Question 1

What is the result of packets that are created which exceed the MTU of the network? How can this process be exploited?

Accepted Answer

Packets that are larger than the MTU must be fragmented,or broken into multiple segments that are small enough for the network to handle.
After a packet is broken into fragments,each fragment receives its own IP header.However,in IPv4,only the initial packet in a set includes a header for higher-level protocols.Most filters need the information in the higher-level protocol header to make the decision to allow or deny the packet.Accordingly,attackers send only secondary fragments,which are any fragments other than the initial one.These packets are often allowed past the IDPS because filter rules are applied to first fragments only.

Question 2

Which TCP flag can be the default response to a probe on a closed port?

Accepted Answer

A)  RST 
B)  URG 
C)  PSH 
D)  SYN 
A)  RST 
B)  URG 
C)  PSH 
D)  SYN A

Question 3

What can an IDPS check to try to determine whether a packet has been tampered with or damaged in transit?

Accepted Answer

A)  parity bit 
B)  CRC value 
C)  checksum 
D)  fragment offset 
A)  parity bit 
B)  CRC value 
C)  checksum 
D)  fragment offset C

Question 4

MATCHING
-used by attackers to delay the progression of a scan

Accepted Answer

A) back door 
B) MTU 
C) ping sweep 
D) scan throttling 
E) packet injection
F)signature
G)vanilla scan
H)RPC
I)FIN packet
J)RST packet 
A) back door 
B) MTU 
C) ping sweep 
D) scan throttling 
E) packet injection
F)signature
G)vanilla scan
H)RPC
I)FIN packet
J)RST packet

Question 5

Under which attack category does a UNIX Sendmail exploitation fall?

Accepted Answer

A)  bad header information 
B)  single-packet attack 
C)  multiple-packet attack 
D)  suspicious data payload 
A)  bad header information 
B)  single-packet attack 
C)  multiple-packet attack 
D)  suspicious data payload

Question 6

MATCHING
-a series of ICMP echo request packets in a range of IP addresses

Accepted Answer

A) back door 
B) MTU 
C) ping sweep 
D) scan throttling 
E) packet injection
F)signature
G)vanilla scan
H)RPC
I)FIN packet
J)RST packet 
A) back door 
B) MTU 
C) ping sweep 
D) scan throttling 
E) packet injection
F)signature
G)vanilla scan
H)RPC
I)FIN packet
J)RST packet

Question 7

A ______________ is made up of IP numbers and options,TCP flags,and port number that define a type of network activity.

Accepted Answer

The answer of A ______________ is made up of IP...

Question 8

Which element of an ICMP header would indicate that the packet is an ICMP echo request message.

Accepted Answer

A)  Code 
B)  Type 
C)  Identifier 
D)  Data 
A)  Code 
B)  Type 
C)  Identifier 
D)  Data

Question 9

In an RPC _________,a targeted host receives an RPC set request from a source IP address of 127.0.0.1.

Accepted Answer

The answer of In an RPC _________,a targeted host receives...

Question 10

What is a selective acknowledgement and how does it affect transmissions?

Accepted Answer

Selective acknowledgements speed up tran

Question 11

MATCHING
-a standard set of communications rules that allows one computer to request a service from another computer

Accepted Answer

A) back door 
B) MTU 
C) ping sweep 
D) scan throttling 
E) packet injection
F)signature
G)vanilla scan
H)RPC
I)FIN packet
J)RST packet 
A) back door 
B) MTU 
C) ping sweep 
D) scan throttling 
E) packet injection
F)signature
G)vanilla scan
H)RPC
I)FIN packet
J)RST packet

Question 12

Describe the SYN flag and how it is used in the three-way handshake.

Accepted Answer

The SYN flag is sent from one computer t

Question 13

Which of the following correctly represents the port used by FTP control traffic and FTP file transfer traffic respectively?

Accepted Answer

A)  20, 25 
B)  21, 23 
C)  20, 23 
D)  21, 20 
A)  20, 25 
B)  21, 23 
C)  20, 23 
D)  21, 20

Question 14

What are the signatures of malformed packets that misuse the SYN and FIN flags? Briefly describe each.

Accepted Answer

SYN FIN is probably the best-known illeg

Question 15

What is the packet called where a Web browser sends a request to the Web server for Web page data?

Accepted Answer

A)  HTML SEND 
B)  HTTP XFER 
C)  HTTP GET 
D)  HTML RELAY 
A)  HTML SEND 
B)  HTTP XFER 
C)  HTTP GET 
D)  HTML RELAY

Question 16

The _______________ part of a packet is the actual data sent from an application on one computer to an application on another.

Accepted Answer

The answer of The _______________ part of a packet is...

Question 17

Which of the following is an accurate set of characteristics you would find in an attack signature?

Accepted Answer

A)  IP address, attacker's alias, UDP options 
B)  protocol options, TCP ports, region of origin 
C)  IP address, TCP flags, port numbers 
D)  IP number, MAC address, TCP options 
A)  IP address, attacker's alias, UDP options 
B)  protocol options, TCP ports, region of origin 
C)  IP address, TCP flags, port numbers 
D)  IP number, MAC address, TCP options

Question 18

In the three-way handshake,the first packet in the sequence has the ________ flag set.

Accepted Answer

The answer of In the three-way handshake,the first packet in...

Question 19

Which of the following is NOT among the items of information that a CVE reference reports?

Accepted Answer

A)  attack signature 
B)  name of the vulnerability 
C)  description of vulnerability 
D)  reference in other databases 
A)  attack signature 
B)  name of the vulnerability 
C)  description of vulnerability 
D)  reference in other databases

Question 20

What is the difference between a vanilla port scan and a strobe port scan?

Accepted Answer

In a vanilla scan,all ports from 0 to 65

What is the result of packets that are created which exceed the MTU of the network? How can this process be exploited?

Which TCP flag can be the default response to a probe on a closed port?

What can an IDPS check to try to determine whether a packet has been tampered with or damaged in transit?

MATCHING -used by attackers to delay the progression of a scan

Under which attack category does a UNIX Sendmail exploitation fall?

MATCHING -a series of ICMP echo request packets in a range of IP addresses

A ______________ is made up of IP numbers and options,TCP flags,and port number that define a type of network activity.

Which element of an ICMP header would indicate that the packet is an ICMP echo request message.

In an RPC _________,a targeted host receives an RPC set request from a source IP address of 127.0.0.1.

What is a selective acknowledgement and how does it affect transmissions?

MATCHING -a standard set of communications rules that allows one computer to request a service from another computer

Describe the SYN flag and how it is used in the three-way handshake.

Which of the following correctly represents the port used by FTP control traffic and FTP file transfer traffic respectively?

What are the signatures of malformed packets that misuse the SYN and FIN flags? Briefly describe each.

What is the packet called where a Web browser sends a request to the Web server for Web page data?

The _______________ part of a packet is the actual data sent from an application on one computer to an application on another.

Which of the following is an accurate set of characteristics you would find in an attack signature?

In the three-way handshake,the first packet in the sequence has the ________ flag set.

Which of the following is NOT among the items of information that a CVE reference reports?

What is the difference between a vanilla port scan and a strobe port scan?

Network Security Fundamentals

TCP-IP

Routing Fundamentals

Cryptography

Wireless Network Fundamentals

Understanding Wireless Security

Intrusion Detection and Prevention Systems

Firewalls

Firewall Design and Management

VPN Concepts

Internet and World Wide Web Security

Security Policy Design and Implementation

On-Going Security Management

Filters

Exam 3: Network Traffic Signatures

What is the result of packets that are created which exceed the MTU of the network? How can this process be exploited?

Which TCP flag can be the default response to a probe on a closed port?

What can an IDPS check to try to determine whether a packet has been tampered with or damaged in transit?

MATCHING -used by attackers to delay the progression of a scan

Under which attack category does a UNIX Sendmail exploitation fall?

MATCHING -a series of ICMP echo request packets in a range of IP addresses

A ______________ is made up of IP numbers and options,TCP flags,and port number that define a type of network activity.

Which element of an ICMP header would indicate that the packet is an ICMP echo request message.

In an RPC _________,a targeted host receives an RPC set request from a source IP address of 127.0.0.1.

What is a selective acknowledgement and how does it affect transmissions?

MATCHING -a standard set of communications rules that allows one computer to request a service from another computer

Describe the SYN flag and how it is used in the three-way handshake.

Which of the following correctly represents the port used by FTP control traffic and FTP file transfer traffic respectively?

What are the signatures of malformed packets that misuse the SYN and FIN flags? Briefly describe each.

What is the packet called where a Web browser sends a request to the Web server for Web page data?

The _______________ part of a packet is the actual data sent from an application on one computer to an application on another.

Which of the following is an accurate set of characteristics you would find in an attack signature?

In the three-way handshake,the first packet in the sequence has the ________ flag set.

Which of the following is NOT among the items of information that a CVE reference reports?

What is the difference between a vanilla port scan and a strobe port scan?

Network Security Fundamentals

TCP-IP

Routing Fundamentals

Cryptography

Wireless Network Fundamentals

Understanding Wireless Security

Intrusion Detection and Prevention Systems

Firewalls

Firewall Design and Management

VPN Concepts

Internet and World Wide Web Security

Security Policy Design and Implementation

On-Going Security Management

Filters