Deck 21: Network Endpoint Security

Question 1

Intrusion detection is the process of collecting information about
events occurring in a computer system or network and analyzing them for signs of intrusions.

Answer 1

True

Question 2

One limitation of a firewall is that an improperly secured wireless
LAN may be accessed from outside the organization.

Answer 2

True

Question 3

the primary benefit of a host-based IDS is that it can detect both
external and internal intrusions.

Answer 3

True

Question 4

Packet filter firewalls are susceptible to security breaches caused
by improper configurations.

Question 5

the __________ defines the transport protocol.

A)interface
B)IP protocol field
C)source IP address
D)destination IP address

Question 6

typically, a _________ is inserted between the premises network and the Internet to establish a controlled link and to erect an outer security wall or perimeter.

A)WAP
B)firewall
C)reflector
D)blocker

Question 7

A __________ provides a location for monitoring security-related events.

A)firewall
B)choke point
C)LAN
D)secured operating system

Question 8

the internal firewall provides a measure of access control and
protection for the DMZ systems consistent with their need for external connectivity.

Question 9

the firewall provides an additional layer of defense, insulating
internal systems from external networks or other parts of the internal network.

Question 10

__________ determines the direction in which particular service requests may be initiated and allowed to flow through the firewall.

A)Behavior control
B)Service control
C)Direction control
D)User control

Question 11

Analyzers are responsible for collecting dat
A.

Question 12

A circuit-level gateway permits an end-to-end tCP connection.

Question 13

the user control feature is typically applied to users outside the
firewall perimeter.

Question 14

Multiple internal firewalls can be used to protect portions of the
internal network from each other.

Question 15

__________ controls how particular services are used.

A)User control
B)Direction control
C)Service control
D)Behavior control

Question 16

A firewall may filter traffic on the basis of IP address, protocol, or
port number.

Question 17

Packet filter gateways tend to be more secure than application-
level gateways.

Question 18

A firewall may not act as a packet filter.

Question 19

the first step in a DDoS attack is for the attacker to infect a
number of machines with zombie software that will ultimately be
used to carry out the attack.

Question 20

A stateful packet inspection firewall reviews the same packet
information as a packet filtering firewall, but also records information about tCP connections.

Question 21

Between internal and external firewalls are one or more networked devices in a region referred to as a __________ network.

A)demilitarized zone
B)war zone
C)safe zone
D)protected zone

Question 22

the countermeasure for __________ is to discard packets with an inside source address if the packet arrives on an external interface.

Question 23

there are four techniques that firewalls use to control access and enforce the site's security policy: service control, direction control, user control, and __________ .

Question 24

__________ can more readily see the intended outcome of an attempted attack because they can directly access and monitor the data files and system processes usually targeted by attacks.

A)Host-based IDSs
B)External firewalls
C)User interfaces
D)Sensors

Question 25

A(n) __________ is placed at the edge of a local or enterprise network, just inside the boundary router that connects to the Internet or some wide area network.

Question 26

A(n) __________ is hardware or software products that gather and analyze information from various areas within a computer or a network for the purpose of finding, and providing real-time or near-real-time warning of, attempts to access system resources in an unauthorized manner.

Question 27

An application-level gateway, also called a(n) __________ , acts as a relay of application-level traffic.

A)application proxy
B)relay proxy
C)source proxy
D)program proxy

Question 28

Systems that are externally accessible but need some protections are usually located on _________ networks.

A)IDS
B)DMZ
C)DMARC
D)ISP

Question 29

A __________ monitors network traffic for particular network segments or devices and analyzes network, transport, and application protocols to identify suspicious activity.

Question 30

A __________ is a computer program that can copy itself and infect a computer without permission or knowledge of the user.

A)worm
B)virus
C)rootkit
D)trojan horse

Question 31

An __________ is violations of security policy, usually characterized as attempts to affect the confidentiality, integrity, or availability of a computer or network.

A)anomaly
B)IDS
C)intrusion
D)analyzer

Question 32

A __________ is an undocumented way of gaining access to a computer system.

A)backdoor
B)rootkit
C)bot
D)virus

Question 33

An IDS comprises three logical components: sensors, __________ , and user interface.

Question 34

A __________ attack can be defeated by enforcing a rule that the first fragment of a packet must contain a predefined minimum amount of the transport header.

Question 35

A typical use of __________ is a situation in which the system administrator trusts the internal users.

A)DMZ networks
B)firewalls
C)circuit-level gateways
D)IDSs

Question 36

Data collection, correlation, alerting, and reporting/compliance are all key elements of ___________ .

A)incident management
B)reflector DDoS
C)direct DDoS
D)malware

Question 37

the __________ to an IDS enables a user to view output from the system or
control the behavior of the system.

Question 38

A __________ firewall applies a set of rules to each incoming and outgoing IP packet and then forwards or discards the packet.

Question 39

__________ control determines the types of Internet services that can be accessed, inbound or outbound.

Question 40

A scanning strategy that uses information contained on an infected victim machine to find more hosts to scan is the __________ method.

A)random
B)hit list
C)topological
D)local subnet

Question 41

__________ is the identification, collection, examination, and analysis of data while preserving the integrity of the information and maintaining a strict chain of custody for the dat
A.

Question 42

there are two general approaches to intrusion detection: Misuse detection
and ___________ .

Question 43

A __________ attack attempts to consume the target's resources so that it
cannot provide service.

Question 44

Information security ___________ consists of processes for detecting,
reporting, assessing, responding to, dealing with, and learning from
information security incidents.

Question 45

Malicious software, commonly called __________ , is perhaps the most
significant security threat to organizations.