ITN 263 Midterm Exam | Questions and Answers (Complete Solutions)

ITN 263 Midterm Exam | Questions and Answers (Complete Solutions) Who performs penetration testing? ethical hackers Which type of backup solution typically stores your data on another organization's hardware, making you dependent on their security, confidentiality assurance, and reliability? Cloud An Access Control List (ACL) is an example of which of the following? logical security A security assessment may include which of the following steps? perform a risk assessment perform penetration testing perform vulnerability scanning Which of the following is a method of trapping hackers and detecting new attacks? Honeypot What is not an example of containment during incident response? confirming a breach Which of the following is an example of multi-factor authentication? Choose the best answer. a user accesses the server (login) with a username, password, and RSA token card The best practice of 'use default deny over default permit' can be applied to which of the following system? Choose the best answer. Firewalls What is the purpose of the post-mortem review after a security assessment? learn from mistakes What is another form of a honeypot? padded cell Isolating and compartmentalizing administrative privileges, so that no single administrator has full or total power over the entire environment, is an example of __________. separation of duties Window locks, door locks, and security cameras are examples of which of the following? physical security One of the most effective preventative techniques in network security troubleshooting is __________. installing patches and updates Assigning users, including administrators, only the necessary privileges, access, and permissions to accomplish their assigned work is an example of __________. principle of least privilege Which of the following is an example of multi-factor authentication? choose the best answer. a bank ATM card and a pin number Which of the following must an administrator organize to ensure follow-through of a new security plan? end-user training and awareness Which of the following is not a network security management best practice? implement single-factor authentication Which of the following could compromise network security? simplify by assigning maximum required permissions Giving network users enough permissions to do their job is an example of , is an example of __________. least privilege What is a potential disadvantage of online data backups? dependency on provider's security Which of the following helps avoid single points of failure by building in multiple elements, pathways, or methods of accomplishing mission-critical tasks? Redundancy Using a fingerprint to unlock a workstation is an example of which of the following? something you are Which entity is responsible for global coordination of IP addressing? Internet Assigned Numbers Authority (IANA) What is accomplished with IP addressing? Traffic management through routing Traffic filtering Hardening is the process of reducing the _________ of a potential target by removing unnecessary components and adding protections. attack surface Which of the following is the best reason you might switch from IPv4 to IPv6 as your primary network protocol? Security Which IT domain marks the boundary where the private network meets the public network? LAN-to-WAN domain Uninstalling all unnecessary applications and services on a user system is an example of system hardening. In which IT domain is client system hardening typically applied? Workstation Domain Logging the time a user accessed a particular resource is an example of which of the following? Accounting What employs routing protocols to exchange information about routes and connected pathways? This information calculates the best path to guide a packet towards its destination. Router The address range 192.168.0.0-192.168.255.255/16 is an example of which of the following? Class C What is defined as any device on a network, even those without an IP address? Node Bus, tree, and mesh are types of __________. network topologies Why might you develop an acceptable use policy? to establish network usage rules When selecting networking equipment, which of the following is not a desirable feature from a security perspective? easy power switch The principle of least privilege is often a good guideline as to appropriate ___________ settings. authorization Staying offline and only using trusted communication pathways is an example of which of the following? security through obscurity _____________ is the act of avoiding single points of failure by building in multiple elements, pathways, or methods of accomplishing each mission-critical task. Redundancy An IT environment with a bastion host, an intrusion prevention system, and workstation antivirus and firewall software is an example of _____________. defense in depth Encryption is primarily concerned with which of the following primary objective(s)? integrity and confidentiality A person receives a phishing e-mail, clicks the link in the e-mail (without understanding the risks), and is directed to a malicious Web site. The site downloads and installs a Trojan horse program and keystroke logger on the user's computer without the user's knowledge. What type of attack has occurred? cross-site scripting A hacker captures and retransmits authentication packets against the same server in order to gain interactive or session access to a system. This describes which type of attack? Replay In which type of attack does the hacker fool clients into initiating sessions with the hacker's computer instead of the target server? man in the middle Which of the following attacks must take maximum transmission units (MTUs) into account? Fragmentation A hacker eavesdrops on a session to learn details, such as the addresses of the session endpoints and the sequencing numbers. With this information, the hacker desynchronizes the client, takes on the client's addresses, and then injects crafted packets into the data stream. Which type of attack is being described? Hijacking A ________ attack occurs when a hacker intervenes in a communication session between a client and a server. The attack usually involves fooling or tricking the client into initiating the session with the hacker's computer instead of with the intended server. man-in-the-middle Which of the following is effective against traffic generation DoS attacks? traffic filtering What is a type of social engineering technique? impersonation creating urgency A hacker posing as a contract IT consultant tricks an employee into stating his network user name and password. Which type of attack is being described? social engineering Any host that uses TCP/IP without encryption is vulnerable to ____________. session hijacking Which IT domain is most vulnerable to social engineering? User domain A ________ is a mechanism of distribution or delivery more than a specific type of malware. Trojan What is usually the first activity in the hacking process? Reconnaissance During which phase of the hacking process does footprinting take place? Reconnaissance An attack is composed of four packets: A, B, C, and D. The IDS signature is a packet stream of ABCD. The hacker transmits the attack as AXBCYD, where X and Y are invalid packets. The IDS doesn't recognize the pattern, and the target discards X and Y, enabling the ABCD attack to occur. Which type of attack has been described? Insertion What type of attack can result in arbitrary code execution with system-level privileges? buffer overflow From the perspective of a hacker, what is a primary difference between wired and wireless networks? the hacker doesn't have to be physically close to a wireless network to launch an attack Which of the following is not a common hacking tool countermeasure? creating an acceptable user policy SQL injection is considered to be which type of attack? Insertion During which phase of the hacking process does war dialing, war driving, or ping sweeps take place? Scanning Which of the following is a VPN device model that's best suited for business partners? edge router Which of the following is not true of a secure VPN? addressing and routing performed within the trusted VPN must be defined after the VPN goes online For what reason might you use an optical carrier (OC) line for a VPN rather than the Internet? High speed Which of the following is generally not a benefit of VPNs? quality of service When selecting a strong symmetric cryptography algorithm, which of the following is not a desirable feature? short key length What is a feature of hashing? creates a fixed-length output from a file or message What does asymmetric cryptography provide? authenticity non-repudiation Which aspect of a VPN prevents others from eavesdropping and observation? cryptographic functions Which of the following is a secure VPN protocol? IPSec Which of the following is a common drawback of VPNs? Speed In asymmetric cryptography, what does a digital signature accomplish? proves the identity of the sender What is an advantage of VPN tunnel mode? encapsulates protocol headers and packet payloads What is a benefit of implementing a VPN? establish remote network access Which type of VPN architecture supports secure connections between LANs over intermediary public networks? site-to-site Which of the following is not a common VPN device model? Switch Which layer of the OSI reference model handles logical addressing (IP addresses) and routing traffic? Network What type of firewall keeps track of state tables to filter network traffic? stateful packet inspection _______ translates internal addresses into external addresses. network address translation (NAT) Which of the following is generally not protected by a firewall? USB flash drive When performing a risk assessment, what is the amount of potential loss that can be experienced due to any compromise of an asset for a specific threat within a year? Annualized loss expectancy (ALE) What is a network component that filters traffic between nodes? Firewall Which layer of the OSI reference model manages physical addressing (MAC addresses) and supports the network topology, such as Ethernet? data link When performing a risk assessment, how do you calculate a potential cost/benefit? (Original ALE - New ALE) - cost of the countermeasure per year You are analyzing a risk and have determined that the SLE is $1,000 and the ARO is 5. What is the ALE? $5,000 A _________ is any segment, subnet, network, or collection of networks that represent a certain level of risk. zone of risk What is a primary benefit of a multi-homed firewall? isolation of subnets What can a firewall provide that is a form of static reversal of network translation? port forwarding What can a stateful firewall accomplish by filtering network packets? prevent malware infection Which of the following is a problem for static filtering? large, unordered rule sets Which of the following is a typical function of a network firewall? traffic filtering You have a firewall between a programming group's network and the production network. What is the best option to enable on the firewall to prevent unapproved versions of software from leaking out? content filtering Which firewall is able to protect only a single host from malicious network activity? Software What does an application proxy do? examines packet payloads When performing a risk assessment, what is the amount of potential harm from a threat, expressed as a percentage? exposure factor (EF) Which of the following does not apply to stateful firewalls? analyzes both static and real-time data From the perspective of computers and networks, _________ is confidence that other users will act in accordance with your organization's security rules. Trust _______________ is the process of securing or locking down a host against threats and attacks. Hardening You are filtering MAC addresses on a switch by blocking only specific IP addresses. What do you use to perform this type of filtering? black list Which IT domain includes demilitarized zones (DMZs) and intrusion detection systems (IDS)? LAN-to-WAN domain ______ __________ ____________ allows an attacker to eavesdrop on electronic devices from a distance. The technique is of perfect or simple to perform, but has been demonstrated on LCD and CRT monitors as well as keyboard cables. With minor shielding, you can eliminate most of the risk from such an attack. Van Eck Phreaking You can filter which type of traffic on a typical firewall? both ingress and egress A ___________ is either a hardware device or a software product you deploy to enforce the access control policy on network communications. Firewall Which of the following do you not get with network address translation (NAT)? a static public IP address for each internal client Which of the following has the ultimate and final responsibility for network security in an organization? senior management Which of the following is not a primary objective of information security? Privacy Which private address range is 172.16.0.0-172.31.255.255 /12? Class B Which of the following is not a distinguishing characteristic of a WAN compared to a LAN? Has a limited geographic area Which IT domain in a typical IT infrastructure typically includes routers, circuits, switches, firewalls, and equivalent gear at remote locations? WAN domain _____ ________ __________are new and previously unknown attacks for which no current specific defenses exist. zero day exploits Which of the following enables you to check a client computer for compliance with security policies and either grant or deny its access to the internal network? Network access control A _________ is a boundary network that hosts resource servers for the public Internet. DMZ What does a client/server environment have that a peer-to-peer networking environment typically does not? Server _______ resolves FQDNs into the associated IP address. [hint 3 letters abbreviation] DNS Security ________ are goals an organization strives to achieve through its security efforts. Objectives The lack of ____________ is both a strength and weakness of workgroups. central authority Deciding which firewall rules to define is subject to an organization's _____________. security policy Which type of firewall commonly uses inbound rules? DMZ Firewall What is an access control list (ACL)? a firewall rule or filter Which firewall limitation is typically characterized by a memory-based exploit? buffer overflow Which of the following is the best method of determining an optimal firewall configuration? test the rules in a laboratory environment Regarding firewall rules, what is another name for default deny? deny all What is the primary purpose of log monitoring? detect malicious network activities ___________ is the process of verifying the identity of an electronic entity. Authentication Which of the following is a centralized logging system? Syslog In which situation is a change control system most effective? Troubleshooting What is an important thing to do regarding firewall logs?