Deck 10: Security in Network Design

Question 1

 What kind of firewall can block designated types of traffic based on application data contained within packets?

A) stateful firewall
B) stateless firewall
C) content-filtering firewall
D) packet-filtering firewall

Answer 1

C

Question 2

 Which of the following is an example of proxy server software?

A) Squid
B) BIND
C) Snort
D) Apache

Answer 2

A

Question 3

 Of the three methods of access control (RBAC, DAC, and MAC), RBAC is the least secure of the options.

Answer 3

False

Question 4

 The storm-control command is a type of flood guard that is available on most major network switch vendor platforms.

Question 5

 On a Linux system, which command allows you to modify settings used by the built-in packet filtering firewall?

A) ipf
B) modfire
C) iptables
D) netwall

Question 6

 When utilizing Kerberos, an access granting ticket is the same as a key.

Question 7

 You have been tasked with the configuration of a Juniper switch, and have been told to restrict the number of MAC addresses allowed in the MAC address table. What command should you use?

A) set max-mac
B) set total-macs
C) mac-address limit
D) mac-limit

Question 8

 What is a SIEM (Security Information and Event Management) system utilized for?

A) It is an advanced intrusion protection system with a GUI-frontend.
B) It is a system used to evaluate data from security devices and generate alerts.
C) It is an intellectual property protection software that prevents data links, and generates alerts.
D) It is a system that monitors security device hardware availability.

Question 9

 In order to prevent ports that are serving network hosts from being considered as best paths, what should be enabled to block BPDUs?

A) BPDU filter
B) BPDU guard
C) root guard
D) BPDU drop

Question 10

 When using Spanning Tree Protocol, what is the first step in selecting paths through a network?

A) STP must first select the root bridge, or master bridge.
B) STP examines the possible paths between all other bridges.
C) STP disables links that are not part of a shortest path.
D) STP begins to block BPDUs on non-designated ports.

Question 11

 The PEAP standard creates an encrypted TLS tunnel between the supplicant and the server before proceeding with the usual EAP process.

Question 12

 By default, Active Directory is configured to use the Kerberos protocol, but can be configured to use LDAP or a combination of LDAP and Kerberos.

Question 13

 What is NOT a variable that an network access control list can filter traffic with?

A) The Network layer protocol used for the packet.
B) The Transport layer protocol used for the packet.
C) The source or destination TCP/UDP port number in the packet.
D) The operating system used by the source or destination device.

Question 14

 A stateless firewall inspects each incoming packet to determine whether it belongs to a currently active connection.

Question 15

 In ACL statements, using the "any" keyword is equivalent to using a wildcard mask of what value?

A) 0.0.0.0
B) 255.255.255.255
C) 255.255.0.0
D) 0.0.255.255

Question 16

 The supplicant is an EAP entity responsible for requesting authentication, such as a smartphone or laptop.

Question 17

 The Spanning Tree Protocol operates at the Network layer of the OSI model.

Question 18

 Proxy servers and ACLs on network devices are examples of non-security devices with security features, while firewalls and IDS/IPS systems are the network's specialized security devices.

Question 19

 Which protocol designed to replace STP operates at Layer 3 of the OSI model?

A) Rapid Spanning Tree Protocol (RSTP)
B) Transparent Interconnection of Lots of Links (TRILL)
C) Shortest Path Bridging (SPB)
D) Multiple Spanning Tree Protocol (MSTP)

Question 20

 User access to network resources falls into one of these two categories: 1) the privilege or right to execute, install, and uninstall software, and 2) permission to read, modify, create, or delete data files and folders.

Question 21

 What descendant of the Spanning Tree Protocol is defined by the IEEE 802.1W standard, and can detect as well as correct for link failures in milliseconds?

A) Transparent Interconnection of Lots of Links (TRILL)
B) Shortest Path Bridging (SPB)
C) Rapid Spanning Tree Protocol (RSTP)
D) Multiple Spanning Tree Protocol (MSTP)

Question 22

 Enforcing a virtual security perimeter using a client's geographic location is known by what term?

A) geohashing
B) geofencing
C) geolocating
D) geolocking

Question 23

 The Group Policy utility can be opened by typing what name into a Run box?

A) secpol.msc
B) gpedit.msc
C) grouppol.msc
D) grppol.msc

Question 24

 What scenario might be ideal for the use of root guard in configuring a switch?

A) You wish to block BPDUs on an access port serving network hosts.
B) You wish to disable STP on a port connected to a partnered company's switch.
C) You wish to prevent switches beyond a certain port from becoming the root bridge, but still wish to use STP.
D) You wish to prevent a rogue switch or computer from hijacking the network's STP paths.

Question 25

 What aspect of AAA is responsible for determining what a user can and cannot do with network resources?

A) authentication
B) authorization
C) accounting
D) accessibility

Question 26

 You have been asked by your superior to configure all Cisco network switches to allow only acceptable MAC addresses through switch access ports. How is this accomplished?

A) Use the switchport port-security command to enable MAC filtering.
B) Use the mac-limit command to prevent more than one MAC from being accepted.
C) Use the allowed-mac command to filter by MAC address.
D) Use the secure port mac-address command to limit the port to learned addresses only.

Question 27

 When using a host-based intrusion detection system, what additional feature might be available to alert the system of any changes made to files that shouldn't change?

A) file integrity monitoring (FIM)
B) file change management (FCM)
C) file access auditing (FAA)
D) file checksum watching (FCW)

Question 28

 What IEEE standard includes an encryption key generation and management scheme known as TKIP?

A) 802.11i
B) 802.11h
C) 802.1X
D) 802.11j

Question 29

 What statement regarding role-based access control is accurate?

A) RBAC allows a network administrator to base privileges and permissions around a detailed description of a user's roles or jobs.
B) RBAC allows users to decide for themselves who has access to that user's resources.
C) RBAC organizes resources into hierarchical classifications, such as "confidential" or "top secret".
D) RBAC is the most restrictive method of access control.

Question 30

 By far the most popular AAA service, what open-source service runs in the Application layer and can use UDP or TCP in the Transport layer?

A) Google Authenticator
B) RADIUS
C) TACACS+
D) Kerberos

Question 31

 When using Spanning Tree Protocol, which port on non-root bridges can forward traffic toward the root bridge?

A) Only one root port, which is the bridge's port that is closest to the root bridge, can forward.
B) Only one root port, which is the bridge's port that is furthest from the root bridge, can forward.
C) All ports can forward frames to the root bridge, provided they are not in a down state.
D) All ports will forward frames to the root bridge, unless a BPDU is received back on that same port.

Question 32

 In Open System Authentication, how does authentication occur?

A) The client sends a pre-shared key along with the access point's SSID.
B) The client requests an encrypted tunnel, after which, the client's MAC serves as the authentication.
C) The access point forces the client to authenticate via a captive portal, after which all communication is encrypted.
D) The client "authenticates" using only the SSID name. In other words, no real authentication occurs.

Question 33

 The Wired Equivalent Privacy standard had what significant disadvantage?

A) It did not allow the use of a password for access to the network.
B) It provided no encryption for traffic sent over the air.
C) It used a shared encryption key for all clients, and the key might never change.
D) It only encrypted the initial connection authentication, but did not encrypt subsequent traffic.

Question 34

 What statement correctly describes a stateless firewall?

A) A stateless firewall manages each incoming packet as a stand-alone entity, without regard to currently active connections.
B) A stateless firewall inspects each incoming packet to determine whether it belongs to a currently active connection.
C) A stateless firewall blocks designated types of traffic based on application data contained within packets.
D) A stateless firewall filters packets based on source and destination IP addresses.

Question 35

 Which of the following terms is used to describe the configuration of a port to copy all traffic passing through the switch to the device at the other end of the port?

A) port supertrunking
B) port mirroring
C) port shadowing
D) port lurking

Question 36

 Which legacy authentication protocol requires mutual authentication?

A) Password Authentication Protocol (PAP)
B) Challenge Handshake Authentication Protocol (CHAP)
C) Microsoft Challenge Handshake Authentication Protocol (MS-CHAP)
D) Microsoft Challenge Handshake Authentication Protocol, version 2 (MS-CHAPv2)

Question 37

 In regards to the use of local authentication, what statement is accurate?

A) Local authentication provides the most security.
B) Local authentication is scalable for large networks.
C) Local authentication is network and server failure tolerant.
D) Local authentication does not allow for strong enough passwords.

Question 38

 When using Kerberos, what is the purpose of a ticket?

A) It is the name for a Kerberos client or user.
B) It is a key used by the client to gain access to services that are protected by the key on the network.
C) It is a temporary set of credentials that a client uses to prove to other servers that its identity has been validated.
D) It is the event that is generated when auditing a resource and unauthorized access is attempted.

Question 39

 Which adaptation of EAP utilizes EAP

A) EAP-TLS
B) Protected EAP (PEAP)
C) EAP-FAST
D) LEAP

Question 40

 Which encryption standard was originally utilized with WPA's TKIP?

A) Advanced Encryption Standard (AES)
B) Rivest Cipher 4 (RC4)
C) Blowfish
D) Data Encryption Standard (DES)

Question 41

 How does a reverse proxy differ from a normal proxy?

Question 42

 What are the three components required to manage access control to a network and its resources?

Question 43

 What is the difference between an Intrusion Detection System and an Intrusion Protection System?

Question 44

 How does the CCMP help ensure data confidentiality?

Question 45

 In a network access control (NAC) system, what are the two different types of software agents that are commonly used?

Question 46

 If your LAN utilizes a proxy server, and you wish to send an email message from your workstation inside the LAN to a colleague via the Internet, what does this process look like?

Question 47

 What is multifactor authentication, and what are some examples?

Question 48

 Describe the TACACS+ AAA protocol, and detail how it differs from RADIUS.

Question 49

 What is the purpose of Unified Threat Management (UTM)?

Question 50

 How does the Remote Authentication Dial-In User Service (RADIUS) function?