Exam 9: Firewalls and Intrusion Prevention Systems

__________ looks for deviation from standards set forth in RFCs.

__________ scans for attack signatures in the context of a traffic stream rather than individual packets.

A prime disadvantage of an application-level gateway is the additional processing overhead on each connection.

A traditional packet filter makes filtering decisions on an individual packet basis and does not take into consideration any higher layer context.

A __________ gateway sets up two TCP connections,one between itself and a TCP user on an inner host and one between itself and a TCP user on an outside host.

The _________ attack is designed to circumvent filtering rules that depend on TCP header information.

The __________ protocol is an example of a circuit-level gateway implementation that is conceptually a "shim-layer" between the application layer and the transport layer and does not provide network-layer gateway services.

The primary role of the personal firewall is to deny unauthorized remote access to the computer.

The firewall can protect against attacks that bypass the firewall.

A _________ firewall applies a set of rules to each incoming and outgoing IP packet and then forwards or discards the packet.

Identified as a critical strong point in the network's security,the _________ serves as a platform for an application-level or circuit-level gateway.

The _________ defines the transport protocol.

A ___________ makes use of both signature and anomaly detection techniques to identify attacks.

The ________ IP address is the IP address of the system that originated the IP packet.

The firewall follows the classic military doctrine of _________ because it provides an additional layer of defense.

An example of a circuit-level gateway implementation is the __________ package.

The countermeasure to tiny fragment attacks is to discard packets with an inside source address if the packet arrives on an external interface.

A single device that integrates a variety of approaches to dealing with network-based attacks is referred to as a __________ system.

Snort Inline adds three new rule types: drop,reject,and _________.

__________ protocols operate in networking devices,such as a router or firewall,and will encrypt and compress all traffic going into the WAN and decrypt and uncompress traffic coming from the WAN.