RADIUS supports more protocols than TACACS+

Which of the following are differences between RADIUS and TACACS+?

>>TACACS+ 802.1x EAP AAA >>RADIUS PKI

Which of the following are methods for providing centralized authentication, authorization, and accounting for remote access?

Using SSH to connect to a router remotely >>Not controlling physical access to the router Using the MD5 hashing algorithm to encrypt the password Storing the router config file to a secure location

Which of the following can make passwords useless on a router?

>>Fingerprinting Social engineering Port scanning Firewalking

Which of the following identifies an operating system or network service based upon it response to ICMP messages?

MAC spoofing Cross-site scripting DNS poisoning >>ARP spoofing/ poisoning

Which of the following switch attacks associates the attackers MAC address with the IP address of the victim's devices?

Full-knowledge team Split-knowledge team Partial-knowledge team >>Zero-knowledge team

Which of the following types of penetration test teams will provide you information that is most revealing of a real-world hacker attack?

Vulnerability mapping >>Reconnaissance Privilege escalation Enumeration

Which phase or step of a security assessment is a passive activity?

Drop >>Flag Tarpit Block

You are implementing a new application control solution. Prior to enforcing you application whitelist,you want to monitor user traffic for a period of time to discover user behaviors and log violations for later review. How should you configure the application control software to handle applications not contained in the whitelist?

Mirroring Trunking OSPF >>Spanning tree PoE

You manage a network that uses multiple switches. You want to provide multiple paths between switches so that if one link goes down, an alternate path is available. What feature should your switch support?

Spanning tree >>Port authentication Mirroring VLAN Bonding

You manage a network that uses switches. In the lobby of you building are three RJ-45 ports connected to a switch. You want to make sure that visitors cannot plug in their computers to the free network jacks and connect to the network. However, employees who plug into those same jacks should be able to connect to the network. What feature should you configure?

Protocol analyzer >>vulnerability scanner network mapper port scanner

You want to be able to identify services running on a set of servers on your network. Which tool would best give you the information you need?

Firewalking >>Active fingerprinting Network enumeration Passive fingerprinting

A security administrator is conducting a penetration test on a network. She connects a notebook system running Linux to a wireless network and then uses NMAP to probe various network hosts to see which operating system they are running.

Firewalking Active fingerprinting Network enumeration >>Passive fingerprinting

A security administrator is conducting a penetration test on a network. She connects a notebook system to a mirror port on a network switch. She then uses a packet sniffer to monitor network traffic to try and determine which operating systems are running on network hosts. Which process did the administrator use in the penetration test in this scenario?

Ping scan >>Credentialed scan TCP SYN scan Non-credentialed scan

A security administrator logs on to a Windows server on her organization's network. She then runs a vulnerability scan on that server.

>>Privilege escalation Replay Impersonation Social engineering

An attacker has obtained the logon credentials for a regular user on your network. Which type of security threat exists if this user account is used to perform administrative functions?

Network-based IDS VPN concentrator Port scanner Protocol analyzer >>Host-based IDS

As a security precaution, you have implemented IPsec that is used between any two devices on your network. IPsec provides encryption for all traffic between devices. You woud like to implement a solution that can scan the contents of the encrypted traffic to prevent any malicious attacks. What solution should you implement?

IoT and SCADA devices >>Inherent vulnerabilities Used to identify a weak network architecture or design >>Documentation Public-facing servers, workstations, Wi-Fi network, and personal devices. >>Entry points An older version of Windows that is used for a particular application >>Inherent vulnerabilites What activity looks like a normal day-to-day usage >>network baseline

As a security professional, you need to understand your network on multiple levels. You should focus on the following areas: Entry points inherent vulnerabilities Documentation Network baseline Drag the area of focus on the left to the appropriate example on the right.

>>Software-defines netowrking Load balancing software Control later networking Infrastructure software networking

Network engineers have the option of using software to configure and intelligently control the network rather than relying on the individual static configuration files that are located on each network device. Which of the following is a relatively new technology that allows network and security professionals to use software to manage, control, and make changes to a network?

Buffer overflow exploitation of software >>Bandwidth-based denial of service Brute force password attack Application implementation flaw

Network-based intrusion detection is most suited to detect and prevent which types of attacks?

This configuration create two broadcast domains. VLAN1 and VLAN2 are separate broadcast domains FastEthernet ports 0/1 and 0/2 are members of VLAN1. FastEthernet ports 0/3 and 0/4 are members of VLAN2. >>Workstations in VLAN1 are able to communicate with workstations in VLAN2 because they are connected to the same physical switch. VLAN1 is one of the default VLANs on the switch. VLAN2 had to be manuallt configured

Based on the VLAN configuration shown in the diagram above, which of the following is not true?

Managing RAID fault-tolerant drive configurations >>Authenticating remote clients before access to the network is granted Controlling entry gate access using proximity sensors Managing access to a network over a VPN

RADIUS is primarily used for what purpose?

>>Periodically verifies the identity of a peer using a three-way handshake Links remote systems together Protects user names Allows the use of biometric devices

CHAP preforms which of the following security functions?

White box test >>The tester has detailed information about the target system prior to starting the test. Grey Box test >>The tester has the same about of information that would be available to a typical insider in the organization. Black box test >>The tester has no prior knowledge of the target system. Single blind test >>Either the attacker has prior knowledge about the target system, or the administrator knows that the test is being performed. Double blind test >>The tester does not have prior information about the system and the administrator has no knowledge that the test is being performed

Drag each penetration test characteristic on the left to the appropriate penetration test name on the right.

ARP Spoofing/Poisoning >>The source device sends frames to the attacker's MAC address instead of the correct devises. Dynamic Trunking Protocol >>Should be disabled on the switch's end user (access) ports before implementing the switch configuration into the network. MAC Flooding >>Causes packets to fill up the forwarding table and consumes so much of the switch's memory that it enters a state called fail open mode. MAC Spoofing >>Can be used to hide the identity of the attacker's computer or impersonate another device on the network.

Drag the description on the left to the appropriate switch attack type shown on the right.

Perpetrators attempt to compromise or affect the operations of a system >>Active Attack Unauthorized individuals try to breach a network from off-site. >>External attack Attempting to find the root password on a web server by brute force. >>Active attack Attempting to gather information without affecting the flow of information on the network >>Passive attack Sniffing network packets or performing a port scan. >>Passive attack

Drag the network attack technique on the left to the appropriate description or example on the right.

This layer receives its requests from the application layer >>Control Layer This layer is known as the infrastructure layer >>Physical layer This layer communicates with the control layer through what's called the northbound interface >>Application layer This layer provides the physical later with config and instructions >>Control layer On this layer, individual networking devices use southbound APIs to communicate with the control plane. >>Physical layer

Drag the software-defines networking (SDN) layer on the left to the appropriate function on the right.

Configure all the workstations to be members of both VLANs. >>Use a Layer 3 switch to route packets between VLAN1 and VLAN2. Configure all the ports on the switch to be members of both VLANs. Configure port fa0/2 to also be a member of VLAN2 and port fa0/4 to also be a member of VLAN1. >>Use a router to route packets between VLAN1 and VLAN2

In the VLAN config shown in the diagram above, workstations in VLAN1 are *not* able to communicate with workstationd in VLAN2, even though they are connected to the same Physical switch. Which of the following can you use to allow workstations in VLAN1 to communicate with the workstations in VLAN2?

You want to control the packets sent and received by a router You want to prevent MAC address spoofing You want to prevent sniffing attacks on the network >>You want to restrict the devices that could connect through a switch port.

In which of the following situation would you use port security?

To disable an intruders system >>To delay intruders in order to gather auditing data To prevent sensitive data from being accessed To entrap intruders

A honeypot is used for which purpose?

Smurf attack Social engineering Man-in-the-middle attack >>Privilege escalation

A relatively new employee in the data entry cubical farm was assigned a user account similar to that of all of the other data entry employees. However, audit logs have shown that this user account has been used to change ACLs on several confidential files and has accessed data in restricted areas. This situation indicates which of the following has occurred?

>>Non-credentialed scan Credentialed scan Networked mapping scan Port scan

A security admin. needs to run a vulnerability scan that will analyze a system form the perspective of a hacker attacking the organization from the outside.

Gateway >>Switch Hub Router

A virtual LAN can be created using which of the following?

Twofish >>Blowfish HMAC-SHA1 >>GPG Kerberos

KWalletManager is a Linux-based credential management system that stores encrypted account credentials for network resources. Which encryption methods can KWalletManager use to secure account credentials?

Public cloud Provides cloud services to just about anyone. Private cloud Provides cloud services to a single organization. Community cloud Allows cloud services to be shared by several organizations. Hybrid cloud Integrates one cloud service with other cloud services.

Match each description on the left with the appropriate cloud technology on the right.

>>Privacy Ease of file transfers Real-time communication Indication of when you are online

Instant messaging does *not* provide which of the following?

Brute force password attack >>Bandwidth-based denial of service Buffer overflow exploitation of software Application implementation flaws

Network-based intrusion detection is most suited to detect and prevent which types of attacks?

>>Host system auditing capabilities Remote monitoring tools External sensors Network traffic

What do host based intrusion detection systems often rely upon to perform their detection activities?

Assess the skill level of new IT security staff Infiltrate a competitor's network >>Test the effectiveness of your security perimeter Evaluate newly deployed firewalls

What is the primary purpose of penetration testing?

>>Sniffing Denial of Service DNS poisoning Brute force password attack

What type of attack is most likely to succeed against communications between Instant Messaging clients?

LAN-side clients are halted and removed from the domain The IDS config is changed dynamically, and the source IP is banned >>The IDS logs all pertinent data about the intrusion. >>An alert generated and delivered via email, the console, or an SNMP trap.

Which actions can a typical passive intrusion detection system (IDS) take when it detects an attacks?

>>Ticket granting server RADIUS or TACACS+ server >>Time synchronization PPPoE PPP

Which of the following are required when implementing Kerberos for authentication and authorization?

DaaS PaaS >>SaaS IaaS

Which of the following cloud computing solutions delivers software applications to a client either over the internet or on a local area network.

Retina MBSA OSSTMM >>OVAL

Which of the following identifies standards and XML formats for reporting and analyzing system vulnerabilities?

Cloud computing requires end-user knowledge of the physical location and configuration of the system that delivers the services.

Which of the following is *not* true?

>>TCP SYN scan TCP ACK scan TCP FIN scan TCP connect scan

Which of the following is the name of the type of port scan which does not complete the three-way handshake of TCP, but rather listens for either SYN.ACK or RST/ACK packets?

22 >>49 50 and 51 1812 and 1813 3389

Which of the following ports are used with TACACS?

>>CHAP PAP EAP Certificates

Which remote access authentication protocol periodically and transparently re-authenticates during a logon session by default?

Weak passwords Buffer overflow Privilege escalation >>Backdoor

While developing a network application, a programmer adds functionally that allows her to access the running program, without authentication, to capture debugging data. The programmer forgets to remove this functionality prior to finalizing the code and shipping the application. What type of security weakness does this represent?

System log Event log Load tester >>Packet sniffer Throughput tester

You are concerned about attacks directed against the firewall on your network. You would like to examine the content of individual frames sent to the firewall. Which tool should you use?

Packet sniffer IDS Port Scanner >>IPS

You are concerned about attacks directed at your network firewall. You want to be able to identify and be notified of any attacks. In addition, you want the system to take immediate action to stop or prevent attack, if possible. Which tool should you use?

>>Connect the virtual network interfaces in the virtual machine to the virtual switch Disable the switch port the hypervisor's office is connected to Create a new virtual switch configured for host-only networking >>Create a new virtual switch configured for bridged (external) networking Create a new virtual switch configured for internal networking

You are responsible for maintaining Windows workstation operating systems in your organization. Recently, an update from Microsoft was automatically installed on your workstations that caused an in-house application to stop working. To keep this from happening again, you decide to test all updates on a virtual machine before allowing them to be installed on production workstations. Currently, none of your testing virtual machines have a network connection. However, they need to be able to connect to the update servers at Microsoft to download and install updates.

>>Definition Library Asset risk Repository Threat agent

You are using a vulnerability scanner that conforms to the OVAL specifications. Which of the following items contains a specific vulnerability or security issue that could be present on a system?

Spanning tree >>Promiscuous mode Mirroring Bonding

You decide to use a packet sniffer to identify the type of traffic sent to a router. You run the packet sniffing software on a device, which is connected to the same hub that is connected to the router. When you run the software, you only see frames addressed to the workstation, not to other devices. Which feature should you configure?

False negative Positive Negative False Positive

You have configured an NIDS to monitor network traffic. Which of the following describes harmless traffic that has been identified as a potential attack by the NIDS devices?

>>Inform senior management Perform operational reconnaissance Engage in social engineering Run system fingerprinting software

You have decided to perform a double-blind penetration test. Which of the following actions would you perform *first*

Systems monitor >>Protocol analyzer Performance monitor Vulnerability scanner

You have recently reconfigure FTP to require encryption of both passwords and data transfers. You would like to check network traffic to verify that all FTP passwords and data are encrypted. Which tool should you use?

802.1x >>Spanning tree Trunking PoE Bonding

You manage a single subnet with three switches. The switches are connected to provide redundant paths between the switches. What feature prevents switching loops and ensures there is only a single active path between any two switches?

Create a VLAN to use as a no-trust network zone for these static stems to connect to. Create a VLAN to use as a medium-trust network zone for these static stems to connect to. Create a VLAN to use as a high trust network zone for these static stems to connect to. >>Create a VLAN to use as a low-trust network zone for these static stems to connect to.

You notice that over the last few months more and more static systems, such as the office environment control system, the security system, and lighting controls, are connected to your network. You know that these devices can be a security threat. Which of the following measures can you take to minimize the damage these devices can cause if they are compromised?

Back up Credentials

You want to protect the authentication credentials you use to connect to the LAB server in your network by copying them to a USB drive. Click the option you use in Credential Manager to protect your credentials.

RIP >>RAS ISDN PPP

You want to set up a service to allow multiple users to dial in to the office server form modems on their home computers. What service should you implement?

Testing virus definition design for false positives >>Discovering unadvertised servers >>Determining which ports are open on a firewall Auditing IPsec encryption algorithm config

which of the following functions can a port scanner provide?

The SDN controller is a virtual networking devices The SDN controlling is hardware The SDN controller is a networking protocol >>The SDN controller is software

Software-defined networking (SDN) uses a controller to manage the devices. The controller is able to inventory hardware components in the network, gather network statistics, making routing decisions based on gathered data, and facilitate communication between devices from different vendors. It can also be used to make wide-spread configuration changes on just one device. Which of the following best describes an SDN controller?

You can load-balance wireless guest network traffic to have a lower priority than the rest of the traffic on the network. You can control broadcast traffic and create a collision domain for just the wireless guest devices >>You can control security by isolating wireless guest devices within this VLAN. You can create a wireless guest network more affordably with a VLAN than you can with a router.

The IT manager has asked you to create a separate VLAN to be used exclusively for wireless guest devices to connect to. which of the following is the primary benefit of creating this VLAN?

>>Peer-to-peer networking Real-time communication Transfer of text and files Freely available for use

What common design feature among Instant Messaging clients make them more insecure than other means of communicating over the Internet?

Deploying CHAP and EAP on remote access connections >>A process by which each party in an online communication verifies the identity of each other party. Using a CA to issue certificates The use of two or more authentication factors

What is mutual authentication?

>>Vulnerability scanning is performed within the security perimeter; penetration testing is performed outside the security perimeter Vulnerability scanning uses approved methods and tools; penetration testing uses hacking tools The goal of vulnerability scanning is to identify potential weaknesses; the goal of penetration testing is to attack a system Vulnerability scanning is performed with a detailed knowledge of the system; penetration testing begins with no knowledge of the system.

What is the main difference between vulnerability scanning and penetration scanning?

Host name IP address MAC address >>Switch port

When configuring VLANs on a switch, what is used to identify VLAN membership of a device?

Uplink ports Any port not assigned to a VLAN Trunk ports Gigabit and higher Ethernet ports Each port can only be a member of a single VLAN

When configuring VLANs on a switch, what type of switch ports are members of all VLANs defined on the switch?

Rerouting local switch traffic to a specified destination Causing incoming packets to broadcast to all ports >>Bypassing 802.1x port-based security Causing a switch to enter fail open mode

Which is a typical goal of MAC spoofing?

Transmitting FIN or RES packets to an external host >>Monitoring the audit trails on a server >>Listening to network traffic Disconnecting a port being used by a zombie

Which of the following activities are considered passive in regards to the function of an intrusion detection system?

Interviewing employees to verify that the security policy is being followed >>Running a port scanner >>Attempting a social engineering Creating a performance baseline Running a vulnerability scanner on network servers

Which of the following activities are typically associated with a penetration test?

>>Controlling access through a wireless access point Authentication remote access clients Authentication VPN users through the Internet Controlling access through a router >>Controlling access through a switch

Which of the following applications typically use 802.1x authentication?

Uses UDP Allows of two different servers, one for authentication and authorization, and another for accounting >>Allows three different servers, one each for authentication, authorization, and accounting >>Uses TCP

Which of the following are characteristics of TACAS+?

Sneaking into a building without authorization >>Looking through discarded paper or media for sensitive information Scanning various ports on remote hosts looking for well-known service >>Eavesdropping or obtaining sensitive information from items that are not properly stored. Duplicating captured packets without altering or interfering with the flow of traffic on that medium

Which of the following are included in an *operations penetration* test?

>>Check for open ports Analyze packets for evidence of an attack >>Check user accounts for weak passwords >>Check for missing patches Gather performance statistics for setting a baseline

Which of the following are preformed by the Microsoft Baseline Security Analyzer (MBSA) tool?

Blocking of remote connectivity >>A centralized database of users and passwords A directory service Use of token devices and one-time passwords >>Time synchronization between devices

Which of the following are requirements to deploy Kerberos on a network?

>>IPS >>IDS ACL Firewall VPN

Which of the following are security devices that perform stateful inspection of packet date and look for patterns that indicate malicious code?

In the event of a widespread malware infection, the administrator can quickly reimage all user desktops on a few central servers. User desktop environments are centrally hosted on servers instead of on individual desktop systems.

Which of the following are true concerning the Virtual Desktop Infrastructure?

Replay ARP Poisoning MAC spoofing >>MAC flooding

Which of the following attacks, if successful, cause a switch to function like a hub.

NTLM >>LANMAN NTLMv2 LDAP

Which of the following authentication mechanisms is designed to protect to protect a nine-character password from attacks by hashing the first seven characters into a single hash and then hashing the remaining two characters into another separate hash?

RADIUS CHAP >>PAP EAP

Which of the following authentication protocols transmits passwords in clear text, and is, therefore, considered too insecure for modern networks?

Devices on different networks that can receive multicast packets Devices connected by a transmission medium other than a cable. (i.e. microwave, radio transmissions) >>Devices on the same network logically grouped as if they were on separate networks Devices connected through the Internet that can communicate without using a network address Devices in separate networks (i.e. different network addresses) logically grouped as if they were in the same network

Which of the following best describes the concept of a *virtual LAN*?

PaaS delivers software applications to the client either over the internet or on a local area network. PaaS delivers infrastructure to the client, such as processing, storage, networks, and virtualized environments PaaS stores and provides data from a centralized location without the need for local collection and storage >>PaaS delivers everything a developer needs to build an application onto the cloud infrastructure

Which of the following best describes the platform as a service (PaaS) cloud computing service model?

The source address matching the destination address The source address identifying a non-existent host >>Legitimate traffic being flagged as malicious Malicious traffic masquerading as legitimate traffic Malicious traffic not being identified

Which of the following describes a false postive when using IPS device?

The system identified harmful traffic as harmless and allowed it to pass without generating any alerts.

Which of the following describes the worst possible action by an IDS?

Load balancer CSU/DSU >>IDS DNS server Proxy

Which of the following devices can monitor a network and detect potential security attacks?

Virtual firewall >>Virtual switch Virtual router Hypervisor

Which of the following devices facilitates communication between different virtual machines by checking data packets before moving the to a destination?

DNS server IDS Multi-layer switch >>IPS

Which of the following devices is capable of detecting and responding to security threats?

>>Hypervisor Virtual router Virtual switch Virtual firewall

Which of the following devices is computer software, firmware, or hardware that creates and runs virtual machines?

>>Encrypts the entire packet, not just authentication packets Requires that authentication and authorization are combined in a single server Supports only TCP/IP Uses UDP ports 1812 and 1813

Which of the following is a characteristics of TACACS+?

SDN facilitates communication between hardware from different vendors SDN gathers network info and statistics >>SDN standards are still being developed SDN creates centralized management

Which of the following is a disadvantage of software-defined networking (SDN)?

Three-way handshake Hashed shared secret >>Mutual authentication Certificate-based authentication

Which of the following is a feature of MS-CHAP v2 that is not included in CHAP?

>>A logical grouping of devices based on service need, protocol, or other criteria. A device used to filter WAN traffic A device used to route traffic between separate networks A physical collection of devices that belong together and are connected to the same wire of physical switch.

Which of the following is an appropriate definition of a VLAN?

You can simply device moves You can manually load-balance network traffic You can control security by isolating traffic within a VLAN >>You can simplify routing traffic between separate networks. You can control broadcast traffic and create collision domains based on logical criteria

Which of the following is not an administrative benefit of implementing VLANs?

A user connects to a computer on the LAN using Remote Desktop A user logs on to an e-commerce site that use SSL. >>A user establishes a dial-up connection to a server to gain access to shared resources. A user accesses a shared folder on a server

Which of the following is the best example of remote access authentication?

CHAP >>TACACS EAP SESAME Kerberos

Which of the following protocols can be used to centralize remote access authentication?

TACACS LDAP L2TP PPTP >>Kerberos

Which of the following protocols uses port 88?

Auto-duplex >>Spanning tree CSMA/CD Inter-vlan routing

Which of the following solutions would you implement to eliminate switching loops?

A virtual network is dependent on the configuration and physical hardware of the host operating system Multiple virtual networks can be associated with a single physical network adapter

Which of the following statements about virtual networks is true?

Inbound scanning Passive reconnaissance Reverse engineering >>Penetration testing

Which of the following uses hacking techniques to proactively discover internal vulnerabilities?

110 >>639 69 161 >>389

Which ports does LDAP (Lightweight Directory Access Protocol) use by default?

>>DTP PPTP TCP IPsec

Which protocol should you disable on the user access ports of a switch?

>>Create a new virtual switch configured for host-only (internal) networking Create MAC address filters on the network switch that block each virtual machine's virtual network interfaces Disconnect the network cable from the hypervisor's network interface Disable the switch port the hypervisor's office is connected to Create a new virtual switch configured for bridged (external) networking >>Connect the virtual network interfaces in the virtual machines to the virtual switch

You are an application developer. You use a hypervisor with multiple virtual machines installed to test your applications on various operating system versions and editions. Currently, all of your testing virtual machines are connected to the production network through the hypervisor's network interface. However, you are concerned that the latest application you are working on could adversely impact other network hosts if errors exist in the code. To prevent this, you decide to isolate the virtual machines from the production network. However, they still need to be able to communicate directly with each other. What should you do?

PAP >>PPP PPPoE SLIP >>CHAP

You are configuring a dial-up connection to a remote access server. Which protocols would you choose to establish the connection and authenticate, providing the most secure connection possible?

Remove the hub and place each library computer on its own access port >>Configure port security on the switch Create a VLAN for each group of four computers Create static MAC addresses for each computer and associate it with a VLAN

You are the network administrator for a city library. Throughout the library are several groups of computers that provide public access to the internet. Supervision of these computers has been difficult. You've had problems with patrons bringing personal laptops into the library and disconnecting the network cable from the library computers to connect to their laptops to the internet. The library computers are in groups of four. Each group of four computers is connected to a hub that is connected to the library network through an access port on a switch. You want to restrict access to the network so only the library computers are permitted connectivity to the internet. What can you do?

SSL >>Uses public-key cryptography HTTP >>Transfers data in cleartext SSH >>Uses public-key cryptography Telnet >>Transfers data in cleartext Console port >>Cannot be sniffed

You can use a variety of methods to manage the configuration of a network router. Match the management option on the right with its corresponding description on the left. (Each option can be used more than once.)

Promiscuous mode >>Mirroring Spanning tree Bonding

You decide to use a packet sniffer to identify the type of traffic sent to a router. You run the packet sniffing software on a device that is connected to a hub with three other computers. The hub is connected to the same switch that is connected to the router. When you run the software, you see frames addressed to the four workstations, but not to the router. Which feature should you configure?

On each of the remote access servers On one of the remote access servers >>On the RADIUS server used for authentication and authorization On the RADIUS server used for accounting

You have a network with three remote access servers, a RADIUS server used for authintication and authorization, and a second RADIUS server used for authentication and authorization, and a second RADIUS server used for accounting. Where should you configure remote access policies?

>>Configure port mirroring Connect hosts A and B together on the same switch port through a hub Configure the default gateway addresses on hosts A and B with the IP address of Host C Manually set the MAC address of Host C to the MAC address of host A

You have a small network of devices connected using a switch. You want to capture the traffic that is sent form Host A to Host B. On Host C, you install a packet sniffer that captures network traffic. After running the packet sniffer, you cannot find any captured packets between Host A and Host B.

>>The control layer removes the control plane from networking devices and creates a single control plane This control layer interfaces with the control plane in each networking device and creates a virtual control plane. The control layer removes the control plane from networking devices and creates a virtual control plane for each device. The control layer uses southbound APIs to communicate with the control plane in each network device and creates a single control plane

You have opted to use software-defined networking (SDN) to manage, control, and make changes to your network. You want to be able to use software to configure and intelligently ocntrol the network rather than relying on the individual static config files that are located on each network device. SDN consists of three layers: Application layer Control layer Physical layer Which of the following describes what the SDN control layer does to networking devices that comprise the physical layer?

Update the vulnerability scanner definition files Document your actions Use a port scanner to check for open ports >>Run the vulnerability assessment agent

You have run a vulnerability scanning tool and identified several patches that need to be applied to a system. What should you do next after applying the patches?

NAT >>VLANs Port authentication DMZ

You manage a network that uses a single switch. All ports within your building connect through the single switch. In the lobby of your building are three RJ-45 ports connected to the switch. You want to allow visitors to plug into these ports to gain Internet access, but they should not have access to any other devices on your private network. Employees connected throughout the rest of your building should have both private and Internet access. Which feature should you implement?

Intranet >>Remote access Internet Virtual private network

You often travel away from the office. While traveling, you would like to use a modem on your laptop computer to connect directly to a server in your office and access files. You want the connection to be as secure as possible. Which type of connection will you need?

Port security VPN Spanning tree >>VLAN

You run a small network for your business that has a single router connected to the internet and a single switch. You keep sensitive documents on a computer that you would like to keep isolated from other computers on the network. Other hosts on the network should not be able to communicate with this computer through the switch, but you still need to access the network through the computer. What should you use for this situation?

OVAL Retina >>John the Ripper Nessus

You want to check a server for user accounts that have weak passwords. Which tool should you use?

60 80 389 443 >>636 2208

You want to deploy SSL to protect authentication traffic with your LDAP-based directory services. Which port does this action use?

Port scanner Ping scanner OVAL >>Network mapper

You want to identify all devices on a network along with a list of ports on those devices. You want the results displayed in a graphical diagram. Which tool should you use?

>>Protocol analyzer Multimeter TDR Certifier Toner probe

You want to identify traffic that is generated and sent through the network by a specific application running on a device. Which tool should you use?

>>802.1x Port Security IPsec Spanning tree

You want to increase the security of your network by allowing only authenticated users to access network devices through a switch. Which of the following should you implement?

>>Packet sniffer IDS Throughput tester IPS Port scanner

You want to know what protocols are being used on your network. You'd like to monitor traffic and sort traffic based on protocol. Which tool should you use?

IDS >>Port scanner System logs Packet sniffer IPS

You want to make sure that a set of servers will only accept traffic for specific network services. You have verified that the servers are only running the necessary services, but you also want to make sure that the servers will not accept packets sent to those services. Which tool should you use?

Simple >>SASL Mutual EAP

You want to use Kerberos to protect LDAP authentication. Which authentication mode should you choose?

Wireshark >>Nessus OVAL LC4 >>Retina

You want to use a tool to scan a system for vulnerabilities including open ports, running services, and missing patches. Which two tool would you use?

>>Wireshark Nmap Nessus OVAL

You want to use a tool to see packets on a network, including the source and destination of each packet. Which tool should you use?

Apply all known patches to the system Inform senior management of your actions >>Update the scanner definition files Perform a port scan

You want to use a vulnerability scanner to check a system for known security risks. What should you do first?

>>Change the user name and create a more complex password Remove any backdoors that might have been created by a programmer Create a more complex password Change the username

You've just deployed a new Cisco router so you can connect a new segment to your organization's network. The router is physically located in a server room that can only be accessed with an ID card. You've backed up the router config to a remote location in an encrypted file. You access the router config from your notebook computer by connecting it to the console port on the router. The web-based management interface uses the default user name of *cusadmin* and a password of *highspeed*. What should you do to increase the security of the device?

Use TFTP to back up the router config to a remote location >>Move the router to a secure server room Use a Telnet client to access the router config Change the default admin user name and password Use encrypted type 7 passwords

You've just deployed a new Cisco router that connects several network segments in your organization. The router is physically located in a cubicle near your office. You've backed up the router config to a remote location in an encrypted file. You access the router config interface from your notebook computer using an SSH client with the user name *admin01* and the password *P@ssW0rd*. You have used the MD5 hashing algorithm to protect the password. What should you do to increase the security of this device?

Use a web browser to access the router config using an HTTP connection Use an SSH client to access the router configuration Move the device to a secure data center >>Use a stronger admin password

You've just deployed a new Cisco router that connects several network segments in your organization. The router is physically located in a cubicle near your office. You've backed up the router configuration to a remote location in an encrypted file. You access the router configuration interface from your notebook computer using an SSH client with a user name of admin01 and a password of P@ssW0rd. You have used the MD5 hashing algorithm to protect the password. What should you do to increase the security of this device?

>>Use SCP to back up the router config to a remote location Move the router to a secure data center. Use an SSH client to access the router config Use encrypted type 7 passwords

You've just deployed a new Cisco router that connects several network segments in your organization. The router is physically located in a locked server closet. You use an FTP client to regularly back up the router configuration to a remote sever in an encrypted file. You access the router configuration interface from a notebook computer that is connected to the router's console port. You've configured the device with the user name *admin01* and the password *P@ssW0rd*. You have used the MD5 hashing algorithm to protect the password. What should you do to increase the security of this device?

>>Change the default admin user name and password Use TFTP to back up the router config to a remote location Use a web browser to access the router configuration using an HTTP connection >>Use an SSH client to access the router config Use encrypted type 7 passwords

You've just deployed a new Cisco router that connects several network segments in your organization. The router is physically located in a server room that requires an ID card to gain access. You've backed up the router configuration to a remote location location in an encrypted file. You access the router configuration interface from your notebook computer by connecting it to the console port on the router. You configured the management interface with a user name of admin and a password of password. What should you do to increase the security of this device?

Use Kerberos Use IPsec and certificates >>Use SSL Add SASL and use TLS

Your LDAP directory services solution uses simple authentication. What should you always do when using simple authentication?

Spanning tree VPN >>VLAN Port Security

Your company is a small start-up company that has leased office space in the building shared by other businesses. All businesses share a common infrastructure. A single switch connects all devices in the building to the router that provides internet access. You would like to make sure your computers are isolated from computers used by other companies. What feature should you request to have implemented?

Network firewalling Virtual local area networking >>Network segmentation Trust zone networking

Your network devices are categorized into the following zone types: No-trust zone Low-trust zone Medium-trust zone High-trust zone Your network architecture employs multiple VLANs for each of these network zones. Each zone is separated by a firewall that ensures only specific traffic is allowed. Which of the following is the secure architecture concept that is being used on this network?

>>User education and training Identifying a network baseline Network segmentation Identifying inherent vulnerabilities Documenting all network assets in your organization

Your organization has started receiving phishing emails. You suspect that an attacker is attempting to find an employee workstation they can compromise. You know that a workstation can be used as a pivot point to gain access to more sensitive systems. Which of the following is the most important aspect of maintaining network security against this type of attack?

Implement a packet-filtering firewall in front of the web server Implement an application-aware IDS in front of the web server Install an anti-malware scanner on the web server >>Implement an application-aware IPS in front of the web server Implement a stateful firewall in front of the web server

Your organization uses a web server to host an e-commerce site. Because this web server handles financial transactions, you are concerned that it could become a prime target for exploits. You want to implement a network security control that will analyze the contents of each packet going to or from the web server. The security control must be able to identify malicious payloads and block them.

Determine that the accused employee is innocent and being framed. >>Implement an application control solution Block all outbound ports in the perimeter firewall Call human resources and have the employee fired for violation of the security policy.

Your organization's security policy specifies that peer-to-peer file sharing is not allowed. Recently, you received an anonymous tip that an employee has been using a BitTorrent client to download copyrighted media while at work. You research BitTorrent and find that it uses TCP ports 6881-6889 by default. When you check your perimeter firewall configuration, ports 80 and 443 are open. When you check your firewall logs, you find that no network traffic is using ports 6881-6889 has been blocked. What should you do?