Deck 25: Digital Evidence at the Network and Transport Layers

Question 1

The IP software on each__________ contains a routing table that is used to determine where to send information.

A) Host
B) Server
C) Router
D) Switch

Answer 1

Router

Question 2

In addition to the IP address of the sender, SMTP e-mail server logs contain which of the following?

A) The Message ID
B) The time the message was received
C) The name of the sender
D) All of the above

Answer 2

D

Question 3

Which of the following logs record the IP addresses of computers accessing an FTP server?

A) Wtmp
B) Xferlog
C) Syslog
D) Access log

Answer 3

B

Question 4

What system is used to convert IP addresses to their associated names?

A) TCP/IP
B) DNS
C) ARP
D) Routing

Question 5

Which of the following is a Class A network?

A) 15.0.0.0
B) 145.19.0.0
C) 199.54.63.0
D) All of the above

Question 6

It is sometimes possible to obtain a list of all machines in the DNS belonging to a specific organization by performing a ___________.

A) Web crawl
B) Zone transfer
C) Reverse IP
D) IP transfer

Question 7

TCP is an abbreviation for:

A) Transit Communication Protocol
B) Transportation Cost Product
C) Transport Control Protocol
D) Time Communication Protocol

Question 8

The UDP protocol will resend packets that were not received by the destination computer.

Question 9

To make large-scale internetworking more reliable, TCP creates what are called "TCP streams," also known as__________ , to establish, maintain, and terminate connections between hosts.

A) Virtual circuits
B) Dedicated circuits
C) Temporary circuits
D) Parallel circuits

Question 10

Port 80 is generally associated with the Domain Name System.

Question 11

TCP session hijacking can only be performed using a computer on the same network segment as the client and/or server.

Question 12

The creator of the first Internet worm and one of the first individuals to be prosecuted under the Computer Fraud and Abuse Act was:

A) Captain Crunch
B) Scott Tyree
C) Richard Morris Jr.
D) Kevin Mitnick

Question 13

The Domain Name System can be used to obtain the names of people who are responsible for a given computer.

Question 14

Which of the following servers maintain logs of when users accessed their e-mail?

A) SMTP
B) Imapd
C) Sendmail
D) All of the above

Question 15

What protocol does the "ping" command use?

A) TCP
B) IP
C) ICMP
D) All of the above

Question 16

IP Address Class B addresses start with 128.0.0.0 through:

A) 176.0.0.0
B) 191.0.0.0
C) 192.0.0.0
D) 254.0.0.0

Question 17

IP address [ 10.40.3.2 ] is a__________ ,__________ network address:

A) Class A, Public
B) Class B, Public
C) Class A, Private
D) Class B, Private

Question 18

VNC software:

A) Permits full remote control of a computer
B) Has legitimate uses such as remote system administration.
C) Can be used by computer intruders
D) All of the above

Question 19

__________is a tool for querying DNS.

A) nslookup
B) ping
C) tracert
D) nmap

Question 20

The Internet is a packet-switched network.

Question 21

RADIUS and TACACS authentication servers keep logs of the IP addresses that were assigned to user accounts connecting to the Internet.

Question 22

Any host, even a personal computer in someone's home, can function as a server on the Internet.

Question 23

All servers keep logs of the IP addresses of clients that connected to them.

Question 24

It is sometimes possible to obtain a list of all machines in the DNS belonging to a specific organization by performing a zone transfer.

Question 25

IP spoofing establishes a bi-directional TCP connection between the attacker's computer and the target.

Question 26

On a packet-switched network, computers are not connected using dedicated circuits.

Question 27

The command 'dig' stands for 'Digital Information Groper'.

Question 28

Network address translation (NAT) enables many computers to connect to the Internet using only one IP address.

Question 29

An IP address can only be assigned one name in the Domain Name System.

Question 30

"dig," which comes installed on UNIX and Windows systems, is a tool used for querying DNS.