Question 1

What kind of firewall can block designated types of traffic based on application data contained within packets?
A) stateful firewall
B) stateless firewall
C) content-filtering firewall
D) packet-filtering firewall

Accepted Answer

A content-filtering firewall is designed to examine the contents of packets and can block traffic based on specific application data contained within those packets. This allows for more granular control over the types of traffic allowed through the firewall.

Question 2

Which of the following is an example of proxy server software?
A) Squid
B) BIND
C) Snort
D) Apache

Accepted Answer

Squid is an example of proxy server software that allows clients to access resources on the internet. BIND is a domain name system (DNS) software, Snort is an intrusion detection and prevention system, and Apache is a web server software. Therefore, A) Squid is the best choice for this question.

Question 3

Of the three methods of access control (RBAC, DAC, and MAC), RBAC is the least secure of the options.

Accepted Answer

RBAC (Role-Based Access Control) is actually considered one of the most secure methods of access control. It limits access to resources based on the role and responsibility of individual users within an organization. DAC (Discretionary Access Control) and MAC (Mandatory Access Control) have their own strengths and weaknesses, but RBAC is not the least secure option.

Question 4

The storm-control command is a type of flood guard that is available on most major network switch vendor platforms.

Accepted Answer

The storm-control command is a type of flood guard that is available on most major network switch vendor platforms. It helps prevent network storms by monitoring broadcast, multicast, and unicast traffic levels and blocking traffic that exceeds predefined thresholds.

Question 5

On a Linux system, which command allows you to modify settings used by the built-in packet filtering firewall?
A) ipf
B) modfire
C) iptables
D) netwall

Accepted Answer

On a Linux system, the command that allows you to modify settings used by the built-in packet filtering firewall is "iptables". Option A ("ipf") is associated with the IPFilter firewall, which is not the default firewall on Linux systems. Option B ("modfire") and Option D ("netwall") are not valid commands.

Question 6

When utilizing Kerberos, an access granting ticket is the same as a key.

Accepted Answer

In Kerberos, an access granting ticket, known as a Ticket Granting Ticket (TGT), is used to obtain service tickets for accessing services, while a key (such as a session key) is used for encryption and ensuring secure communication. The TGT itself is not a key.

Question 7

You have been tasked with the configuration of a Juniper switch, and have been told to restrict the number of MAC addresses allowed in the MAC address table. What command should you use?
A) set max-mac
B) set total-macs
C) mac-address limit
D) mac-limit

Accepted Answer

The command "mac-limit" is used to restrict the number of MAC addresses allowed in the MAC address table on a Juniper switch. The command is entered in the configuration mode and can specify a limit for the entire switch or for a specific VLAN. The other options listed (set max-mac, set total-macs, and mac-address limit) are not valid commands for this purpose.

Question 8

What is a SIEM (Security Information and Event Management) system utilized for?
A) It is an advanced intrusion protection system with a GUI-frontend.
B) It is a system used to evaluate data from security devices and generate alerts.
C) It is an intellectual property protection software that prevents data links, and generates alerts.
D) It is a system that monitors security device hardware availability.

Accepted Answer

A SIEM system is utilized to evaluate data from security devices and generate alerts. It collects data from various sources such as firewalls, intrusion detection systems, and antivirus software and then analyzes the data for potential security threats, generating alerts when necessary.

Question 9

In order to prevent ports that are serving network hosts from being considered as best paths, what should be enabled to block BPDUs?
A) BPDU filter
B) BPDU guard
C) root guard
D) BPDU drop

Accepted Answer

BPDU guard is used to protect ports that are connected to end devices from receiving Bridge Protocol Data Units (BPDUs), which can prevent them from being considered as best paths in the network.

Question 10

When using Spanning Tree Protocol, what is the first step in selecting paths through a network?
A) STP must first select the root bridge, or master bridge.
B) STP examines the possible paths between all other bridges.
C) STP disables links that are not part of a shortest path.
D) STP begins to block BPDUs on non-designated ports.

Accepted Answer

The first step in selecting paths through a network using Spanning Tree Protocol is for STP to select the root bridge or the master bridge. Once the root bridge is selected, the network topology is mapped, and the shortest paths from each bridge to the root bridge are determined. The root bridge is the bridge with the lowest bridge ID, and it is responsible for propagating BPDUs (Bridge Protocol Data Units) that are used to identify the root bridge, calculate the path cost, and prevent loops in the network.

Question 11

The PEAP standard creates an encrypted TLS tunnel between the supplicant and the server before proceeding with the usual EAP process.

Accepted Answer

The statement is true. PEAP stands for Protected Extensible Authentication Protocol and it does create an encrypted TLS tunnel between the supplicant (client device) and the authentication server before carrying out the usual EAP (Extensible Authentication Protocol) process. This helps to secure the authentication process and protect user credentials from unauthorized access.

Question 12

By default, Active Directory is configured to use the Kerberos protocol, but can be configured to use LDAP or a combination of LDAP and Kerberos.

Accepted Answer

By default, Active Directory uses Kerberos protocol for authentication and can be configured to use LDAP or a combination of both LDAP and Kerberos.

Question 13

What is NOT a variable that an network access control list can filter traffic with?
A) The Network layer protocol used for the packet.
B) The Transport layer protocol used for the packet.
C) The source or destination TCP/UDP port number in the packet.
D) The operating system used by the source or destination device.

Accepted Answer

An access control list (ACL) can filter traffic based on network layer protocol (such as IP), transport layer protocol (such as TCP or UDP), and source/destination port numbers. However, it cannot filter traffic based on the operating system used by the source or destination device.

Question 14

A stateless firewall inspects each incoming packet to determine whether it belongs to a currently active connection.

Accepted Answer

A stateless firewall does not keep track of the state of active connections; it makes decisions based on the contents of each packet independently, without considering whether it is part of an existing connection.

Question 15

In ACL statements, using the "any" keyword is equivalent to using a wildcard mask of what value?
A) 0.0.0.0
B) 255.255.255.255
C) 255.255.0.0
D) 0.0.255.255

Accepted Answer

The "any" keyword in ACL (Access Control List) statements is equivalent to using a wildcard mask of 255.255.255.255, which means to match any IP address.

Question 16

The supplicant is an EAP entity responsible for requesting authentication, such as a smartphone or laptop.

Accepted Answer

The definition of a supplicant is accurate.

Question 17

The Spanning Tree Protocol operates at the Network layer of the OSI model.

Accepted Answer

The Spanning Tree Protocol operates at the Data Link layer (Layer 2) of the OSI model. This protocol is responsible for eliminating loops in switched Ethernet networks.

Question 18

Proxy servers and ACLs on network devices are examples of non-security devices with security features, while firewalls and IDS/IPS systems are the network's specialized security devices.

Accepted Answer

Proxy servers and ACLs are not exclusively designed for security purposes but have security features. Firewalls and IDS/IPS systems are specifically designed for network security.

Question 19

Which protocol designed to replace STP operates at Layer 3 of the OSI model?
A) Rapid Spanning Tree Protocol (RSTP)
B) Transparent Interconnection of Lots of Links (TRILL)
C) Shortest Path Bridging (SPB)
D) Multiple Spanning Tree Protocol (MSTP)

Accepted Answer

The answer of Which protocol designed to replace STP operates...

Question 20

User access to network resources falls into one of these two categories: 1) the privilege or right to execute, install, and uninstall software, and 2) permission to read, modify, create, or delete data files and folders.

Accepted Answer

User access to network resources indeed falls into these two categories, where the first pertains to software management capabilities and the second involves managing data in various forms.

Quiz 10: Security in Network Design

What kind of firewall can block designated types of traffic based on application data contained within packets?

Which of the following is an example of proxy server software?

Of the three methods of access control (RBAC, DAC, and MAC), RBAC is the least secure of the options.

The storm-control command is a type of flood guard that is available on most major network switch vendor platforms.

On a Linux system, which command allows you to modify settings used by the built-in packet filtering firewall?

When utilizing Kerberos, an access granting ticket is the same as a key.

You have been tasked with the configuration of a Juniper switch, and have been told to restrict the number of MAC addresses allowed in the MAC address table. What command should you use?

What is a SIEM (Security Information and Event Management) system utilized for?

In order to prevent ports that are serving network hosts from being considered as best paths, what should be enabled to block BPDUs?

When using Spanning Tree Protocol, what is the first step in selecting paths through a network?