Question 1

Single sign-on (SSO)allows a user to do which of the following?

Accepted Answer

A)   Access all authorized services and systems.
B)   Access just email, with only one login per week.
C)   Administrator access to all services and systems.
D)   None of the above is correct. A

Question 2

An attacker to a network is using social engineering to attack a network.This means which of the following? (Select all that apply.)

Accepted Answer

A)  The attacker claims to be from network support.
B)  The attacker is sifting through discarded trash.
C)  The attacker uses a dictionary attack.
D)  The attacker uses packet sniffing. A, B

Question 3

The network management is concerned about intrusion problems.The network administrator recommends intrusion detection be placed on the network.This will do which of the following? (Select all that apply.)

Accepted Answer

A)  This system will provide IP address information of all possible threats in the network.
B)  This system will monitor data packets passing through the network and identify potential attacks.
C)  This system will cut down any unnecessary TCP data traffic and convert it to UDP.
D)  This system will potentially catch ongoing attacks. B, D

Question 4

What technology or technologies use the AAA protocol framework?

Accepted Answer

A)   RADIUS
B)   TACACS+
C)   Both RADIUS and TACACS+
D)   Neither RADIUS nor TACACS+

Question 5

A user who can view a network file but cannot change it lacks which of the following?

Accepted Answer

A)   Authorization
B)   Authentication
C)   Accounting
D)   Access

Question 6

What wireless security technology replaces WEP as the main security mechanism?

Accepted Answer

A)  WPA
B)  WEP2
C)  SSID
D)  MACSEC

Question 7

What ACL entry would eliminate the effect of the implicit deny?

Accepted Answer

A)  permit ip any any
B)  permit all
C)  permit any
D)  permit traffic all

Question 8

A dictionary attack is being used by an attacker to break into a network.What does this mean?

Accepted Answer

A)  The attacker is using a secret list of code words.
B)  The attacker is using only uppercase letters for common words.
C)  The attacker is using only lowercase letter for unknown words.
D)  The attacker is using known passwords and many variations of upper- and lowercase combinations.
E)  All of these answers are correct.

Question 9

Authentication methods are based on _______.

Accepted Answer

A)   Something you have
B)   Something you want
C)   Someone you know
D)   None of the above

Question 10

Which is not a stage of forensics examination?

Accepted Answer

A)  Review
B)  Analysis
C)  Containment
D)  Collection

Question 11

The network administrator suspects that packet sniffing is being used to capture data packets in the network.The network administrator is using an SSH connection for all critical applications,and switches are being used on all network connections.Should the network administrator be concerned?

Accepted Answer

A)  No, the SSH connection is fully encrypted and this cannot be decoded.
B)  Yes, the SSH connection is not very strong and parts are in plain text.
C)  No, the time required to decode the SSH is too lengthy to be a threat.
D)  Yes, the network administrator should be concerned if someone is suspected of having internal access.

Question 12

There is a new virus reported on the Internet.What steps should the network administrator take to protect the network from the threat?

Accepted Answer

A)  Convert all operating systems to Linux.
B)  Make sure antivirus software is installed with the most current version.
C)  Use a personal firewall.
D)  Use firewall software that permits only trusted sites.

Question 13

What is the name for the process of keeping track of user network activity?

Accepted Answer

A)   Network accounting
B)   Net-logging
C)   Sys-logging
D)   Net-tracking

Question 14

A network administrator is considering placing a firewall on an internal file server in the network.What is the purpose of the firewall,and is it important for the firewall to be stateful?

Accepted Answer

A)  The purpose of the firewall is to hide the file server from the outside but still allow traffic to pass to the outside and back. The firewall must be stateful so that it keeps track of data packet flow.
B)  The purpose of the firewall is to protect the file server from the outside but still allow traffic to pass to the outside and back. The firewall should not be stateful unless the file server is not secure.
C)  The purpose of the firewall is to protect the file server from the outside but still allow traffic to pass to the outside and back. The firewall must be stateful so that it keeps track of data packet flow.
D)  The purpose of the firewall is to hide the file server from the inside but allow traffic to pass to the outside. The firewall must be stateful so that it keeps track of data packet flow.

Question 15

The network administrator configures a VPN tunnel from a remote office to the main facility.A problem has occurred in the link.Which are the main steps the administrator should take to resolve the problem? (Select all that apply.)

Accepted Answer

A)  Check the source and destination IP address of the tunnel configured on the router.
B)  Make sure the IP addresses on the ends of the tunnel are not in the same subnet.
C)  Make sure the IP addresses on the ends of the tunnel are in the same subnet.
D)  Use the show access-list command to verify the routers are properly configured.

Question 16

When would a network administrator use L2TP?

Accepted Answer

A)  When configuring routing for a network
B)  When configuring a remote user's tunneling protocol
C)  To block ICMP packets from coming into a network
D)  To help with packet filtering

Question 17

Which of the following is a Linux-based port scanner that is now ported to most all operating systems?

Accepted Answer

A)  SNMP
B)  TRACE
C)  NMAP
D)  ICMP

Question 18

A network administrator is concerned that the network is vulnerable to a denial-of-service attack.What steps should be taken to reduce this threat? (Select all that apply.)

Accepted Answer

A)  Use access lists to allow only sources from the network to enter the router's interfaces.
B)  Set up a spoofing account so that the attacker doesn't know which machine to attack.
C)  There isn't a way to reduce this threat.
D)  Configure the router to block directed broadcasts to the network.
E)  Prevent intrusions.

Question 19

Network operations documentation includes which of the following?

Accepted Answer

A)   Asset management
B)   Network drawings and diagrams
C)   Vendor documentation
D)   All of the above

Question 20

Where might you place servers that require access from the public network?

Accepted Answer

A)  A test lab
B)  A safe zone
C)  A DMZ
D)  A protected hub

Exam 12: Network Security

Single sign-on (SSO) allows a user to do which of the following?