Question 1

Which two terms can be used to describe a decoy system that is purposely vulnerable for the sake of attracting attackers?
A)honeypot
B)pandora box
C)trap
D)lure

Accepted Answer

A honeypot is a decoy system that is purposely vulnerable for the sake of attracting attackers. A lure is a similar type of system that is used to attract attackers.

Question 2

Matching
Match each correct item with the statement below.
-A type ofintrusion detection that protects an entire network and is situatedat the edge of the network or in a network's protectiveperimeter,known as the DMZ (demilitarized zone).Here,itcan detect many types of suspicious traffic patterns.
A)acceptable use policy (AUP)
B)backdoor
C)HIDS (host-based intrusion detection system)
D)HIPS (host-based intrusion prevention system)
E)NIDS (network-based intrusion detection system)
F)proxy service
G)smurf attack
H)TEMPEST
I)virus
J)worm

Accepted Answer

The statement describes a network-based intrusion detection system (NIDS) which is situated at the edge of the network and can detect suspicious traffic patterns.

Answer: D 
 The statement describes a host-based intrusion prevention system (HIPS) which can protect a single host by identifying and blocking malicious activity.

Answer: F 
 A proxy service can act as an intermediary between a client and a server, providing an additional layer of protection and filtering out potentially harmful traffic.

Note: None of the other options match the description given.

Question 3

A _________________ form is a document that is used to ensure that employees are aware of the fact that their use of company equipment and accounts will be monitored and reviewed as needed for security purposes.

Accepted Answer

The answer of A _________________ form is a document that...

Question 4

In ACL statements,the any keyword is equivalent to using which wildcard mask?
A)255.255.255.255
B)0.0.0.0
C)0.0.255.255
D)255.255.0.0

Accepted Answer

The "any" keyword in ACL statements is equivalent to using the wildcard mask 255.255.255.255, which matches any IP address.

Question 5

What two types of agents are used to check compliance with network security policies?
A)dissolvable agent
B)temporary agent
C)persistent agent
D)permanent agent

Accepted Answer

Dissolvable agents are used for one-time checks and do not remain on the client system, making them suitable for checking compliance without installing permanent software. Persistent agents, on the other hand, remain installed on the client system to continuously monitor and ensure compliance with network security policies.

Question 6

What two options below are IDS implementations used to provide additional security on a network?
A)IIDS
B)PIDS
C)HIDS
D)NIDS

Accepted Answer

C) HIDS (Host-based Intrusion Detection System) is used on individual hosts (computers) to monitor and detect any suspicious activity or changes on that specific host. It works by analyzing system logs and comparing them against predefined rules or patterns of known attacks. HIDS can detect attacks that may not be seen by network-based IDS systems.
D) NIDS (Network-based Intrusion Detection System) is implemented at the network perimeter to monitor incoming and outgoing network traffic. It analyzes the packets of data for any signs of suspicious or malicious activity, using known patterns of attacks and predefined rules. NIDS can detect attacks that are targeting the whole network or multiple hosts within the network.

Question 7

What two terms describe a network of compromised computers that are then used to perform coordinated DDoS attacks without their owners' knowledge or consent?
A)reflectors
B)botnet
C)zombie army
D)repeaters

Accepted Answer

Botnet and zombie army both refer to networks of compromised computers controlled by a hacker or group of hackers to perform malicious tasks, such as DDoS attacks, without the knowledge or consent of the computer owners.

Question 8

What mode setting on a firewall makes the firewall transparent to surrounding nodes as if it's just part of the wire?
A)transparent wire mode
B)virtual access mode
C)pass-thru mode
D)virtual wire mode

Accepted Answer

Virtual wire mode is the mode setting on a firewall that makes the firewall transparent to surrounding nodes as if it's just part of the wire. This mode allows traffic to pass through the firewall without the need for IP addressing, making it a good choice for network environments that require a powerful and accurate firewall but do not want any network disruptions. Transparent wire mode is not a common mode setting for firewalls, while virtual access mode and pass-thru mode are not related to making the firewall transparent.

Question 9

Matching
Match each correct item with the statement below.
-A portion of the security policythat explains to users what they can and cannot do,andpenalties for violations.It might also describe how thesemeasures protect the network's security.
A)acceptable use policy (AUP)
B)backdoor
C)HIDS (host-based intrusion detection system)
D)HIPS (host-based intrusion prevention system)
E)NIDS (network-based intrusion detection system)
F)proxy service
G)smurf attack
H)TEMPEST
I)virus
J)worm

Accepted Answer

An acceptable use policy (AUP) is a portion of the security policy that explains to users what they can and cannot do, and penalties for violations. It might also describe how these measures protect the network's security.

Answer: E 
 A network-based intrusion detection system (NIDS) is a type of security software that monitors network traffic for signs of unauthorized access or suspicious activity.

Answer: D 
 A host-based intrusion prevention system (HIPS) is a type of security software that runs on an individual host or endpoint to identify and prevent malicious activity.

Answer: F 
 A proxy service is a type of server that acts as an intermediary between a client device and another server or service, allowing users to browse the internet anonymously or access restricted content.

Answer: H 
 TEMPEST is a term used to describe the potential for electromagnetic radiation from electronic equipment to be intercepted by a third party and used to collect sensitive information.

Question 10

Matching
Match each correct item with the statement below.
-A software security flaw that can allow unauthorizedusers to gain access to a system.Legacy systems areparticularly notorious for leaving these kinds of gaps in anetwork's overall security net.
A)acceptable use policy (AUP)
B)backdoor
C)HIDS (host-based intrusion detection system)
D)HIPS (host-based intrusion prevention system)
E)NIDS (network-based intrusion detection system)
F)proxy service
G)smurf attack
H)TEMPEST
I)virus
J)worm

Accepted Answer

A backdoor is a software security flaw that can allow unauthorized users to gain access to a system.

Answer: E
 NIDS (network-based intrusion detection system) is a type of security system that can detect and respond to unauthorized activity on a network.

Answer: D
 HIPS (host-based intrusion prevention system) is a type of security system that can prevent unauthorized access to a host or network.

Answer: I
 A virus is a type of malware that can infect a computer and cause damage or steal information.

Answer: J
 A worm is a type of malware that can spread through a network and cause damage or steal information.

Question 11

Matching
Match each correct item with the statement below.
-A type ofintrusion prevention that runs on a single computer,such as aclient or server,to intercept and help prevent attacks againstthat one host.
A)acceptable use policy (AUP)
B)backdoor
C)HIDS (host-based intrusion detection system)
D)HIPS (host-based intrusion prevention system)
E)NIDS (network-based intrusion detection system)
F)proxy service
G)smurf attack
H)TEMPEST
I)virus
J)worm

Accepted Answer

HIPS (host-based intrusion prevention system) is the correct match for the given statement.

Answer: C 
 HIDS (host-based intrusion detection system) is a related term, but it is not a perfect match for the statement. It detects intrusions rather than preventing them.

Question 12

Matching
Match each correct item with the statement below.
-A program that runs independently and travelsbetween computers and across networks.Although wormsdo not alter other programs as viruses do,they can carryviruses.
A)acceptable use policy (AUP)
B)backdoor
C)HIDS (host-based intrusion detection system)
D)HIPS (host-based intrusion prevention system)
E)NIDS (network-based intrusion detection system)
F)proxy service
G)smurf attack
H)TEMPEST
I)virus
J)worm

Accepted Answer

A worm is a program that can travel independently between computers and networks, unlike viruses that need to attach themselves to other programs.

Answer: I 
 Viruses, like worms, can also travel between computers and networks, but they need to attach themselves to other programs to spread.

Answer: G 
 A smurf attack is a type of DDoS attack that uses ICMP messages to flood a network. It is unrelated to the other choices.

Question 13

What feature on some network switches can be used to detect faked arp messages?
A)DHCP snooping
B)session monitoring
C)dynamic packet inspection
D)dynamic ARP inspection

Accepted Answer

Dynamic ARP inspection (DAI) is a feature on some network switches that can be used to detect fake Address Resolution Protocol (ARP) messages. DAI is used to validate ARP requests and responses based on a database of trusted IP to MAC address bindings known as the DHCP snooping binding database. DAI drops ARP packets that contain invalid IP-to-MAC address bindings. Therefore, it can help prevent certain types of attacks, such as ARP poisoning and spoofing. Session monitoring and dynamic packet inspection are not specifically designed for detecting faked ARP messages.

Question 14

Which two viruses below are examples of boot sector viruses?
A)Michelangelo
B)Stoned
C)Natas
D)Klez

Accepted Answer

Michelangelo and Stoned are both examples of boot sector viruses. They infect the boot sector of a hard drive or floppy disk and can activate when the system is booted up.

Question 15

The ________________ utility is a Windows console that is used to control what users do and how the system can be used.

Accepted Answer

The answer of The ________________ utility is a Windows console...

Question 16

Networks that use ________________,such as T-1 or DSL connections to the Internet,are vulnerable to eavesdropping at a building' s demarc (demarcation point),at aremote switching facility,or in a central office.

Accepted Answer

The answer of Networks that use ________________,such as T-1 or...

Question 17

A ______________ on a device attempts to alter management interfaces within the hardware to the point where the device is irreparable.

Accepted Answer

The answer of A ______________ on a device attempts to...

Question 18

Which option below is a standard created by the NSA that defines protections against radio frequency emanations?
A)EmSec
B)TEMPEST
C)RFGUARD
D)BlockSec

Accepted Answer

TEMPEST is a standard created by the NSA that defines protections against radio frequency emanations. EmSec and BlockSec are not standards related to radio frequency emanations, and RFGUARD is not a standard created by the NSA.

Question 19

The _____________ proxy server software is available for use on the UNIX / Linux platform.

Accepted Answer

The answer of The _____________ proxy server software is available...

Question 20

The process in which a person attempts to glean access for authentication information by posing as someone who needs that information is known as what option below?
A)mining
B)phishing
C)hunting
D)doxing

Accepted Answer

Phishing is a type of social engineering attack in which the attacker masquerades as a trustworthy entity in an attempt to obtain sensitive information, such as login credentials or credit card details, from the victim. The attacker typically tries to trick the victim into clicking a link or opening an attachment that leads to a fake login page or downloads malware. Mining usually refers to the process of extracting valuable resources from the earth, while hunting refers to searching for something with intent. Doxing is the practice of publicly revealing personal or sensitive information about a person without their consent.

Quiz 8: Network Risk Management

Which two terms can be used to describe a decoy system that is purposely vulnerable for the sake of attracting attackers?

Matching Match each correct item with the statement below. -A type ofintrusion detection that protects an entire network and is situatedat the edge of the network or in a network's protectiveperimeter,known as the DMZ (demilitarized zone) .Here,itcan detect many types of suspicious traffic patterns.

A _________________ form is a document that is used to ensure that employees are aware of the fact that their use of company equipment and accounts will be monitored and reviewed as needed for security purposes.

In ACL statements,the any keyword is equivalent to using which wildcard mask?

What two types of agents are used to check compliance with network security policies?

What two options below are IDS implementations used to provide additional security on a network?

What two terms describe a network of compromised computers that are then used to perform coordinated DDoS attacks without their owners' knowledge or consent?

What mode setting on a firewall makes the firewall transparent to surrounding nodes as if it's just part of the wire?

Matching Match each correct item with the statement below. -A portion of the security policythat explains to users what they can and cannot do,andpenalties for violations.It might also describe how thesemeasures protect the network's security.

Matching Match each correct item with the statement below. -A software security flaw that can allow unauthorizedusers to gain access to a system.Legacy systems areparticularly notorious for leaving these kinds of gaps in anetwork's overall security net.

Matching Match each correct item with the statement below. -A type ofintrusion prevention that runs on a single computer,such as aclient or server,to intercept and help prevent attacks againstthat one host.

Matching Match each correct item with the statement below. -A program that runs independently and travelsbetween computers and across networks.Although wormsdo not alter other programs as viruses do,they can carryviruses.

What feature on some network switches can be used to detect faked arp messages?

Which two viruses below are examples of boot sector viruses?

The ________________ utility is a Windows console that is used to control what users do and how the system can be used.

Networks that use ________________,such as T-1 or DSL connections to the Internet,are vulnerable to eavesdropping at a building' s demarc (demarcation point),at aremote switching facility,or in a central office.

A ______________ on a device attempts to alter management interfaces within the hardware to the point where the device is irreparable.

Which option below is a standard created by the NSA that defines protections against radio frequency emanations?

The _____________ proxy server software is available for use on the UNIX / Linux platform.

The process in which a person attempts to glean access for authentication information by posing as someone who needs that information is known as what option below?