Deck 6: Security Technology: Firewalls and Vpns

Question 1

The Cisco security kernel contains three component technologies: the Interceptor/Packet Analyzer,the Security Verification ENgine (SVEN),and Kernel Proxies.

Answer 1

True

Question 2

One method of protecting the residential user is to install a software firewall directly on the user's system.

Answer 2

True

Question 3

All organizations with an Internet connection have some form of a router at the boundary between the organization's internal networks and the external service provider.

Answer 3

False

Question 4

Firewall Rule Set 1 states that responses to internal requests are not allowed.

Question 5

The screened subnet protects the DMZ systems and information from outside threats by providing a network of intermediate security.

Question 6

There are limits to the level of configurability and protection that software firewalls can provide.

Question 7

Internal computers are always visible to the public network.

Question 8

Firewalls can be categorized by processing mode,development era,or structure.

Question 9

Packet filtering firewalls scan network data packets looking for compliance with or violation of the rules of the firewall's database.

Question 10

When Web services are offered outside the firewall,HTTP traffic should be blocked from internal networks through the use of some form of proxy access or DMZ architecture.

Question 11

Syntax errors in firewall policies are usually difficult to identify.

Question 12

The SMC Barricade residential broadband router does not have an intrusion detection feature.

Question 13

The DMZ cannot be a dedicated port on the firewall device linking a single bastion host.

Question 14

The firewall can often be deployed as a separate network containing a number of supporting devices.

Question 15

Good policy and practice dictates that each firewall device,whether a filtering router,bastion host,or other firewall implementation,must have its own set of configuration rules.

Question 16

A Web server is often exposed to higher levels of risk when placed in the DMZ than when it is placed in the untrusted network.

Question 17

A packet's structure is independent from the nature of the packet.

Question 18

Circuit gateway firewalls usually look at data traffic flowing between one network and another.

Question 19

The ability to restrict a specific service is now considered standard in most routers and is invisible to the user.

Question 20

The application firewall runs special software that acts as a proxy for a service request.

Question 21

The static packet filtering firewall allows only a particular packet with a particular source,destination,and port address to enter through the firewall._________________________

Question 22

Access control is achieved by means of a combination of policies,programs,and technologies._________________________

Question 23

Even if Kerberos servers are subjected to denial-of-service attacks,a client can request additional services.

Question 24

The Extended TACACS version uses dynamic passwords and incorporates two-factor authentication.

Question 25

Address grants prohibit packets with certain addresses or partial addresses from passing through the device._________________________

Question 26

It is important that e-mail traffic reach your e-mail server and only your e-mail server.

Question 27

When a dual-homed host approach is used,the bastion host contains four NICs._________________________

Question 28

Static filtering is common in network routers and gateways._________________________

Question 29

A VPN allows a user to turn the Internet into a private network.

Question 30

Though not used much in Windows environments,Telnet is still useful to systems administrators on Unix/Linux systems.

Question 31

On the client end,a user with Windows 2000 or XP can establish a VPN by configuring his or her system to connect to a VPN server.

Question 32

The outside world is known as the trusted network (e.g. ,the Internet)._________________________

Question 33

Circuit gateway firewalls prevent direct connections between one network and another._________________________

Question 34

First generation firewalls are application-level firewalls._________________________

Question 35

A content filter is essentially a set of scripts or programs that restricts user access to certain networking protocols and Internet locations.

Question 36

SOHO assigns non-routing local addresses to the computer systems in the local area network and uses the single ISP-assigned address to communicate with the Internet._________________________

Question 37

In addition to recording intrusion attempts,a(n)router can be configured to use the contact information to notify the firewall administrator of the occurrence of an intrusion attempt._________________________

Question 38

A content filter is technically a firewall.

Question 39

Internet connections via dial-up and leased lines are becoming more popular.

Question 40

Some firewalls can filter packets by protocol name.

Question 41

In order to keep the Web server inside the internal network,direct all HTTP requests to the proxy server and configure the internal filtering router/firewall only to allow the proxy server to access the internal Web server._________________________

Question 42

____ firewalls examine every incoming packet header and can selectively filter packets based on header information such as destination address,source address,packet type,and other key information.

A)Packet-filtering
B)Application gateways
C)Circuit gateways
D)MAC layer firewalls

Question 43

Best practices in firewall rule set configuration state that the firewall device is never accessible directly from the public network._________________________

Question 44

When Web services are offered outside the firewall,SMTP traffic should be blocked from internal networks through the use of some form of proxy access or DMZ architecture._________________________

Question 45

Most firewalls use packet header information to determine whether a specific packet should be allowed to pass through or should be dropped._________________________

Question 46

A benefit of a(n)dual-homed host is its ability to translate between many different protocols at their respective data link layers,including Ethernet,token ring,Fiber Distributed Data Interface,and asynchronous transfer mode._________________________

Question 47

The filtering component of a content filter is like a set of firewall rules for Web sites,and is common in residential content filters._________________________

Question 48

A ____ filtering firewall can react to an emergent event and update or create rules to deal with the event.

A)dynamic
B)static
C)stateful
D)stateless

Question 49

Kerberos uses asymmetric key encryption to validate an individual user to various network resources._________________________

Question 50

In a DMZ configuration,connections into the trusted internal network are allowed only from the DMZ bastion host servers._________________________

Question 51

The restrictions most commonly implemented in packet-filtering firewalls are based on ____.

A)IP source and destination address
B)Direction (inbound or outbound)
C)TCP or UDP source and destination port requests
D)All of the above

Question 52

An attacker who suspects that an organization has dial-up lines can use a device called a(n)war dialer to locate the connection points._________________________

Question 53

Traces,formally known as ICMP Echo requests,are used by internal systems administrators to ensure that clients and servers can communicate._________________________

Question 54

SESAME may be obtained free of charge from MIT._________________________

Question 55

Firewalls fall into ____ major processing-mode categories.

A)two
B)three
C)four
D)five

Question 56

____ filtering requires that the filtering rules governing how the firewall decides which packets are allowed and which are denied be developed and installed with the firewall.

A)Dynamic
B)Static
C)Stateful
D)Stateless

Question 57

The popular use for tunnel mode VPNs is the end-to-end transport of encrypted data._________________________

Question 58

The presence of external requests for Telnet services can indicate a potential attack._________________________

Question 59

A(n)perimeter is a segment of the DMZ where additional authentication and authorization controls are put into place to provide services that are not available to the general public._________________________

Question 60

Secure VPNs use security protocols and encrypt traffic transmitted across unsecured public networks like the Internet._________________________

Question 61

____ generates and issues session keys in Kerberos.

A)VPN
B)KDC
C)AS
D)TGS

Question 62

____ and TACACS are systems that authenticate the credentials of users who are trying to access an organization's network via a dial-up connection.

A)RADIUS
B)RADIAL
C)TUNMAN
D)IPSEC

Question 63

____ is the protocol for handling TCP traffic through a proxy server.

A)SOCKS
B)HTTPS
C)FTP
D)Telnet

Question 64

In ____ mode,the data within an IP packet is encrypted,but the header information is not.

A)tunnel
B)transport
C)public
D)symmetric

Question 65

A(n)____ is "a private data network that makes use of the public telecommunication infrastructure,maintaining privacy through the use of a tunneling protocol and security procedures."

A)SVPN
B)VPN
C)SESAME
D)KERBES

Question 66

____ firewalls are designed to operate at the media access control sublayer of the data link layer of the OSI network model.

A)MAC layer
B)Circuit gateway
C)Application gateways
D)Packet filtering

Question 67

ISA Server can use ____ technology.

A)PNP
B)Point to Point Tunneling Protocol
C)RAS
D)All of the above

Question 68

____ inspection firewalls keep track of each network connection between internal and external systems.

A)Static
B)Dynamic
C)Stateful
D)Stateless

Question 69

In SESAME,the user is first authenticated to an authentication server and receives a token.The token is then presented to a privilege attribute server as proof of identity to gain a(n)____.

A)VPN
B)ECMA
C)ticket
D)PAC

Question 70

Which of the following is a valid version of TACACS?

A)TACACS
B)Extended TACACS
C)TACACS+
D)All of the above

Question 71

Since the bastion host stands as a sole defender on the network perimeter,it is commonly referred to as the ____ host.

A)trusted
B)domain
C)single
D)sacrificial

Question 72

In most common implementation models,the content filter has two components: ____.

A)encryption and decryption
B)filtering and encoding
C)rating and decryption
D)rating and filtering

Question 73

The proxy server is often placed in an unsecured area of the network or is placed in the ____ zone.

A)fully trusted
B)hot
C)demilitarized
D)cold

Question 74

The application gateway is also known as a(n)____.

A)application-level firewall
B)client firewall
C)proxy firewall
D)All of the above

Question 75

Telnet protocol packets usually go to TCP port ____.

A)7
B)8
C)14
D)23

Question 76

The dominant architecture used to secure network access today is the ____ firewall.

A)static
B)bastion
C)unlimited
D)screened subnet

Question 77

Kerberos ____ provides tickets to clients who request services.

A)KDS
B)TGS
C)AS
D)VPN

Question 78

The ____ is an intermediate area between a trusted network and an untrusted network.

A)perimeter
B)DMZ
C)domain
D)firewall

Question 79

ICMP uses port ____ to request a response to a query and can be the first indicator of a malicious attack.

A)4
B)7
C)8
D)48

Question 80

In recent years,the broadband router devices that can function as packet-filtering firewalls have been enhanced to combine the features of ____.

A)UDPs
B)MACs
C)WANs
D)WAPs