Deck 9: Firewalls and Intrusion Prevention Systems

Question 1

A logical means of implementing an IPSec is in a firewall.

Answer 1

True

Question 2

_________ control determines the direction in which particular service requests may be initiated and allowed to flow through the firewall.

A) Behavior
B) User
C) Direction
D) Service

Answer 2

C

Question 3

A firewall can serve as the platform for IPSec.

Answer 3

True

Question 4

One disadvantage of a packet filtering firewall is its simplicity.

Question 5

The firewall may be a single computer system or a set of two or moresystems that cooperate to perform the firewall function.

Question 6

The countermeasure to tiny fragment attacks is to discard packets withan inside source address if the packet arrives on an external interface.

Question 7

An important aspect of a distributed firewall configuration is securitymonitoring.

Question 8

The primary role of the personal firewall is to deny unauthorizedremote access to the computer.

Question 9

Distributed firewalls protect against internal attacks and provideprotection tailored to specific machines and applications.

Question 10

A traditional packet filter makes filtering decisions on an individualpacket basis and does not take into consideration any higher layer context.

Question 11

_________ control controls how particular services are used.

A) Service
B) Behavior
C) User
D) Direction

Question 12

________ control controls access to a service according to which user is attempting to access it.

A) User
B) Direction
C) Service
D) Behavior

Question 13

Snort Inline enables Snort to function as an intrusion preventioncapability.

Question 14

_________ control determines the types of Internet services that can be accessed, inbound or outbound.

A) Behavior
B) Direction
C) Service
D) User

Question 15

A prime disadvantage of an application-level gateway is the additionalprocessing overhead on each connection.

Question 16

The firewall can protect against attacks that bypass the firewall.

Question 17

The _________ defines the transport protocol.

A) destination IP address
B) source IP address
C) interface
D) IP protocol field

Question 18

A packet filtering firewall is typically configured to filter packets goingin both directions.

Question 19

Unlike a firewall, an IPS does not block traffic.

Question 20

A DMZ is one of the internal firewalls protecting the bulk of theenterprise network.

Question 21

The ________ IP address is the IP address of the system that originated the IP packet.

Question 22

An intruder transmitting packets from the outside with a source IP address field containing an address of an internal host is known as IP address _________.

Question 23

__________ are attacks that attempt to give ordinary users root access.

A) Privilege-escalation exploits
B) Directory transversals
C) File system access
D) Modification of system resources

Question 24

A ___________ makes use of both signature and anomaly detection techniques to identify attacks.

Question 25

An example of a circuit-level gateway implementation is the __________ package.

A) application-level
B) SOCKS
C) SMTP
D) stateful inspection

Question 26

The __________ protocol is an example of a circuit-level gateway implementation that is conceptually a "shim-layer" between the application layer and the transport layer and does not provide network-layer gateway services.

Question 27

The _________ attack is designed to circumvent filtering rules that depend on TCP header information.

A) tiny fragment
B) address spoofing
C) source routing
D) bastion host

Question 28

Identified as a critical strong point in the network's security, the _________ serves as a platform for an application-level or circuit-level gateway.

Question 29

__________ scans for attack signatures in the context of a traffic stream rather than individual packets.

A) Pattern matching
B) Protocol anomaly
C) Traffic anomaly
D) Stateful matching

Question 30

A _________ configuration involves stand-alone firewall devices plus host-based firewalls working together under a central administrative control.

A) packet filtering firewall
B) distributed firewall
C) personal firewall
D) stateful inspection firewall

Question 31

__________ looks for deviation from standards set forth in RFCs.

A) Statistical anomaly
B) Protocol anomaly
C) Pattern matching
D) Traffic anomaly

Question 32

A ________ uses encryption and authentication in the lower protocol layers to provide a secure connection through an otherwise insecure network, typically the Internet.

Question 33

A _________ firewall applies a set of rules to each incoming and outgoing IP packet and then forwards or discards the packet.

Question 34

__________ protocols operate in networking devices, such as a router or firewall, and will encrypt and compress all traffic going into the WAN and decrypt and uncompress traffic coming from the WAN.

Question 35

Typically the systems in the _________ require or foster external connectivity such as a corporate Web site, an e-mail server, or a DNS server.

A) DMZ
B) IP protocol field
C) boundary firewall
D) VPN

Question 36

A _________ consists of a set of computers that interconnect by means of a relatively unsecure network and makes use of encryption and special protocols to provide security.

A) proxy
B) UTM
C) VPN
D) stateful inspection firewall

Question 37

The _________ is inserted between the premises network and the Internet to establish a controlled link and to erect an outer security wall or perimeter to protect the premises network from Internet-based attacks.

Question 38

A __________ firewall controls the traffic between a personal computer or workstation on one side and the Internet or enterprise network on the other side.

Question 39

Typical for SOHO applications, a __________ is a single router between internal and external networks with stateless or full packet filtering.

A) single bastion T
B) double bastion inline
C) screening router
D) host-resident firewall

Question 40

A __________ gateway sets up two TCP connections, one between itself and a TCP user on an inner host and one between itself and a TCP user on an outside host.

A) packet filtering
B) stateful inspection
C) application-level
D) circuit-level

Question 41

The firewall follows the classic military doctrine of _________ because it provides an additional layer of defense.

Question 42

A single device that integrates a variety of approaches to dealing with network-based attacks is referred to as a __________ system.

Question 43

__________ anomaly watches for unusual traffic activities, such as a flood of UDP packets or a new service appearing on the network.

Question 44

_________ matching scans incoming packets for specific byte sequences (the signature) stored in a database of known attacks.

Question 45

Snort Inline adds three new rule types: drop, reject, and _________.