Quiz
Midterm review Chapters 1-5
Fragen in diesem Quiz (176)
1Which of the following is the best definition for war-driving?
- ADriving and seeking rival hackers
- BDriving while hacking and seeking a computer job
- CDriving looking for wireless networks to hack
- DDriving while using a wireless connection to hack
2In addition to mandating federal agencies to establish security measures, the Computer Security Act of 1987 defined important terms such as:
- Asecurity information
- Bprivate information
- Cunauthorized access
- Dsensitive information
3What are the three approaches to security?
- AHigh security, medium security, and low security
- BPerimeter, layered, and hybrid
- CInternal, external, and hybrid
- DPerimeter, complete, and none
4An attack characterized by an explicit attempt by attackers to prevent legitimate users from accessing a system is called:
- Awar-dialing
- Bspoofing
- Cdenial of service
- Dsocial engineering
5The first computer incident response team is affiliated with what university?
- AHarvard University
- BPrinceton
- CCarnegie-Mellon University
- DYale
6The process of reviewing logs, records, and procedures to determine whether they meet appropriate standards is called:
- Aauditing
- Bfiltering
- Cauthenticating
- Dsneaking
7Which of the following best defines the primary difference between a sneaker and an auditor?
- AThere is no difference
- BThe sneaker tends to be less skilled
- CThe sneaker tends to use more unconventional methods
- DThe auditor tends to be less skilled
8Which of the following types of privacy laws affect computer security?
- AAny privacy law applicable to your organization
- BAny privacy law
- CAny federal privacy law
- DAny state privacy law
9An intrusion-detection system is an example of:
- AProactive security
- BPerimeter security
- CGood security practices
- DHybrid security
10Which of the following is the best definition of “sensitive information”?
- AAny information that is worth more than $1,000
- BAny information that has monetary value and is protected by any privacy laws
- CAny information that, if accessed by unauthorized personnel, could damage your organization in any way
- DMilitary or defense related information
11Which of the following maintains a repository for information on virus outbreaks and detailed information about specific viruses?
- AF-Secure Corporation
- BCERT
- CSANS Institute
- DMicrosoft Security Advisor
12Which is a technique used to provide false information about data packets?
- APhreaking
- BSocial engineering
- CHacking
- DSpoofing
13What is the term for hacking a phone system?
- Aphreaking
- BCracking
- CHacking
- DTelco-hacking
14Which is NOT one of the three broad classes of security threats?
- APreventing or blocking access to a system
- BGaining unauthorized access into a system
- CMalicious software
- DDisclosing contents of private networks
15Are there any reasons not to take an extreme view of security, if that view errs on the side of caution?
- ANo, there is no reason not to take such an extreme view.
- BYes, if you are going to err, assume there are few if any realistic threats.
- CYes, that can lead to wasting resources on threats that are not likely.
- DYes, that can require that you increase your security skills in order to implement more rigorous defenses.
16A text file that is downloaded to a computer by a Web site to provide information about the Web site and online access is called a:
- Acookie
- BTrojan horse
- Cscript kiddy
- Dkey logger
17Which of the following is the most basic security activity?
- AInstalling a firewall
- BControlling access to resources
- CAuthenticating users
- DUsing a virus scanner
18Which of the following is NOT a connectivity device used to connect machines on a network?
- ANetwork interface card
- BHub
- CProxy server
- DSwitch
19The process of determining whether the credentials given by a user are authorized to access a particular network resource is called:
- Aauditing
- Baccessing
- Cauthorization
- Dauthentication
20Which approach to security is proactive in addressing potential threats before they occur?
- ALayered security approach
- BPassive security approach
- CDynamic security approach
- DHybrid security approach
21Those who exploit systems for harm such as to erase files, change data, or deface Web sites are typically called:
- Agray hat hackers
- Bblack hat hackers
- Cwhite hat hackers
- Dred hat hackers
22Encryption and virtual private networks are techniques used to secure which of the following?
- AConnection points
- BData
- CFirewalls
- DProxy servers
23Which of the following is the best definition for the term sneaker?
- AAn amateur hacker
- BA person who hacks a system to test its vulnerabilities
- CA person who hacks a system by faking a legitimate password
- DAn amateur who hacks a system without being caught
24Which of the following is not one of the three major classes of threats?
- AOnline auction fraud
- BDenial of Service attacks
- CA computer virus or worm
- DActually intruding on a system
25Which is NOT one of the three broad classes of security threats?
- ADisclosing contents of private networks
- BMalicious software
- CPreventing or blocking access to a system
- DGaining unauthorized access into a system
26What is a computer virus?
- AAny program that can change your Windows registry.
- BAny program that self replicates
- CAny program that causes harm to your system
- DAny program that is downloaded to your system without your permission
27When assessing threats to a system, what three factors should you consider?
- AHow much traffic the system gets, the security budget, and the skill level of the security team
- BThe system’s attractiveness, the information contained on the system, and how much traffic the system gets
- CThe skill level of the security team, the system’s attractiveness, and how much traffic the system gets
- DThe system’s attractiveness, the information contained on the system, and the security budget
28Which of the following would most likely be classified as misuses of systems?
- AUsing your business computer to conduct your own (non-company) business
- BGetting an occasional personal email
- CLooking up information on a competitor using the Web
- DShopping on the web during lunch
29What is a technique used to determine if someone is trying to falsely deny that they performed a particular action?
- ANon-repudiation
- BAccess Control Authorization
- CAudiiting
- DSneaking
30Which approach to security addresses both the system perimeter and individual systems within the network?
- APerimeter security approach
- BLayered security approach
- CHybrid aecurity approach
- DDynamic security approach
31Which of the following gives the best definition of spyware?
- AAny software that monitors which Web sites you visit
- BAny software or hardware that monitors your system
- CAny software that logs keystrokes
- DAny software used to gather intelligence
32Which of the following is the best definition for non-repudiation?
- AIt is another term for user authentication
- BProcesses that verify which user performs what action
- CSecurity that does not allow the potential intruder to deny his attack
- DAccess control
33Blocking attacks seek to accomplish what?
- APrevent legitimate users from accessing a system
- BBreaking into a target system
- CShut down security measures
- DInstall a virus on the target machine
34Which term is generally used by hackers to refer to attempts at intrusion into a system without permission and usually for malevolent purposes?
- ASocial engineering
- BBlocking
- CHacking
- DCracking
35The most desirable approach to security is one which is:
- ALayered and dynamic
- BPerimeter and static
- CLayered and static
- DPerimeter and dynamic
36Which of the following activities do security professionals recommend to limit the chances of becoming a target for a Trojan horse?
- APrevent employees from downloading and installing any programs
- BDownload and install Windows updates and patches monthly
- COnly open e-mail attachments from friends or co-workers
- DOnly download jokes, animated Flash files, or utility programs from popular sites
37Which method of defense against a SYN flood involves altering the response timeout?
- AMicro blocks
- BSYN cookies
- CRST cookies
- DStack tweaking
38Which created a buffer overflow attack against a Windows flaw called the DCOM RPC vulnerability?
- ABlaster
- BMyDoom
- CSoBig
- DSlammer
39What do many analysts believe was the reason for the MyDoom virus/worm?
- AA DoS attack against Microsoft.com
- BA DoS attack targeting Microsoft Windows IIS servers
- CAn e-mail attack targeting Bill Gates
- DA DDoS attack targeting Santa Cruz Operations
40Which is NOT true about a buffer overflow attack?
- ASusceptibility to a buffer overflow is entirely contingent on software flaws.
- BA hacker does not need a good working knowledge of some programming language to create a buffer overflow.
- CA buffer overflow can load malicious data into memory and run it on a target machine.
- DA careful programmer will write applications so the buffer will truncate or reject data that exceeds the buffer length.
41What is the name for a DoS defense that is dependent on sending back a hash code to the client?
- AServer reflection
- BRST cookie
- CStack tweaking
- DSYN cookie
42What is the best way to defend against a buffer overflow?
- AStopping all ICMP traffic
- BUsing a robust firewall
- CKeeping all software patched and updated
- DBlocking TCP packets at the router
43The spread of viruses can be minimized by all of the following EXCEPT:
- Ausing a code word with friends to determine if attachments are legitimate
- Busing a virus scanner
- Cimmediately following instructions in security alerts e-mailed to you from Microsoft
- Dnever opening attachments you are unsure of
44Which of the following is NOT a denial of service attack?
- APing of Death
- BSYN flood
- CSmurf attack
- DStack tweaking
45Which of the following is the best definition for IP spoofing?
- ASending packets that are misconfigured
- BSending a packet that appears to come from a trusted IP
- CSetting up a fake Web site that appears to be a different site
- DRerouting packets to a different IP
46Which attack relies on broadcast packets to cause a network to actually flood itself with ICMP packets?
- ASmurf attack
- BSYN flood
- CTribal flood
- DICMP flood
47Which attack occurs by sending packets that are too large for the target machine to handle?
- ASYN flood
- BICMP flood
- CPing of death
- DStack tweaking
48One of the most common types of attacks via the Internet is:
- ABuffer overflow
- BIP spoofing
- CSession hacking
- DDenial of service
49Which of the following virus attacks initiated a DoS attack?
- AWalachi
- BMyDoom
- CBagle
- DFaux
50Which router configuration is potentially least vulnerable to an attack?
- ARouters that filter packets with source addresses in the local domain
- BProxy firewalls where the proxy applications use the source IP address for authentication
- CRouters to external networks that support multiple internal interfaces
- DRouters with two interfaces that support subnetting on the internal network
51What is a technical weakness of the Stack tweaking defense?
- AIt only decreases time out but does not actually stop DoS attacks
- BIt is complicated and requires very skilled technicians to implement
- CIt is resource intensive and can degrade server performance.
- DIt is ineffective against DoS attacks
52Which created a domestic “cyber terrorism” attack against a Unix distributor?
- AMyDoom
- BW32.Storm.Worm
- CBlaster
- DSlammer
53What is the name for a DoS attack that causes machines on a network to initiate a DoS against one of that network’s servers?
- ASmurf attack
- BDistributed Denial of Service
- CSYN flood
- DPing of Death
54Which of the following would be the best defense if your Web server had limited resources but you needed a strong defense against DoS?
- AStack tweaking
- BA firewall
- CSYN cookies
- DRST cookies
55What was the greatest damage from the Bagle virus?
- AIt deleted system files
- BIt corrupted the Windows registry
- CIt was difficult to detect
- DIt shut down antivirus software
56How does the SYN cookie work?
- AReplaces cookies left by virus/worm programs.
- BCauses server to send wrong SYNACK to the client.
- CPrevents memory allocation until third part of SYN ACK handshaking.
- DEnables encryption of outbound packets.
57From the attacker’s point of view, what is the primary weakness in a DoS attack?
- AThe attack does not cause actual damage
- BThe attack must be sustained.
- CThe attack is difficult to execute
- DThe attack is easily thwarted
58Shutting down router and firewall ports 5554 and 9996 will block most damage from which of these?
- ASobig
- BTrojan horses
- CBagle
- DSasser
59Which attack causes Internet routers to attack the target systems without actually compromising the routers themselves?
- AICMP flood
- BSYN flood
- CTribal Flood Network
- DDistributed Reflection Denial of Service
60Which attack relies on broadcast packets to cause a network to actually flood itself with ICMP packets?
- ATribal flood
- BSYN flood
- CSmurf attack
- DICMP flood
61What DoS attack is based on leaving connections half open?
- ASYN flood
- BSmurf Attack
- CPing of Death
- DDistributed Denial of Service
62What is the best method of defending against IP spoofing?
- AInstalling a router/firewall that blocks packets that appear to be originating within the network
- BBlocking all incoming TCP traffic
- CBlocking all incoming ICMP traffic
- DInstalling a router/firewall that blocks packets that appear to be originating from outside the network
63Which of the following best describes session hacking?
- ATaking over a target machine via a Trojan horse
- BTaking control of the login session
- CTaking control of a target machine remotely
- DTaking control of the communication link between two machines
64Which of the following is a recommended configuration of your firewall to defend against DoS attacks?
- ABlock TCP packets that originate outside your network
- BBlock all incoming packets
- CBlock ICMP packets that originate outside your network
- DBlock all ICMP packets
65Which copies itself into the Windows directory and creates a registry key to load itself at startup?
- ASlammer
- BMyDoom
- CSasser
- DBagle
66Which presented itself as an e-mail from the system administrator informing the user of a virus infection and gave directions to open an e-mail attachment which would then scan for e-mail addresses and shared folders?
- ASobig
- BSasser
- CMinmail
- DBagle
67Which of the following best describes a buffer overflow attack?
- AAn attack that attempts to put misconfigured data into a memory buffer
- BAn attack that attempts to send oversized TCP packets
- CAn attack that attempts to put too much data in a memory buffer
- DAn attack that overflows the target with too many TCP packets
68What is a Trojan horse?
- ASoftware that deletes system files then infects other machines
- BSoftware that self replicates
- CSoftware that causes harm to your system
- DSoftware that appears to be benign but really has some malicious purpose
69Which of the following denial of service attacks results from a client’s failure to respond to the server’s reply to a request for connection?
- AICMP flood
- BSYN flood
- CTribal flood
- DUDP flood
70What is the danger inherent in IP spoofing attacks?
- AMany of these attacks open the door for other attacks
- BMany firewalls don’t examine packets that seem to come from within the network.
- CThey can be difficult to stop
- DThey are very damaging to target systems
71Which is NOT a typical adverse result of a virus?
- AIncreased network traffic
- BChanging system settings
- CIncreased network functionality and responsiveness
- DDeletion of files
72What type of firewall is Check Point Firewall-1?
- APacket filtering/application gateway hybrid
- BSPI/application gateway hybrid
- CCircuit level gateway
- DApplication gateway
73What implementation is Check Point Firewall-1?
- ASwitch based
- BHost based
- CNetwork based
- DRouter based
74Which is a hardware firewall vendor manufacturing Stateful Packet Inspection units with NAT and DES especially for small offices?
- ACisco
- BWolverine
- CD-Link
- DCheck Point
75Should a home user with ICF block port 80, and why or why not?
- AShe should not because it would prevent her from using Web Pages
- BShe should not because that will prevent her from getting updates and patches
- CShe should unless she is running a Web server on her machine.
- DShe should because port 80 is a common attack point for hackers
76Why is an SPI firewall more resistant to flooding attacks?
- AIt requires user authentication
- BIt examines each packet in the context of previous packets
- CIt automatically blocks large traffic from a single IP
- DIt examines the destination IP of all packets
77Snort is which type of IDS?
- AClient-based
- BRouter-based
- COS-based
- DHost-based
78Snort is which type of IDS?
- AClient-based
- BRouter-based
- COS-based
- DHost-based
79What is one complexity found in enterprise environements that is unlikely in small networks or SOHO environments?
- ADiverse user groups
- BWeb vulnerabilities
- CMultiple operating systems
- DUsers running different applications
80Which type of IDS is the Cisco Sensor?
- AAnomaly detection
- BIntrusion deterrence
- CIntrusion deflection
- DAnomaly deterrence
81It should be routine for someone in the IT security staff to
- APhysically inspect the firewall
- BReview firewall logs
- CReboot the firewall
- DTest the firewall by attempting a ping flood
82Using a server running the Linux operating system with its built-in firewall as the network firewall is one example of which firewall configuration?
- Arouter-based
- Bdual-homed host
- Cnetwork host-based
- Dscreened host
83What is an advantage of an enterprise environment?
- ASkilled technical personnel available
- BMultiple operating systems to deal with
- CIDS systems not needed
- DLower security needs
84Which is true about SonicWALL firewall solutions?
- AThey work on Linux, Unix, Solaris, and Windows platforms.
- BThey are relatively inexpensive.
- CAll models contain built-in encryption.
- DThey include built-in proxy server capabilities.
85In which mode of operation does Snort display a continuous stream of packet contents to the console?
- AHeuristic mode
- BNetwork intrusion-detection mode
- CPacket logger mode
- DPacket sniffer mode
86In comparing a packet filter firewall with a stateful packet inspection firewall (SPI), the SPI firewall is:
- ALESS susceptible to ping and SYN floods but MORE susceptible to IP spoofing
- BLESS susceptible to ping and SYN floods and LESS susceptible to IP spoofing.
- CMORE susceptible to ping and SYN floods and MORE susceptible to IP spoofing
- DMORE susceptible to ping and SYN floods and LESS susceptible to IP spoofing
87Which of the following are four basic types of firewalls?
- AScreening, bastion, dual-homed, circuit level
- BPacket filtering, application gateway, circuit level, stateful packet inspection
- CStateful packet inspection, gateway, bastion, screening
- DApplication gateway, bastion, dual-homed, screening
88In many typical configurations with multiple firewalls, e-mail servers and FTP servers are located in the:
- Ainternal corporate network
- Bdemilitarized zone
- Ccorporate intranet
- Dexternal network
89Which of the following is not an advantage of the Fortigate firewall?
- ABuilt-in encryption
- BBuilt-in virus scanning
- CContent filtering
- DLow cost
90Should a home user block ICMP traffic, and why or why not?
- AIt should be blocked because such traffic is often used to transmit a virus
- BIt should be blocked because such traffic is often used to do port scans and flood attacks
- CIt should not be blocked because it is necessary for network operations
- DIt should not be blocked because it is necessary for using the Web
91Why might a proxy gateway be susceptible to a flood attack?
- AIt does not require user authentication
- BIt allows multiple simultaneous connections
- CIt does not properly filter packets
- DIts authentication method takes more time and resources
92A standalone technology that hides internal addresses from the outside and only allows connections that originate from inside the network is called:
- ATFTP
- BHTTP
- CDMZ
- DNAT
93What is another term for preemptive blocking?
- ABanishment vigilance
- BIntruder blocking
- CIntrusion deflection
- DUser deflection
94Which serves as a single contact point between the Internet and the private network?
- ABastion host
- BDMZ
- CScreened host
- DDual-homed host
95One type of intrusion-detection and avoidance which involves identifying suspect IP addresses and preventing intrusions is called:
- Aanomaly detection
- Bintrusion deterrence
- Cpreemptive blocking
- Dintrusion deflection
96NAT is a replacement for what technology?
- AProxy server
- BFirewall
- CIDS
- DAntivirus software
97Which is a robust commercial software firewall solution for Linux operating systems?
- ASonicWALL
- BWolverine
- CMcAfee Personal Firewall
- DSymantec Norton Firewall
98Which is true about Windows XP Internet Connection Firewall (ICF)?
- AIt has a logging feature enabled by default.
- BIt works best in conjunction with a perimeter firewall.
- CIt blocks incoming and outgoing packets.
- DIt is a screened host firewall.
99Which of the following is not a profiling strategy used in anomaly detection?
- AExecutable profiling
- BThreshold monitoring
- CResource profiling
- DSystem monitoring
100Which type of intrusion-detection relies on people rather than software or hardware?
- ABanishment vigilance
- BIntrusion deterrence
- CInfiltration
- DAnomaly detection
101Which type of firewall is included in Windows XP and many distributions of Linux operating systems?
- AStateful packet inspection
- BUser authentication
- CPacket filter
- DApplication proxy
102What is one complexity found in enterprise environements that is unlikely in small networks or SOHO environments?
- AUsers running different applications
- BMultiple operating systems
- CDiverse user groups
- DWeb vulnerabilities
103What type of firewall requires individual client applications to be authorized to connect?
- AStateful packet inspection
- BDual-homed
- CApplication gateway
- DScreened gateway
104Which of the following is not one of Snort’s modes?
- ANetwork intrusion-detection
- BSniffer
- CPacket logger
- DPacket filtering
105What tool does McAfee Personal Firewall offer?
- AA visual tool to trace attacks
- BNAT
- CStrong encryption
- DVulnerability scanning
106An open source software circuit level gateway is available from which of the following?
- AWatchguard Technologies
- BSonicWALL
- CTeros
- DAmrita Labs
107Which of the following are four basic types of firewalls?
- AApplication gateway, bastion, dual-homed, screening
- BPacket filtering, application gateway, circuit level, stateful packet inspection
- CStateful packet inspection, gateway, bastion, screening
- DScreening, bastion, dual-homed, circuit level
108Which type of firewall creates a private virtual connection with the client?
- ACircuit level gateway
- BDual-homed
- CApplication gateway
- DBastion
109Which type of firewall negotiates between the server and client to permit or deny connection based on the type of software and connection requested?
- ACircuit level gateway
- BApplication gateway
- CPacket filter
- DStateful packet inspection
110Which firewall configuration would be appropriate within a network to separate and protect various subnets of a network to provide greater security?
- Abastion host
- Bdemilitarized zone
- Crouter-based
- Ddual-homed host
111Which of the following is not a common feature of most single PC firewalls?
- APacket filtering
- BSoftware-based
- CEase of use
- DBuilt-in NAT
112It should be routine for someone in the IT security staff to
- AReboot the firewall
- BPhysically inspect the firewall
- CReview firewall logs
- DTest the firewall by attempting a ping flood
113A firewall designed to secure an individual personal computer is a:
- Ascreened host firewall
- Bsingle machine firewall
- Csimple hardware firewall
- Dcombination hardware/software firewall
114What type of firewall is SonicWALL TI70?
- AApplication gateway
- BCircuit-level gateway
- CPacket screening
- DStateful Packet Inspection
115Which of the following is an advantage of the network host-based configuration?
- AIt is resistant to IP spoofing
- BIt has user authentication
- CIt is inexpensive or free
- DIt is more secure
116Which of the following is a benefit of Cisco firewalls?
- AVery low cost
- BBuilt-in virus scanning on all products
- CBuilt-in IDS on all products
- DExtensive training available on the product
117Once a circuit level gateway verifies the user’s logon, it creates a virtual circuit between:
- Athe internal client and the external server
- Bthe external server and the proxy server
- Cthe external server and the firewall
- Dthe internal client and the proxy server
118At what OSI layer do packet filters function?
- APhysical layer
- BTransport layer
- CNetwork layer
- DData link layer
119Which is NOT a function of an intrusion-detection system?
- AInspect all inbound and outbound port activity
- BNotify the system administrator of suspicious activity
- CInfiltrate the illicit system to acquire information
- DLook for patterns in port activity
120What might one see in an implementation of intrusion deterrence?
- AReal resources with fake names
- BFake resources with legitimate-sounding names
- CBlocking of legitimate users by mistake
- DProfiling of users, resources, groups, or applications
121A system that is set up for attracting and monitoring intruders is called what?
- AFly paper
- BHoney pot
- CHacker cage
- DTrap door
122A device that hides internal IP addresses is called
- ADual-homed host
- BBastion firewall
- CProxy server
- DA screened host
123Medium-sized networks have what problem?
- ALow budgets
- BDiverse user group
- CNeed to connect multiple LANs into a single WAN
- DLack of skilled technical personnel
124A firewall that uses a combination of approaches rather than a single approach to protect the network is called:
- Amulti-homed
- Bdual-homed
- Copen source
- Dhybrid
125How can vulnerability to flooding attacks be reduced with an application gateway?
- APackets are continually checked during the connection
- BVulnerability to flooding attacks with an application gateway cannot be mitigated
- CAuthenticating users
- DExternal systems never see the gateway
126Identifying abnormal activity on a firewall requires that one establish a:
- Abaseline
- Bscreened host
- Cbastion host
- Dproxy server
127An intrusion-detection system detecting a series of ICMP packets sent to each port from the same IP address might indicate:
- Ascanning of the system for vulnerabilities prior to an attack
- BTrojan horse/virus infection sending information back home
- Ca Distributed Denial of Service attack in progress
- Dthe system has been infiltrated by an outsider
128Why is an SPI firewall less susceptible to spoofing attacks?
- AIt requires user authentication
- BIt requires client application authentication
- CIt automatically blocks spoofed packets
- DIt examines the source IP of all packets
129What is ICF?
- AWindows XP Internet Connection Firewall
- BWindows 2000 Internet Connection Firewall
- CWindows 2000 Internet Control Firewall
- DWindows XP Internet Control Firewall
130Which is a firewall vendor manufacturing a host-based firewall for Windows 2000 Server, Sun Solaris, and Red Hat Linux environments?
- AD-Link
- BWolverine
- CCheck Point
- DCisco
131Which of the following is not a reason to avoid choosing infiltration as part of an IDS strategy?
- AIt can be time consuming
- BIt requires knowledge of the target group
- CIt can be expensive
- DThe group may retaliate
132A series of ICMP packets sent to your ports in sequence might indicate what?
- AA packet sniffer
- BA port scan
- CA DoS attack
- DA ping flood
133An intrusion-detection method that measures and monitors how programs use system resources is called:
- Auser/group profiling.
- Bresource profiling.
- Cexecutable profiling.
- Dthreshold monitoring.
134Which strategy is used in the implementation of intrusion deterrence?
- AInstalling honey pots to pose as important system
- BMonitoring connection attempts to identify IP addresses of attackers
- CUsing fake names to camouflage important systems
- DInfiltrating online hacker groups
135Which method of intrusion-detection develops historic usage levels to measure activity against?
- AThreshold monitoring
- BApplication profiling
- CResource profiling
- DInfiltration profiling
136What is the greatest danger in a network host-based configuration?
- ASYN flood attacks
- BIP spoofing
- COperating System Security flaws
- DPing flood attacks
137Which type of firewall is generally the simplest and least expensive?
- ACircuit level gateway
- BApplication gateway
- CPacket filter
- DStateful packet inspection
138Implementation of intrusion deflection as a strategy requires the use of:
- Afake targets
- Bblocking software
- Cwarnings to intruders to leave
- Dinnocuous names for sensitive targets
139Which of the following is found in Norton’s personal firewall but not in ICF?
- AStrong encryption
- BVulnerability scanning
- CA visual tool to trace attacks
- DNAT
140Which of the following is a common problem when seeking information on firewalls?
- AUnbiased information may be hard to find.
- BIt is difficult to find information on the Web.
- CInformation often emphasizes price rather than features.
- DDocumentation is often incomplete
141Which of the following can be shipped preconfigured?
- ARouter-based firewalls
- BStateful packet inspection firewalls
- CDual-homed firewalls
- DNetwork host-based firewalls
142Which is a term used to refer to the process of authentication and verification?
- AFiltering
- BNegotiation
- CConnecting
- DScreening
143Which type of firewall negotiates between the server and client to permit or deny connection based on the type of software and connection requested?
- ACircuit level gateway
- BStateful packet inspection
- CApplication gateway
- DPacket filter
144Which intrusion detection strategy monitors and compares activity against preset acceptable levels?
- AThreshold monitoring
- BInfiltration monitoring
- CApplication monitoring
- DResource profiling
145Which of the following is a problem with the approach of a profiling strategy that is used in anomaly detection?
- AIt misses many attacks
- BIt is resource intensive
- CIt yields many false positives
- DIt is difficult to configure
146What is the purpose of the warning configuration for Specter’s email file?
- ATo scare off at least novice hackers
- BTo keep your normal users honest
- CTo deter highly skilled hackers
- DTo track hackers back to their source IPs
147Regarding the Firewall-1 firewall, which of the following is NOT true?
- AIt is particularly vulnerable to SYN floods.
- BIt is a packet filtering, application gateway hybrid.
- CIt uses Stateful Packet Inspection.
- DIt automatically blocks and logs oversized packets.
148IDS is an acronym for:
- AIntrusion deterrence service
- BIntrusion-detection service
- CIntrusion deterrence system
- DIntrusion-detection system
149What is the most important security advantage to NAT?
- AIt hides internal network addresses
- BBy default it blocks all ICMP packets
- CIt blocks incoming ICMP packets
- DBy default it only allows outbound connections
150Which is true about the Wolverine firewall solution?
- AIt includes built-in VPN capabilities.
- BIt works on Linux, Unix, Solaris, and Windows platforms.
- CEncryption can be added with a free Web download.
- DIt is expensive.
151What four rules must be set for packet filtering firewalls?
- AUsername, password, protocol type, destination IP
- BSource IP, destination IP, username, password
- CProtocol type, source port, destination port, source IP
- DProtocol version, destination IP, source port, username
152Setting up parameters for acceptable use, such as the number of login attempts, and watching to see if those levels are exceeded is referred to as what?
- AResource profiling
- BExecutable profiling
- CSystem monitoring
- DThreshold monitoring
153Attempts by an intruder to determine information about a system prior to the start of an intrusion attack is called:
- Afoot printing
- Binfiltration
- Cdeflecting
- Ddetecting
154Which is NOT a service included in the Norton single machine firewall?
- AData recovery
- BPopup ad blocking
- CBlocking of outgoing traffic
- DPrivacy protection
155Banishment vigilance is another name for:
- Aanomaly detection
- Bintrusion deflection
- Cintrusion deterrence
- Dpreemptive blocking
156Which type of encryption is included with the T170?
- APGP and AES
- BWEP and DES
- CWEP and PGP
- DAES and DES
157Which is a unique feature of the McAfee Personal Firewall that is not found on most personal firewalls?
- ABlocking incoming traffic on selected ports
- BOnline scanning of system for vulnerabilities
- CPerforming traceroute to show the source of incoming packets
- DRecording a log of all attempts at incoming packets
158Why might you run Specter in strange mode?
- AIt will be difficult to determine the system is a honey pot
- BIt will deter novice hackers
- CIt may fascinate hackers and keep them online long enough to catch them
- DIt may confuse hackers and deter them from your systems
159A firewall configuration using a server as a router and running multiple network interfaces with automatic routing disabled is an example of a:
- Adual-homed host
- Bscreened host
- Crouter-based
- Dnetwork host-based
160Why might a proxy gateway be susceptible to a flood attack?
- AIts authentication method takes more time and resources
- BIt does not properly filter packets
- CIt allows multiple simultaneous connections
- DIt does not require user authentication
161Which intrusion-detection method measures activity levels against known short-term and/or long-term work profiles?
- AThreshold monitoring
- BUser/group work profiling
- CExecutable profiling
- DResource profiling
162Why might a circuit level gateway be inappropriate for some situations?
- AIt blocks web traffic
- BIt is simply too expensive
- CIt has no user authentication
- DIt requires client side configuration
163Which is NOT true about enterprise networks and firewall solutions?
- AThey are likely to be supported by multiple network administrators.
- BThey are usually made up of several interconnected networks.
- CThey are usually easier to manage and secure.
- DThey are likely to contain several different operating systems.
164Attempting to make your system appear less appealing is referred to as what?
- AIntrusion deterrence
- BSystem deterrence
- CSystem camouflage
- DIntrusion deflection
165Which of the following is an important feature of D-Link DFL 300?
- AVulnerability scanning
- BLiberal licensing policy
- CWEP encryption
- DBuilt-in IDS
166Which firewall solution would be best for a large enterprise running Windows XP Professional and Linux operating systems, using the Internet, and requiring remote access to their Intranet server for field sales people?
- ACheck Point Firewall-1
- BCisco PIX 515E
- CFortigate 3600
- DWindows XP Internet Connection Firewall
167Why is an SPI firewall more resistant to flooding attacks?
- AIt automatically blocks large traffic from a single IP
- BIt requires user authentication
- CIt examines each packet in the context of previous packets
- DIt examines the destination IP of all packets
168A profiling technique that monitors how applications use resources is called what?
- AApplication monitoring
- BResource profiling
- CSystem monitoring
- DExecutable profiling
169Symantec Decoy Server does all of the following EXCEPT:
- Asimulate incoming mail server functions
- Brecord all traffic related to an intrusion attack
- Csimulate outgoing mail server functions
- Dtrack attacking packets to their source
170Attempting to attract intruders to a system set up to monitor them is called what?
- AIntrusion routin
- BIntrusion deterrence
- CIntrusion banishment
- DIntrusion deflection
171Which type of firewall is considered the most secure?
- ACircuit-level gateway
- BStateful packet inspection
- CDual-homed
- DPacket screening
172Following rules and learning from experience as part of the process to identify and notify an administrator about an intrusion are typical when Snort is operating in which mode?
- ANetwork intrusion-detection mode
- BPacket logger mode
- CSniffer mode
- DCommand mode
173Using a server running the Linux operating system with its built-in firewall as the network firewall is one example of which firewall configuration?
- Ascreened host
- Bnetwork host-based
- Crouter-based
- Ddual-homed host
174Which of the following solutions is actually a combination of firewalls?
- ADual-homed firewalls
- BRouter-based firewalls
- CScreened firewalls
- DBastion host firewalls
175Which is NOT one of the basic premises under which a honey pot functions?
- AIntruders will tend to go for easy targets with valuable data
- BAny traffic to the honey pot is suspicious
- CSecurity must allow attackers inside
- DOnly legitimate users have a reason to connect to it
176In many typical configurations with multiple firewalls, e-mail servers and FTP servers are located in the:
- Ademilitarized zone
- Binternal corporate network
- Ccorporate Intranet
- Dexternal network
Informationen
- Beschreibung
- Information Technology Quiz am Midterm review Chapters 1-5, erstellt von Mary Sunseri am 03/03/2018.
- Autor
- Mary Sunseri
- Sprache
- English
- Aufrufe
- 256
- Schlagwörter
- Bewertung
- Noch keine Bewertungen Bewerte dieses Quiz