Deck 5: Packet Filtering

Question 1

An 8-bit value ____.

A) can be between 0 and 128
B) is between 00000001 and 11111111
C) must have at least 3 0s
D) is smaller than a 2-bit value

Answer 1

B

Question 2

A stateless filter compares the header data against its ____ and forwards each packet as a rule is found to match the specifics of that packet.

A) ACK flag
B) rule base
C) state table
D) log

Answer 2

B

Question 3

Telnet is most often assigned to use port ____.

A) 20
B) 21
C) 23
D) 80

Answer 3

C

Question 4

____ packet filters are useful for completely blocking traffic from a subnet or other network.

A) Stateless
B) Stateful
C) Personal
D) IP

Question 5

Packet-filter rules must account for all possible ports that a type of communication might use or for all variations within a particular protocol.

Question 6

The problem with fragmentation is that because the TCP or UDP port number is provided only at the beginning of a packet, it appears ____.

A) only in fragments numbered 0
B) only in fragments numbered above 0
C) in all fragments
D) in no fragments

Question 7

Some systems, like Windows and Linux, have built-in utilities that can filter packets on the TCP/IP stack of the server software.

Question 8

The ____ describes the length of the packet header in 32-bit words and is a 4 bit value.

A) Header checksum
B) type of service
C) total length
D) Internet header length

Question 9

One of the first IP header criteria you can filter on is the packet's ____.

A) length
B) ACK flag
C) source IP address
D) type of service

Question 10

Stateless packet filtering is more secure than stateful packet filtering.

Question 11

The header field that indicates whether the packet is a fragment is ____.

A) flags
B) options
C) protocol
D) destination IP address

Question 12

____ are stand-alone hardware devices with self-contained components thar are purpose built to filter out network traffic that does not conform to established rules.

A) Firewall appliances
B) Routers
C) Software firewalls
D) Operating systems

Question 13

Firewall ____ indicate whether a large number of echo messages are being received.

A) logs
B) state tables
C) alerts
D) errors

Question 14

ICMP message type ____ indicates that a faster route has been located.

A) 0
B) 3
C) 5
D) 6

Question 15

Enabling external hosts to connect to your public servers in the DMZ, but not to hosts in the internal LAN, is an example of filtering on the ____.

A) port number
B) protocol
C) source IP address
D) destination IP address

Question 16

TCP/IP includes ____ which are small manageable chucks of network data.

A) Folders
B) Frames
C) Messages
D) Packets

Question 17

Using TCP or UDP port numbers can help you filter a wide variety of information, including SMTP and POP e-mail messages, NetBIOS sessions, ____, and Network News Transfer Protocol (NNTP) newsgroup sessions.

A) DNS requests
B) ICMP messages
C) stateful transfers
D) Trojan horses

Question 18

Packet filters examine packet headers and packet data when applying allow and deny rules.

Question 19

One type of network protocol attack takes advantage of the ICMP Echo Request message type by flooding a target computer with ICMP echo requests.

Question 20

The header field that can contain a security field, which enables the sender to assign a classification level to the packet is ____.

A) flags
B) options
C) protocol
D) destination IP address

Question 21

A(n) ____________________ is hardware or software that blocks or allows transmission of information packets based on criteria such as port, IP address, and protocol.

Question 22

Match each item with a statement below.
a.packet
b.identification header field
c.router
d.ICMP
e.protocol header field
f.firewall appliances
g.stateful packet filtering
h.fragmentation
i.stateless packet filtering
16-bit value aids in the division of the data stream into packets of information.

Question 23

Filtering by TCP or UDP port number is commonly called port filtering or ____________________ filtering.

Question 24

Match each item with a statement below.
a.packet
b.identification header field
c.router
d.ICMP
e.protocol header field
f.firewall appliances
g.stateful packet filtering
h.fragmentation
i.stateless packet filtering
Originally developed as a means of enabling large packets to pass through early routers that had frame size limitations.
3. 16-bit value aids in the division of the data stream into packets of information.

Question 25

When Web services are offered outside the firewall, ____________________ traffic is prevented from reaching the internal networks via the implementation of some form of proxy access or DMZ architecture.

Question 26

The ____ flag tells a host to immediately terminate a connection.

A) RST
B) ACK
C) FIN
D) STP

Question 27

Match each item with a statement below.
a.packet
b.identification header field
c.router
d.ICMP
e.protocol header field
f.firewall appliances
g.stateful packet filtering
h.fragmentation
i.stateless packet filtering
Reviews packet header content and makes decisions on whether to allow or drop the packets based on whether a connection has actually been established between an external host and an internal one.

Question 28

Match each item with a statement below.
a.packet
b.identification header field
c.router
d.ICMP
e.protocol header field
f.firewall appliances
g.stateful packet filtering
h.fragmentation
i.stateless packet filtering
Identifies the IP protocol that was used in the data portion of the packet and should receive the data at its destination

Question 29

A stateless or stateful packet filter that supports active ____ must allow all traffic coming from TCP Port 20 as well as outbound traffic coming from ports above 1023.

A) TCP
B) ICMP
C) FTP
D) UDP

Question 30

Match each item with a statement below.
a.packet
b.identification header field
c.router
d.ICMP
e.protocol header field
f.firewall appliances
g.stateful packet filtering
h.fragmentation
i.stateless packet filtering
The most common packet filter.

Question 31

It is good practice to block ____ access to all internal servers from the public networks.

A) HTTP
B) Telnet
C) Simple Mail Transport Protocol
D) DNS

Question 32

The ____ is a structure for organizing Internet names associated with IP addresses.

A) Domain Name System (DNS)
B) Transport Control Protocol (TCP)
C) Hypertext Transfer Protocol (HTTP)
D) Simple Mail Transfer Protocol (SMTP)

Question 33

Packets requesting a connection have the ACK bit set to 0; those that are part of an ongoing connection have the ACK bit set to ____.

A) -1
B) 0
C) 1
D) 99

Question 34

A stateful filter has a ____, which is a list of current connections.

A) state table
B) rule base
C) rule list
D) state packet list

Question 35

The proper rule ____________________ ensures that the most resource-intensive actions are performed after the most restrictive ones, thereby reducing the number of packets that undergo intense scrutiny.

Question 36

Match each item with a statement below.
a.packet
b.identification header field
c.router
d.ICMP
e.protocol header field
f.firewall appliances
g.stateful packet filtering
h.fragmentation
i.stateless packet filtering
Packets that can be easily forged and used to redirect other communications.

Question 37

Match each item with a statement below.
a.packet
b.identification header field
c.router
d.ICMP
e.protocol header field
f.firewall appliances
g.stateful packet filtering
h.fragmentation
i.stateless packet filtering
Consists of two parts: the header and the data.

Question 38

Match each item with a statement below.
a.packet
b.identification header field
c.router
d.ICMP
e.protocol header field
f.firewall appliances
g.stateful packet filtering
h.fragmentation
i.stateless packet filtering
Standalone hardware and software devices that have self-contained components.

Question 39

Match each item with a statement below.
a.packet
b.identification header field
c.router
d.ICMP
e.protocol header field
f.firewall appliances
g.stateful packet filtering
h.fragmentation
i.stateless packet filtering
Maintains a record of the state of a connection when filtering packets.

Question 40

A single bit of information in a TCP packet -the ____________________ flag -indicates if a packet is requesting a connection or a connection has already been established.

Question 41

How should a firewall process fragmentation flags?

Question 42

What are ICMP packets?

Question 43

What are some of the e-mail protocols that may be used within an organization?

Question 44

How does a packet filter process IP header criteria?

Question 45

Explain the process of packet filtering by TCP or UDP port number.

Question 46

How can a stateful packet filter determine whether a session is beginning or ending?

Question 47

List and describe the types of hardware devices and software programs that perform packet filtering.

Question 48

Describe how a firewall can enable Web access.

Question 49

Describe best practices for testing firewall rules.

Question 50

Why might a small-scale software-only personal firewall cause problems in a network situation?