Question 1

Which is not a stage of forensics examination?

Accepted Answer

The four stages of forensics examination are collection, containment, analysis, and review. Containment involves identifying and isolating the affected systems or devices to prevent further damage or alteration, but it is not considered a stage in the actual examination process.

Question 2

The network administrator configures a VPN tunnel from a remote office to the main facility.A problem has occurred in the link.Which are the main steps the administrator should take to resolve the problem

Accepted Answer

A,C

Question 3

An attacker to a network is using social engineering to attack a network.This means which of the following

Accepted Answer

A,B

Question 4

A network administrator is concerned that the network is vulnerable to a denial-of-service attack.What steps should be taken to reduce this threat

Accepted Answer

Access lists can filter traffic and prevent unauthorized access. Blocking directed broadcasts can prevent certain types of DoS attacks. Preventing intrusions can help mitigate the risk of DoS attacks.

Question 5

Where might you place servers that require access from the public network?

Accepted Answer

Servers that require access from the public network should be placed in a DMZ, which stands for demilitarized zone. A DMZ is a separate network segment that sits between the public internet and a private network, providing an extra layer of security by isolating public-facing servers from sensitive data and resources on the private network. This helps to minimize the risk of attacks from the internet, such as DDoS, malware, and hacking attempts. By placing servers in the DMZ, you can control the incoming and outgoing traffic to and from them, and apply advanced security measures like firewalls, intrusion prevention systems, and VPNs. A DMZ can also be used for other public-facing infrastructure components, such as load balancers, web application firewalls, and reverse proxies.

Question 6

Why would a network administrator configure access lists to filter data packets on a routers interface?

Accepted Answer

Configuring access lists on a router's interface can be used to limit data packets that enter the network. This helps to enhance security and prevent unauthorized access, as well as manage network traffic by filtering out unwanted or unnecessary packets.

Question 7

When would a network administrator use L2TP?

Accepted Answer

A network administrator would use L2TP (Layer 2 Tunneling Protocol) when configuring a remote user's tunneling protocol. L2TP is commonly used for Virtual Private Network (VPN) connections and creates a secure tunnel for data to travel through. This ensures that remote users can securely access the network resources they need.

Question 8

What ACL entry would eliminate the effect of the implicit deny?

Accepted Answer

The implicit deny is the default behavior of an ACL, which denies all traffic that is not explicitly permitted. Therefore, to eliminate the effect of the implicit deny, we need to permit all traffic explicitly, as in choice A - "permit ip any any". This allows all types of IP traffic to pass through the ACL. However, it is important to note that this can sometimes be a security risk, as it allows all traffic, including malicious traffic, to pass through the network.

Question 9

The network administrator suspects that packet sniffing is being used to capture data packets in the network.The network administrator is using an SSH connection for all critical applications,and switches are being used on all network connections.Should the network administrator be concerned?

Accepted Answer

While an SSH connection is encrypted, the use of packet sniffing can still potentially reveal information about the type of traffic being transferred. Additionally, if someone with internal access is using packet sniffing, they may have access to the encryption keys used for the SSH connection. As such, the network administrator should be concerned and take steps to further secure the network.

Question 10

A dictionary attack is being used by an attacker to break into a network.What does this mean?

Accepted Answer

A dictionary attack involves using known passwords and many variations of upper- and lowercase combinations to crack a network's security. Therefore, choices A, B, and C are incorrect.

Question 11

Which of the following is a Linux-based port scanner that is now ported to most all operating systems?

Accepted Answer

NMAP is a widely used port scanner that has been ported to work on most operating systems, including Linux. SNMP, TRACE, and ICMP are not port scanners.

Question 12

What wireless security technology replaces WEP as the main security mechanism?

Accepted Answer

WPA (Wi-Fi Protected Access) replaces WEP as the main security mechanism as it offers better encryption and authentication methods, making it more difficult for unauthorized users to access the wireless network.

Question 13

There is a new virus reported on the Internet.What steps should the network administrator take to protect the network from the threat?

Accepted Answer

The most important step to protect the network from a new virus is to ensure that the antivirus software is installed with the most current version. This will help to detect and remove the virus from the infected systems and prevent it from spreading further. Converting all operating systems to Linux, using a personal firewall, or using firewall software that permits only trusted sites may provide some additional protection, but they are not sufficient to protect against all types of viruses and malware.

Question 14

The network management is concerned about intrusion problems.The network administrator recommends intrusion detection be placed on the network.This will do which of the following

Accepted Answer

Intrusion detection systems (IDS) are designed to monitor data packets passing through the network and identify potential attacks. This system will assist in identifying ongoing attacks and alerting the network management. Thus options B and D are correct. Option A is incorrect as it is not the intended purpose of an IDS. Option C is also incorrect as it does not relate to the function of an IDS.

Question 15

A network administrator is considering placing a firewall on an internal file server in the network.What is the purpose of the firewall,and is it important for the firewall to be stateful?

Accepted Answer

The purpose of placing a firewall on an internal file server is to protect it from outside threats while still allowing traffic to pass through. The firewall must be stateful to keep track of data packet flow and ensure that only authorized traffic is allowed. Hiding the file server from the outside is not the main purpose of the firewall in this scenario.

Quiz 12: Network Security