Question 1

The ________ IP address is the IP address of the system that originated the IP packet.

Accepted Answer

The answer of The ________ IP address is the IP...

Question 2

The __________ protocol is an example of a circuit-level gateway implementation that is conceptually a "shim-layer" between the application layer and the transport layer and does not provide network-layer gateway services.

Accepted Answer

The answer of The __________ protocol is an example of...

Question 3

__________ scans for attack signatures in the context of a traffic stream rather than individual packets.

Accepted Answer

Stateful matching scans for attack signatures within the context of a traffic stream, considering the state of the connection, rather than looking at individual packets in isolation. This allows for a more nuanced detection of attacks that unfold over several packets.

Question 4

A _________ firewall applies a set of rules to each incoming and outgoing IP packet and then forwards or discards the packet.

Accepted Answer

The answer of A _________ firewall applies a set of...

Question 5

A __________ firewall controls the traffic between a personal computer or workstation on one side and the Internet or enterprise network on the other side.

Accepted Answer

The answer of A __________ firewall controls the traffic between...

Question 6

The _________ is inserted between the premises network and the Internet to establish a controlled link and to erect an outer security wall or perimeter to protect the premises network from Internet-based attacks.

Accepted Answer

The answer of The _________ is inserted between the premises...

Question 7

An example of a circuit-level gateway implementation is the __________ package.

Accepted Answer

SOCKS, or Socket Secure, is a circuit-level gateway implementation that allows users to bypass firewalls and filters by redirecting network traffic through a proxy server. It operates on the circuit level, meaning that it establishes a virtual circuit between the client and the server, allowing all subsequent traffic to be sent through that circuit without further analysis or filtering. SOCKS is frequently used to access restricted or censored content on the internet, and is often employed alongside other security measures like encryption and authentication.

Question 8

An intruder transmitting packets from the outside with a source IP address field containing an address of an internal host is known as IP address _________.

Accepted Answer

The answer of An intruder transmitting packets from the outside...

Question 9

A ________ uses encryption and authentication in the lower protocol layers to provide a secure connection through an otherwise insecure network,typically the Internet.

Accepted Answer

The answer of A ________ uses encryption and authentication in...

Question 10

__________ looks for deviation from standards set forth in RFCs.

Accepted Answer

RFCs (Request for Comments) are documents that describe standards and protocols in networking. A protocol anomaly detection system checks for deviations from the standards set forth in RFCs.

Question 11

A __________ gateway sets up two TCP connections,one between itself and a TCP user on an inner host and one between itself and a TCP user on an outside host.

Accepted Answer

A circuit-level gateway sets up two TCP connections, one between itself and a TCP user on an inner host and one between itself and a TCP user on an outside host. It relays TCP segments from one connection to the other without examining the contents of the segments.

Question 12

The _________ attack is designed to circumvent filtering rules that depend on TCP header information.

Accepted Answer

The tiny fragment attack is designed to circumvent filtering rules that depend on TCP header information by sending a packet that is divided into small fragments, with enough information in the last fragment to allow the recipient to reassemble the packet and execute the payload. This attack is effective against firewalls that rely on header information to filter packets. Options B and C refer to different types of attacks that are not specifically designed to circumvent filtering rules, while option D refers to a type of hardened server that is designed to resist attacks.

Question 13

Typical for SOHO applications,a __________ is a single router between internal and external networks with stateless or full packet filtering.

Accepted Answer

A screening router is the most typical solution for SOHO applications as it acts as a single router between internal and external networks with stateless or full packet filtering. A single bastion and double bastion inline are more advanced and complex solutions that are typically used in larger organizations with more complex network structures. A host-resident firewall is installed on individual computers, rather than at the network level, and is not a suitable solution for a SOHO application.

Question 14

A ___________ makes use of both signature and anomaly detection techniques to identify attacks.

Accepted Answer

The answer of A ___________ makes use of both signature...

Question 15

__________ protocols operate in networking devices,such as a router or firewall,and will encrypt and compress all traffic going into the WAN and decrypt and uncompress traffic coming from the WAN.

Accepted Answer

The answer of __________ protocols operate in networking devices,such as...

Question 16

A _________ consists of a set of computers that interconnect by means of a relatively unsecure network and makes use of encryption and special protocols to provide security.

Accepted Answer

The set of computers described in the question is a virtual private network (VPN). VPNs use encryption and special protocols to ensure secure communication over an unsecure network, such as the internet. Proxies, UTM, and stateful inspection firewalls are all security measures, but they do not necessarily involve the interconnection of computers over a network. Therefore, the best choice is C) VPN.

Question 17

Identified as a critical strong point in the network's security,the _________ serves as a platform for an application-level or circuit-level gateway.

Accepted Answer

The answer of Identified as a critical strong point in...

Question 18

A _________ configuration involves stand-alone firewall devices plus host-based firewalls working together under a central administrative control.

Accepted Answer

A distributed firewall configuration involves stand-alone firewall devices (such as network firewalls) and host-based firewalls working together under a central administrative control.

Question 19

Typically the systems in the _________ require or foster external connectivity such as a corporate Web site,an e-mail server,or a DNS server.

Accepted Answer

DMZ (Demilitarized Zone) is a network segment that is located between the internal and external networks of an organization. It is designed to provide controlled access to external-facing systems such as Web servers, email servers, and DNS servers. Its purpose is to allow external users to access these systems while providing an additional layer of security to protect the internal network.

Question 20

__________ are attacks that attempt to give ordinary users root access.

Accepted Answer

Privilege-escalation exploits are attacks that attempt to give ordinary users root access by exploiting vulnerabilities in the system. This can allow the attacker to perform actions beyond their authorized privileges, potentially leading to data theft, system modification, or other malicious activities. Directory traversals, file system access, and modification of system resources are all types of attacks that can be used in conjunction with privilege-escalation exploits, but they are not the primary focus of this type of attack.

Quiz 9: Firewalls and Intrusion Prevention Systems