Question 1

The ________ IP address is the IP address of the system that originated the IP packet.

Accepted Answer

The answer of The ________ IP address is the IP...

Question 2

An intruder transmitting packets from the outside with a source IP address field containing an address of an internal host is known as IP address _________.

Accepted Answer

The answer of An intruder transmitting packets from the outside...

Question 3

__________ are attacks that attempt to give ordinary users root access.

Accepted Answer

Privilege-escalation exploits are attacks where an attacker attempts to gain root access or elevated privileges. Once they have root access, they have complete control over the system and can carry out any actions they wish, including modifying system resources or gaining access to sensitive data. Directory traversals, file system access, and modification of system resources are all potential outcomes of a successful privilege-escalation exploit, but they are not the actual attack itself.

Question 4

A ___________ makes use of both signature and anomaly detection techniques to identify attacks.

Accepted Answer

The answer of A ___________ makes use of both signature...

Question 5

An example of a circuit-level gateway implementation is the __________ package.

Accepted Answer

SOCKS is an example of a circuit-level gateway implementation, which is designed to allow network clients to securely and transparently communicate through a firewall.

Question 6

The __________ protocol is an example of a circuit-level gateway implementation that is conceptually a "shim-layer" between the application layer and the transport layer and does not provide network-layer gateway services.

Accepted Answer

The answer of The __________ protocol is an example of...

Question 7

The _________ attack is designed to circumvent filtering rules that depend on TCP header information.

Accepted Answer

Tiny fragment attacks are designed to evade filtering rules that depend on TCP header information. In this type of attack, the attacker sends fragmented packets that are smaller than the minimum size required by the IP protocol. This can cause the packet headers to be split and processed separately, making it difficult for filters to identify and block the attack. Address spoofing, source routing, and bastion host attacks do not specifically target TCP header information.

Question 8

Identified as a critical strong point in the network's security, the _________ serves as a platform for an application-level or circuit-level gateway.

Accepted Answer

The answer of Identified as a critical strong point in...

Question 9

__________ scans for attack signatures in the context of a traffic stream rather than individual packets.

Accepted Answer

Stateful matching scans for attack signatures within the context of a traffic stream, considering the state of the connection, rather than looking at individual packets in isolation. This allows for a more nuanced detection of attacks that unfold over several packets.

Question 10

A _________ configuration involves stand-alone firewall devices plus host-based firewalls working together under a central administrative control.

Accepted Answer

The given scenario describes a distributed firewall configuration, which consists of stand-alone firewall devices and host-based firewalls working together under a central administrative control. This approach provides multiple layers of protection to the network, as external traffic is filtered by the stand-alone firewall devices, while internal traffic is controlled by the host-based firewalls on individual systems. Hence, option B is the correct choice. Option A describes a type of firewall technology, while option C describes a personal firewall that is installed on a single computer. Option D describes a firewall technology that keeps track of the state and context of network connections.

Question 11

__________ looks for deviation from standards set forth in RFCs.

Accepted Answer

Protocol anomaly detection specifically looks for deviations from the defined standards in RFCs (Requests for Comments) for protocols such as TCP/IP, HTTP, FTP, DNS, etc. This method is effective in identifying potential security threats and attacks that exploit weaknesses in the protocol implementation.

Question 12

A ________ uses encryption and authentication in the lower protocol layers to provide a secure connection through an otherwise insecure network, typically the Internet.

Accepted Answer

The answer of A ________ uses encryption and authentication in...

Question 13

A _________ firewall applies a set of rules to each incoming and outgoing IP packet and then forwards or discards the packet.

Accepted Answer

The answer of A _________ firewall applies a set of...

Question 14

__________ protocols operate in networking devices, such as a router or firewall, and will encrypt and compress all traffic going into the WAN and decrypt and uncompress traffic coming from the WAN.

Accepted Answer

The answer of __________ protocols operate in networking devices, such...

Question 15

Typically the systems in the _________ require or foster external connectivity such as a corporate Web site, an e-mail server, or a DNS server.

Accepted Answer

DMZ (Demilitarized Zone) is a subnetwork that sits between the internal network and the external network (usually the internet). It is designed to provide external-facing services (such as a corporate website or email server) while keeping the internal network secure. Therefore, systems in the DMZ require or foster external connectivity. IP protocol field and VPN do not directly relate to external connectivity. A boundary firewall can be used to protect the DMZ, but it does not require or foster external connectivity.

Question 16

A _________ consists of a set of computers that interconnect by means of a relatively unsecure network and makes use of encryption and special protocols to provide security.

Accepted Answer

A VPN (Virtual Private Network) connects a set of computers over a relatively unsecure network (such as the internet) and uses encryption and special protocols to provide security. A proxy is a server that acts as an intermediary between a client and a server. UTM (Unified Threat Management) is a type of network security solution that combines multiple security features into a single appliance. Stateful inspection firewall is a type of firewall that keeps track of the state of network connections in order to apply security policies. None of these options fully meets the description given in the question except for VPN.

Question 17

The _________ is inserted between the premises network and the Internet to establish a controlled link and to erect an outer security wall or perimeter to protect the premises network from Internet-based attacks.

Accepted Answer

The answer of The _________ is inserted between the premises...

Question 18

A __________ firewall controls the traffic between a personal computer or workstation on one side and the Internet or enterprise network on the other side.

Accepted Answer

The answer of A __________ firewall controls the traffic between...

Question 19

Typical for SOHO applications, a __________ is a single router between internal and external networks with stateless or full packet filtering.

Accepted Answer

A screening router is the most common and appropriate choice for small office/home office (SOHO) applications. It provides a single point of entry and filters packets based on predetermined criteria. A single bastion (A) is a heavily fortified device that allows only a single access point to an internal network and is more suitable for larger organizations. Double bastion inline (B) is a configuration that adds an additional layer of security and is also more appropriate for larger organizations. A host-resident firewall (D) is a software-based firewall that runs on individual computers, but is not as efficient or secure as a screening router for SOHO applications.

Question 20

A __________ gateway sets up two TCP connections, one between itself and a TCP user on an inner host and one between itself and a TCP user on an outside host.

Accepted Answer

A circuit-level gateway sets up two TCP connections, one between itself and a TCP user on an inner host and one between itself and a TCP user on an outside host. This type of gateway controls the flow of data between the connections, and it does not examine the contents of the packets.

Quiz 9: Firewalls and Intrusion Prevention Systems