Testout 5.4-5.7
In addition to Authentication Header (AH), IPSec is comprised of what other service?
ESP
Which IPSec subprotocol provides data encryption?
ESP
which of the following is likely to be located in a DMZ
FTP Server
which of the following is a firewall function
Packet filtering
PPTP is quickly becoming obsolete because of what VPN protocol?
L2TP
Which VPN protocol typically employs IPSec as its data encryption mechanism?
L2TP
which of the following network devices or services prevents the use of IPsec in most cases
NAT
in which of the following situations would you most likely implement a dmz
you want to protect a public web server from attack
A salesperson in your organization spent most of her time traveling between customers sites. After a customer visit, she must complete various managerial tasks, such as updating your organizations order database. Because she rarely... many of the things... Which key step should you take when implementing this configurations? select two
- configure the vpn connection to use IPsec - configure the browser to send HTTPS requests through the VPN connection
which of the following are characteristics of a packet filtering firewall
- filters ip address and port - stateless
which of the following are characteristics of a circuit-level gateway?
- stateful - filters based on sessions
which of the following are true of a circuit proxy filter firewall?
- verifies sequencing of session packets - operates at the session layer
You have used firewalls to create a demilitarized zone. You have a web server that needs to be accessible to internet users. The web server must communicate with a database server for retrieving product, customer, and order information. How should you place devices on the network to best protect the servers?
-put the web server inside the DMZ - put the database server on the private network
which of the following is not one of the IP address ranges defined in RFC 1918 that are commonly used behind a NAT server?
169.254.0.0-169.254.255.255
which of the following does a router acting as a firewall use to control which packets are forwarded or dropped?
ACL
Of the following security zones, which one can serve as a buffer network between a private secured network and the untrusted Internet?
DMZ
You have a company network that is connected to the Internet. You want all users to have Internet access, but need to protect your private network and users. You also need to make a Web server publicly available to Internet users. Which solution should you use?
Use firewalls to create a DMZ. Place the web server inside the DMZ and the private network behind the DMZ.
which is the best countermeasure for someone attempting to view your network traffic?
VPN
A group of salesmen would like to access your private network through the internet while they are traveling. You want to control access to the private network through a single server. Which solution should you implement?
VPN concentrator
which of the following describes how access lists can be used to improve network security?
an access list filters traffic based on the IP header information such as source or destination IP address, protocol, or socket numbers
You provide Internet access for a local school. You want to control Internet access based on user, and prevent access to specific URLs. Which type of firewall should you install?
application level
which of the following terms describes a network device that is exposed to attacks and has been hardened against those attacks?
bastion/sacrificial host
You want to install a firewall that can reject packets that are not part of an active session. Which type of firewall should you use?
circuit-level
When designing a firewall, what is the recommended approach for opening and closing ports?
close all ports; open only ports required by applications inside the DMZ
You want to connect your small company network to the Internet. Your ISP provides you with a single IP address that is to be shared between all hosts on your private network. You do not want external hosts to be able to initiate connection to internal hosts. What type of NAT should you implement?
dynamic
which of the following is the best device to deploy/protect your private network from a public untrusted network
firewall
you have been given a laptop to use for work. you connect the laptop to your company network, use it from home, and use it while traveling. you want to protect the laptop from internet-based attacks. which solution should you use?
host based firewall
which of the following is not a benefit of NAT
improving the throughput rate of traffic
you would like to control internet access based on users, time of day, and websites visited. how can you do this?
install a proxy server. allow internet access through the proxy server.
You manage a small network at work. Users use workstations connected to your network. No portable computers are allowed. As part of your security plan, you would like to implement scanning of e-mails for all users. You want to scan the e-mails and prevent any e-mails with malicious attachments from being received by users. Your solution should minimize administration, allowing you to centrally manage the scan settings. Which solution should you use?
network based firewall
Your company has a connection to the Internet that allows users to access the Internet. You also have a Web server and an e-mail server that you want to make available to Internet users. You want to create a DMZ for these two servers. Which type of device should you use to create the DMZ?
network based firewall
You are the network administrator for a small company that implements NAT to access the Internet. However, you recently acquired 5 servers that must be accessible from outside your network. Your ISP has provided you with 5 additional registered IP addresses to support these new servers but you don't want the public to access these servers directly. You want to place these servers behind your firewall on the inside network yet still allow them to be accessible to the public from the outside. Which method of NAT translation should you implement for these servers?
static
you want to configure the server as a web server and allow internet hosts to contact the server to browse a personal website. what should you use to allow access?
static NAT
VPN
support secured communications over an untrusted network
tunneling
supporting private traffic through a public communication medium
which statement best describes IPSec when used in tunnel mode?
the entire data packet, including headers, is encapsulated
features of an application level gateway
the entire messages are reassembled stops each packet at the firewall and inspects it
