Question 1

Jack has been monitoring his network using a specialized application. In spite of using a secure SSID password, unauthentic users are gaining access to his WiFi network without his consent. John wants specific users to be able to connect to his wireless network. What should he do?

Accepted Answer

Enable MAC ID filtering to ensure that any unknown MAC IDs are restricted from gaining access to the network.
Key Takeaway: Most wireless access points contain some type of MAC ID filtering that allows the administrator only to permit access to computers that have wireless functionalities containing certain MAC IDs. To set up MAC address filtering, you must configure a list of clients that will be allowed to join the network. You need to obtain the MAC addresses of each client from its operating system or configuration utility and then designate those addresses as authorized in the wireless access point or router.

Question 2

Jack walks back to his desk and tries to logon to his computer. He receives a message that states he needs to contact his administrator because his account is locked. What could have been the probable cause?

Accepted Answer

In this case, the account lockout policy has been activated on his computer.
Key Takeaway: In an account lockout attack, the attacker attempts to lock out all user accounts, typically by failing login as many times as the threshold defined by the authentication system. For example, if users are locked out of their accounts after three failed login attempts, an attacker can lock out their account for them simply by failing login three times.

Question 3

What encryption standard should be used to protect 802.11g traffic?

Accepted Answer

WPA2 is the preferred security for wireless networks.
Key Takeaway: WPA2 should be used to encrypt wireless network traffic that needs to be secured. WEP should be avoided if at all possible as it has been proven to be very hackable.

Question 4

When communicating with a switch or router over a network and using the command line, which would be the best protocol to use?

Accepted Answer

SSH is the protocol that should be used.
Key takeaway: Although telnet works for using the command line on routers and switches, it is not secure and everything sent and received is unencrypted. The better choice is SSH, or Secure Shell, which is a secure protocol.

Question 5

When you block traffic by default and allow only what you've specifically granted, it is called:

Accepted Answer

Implicit deny is the state in which all traffic is blocked except what is explicitly allowed.
Key Takeaway: Implicit deny, which is also called default deny, is the most secure policy that can be implemented on a firewall. In this mode, a firewall will block all communication, except that which is explicitly allowed.

Question 6

What is the Predecessor to Transport Layer Security used to encrypt communication over the internet?

Accepted Answer

TLS succeeded SSL as the technology to encrypt Internet communications.
Key Takeaway: TLS, or Transport Layer Security, is replacing SSL, or Secure Socket Layers, as the method of encrypting traffic over the Internet. It has been a graceful transmission as they both use the HTTPS protocol and the client uses TLS as well as it used SSL with no manual intervention needed

Question 7

What is the type of cryptography used in TLS called?

Accepted Answer

TLS uses asymmetric encryption
Key Takeaway: Asymmetric cryptography makes use of public and private keys, which are paired but not identical. This is heavily used over the Internet as it makes interception of the key impossible.

Question 8

Which of the following can be categorized as multifactor authentication? (CHOOSE ALL THAT APPLY)

Accepted Answer

An ATM Card and Pin, as well as a code word and voice recognition software are both methods that can be categorized as multifactor authentication.
Key takeaway: Multifactor authentication is achieved by having two or more of the three methods of authentication. The three methods of authentication are something you know, something you have, and something you are. An example of something you know is your password, or username or anything that you can have knowledge of. So in the case of A, Username and Password, this is still Single-factor authentication because they are both something you know. The something you have could be your ATM Card, or something that you can physically hold. The last is something you are. These are the things that belong only to you, such as your fingerprints, or your retinas or your voices. Biometric devices are how we can authenticate via something you are so in the case of C, the thumb and forefinger print reader, these are both something you are, and so is E. For B, your ATM card is something you have, and the PIN is something you know, thereby achieving multifactor authentication.

Question 9

Alex, a technician, wishes to be notified if a denial of service attack is being attempted, without any action being taken to keep the attack from happening. What should Alex implement on his network to allow this?

Accepted Answer

A Host Based IDS would allow Alex, the technician to be notified if a denial of service attack was occurring while not taking action to prevent it.
Key takeaway: By definition an IDS is an Intrusion Detection System, meaning it will detect when intrusions or attacks are occurring, however will not take any actions to prevent them. The Intrusion Prevention Systems or IPSs will do this. The typical use for only having an IDS instead of an IPS is if the person intends to monitor the actions taken on that network connection via some means.

Question 10

Jeremy, a neighborhood IT was asked to install a home router for his friend Timothy. Timothy has requested that Jeremy make his home network as secure as possible. What level of encryption will best suit Timothy for his brand new router?

Accepted Answer

WPA2/ Enterprise is the stronger encryption and will better suit Timothy for his new router.
Key Takeaway: The initial and strongest take away from this should be that WEP is weak. This is the weakest level of encryption and nearly at all costs should be avoided. WEP2 does not exist. WPA2/Enterprise, also in many circles just considered "WPA2" is the strongest level of encryption currently available for modern home routers. While the setup for WPA2 in an enterprise setting can be more difficult to implement, it allows for a stronger level of security as it requires a RADIUS authentication server. WPA2/PSK uses a "Pre-Shared-Key" hence the PSK. This makes it handy for smaller networks; however it is still not the strongest level of encryption.

Question 11

Which authentication protocol relies on a Ticket Granting Ticket system for identity verification to network resources?

Accepted Answer

Kerberos is an authentication protocol that relies on a Ticket Granting Ticket System for identity verification to network resources.
Key takeaway: Kerberos utilizes a central server for authentication purposes. The way Kerberos works is a client will authenticate with an AS, or Authentication Server. The AS will then give the client a time stamped "Ticket" which the client will then present to the network resource and is then authenticated for the service being requested. The client and resource then negotiates session keys and establishes a secure connection with each other. This is a very simplified description, but essentially covers how it works. In essence, it is an authentication method utilized for mutual authentication typically in "client-server" networks.

Question 12

Spanning Tree Protocol is enabled on what kinds of network devices?

Accepted Answer

Spanning Tree Protocol is enabled on Switches.
Key takeaway: STP or Spanning Tree Protocol is enabled on Switches to prevent switching loops and anomalies called broadcast storms. By using many operations, STP attempts to prevent loops that have the potential to bring down the entire network. These loops can be caused by a number of things. An example would be if an individual should take a patch cable and plug both ends into the same switch to intentionally disrupt data traffic by forcing traffic in a loop.

Question 13

MAC address and packet filtering services can be provided for the network through the use of which devices?

Accepted Answer

A network-based firewall can provide MAC address filtering services
Key takeaway: A network-based Intrusion Prevention System is designed to monitor protocol activity for suspicious traffic and attempt to prevent a malicious attack. A Network based IDS is simply an Intrusion Detection System that is designed to monitor for the same thing, however is only designed to notify of, and not respond to, an identified threat or attack. A network based proxy server is designed to respond to requests for resources, but not necessarily access packet filtering, or MAC address filtering. The network based firewall is designed to do just that, and more.

Question 14

Where is the best location for Tanya, an avid computer gamer, to install a game server in her home network?

Accepted Answer

The best place for Tanya to install a game server in her home network is within the DMZ.
Key takeaway: The DMZ or "demilitarized zone" is an area designated in a network that is partially exposed to an unsecure network such as the Internet. The DMZ is typically sectioned off securely with firewalls, the outside firewall called the front-end firewall allowing those ports open that are necessary for services on the devices in the DMZ to function, and the interior firewall called the back-end firewall will have much more secure settings, only letting through that traffic that is essential between those devices and the internal network. The DMZ is designed to add an additional level of security only allowing an attacker only external access to that separate segment.

Question 15

Using the ACL on the firewall to block already known websites is describing what type of filtering?

Accepted Answer

Using the ACL on the firewall to block already known websites describes IP Filtering.
Key Takeaway: ACLs, or Access Control Lists can be used to control access via IP addresses, MAC addresses, FQDNs, and others, in this case, we know that we are blocking websites that are already known. Our first option doesn't work as web sites don't have MAC addresses to block. If we had used port filtering, then not just the malicious websites would be blocked, all websites using the blocked ports would be. Finally packet filtering in this sense would accomplish the same goal, however the more plausible and realistic option is IP filtering since we know the IP addresses of the websites we want to block.

Question 16

Nathan has just finished installing a brand new firewall blocking FTP traffic. Almost immediately after the installation, Nathan is receiving calls that everyone in the office is no longer able to access the internet. Which of the following BEST explains the reason for the outage?

Accepted Answer

Implicit deny blocking all traffic best explains the reason for outage.
Key takeaway: The firewall rule-set "implicit deny" states that anything that is not specifically outlined and identified as an "allow" rule, will be denied. In this case, the most likely explanation is that the new firewall had a default configuration of implicit deny. This is a common security feature that basically ensures that when plugged in, will immediately ensure a safer connection.

Question 17

What process prevents the private IP address of network nodes from being readily viewable from the public, while also allowing multiple devices with private IP addresses to access the internet through a single public IP address?

Accepted Answer

NAT is the process that prevents the private IP addresses of network nodes from being readily viewable, while also allowing multiple devices with private IP addresses to access the internet through a single public IP address.
Key takeaway: NAT or Network Address Translation is a process that translates internal and external IP addresses. NAT can be implemented as software, such as a NAT service on a router, or as hardware such as a cable modem or DSL router. There are other versions of NAT, Dynamic NAT utilizing an address pool to select the addresses to use, Static NAT for a one-to-one address assignment, and SNAT, or Stateful NAT that uses multiple routers to complete the NAT functions.

Quiz 23: Media Topologies