Question 1

Generally,connections to instant-messaging ports are harmless and should be allowed.

Accepted Answer

Instant-messaging ports can be exploited for malicious purposes such as spreading malware or unauthorized access, so they should be monitored and controlled, not automatically allowed.

Question 2

Which of the following is NOT among the common guidelines that should be reflected in the rule base to implement an organization's security policy?
A) only authenticated traffic can access the internal network
B) employees can use instant-messaging only with external network users
C) the public can access the company Web servers
D) employees can have restricted Internet access

Accepted Answer

The common guidelines for a rule base typically aim to protect the organization's network and data while ensuring necessary access. Allowing employees to use instant messaging only with external network users (B) does not align with typical security policies aimed at protecting against data leaks and external threats. Other options like authenticated traffic (A), public access to web servers (C), and restricted internet access for employees (D) are common practices to balance security and functionality.

Question 3

The Cisco PIX line of products is best described as which of the following?
A) software firewall
B) PC with firewall installed
C) firewall appliance
D) VPN gateway

Accepted Answer

The Cisco PIX line of products is a firewall appliance, which refers to a dedicated hardware device that is designed to provide firewall protection to a network. It is not a software firewall that can be installed on a PC, nor is it a VPN gateway (which provides secure remote access to a network).

Question 4

Which two ports should packet-filtering rules address when establishing rules for Web access?
A) 143, 80
B) 25, 110
C) 80, 443
D) 423, 88

Accepted Answer

Port 80 is used for HTTP web traffic, while port 443 is used for HTTPS web traffic which is encrypted. Therefore, both of these ports should be addressed when establishing rules for Web access.

Question 5

What type of attack are stateless packet filters particularly vulnerable to?
A) attempts to connect to ports above 1023
B) attempts to connect to the firewall
C) IP spoofing attacks
D) attempts to connect to ports below 1023

Accepted Answer

Stateless packet filters are vulnerable to IP spoofing attacks where an attacker can forge the source IP address of a packet to bypass the firewall.

Question 6

Which of the following is a general practice for a rule base?
A) begin by blocking all traffic and end by allowing selective services
B) permit access to public servers in the DMZ
C) allow all access to the firewall
D) allow direct access from the Internet to computers behind the firewall

Accepted Answer

The answer of Which of the following is a general...

Question 7

What is considered the 'cleanup rule' on a Cisco router?
A) explicit allow all
B) implicit deny all
C) explicit prompt
D) implicit allow

Accepted Answer

The cleanup rule on a Cisco router should be an implicit deny all, which means that any traffic that is not explicitly allowed will be denied. This helps to add an extra layer of security to the network and prevent unauthorized access or traffic.

Question 8

Which of the following is NOT a criteria typically used by stateless packet filters to determine whether or not to block packets.
A) IP address
B) ports
C) data patterns
D) TCP flags

Accepted Answer

IP address, ports, and TCP flags are commonly used criteria by stateless packet filters to determine whether to block packets. However, data patterns are usually not used as a criterion for filtering packets because it requires deep packet inspection and analysis, which can be resource-intensive and impactful to network performance. Stateful packet filters are typically used for more advanced filtering and inspection beyond the criteria typically used by stateless packet filters.

Question 9

Which of the following is NOT a protocol,port pair that should be filtered when an attempt is made to make a connection from outside the company network?
A) TCP,80
B) TCP,139
C) UDP,138
D) TCP,3389

Accepted Answer

TCP port 80 is used for HTTP, which is necessary for accessing websites from outside the company network. Filtering this port would block web access. Ports 139 (TCP), 138 (UDP), and 3389 (TCP) are associated with NetBIOS, SMB, and Remote Desktop Protocol respectively, which are commonly filtered to prevent unauthorized network access or remote control.

Question 10

Which of the following is a typical drawback of a free firewall program?
A) cannot monitor traffic in real time
B) oversimplified configuration
C) have centralized management
D) more expensive than hardware firewalls

Accepted Answer

A free firewall program typically lacks the advanced features found in paid firewalls, such as real-time traffic monitoring.

Question 11

At what layer of the OSI model do proxy servers generally operate?
A) Application
B) Session
C) Transport
D) Network

Accepted Answer

Proxy servers operate at the Application Layer, which is the seventh and highest layer of the OSI model. This layer deals with the interface between the network and the user's applications, and it includes protocols such as HTTP, FTP, SMTP, and Telnet. Proxy servers work by intercepting and forwarding application-layer messages between clients and servers, allowing them to filter and modify the requests and responses as needed. By operating at this layer, proxy servers can provide various benefits, such as caching, filtering, load balancing, and anonymity.

Question 12

Stateless packet filtering keeps a record of connections that a host computer has made with other computers.

Accepted Answer

Stateless packet filtering does not keep a record of connections that a host computer has made with other computers. It only examines each packet in isolation and filters them based on predefined rules.

Question 13

Which element of a rule base conceals internal names and IP addresses from users outside the network?
A) tracking
B) filtering
C) NAT
D) QoS

Accepted Answer

NAT (Network Address Translation) conceals internal names and IP addresses from users outside the network by translating them into a public IP address. This helps to improve network security and privacy. Tracking, filtering, and QoS do not provide this functionality.

Question 14

Since ICMP messages use authentication,man-in-the-middle attacks cannot be successful.

Accepted Answer

ICMP messages do not use authentication, therefore they are susceptible to man-in-the-middle attacks.

Question 15

Which of the following is described as the combination of an IP address and a port number?
A) portal
B) subnet
C) datagram
D) socket

Accepted Answer

A socket is a combination of an IP address and a port number. It is used to establish a connection between two devices in a network.

Question 16

What is a suggested maximum size of a rule base?
A) 30 rules
B) 300 rules
C) 10 rules
D) 100 rules

Accepted Answer

A rule base with around 30 rules is often suggested as a maximum to maintain manageability and understandability. Beyond this, the complexity can significantly increase, making the system harder to manage and understand.

Question 17

What should a company concerned about protecting its data warehouses and employee privacy might consider installing on the network perimeter to prevent direct connections between the internal network and the Internet?
A) router
B) VPN server
C) ICMP monitor
D) proxy server

Accepted Answer

A proxy server can act as an intermediary between the internal network and the Internet, screening and filtering connections to prevent direct access to data warehouses and employee data. It can also add another layer of security by providing logging and auditing capabilities. Routers and VPN servers may provide some level of protection, but a proxy server is specifically designed for this purpose. ICMP monitors are used to troubleshoot network issues and would not directly prevent direct connections between the internal network and the Internet.

Question 18

Firewalls can protect against employees copying confidential data from within the network.

Accepted Answer

Firewalls are designed to control access and communication between networks but they do not have any control over data transfer within the network. To prevent employees from copying confidential data, other security measures like access controls, data encryption, and employee training need to be implemented.

Question 19

Software firewalls are usually more scalable than hardware firewalls.

Accepted Answer

Hardware firewalls are usually more scalable than software firewalls as they are designed to handle large amounts of traffic and can be easily upgraded by adding more hardware components. Software firewalls, on the other hand, may require additional resources or configuration changes to handle increased traffic.

Question 20

Which of the following is an advantage of hardware firewalls?
A) not scalable compared to software firewalls
B) not dependent on a conventional OS
C) less expensive than software firewalls
D) easy to patch

Accepted Answer

Hardware firewalls operate independently of the computer's operating system, making them less vulnerable to attacks and compromise than software firewalls. This independence also allows for easier management and scalability, as they do not require individual installation on each device. Hardware firewalls can be more expensive upfront but may ultimately save money in overall security costs. Patching hardware firewalls is typically straightforward and requires updating the firmware.

Quiz 9: Firewalls

Generally,connections to instant-messaging ports are harmless and should be allowed.

Which of the following is NOT among the common guidelines that should be reflected in the rule base to implement an organization's security policy?

The Cisco PIX line of products is best described as which of the following?

Which two ports should packet-filtering rules address when establishing rules for Web access?

What type of attack are stateless packet filters particularly vulnerable to?

Which of the following is a general practice for a rule base?

What is considered the 'cleanup rule' on a Cisco router?

Which of the following is NOT a criteria typically used by stateless packet filters to determine whether or not to block packets.

Which of the following is NOT a protocol,port pair that should be filtered when an attempt is made to make a connection from outside the company network?

Which of the following is a typical drawback of a free firewall program?

At what layer of the OSI model do proxy servers generally operate?

Stateless packet filtering keeps a record of connections that a host computer has made with other computers.

Which element of a rule base conceals internal names and IP addresses from users outside the network?

Since ICMP messages use authentication,man-in-the-middle attacks cannot be successful.

Which of the following is described as the combination of an IP address and a port number?

What is a suggested maximum size of a rule base?

What should a company concerned about protecting its data warehouses and employee privacy might consider installing on the network perimeter to prevent direct connections between the internal network and the Internet?

Firewalls can protect against employees copying confidential data from within the network.

Software firewalls are usually more scalable than hardware firewalls.

Which of the following is an advantage of hardware firewalls?