Deck 6: Security Technology: Access Controls, Firewalls, and VPNS

Question 1

​Accountability is the matching of an authenticated entity to a list of information assets and corresponding access levels.

Answer 1

False

Question 2

An extranet is a segment of the DMZ where no authentication and authorization controls are put into place.

Answer 2

False

Question 3

Packet-filtering firewalls scan network data packets looking for compliance with the rules of the firewall's database or violations of those rules.

Answer 3

True

Question 4

​Lattice-based access control is a form of access control in which users are assigned a matrix of authorizations for particular areas of access.

Question 5

Good policy and practice dictates that each firewall device, whether a filtering router, bastion host, or other firewall implementation, must have its own set of configuration rules.

Question 6

​Task-based controls are associated with the assigned role a user performs in an organization, such as a position or temporary assignment like project manager.

Question 7

The application layer proxy firewall is capable of functioning both as a firewall and an application layer proxy server.

Question 8

Good firewall rules include denying all data that is not verifiably authentic.

Question 9

The screened subnet protects the DMZ systems and information from outside threats by providing a network with intermediate security, which means the network is less secure than the general-public networks but more secure than the internal network.

Question 10

A firewall cannot be deployed as a separate network containing a number of supporting devices.

Question 11

Using an application firewall means the associated Web server must be exposed to a higher level of risk by placing it in the DMZ.

Question 12

Firewalls can be categorized by processing mode, development era, or structure.

Question 13

Authentication is the process of validating and verifying an unauthenticated entity's purported identity.

Question 14

All organizations with a router at the boundary between the organization's internal networks and the external service provider will experience improved network performance due to the complexity of the ACLs used to filter the packets.

Question 15

The DMZ can be a dedicated port on the firewall device linking a single bastion host.

Question 16

The ability of a router to restrict traffic to a specific service is an advanced capability and not considered a standard feature for most routers.

Question 17

When Web services are offered outside the firewall, HTTP traffic should be blocked from internal networks through the use of some form of proxy access or DMZ architecture.

Question 18

Syntax errors in firewall policies are usually difficult to identify.

Question 19

Some firewalls can filter packets by protocol name.

Question 20

Discretionary access control is an approach whereby the organization specifies use of resources based on the assignment of data classification schemes to resources and clearance levels to users.

Question 21

The static packet filtering firewall can react to an emergent event and update or create rules to deal with that event. _________________________

Question 22

A routing table tracks the state and context of each packet in the conversation by recording which station sent what packet and when. _________________________

Question 23

A common DMZ arrangement is a subnet firewall that consists of two or more internal bastion hosts behind a packet-filtering router, with each host protecting the trusted network. _________________________

Question 24

Firewalls operate by examining a data packet and performing a comparison with some predetermined logical rules. _________________________

Question 25

When a bastion host approach is used, the host contains two NICs, forcing all traffic to go through the device. _________________________

Question 26

A content filter is essentially a set of scripts or programs that restricts user access to certain networking protocols and Internet locations.

Question 27

Port Address Translation assigns non-routing local addresses to computer systems in the local area network and uses ISP-assigned addresses to communicate with the Internet on a one-to-one basis. _________________________

Question 28

A content filter, also known as a reverse firewall, is a network device that allows administrators to restrict access to external content from within a network.

Question 29

One of the biggest challenges in the use of the trusted computer base (TCB) is the existence of explicit channels. _________________________

Question 30

The primary disadvantage of stateful packet inspection firewalls is the additional processing required to manage and verify packets against the state table. _________________________

Question 31

Authentication is a mechanism whereby unverified entities who seek access to a resource provide a label by which they are known to the system. _________________________

Question 32

In static filtering, configuration rules must be manually created, sequenced, and modified within the firewall. _________________________

Question 33

Internet connections via dial-up lines are regaining popularity due to recent technological developments.

Question 34

Though not used as much in Windows environments, terminal emulation is still useful to systems administrators on Unix/Linux systems.

Question 35

The RADIUS system decentralizes the responsibility for authenticating each user by validating the user's credentials on the NAS server.

Question 36

The false reject rate describes the number of legitimate users who are denied access because of a failure in the biometric device. _________________________

Question 37

It is important that e-mail traffic reach your e-mail server and only your e-mail server.

Question 38

A VPN, used properly, allows use of the Internet as if it were a private network.

Question 39

Access control is achieved by means of a combination of policies, programs, and technologies. _________________________

Question 40

Even if Kerberos servers are subjected to denial-of-service attacks, a client can still request additional services.

Question 41

__________ firewalls examine every incoming packet header and can selectively filter packets based on header information such as destination address, source address, packet type, and other key information.

A) Packet-filtering
B) Application gateway 
C) Circuit gateway
D) MAC layer

Question 42

__________ access control is a form of __________ access control in which users are assigned a matrix of authorizations for particular areas of access.

A) lattice-based, discretionary
B) arbor-based, nondiscretionary 
C) arbor-based, discretionary
D) lattice-based, nondiscretionary

Question 43

__________ filtering requires that the firewall's filtering rules for allowing and denying packets are developed and installed with the firewall.

A) Dynamic
B) Static 
C) Stateful
D) Stateless

Question 44

The popular use for tunnel mode VPNs is the end-to-end transport of encrypted data. _________________________

Question 45

Secure VPNs use security protocols and encrypt traffic transmitted across unsecured public networks like the Internet. _________________________

Question 46

The filtering component of a content filter is like a set of firewall rules for Web sites, and is common in residential content filters. _________________________

Question 47

The restrictions most commonly implemented in packet-filtering firewalls are based on __________.

A) IP source and destination address 
B) Direction (inbound or outbound) 
C) TCP or UDP source and destination port requests 
D) All of the above

Question 48

In order to keep the Web server inside the internal network, direct all HTTP requests to the internal filtering firewall and configure the internal filtering router/firewall to allow only that device to access the internal Web server. _________________________

Question 49

Which of the following is not a major processing mode category for firewalls  

A) Packet-filtering firewalls
B) Application gateways 
C) Circuit gateways​
D) Router passthru

Question 50

The presence of external requests for Telnet services can indicate a potential attack. _________________________

Question 51

Traceroute, formally known as an ICMP Echo request, is used by internal systems administrators to ensure that clients and servers can communicate. _________________________

Question 52

Kerberos uses asymmetric key encryption to validate an individual user to various network resources. _________________________

Question 53

Most firewalls use packet header information to determine whether a specific packet should be allowed to pass through or should be dropped. _________________________

Question 54

Best practices in firewall rule set configuration state that the firewall device never allows administrative access directly from the public network. _________________________

Question 55

A(n) intranet ​is a segment of the DMZ where additional authentication and authorization controls are put into place to provide services that are not available to the general public. _________________________

Question 56

An attacker who suspects that an organization has dial-up lines can use a device called a(n) war dialer to locate the connection points. _________________________

Question 57

__________ inspection firewalls keep track of each network connection between internal and external systems.

A) Static
B) Dynamic 
C) Stateful
D) Stateless

Question 58

A __________ filtering firewall can react to an emergent event and update or create rules to deal with the event.

A) dynamic
B) static 
C) stateful
D) stateless

Question 59

SESAME, as described in RFC 4120, keeps a database containing the private keys of clients and servers-in the case of a client, this key is simply the client's encrypted password. _________________________

Question 60

When Web services are offered outside the firewall, SMTP traffic should be blocked from internal networks through the use of some form of proxy access or DMZ architecture. _________________________

Question 61

Configuring firewall policies is viewed as much as a(n) __________ as it is a(n) __________.

A) art, science
B) philosophy, skill 
C) skill, science
D) pain, necessity

Question 62

The ____________________ describes the number of legitimate users who are denied access because of a failure in the biometric device. This failure is known as a Type I error.

Question 63

Which of the following versions of TACACS is still in use  

A) TACACS
B) Extended TACACS 
C) TACACS+
D) All of the above

Question 64

Kerberos __________ provides tickets to clients who request services.

A) KDS
B) TGS 
C) AS
D) VPN

Question 65

In SESAME, the user is first authenticated to an authentication server and receives a token. The token is then presented to a privilege attribute server as proof of identity to gain a(n) __________.

A) VPN
B) ECMA 
C) ticket
D) PAC

Question 66

__________ and TACACS are systems that authenticate the credentials of users who are trying to access an organization's network via a dial-up connection.

A) RADIUS
B) RADIAL 
C) TUNMAN
D) IPSEC

Question 67

A(n) ____________________ contains a computer chip that can verify and validate several pieces of information instead of just a PIN.

Question 68

A(n) __________ is a private data network that makes use of the public telecommunication infrastructure, maintaining privacy through the use of a tunneling protocol and security procedures.

A) SVPN
B) VPN 
C) SESAME
D) KERBES

Question 69

Known as the ping service, ICMP is a(n) __________ and should be ___________.

A) essential feature, turned on to save money
B) common method for hacker reconnaissance, turned off to prevent snooping 
C) infrequently used hacker tool, turned off to prevent snooping
D) common method for hacker reconnaissance, turned on to save money

Question 70

In __________ mode, the data within an IP packet is encrypted, but the header information is not.

A) tunnel
B) transport 
C) public
D) symmetric

Question 71

The service within Kerberos that generates and issues session keys is known as __________.

A) VPN
B) KDC 
C) AS
D) TGS

Question 72

The proxy server is often placed in an unsecured area of the network or is placed in the __________ zone.

A) fully trusted
B) hot 
C) demilitarized
D) cold

Question 73

The __________ is an intermediate area between a trusted network and an untrusted network.

A) perimeter
B) DMZ 
C) domain
D) firewall

Question 74

The application layer proxy firewall is also known as a(n) __________.

A) application firewall
B) client firewall 
C) proxy firewall
D) All of the above

Question 75

Because the bastion host stands as a sole defender on the network perimeter, it is commonly referred to as the __________ host.

A) trusted
B) domain 
C) DMZ
D) sacrificial

Question 76

Telnet protocol packets usually go to TCP port __________, whereas SMTP packets go to port __________.

A) 23, 52
B) 80, 52 
C) 80, 25
D) 23, 25

Question 77

The primary benefit of a VPN that uses _________ is that an intercepted packet reveals nothing about the true destination system.

A) intermediate mode
B) tunnel mode 
C) reversion mode
D) transport mode

Question 78

In most common implementation models, the content filter has two components: __________.

A) encryption and decryption
B) filtering and encoding 
C) rating and decryption
D) rating and filtering

Question 79

__________ firewalls are designed to operate at the media access control sublayer of the data link layer of the OSI network model.

A) MAC layer
B) Circuit gateway 
C) Application gateway
D) Packet-filtering

Question 80

The dominant architecture used to secure network access today is the __________ firewall.

A) static
B) bastion 
C) unlimited
D) screened subnet