Question 1

Configuring firewall policies is viewed as much as a(n) __________ as it is a(n) __________.

Accepted Answer

Configuring firewall policies requires both technical knowledge and a level of creativity to design policies that effectively balance security needs and business requirements. It involves both technical skill and a degree of artistry to create policies that sufficiently protect the network without impeding business operations.

Question 2

The ____________________ describes the number of legitimate users who are denied access because of a failure in the biometric device. This failure is known as a Type I error.

Accepted Answer

reject rate

Question 3

Which of the following versions of TACACS is still in use

Accepted Answer

Only TACACS+ is currently in use. TACACS and Extended TACACS are outdated and no longer recommended for use.

Question 4

Kerberos __________ provides tickets to clients who request services.

Accepted Answer

The Ticket Granting Service (TGS) in Kerberos provides tickets to clients who request access to services.

Question 5

In SESAME, the user is first authenticated to an authentication server and receives a token. The token is then presented to a privilege attribute server as proof of identity to gain a(n) __________.

Accepted Answer

In SESAME, after authentication, the user receives a token which is presented to a privilege attribute server to gain a Privilege Attribute Certificate (PAC).

Question 6

__________ and TACACS are systems that authenticate the credentials of users who are trying to access an organization's network via a dial-up connection.

Accepted Answer

RADIUS (Remote Authentication Dial-In User Service) and TACACS (Terminal Access Controller Access-Control System) are both protocols used for authentication, authorization, and accounting (AAA) of remote access users. They are commonly used for dial-up connections, but can also be used for other forms of remote access, such as VPNs. IPSEC (Internet Protocol Security) is a protocol used for securing network communication, but it does not handle user authentication. TUNMAN is not a recognized network protocol or system.

Question 7

A(n) ____________________ contains a computer chip that can verify and validate several pieces of information instead of just a PIN.

Accepted Answer

The answer of A(n) ____________________ contains a computer chip that...

Question 8

A(n) __________ is a private data network that makes use of the public telecommunication infrastructure, maintaining privacy through the use of a tunneling protocol and security procedures.

Accepted Answer

A VPN (virtual private network) is a private data network that uses public telecommunication infrastructure for secure communication. It maintains privacy using tunneling protocols and security procedures. SVPN is not a commonly used term, whereas SESAME and KERBES are authentication protocols and do not refer to a private data network.

Question 9

Known as the ping service, ICMP is a(n) __________ and should be ___________.

Accepted Answer

ICMP is commonly used by hackers for reconnaissance and can be used to perform Denial of Service (DoS) attacks. Disabling the ICMP service can help prevent this type of attack.

Question 10

In __________ mode, the data within an IP packet is encrypted, but the header information is not.

Accepted Answer

The answer of In __________ mode, the data within an...

Question 11

The service within Kerberos that generates and issues session keys is known as __________.

Accepted Answer

The Key Distribution Center (KDC) is the service within Kerberos that generates and issues session keys.

Question 12

The proxy server is often placed in an unsecured area of the network or is placed in the __________ zone.

Accepted Answer

The demilitarized zone (DMZ) is an area of the network that sits between the internal trusted network and the untrusted external network. The proxy server is often placed in the DMZ to provide secure access for external clients while protecting the internal network.

Question 13

The __________ is an intermediate area between a trusted network and an untrusted network.

Accepted Answer

A DMZ (demilitarized zone) is a network segment that is typically placed between a trusted internal network and an untrusted external network (such as the Internet). It is designed to provide an additional layer of security by restricting network access between the two networks and limiting the potential impact of a security breach in the DMZ. Perimeter is a general term that can refer to the boundaries of any network or security architecture, and doesn't specifically denote an intermediate area between trusted and untrusted networks. A domain is a grouping of computers and devices that share a common set of rules and policies. A firewall is a device or software that is used to monitor and control network traffic, but it is not necessarily an intermediate area between trusted and untrusted networks.

Question 14

The application layer proxy firewall is also known as a(n) __________.

Accepted Answer

The answer of The application layer proxy firewall is also...

Question 15

Because the bastion host stands as a sole defender on the network perimeter, it is commonly referred to as the __________ host.

Accepted Answer

A bastion host is often called a "sacrificial" host because it is exposed to potential attacks and is designed to withstand them, protecting the internal network.

Question 16

Telnet protocol packets usually go to TCP port __________, whereas SMTP packets go to port __________.

Accepted Answer

Telnet protocol packets usually go to TCP port 23, whereas SMTP packets go to port 25. Therefore, the correct choice is D.

Question 17

The primary benefit of a VPN that uses _________ is that an intercepted packet reveals nothing about the true destination system.

Accepted Answer

Tunnel mode encrypts the entire original IP packet (including the header) and encapsulates it within another IP packet, which serves as the new header. This ensures that an intercepted packet reveals nothing about the true destination system. Intermediate mode and reversion mode are not valid options for VPNs. Transport mode encrypts only the data portion of the original IP packet, leaving the header unencrypted.

Question 18

In most common implementation models, the content filter has two components: __________.

Accepted Answer

The content filter typically has two primary components: rating and filtering. The rating component is responsible for classifying content based on its appropriateness (e.g., G, PG, R) while the filtering component is responsible for preventing access to inappropriate content based on the rating classification. Therefore, the best choice would be D) rating and filtering.

Question 19

__________ firewalls are designed to operate at the media access control sublayer of the data link layer of the OSI network model.

Accepted Answer

MAC layer firewalls are also known as bridge firewalls and operate at the data link layer of the OSI model, examining MAC addresses in network traffic. They can filter packets based on source and destination MAC addresses, making them effective for controlling network traffic within a single LAN or between multiple LANs.

Question 20

The dominant architecture used to secure network access today is the __________ firewall.

Accepted Answer

The screened subnet firewall, also known as DMZ (demilitarized zone) firewall, is the dominant architecture used to secure network access because it provides a layer of protection between the internal network and the external network. It uses a screening router that filters incoming traffic and separates the internal network from the DMZ, where public-facing servers are placed. This architecture allows for secure remote access and protects the internal network from external attacks. Static, bastion, and unlimited firewalls are less common and have limitations in terms of security and scalability.

Quiz 6: Security Technology: Access Controls, Firewalls, and VPNS

Configuring firewall policies is viewed as much as a(n) as it is a(n) .