Deck 8: Network Risk Management

Question 1

The simplest type of firewall is a content filtering firewall.

Answer 1

False

Question 2

A proxy that provides Internet clients access to services on its own network is known as what type of proxy?

A)reverse proxy
B)cache proxy
C)service proxy
D)inverse proxy

Answer 2

A

Question 3

If multiple honeypots are connected to form a larger network,what term is used to describe the network?

A)combolure
B)lurenet
C)honeycomb
D)honeynet

Answer 3

D

Question 4

Which software below combines known scanning techniques and exploits to allow for hybrid exploits?

A)Nessus
B)metasploit
C)nmap
D)Sub7

Question 5

Botnets often make use of what chat protocol in order to receive commands?

A)XMPP
B)AIM
C)IRC
D)Skype

Question 6

The term malware is derived from a combination of the words malicious and software.

Question 7

An attack that involves a person redirecting or capturing secure transmissions as they occur is known as what type of attack?

A)buffer overflow
B)session hijacking attack
C)man-in-the-middle attack
D)banner-grabbing attack

Question 8

Which software below serves as the firewall for Linux systems?

A)ZoneAlarm
B)Comodo
C)iptables
D)ipf

Question 9

Programs that run independently and travel between computers and across networks,such as by e-mail attachment or virtually any kind of file transfer,are known as which option below?

A)file-infector viruses
B)worms
C)network viruses
D)macro viruses

Question 10

A reflective attack can be increased in intensity by combining it with what type of attack?

A)smurf attack
B)SYN attack
C)amplification attack
D)friendly attack

Question 11

Different types of organizations have similar levels of network security risks.

Question 12

What characteristic of viruses make it possible for a virus to potentially change its characteristics (such as file size,and internal instructions)to avoid detection?

A)encryption
B)stealth
C)polymorphism
D)time dependence

Question 13

A SOHO wireless router typically acts as a firewall and may include packet filtering options.

Question 14

What type of virus are dormant until a specific condition is met,such as the changing of a file or a match of the current date?

A)encrypted virus
B)logic bomb
C)boot sector virus
D)worm

Question 15

A firewall typically involves a combination of hardware and software.

Question 16

A system that is capable of collecting and analyzing information generated by firewalls,IDS,and IPS systems is known as which term below?

A)event collector architecture
B)syslog system
C)SIEM system
D)log organizer

Question 17

At what layer of the OSI model do firewalls operate?

A)Transport
B)Data link
C)Network
D)Application

Question 18

Which virus below combines polymorphism and stealth techniques to create a very destructive virus?

A)Natas
B)Macro
C)Michelangelo
D)Stoned

Question 19

An attack in which hackers transmit bogus requests for connection to servers or applications in order to harvest useful information to guide their attack efforts is known as what option below?

A)banner-grabbing attack
B)reflective attack
C)friendly attack
D)IP spoofing attack

Question 20

What kind of attack involves a flood of broadcast ping messages,with the originating source address being spoofed to appear as a host on the network?

A)amplification attack
B)smurf attack
C)zombie attack
D)SYN attack

Question 21

Which two terms can be used to describe a decoy system that is purposely vulnerable for the sake of attracting attackers?

A)honeypot
B)pandora box
C)trap
D)lure

Question 22

Matching
Match each correct item with the statement below.
a.acceptable use policy (AUP)
b.backdoor
c.HIDS (host-based intrusion detection system)
d.HIPS (host-based intrusion prevention system)
e.NIDS (network-based intrusion detection system)
f.proxy service
g.smurf attack
h.TEMPEST
i.virus
j.worm
A type ofintrusion detection that protects an entire network and is situatedat the edge of the network or in a network's protectiveperimeter,known as the DMZ (demilitarized zone).Here,itcan detect many types of suspicious traffic patterns.

Question 23

A _________________ form is a document that is used to ensure that employees are aware of the fact that their use of company equipment and accounts will be monitored and reviewed as needed for security purposes.

Question 24

In ACL statements,the any keyword is equivalent to using which wildcard mask?

A)255.255.255.255
B)0.0.0.0
C)0.0.255.255
D)255.255.0.0

Question 25

What two types of agents are used to check compliance with network security policies?

A)dissolvable agent
B)temporary agent
C)persistent agent
D)permanent agent

Question 26

What two options below are IDS implementations used to provide additional security on a network?

A)IIDS
B)PIDS
C)HIDS
D)NIDS

Question 27

What two terms describe a network of compromised computers that are then used to perform coordinated DDoS attacks without their owners' knowledge or consent?

A)reflectors
B)botnet
C)zombie army
D)repeaters

Question 28

What mode setting on a firewall makes the firewall transparent to surrounding nodes as if it's just part of the wire?

A)transparent wire mode
B)virtual access mode
C)pass-thru mode
D)virtual wire mode

Question 29

Matching
Match each correct item with the statement below.
a.acceptable use policy (AUP)
b.backdoor
c.HIDS (host-based intrusion detection system)
d.HIPS (host-based intrusion prevention system)
e.NIDS (network-based intrusion detection system)
f.proxy service
g.smurf attack
h.TEMPEST
i.virus
j.worm
A portion of the security policythat explains to users what they can and cannot do,andpenalties for violations.It might also describe how thesemeasures protect the network's security.

Question 30

Matching
Match each correct item with the statement below.
a.acceptable use policy (AUP)
b.backdoor
c.HIDS (host-based intrusion detection system)
d.HIPS (host-based intrusion prevention system)
e.NIDS (network-based intrusion detection system)
f.proxy service
g.smurf attack
h.TEMPEST
i.virus
j.worm
A software security flaw that can allow unauthorizedusers to gain access to a system.Legacy systems areparticularly notorious for leaving these kinds of gaps in anetwork's overall security net.

Question 31

Matching
Match each correct item with the statement below.
a.acceptable use policy (AUP)
b.backdoor
c.HIDS (host-based intrusion detection system)
d.HIPS (host-based intrusion prevention system)
e.NIDS (network-based intrusion detection system)
f.proxy service
g.smurf attack
h.TEMPEST
i.virus
j.worm
A type ofintrusion prevention that runs on a single computer,such as aclient or server,to intercept and help prevent attacks againstthat one host.

Question 32

Matching
Match each correct item with the statement below.
a.acceptable use policy (AUP)
b.backdoor
c.HIDS (host-based intrusion detection system)
d.HIPS (host-based intrusion prevention system)
e.NIDS (network-based intrusion detection system)
f.proxy service
g.smurf attack
h.TEMPEST
i.virus
j.worm
A program that runs independently and travelsbetween computers and across networks.Although wormsdo not alter other programs as viruses do,they can carryviruses.

Question 33

What feature on some network switches can be used to detect faked arp messages?

A)DHCP snooping
B)session monitoring
C)dynamic packet inspection
D)dynamic ARP inspection

Question 34

Which two viruses below are examples of boot sector viruses?

A)Michelangelo
B)Stoned
C)Natas
D)Klez

Question 35

The ________________ utility is a Windows console that is used to control what users do and how the system can be used.

Question 36

Networks that use ________________,such as T-1 or DSL connections to the Internet,are vulnerable to eavesdropping at a building' s demarc (demarcation point),at aremote switching facility,or in a central office.

Question 37

A ______________ on a device attempts to alter management interfaces within the hardware to the point where the device is irreparable.

Question 38

Which option below is a standard created by the NSA that defines protections against radio frequency emanations?

A)EmSec
B)TEMPEST
C)RFGUARD
D)BlockSec

Question 39

The _____________ proxy server software is available for use on the UNIX / Linux platform.

Question 40

The process in which a person attempts to glean access for authentication information by posing as someone who needs that information is known as what option below?

A)mining
B)phishing
C)hunting
D)doxing

Question 41

Matching
Match each correct item with the statement below.
a.acceptable use policy (AUP)
b.backdoor
c.HIDS (host-based intrusion detection system)
d.HIPS (host-based intrusion prevention system)
e.NIDS (network-based intrusion detection system)
f.proxy service
g.smurf attack
h.TEMPEST
i.virus
j.worm
A specification created by the NSA to define protectionstandards against RF emanation,which when implementedare called EmSec (emission security).

Question 42

Describe some of the characteristics of malware that make it difficult to detect.

Question 43

Describe two different implementations of IDS that can be deployed on a network.

Question 44

Matching
Match each correct item with the statement below.
a.acceptable use policy (AUP)
b.backdoor
c.HIDS (host-based intrusion detection system)
d.HIPS (host-based intrusion prevention system)
e.NIDS (network-based intrusion detection system)
f.proxy service
g.smurf attack
h.TEMPEST
i.virus
j.worm
A threat to networked hosts in which the hostis flooded with broadcast ping messages.A smurf attack is atype of denial-of-service attack.

Question 45

Define what a file-infector virus is.

Question 46

Matching
Match each correct item with the statement below.
a.acceptable use policy (AUP)
b.backdoor
c.HIDS (host-based intrusion detection system)
d.HIPS (host-based intrusion prevention system)
e.NIDS (network-based intrusion detection system)
f.proxy service
g.smurf attack
h.TEMPEST
i.virus
j.worm
A type ofintrusion detection that runs on a single computer,such as aclient or server,to alert about attacks against that one host.

Question 47

Describe a boot sector virus.

Question 48

Matching
Match each correct item with the statement below.
a.acceptable use policy (AUP)
b.backdoor
c.HIDS (host-based intrusion detection system)
d.HIPS (host-based intrusion prevention system)
e.NIDS (network-based intrusion detection system)
f.proxy service
g.smurf attack
h.TEMPEST
i.virus
j.worm
A program that replicates itself to infect more computers,either through network connections when it piggybackson other files or through exchange of external storagedevices,such as USB drives,passed among users.

Question 49

Matching
Match each correct item with the statement below.
a.acceptable use policy (AUP)
b.backdoor
c.HIDS (host-based intrusion detection system)
d.HIPS (host-based intrusion prevention system)
e.NIDS (network-based intrusion detection system)
f.proxy service
g.smurf attack
h.TEMPEST
i.virus
j.worm
A software application on a network host thatacts as an intermediary between the external and internal networks,screening all incoming and outgoing traffic and providing one address to the outside world,instead of revealing the addresses of internal LAN devices.

Question 50

List and describe the four different locations in which anti-malware can be installed.