Deck 4: Secure Networks

Question 1

A direct attack occurs when an attacker tries to flood a victim with a stream of packets directly from the attacker's computer.

Answer 1

True

Question 2

ICMP can be best described as the second part of a three-way TCP handshake sent in response to a SYN.

Answer 2

False

Question 3

A DoS attack makes a server or network unavailable by flooding it with attack packets.

Answer 3

True

Question 4

In regards to network security, ________ means preventing unauthorized users from gaining information about the network structure, data flowing across the network, network protocols used, or packet header values.

A) confidentiality
B) integrity
C) availability
D) authentication

Question 5

"Breadth of the perimeter" is a phrase used by network administrators to convey that creating a 100% secure network is possible.

Question 6

DoS network attacks are fairly uncommon.

Question 7

SYN-ACK can be best described as the second part of a three-way TCP handshake sent in response to a SYN.

Question 8

Ensuring network ________ means that authorized users have access to information, services, and network resources.

A) confidentiality
B) integrity
C) availability
D) authentication

Question 9

The ultimate goal of a DoS attack is to ________.

A) cause harm
B) frustrate users
C) practice hacking
D) None of the above

Question 10

Similar to a direct attack, an indirect attack occurs when an attacker spoofs his/her IP address.

Question 11

A ________ attack is when a webserver is flooded with application layer web requests.

A) SYN flood
B) Ping flood
C) HTTP flood
D) None of the above

Question 12

Ensuring appropriate network ________ means preventing attackers from altering the capabilities or operation of the network.

A) confidentiality
B) integrity
C) availability
D) functionality

Question 13

In regards to network security, ________ is the policy-driven control of access to systems, data, and dialogues.

A) confidentiality
B) integrity
C) access control
D) availability

Question 14

A ________ attack is when a victim is flooded with SYN packets in an attempt to make many half-open TCP connections.

A) SYN flood
B) Ping flood
C) HTTP flood
D) None of the above

Question 15

________ is the process of obscuring an attackers source IP address.

A) Backscatter
B) Spoofing
C) IP Flood
D) None of the above

Question 16

"Death of the perimeter" is a phrase used by network administrators to convey that creating a 100% secure network is impossible.

Question 17

A ________ attack is when a victim is flooded with ICMP packets that appear to be normal supervisory traffic.

A) SYN flood
B) Ping flood
C) HTTP flood
D) None of the above

Question 18

________ are compromised hosts running malware controlled by the hacker.

A) DDoS
B) ICMP
C) Bots
D) None of the above

Question 19

An indirect attack occurs when an attacker tries to flood a victim with a stream of packets directly from the attacker's computer.

Question 20

DoS attacks can cause harm by ________.

A) stopping a critical service
B) slowly degrading services over a period of time
C) Both A and B
D) Neither A nor B

Question 21

________ is one method of thwarting DoS attacks by dropping all IP packets from an attacker.

A) Black holing
B) ICMP echo
C) P2P redirect
D) None of the above

Question 22

A ________ is an older attack that uses an illegally large IP packet to crash an operating system.

A) smurf flood
B) P2P redirect
C) ping of death
D) None of the above

Question 23

Listing your friend's home in the local classifieds at a low price is equivalent to a ________.

A) P2P redirect
B) P2P port
C) DDoS
D) None of the above

Question 24

One problem with ARP requests and replies is that they do not require authentication of verification.

Question 25

In a P2P attack, there is a change in traffic pattern but the overall volume of traffic is the same.

Question 26

________ are an additional layer of compromised hosts that are used to manage large groups of bots.

A) Botnets
B) Handlers
C) Phatbots
D) None of the above

Question 27

Most DoS attacks are difficult to detect.

Question 28

An attacker controlling bots in a coordinated attack against a victim is known as a ________.

A) DoS attack
B) DDoS attack
C) ICMP
D) None of the above.

Question 29

Once established, botnets can be leased to other criminals for DoS attacks.

Question 30

In a reflected DoS attack, attackers send spoofed requests to legitimate servers. The servers then send all responses to the victim.

Question 31

ARP is used to resolve 32-bit IP addresses into 48-bit local MAC addresses.

Question 32

In a smurf flood DoS attack, attackers can benefit from a multiplier effect because multiple ICMP requests are responded to by a single host.

Question 33

In a P2P attack, there is a change in the overall volume of traffic but the traffic pattern is the same.

Question 34

ARP is used to resolve 48-bit IP addresses into 32-bit local MAC addresses.

Question 35

________ is a good option if an attack is aimed at a single server because it keeps transmission lines at least partially open for other communication.

A) Rate limiting
B) False open
C) Black holing
D) None of the above

Question 36

A firewall does note set aside resources for a connection when a SYN segment arrives, so handling a large number of false SYN segments is only a small burden.

Question 37

Rerouting traffic using ARP poisoning is an attack on ________ of a network.

A) functionality
B) confidentiality
C) Both A and B
D) None of the above

Question 38

In normal ARP traffic, every host can make ARP requests.

Question 39

In a smurf flood DoS attack, attackers can benefit from a multiplier effect because a single ICMP request is responded to by multiple hosts.

Question 40

In normal ARP traffic, generally an attacker on the same network cannot see traffic between two hosts.

Question 41

In a MITM attack, access to the local network is not required in order to work.

Question 42

Which of the following is a benefit of using a central authentication server in 802.1X?

A) Reduced cost
B) Consistency in authentication
C) Immediacy in access control changes
D) All of the above

Question 43

Access control is more of a problem for wired LANs than for wireless LANs.

Question 44

An EAP failure message is sent to the ________.

A) authentication server
B) authenticator
C) client
D) Any of the above

Question 45

In 802.1X, the heavy authentication work is done on ________.

A) authenticators
B) clients
C) Both A and B
D) Neither A nor B

Question 46

The authenticator is the ________.

A) workgroup switch
B) central authentication server
C) client
D) None of the above

Question 47

When a new EAP authentication is added, software does not have to be changed on the ________.

A) client
B) authenticator
C) central authentication server
D) No software has to be changed on ANY device

Question 48

An EAP message begins with an ________ message.

A) EAP request
B) EAP accept
C) EAP start
D) EAP response

Question 49

________ is/are effective method(s) to preventing ARP poisoning attacks.

A) Static tables
B) Limiting local access
C) Both A and B
D) Neither A nor B

Question 50

Eavesdropping usually is more of a concern for ________ LANs than for ________ LANs.

A) wired, wireless
B) wireless, wired
C) about an equal concern for wired and wireless LANs
D) None of the above

Question 51

EAP uses RADIUS for authentication.

Question 52

________ is called Port-Based Access Control.

A) 802.11i
B) 802.1X
C) Both A and B
D) Neither A nor B

Question 53

Most central authentication servers are governed by the ________ standard.

A) EAP
B) RADIUS
C) IPsec
D) 802.1X

Question 54

When a new EAP authentication is added, software has to be changed on the ________.

A) authenticator
B) central authentication server
C) Both A and B
D) Neither A nor B

Question 55

The main access threat to 802.11 wireless LANs is an attacker plugging into a wall jack.

Question 56

________ is used by ________ for authentication.

A) EAP, RADUS
B) RADIUS, EAP
C) Both A and B
D) Neither A nor B

Question 57

An EAP response message may contain ________.

A) a request for a different authentication mechanism
B) a negative acknowledgement
C) Both A and B
D) Neither A nor B

Question 58

The 802.1X protocol created for wired LANs can work in wireless LANs without significant modification.

Question 59

The 802.11 standards were developed by the IEEE 802.11 Working Group.

Question 60

Traditionally, Ethernet LANs offered no access security.

Question 61

Rogue access points are unauthorized access points set up by individuals or departments.

Question 62

A ________ can be used to gather network information or user data.

A) RFMON
B) packet sniffer
C) whaling device
D) None of the above

Question 63

The most common attack against a wireless network is a ________.

A) man-in-the-middle attack using an evil twin
B) wireless DOS attacks
C) unauthorized network access
D) None of the above

Question 64

Which of the following is an example of a wireless attack?

A) Unauthorized network access
B) Man-in-the-middle attack using an evil twin
C) Wireless DOS attacks
D) All of the above

Question 65

Open networks can be legally accessed by anyone and are frequently posted as such.

Question 66

In a man-in-the-middle attack, ________.

A) an evil twin must have a stronger signal than the legitimate AP
B) an evil twin sends own attacks, impersonating the victim
C) Both A and B
D) Neither A nor B

Question 67

Flooding the frequency of a wireless network is one method attackers use to affect the network.

Question 68

The most common attack against a wireless network is a wireless DoS attack.

Question 69

In a man-in-the-middle attack, an evil twin sends own attacks, impersonating the victim.

Question 70

Wireless attacks avoid the access points to limit detection.

Question 71

Secure wireless networks can be legally accessed by anyone and are frequently posted as such.

Question 72

Evil twin access point attacks are most common in ________.

A) secure WLANs
B) public hotspots
C) wired connected networks
D) None of the above

Question 73

Wireless 802.11 networks generally have a range of ________.

A) 5 to 10 meters
B) 10 to 30 meters
C) 15 to 45 meters
D) None of the above

Question 74

A network administrator notices extensive damage to wireless packets. This might indicate a ________ attack.

A) man-in-the-middle
B) SYN/ACK
C) DoS flood attack
D) None of the above

Question 75

Rogue access points are authorized access points set up by individuals or departments.

Question 76

WLAN DoS attacks are designed to affect the ________ of the network.

A) confidentiality
B) integrity
C) availability
D) authentication

Question 77

Focusing electronic attacks on specific high-value targets is known as whaling.

Question 78

After gaining wireless access to the private network, the attach can ________.

A) cause harm to internal clients
B) steal data
C) launch external attacks
D) All of the above

Question 79

Focusing electronic attacks on specific high-value targets is known as promiscuous attacks.

Question 80

By giving unauthorized users access to a local WLAN means that they are on the local network.