Deck 9: Firewalls and Intrusion Prevention Systems

Question 1

A firewall can serve as the platform for IPSec.

Answer 1

True

Question 2

The _________ defines the transport protocol.

A)destination IP address
B)source IP address
C)interface
D)IP protocol field

Answer 2

D

Question 3

Snort Inline enables Snort to function as an intrusion prevention
capability.

Answer 3

True

Question 4

The firewall may be a single computer system or a set of two or more
systems that cooperate to perform the firewall function.

Question 5

The countermeasure to tiny fragment attacks is to discard packets with
an inside source address if the packet arrives on an external interface.

Question 6

Distributed firewalls protect against internal attacks and provide
protection tailored to specific machines and applications.

Question 7

A prime disadvantage of an application-level gateway is the additional
processing overhead on each connection.

Question 8

A packet filtering firewall is typically configured to filter packets going
in both directions.

Question 9

The firewall can protect against attacks that bypass the firewall.

Question 10

The primary role of the personal firewall is to deny unauthorized
remote access to the computer.

Question 11

A traditional packet filter makes filtering decisions on an individual
packet basis and does not take into consideration any higher layer context.

Question 12

________ control controls access to a service according to which user is attempting to access it.

A)User
B)Direction
C)Service
D)Behavior

Question 13

_________ control determines the direction in which particular service requests may be initiated and allowed to flow through the firewall.

A)Behavior
B)User
C)Direction
D)Service

Question 14

_________ control controls how particular services are used.

A)Service
B)Behavior
C)User
D)Direction

Question 15

A logical means of implementing an IPSec is in a firewall.

Question 16

An important aspect of a distributed firewall configuration is security
monitoring.

Question 17

_________ control determines the types of Internet services that can be accessed,inbound or outbound.

A)Behavior
B)Direction
C)Service
D)User

Question 18

Unlike a firewall,an IPS does not block traffic.

Question 19

One disadvantage of a packet filtering firewall is its simplicity.

Question 20

A DMZ is one of the internal firewalls protecting the bulk of the
enterprise network.

Question 21

A __________ gateway sets up two TCP connections,one between itself and a TCP user on an inner host and one between itself and a TCP user on an outside host.

A)packet filtering
B)stateful inspection
C)application-level
D)circuit-level

Question 22

A _________ configuration involves stand-alone firewall devices plus host-based firewalls working together under a central administrative control.

A)packet filtering firewall
B)distributed firewall
C)personal firewall
D)stateful inspection firewall

Question 23

The _________ is inserted between the premises network and the Internet to establish a controlled link and to erect an outer security wall or perimeter to protect the premises network from Internet-based attacks.

Question 24

Identified as a critical strong point in the network's security,the _________ serves as a platform for an application-level or circuit-level gateway.

Question 25

A ________ uses encryption and authentication in the lower protocol layers to provide a secure connection through an otherwise insecure network,typically the Internet.

Question 26

The __________ protocol is an example of a circuit-level gateway implementation that is conceptually a "shim-layer" between the application layer and the transport layer and does not provide network-layer gateway services.

Question 27

__________ looks for deviation from standards set forth in RFCs.

A)Statistical anomaly
B)Protocol anomaly
C)Pattern matching
D)Traffic anomaly

Question 28

__________ scans for attack signatures in the context of a traffic stream rather than individual packets.

A)Pattern matching
B)Protocol anomaly
C)Traffic anomaly
D)Stateful matching

Question 29

An intruder transmitting packets from the outside with a source IP address field containing an address of an internal host is known as IP address _________.

Question 30

__________ protocols operate in networking devices,such as a router or firewall,and will encrypt and compress all traffic going into the WAN and decrypt and uncompress traffic coming from the WAN.

Question 31

A _________ consists of a set of computers that interconnect by means of a relatively unsecure network and makes use of encryption and special protocols to provide security.

A)proxy
B)UTM
C)VPN
D)stateful inspection firewall

Question 32

A ___________ makes use of both signature and anomaly detection techniques to identify attacks.

Question 33

A __________ firewall controls the traffic between a personal computer or workstation on one side and the Internet or enterprise network on the other side.

Question 34

The _________ attack is designed to circumvent filtering rules that depend on TCP header information.

A)tiny fragment
B)address spoofing
C)source routing
D)bastion host

Question 35

The ________ IP address is the IP address of the system that originated the IP packet.

Question 36

A _________ firewall applies a set of rules to each incoming and outgoing IP packet and then forwards or discards the packet.

Question 37

__________ are attacks that attempt to give ordinary users root access.

A)Privilege-escalation exploits
B)Directory transversals
C)File system access
D)Modification of system resources

Question 38

Typical for SOHO applications,a __________ is a single router between internal and external networks with stateless or full packet filtering.

A)single bastion T
B)double bastion inline
C)screening router
D)host-resident firewall

Question 39

An example of a circuit-level gateway implementation is the __________ package.

A)application-level
B)SOCKS
C)SMTP
D)stateful inspection

Question 40

Typically the systems in the _________ require or foster external connectivity such as a corporate Web site,an e-mail server,or a DNS server.

A)DMZ
B)IP protocol field
C)boundary firewall
D)VPN

Question 41

Snort Inline adds three new rule types: drop,reject,and _________.

Question 42

_________ matching scans incoming packets for specific byte sequences (the signature)stored in a database of known attacks.

Question 43

The firewall follows the classic military doctrine of _________ because it provides an additional layer of defense.

Question 44

A single device that integrates a variety of approaches to dealing with network-based attacks is referred to as a __________ system.

Question 45

__________ anomaly watches for unusual traffic activities,such as a flood of UDP packets or a new service appearing on the network.