Examwise for Ciw Security Professional: Exam 1d0-470

ExamWise For CIW Security Professional Exam 1D0-470 Online testing provided by BeachFrontQuizzer, Inc. Friendswood, Te...

Author: Chad M. Bayer

129 downloads 492 Views 687KB Size Report

This content was uploaded by our users and we assume good faith they have the permission to share this book. If you own the copyright to this book and it is wrongfully on our website, we offer a simple DMCA procedure to remove your content from our site. Start by pressing the button below!
Report copyright / DMCA form

DOWNLOAD PDF

ExamWise For CIW Security Professional Exam 1D0-470

Online testing provided by BeachFrontQuizzer, Inc. Friendswood, Texas 77546

Author Chad M. Bayer Published by TotalRecall Publications, Inc. 1103 Middlecreek Friendswood, TX 77546 281-992-3131

NOTE: THIS IS BOOK IS GUARANTEED: See details at www.TotalRecallPress.com

TotalRecall Publications, Inc. A division of BeachFront Quizzer, Inc. Copyright 2003 by TotalRecall Publications, Inc. All rights reserved. Printed in the United States of America. Except as permitted under the United States Copyright Act of 1976, No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means electronic or mechanical or by photocopying, recording, or otherwise without the prior permission of the publisher. The views expressed in this book are solely those of the author, and do not represent the views of any other party or parties. Printed in United States of America Printed and bound by Data Duplicators of Houston Texas Printed and bound by Lightning Source, Inc. in the USA and UK ISBN: 1-59095-695-8 UPC: 6-43977-43470-8 The sponsoring editor is Bruce Moran and the production supervisor is Corby Tate.

Worldwide eBook distribution by:

This publication is not sponsored by, endorsed by, or affiliated with ProSoft, ProSoft Training, www.ciwcertified.com or Certified Internet Webmaster. The CIW®, CIWCertified.com®, CIW™, and all other Certified Internet Webmaster logos, trademarks, or registered trademarks are the property of CIW in the United States and certain other countries. All other trademarks are trademarks of their respective owners. Throughout this book, trademarked names are used. Rather than put a trademark symbol after every occurrence of a trademarked name, we used names in an editorial fashion only and to the benefit of the trademark owner. No intention of infringement on trademarks is intended. Disclaimer Notice: Judgments as to the suitability of the information herein for purchaser’s purposes are necessarily the purchaser’s responsibility. BeachFront Quizzer, Inc. and TotalRecall Publications, Inc. extends no warranties, makes no representations, and assumes no responsibility as to the accuracy or suitability of such information for application to the purchaser’s intended purposes or for consequences of its use except as described in the Guarantee.

Dedication This book is dedicated to my father, Carl Bayer. Thanks for always being there.

Chad M. Bayer

ExamWise¥ For CIW£ Security Professional BY Chad M. Bayer

About the Authors Chad Bayer has been working in the computer industry for over 6 years and is currently CIW Certifiable. His background is quite varied in regards to CIW and is interested in both the engineering of software and hardware. Chad is working towards his computer engineering degree at the University of Texas in Dallas.

About the Book Part of the TotalRecall: IT Question Book Series For CIW certification, this new Self Help and Interactive Exam Study Aid is now available for candidate’s preparing to sit the CIW 1D0-470 Operating Systems Security, Network Security and Firewalls, and Security Auditing, Attacks and Threat Analysis exam. The book covers the information associated with each of the exam topics in detail and includes information found in no other book. Using the book will help readers determine if they are ready for the CIW 1D0-470 certification exam. This book provides Questions, Answers, and Explanations that explain the concepts in a clear and easy-to-understand manner. This book is designed for the Experienced user that desires to build their confidence by refreshing their knowledge of CIW material.

About Online Testing www.bfqonline.com practice tests include Self Help and Interactive Exam Study Aid with instant feed back for simulated and adaptive testing with detailed explanations. Register your book purchase at www.TotalRecallPress.com or send an email to [email protected] for your free 30 day Registration. Located in the back of this book are the instructions for obtaining your Free 30 day Registration for the online practice test. The Registration is good for access to only the CIW Fundamentals Exam.

NOTE: THIS BOOK IS GUARANTEED: See details at www.TotalRecallPress.com

1D0-470 Exam Preparation For Operating Systems Security, Network Security and Firewalls, and Security Auditing, Attacks and Threat Analysis CIW Certification Home Page

http://www.ciwcertified.com/default.asp CIW Certification Path Information

http://www.ciwcertified.com/certifications/program.asp?comm=home&llm=3 CIW Exam 1D0-470 guide location

http://www.ciwcertified.com/exams/1d0470.asp?comm=home&llm=4 Note:

Exam subject matter and skills being measured are subject to change at any time without prior notice and at CIW’s sole discretion

Certification Credit Upon successful completion of this exam, you will achieve CIW Professional status. This exam also provides elective credit towards x CIW Certified Instructor status x Master CIW Administrator certification

Exam Audience Network server administrators, firewall administrators, systems administrators, application developers, and IT security officers. Candidates should have the following prerequisites completed before taking the exam: CIW Foundations, CIW Server Administrator, and CIW Internetworking Professional or equivalent skills.

Prerequisites Candidates must complete the following prerequisites prior to sitting the CIW Security Professional exam: x CIW Certification Agreement. This simple on-line agreement needs to be completed only once, but is necessary for CIW Certification Central to ship CIW certificates (CIW Associate, CIW Professional or Master CIW certificates) to candidates who pass the required CIW certification exam(s). x CIW Associate certificate. Passing the CIW Foundations exam 1D0-410 is required for those candidates to achieve CIW Professional, Master CIW Administrator, and/or Master CIW Web Site Manager certification designation. x CIW Server Administrator. Passing the CIW Server Administrator exam 1D0450 is required for those candidates seeking Master CIW Administrator certification designation. x CIW Internetworking Professional. Passing the CIW Internetworking Professional exam 1D0-460 is required for those candidates seeking Master CIW Administrator certification designation. x No candidate is restricted from taking the CIW Security Professional exam. However, it is highly recommended that candidates take (and pass) CIW exams in sequential order. x CIW Security Professional certification is a requirement for Master CIW Administrator certification.

Exam Information Students who have taken CIW courses are encouraged to continue their studies and apply their new skills before attempting the 1D0-470 CIW Security Professional exam. Skills taught in CIW Security Professional courses are best reinforced with real-world experience. The candidate is responsible for learning the content and achieving a passing score on the 1D0-470 CIW Security Professional exam. Comments regarding course delivery should be referred to the training company that delivered the course. Any 1D0-470 CIW Security Professional exam will be subject to the following: x Each delivery of the exam will include a random selection of 60 items. x The examination period will be 75 minutes.

To achieve a passing score on the 1D0-470 CIW Security Professional exam, candidates must: x Correctly answer at least 45 of the 60 questions to achieve a total score of 75% or greater, x Answer at least 70% of the questions correctly in each individual module.

Module Number of Items Network Security and Firewalls 22 Operating Systems Security 16 Security Auditing, Attacks and Threat Analysis 22 Each exam item offers four solutions or distracters. Exam candidates must select the one best solution for each item.

Skills Measured A CIW Security Professional implements security policy, identifies security threats, and develops countermeasures using firewall systems and attack-recognition technologies. This individual is responsible for managing the deployment of e-business transaction and payment security solutions. Skills measured in the 1D0-470 exam include but are not limited to: Network perimeter security and elements of an effective security policy. Encryption, including the three main encryption methods used in internetworking. Universal guidelines and principles for effective network security, as well as guidelines to create effective specific solutions. Security principles and security attack identification. Firewall types and common firewall terminology. Firewall system planning including levels of protection. Network firewall deployment. Network security including industry security evaluation criteria and guidelines used to determine three security levels. Mechanisms used to implement security systems, tools to evaluate key security parameters, techniques for security accounts, and threats to Windows 2000 and UNIX systems. Permissions identification, assignment and usage, system defaults, and security commands. System patches and fixes including application of system patches. Windows 2000 Registry modifications, including lockdown and removal of services for effective security in Windows 2000 and Linux. Security auditing principles, security auditor's chief duties and network risk factor assessment. Security auditing and discovery processes, audit plans, and network-based and hostbased discovery software. Penetration strategies and methods, including identification of potential attacks. User activities baseline, log analysis, and auditing of various activities. Security policy compliance and assessment reports. Operating system add-ons, including personal firewalls and native auditing.

Table of Contents XI

Table of Contents About the Authors..................................................................................................... IV About the Book ...........................................................................................................V About Online Testing..................................................................................................V 1D0-470 Exam Preparation For ................................................................................ VI Chapter 1: Operating System Security

1

Chapter 2: Network Security and Firewalls

109

Chapter 3: Security Auditing, Attacks, and Threat Analysis

239

Money Back Book Guarantee

349

Registration Instructions

350

Operating System Security 1

Chapter 1: Operating System Security 1. Nathan has been tasked to increase the security of his corporate Web site, www.iPromotions.com. Using a standard definition of security, realistically, what is Nathan's goal? A. Reduce vulnerabilities of www.iPromotions.com B. Eliminate threats to www.iPromotions.com C. Eliminate vulnerabilities of www.iPromotions.com D. Reduce threats to www.iPromotions.com

2 Chapter 1

1. Nathan has been tasked to increase the security of his corporate Web site, www.iPromotions.com. Using a standard definition of security, realistically, what is Nathan's goal? *A. Reduce vulnerabilities of www.iPromotions.com B. Eliminate threats to www.iPromotions.com C. Eliminate vulnerabilities of www.iPromotions.com D. Reduce threats to www.iPromotions.com

Explanation: Nathan has no control over threats to www.iPromotions.com, and he can only reduce to the greatest extent possible the vulnerability of data and resources. In virtually all cases, some limited vulnerabilities will always exist, and even Microsoft's Website has been hacked. OS Security, Lesson 1: Security Principles


2. Tonya develops and hosts Websites. She notices that her larger clients are concerned about security. She carefully listens to what her clients want and has made a list of their security concerns: 1) Authentication, 2) Access control, 3) Data confidentiality, 4) Data integrity & 5) Nonrepudiation. When Tonya uses file, directory or Website permissions based on user login, which security concern is Tonya addressing? A. Authentication B. Access control C. Data confidentiality D. Data integrity E. Nonrepudiation

4 Chapter 1

2. Tonya develops and hosts Websites. She notices that her larger clients are concerned about security. She carefully listens to what her clients want and has made a list of their security concerns: 1) Authentication, 2) Access control, 3) Data confidentiality, 4) Data integrity & 5) Nonrepudiation. When Tonya uses file, directory or Website permissions based on user login, which security concern is Tonya addressing? A. Authentication *B. Access control C. Data confidentiality D. Data integrity E. Nonrepudiation

Explanation: Access control allows Tonya to grant different users and groups the appropriate file and directory permissions. OS Security, Lesson 1: Security Principles


3. Tonya develops and hosts Websites. She notices that her larger clients are concerned about security. She carefully listens to what her clients want and has made a list of their security concerns: 1) Authentication, 2) Access control, 3) Data confidentiality, 4) Data integrity & 5) Nonrepudiation. When Tonya ensures that Website customers get a digital receipt for their purchase, which security concern is Tonya addressing? A. Authentication B. Access control C. Data confidentiality D. Data integrity E. Nonrepudiation

6 Chapter 1

3. Tonya develops and hosts Websites. She notices that her larger clients are concerned about security. She carefully listens to what her clients want and has made a list of their security concerns: 1) Authentication, 2) Access control, 3) Data confidentiality, 4) Data integrity & 5) Nonrepudiation. When Tonya ensures that Website customers get a digital receipt for their purchase, which security concern is Tonya addressing? A. Authentication B. Access control C. Data confidentiality D. Data integrity *E. Nonrepudiation

Explanation: Nonrepudiation is the security device that proves that a transaction took place. A digital receipt is one of the mechanisms that provides such proof. OS Security, Lesson 1: Security Principles


4. Tonya develops and hosts Websites. She notices that her larger clients are concerned about security. She carefully listens to what her clients want and has made a list of their security concerns: 1) Authentication, 2) Access control, 3) Data confidentiality, 4) Data integrity & 5) Nonrepudiation. Many of Tonya's customers upload information to their Website's by using FTP. Tonya requires that customers provide a username and password for this access. What security concern is Tonya addressing? A. Authentication B. Access control C. Data confidentiality D. Data integrity E. Nonrepudiation

8 Chapter 1

4. Tonya develops and hosts Websites. She notices that her larger clients are concerned about security. She carefully listens to what her clients want and has made a list of their security concerns: 1) Authentication, 2) Access control, 3) Data confidentiality, 4) Data integrity & 5) Nonrepudiation. Many of Tonya's customers upload information to their Website's by using FTP. Tonya requires that customers provide a username and password for this access. What security concern is Tonya addressing? *A. Authentication B. Access control C. Data confidentiality D. Data integrity E. Nonrepudiation

Explanation: Tonya is requiring user authentication. OS Security, Lesson 1: Security Principles


5. Tonya develops and hosts Websites. She notices that her larger clients are concerned about security. She carefully listens to what her clients want and has made a list of their security concerns: 1) Authentication, 2) Access control, 3) Data confidentiality, 4) Data integrity & 5) Nonrepudiation.S Tonya provides data encryption using SSL for credit card orders. Which security concern is Tonya addressing? A. Authentication B. Access control C. Data confidentiality D. Data integrity E. Nonrepudiation

10 Chapter 1

5. Tonya develops and hosts Websites. She notices that her larger clients are concerned about security. She carefully listens to what her clients want and has made a list of their security concerns: 1) Authentication, 2) Access control, 3) Data confidentiality, 4) Data integrity & 5) Nonrepudiation. Tonya provides data encryption using SSL for credit card orders. Which security concern is Tonya addressing? A. Authentication B. Access control *C. Data confidentiality D. Data integrity E. Nonrepudiation

Explanation: Tonya is using encryption to provide data confidentiality. OS Security, Lesson 1: Security Principles


6. Tonya develops and hosts Websites. She notices that her larger clients are concerned about security. She carefully listens to what her clients want and has made a list of their security concerns: 1) Authentication, 2) Access control, 3) Data confidentiality, 4) Data integrity & 5) Nonrepudiation. When customers order via one of Tonya's Websites, Tonya uses SSL to provide a hash on each data packet so that if it is hijacked or altered the hash will not match up to the rest of the data in the packet. What security concern is Tonya addressing? A. Authentication B. Access control C. Data confidentiality D. Data integrity E. Nonrepudiation

12 Chapter 1

6. Tonya develops and hosts Websites. She notices that her larger clients are concerned about security. She carefully listens to what her clients want and has made a list of their security concerns: 1) Authentication, 2) Access control, 3) Data confidentiality, 4) Data integrity & 5) Nonrepudiation. When customers order via one of Tonya's Websites, Tonya uses SSL to provide a hash on each data packet so that if it is hijacked or altered the hash will not match up to the rest of the data in the packet. What security concern is Tonya addressing? A. Authentication B. Access control C. Data confidentiality *D. Data integrity E. Nonrepudiation

Explanation: Tonya is providing data integrity when she ensures that the data is not hijacked, modified, or corrupted in transit. OS Security, Lesson 1: Security Principles


7. DigitalKnowledge provides online training in the USA. They are expanding to the UK. They need regulatory approval for their security model if they are to provide online, confidential, counter-terrorist training for NATO Forces. Which security evaluation criteria will DigitalKnowledge most likely be judged against? A. TCSEC B. Common Criteria C. IPSEC D. ITSEC, BS 7799

8. DigitalKnowledge provides online training in the USA. They are expanding to the UK. They need regulatory approval for their security model if they are to provide online, confidential, counter-terrorist training for NATO Forces. Which security evaluation criteria did DigitalKnowledge most likely meet in the USA? A. TCSEC B. Common Criteria C. IPSEC D. ITSEC, BS 7799

14 Chapter 1

7. DigitalKnowledge provides online training in the USA. They are expanding to the UK. They need regulatory approval for their security model if they are to provide online, confidential, counter-terrorist training for NATO Forces. Which security evaluation criteria will DigitalKnowledge most likely be judged against? A. TCSEC B. Common Criteria C. IPSEC *D. ITSEC, BS 7799

Explanation: Security is often judged by national or regional standards. the European Information technology Security Evaluation criteria (ITSEC) document British Security 7799 (BS 7799) would likely apply in this case. For more information, visit www.itsec.gov.uk. OS Security, Lesson 1: Security Principles

8. DigitalKnowledge provides online training in the USA. They are expanding to the UK. They need regulatory approval for their security model if they are to provide online, confidential, counter-terrorist training for NATO Forces. Which security evaluation criteria did DigitalKnowledge most likely meet in the USA? *A. TCSEC B. Common Criteria C. IPSEC D. ITSEC, BS 7799

Explanation: DigitalKnowledge would most likely have been judged by the Trusted Computer Systems Evaluation Criteria (TCSEC)/DOD Standard 5200.28 in the USA. OS Security, Lesson 1: Security Principles


9. Peter has invented a revolutionary sterling engine that is super fuel efficient. He designed the engine of a NT 4.0 workstation. What is the highest level of TCSEC security that he can reach on his NT workstation? A. D B. C1 C. C2 D. B1 E. A1

10. Peter has invented a revolutionary sterling engine that is super fuel efficient. He designed the engine of a NT 4.0 workstation. What is the highest level of TCSEC security that he can reach if he migrates to AT &T System V Unix with MLS? A. D B. C1 C. C2 D. B1 E. A1

16 Chapter 1

9. Peter has invented a revolutionary sterling engine that is super fuel efficient. He designed the engine of a NT 4.0 workstation. What is the highest level of TCSEC security that he can reach on his NT workstation? A. D B. C1 *C. C2 D. B1 E. A1

Explanation: TCSEC level C2 requires the user to log on to the network with a password and it requires an audit mechanism. OS Security, Lesson 1: Security Principles

10. Peter has invented a revolutionary sterling engine that is super fuel efficient. He designed the engine of a NT 4.0 workstation. What is the highest level of TCSEC security that he can reach if he migrates to AT &T System V Unix with MLS? A. D B. C1 C. C2 *D. B1 E. A1

Explanation: AT&T System V Unix with MLS is capable of labeled security protection, level B1, in which users are isolated into cells. OS Security, Lesson 1: Security Principles


11. Peter has invented a revolutionary sterling engine that is super fuel efficient. He designed the engine of a NT 4.0 workstation. What is the highest level of TCSEC security that he can reach in a peer to peer network with Windows 98 peers? A. D B. C1 C. C2 D. B1 E. A1

18 Chapter 1

11. Peter has invented a revolutionary sterling engine that is super fuel efficient. He designed the engine of a NT 4.0 workstation. What is the highest level of TCSEC security that he can reach in a peer to peer network with Windows 98 peers? *A. D B. C1 C. C2 D. B1 E. A1

Explanation: The presumption here is that some of the data may be stored on the Windows 9X computers. Security level D, minimal security, applies to MS-DOS and Windows 9X. OS Security, Lesson 1: Security Principles


12. Peter has invented a revolutionary sterling engine that is super fuel efficient and that runs on alternative fuel. The US Government classifies his work as vital to the National Defense in light of Mideast oil disruptions. The government migrates his work to a Honeywell SCOMP computer and applies the highest TCSEC security level to this computer. What security level was applied? A. Verified Design B. Security Domains C. Structured protection D. Labeled security protection E. Discretionary access security.

20 Chapter 1

12. Peter has invented a revolutionary sterling engine that is super fuel efficient and that runs on alternative fuel. The US Government classifies his work as vital to the National Defense in light of Mideast oil disruptions. The government migrates his work to a Honeywell SCOMP computer and applies the highest TCSEC security level to this computer. What security level was applied? *A. Verified Design B. Security Domains C. Structured protection D. Labeled security protection E. Discretionary access security.

Explanation: Level A1, verified design would apply, not level B3, security domains, nor level B2, structured protection, nor level B1 labeled security protection, nor level C2 discretionary access control. OS Security, Lesson 1: Security Principles


13. The CIO of IVertical.com wants you to prepare a slide on Win2k TCSEC level C2 features in order to brief some potential angel investors. Which bullet points would you include in your PowerPoint slide? (Choose 3): A. Varied security protection isolating users into cells. B. Discretionary access control C. Object reuse is controlled by users D. Identification and authentication of users E. Auditing

14. Linus proposes that the new Linux kernel should be tested against the Common Criteria. What advantages might Linus cite? A. This is supported by ISO and is a worldwide standard B. It unifies ITSEC and TCSEC C. It provides a standardized way to describe security requirements and evaluate security features of products and systems. D. It is optimized for the evaluation of Internet security systems.

22 Chapter 1

13. The CIO of IVertical.com wants you to prepare a slide on Win2k TCSEC level C2 features in order to brief some potential angel investors. Which bullet points would you include in your PowerPoint slide? (Choose 3): A. Varied security protection isolating users into cells. *B. Discretionary access control C. Object reuse is controlled by users *D. Identification and authentication of users *E. Auditing

Explanation: Object reuse must be controlled by the operating system so that any time a program or process uses memory or some other object, then the object's previous contents may not be determined by the new owner. OS Security, Lesson 1: Security Principles

14. Linus proposes that the new Linux kernel should be tested against the Common Criteria. What advantages might Linus cite? *A. This is supported by ISO and is a worldwide standard *B. It unifies ITSEC and TCSEC *C. It provides a standardized way to describe security requirements and evaluate security features of products and systems. D. It is optimized for the evaluation of Internet security systems.

Explanation: The Common Criteria is supported by ISO and is a worldwide standard, unifying ITSEC and TCSEC, and providing a standardized way to describe security requirements and evaluate security features of products and systems. OS Security, Lesson 1: Security Principles


15. Brenda is in charge of network security at the International Monetary Fund (IMF). In light of advances in computer hacking she would like to evaluate her network's security against the Common Criteria. What three key concepts are used to determine the correct security product and system for the IMF? A. Security Baseline (SB) B. Protection Profile (PP) C. Security Target (ST) D. Target of Evaluation (TOE) E. Security Descriptor (SD)

16. Brenda is in charge of network security at the International Monetary Fund (IMF). In light of advances in computer hacking she would like to evaluate her network's security against the Common Criteria. What document should she prepare to describe the IMF's security needs? A. Security Baseline (SB) B. Protection Profile (PP) C. Security Target (ST) D. Target of Evaluation (TOE) E. Security Descriptor (SD)

24 Chapter 1

15. Brenda is in charge of network security at the International Monetary Fund (IMF). In light of advances in computer hacking she would like to evaluate her network's security against the Common Criteria. What three key concepts are used to determine the correct security product and system for the IMF? A. Security Baseline (SB) *B. Protection Profile (PP) *C. Security Target (ST) *D. Target of Evaluation (TOE) E. Security Descriptor (SD)

Explanation: The PP, ST and TOE are the key concepts of the CC. OS Security, Lesson 1: Security Principles

16. Brenda is in charge of network security at the International Monetary Fund (IMF). In light of advances in computer hacking she would like to evaluate her network's security against the Common Criteria. What document should she prepare to describe the IMF's security needs? A. Security Baseline (SB) *B. Protection Profile (PP) C. Security Target (ST) D. Target of Evaluation (TOE) E. Security Descriptor (SD)

Explanation: She would write the IMF's Protection Profile (PP) of security needs. OS Security, Lesson 1: Security Principles


17. Brenda is in charge of network security at the International Monetary Fund (IMF). In light of advances in computer hacking she would like to evaluate her network's security against the Common Criteria. She has prepared a Protection Profile (PP) describing the IMF's security needs. Several security consulting firms have bid on upgrading IMF's security to meet the IMF PP. The security consulting firms each submit a CC document describing the claims of the products and methods that they would use to meet the PP. What document would they each submit? A. Security Baseline (SB) B. Profile Response (PR) C. Security Target (ST) D. Target of Evaluation (TOE) E. Security Descriptor (SD)

26 Chapter 1

17. Brenda is in charge of network security at the International Monetary Fund (IMF). In light of advances in computer hacking she would like to evaluate her network's security against the Common Criteria. She has prepared a Protection Profile (PP) describing the IMF's security needs. Several security consulting firms have bid on upgrading IMF's security to meet the IMF PP. The security consulting firms each submit a CC document describing the claims of the products and methods that they would use to meet the PP. What document would they each submit? A. Security Baseline (SB) B. Profile Response (PR) *C. Security Target (ST) D. Target of Evaluation (TOE) E. Security Descriptor (SD)

Explanation: The consultants or the manufacturers of security products would submit a Security Target (ST) that would make security claims that would be evaluated against the Protection Profile (PP). OS Security, Lesson 1: Security Principles


18. Brenda is in charge of network security at the International Monetary Fund (IMF). In light of advances in computer hacking she would like to evaluate her network's security against the Common Criteria. She wrote the IMF's Protection Profile (PP) of security needs. The Balboa Group submitted the lowest bid to meet this PP and described how they would meet the PP with a Security Target (ST) document. They install a pilot, demonstration system and the IMF chooses an accredited third-party security evaluation consulting company to rigorously test the security of the IMF's proposed computer network. What is the pilot system to be tested called? A. Security Baseline (SB) B. Protection Profile (PP) C. Security Target (ST) D. Target of Evaluation (TOE) E. Security Descriptor (SD)

28 Chapter 1

18. Brenda is in charge of network security at the International Monetary Fund (IMF). In light of advances in computer hacking she would like to evaluate her network's security against the Common Criteria. She wrote the IMF's Protection Profile (PP) of security needs. The Balboa Group submitted the lowest bid to meet this PP and described how they would meet the PP with a Security Target (ST) document. They install a pilot, demonstration system and the IMF chooses an accredited third-party security evaluation consulting company to rigorously test the security of the IMF's proposed computer network. What is the pilot system to be tested called? A. Security Baseline (SB) B. Protection Profile (PP) C. Security Target (ST) *D. Target of Evaluation (TOE) E. Security Descriptor (SD)

Explanation: The IT product or system to be tested is called the Target of Evaluation (TOE). OS Security, Lesson 1: Security Principles


19. Access Data and Data Mine merge their operations. A new Chief Security officer is hired. He would like to apply three conventional broad classifications of security levels to categorize an asset's need for security. The security levels he uses are Low, Medium and High. At what level(s) would a computer be secured against theft and virus software used? A. Low B. Medium C. High D. All of the above

30 Chapter 1

19. Access Data and Data Mine merge their operations. A new Chief Security officer is hired. He would like to apply three conventional broad classifications of security levels to categorize an asset's need for security. The security levels he uses are Low, Medium and High. At what level(s) would a computer be secured against theft and virus software used? A. Low B. Medium C. High *D. All of the above

Explanation: At the low level and above a computer is secured against theft and virus software is used. Computers at the low security level are in a secure location and do not contain or access sensitive data. OS Security, Lesson 1: Security Principles


20. Access Data and Data Mine merge their operations. A new Chief Security officer is hired. He would like to apply three conventional broad classifications of security levels to categorize an asset's need for security. The security levels he uses are Low, Medium and High. He applies the High classification to computers that access highly sensitive or valuable information and/or are in a high risk situation. What additional measures does he take that he does not take at the Medium level? (Choose 2): A. Countermeasures and protections are enabled at the operating system. B. Auditing is enabled C. File permissions and account policies are implemented. D. The operating system is stripped down to the bare minimum. E. Additional strict countermeasures are enabled in the OS.

32 Chapter 1

20. Access Data and Data Mine merge their operations. A new Chief Security officer is hired. He would like to apply three conventional broad classifications of security levels to categorize an asset's need for security. The security levels he uses are Low, Medium and High. He applies the High classification to computers that access highly sensitive or valuable information and/or are in a high risk situation. What additional measures does he take that he does not take at the Medium level? (Choose 2): A. Countermeasures and protections are enabled at the operating system. B. Auditing is enabled C. File permissions and account policies are implemented. *D. The operating system is stripped down to the bare minimum. *E. Additional strict countermeasures are enabled in the OS.

Explanation: At the High level, the operating system is stripped down to the bare minimum and additional strict countermeasures and protections are enabled. At the medium level, auditing, file permissions, account policies and OS countermeasures and protections are enabled. OS Security, Lesson 1: Security Principles


21. Access Data and Data Mine merge their operations. A new Chief Security officer is hired. He would like to apply three conventional broad classifications of security levels to categorize an asset's need for security. The security levels he uses are Low, Medium and High. Which of the following conditions would be indicative of a Medium security classification? (Choose 3): A. Computer holds or accesses corporate data. B. Computer is a high-risk situation. C. Computer is accessed by multiple users D. Accidental damage of information must be avoided E. Computer is in a secure location

22. Access Data and Data Mine merge their operations. A new Chief Security officer is hired. He would like to categorize security mechanisms as specific or wide. Which of the following are specific mechanisms? (Choose 2): A. Digital signatures, encipherment, access control and authentication mechanisms. B. Data integrity and traffic padding mechanisms. C. Trusted functionality and security labels. D. Audit trails E. Security recovery

34 Chapter 1

21. Access Data and Data Mine merge their operations. A new Chief Security officer is hired. He would like to apply three conventional broad classifications of security levels to categorize an asset's need for security. The security levels he uses are Low, Medium and High. Which of the following conditions would be indicative of a Medium security classification? (Choose 3): *A. Computer holds or accesses corporate data. B. Computer is a high-risk situation. *C. Computer is accessed by multiple users *D. Accidental damage of information must be avoided E. Computer is in a secure location

Explanation: A computer would be classified as a Medium risk if the computer holds or accesses corporate data, is accessed by multiple users, or needs protection from the accidental deletion or compromise of data. OS Security, Lesson 1: Security Principles

22. Access Data and Data Mine merge their operations. A new Chief Security officer is hired. He would like to categorize security mechanisms as specific or wide. Which of the following are specific mechanisms? (Choose 2): *A. Digital signatures, encipherment, access control and authentication mechanisms. *B. Data integrity and traffic padding mechanisms. C. Trusted functionality and security labels. D. Audit trails E. Security recovery

Explanation: Specific security measures include digital signatures, encipherment, access control, authentication data integrity and traffic padding mechanisms. OS Security, Lesson 1: Security Principles


23. Access Data and Data Mine merge their operations. A new Chief Security officer is hired. He would like to categorize security mechanisms as specific or wide. Which of the following are wide mechanisms? (Choose all that apply): A. Digital signatures, encipherment, access control and authentication mechanisms. B. Data integrity and traffic padding mechanisms. C. Trusted functionality and security labels. D. Audit trails E. Security recovery

24. NT 4.0, unlike previous versions of Windows received a C2 security rating without disabling networking. Which NT security component lead to this C2 rating without the previous qualification? A. Discretionary access control B. Object reuse controlled by the OS C. Mandatory log on. D. Auditing E. OS control of access to objects

36 Chapter 1

23. Access Data and Data Mine merge their operations. A new Chief Security officer is hired. He would like to categorize security mechanisms as specific or wide. Which of the following are wide mechanisms? (Choose all that apply): A. Digital signatures, encipherment, access control and authentication mechanisms. B. Data integrity and traffic padding mechanisms. *C. Trusted functionality and security labels. *D. Audit trails *E. Security recovery

Explanation: Trusted functionality, security labels, audit trails, and security recovery are wide security mechanisms. OS Security, Lesson 1: Security Principles

24. NT 4.0, unlike previous versions of Windows received a C2 security rating without disabling networking. Which NT security component lead to this C2 rating without the previous qualification? A. Discretionary access control B. Object reuse controlled by the OS *C. Mandatory log on. D. Auditing E. OS control of access to objects

Explanation: Mandatory log on for NT 4.0, allows a C2 security rating without disabling networking. OS Security, Lesson 1: Security Principles


25. Sally accidentally deletes Ethyl's NT user account. As soon as she realizes her mistake, she recreates Ethyl's account with the same name and puts Ethyl back into the global groups in which she belongs. Although the account name is the same, Etthyl does not have the individually assigned user rights she once had. This is because her _______ changed. (Fill in the blank). A. SID B. Access token C. Security descriptor D. ACL E. ACE

26. At the end of the work day, Mary adds Susan to the Managers group and calls Susan to tell her the good news. Susan attempts to access the "Manager Bonus Plan" folder and still gets an "access denied" message. The next day Susan can get to the "Manager Bonus Plan" folder and sees that the bonus is paid in company stock. Why couldn't Susan see this information the day before? A. The SID was updated based on the Julian day. B. The Access Token was refreshed when Susan logged in again. C. Replication had to refresh the security descriptor of the target folder D. Susan's ACE in the ACL was incorrectly entered by Mary.

38 Chapter 1

25. Sally accidentally deletes Ethyl's NT user account. As soon as she realizes her mistake, she recreates Ethyl's account with the same name and puts Ethyl back into the global groups in which she belongs. Although the account name is the same, Etthyl does not have the individually assigned user rights she once had. This is because her _______ changed. (Fill in the blank). *A. SID B. Access token C. Security descriptor D. ACL E. ACE

Explanation: Ethyl's SID changed. The SID uniquely identifies a user, group or computer. OS Security, Lesson 1: Security Principles

26. At the end of the work day, Mary adds Susan to the Managers group and calls Susan to tell her the good news. Susan attempts to access the "Manager Bonus Plan" folder and still gets an "access denied" message. The next day Susan can get to the "Manager Bonus Plan" folder and sees that the bonus is paid in company stock. Why couldn't Susan see this information the day before? A. The SID was updated based on the Julian day. *B. The Access Token was refreshed when Susan logged in again. C. Replication had to refresh the security descriptor of the target folder D. Susan's ACE in the ACL was incorrectly entered by Mary.

Explanation: The access token is a user's "ticket' to access resources. It is only updated when to user logs on to the network. OS Security, Lesson 1: Security Principles


27. NT 4.0 uses security descriptors for every object. Based on the security descriptors, what can be determined about any NT object? (Choose 3); A. Object owner B. Which users and groups have rights to access an object C. What types of access by what users or groups will be audited D. Outstanding access tokens.

28. Marty wants to add a smart card reader to the NT logon process. Which dll will he replace? A. logon.dll B. sspi.dll C. sam.dll D. msgina.dll

40 Chapter 1

27. NT 4.0 uses security descriptors for every object. Based on the security descriptors, what can be determined about any NT object? (Choose 3); *A. Object owner *B. Which users and groups have rights to access an object *C. What types of access by what users or groups will be audited D. Outstanding access tokens.

Explanation: The security descriptor contains the SID of the object owner (and the POSIX group of the object owner). The security descriptor also includes the Discretionary ACL which enumerates which users and groups have rights to access an object and the System ACL which determines what types of access by which users or groups will be audited. OS Security, Lesson 1: Security Principles

28. Marty wants to add a smart card reader to the NT logon process. Which dll will he replace? A. logon.dll B. sspi.dll C. sam.dll *D. msgina.dll

Explanation: The default msgina.dll may be replaced by a stronger, customized gina.dll authentication module. OS Security, Lesson 1: Security Principles


29. Which of the following is responsible for creating a user's access token? A. LSA B. SAM C. Gina D. SSPI

30. Frank install NT 4.0 on his new computer using a combination DVD/CD Rom drive and a burned copy of NT 4.0 server. One file does not copy from the CD, schannel.dll. Which of the following won't Frank be able to do? A. Logon B. Use SSL C. Use Internet Explorer D. Audit file and folder access

42 Chapter 1

29. Which of the following is responsible for creating a user's access token? *A. LSA B. SAM C. Gina D. SSPI

Explanation: The Local security Authority creates a user's access token. OS Security, Lesson 1: Security Principles

30. Frank install NT 4.0 on his new computer using a combination DVD/CD Rom drive and a burned copy of NT 4.0 server. One file does not copy from the CD, schannel.dll. Which of the following won't Frank be able to do? A. Logon *B. Use SSL C. Use Internet Explorer D. Audit file and folder access

Explanation: Secure Channel dll, schannel.dll is required for SSL. OS Security, Lesson 1: Security Principles


31. Vince cannot logon to a domain controller. He gets the message that he has been logged on using cached user credentials. He checks his network cable and NIC. the NIC has a green light. he can ping the domain controller. His coworkers can logon to the domain controller. What might be the problem? A. The domain controller's server service is stopped B. Vince's workstation's server service is stopped C. Vince's workstation's netlogon service is stopped D. The domain controller's netlogon service is stopped

32. Tammy is doing an emergency repair on a NT Server in which the user accounts database has been corrupted. What does Tammy want to replace? A. The SAM B. Gina.dll C. schannel.dll D. LSA

44 Chapter 1

31. Vince cannot logon to a domain controller. He gets the message that he has been logged on using cached user credentials. He checks his network cable and NIC. the NIC has a green light. he can ping the domain controller. His coworkers can logon to the domain controller. What might be the problem? A. The domain controller's server service is stopped B. Vince's workstation's server service is stopped *C. Vince's workstation's netlogon service is stopped D. The domain controller's netlogon service is stopped

Explanation: The server's netlogon service must be working if others can logon. Vince's workstation's netlogon service may be stopped OS Security, Lesson 1: Security Principles

32. Tammy is doing an emergency repair on a NT Server in which the user accounts database has been corrupted. What does Tammy want to replace? *A. The SAM B. Gina.dll C. schannel.dll D. LSA

Explanation: The SAM or Security Accounts Manager is the actual database of users and their credentials that is stored in the registry. OS Security, Lesson 1: Security Principles


33. Don wants to protect his Linux system from viruses. He should (Choose 3): A. Regularly verify modification times and checksums of system executables. B. Read protect system level directories C. First install executables in /tmp or /var/tmp for testing purposes D. Virus check applications before installing E. Write protect system-level directories

34. What mechanism has been used to hack Unix/Linux systems? A. Buffer underruns B. Buffer overflows C. Split horizon D. Poison reverse E. Registry hacks

46 Chapter 1

33. Don wants to protect his Linux system from viruses. He should (Choose 3): *A. Regularly verify modification times and checksums of system executables. B. Read protect system level directories C. First install executables in /tmp or /var/tmp for testing purposes *D. Virus check applications before installing *E. Write protect system-level directories

Explanation: System level directories should be write-protected. Executables should not be installed in temp directories that are writable by ordinary users. OS Security, Lesson 1: Security Principles

34. What mechanism has been used to hack Unix/Linux systems? A. Buffer underruns *B. Buffer overflows C. Split horizon D. Poison reverse E. Registry hacks

Explanation: As there is no registry to hack in Unix/Linux, hackers have focused on buffer overflows in individual applications. OS Security, Lesson 1: Security Principles


35. Mark is providing password guidelines to his users. He tells his users to select passwords that use at least three of the following four types of content: (Choose 3) A. Non-printing characters B. Capital letters C. Lowercase letters D. Numbers E. Non-alphanumeric characters, such as punctuation

36. Which of the following are strong passwords? (Choose 2): A. redbone23 B. Bama4ME! C. 2Short!? D. good-man-is-hard-to-find

48 Chapter 1

35. Mark is providing password guidelines to his users. He tells his users to select passwords that use at least three of the following four types of content: (Choose 3) A. Non-printing characters *B. Capital letters *C. Lowercase letters *D. Numbers *E. Non-alphanumeric characters, such as punctuation Explanation: Complex passwords are a key element of security. OS Security, Lesson 2: Account Security

36. Which of the following are strong passwords? (Choose 2): A. redbone23 *B. Bama4ME! *C. 2Short!? D. good-man-is-hard-to-find

Explanation: A strong password should have three of the following four elements: uppercase, lowercase, numbers and non-alphanumeric characters. OS Security, Lesson 2: Account Security


37. Joe is a hacker attempting to access a Linux box. He wants to gain ________ access to the ________ file. A. Root, /etc/passwd B. Admin, /etc/passwd C. Supervisor, \etc\passwd D. Root, \etc\passwd E. Admin, \etc\passwd

38. Kelly wants to check which new accounts have been added each day to her NT Dealers domain. What commands can she incorporate into a batch file to automate this process, if she uses Task Scheduler? A. net accounts /synch B. net accounts > users.txt C. net users > users.txt D. net users >> users.txt

50 Chapter 1

37. Joe is a hacker attempting to access a Linux box. He wants to gain ________ access to the ________ file. *A. Root, /etc/passwd B. Admin, /etc/passwd C. Supervisor, \etc\passwd D. Root, \etc\passwd E. Admin, \etc\passwd

Explanation: Joe would like to gain Root access to the /etc/passwd file. OS Security, Lesson 2: Account Security

38. Kelly wants to check which new accounts have been added each day to her NT Dealers domain. What commands can she incorporate into a batch file to automate this process, if she uses Task Scheduler? A. net accounts /synch B. net accounts > users.txt *C. net users > users.txt *D. net users >> users.txt

Explanation: net users > users.txt dumps the user accounts into a text file. net users >> users.txt appends the latest user accounts list to the existing text file which contains older user account lists. OS Security, Lesson 2: Account Security


39. Sam wants to provide higher security on the Administrator account. Which are good ways to do this? A. Rename the administrator account B. Disable the Administrator account C. Use a strong password on the administrator account and change it on a regular basis D. Have administrators log in with a regular user account when they don't need to exercise administrative privileges E. Shadow the administrator account

40. Jill wants to change the minimum password length for the Corp domain. Where would she go to do this? A. User Manager for Domains, Policies - Account B. User Manager, Policies - Account C. Server Manager D. Account Manager

52 Chapter 1

39. Sam wants to provide higher security on the Administrator account. Which are good ways to do this? *A. Rename the administrator account B. Disable the Administrator account *C. Use a strong password on the administrator account and change it on a regular basis *D. Have administrators log in with a regular user account when they don't need to exercise administrative privileges E. Shadow the administrator account

Explanation: The administrator account should be renamed, protected by a strong password that is changed on a regular basis, and it should only be used when needed. OS Security, Lesson 2: Account Security

40. Jill wants to change the minimum password length for the Corp domain. Where would she go to do this? *A. User Manager for Domains, Policies - Account B. User Manager, Policies - Account C. Server Manager D. Account Manager

Explanation: User Manager for Domains, Policies - Account is where the account policies are set. OS Security, Lesson 2: Account Security


41. Miranda wants to insure that users change their passwords and have unique passwords. Which Account Policy settings should she change? A. Maximum Password Age B. Minimum Password Age C. Password Uniqueness D. Minimum Password length E. Account lockout

42. In Account Policies, Jason sets Account Lockout Duration to forever. What is/are the effect(s)? A. If a user attempts to hack the administrator account, the administrator account will be locked out. B. The administrator will have to reset user accounts that are Locked Out by bad password attempts. C. The administrator will have to reset user accounts that are Disabled by bad password attempts. D. No user accounts will be Locked Out

54 Chapter 1

41. Miranda wants to insure that users change their passwords and have unique passwords. Which Account Policy settings should she change? *A. Maximum Password Age *B. Minimum Password Age *C. Password Uniqueness D. Minimum Password length E. Account lockout

Explanation: In order for users not to be able to change back to their original password, Minimum Password Age and Password Uniqueness values must be enforced as well as Maximum Password Age. OS Security, Lesson 2: Account Security

42. In Account Policies, Jason sets Account Lockout Duration to forever. What is/are the effect(s)? A. If a user attempts to hack the administrator account, the administrator account will be locked out. *B. The administrator will have to reset user accounts that are Locked Out by bad password attempts. C. The administrator will have to reset user accounts that are Disabled by bad password attempts. D. No user accounts will be Locked Out

Explanation: The administrator will have to reset user accounts that are Locked Out by bad password attempts. Out of the box, the NT 4.0 administrator account cannot be locked out. OS Security, Lesson 2: Account Security


43. So as to defeat brute force attacks on the administrator account, Sally wants to lockout the administrator account for five minutes if there are ten bad logon attempts in 30 minutes. What initial steps does Sally need to take? (Choose two): A. Get the Passprop utility from the NT 4.0 Server Resource Kit. B. Enter "passprop /adminlockout" to apply the rules C. Get the Passfilt utility from the NT 4.0 Server Resource Kit. D. Enter "Passfilt /adminlockout" to apply the rules E. Copy the passfilt.dll to the Winnt\system32 directory.

44. Larry wants to implement strong passwords for his NT 4.0 domain. Which of the following steps must Larry take? (Choose 3): A. From the NT 4.0 Server Resource Kit, Larry should copy the passfilt.dll to the Winnt\system32 folder. B. Larry must edit or add the registry key \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notifi cation Packages C. Larry must edit or add the registry key \HKEY_CURRENT_USER\Security\LSA\Notification Packages D. Larry must enter the command passprop /complex E. Larry must enter the command passprop /high

56 Chapter 1

43. So as to defeat brute force attacks on the administrator account, Sally wants to lockout the administrator account for five minutes if there are ten bad logon attempts in 30 minutes. What initial steps does Sally need to take? (Choose two): *A. Get the Passprop utility from the NT 4.0 Server Resource Kit. *B. Enter "passprop /adminlockout" to apply the rules C. Get the Passfilt utility from the NT 4.0 Server Resource Kit. D. Enter "Passfilt /adminlockout" to apply the rules E. Copy the passfilt.dll to the Winnt\system32 directory.

Explanation: Sally need to get the Passprop utility from the NT 4.0 Server Resource Kit and from the cmd prompt enter "passprop /adminlockout" to apply the rules OS Security, Lesson 2: Account Security

44. Larry wants to implement strong passwords for his NT 4.0 domain. Which of the following steps must Larry take? (Choose 3): *A. From the NT 4.0 Server Resource Kit, Larry should copy the passfilt.dll to the Winnt\system32 folder. *B. Larry must edit or add the registry key \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notifi cation Packages C. Larry must edit or add the registry key \HKEY_CURRENT_USER\Security\LSA\Notification Packages *D. Larry must enter the command passprop /complex E. Larry must enter the command passprop /high

Explanation: OS Security, Lesson 2: Account Security


45. Brian wants to ensure that for Linux user Jeremy , the password has a maximum age of 30 days, a minimum age of 2 days and that Jeremy gets a warning 5 days before his password expires. What command would Brian enter? A. # chage -m 2 -M 30 -W 5 jeremy B. # chmode -m 2 -M 30 -W 5 jeremy C. # chpass -m 2 -M 30 -W 5 jeremy D. # chpass /min 2 /max 30 /warn 5 jeremy

46. Wendy wants to foil password-cracking programs. Where should she store Unix or Linux passwords? A. etc/passwd B. etc/shadow C. var/root/hidden D. var/hidden

58 Chapter 1

45. Brian wants to ensure that for Linux user Jeremy , the password has a maximum age of 30 days, a minimum age of 2 days and that Jeremy gets a warning 5 days before his password expires. What command would Brian enter? *A. # chage -m 2 -M 30 -W 5 jeremy B. # chmode -m 2 -M 30 -W 5 jeremy C. # chpass -m 2 -M 30 -W 5 jeremy D. # chpass /min 2 /max 30 /warn 5 jeremy

Explanation: # chage -m 2 -M 30 -W 5 jeremy OS Security, Lesson 2: Account Security

46. Wendy wants to foil password-cracking programs. Where should she store Unix or Linux passwords? A. etc/passwd *B. etc/shadow C. var/root/hidden D. var/hidden

Explanation: If not enabled, Wendy should install a shadow password file in etc/shadow. This file is encrypted and only the root user has read privileges. OS Security, Lesson 2: Account Security


47. Carl attempts to execute a Linux program from his current directory. He gets an error. What might be the problem? (Choose the best answer): A. The executable is in the current directory B. The executable is /bin C. The executable is in /var/bin D. The executable is in /sbin

48. Carl wants to allow users install and run programs from any directory that they have read, execute and write privileges. He includes the "." entry as the first element in the search path. What is the effect? (Choose 2): A. The current directory is included in the search path B. The user’s home directory is included in the search path C. A hacker might be able to place Trojan-Horse executables in the current directory D. No effect ".." should be placed in the path.

60 Chapter 1

47. Carl attempts to execute a Linux program from his current directory. He gets an error. What might be the problem? (Choose the best answer): A. The executable is in the current directory *B. The executable is /bin C. The executable is in /var/bin D. The executable is in /sbin

Explanation: In Linux/Unix, the current directory is not automatically added to the search path. OS Security, Lesson 2: Account Security

48. Carl wants to allow users install and run programs from any directory that they have read, execute and write privileges. He includes the "." entry as the first element in the search path. What is the effect? (Choose 2): *A. The current directory is included in the search path B. The users home directory is included in the search path *C. A hacker might be able to place Trojan-Horse executables in the current directory D. No effect ".." should be placed in the path.

Explanation: placing "." early in the search path is a security loophole. OS Security, Lesson 2: Account Security


49. Sandy wants to read the Linux log with failed logon attempts. What command should she enter? A. host# grep login /var/log/messages B. host# ls /var/log/messages C. host# cat /var/log/messages D. host# grep login /var/log/messages

50. Dan wants to secure NT files using NTFS permissions. Which tool would he use? A. Server Manager B. Explorer C. User Manager D. User Manager for Domains

62 Chapter 1

49. Sandy wants to read the Linux log with failed logon attempts. What command should she enter? A. host# grep login /var/log/messages B. host# ls /var/log/messages C. host# cat /var/log/messages *D. host# grep login /var/log/messages Explanation: Sandy should enter host# grep login /var/log/messages. OS Security, Lesson 2: Account Security

50. Dan wants to secure NT files using NTFS permissions. Which tool would he use? A. Server Manager *B. Explorer C. User Manager D. User Manager for Domains

Explanation: Explorer is used to set permissions. OS Security, Lesson 3: File System Security


51. Larry is assigning individual NTFS permissions to the Common folder to Randy. He wants Randy to be able to read documents, execute programs and modify documents. Which permissions would allow Larry to do at least all of these tasks. (Choose 3): A. RWXD B. P C. O D. RW

52. Joseph cannot access a folder even though he has always been in the Managers group with Full Control NTFS and Share permissions to the folder. How can this be solved? A. Reboot the computer B. Take Joseph out of any group with the No Access permission C. Delete and recreate Joseph's account D. Synch the BDCs with the PDC.

64 Chapter 1

51. Larry is assigning individual NTFS permissions to the Common folder to Randy. He wants Randy to be able to read documents, execute programs and modify documents. Which permissions would allow Larry to do at least all of these tasks. (Choose 3): *A. RWXD *B. P *C. O D. RW

Explanation: Randy should be given RWXD, but if Randy were accidentally given the Change Permission (P) permission, he could give himself any permission that he wanted. Also, if Randy were accidentally given the Take Ownership (O) permission, he could take ownership and give himself any permission he wanted. OS Security, Lesson 3: File System Security

52. Joseph cannot access a folder even though he has always been in the Managers group with Full Control NTFS and Share permissions to the folder. How can this be solved? A. Reboot the computer *B. Take Joseph out of any group with the No Access permission C. Delete and recreate Joseph's account D. Synch the BDCs with the PDC.

Explanation: Joseph must be in a group or have the individual NTFS or Share permission of "No Access." OS Security, Lesson 3: File System Security


53. Joseph cannot access a folder after he was just added to the Managers group with Full Control NTFS and Share permissions to the folder. How can this be solved with the least amount of effort? A. Reboot the Joseph's computer B. Reboot the server C. Have Joseph log off and logon. D. Stop and restart the workstation service.

54. Harry installing NT 4.0. He partitions his hard drive into three NTFS partitions, one for the NT OS, one for Program Files, and one for Data. What benefits does Harry reap? (Choose 3)? A. Smaller cluster size B. Easier backup C. Easier administration of directory permissions D. More security if a hacker gains control of one partition.

66 Chapter 1

53. Joseph cannot access a folder after he was just added to the Managers group with Full Control NTFS and Share permissions to the folder. How can this be solved with the least amount of effort? A. Reboot the Joseph's computer B. Reboot the server *C. Have Joseph log off and logon. D. Stop and restart the workstation service.

Explanation: Have Joseph log off and log on to refresh his access token. OS Security, Lesson 3: File System Security

54. Harry installing NT 4.0. He partitions his hard drive into three NTFS partitions, one for the NT OS, one for Program Files, and one for Data. What benefits does Harry reap? (Choose 3)? A. Smaller cluster size *B. Easier backup *C. Easier administration of directory permissions *D. More security if a hacker gains control of one partition. Explanation:

For NTFS the cluster size is independent of the partition size. OS Security, Lesson 3: File System Security


55. In what one case will a file that is moved retain the permissions of its parent folder rather than the destination folder? A. It is moved in the same partition. B. It is moved to a separate partition C. It is moved to a FAT partition D. It is copied to the same partition E. It is copied to a different partition

56. Marty has read share permissions and change NTFS permissions to a folder on Server1. When Marty logs on interactively at Server1 what effective permissions does Marty have? A. Read B. Change C. RW D. RE

68 Chapter 1

55. In what one case will a file that is moved retain the permissions of its parent folder rather than the destination folder? *A. It is moved in the same partition. B. It is moved to a separate partition C. It is moved to a FAT partition D. It is copied to the same partition E. It is copied to a different partition

Explanation: If a file is moved in the same partition, it still lives in its parent directory, only a virtual pointer to the file location has changed. OS Security, Lesson 3: File System Security

56. Marty has read share permissions and change NTFS permissions to a folder on Server1. When Marty logs on interactively at Server1 what effective permissions does Marty have? A. Read *B. Change C. RW D. RE

Explanation: Logging on interactively, means logging on locally at server1. In this case, share permissions do not apply. OS Security, Lesson 3: File System Security


57. Larry want to list the permissions of the /home/larry/file1 file. What command does he use? A. ls -l /home/larry/file1 B. ls -p /home/larry/file1 C. ls /home/larry/file1 -l D. ls /home/larry/file1 -a

58. Larry types ls-l /home/larry/file1 and gets the following output "-rwer-xr-- larry staff" Which of the following are true? A. Larry has the read, write and execute permissions B. The staff group has execute and read permissions C. The nobody group has read permissions D. The everyone group has execute permissions.

70 Chapter 1

57. Larry want to list the permissions of the /home/larry/file1 file. What command does he use? *A. ls -l /home/larry/file1 B. ls -p /home/larry/file1 C. ls /home/larry/file1 -l D. ls /home/larry/file1 -a

Explanation: ls -l /home/larry OS Security, Lesson 3: File System Security

58. Larry types ls-l /home/larry/file1 and gets the following output "-rwer-xr-- larry staff" Which of the following are true? *A. Larry has the read, write and execute permissions *B. The staff group has execute and read permissions *C. The nobody group has read permissions D. The everyone group has execute permissions.

Explanation: Larry has the read, write and execute permissions, The staff group has read and execute permissions, and the nobody group has read permissions OS Security, Lesson 3: File System Security


59. Marsha wants to make sure that no file that is placed in the /temp directory is executable by any user. What command could Marsha use? A. umask 0111 /temp B. umask 0444 /temp C. chmod 111 /temp D. chmod 444 /temp

60. Fred wants to make sure that everyone has at least read privileges on the /common/readme file. Which commands would work? (Choose 4): A. chmode 664 /common/readme B. chmode a+r /common/readme C. chmode o+r /common/readme D. chmode o=r /common/readme E. chmode a-r /common/readme

72 Chapter 1

59. Marsha wants to make sure that no file that is placed in the /temp directory is executable by any user. What command could Marsha use? *A. umask 0111 /temp B. umask 0444 /temp C. chmod 111 /temp D. chmod 444 /temp

Explanation: The umask command masks-out the bits that are set in the command. The bit value of execute is 1, so umask 0111 /temp masks-out execute for the /temp directory for user, group and other. The chmode command is only applicable to file and not directory permissions. OS Security, Lesson 3: File System Security

60. Fred wants to make sure that everyone has at least read privileges on the /common/readme file. Which commands would work? (Choose 4): *A. chmode 664 /common/readme *B. chmode a+r /common/readme *C. chmode o+r /common/readme *D. chmode o=r /common/readme E. chmode a-r /common/readme

Explanation: chmode 664 /common/readme sets the permission to read for others, and to read and write for the owner and group. chmode a+r /common/readme adds the readme permission to the owner, group and others. chmode o+r /common/readme adds the readme permission to others. chmode o=r /common/readme set the permission to read for others. OS Security, Lesson 3: File System Security


61. Brandy wants to defend against the most common hacker attack. What type of attack is most common? A. Trapdoor attacks B. Replay attacks C. Denial-of-service attacks D. Insider attacks E. IP spoofing

62. Brandy is defending against a hacker attack. She disables the NT Scheduler service because it runs with administrative privilege and could be used by a hacker to run a rogue program. What type of attack is Brandy defending against? A. Insider attack B. Trapdoor attack C. Masquerade attack D. Denial-of-service attack E. Replay attack

74 Chapter 1

61. Brandy wants to defend against the most common hacker attack. What type of attack is most common? A. Trapdoor attacks B. Replay attacks C. Denial-of-service attacks *D. Insider attacks E. IP spoofing

Explanation: Insider attacks are the most common. OS Security, Lesson 4: Assessing Risk

62. Brandy is defending against a hacker attack. She disables the NT Scheduler service because it runs with administrative privilege and could be used by a hacker to run a rogue program. What type of attack is Brandy defending against? A. Insider attack *B. Trapdoor attack C. Masquerade attack D. Denial-of-service attack E. Replay attack Explanation: Mandy is defending against a trapdoor attack. OS Security, Lesson 4: Assessing Risk


63. Brandy is defending against a hacker attack. She disables ICMP packet responses to ping packets so an attacker cannot flood her system with pings, the responses to which would take up bandwidth and system resources. What type of attack is Brandy defending against? A. Insider attack B. Trapdoor attack C. Masquerade attack D. Denial-of-service attack E. Replay attack

64. Billy-Bob is a hacker. He listens to a client computer negotiating a secure session with a server. He performs an attack against the client computer to flood it with TCP synch packets so as to take that client out of the picture. He then repeats the captured logon sequence against the server, cooking the IP packet checksum and changing the IP address to his own, pretending to be the original client. What types of attacks are taking place? (Choose 3): A. Spoofing or masquerade attack B. Replay attack C. Denial-of-service attack D. Insider attack E. Trapdoor attacks

76 Chapter 1

63. Brandy is defending against a hacker attack. She disables ICMP packet responses to ping packets so an attacker cannot flood her system with pings, the responses to which would take up bandwidth and system resources. What type of attack is Brandy defending against? A. Insider attack B. Trapdoor attack C. Masquerade attack *D. Denial-of-service attack E. Replay attack

Explanation: Brandy is defending against a denial-of-service attack. OS Security, Lesson 4: Assessing Risk

64. Billy-Bob is a hacker. He listens to a client computer negotiating a secure session with a server. He performs an attack against the client computer to flood it with TCP synch packets so as to take that client out of the picture. He then repeats the captured logon sequence against the server, cooking the IP packet checksum and changing the IP address to his own, pretending to be the original client. What types of attacks are taking place? (Choose 3): *A. Spoofing or masquerade attack *B. Replay attack *C. Denial-of-service attack D. Insider attack E. Trapdoor attacks

Explanation: Most hacker attacks use a variety of techniques. OS Security, Lesson 4: Assessing Risk


65. NT4.0 requires that a user hit control-alt-delete to logon to foil a hacker attack in which a fake logon screen is presented and a hacker captures the username and password. In this case, what type of attack is Microsoft protecting against? A. Trojan horses B. Denial-of-service attacks. C. Insider attacks D. Replay attacks E. Spoofing or masquerade attacks.

66. Bert works for the FBI. He wants to see everything that a suspected terrorist types on his computer. He might install a software or hardware ____________. A. Melissa virus B. Trojan horse C. Keylogger D. Replay program

78 Chapter 1

65. NT4.0 requires that a user hit control-alt-delete to logon to foil a hacker attack in which a fake logon screen is presented and a hacker captures the username and password. In this case, what type of attack is Microsoft protecting against? *A. Trojan horses B. Denial-of-service attacks. C. Insider attacks D. Replay attacks E. Spoofing or masquerade attacks.

Explanation: A Trojan horse hides a an unauthorized command within a commonly used function in order to cause a security breach. In Unix a root kit is a Trojan Horse that legitimate programs that can copy the username and password. OS Security, Lesson 4: Assessing Risk

66. Bert works for the FBI. He wants to see everything that a suspected terrorist types on his computer. He might install a software or hardware ____________. A. Melissa virus B. Trojan horse *C. Keylogger D. Replay program

Explanation: A keylogger captures all the keystrokes. OS Security, Lesson 4: Assessing Risk


67. Mary wants to make a hacker's job harder. She should change the default _________, ________, and ___________. Choose three answers to fill-in the blanks. A. Directories B. Accounts C. Shares D. Permissions E. Rights

68. Nancy wants to perform a quick and dirty, relatively inexpensive security audit. She should? (Choose the best choice): A. Use a "security analyzer" program B. Configure auditing of file and object access C. Perform an online security audit D. Use a keylogger program E. Install WebTrends Log Analyzer

80 Chapter 1

67. Mary wants to make a hacker's job harder. She should change the default _________, ________, and ___________. Choose three answers to fill-in the blanks. *A. Directories *B. Accounts *C. Shares D. Permissions E. Rights

Explanation: Mary should change the default directories, such as C:\Winnt, default account names such as "administrator," and the default shares such as C$. OS Security, Lesson 4: Assessing Risk

68. Nancy wants to perform a quick and dirty, relatively inexpensive security audit. She should? (Choose the best choice): *A. Use a "security analyzer" program B. Configure auditing of file and object access C. Perform an online security audit D. Use a keylogger program E. Install WebTrends Log Analyzer

Explanation: Mary should use a security analyzer program such as WebTrends Security Analyzer. OS Security, Lesson 4: Assessing Risk


69. Mark wants to increase security on his Unix system. Which steps should Mark implement? (Choose 2): A. Use rlogin instead of Telnet for remote login B. When using NIS use a wrapper program that limits access to portmapper functions to certain IP address or domains. C. Use NIS+ vice NIS for complete security. D. Use secure RPC for access to NFS resources

70. Jollene wants to avoid Unix NFS. What valid security concerns might Jollene she have? (Choose 3): A. NFS file transfers are unencrypted B. RPC is nonsecure C. Secure RPC can be decoded by hackers D. NFS decentralizes virus protection E. Reverse RPC can be used in a denial-of-service attack.

82 Chapter 1

69. Mark wants to increase security on his Unix system. Which steps should Mark implement? (Choose 2): A. Use rlogin instead of Telnet for remote login *B. When using NIS use a wrapper program that limits access to portmapper functions to certain IP address or domains. C. Use NIS+ vice NIS for complete security. *D. Use secure RPC for access to NFS resources

Explanation: rlogin should be disabled. Mark should use a wrapper program with NIS and secure RPC with NFS. While NIS+ is more secure than NIS it still is has security loopholes. OS Security, Lesson 4: Assessing Risk

70. Jollene wants to avoid Unix NFS. What valid security concerns might Jollene she have? (Choose 3): *A. NFS file transfers are unencrypted *B. RPC is nonsecure *C. Secure RPC can be decoded by hackers D. NFS decentralizes virus protection E. Reverse RPC can be used in a denial-of-service attack.

Explanation: NFS file transfers are unencrypted. RPC is nonsecure. Secure RPC can be decoded by hackers. OS Security, Lesson 4: Assessing Risk


71. Mike wants to know which service packs should be installed? Which choices are correct? (Choose 3): A. Always apply the latest service pack B. Only apply service packs that fix a problem specific to your installation C. Most patches should not be applied D. Administrators should always read the documentation that comes with service packs. E. As long as your server is running OK, don't apply a service pack

72. Ursula is smart about applying patches and service packs. What rules does Ursula follow? (Choose 2): A. Ursula always applies the latest patch B. Ursula performs a full backup before applying a patch C. Ursula doesn't apply most patches unless there is a specific reason D. Ursula makes the operating system files read-only before applying a patch.

84 Chapter 1

71. Mike wants to know which service packs should be installed? Which choices are correct? (Choose 3): A. Always apply the latest service pack *B. Only apply service packs that fix a problem specific to your installation *C. Most patches should not be applied *D. Administrators should always read the documentation that comes with service packs. E. As long as your server is running OK, don't apply a service pack

Explanation: Read the documentation and apply the services packs that will fix security loopholes or resolve specific problems with the operating system. Most service packs should not be applied. Your computer could be running OK, but have a security vulnerability that a service pack could fix. OS Security, Lesson 4: Assessing Risk

72. Ursula is smart about applying patches and service packs. What rules does Ursula follow? (Choose 2): A. Ursula always applies the latest patch *B. Ursula performs a full backup before applying a patch *C. Ursula doesn't apply most patches unless there is a specific reason D. Ursula makes the operating system files read-only before applying a patch.

Explanation: Ursula does a full backup before applying a patch and only applies patches that to resolve specific problem or close specific security loopholes. OS Security, Lesson 5: Reducing Risk


73. What part of NT must be secured to prevent attack by the Red Button program? A. The registry B. The winnt\drivers\etc directory C. The boot and system files D. ntuser.dat in the administrator profile directory

74. Sam wants to hack the accounts database contained in the windows registry. Where could Sam find the accounts database or copies of the accounts database? (Choose three): A. ERD B. ASP C. \winnt\repair D. \winnt\system32\config E. \Winnt\backup

86 Chapter 1

73. What part of NT must be secured to prevent attack by the Red Button program? *A. The registry B. The winnt\drivers\etc directory C. The boot and system files D. ntuser.dat in the administrator profile directory

Explanation: The Red Button program reads unsecured parts of the registry. the registry is stored in \WINNT\system32\Config. OS Security, Lesson 5: Reducing Risk

74. Sam wants to hack the accounts database contained in the windows registry. Where could Sam find the accounts database or copies of the accounts database? (Choose three): *A. ERD B. ASP *C. \winnt\repair *D. \winnt\system32\config E. \Winnt\backup

Explanation: Safeguard the Emergency Repair Disk. OS Security, Lesson 5: Reducing Risk


75. Hector wants secure the two most important keys of the registry. They are the following keys: A. HKey_Local_Machine B. HKey_Current_User C. HKey_Users D. HKey_Classes_Root E. HKey_Current_Config

76. Which of the following statements are true about the HKLM of the registry? (Choose all the correct answers): A. The Hardware key is recreated every time NT starts up. B. The Security subkey contains the actual user accounts and password C. The subkeys are Hardware, SAM, Security, Software, and System D. The Software subkey application information is specific to the current user. E. The system subkey stores device driver and service configuration data.

88 Chapter 1

75. Hector wants secure the two most important keys of the registry. They are the following keys: *A. HKey_Local_Machine *B. HKey_Current_User C. HKey_Users D. HKey_Classes_Root E. HKey_Current_Config

Explanation: The computer device settings are in HKey_Local_Machine and the HKey_Current_User contain the profile of the current user. Most of the registry derives from HKey_Local_Machine, but the values contained in HKey_Current_User have precedence over HKey_Local_Machine. OS Security, Lesson 5: Reducing Risk

76. Which of the following statements are true about the HKLM of the registry? (Choose all the correct answers): *A. The Hardware key is recreated every time NT starts up. B. The Security subkey contains the actual user accounts and password *C. The subkeys are Hardware, SAM, Security, Software, and System D. The Software subkey application information is specific to the current user. *E. The system subkey stores device driver and service configuration data.

Explanation: The SAM contains the actual user accounts and password. The Software subkey application information is independent of the current user. OS Security, Lesson 5: Reducing Risk


77. Andy wants to secure the registry. How should he do this? (Choose the best answer): A. Implement parameter hiding B. Use the NT 4.0 Resource Kit C2 Configuration Manager C. Make the registry read only D. Encrypt the registry E. Delete Regedit32 and Regedit

78. Pamela wants to audit the registry. How she do this? (Pick the best answer): A. Audit Success and Failure of all Events to Audit on the Everyone group B. Audit Failure of all Events to Audit on the Everyone group C. Audit Success and Failure of all Events to Audit on the local Administrators group D. Audit Failure of all Events to Audit on the Domain Users group

90 Chapter 1

77. Andy wants to secure the registry. How should he do this? (Choose the best answer): A. Implement parameter hiding *B. Use the NT 4.0 Resource Kit C2 Configuration Manager C. Make the registry read only D. Encrypt the registry E. Delete Regedit32 and Regedit

Explanation: Use the NT 4.0 Resource Kit C2 Configuration Manager to secure the registry. OS Security, Lesson 5: Reducing Risk

78. Pamela wants to audit the registry. How she do this? (Pick the best answer): A. Audit Success and Failure of all Events to Audit on the Everyone group *B. Audit Failure of all Events to Audit on the Everyone group C. Audit Success and Failure of all Events to Audit on the local Administrators group D. Audit Failure of all Events to Audit on the Domain Users group

Explanation: Audit Failure of all Events to Audit on the Everyone group because the to audit success would put too much of a burden on the system and because anyone could try to hack the registry. OS Security, Lesson 5: Reducing Risk


79. Mary is using the C2 Config tool included with the NT Resources Kit. Besides securing the registry, what additional security functions can this tool perform? (Choose 2): A. Remove OS/2 support B. Remove POSIX support C. Remove Alpha support D. Change default directories E. Hide administrative accounts

80. Chuck wants to secure his NT server. Which steps should Chuck take? A. Disable unnecessary services B. Disable unnecessary devices C. Remove the executable for the Scheduler service D. Remove unnecessary devices

92 Chapter 1

79. Mary is using the C2 Config tool included with the NT Resources Kit. Besides securing the registry, what additional security functions can this tool perform? (Choose 2): *A. Remove OS/2 support *B. Remove POSIX support C. Remove Alpha support D. Change default directories E. Hide administrative accounts

Explanation: The C2 Config tool included with the NT Resources Kit should also be used to remove support for OS/2 and POSIX. OS Security, Lesson 5: Reducing Risk

80. Chuck wants to secure his NT server. Which steps should Chuck take? *A. Disable unnecessary services B. Disable unnecessary devices *C. Remove the executable for the Scheduler service D. Remove unnecessary devices Explanation: Unnecessary Services should be disabled and the executable for the scheduler service should be removed to enhance security. OS Security, Lesson 5: Reducing Risk


81. Eric is configuring a firewall. He wants to block external access to certain ports. Which of the following ports might Eric want to block? (Choose 4): A. DNS zone transfers - TCP port 53 B. MS SQL server - TCP 1433 C. MS Networking - UDP 137 and 138; TCP 139 D. POP3 - TCP 110 E. SMTP - TCP 25

82. Jake wants to secure his NT server, PDC_ATL so that it has a C2 security designation. What is the most important functionality that PDC_ATL will lose? A. No Web server capability B. No email capability C. No networking D. No POSIX or OS2 support

94 Chapter 1

81. Eric is configuring a firewall. He wants to block external access to certain ports. Which of the following ports might Eric want to block? (Choose 4): *A. DNS zone transfers - TCP port 53 *B. MS SQL server - TCP 1433 *C. MS Networking - UDP 137 and 138; TCP 139 D. POP3 - TCP 110 E. SMTP - TCP 25

Explanation: Eric might also want to block SNMP - TCP 161 and 162; UDP 161 and 162 and RPC - TCP - 135 and UDP 135. OS Security, Lesson 5: Reducing Risk

82. Jake wants to secure his NT server, PDC_ATL so that it has a C2 security designation. What is the most important functionality that PDC_ATL will lose? A. No Web server capability B. No email capability *C. No networking D. No POSIX or OS2 support

Explanation: To achieve a C2 security status networking has to be disabled. Although you will lose OS2 and POSIX support, they are not as important as losing networking. OS Security, Lesson 5: Reducing Risk


83. Which protocol is the basis of NT networking? A. SMB B. NCP C. Samba D. NIS E. NFS

84. Kari is changing the configuration of her NT 4.0 servers in order to increase security. Which of the following measures should Kari take? A. Restrict access to print driver installation to administrators and print operators. B. On the logon dialog box, hide the last user name C. Clear the page file on shutdown D. Disable caching of logon credentials E. Restrict access to the scheduler service to administrators

96 Chapter 1

83. Which protocol is the basis of NT networking? *A. SMB B. NCP C. Samba D. NIS E. NFS

Explanation: Server Message Block protocol are the basis of NT networking. OS Security, Lesson 5: Reducing Risk

84. Kari is changing the configuration of her NT 4.0 servers in order to increase security. Which of the following measures should Kari take? *A. Restrict access to print driver installation to administrators and print operators. *B. On the logon dialog box, hide the last user name *C. Clear the page file on shutdown *D. Disable caching of logon credentials E. Restrict access to the scheduler service to administrators

Explanation: All of the above are good ideas. OS Security, Lesson 5: Reducing Risk


85. Pablo wants to disable or remove any unnecessary services in Unix. Which services are unnecessary security loopholes? A. Sendmail debugging tools B. External access /etc/inetd.conf C. DNS D. TFTP

86. Mary still wants to use Telnet and FTP, but wants to secure these services. What can Mary do? (Choose 2): A. Configure /etc/hosts.allow and /etc/hosts/deny B. Use SSL C. Use digital signatures and digital envelopes D. Use TCPWrapper as an application gateway

98 Chapter 1

85. Pablo wants to disable or remove any unnecessary services in Unix. Which services are unnecessary security loopholes? *A. Sendmail debugging tools *B. External access /etc/inetd.conf C. DNS *D. TFTP

Explanation: DNS is necessary, although Pablo could have a DNS server outside his firewall that didn't have records for internal resources, while he could have an internal DNS server behind his firewall. OS Security, Lesson 5: Reducing Risk

86. Mary still wants to use Telnet and FTP, but wants to secure these services. What can Mary do? (Choose 2): *A. Configure /etc/hosts.allow and /etc/hosts/deny B. Use SSL C. Use digital signatures and digital envelopes *D. Use TCPWrapper as an application gateway

Explanation: Mary can secure these and other services using the TCPWrapper program as an application gateway, and then configure the /etc/hosts.allow and /etc/hosts/deny files. OS Security, Lesson 5: Reducing Risk


87. Brandy wants to protect against IP spoofing of her Linux server. What program should she run? A. Webtrends B. Secure-IP C. TCPWrapper D. TCPMatch

88. Sandy suspects that certain large files are being hijacked and altered while being downloaded. Which tool can she use to produce secure checksums so as to detect any alteration, compromise or corruption of the file contents? (Choose the best answer)? A. MD5 B. PDA C. DR7 D. PHP

100 Chapter 1

87. Brandy wants to protect against IP spoofing of her Linux server. What program should she run? A. Webtrends B. Secure-IP *C. TCPWrapper D. TCPMatch

Explanation: TCPWrapper uses DNS to perform reverse name lookups to see if a TCP packet has been spoofed. OS Security, Lesson 5: Reducing Risk

88. Sandy suspects that certain large files are being hijacked and altered while being downloaded. Which tool can she use to produce secure checksums so as to detect any alteration, compromise or corruption of the file contents? (Choose the best answer)? *A. MD5 B. PDA C. DR7 D. PHP

Explanation: Message Digest 5 produces secure checksums. OS Security, Lesson 5: Reducing Risk


89. Jake wants to audit early morning restarts of NT server Mars which could indicate that a hacker had breached security. He also wants to audit the check printer. Which items should Jake audit in this scenario? A. File and Object Access B. User and Group Management C. Use of User Rights D. Restart, Shutdown, and System

90. Where can Jake read the NT 4.0 server audit logs? A. Event Viewer - Security Log B. Event Viewer - Audit Log C. Event Viewer - System Log D. \Winnt\system32\logs E. \Winnt\system32\security\lsa\logs

102 Chapter 1

89. Jake wants to audit early morning restarts of NT server Mars which could indicate that a hacker had breached security. He also wants to audit the check printer. Which items should Jake audit in this scenario? *A. File and Object Access B. User and Group Management C. Use of User Rights *D. Restart, Shutdown, and System

Explanation: In order to audit access to printers or to files and folders, the first step is to enable File and Object Access. This is enabled in User Manager for Domains, Policy - Audit. OS Security, Lesson 5: Reducing Risk

90. Where can Jake read the NT 4.0 server audit logs? *A. Event Viewer - Security Log B. Event Viewer - Audit Log C. Event Viewer - System Log D. \Winnt\system32\logs E. \Winnt\system32\security\lsa\logs

Explanation: Jake can read the audit information in Event Viewer - Security Log . OS Security, Lesson 5: Reducing Risk


91. Chuck is a hacker. How can we make Chuck's job harder? (Choose 3): A. Use removable hard drives for user computers B. Secure printer drivers C. Hide the last user name D. Restrict the use of printer ports and serial ports to administrators only. E. Implement a strong password in BIOS

92. George wants to change NT registry settings to increase security. Which of the following items should George secure? (Choose all that apply): A. Removable media, printer drivers, printer and serial ports, the scheduler service, the page file, cached logon credentials and the last user name. B. Removable media, printer drivers, printer and serial ports, the server service, the page file, cached logon credentials and the last user name. C. Hard drive caching, printer drivers, printer and serial ports, the scheduler service, the page file, cached logon credentials and the last user name. D. Removable media, the print spooler, printer and serial ports, the scheduler service, the page file, cached logon credentials and the last user name.

104 Chapter 1

91. Chuck is a hacker. How can we make Chuck's job harder? (Choose 3): A. Use removable hard drives for user computers *B. Secure printer drivers *C. Hide the last user name *D. Restrict the use of printer ports and serial ports to administrators only. E. Implement a strong password in BIOS

Explanation: We should secure printer drivers, hide the last user name, and secure shared system objects such as printer ports and serial ports. We should also clear the page file at shutdown, disable caching of logon credentials, secure the scheduler service and secure removable media. OS Security, Lesson 5: Reducing Risk

92. George wants to change NT registry settings to increase security. Which of the following items should George secure? (Choose all that apply): *A. Removable media, printer drivers, printer and serial ports, the scheduler service, the page file, cached logon credentials and the last user name. B. Removable media, printer drivers, printer and serial ports, the server service, the page file, cached logon credentials and the last user name. C. Hard drive caching, printer drivers, printer and serial ports, the scheduler service, the page file, cached logon credentials and the last user name. D. Removable media, the print spooler, printer and serial ports, the scheduler service, the page file, cached logon credentials and the last user name.

Explanation: George should change registry setting to secure removable media, printer drivers, printer and serial ports, the scheduler service, the page file, cached logon credentials and the last user name. OS Security, Lesson 5: Reducing Risk


93. In Linux, Joe wants to secure the central file for incoming network access, /etc/inetd.conf. What should Joe do to secure this file and monitor any alterations? (Choose 2): A. Make sure that the file can only be edited by root. B. Check the size and alteration date. C. Hide this file D. Rename this file

106 Chapter 1

93. In Linux, Joe wants to secure the central file for incoming network access, /etc/inetd.conf. What should Joe do to secure this file and monitor any alterations? (Choose 2): *A. Make sure that the file can only be edited by root. *B. Check the size and alteration date. C. Hide this file D. Rename this file

Explanation: The etc/inetd.conf should be monitored for alteration and access control. OS Security, Lesson 5: Reducing Risk

Notes:

Network Security and Firewalls 109

Chapter 2: Network Security and Firewalls 1. Jill's computer exhibits some strange symptoms. Her CD-Rom opens and closes at odd moments. Sometimes her mouse buttons are reversed. Unexpectedly, her computer will shut down. Text messages pop up on her screen saying awful things. What virus is Jill's computer infected with? A. NetBus Trojan B. NAT C. Stealth D. Macro

2. Frank House is a security consultant. He calls on small to medium Internet firms to offer his services on a retainer basis. Which hacker statistics back up his case that the Internet firms should hire him? (Choose 3): A. Intrusions have increased by 50% in the last year B. Most Internet sites that are hacked go out of business C. Losses due to hacking are about $10 billion a year D. One in five Internet sites has suffered a security breach. E. Brute force attacks has become more prevalent

110 Chapter 2

1. Jill's computer exhibits some strange symptoms. Her CD-Rom opens and closes at odd moments. Sometimes her mouse buttons are reversed. Unexpectedly, her computer will shut down. Text messages pop up on her screen saying awful things. What virus is Jill's computer infected with? *A. NetBus Trojan B. NAT C. Stealth D. Macro

Explanation: Jill's computer is infected with the NetBus Trojan virus. Network Security and Firewalls, Lesson 1: What is Security?

2. Frank House is a security consultant. He calls on small to medium Internet firms to offer his services on a retainer basis. Which hacker statistics back up his case that the Internet firms should hire him? (Choose 3): *A. Intrusions have increased by 50% in the last year B. Most Internet sites that are hacked go out of business *C. Losses due to hacking are about $10 billion a year *D. One in five Internet sites has suffered a security breach. E. Brute force attacks has become more prevalent

Explanation: Attacks are becoming more frequent, more sophisticated, and have a greater financial impact. Network Security and Firewalls, Lesson 1: What is Security?


3. Ben discovers that his teenage son has regularly visited www.anticode.com. He suspects that his son wants to do which of the following? (Choose all that apply); A. Decompile Java code B. Reverse engineer Internet Explorer and/or Netscape Navigator C. Gain fairly accurate advice on how to begin hacking D. Scan networks to determine target to attack E. Crack authentication and encryption

4. Martin Goodly III has a high end e-commerce Web site and a ton of money to spend on security. What goal can Martin achieve? (Choose the best answer): A. 100% security B. A balanced security policy C. Proactive security D. Reactive security

112 Chapter 2

3. Ben discovers that his teenage son has regularly visited www.anticode.com. He suspects that his son wants to do which of the following? (Choose all that apply); A. Decompile Java code B. Reverse engineer Internet Explorer and/or Netscape Navigator *C. Gain fairly accurate advice on how to begin hacking *D. Scan networks to determine target to attack *E. Crack authentication and encryption

Explanation: Ben's son may be a budding hacker. He may also learn how attack routers, email servers, Web servers, database servers and file servers. Network Security and Firewalls, Lesson 1: What is Security?

4. Martin Goodly III has a high end e-commerce Web site and a ton of money to spend on security. What goal can Martin achieve? (Choose the best answer): A. 100% security *B. A balanced security policy C. Proactive security D. Reactive security

Explanation: Martin can achieve a security policy that is effective without unduly bogging down legitimate users, but Martin can never achieve 100% security. Network Security and Firewalls, Lesson 1: What is Security?


5. Franklin Stow is the CEO of TransNet Solutions. He is balancing the need for an effective security policy against two other factors. What factors must he balance his security policy against? (Choose 2): A. Ease of use B. Reasonable cost C. Political factors D. Network infrastructure

6. Hannah is the Director of IT Services for TrellisINet.com. She is looking at all the components that comprise an effective security strategy including hardware, software, employee training and security policies. What attributes is Hannah looking for in an effective security matrix? (Choose all that apply): A. Six sigma B. SNMP traps C. Access control D. Superior alarming and reporting E. Flexible and scalable

114 Chapter 2

5. Franklin Stow is the CEO of TransNet Solutions. He is balancing the need for an effective security policy against two other factors. What factors must he balance his security policy against? (Choose 2): *A. Ease of use *B. Reasonable cost C. Political factors D. Network infrastructure

Explanation: Franklin wants the most security at the lowest cost and with the greatest ease of implementation. Network Security and Firewalls, Lesson 1: What is Security?

6. Hannah is the Director of IT Services for TrellisINet.com. She is looking at all the components that comprise an effective security strategy including hardware, software, employee training and security policies. What attributes is Hannah looking for in an effective security matrix? (Choose all that apply): A. Six sigma B. SNMP traps *C. Access control *D. Superior alarming and reporting *E. Flexible and scalable

Explanation: Hannah is also looking for ease of use and appropriate cost of ownership. Network Security and Firewalls, Lesson 1: What is Security?


7. Benedict is classifying the resources that must be protected on his network. What categories should Benedict use? (Choose the best answer). A. Email, file sharing, database and Web-based resources B. Backbone and ancillary services C. Name resolution services, infrastructure and routing services, and file sharing services D. End user resources, network resources, server resources, and information storage resources.

8. In IP spoofing, what does a hacker do? The hacker __________. Fill in the blanks. A. cracks passwords and defeats encryption B. imitates a Internet Protocol device C. scan vulnerable ports D. performs a denial of service attack E. uses the Red Trojan program

116 Chapter 2

7. Benedict is classifying the resources that must be protected on his network. What categories should Benedict use? (Choose the best answer). A. Email, file sharing, database and Web-based resources B. Backbone and ancillary services C. Name resolution services, infrastructure and routing services, and file sharing services *D. End user resources, network resources, server resources, and information storage resources.

Explanation: Benedict should try to protect the following: end user resources, network resources, server resources, and information storage resources. Network Security and Firewalls, Lesson 1: What is Security?

8. In IP spoofing, what does a hacker do? The hacker __________. Fill in the blanks. A. cracks passwords and defeats encryption *B. imitates a Internet Protocol device C. scan vulnerable ports D. performs a denial of service attack E. uses the Red Trojan program

Explanation: With IP spoofing, a hacker can even impersonate a router. Network Security and Firewalls, Lesson 1: What is Security?


9. Of all the categories of assets that Sally is trying to protect, which category is generally the primary target for hackers? A. End user resources B. Network resources C. Server resources D. Database and information resources

10. Which of the following statements are true about the categories of hackers? (Choose 3): A. Casual hackers are the largest group and can be stopped with the proper application of security. B. The most effective tool against Spies is auditing. C. The most effective tool against Spies is the "Ping of Death" D. The determined hacker will eventually gain access to your system and he may be your employee E. Informal hackers consist primarily of antisocial, pre-pubescent males.

118 Chapter 2

9. Of all the categories of assets that Sally is trying to protect, which category is generally the primary target for hackers? A. End user resources B. Network resources *C. Server resources D. Database and information resources Explanation: Server resources are generally the primary target, Network Security and Firewalls, Lesson 1: What is Security?

10. Which of the following statements are true about the categories of hackers? (Choose 3): *A. Casual hackers are the largest group and can be stopped with the proper application of security. *B. The most effective tool against Spies is auditing. C. The most effective tool against Spies is the "Ping of Death" *D. The determined hacker will eventually gain access to your system and he may be your employee E. Informal hackers consist primarily of antisocial, pre-pubescent males. Explanation: Casual hackers are the largest group and can be stopped with the proper application of security. The determined hacker will eventually gain access to your system and he may be your employee. The most effective tool against Spies is auditing. Network Security and Firewalls, Lesson 1: What is Security?


11. Marty wants to make sure that hackers do not read data from the network wire. Which security service most interests Marty? A. Authentication B. Access control C. Data confidentiality D. Data integrity E. Non repudiation

12. Marty wants to make sure that customers who lock-in long-term natural gas service online, do not refute their order if another gas marketer subsequently offers a lower price. Which security service most interests Marty? A. Authentication B. Access control C. Data confidentiality D. Data integrity E. Non-repudiation

120 Chapter 2

11. Marty wants to make sure that hackers do not read data from the network wire. Which security service most interests Marty? A. Authentication B. Access control *C. Data confidentiality D. Data integrity E. Non repudiation

Explanation: Data confidentiality provides protection of data from unauthorized disclosure and protects against passive threats such as packet sniffers. Network Security and Firewalls, Lesson 1: What is Security?

12. Marty wants to make sure that customers who lock-in long-term natural gas service online, do not refute their order if another gas marketer subsequently offers a lower price. Which security service most interests Marty? A. Authentication B. Access control C. Data confidentiality D. Data integrity *E. Non-repudiation

Explanation: Non-repudiation services allow all parties to provide proof or origin and proof of delivery concerning any service. Network Security and Firewalls, Lesson 1: What is Security?


13. Mark is studying ISO 7498-2 and trying to understand the differences between specific and pervasive security mechanisms. Which are true examples of each? A. Specific - Encryption B. Pervasive - Trusted functionality C. Pervasive - Event detection D. Specific - Audit Trail E. Pervasive - Security recovery

14. Jill updates her network management software from SNMPv1 to SNMPv3 which includes support for authentication. Which general security mechanism did Jill implement? (Choose the best answer): A. Trusted functionality B. Event detection C. Audit trail D. Security recovery

122 Chapter 2

13. Mark is studying ISO 7498-2 and trying to understand the differences between specific and pervasive security mechanisms. Which are true examples of each? *A. Specific - Encryption *B. Pervasive - Trusted functionality *C. Pervasive - Event detection D. Specific - Audit Trail *E. Pervasive - Security recovery

Explanation: Audit trail is a pervasive/general security measure that implements helps implement one or more security services at a time and transcends the different layers of the OSI model. Network Security and Firewalls, Lesson 1: What is Security?

14. Jill updates her network management software from SNMPv1 to SNMPv3 which includes support for authentication. Which general security mechanism did Jill implement? (Choose the best answer): *A. Trusted functionality B. Event detection C. Audit trail D. Security recovery

Explanation: Trusted functionality is any procedure that strengthens an existing mechanism, such as upgrading the TCP/IP protocol stack. Network Security and Firewalls, Lesson 1: What is Security?


15. Rajesh is reviewing the security standards that he might apply to his network. Which statements are true about these standards? (Choose 2): A. The Common Criteria - A series of standards and procedures developed by the Department of Defense. B. The Orange Book - A series of standards and procedures developed by an international consortium. C. ISO 7498-2 seeks to minimize vulnerabilities to accidental or intentional, active or passive threats. D. British Standard 7799 outlines "controls" including physical security, security policy, and system access policies.

16. Mark is designing an effective security policy. He is looking at the elements of security that include audit, administration, encryption, access control, user authentication and corporate security policy. Which of these elements is the foundation of a successful security system? A. Authentication and encryption B. Trusted functionality C. Corporate security policy D. Audit and administration.

124 Chapter 2

15. Rajesh is reviewing the security standards that he might apply to his network. Which statements are true about these standards? (Choose 2): A. The Common Criteria - A series of standards and procedures developed by the Department of Defense. B. The Orange Book - A series of standards and procedures developed by an international consortium. *C. ISO 7498-2 seeks to minimize vulnerabilities to accidental or intentional, active or passive threats. *D. British Standard 7799 outlines "controls" including physical security, security policy, and system access policies.

Explanation: The Common Criteria was developed by an international consortium and the Orange Book was developed by the US government. Network Security and Firewalls, Lesson 1: What is Security?

16. Mark is designing an effective security policy. He is looking at the elements of security that include audit, administration, encryption, access control, user authentication and corporate security policy. Which of these elements is the foundation of a successful security system? A. Authentication and encryption B. Trusted functionality *C. Corporate security policy D. Audit and administration.

Explanation: The foundation is corporate security policy. Network Security and Firewalls, Lesson 2: Elements of Security


17. In implementing a security policy, Gene Pool is dividing resources into three categories. the highest category is level one that includes systems central to his JointVentures.com company. What resources might be included in this Level I category? (Choose two): A. All database information B. Developer desktop computers C. Web servers D. E-mail servers

18. In implementing a security policy, Gene Pool is dividing resources into three categories: Level I critical, Level II - significant, and Level III - routinely essential. As a goal, what percentage of resources should Gene put in the different categories? (Level 1 ___ %, Level 2 ___ %, Level 3 ___%): A. 33, 33, 33 B. 25, 25, 50 C. 75, 20, 5 D. 5, 20, 75

126 Chapter 2

17. In implementing a security policy, Gene Pool is dividing resources into three categories. the highest category is level one that includes systems central to his JointVentures.com company. What resources might be included in this Level I category? (Choose two): *A. All database information *B. Developer desktop computers C. Web servers D. E-mail servers

Explanation: While most databases might be critical to a business, a database of employee pager numbers would not be critical. Desktop computers would generally be a Level-III category. Network Security and Firewalls, Lesson 2: Elements of Security

18. In implementing a security policy, Gene Pool is dividing resources into three categories: Level I critical, Level II - significant, and Level III - routinely essential. As a goal, what percentage of resources should Gene put in the different categories? (Level 1 ___ %, Level 2 ___ %, Level 3 ___%): A. 33, 33, 33 B. 25, 25, 50 C. 75, 20, 5 *D. 5, 20, 75

Explanation: Usually five percent of systems are mission critical and cannot tolerate more than a few hours downtime. Network Security and Firewalls, Lesson 2: Elements of Security


19. In implementing a security policy, Gene Pool is dividing resources into three categories: Level I critical, Level II - significant, and Level III - routinely essential. Which of the following would normally be considered Level 1 resources? A. E-mail server B. Wins, DNS or Samba C. Intranet Web server D. HR file server

20. In implementing a security policy, Gene Pool is dividing resources into three categories: Level I critical, Level II - significant, and Level III - routinely essential. After Gene has categorized the resources, what is the next step? A. Assign risk factors B. Define acceptable and unacceptable activities C. Define measures to apply to resources D. Define educational standard

128 Chapter 2

19. In implementing a security policy, Gene Pool is dividing resources into three categories: Level I critical, Level II - significant, and Level III - routinely essential. Which of the following would normally be considered Level 1 resources? A. E-mail server *B. Wins, DNS or Samba C. Intranet Web server D. HR file server

Explanation: Email is often critical to customer service and servers that provide name resolution are often critical to an organization because they provide foundation services. Network Security and Firewalls, Lesson 2: Elements of Security

20. In implementing a security policy, Gene Pool is dividing resources into three categories: Level I critical, Level II - significant, and Level III - routinely essential. After Gene has categorized the resources, what is the next step? *A. Assign risk factors B. Define acceptable and unacceptable activities C. Define measures to apply to resources D. Define educational standard

Explanation: While all of the above are important, the next step is to assign risk factors. Network Security and Firewalls, Lesson 2: Elements of Security


21. Marty wants to make sure that a document is unreadable both over the network and on his hard drive. he should implement __________ to change his __________ documents into __________ that can only be decoded with a ________. (Fill in the blanks): A. encryption, cleartext, encodedtext, hash B. digital signatures, cleartext, hashtext, key C. digital signatures, plaintext, ciphertext, key D. encryption, plaintext, ciphertext, key

22. Ernie is studying the three main encryption categories that are used in networking. What are these categories? A. DES, RSA, MD5 B. Loose encrytion, selective encryption, and tight encryption C. Symmetric, asymmetric, and hash encryption D. Probalistic, deterministic and heuristic encryption

130 Chapter 2

21. Marty wants to make sure that a document is unreadable both over the network and on his hard drive. he should implement __________ to change his __________ documents into __________ that can only be decoded with a ________. (Fill in the blanks): A. encryption, cleartext, encodedtext, hash B. digital signatures, cleartext, hashtext, key C. digital signatures, plaintext, ciphertext, key *D. encryption, plaintext, ciphertext, key

Explanation: he should implement encryption to change his plaintext documents into ciphertext that can only be decoded with a key. Windows 2000 supports encrypting documents on the hard drive. Network Security and Firewalls, Lesson 2: Elements of Security

22. Ernie is studying the three main encryption categories that are used in networking. What are these categories? A. DES, RSA, MD5 B. Loose encrytion, selective encryption, and tight encryption *C. Symmetric, asymmetric, and hash encryption D. Probalistic, deterministic and heuristic encryption

Explanation: Symmetric, asymmetric, and hash encryption are the three types. Network Security and Firewalls, Lesson 2: Elements of Security


23. Ed wants to scramble ATM card PIN numbers so that the code scrambled on the card can be used to verify that the customer has entered the correct PIN number, but the PIN number cannot be reverse engineered from the code on the card. What type of encryption does Ed want to use? A. Symmetric B. Asymmetric C. Hash D. Irreversible

24. Ed wants to securely pass a shared secret over the Internet. What type of encryption does Ed want to use? A. Symmetric B. Asymmetric C. Hash D. Private key

132 Chapter 2

23. Ed wants to scramble ATM card PIN numbers so that the code scrambled on the card can be used to verify that the customer has entered the correct PIN number, but the PIN number cannot be reverse engineered from the code on the card. What type of encryption does Ed want to use? A. Symmetric B. Asymmetric *C. Hash D. Irreversible

Explanation: Hash or one-way encryption theoretically scrambles information so that it can never be recovered. Network Security and Firewalls, Lesson 2: Elements of Security

24. Ed wants to securely pass a shared secret over the Internet. What type of encryption does Ed want to use? A. Symmetric *B. Asymmetric C. Hash D. Private key

Explanation: Asymmetric encryption can be used to securely pass a symmetric session key. Network Security and Firewalls, Lesson 2: Elements of Security


25. Jack wants to use "public key cryptography" on his Web site by using SSL. Public key cryptography is another name for ______________ encryption. A. Symmetric B. Asymmetric C. Hash encryption D. Substitution algorithm

26. Jack wants to use the fastest form of encryption. What form of encryption should Jack use? A. Symmetric B. Asymmetric C. Hash encryption D. MD5 encryption

134 Chapter 2

25. Jack wants to use "public key cryptography" on his Web site by using SSL. Public key cryptography is another name for ______________ encryption. A. Symmetric *B. Asymmetric C. Hash encryption D. Substitution algorithm

Explanation: Public key cryptography is another name for asymmetric encryption. Network Security and Firewalls, Lesson 2: Elements of Security

26. Jack wants to use the fastest form of encryption. What form of encryption should Jack use? *A. Symmetric B. Asymmetric C. Hash encryption D. MD5 encryption

Explanation: Symmetric encryption, also called shared secret encryption is the fastest form of encryption. Network Security and Firewalls, Lesson 2: Elements of Security


27. What is the most common reason that ePlaced.com might want to use encryption? A. Data confidentiality B. Data integrity C. Authentication D. Non-repudiation

28. Jake knows that encryption strength is primarily based on three factors. What are these factors? A. Algorithm strength B. Secrecy of the key C. Length of the key D. Secrecy of the algorithm E. Length of the algorithm

136 Chapter 2

27. What is the most common reason that ePlaced.com might want to use encryption? *A. Data confidentiality B. Data integrity C. Authentication D. Non-repudiation

Explanation: The most common reason that eplaced.com would want to use encryption is data confidentiality. Network Security and Firewalls, Lesson 2: Elements of Security

28. Jake knows that encryption strength is primarily based on three factors. What are these factors? *A. Algorithm strength *B. Secrecy of the key *C. Length of the key D. Secrecy of the algorithm E. Length of the algorithm

Explanation: Encryption strength is primarily based on the strength of the algorithm, the length of the key and the secrecy of the key. Network Security and Firewalls, Lesson 2: Elements of Security


29. Marsha wants to know what the authentication methods she can employ to secure access to the server room? The four authentication methods are as follows: A. Proving what you know B. Demonstrating who you are C. Showing what you have D. Identifying where you are E. Showing where you've been

30. What is the most common authentication method? A. Proving what you know B. Demonstrating who you are C. Showing what you have D. Identifying where you are

138 Chapter 2

29. Marsha wants to know what the authentication methods she can employ to secure access to the server room? The four authentication methods are as follows: *A. Proving what you know *B. Demonstrating who you are *C. Showing what you have *D. Identifying where you are E. Showing where you've been

Explanation: Proving what you know, demonstrating who you are, showing what you have, and identifying where you are the four authentication methods. Network Security and Firewalls, Lesson 2: Elements of Security

30. What is the most common authentication method? *A. Proving what you know B. Demonstrating who you are C. Showing what you have D. Identifying where you are

Explanation: Proving what you know, as providing a username and password is the most common authentication method. Network Security and Firewalls, Lesson 2: Elements of Security


31. Jane implements RRAS security with a caller ID feature to provide additional validation of authorized users. What additional authentication method is Jane using? A. Proving what you know B. Demonstrating who you are C. Showing what you have D. Identifying where you are

32. When Jane goes downtown to the collocated Web server farm that is on the Internet backbone she have to not only provide a username and password, but go through a palm reader and insert a smart card into a slot. What authentication methods are being used to verify Jane's identity? A. Proving what you know B. Demonstrating who you are C. Showing what you have D. Identifying where you are

140 Chapter 2

31. Jane implements RRAS security with a caller ID feature to provide additional validation of authorized users. What additional authentication method is Jane using? A. Proving what you know B. Demonstrating who you are C. Showing what you have *D. Identifying where you are

Explanation: Caller ID or checking your IP address, domain name or host name is identifying where you are. Network Security and Firewalls, Lesson 2: Elements of Security

32. When Jane goes downtown to the collocated Web server farm that is on the Internet backbone she have to not only provide a username and password, but go through a palm reader and insert a smart card into a slot. What authentication methods are being used to verify Jane's identity? *A. Proving what you know *B. Demonstrating who you are *C. Showing what you have D. Identifying where you are

Explanation: For strongest security, use a combination of authentication techniques. Network Security and Firewalls, Lesson 2: Elements of Security


33. Microsoft has adopted Kerberos authentication in Windows 2000. What advantages does Kerberos authentication offer? A. Kerberos is a trusted third party that validates the identities of parties that want to communicate even if the parties do not know each other. B. The password is encrypted across the wire. C. Kerberos can limit authentication to a certain time frame. D. Kerberos can control access to various resources.

34. Jay learns that there are two separate servers included in the Kerberos server. What are these servers? A. Public key server B. Security management server C. Access control server D. Ticket granting server E. Authentication server

142 Chapter 2

33. Microsoft has adopted Kerberos authentication in Windows 2000. What advantages does Kerberos authentication offer? *A. Kerberos is a trusted third party that validates the identities of parties that want to communicate even if the parties do not know each other. B. The password is encrypted across the wire. *C. Kerberos can limit authentication to a certain time frame. *D. Kerberos can control access to various resources.

Explanation: The password, even in encrypted form is never sent over the wire. Network Security and Firewalls, Lesson 2: Elements of Security

34. Jay learns that there are two separate servers included in the Kerberos server. What are these servers? A. Public key server B. Security management server C. Access control server *D. Ticket granting server *E. Authentication server Explanation: The ticket granting server and the authentication server comprise the Kerberos server. Network Security and Firewalls, Lesson 2: Elements of Security


35. Max wants to know which of the following statements are true about Kerberos server. Which of the following statements are true? A. The validated clients are called ticket holders. Their ticket is a session key. B. The Kerberos server ensures that all client machines are secure C. Kerberos clients should destroy the session keys at the end of a session using the kinit command. D. The main disadvantage of a Kerberos server is that if the authentication server or the ticket granting server is compromised, all communications becomes vulnerable.

36. Marty works for a small Win2k test preparation company. He wants his legitimate customers to download his software, but not allow anyone who have might have captured a password to reuse it. Marty would use ___________? A. One time passwords B. Kerberos C. Internet Authentication Server D. Domain blocking E. Security realms

144 Chapter 2

35. Max wants to know which of the following statements are true about Kerberos server. Which of the following statements are true? *A. The validated clients are called ticket holders. Their ticket is a session key. B. The Kerberos server ensures that all client machines are secure C. Kerberos clients should destroy the session keys at the end of a session using the kinit command. *D. The main disadvantage of a Kerberos server is that if the authentication server or the ticket granting server is compromised, all communications becomes vulnerable.

Explanation: The Kerberos server does not ensure that client machines are secure or that client machines initiate the "kdestroy" command at the end of a session to destroy the session keys. Network Security and Firewalls, Lesson 2: Elements of Security

36. Marty works for a small Win2k test preparation company. He wants his legitimate customers to download his software, but not allow anyone who have might have captured a password to reuse it. Marty would use ___________? *A. One time passwords B. Kerberos C. Internet Authentication Server D. Domain blocking E. Security realms

Explanation: Marty would use OTPs. Network Security and Firewalls, Lesson 2: Elements of Security


37. For security, Marty uses _______________ to limit what ActiveX programs may modify and he uses __________ to limit what a Java applet scan do. (Fill in the blanks) A. Execution Control Lists, sandboxing B. ACls, Java controls C. permissions, denied rights D. active auditing, port permissions

38. Jill wants to actively respond to illicit access and intrusions by either ending a login session, blocking access to certain hosts, or tracing the illicit activity back to the point of origin. What should Jill implement? A. Intrusion response B. Active auditing C. Ping of death D. Loopback intrusion protection

146 Chapter 2

37. For security, Marty uses _______________ to limit what ActiveX programs may modify and he uses __________ to limit what a Java applet scan do. (Fill in the blanks) *A. Execution Control Lists, sandboxing B. ACls, Java controls C. permissions, denied rights D. active auditing, port permissions

Explanation: ActiveX programs may be limited by Execution Control Lists (ECLs) while Java applets may be sandboxed. Network Security and Firewalls, Lesson 2: Elements of Security

38. Jill wants to actively respond to illicit access and intrusions by either ending a login session, blocking access to certain hosts, or tracing the illicit activity back to the point of origin. What should Jill implement? A. Intrusion response *B. Active auditing C. Ping of death D. Loopback intrusion protection

Explanation: Jill should implement active auditing. Network Security and Firewalls, Lesson 2: Elements of Security


39. Debbie wants to use public key encryption. She is interested in how she can distribute the public key pairs either manually or automatically. Which of the following statements are true of public key exchange? (Choose 3): A. S/MIME and PGP use manual public key exchange. B. SSL and IPSEC exchange public keys automatically through a series of handshakes C. PPTP and TCPSEC exchange public keys automatically through PGP D. S/MIME and PGP use automatic key exchange through the Diffie-Hoffman protocol E. The public key of the recipient is used to encode messages.

40. Mark works for the NSA. He wants to crack a foreign encryption scheme as quickly as possible. What process would speed Mark's work? A. Rounds B. Parallization C. Distributed processing D. Artificial intelligence

148 Chapter 2

39. Debbie wants to use public key encryption. She is interested in how she can distribute the public key pairs either manually or automatically. Which of the following statements are true of public key exchange? (Choose 3): *A. S/MIME and PGP use manual public key exchange. *B. SSL and IPSEC exchange public keys automatically through a series of handshakes C. PPTP and TCPSEC exchange public keys automatically through PGP D. S/MIME and PGP use automatic key exchange through the Diffie-Hoffman protocol *E. The public key of the recipient is used to encode messages.

Explanation: S/MIME and PGP use manual public key exchange. SSL and IPSEC exchange public keys automatically through a series of handshakes. The public key of the recipient is used to encode messages. Network Security and Firewalls, Lesson 3: Applied Encryption

40. Mark works for the NSA. He wants to crack a foreign encryption scheme as quickly as possible. What process would speed Mark's work? A. Rounds *B. Parallization C. Distributed processing D. Artificial intelligence

Explanation: In parallelization, multiple processors, computers and processes are used to crack an encryption code. Network Security and Firewalls, Lesson 3: Applied Encryption


41. Mark wants to increase the speed and strength of a 128 bit encryption process. He should use the following: A. Rounds B. Parallelization C. Proxy encryption D. Multiprocess encryption E. Strong encryption

42. What is the biggest strength and what is the biggest weakness of symmetric key encryption? A. Strength: Fast and strong B. Strength: Security of algorithm C. Weakness: Key distribution D. Weakness: Possible compromise of algorithm E. Weakness: No support for trusted functionality

150 Chapter 2

41. Mark wants to increase the speed and strength of a 128 bit encryption process. He should use the following: *A. Rounds B. Parallelization C. Proxy encryption D. Multiprocess encryption E. Strong encryption

Explanation: Mark should use rounds. Strong encryption using a key longer than 128 bits would not increase speed. Network Security and Firewalls, Lesson 3: Applied Encryption

42. What is the biggest strength and what is the biggest weakness of symmetric key encryption? *A. Strength: Fast and strong B. Strength: Security of algorithm *C. Weakness: Key distribution D. Weakness: Possible compromise of algorithm E. Weakness: No support for trusted functionality

Explanation: Symmetric key encryption is fast and strong, but the key must be securely distributed. Network Security and Firewalls, Lesson 3: Applied Encryption


43. How would Joe the hacker most likely defeat symmetric encryption? (Choose 3): A. Brute force attack B. Dictionary attack C. Password sniffing D. IP spoofing E. Masquerade attack

44. DES,Triple DES, RSA, RC2, RC4, RC5, RC6, Mars, Twofish and Serpent are examples of what? A. Algorithms that have been routinely compromised B. Experimental algorithms C. Symmetric algorithms D. Asymmetric algorithms E. Hash algorithms

152 Chapter 2

43. How would Joe the hacker most likely defeat symmetric encryption? (Choose 3): *A. Brute force attack *B. Dictionary attack *C. Password sniffing D. IP spoofing E. Masquerade attack

Explanation: Symmetric keys can be defeated with a brute force attack, password sniffing or a dictionary program. Network Security and Firewalls, Lesson 3: Applied Encryption

44. DES,Triple DES, RSA, RC2, RC4, RC5, RC6, Mars, Twofish and Serpent are examples of what? A. Algorithms that have been routinely compromised B. Experimental algorithms *C. Symmetric algorithms D. Asymmetric algorithms E. Hash algorithms Explanation: DES,Triple DES, RSA, RC2, RC4, RC5, RC6, Mars, Twofish and Serpent are examples of symmetric algorithms.Security and Firewalls, Lesson 3: Applied Encryption


45. Which of the following is/are the most popular symmetric algorithm that use(s) 128 bits in the US and 40 bits internationally? A. RSA B. RC2 and RC4 C. Serpent D. Dragon Fish

46. Nancy buys a Sony High Definition TV. Her cable company encodes broadcasts of pay per view channels using a fast, strong encryption algorithm that supports block sizes up to 256 bits. What algorithm is works extremely well with even HDTV, ATM, and ISDN? A. Rijndael B. Skipjack C. DES D. RSA

154 Chapter 2

45. Which of the following is/are the most popular symmetric algorithm that use(s) 128 bits in the US and 40 bits internationally? A. RSA *B. RC2 and RC4 C. Serpent D. Dragon Fish

Explanation: RC2 and RC4 are the most popular symmetric key algorithms. Network Security and Firewalls, Lesson 3: Applied Encryption

46. Nancy buys a Sony High Definition TV. Her cable company encodes broadcasts of pay per view channels using a fast, strong encryption algorithm that supports block sizes up to 256 bits. What algorithm is works extremely well with even HDTV, ATM, and ISDN? *A. Rijndael B. Skipjack C. DES D. RSA

Explanation: Rijndael can perform quickly on about anything. Network Security and Firewalls, Lesson 3: Applied Encryption


47. Which of the following statements are true about asymmetric encryption? A. It's relatively fast B. It solves the problem of secure key distribution over the Internet C. RSA, DSA, and Diffie-Hellman are examples D. It employees a hash function E. The private key is distributed securely

48. Which of the following are examples of hash encryption? (Choose 2): A. Signing B. Sealing C. MD2, MD4, MD5 and SHA D. MARS, RC6 and DES E. RSA, DSA, and Diffie-Hellman

156 Chapter 2

47. Which of the following statements are true about asymmetric encryption? A. It's relatively fast *B. It solves the problem of secure key distribution over the Internet *C. RSA, DSA, and Diffie-Hellman are examples *D. It employees a hash function E. The private key is distributed securely

Explanation: Asymmetric encryption is slow. Only the public key is distributed securely. Network Security and Firewalls, Lesson 3: Applied Encryption

48. Which of the following are examples of hash encryption? (Choose 2): *A. Signing B. Sealing *C. MD2, MD4, MD5 and SHA D. MARS, RC6 and DES E. RSA, DSA, and Diffie-Hellman

Explanation: Signing is an example of a one-way encryption algorithm or hash. Hash algorithms are Message digest 2, 4 and 5 as well as secure Hash Algorithm. Network Security and Firewalls, Lesson 3: Applied Encryption


49. Alfie wants to know what encryption is all about nowadays. Which encryption process is most prevalent today? A. Symmetric B. Asymmetric C. Hash D. A combination of symmetric, asymmetric, and hash encryption.

50. Marty want to encrypt his email. What are the two most popular techniques? A. PGP B. S-SMTP C. PGL D. S-MIME

158 Chapter 2

49. Alfie wants to know what encryption is all about nowadays. Which encryption process is most prevalent today? A. Symmetric B. Asymmetric C. Hash *D. A combination of symmetric, asymmetric, and hash encryption.

Explanation: A combination of encryption processes capitalizes on their respective strengths and minimizes their respective vulnerabilities. Network Security and Firewalls, Lesson 3: Applied Encryption

50. Marty want to encrypt his email. What are the two most popular techniques? *A. PGP B. S-SMTP C. PGL *D. S-MIME

Explanation: Pretty Good Privacy and Secure MIME are the most common ways to encrypt email. Network Security and Firewalls, Lesson 3: Applied Encryption


51. David wants to secure his BetweenBookends.com Website for secure online ordering. What choices does he have and what are the notable differences? (Choose one or more correct choices): A. HTTPS is the same as SSL B. HTTPS only encrypts HTTP traffic C. HTTPS might be more secure because encryption takes place at a higher level on the OSI model D. Only SSL requires a certificate E. In SSL usually only the server is authenticated

52. SSL was invented by ___________ and has been a standard since 1995. A. AOL B. Netscape C. Microsoft D. Apple E. IBM

160 Chapter 2

51. David wants to secure his BetweenBookends.com Website for secure online ordering. What choices does he have and what are the notable differences? (Choose one or more correct choices): A. HTTPS is the same as SSL *B. HTTPS only encrypts HTTP traffic C. HTTPS might be more secure because encryption takes place at a higher level on the OSI model D. Only SSL requires a certificate *E. In SSL usually only the server is authenticated

Explanation: SSL may be more secure because encryption takes place at a lower level of the OSI model. The whole packet is encrypted in SSL so more kinds of network traffic than HTTP may be encrypted. Both HTTPS and SSL require certificates. Client authentication in SSL only occurs if the client has a certificate. Most Internet clients do not have certificates. Network Security and Firewalls, Lesson 3: Applied Encryption

52. SSL was invented by ___________ and has been a standard since 1995. A. AOL *B. Netscape C. Microsoft D. Apple E. IBM

Explanation: SSL was invented by Netscape and has been a standard since 1995. Network Security and Firewalls, Lesson 3: Applied Encryption


53. Secure HTTP uses _____________ encryption to exchange a 128 bit (US) or 40 bit (international) session key and then uses this shared secret for the rest of the connection. A. Asymmetric B. Symmetric C. SSL D. SHA E. Hash

54. Randy wants to encapsulate and encrypt data packets so that confidential corporate information may be securely passed through the Internet which may be used as a low cost corporate backbone. What are the two most popular alternatives? A. PPTP B. COMSEC C. PPP D. IPSEC E. SA

162 Chapter 2

53. Secure HTTP uses _____________ encryption to exchange a 128 bit (US) or 40 bit (international) session key and then uses this shared secret for the rest of the connection. *A. Asymmetric B. Symmetric C. SSL D. SHA E. Hash

Explanation: Secure HTTP uses asymmetric encryption to exchange a 128 bit (US) or 40 bit (international) session key and initiate a secure connection, and then uses this shared secret for the rest of the connection. Network Security and Firewalls, Lesson 3: Applied Encryption

54. Randy wants to encapsulate and encrypt data packets so that confidential corporate information may be securely passed through the Internet which may be used as a low cost corporate backbone. What are the two most popular alternatives? *A. PPTP B. COMSEC C. PPP *D. IPSEC E. SA

Explanation: PPTP and IPSEC are the most popular VPN protocols. IPSEC supports header compression. Network Security and Firewalls, Lesson 3: Applied Encryption


55. Two major airlines merge. They want their staffs to be able to securely communicate with each other without installing any additional software or hardware on client’s machines. They set up their respective firewalls to communicate directly with each other using a VPN. What is the term to describe what they have created? A. Virtual Network Perimeter B. Public Key Infrastructure C. L2TP+ D. Pretty Good Privacy E. Firewall of Firewalls

56. VeriSign maintains a hierarchy of ___________ servers for managing public keys, certificates and signatures. A. Digital Signature B. CA C. PKI D. Digital Certificate

164 Chapter 2

55. Two major airlines merge. They want their staffs to be able to securely communicate with each other without installing any additional software or hardware on client’s machines. They set up their respective firewalls to communicate directly with each other using a VPN. What is the term to describe what they have created? *A. Virtual Network Perimeter B. Public Key Infrastructure C. L2TP+ D. Pretty Good Privacy E. Firewall of Firewalls

Explanation: They have created a Virtual Network Perimeter. Network Security and Firewalls, Lesson 3: Applied Encryption

56. VeriSign maintains a hierarchy of ___________ servers for managing public keys, certificates and signatures. A. Digital Signature B. CA *C. PKI D. Digital Certificate

Explanation: VeriSign maintains a hierarchy of Public Key Infrastructure (PKI) servers for managing public keys, certificates and signatures. Network Security and Firewalls, Lesson 3: Applied Encryption


57. What kind of digital certificate does Jake need to send secure email? A. Certificate Authority Certificate B. Server Certificate C. Personal Certificate D. Software or Publisher Certificate E. S-MIME certificate

58. Jake uses a complex password. What type of attack is Jake thwarting? (Choose the best answer): A. Dictionary attack B. Brute force attack C. Front door attack D. Back door attack

166 Chapter 2

57. What kind of digital certificate does Jake need to send secure email? A. Certificate Authority Certificate B. Server Certificate *C. Personal Certificate D. Software or Publisher Certificate E. S-MIME certificate

Explanation: Jake needs a personal certificate. Network Security and Firewalls, Lesson 3: Applied Encryption

58. Jake uses a complex password. What type of attack is Jake thwarting? (Choose the best answer): *A. Dictionary attack B. Brute force attack C. Front door attack D. Back door attack

Explanation: By using a non-dictionary password, Jake is thwarting a dictionary attack. A complex password should have three or four of the following elements: uppercase letters, lowercase letters, numbers, non-alphanumeric characters, such as punctuation. Network Security and Firewalls, Lesson 4: Types of Attacks


59. In examining the audit logs, George notices a ton of failed logon attempts to the RAS server at 2 AM each morning. He excludes user logon for hours from midnight to 6 AM. What type of attack is George trying to prevent? (Choose the best answer): A. Brute force B. Front door attack C. Back door attack D. Trojan Attack

60. Someone has altered a sensitive Human Resources file. Frank initiates auditing on the HR folder for successful as well as failed access. What type of attack is Frank trying to defeat? (Choose the best answer): A. Front-door attack B. Back-door attack C. Outsider attack D. Insider attack

168 Chapter 2

59. In examining the audit logs, George notices a ton of failed logon attempts to the RAS server at 2 AM each morning. He excludes user logon for hours from midnight to 6 AM. What type of attack is George trying to prevent? (Choose the best answer): *A. Brute force B. Front door attack C. Back door attack D. Trojan Attack

Explanation: Brute force attacks are often easy to detect because they involve repeated logon attempts. Network Security and Firewalls, Lesson 4: Types of Attacks

60. Someone has altered a sensitive Human Resources file. Frank initiates auditing on the HR folder for successful as well as failed access. What type of attack is Frank trying to defeat? (Choose the best answer): *A. Front-door attack B. Back-door attack C. Outsider attack D. Insider attack

Explanation: In a front door attack a hacker enters the system disguised as a legitimate user and attempts to gain unauthorized access to resources. Network Security and Firewalls, Lesson 4: Types of Attacks


61. Judy is a security auditor. She uses the NAT program to probe for weak passwords. What type of attacks is Judy simulating? (Choose 2): A. Brute Force Attack B. Dictionary attack C. Front door attack D. Back door attack

62. Jeff worked on a major software project for GeminiSoftware. He was laid off after it was discovered that he was hacking banks on the side. His boss, Marsha does a top to bottom review of his code to insure that he left no secret way to bypass security and gain access to the program directly without using an authorized username and password. What type of attack is Marsha protecting against? A. Backdoor B. Front door C. Buffer overflow D. Brute Force Attack

170 Chapter 2

61. Judy is a security auditor. She uses the NAT program to probe for weak passwords. What type of attacks is Judy simulating? (Choose 2): *A. Brute Force Attack *B. Dictionary attack C. Front door attack D. Back door attack

Explanation: Many password attack programs will first try dictionary words as passwords and then try all the random combinations. The passwords can still be broken, but it takes a lot more time if complex passwords are used. Network Security and Firewalls, Lesson 4: Types of Attacks

62. Jeff worked on a major software project for GeminiSoftware. He was laid off after it was discovered that he was hacking banks on the side. His boss, Marsha does a top to bottom review of his code to insure that he left no secret way to bypass security and gain access to the program directly without using an authorized username and password. What type of attack is Marsha protecting against? *A. Backdoor B. Front door C. Buffer overflow D. Brute Force Attack

Explanation: Marsha is making sure that Jeff didn't leave a back door. Network Security and Firewalls, Lesson 4: Types of Attacks


63. Marsha uses Windows 2000 domain policy to insure that her user’s software is automatically updated with the latest security patches. What is Marsha defending against? A. Bugs B. A back door C. A front door D. A root kit

64. John is called by a person purporting to represent his ISP with the news that several user passwords have been compromised, could John change his password online and then give the caller the old password which they will use to bait a duplicate account. The caller does not want access to John's ISP account, but hopes that John is using the same password on his work account. What type of attack is John being subjected to? A. Social engineering B. Root kit C. Impersonation D. Back door

172 Chapter 2

63. Marsha uses Windows 2000 domain policy to insure that her user’s software is automatically updated with the latest security patches. What is Marsha defending against? *A. Bugs B. A back door C. A front door D. A root kit

Explanation: Bugs are unintentional security loopholes that can often be fixed with patches or service packs. Network Security and Firewalls, Lesson 4: Types of Attacks

64. John is called by a person purporting to represent his ISP with the news that several user passwords have been compromised, could John change his password online and then give the caller the old password which they will use to bait a duplicate account. The caller does not want access to John's ISP account, but hopes that John is using the same password on his work account. What type of attack is John being subjected to? *A. Social engineering B. Root kit C. Impersonation D. Back door

Explanation: In social engineering, the user is conned. Network Security and Firewalls, Lesson 4: Types of Attacks


65. In IP spoofing and "man-in-the-middle " attacks the impersonated system is often crashed using a ____________ attack. A. Social engineering B. Two-Fish C. DOS D. Front door

66. Within the Research and Development department Jerry implements IPv6 in order to defeat identity theft. What type of attack is Jerry defending against? A. Spoofing B. Rope-a-dope C. DOS D. Fraudulent e-mail E. RSA

174 Chapter 2

65. In IP spoofing and "man-in-the-middle " attacks the impersonated system is often crashed using a ____________ attack. A. Social engineering B. Two-Fish *C. DOS D. Front door

Explanation: A denial of service (DOS) attack is often used to crash the system to be impersonated. Network Security and Firewalls, Lesson 4: Types of Attacks

66. Within the Research and Development department Jerry implements IPv6 in order to defeat identity theft. What type of attack is Jerry defending against? *A. Spoofing B. Rope-a-dope C. DOS D. Fraudulent e-mail E. RSA

Explanation: Jerry is defending against spoofing. IPv4 is subject to the following types of spoofing: IP, ARP, router and DNS spoofing. Network Security and Firewalls, Lesson 4: Types of Attacks


67. Barbara tries to follow recommended security principles. Good general security principles include: A. Be neurotic B. Have a security policy that considers training, multiple techniques and physical security C. Minimize the damage D. Place equipment according to business needs

68. If James is "paranoid" about security he will do which of the following? A. Install keyloggers on high-risk server computers B. Assume that once his network is connected to the Internet it is a target for attack. C. Have backups in place in case one area is breached, the damage can be contained. D. Limit what users can access in case a hacker gains access to a legitimate username and password. E. Protect your FTP files separately from your Web files.

176 Chapter 2

67. Barbara tries to follow recommended security principles. Good general security principles include: A. Be neurotic *B. Have a security policy that considers training, multiple techniques and physical security *C. Minimize the damage *D. Place equipment according to business needs Explanation: You should be paranoid, and not neurotic. Network Security and Firewalls, Lesson 5: General Security Principles

68. If James is "paranoid" about security he will do which of the following? A. Install keyloggers on high-risk server computers *B. Assume that once his network is connected to the Internet it is a target for attack. *C. Have backups in place in case one area is breached, the damage can be contained. *D. Limit what users can access in case a hacker gains access to a legitimate username and password. *E. Protect your FTP files separately from your Web files.

Explanation: Security professionals should expect that things will go wrong. Network Security and Firewalls, Lesson 5: General Security Principles


69. Why should www.TopBets.com have a security policy? A. To eliminate security loopholes B. To inform and motivate users and administrators of their goals and roles in corporate security. C. To provide a foundation for individual security measures. D. To make consistent decisions as you secure your network.

70. Jake is an administrator for MommaCookies.com. He creates an a standard user account for himself with limited privileges and uses this account when not doing administrative tasks. He also resists the attempts of the CEO to be granted administrative access. What security principle is Jake following? A. No system or technique stands alone B. Minimize the damage C. Be paranoid D. Deploy companywide enforcement

178 Chapter 2

69. Why should www.TopBets.com have a security policy? *A. To eliminate security loopholes *B. To inform and motivate users and administrators of their goals and roles in corporate security. *C. To provide a foundation for individual security measures. *D. To make consistent decisions as you secure your network.

Explanation: All of the above are important. Network Security and Firewalls, Lesson 5: General Security Principles

70. Jake is an administrator for MommaCookies.com. He creates an a standard user account for himself with limited privileges and uses this account when not doing administrative tasks. He also resists the attempts of the CEO to be granted administrative access. What security principle is Jake following? A. No system or technique stands alone B. Minimize the damage C. Be paranoid *D. Deploy companywide enforcement

Explanation: Jake is deploying companywide enforcement. Network Security and Firewalls, Lesson 5: General Security Principles


71. Laura Croft understands that security is more than code on machines. What is one of the most effective and easiest to implement security measures? A. Physical security B. Training C. Security policy D. Password policy

72. Voyager Computer Games has a policy that beta software will not be installed on Web servers, and indeed all software to be installed in the DMZ must be thoroughly tested and approved before deployment, and that no new ports will be opened on their firewalls without higher approval. What security principle is Voyager Computer Games following? A. Minimize the damage B. No system or technique stands alone C. Deploy companywide enforcement D. Use an integrated security policy

180 Chapter 2

71. Laura Croft understands that security is more than code on machines. What is one of the most effective and easiest to implement security measures? A. Physical security *B. Training C. Security policy D. Password policy

Explanation: Proper training is one of the easiest and most effective measure you can implement. Network Security and Firewalls, Lesson 5: General Security Principles

72. Voyager Computer Games has a policy that beta software will not be installed on Web servers, and indeed all software to be installed in the DMZ must be thoroughly tested and approved before deployment, and that no new ports will be opened on their firewalls without higher approval. What security principle is Voyager Computer Games following? A. Minimize the damage B. No system or technique stands alone C. Deploy companywide enforcement *D. Use an integrated security policy

Explanation: Voyager Computer Games is following an integrated security policy. Network Security and Firewalls, Lesson 5: General Security Principles


73. Voyager Computer Games has a policy that no hardware or software is deployed without going through their testing lab to determine if it meets a unique need not served by existing hardware or software; to determine the impact of this hardware or software on all users; and to determine the total cost of ownership of this hardware or software including any security implications. What security principle is Voyager Computer Games following? A. Place equipment according to needs B. Use an integrated security policy C. No system or technique stands alone D. Deploy companywide enforcement

74. Ben secures the server room with a crypto lock and that it is used. He makes sure that no one can gain entry by crawling through a drop ceiling. The server room and the corporate office each have security alarms. He makes sure that any vendors that work in the server room are escorted. He installs video surveillance cameras. what security principle is Ben following? A. Provide training B. Consider physical security C. Place equipment according to needs D. Use an integrated security policy. E. No system or technique stands alone

182 Chapter 2

73. Voyager Computer Games has a policy that no hardware or software is deployed without going through their testing lab to determine if it meets a unique need not served by existing hardware or software; to determine the impact of this hardware or software on all users; and to determine the total cost of ownership of this hardware or software including any security implications. What security principle is Voyager Computer Games following? *A. Place equipment according to needs B. Use an integrated security policy C. No system or technique stands alone D. Deploy companywide enforcement

Explanation: Voyager Computer Games is placing equipment according to needs. Network Security and Firewalls, Lesson 5: General Security Principles

74. Ben secures the server room with a crypto lock and that it is used. He makes sure that no one can gain entry by crawling through a drop ceiling. The server room and the corporate office each have security alarms. He makes sure that any vendors that work in the server room are escorted. He installs video surveillance cameras. what security principle is Ben following? A. Provide training *B. Consider physical security C. Place equipment according to needs D. Use an integrated security policy. E. No system or technique stands alone

Explanation: Ben is concerned about physical security. In a few minutes, someone could pop the hard drive out of the server if you let them. Network Security and Firewalls, Lesson 5: General Security Principles


75. For security between buildings at a defense contractor, the cable is fiber and it is buried in steel reinforced concrete with an intrusion detection system. What layer of the OSI model is the defense contractor securing? A. Physical B. Datalink C. Network D. Transport E. TDI

76. A smurf attack is a form of _________ attack. It uses ________ packets, and operates at the ______ layer. Fill in the blanks. A. Denial of service, ICMP, network B. Tribal flood, UDP, network C. Tribal flood, TCP, transport D. Denial of service, ping, transport

184 Chapter 2

75. For security between buildings at a defense contractor, the cable is fiber and it is buried in steel reinforced concrete with an intrusion detection system. What layer of the OSI model is the defense contractor securing? *A. Physical B. Datalink C. Network D. Transport E. TDI

Explanation: The physical layer is being protected. Encryption, data labels and data padding also help secure the physical layer. Network Security and Firewalls, Lesson 6: Protocol Layers and Security

76. A smurf attack is a form of _________ attack. It uses ________ packets, and operates at the ______ layer. Fill in the blanks. *A. Denial of service, ICMP, network B. Tribal flood, UDP, network C. Tribal flood, TCP, transport D. Denial of service, ping, transport

Explanation: A smurf attack is a form of denial of service attack. It uses ping or ICMP packets, and operates at the network layer. Network Security and Firewalls, Lesson 6: Protocol Layers and Security


77. Judy's server has brought to its knees by an enormous number of zombie client SYN TCP handshake request packets that are not followed by the a zombie client ACK packets to the server. What type of attack is being performed on Judy's server? A. TCP FIN attack B. ACK-less attack C. SYN flood attack D. SIN attack

78. Jeremy often begins his attacks of a firewall with a ____________. A. Port scan B. UDP bridge attack C. TCP food attack D. Smurf attack

186 Chapter 2

77. Judy's server has brought to its knees by an enormous number of zombie client SYN TCP handshake request packets that are not followed by the a zombie client ACK packets to the server. What type of attack is being performed on Judy's server? A. TCP FIN attack B. ACK-less attack *C. SYN flood attack D. SIN attack

Explanation: Judy's server is experiencing a SYN flood attack. Network Security and Firewalls, Lesson 6: Protocol Layers and Security

78. Jeremy often begins his attacks of a firewall with a ____________. *A. Port scan B. UDP bridge attack C. TCP food attack D. Smurf attack

Explanation: A port scan for open ports on the firewall is often the first step in an attempted breach. Network Security and Firewalls, Lesson 6: Protocol Layers and Security


79. Jeremy institutes a virus checker that will scan incoming email attachments for viruses and Trojans and then after stripping any malicious attachment the intended recipient, the sender and the email administrator are informed of the malicious email content. What layer of the OSI model is Jeremy protecting? A. Network layer B. Transport layer C. Application layer D. Session layer E. Presentation layer

80. Wendy implements logging on her FTP server. She only allows anonymous account access and institutes strict disk quotes on her Novell server for files uploaded by the anonymous user account. What is Wendy protecting against? A. Hackers uploading erroneous information to fill up the hard disk space. B. Using the target company's FTP server to store pirated software or stolen credit card numbers for the hacker and his cohorts. C. Filling up the FTP server drive to crash the OS and take advantage of a remaining shell in Unix D. Filling up the FTP server drive to prevent the FTP log from detecting further activities. E. Capturing the username and password of an illegitimate user and then using that account against a different corporate server.

188 Chapter 2

79. Jeremy institutes a virus checker that will scan incoming email attachments for viruses and Trojans and then after stripping any malicious attachment the intended recipient, the sender and the email administrator are informed of the malicious email content. What layer of the OSI model is Jeremy protecting? A. Network layer B. Transport layer *C. Application layer D. Session layer E. Presentation layer

Explanation: Jeremy is protecting the Application layer. Network Security and Firewalls, Lesson 6: Protocol Layers and Security

80. Wendy implements logging on her FTP server. She only allows anonymous account access and institutes strict disk quotes on her Novell server for files uploaded by the anonymous user account. What is Wendy protecting against? *A. Hackers uploading erroneous information to fill up the hard disk space. *B. Using the target company's FTP server to store pirated software or stolen credit card numbers for the hacker and his cohorts. *C. Filling up the FTP server drive to crash the OS and take advantage of a remaining shell in Unix *D. Filling up the FTP server drive to prevent the FTP log from detecting further activities. E. Capturing the username and password of an illegitimate user and then using that account against a different corporate server.

Explanation: Capturing the username and password of a legitimate user and then using that account against a different corporate server would be useful. Network Security and Firewalls, Lesson 6: Protocol Layers and Security


81. Mike wants to protect his users from malicious code from Web servers. What does Mike want too protect against? (Choose 3): A. Unsigned ActiveX controls B. Malicious Java applets C. HTTPS applications D. Programs with low content ratings E. Untested plug-in to the browser

82. Marty knows how to use Telnet, rsh, and rlogin. Which of the following are security precautions that Marty should take? (Choose 2): A. Use Telnet instead of trsh and rlogin B. Never use any of these programs C. Don't use Telnet over the Internet D. Use rsh instead of Telnet. Log in with a regular user account. Go secure and then upgrade to root privileges with the SU command.

190 Chapter 2

81. Mike wants to protect his users from malicious code from Web servers. What does Mike want too protect against? (Choose 3): *A. Unsigned ActiveX controls *B. Malicious Java applets C. HTTPS applications D. Programs with low content ratings *E. Untested plug-in to the browser

Explanation: Plug-ins, including ActiveX and Java are potential security loopholes. Policies should be set to either block plug-ins or at least warn about unsigned controls. Network Security and Firewalls, Lesson 6: Protocol Layers and Security

82. Marty knows how to use Telnet, rsh, and rlogin. Which of the following are security precautions that Marty should take? (Choose 2): *A. Use Telnet instead of trsh and rlogin B. Never use any of these programs *C. Don't use Telnet over the Internet D. Use rsh instead of Telnet. Log in with a regular user account. Go secure and then upgrade to root privileges with the SU command.

Explanation: The r-series programs should not be used.Ttelnet should be used instead, but not over the Internet. Network Security and Firewalls, Lesson 6: Protocol Layers and Security


83. Carlos uses SNMP on his network, but does not want anyone to come in through the firewall and impersonate a SNMP Network Management Station. What can Carlos do to increase SNMP security? (Choose 2): A. Disable TCP Ports 161 and 162. B. Disable UDP Ports 161 and 162. C. Upgrade to SNMPv3 D. Use Public as the Community Name

84. Nancy wants to secure her DNS server. What steps might Nancy take? A. Have a separate DNS server inside the firewall with internal records, while placing a DNS server outside the firewall with only the DNS records of publicly accessible resources such as the Web server. Prohibit outbound zone transfers through the firewall. B. Prohibit zone transfers to other DNS servers that are not specifically enumerated. C. Close down UDP port 53 inbound D. Close down TCP port 53 outbound. E. Close down TCP port 53 inbound

192 Chapter 2

83. Carlos uses SNMP on his network, but does not want anyone to come in through the firewall and impersonate a SNMP Network Management Station. What can Carlos do to increase SNMP security? (Choose 2): A. Disable TCP Ports 161 and 162. *B. Disable UDP Ports 161 and 162. *C. Upgrade to SNMPv3 D. Use Public as the Community Name

Explanation: Carlos should disable inbound access to UDP ports 161 and 162 on the firewall and upgrade to SNMPv3. Network Security and Firewalls, Lesson 6: Protocol Layers and Security

84. Nancy wants to secure her DNS server. What steps might Nancy take? *A. Have a separate DNS server inside the firewall with internal records, while placing a DNS server outside the firewall with only the DNS records of publicly accessible resources such as the Web server. Prohibit outbound zone transfers through the firewall. *B. Prohibit zone transfers to other DNS servers that are not specifically enumerated. *C. Close down UDP port 53 inbound D. Close down TCP port 53 outbound. E. Close down TCP port 53 inbound

Explanation: Nancy doesn't want to expose the resource records of internal resources on the Internet. UDP port 53 is used for DNS queries. Network Security and Firewalls, Lesson 6: Protocol Layers and Security


85. George's home computer running Windows 200 Professional has been hacked twice since he has installed a cable modem. He wants to disable just about all inbound ports on his computer with the least amount of effort. George should? A. Install Easy Proxy B. Use Network Address Translation C. Use ICS D. Use the Advanced properties of TCP/IP

86. In order to secure the most commonly attacked servers - Web, FTP and SMTP, Brian implements a five step, iterative security policy. What should the order of these steps be? A. Categorize resources and their needs; define a security policy; secure each resource and service; log test and evaluate; repeat the process and keep current. B. Define a security policy; categorize resources and their needs; secure each resource and service; log test and evaluate; repeat the process and keep current. C. Log test and evaluate; categorize resources and their needs; define a security policy; secure each resource and service; repeat the process and keep current. D. Define a security policy; categorize resources and their needs; log, test and evaluate; secure each resource and service; and then repeat the process and keep current.

194 Chapter 2

85. George's home computer running Windows 200 Professional has been hacked twice since he has installed a cable modem. He wants to disable just about all inbound ports on his computer with the least amount of effort. George should? A. Install Easy Proxy B. Use Network Address Translation C. Use ICS *D. Use the Advanced properties of TCP/IP

Explanation: George should disable ports using the Advanced properties of TCP/IP. Network Security and Firewalls, Lesson 6: Protocol Layers and Security

86. In order to secure the most commonly attacked servers - Web, FTP and SMTP, Brian implements a five step, iterative security policy. What should the order of these steps be? *A. Categorize resources and their needs; define a security policy; secure each resource and service; log test and evaluate; repeat the process and keep current. B. Define a security policy; categorize resources and their needs; secure each resource and service; log test and evaluate; repeat the process and keep current. C. Log test and evaluate; categorize resources and their needs; define a security policy; secure each resource and service; repeat the process and keep current. D. Define a security policy; categorize resources and their needs; log, test and evaluate; secure each resource and service; and then repeat the process and keep current.

Explanation: Brian should categorize resources and their needs; define a security policy; secure each resource and service; log test and evaluate; and then repeat the process and keep current. Network Security and Firewalls, Lesson 7: Securing Resources


87. Brian wants to secure each resource and service on his most vulnerable servers. What steps should Brian take? A. Change server and system defaults. B. Remove extraneous services C. Ensure physical security D. Lock down registry keys and password files E. Constantly monitor internal user connections to his servers.

88. How can Sandy protect the Web server if the FTP server is compromised or protect the compromise of the Web server from compromising the operating system? A. Place the OS, Web Server, and FTP server on different hard drives or hard drive partitions. B. Remove unnecessary services C. Disable Perl and CGI and replace them with ISAPI D. Change system defaults.

196 Chapter 2

87. Brian wants to secure each resource and service on his most vulnerable servers. What steps should Brian take? *A. Change server and system defaults. *B. Remove extraneous services *C. Ensure physical security *D. Lock down registry keys and password files E. Constantly monitor internal user connections to his servers.

Explanation: Brian should constantly monitor public connections to his servers. Network Security and Firewalls, Lesson 7: Securing Resources

88. How can Sandy protect the Web server if the FTP server is compromised or protect the compromise of the Web server from compromising the operating system? *A. Place the OS, Web Server, and FTP server on different hard drives or hard drive partitions. B. Remove unnecessary services C. Disable Perl and CGI and replace them with ISAPI D. Change system defaults.

Explanation: Sandy should place the OS, Web Server, and FTP server on different hard drives or hard drive partitions. The Web server files and the Web server program should also be placed on separate partitions. Network Security and Firewalls, Lesson 7: Securing Resources


89. Sandy wants to protect his CGI scripts. What should Sandy do? (Choose 2): A. At the Web server, remove the execute permission. B. At the web server, allow only the script permission C. Place CGI, PERL and ISAPI scripts on another partition D. Prohibit write access to that partition by the OS.

90. Eddie knows that much of the security of IIS is based on NTFS permissions. What can Eddie do to thwart a hacker in the middle of the night? A. Set an alarm B. Set an authentication trap C. Program the system to reset permissions every hour during the times that the server is unused or lightly used. D. Log off the Web server at the end of the day

198 Chapter 2

89. Sandy wants to protect his CGI scripts. What should Sandy do? (Choose 2): A. At the Web server, remove the execute permission. B. At the web server, allow only the script permission *C. Place CGI, PERL and ISAPI scripts on another partition *D. Prohibit write access to that partition by the OS.

Explanation: CGI scripts must have the execute permission on the Web server. ISAPI scripts need only script permission. Management may direct that all CGI scripts be independent checked for security. Network Security and Firewalls, Lesson 7: Securing Resources

90. Eddie knows that much of the security of IIS is based on NTFS permissions. What can Eddie do to thwart a hacker in the middle of the night? A. Set an alarm B. Set an authentication trap *C. Program the system to reset permissions every hour during the times that the server is unused or lightly used. D. Log off the Web server at the end of the day

Explanation: Eddie could program the system to reset permissions every hour during the times that the server is unused or lightly used. Network Security and Firewalls, Lesson 7: Securing Resources


91. What are some steps that Frank can take to isolate the security of his FTP server from the security of his Web server? A. Put them on separate partitions. B. Use separate FTP server and Web server user accounts C. Do not allow upload by FTP to Web directories D. Do not allow web access to FTP root.

92. Bob goes to www.tucows.com to download an evaluation copy of a SMTP server. He is mostly concerned with the ability to host multiple email domains at a reasonable cost in terms of licensing fees and administrative burden. For securities sake, he should also pick a SMTP server that supports ___________. Fill in the blank. A. Poison reverse B. Split horizon C. Reverse DNS lookup D. MX records

200 Chapter 2

91. What are some steps that Frank can take to isolate the security of his FTP server from the security of his Web server? *A. Put them on separate partitions. *B. Use separate FTP server and Web server user accounts *C. Do not allow upload by FTP to Web directories D. Do not allow web access to FTP root.

Explanation: Web and FTP servers should be on separate partitions with separate user databases. Although common, upload by FTP to Web directories might allow a hacker to post malicious content on your Website. Network Security and Firewalls, Lesson 7: Securing Resources

92. Bob goes to www.tucows.com to download an evaluation copy of a SMTP server. He is mostly concerned with the ability to host multiple email domains at a reasonable cost in terms of licensing fees and administrative burden. For securities sake, he should also pick a SMTP server that supports ___________. Fill in the blank. A. Poison reverse B. Split horizon *C. Reverse DNS lookup D. MX records

Explanation: For securities sake, he should also pick a SMTP server that supports reverse DNS lookup. Network Security and Firewalls, Lesson 7: Securing Resources


93. In testing and evaluating his existing system John should? (Choose 3): A. Use hacker tools an techniques B. Consult server logs C. Be neurotic D. Do not become complacent

94. Hank uses network security scanning software such as Webtrends Security Analyzer. What benefits does Hank derive? A. Convenience B. Automation C. Imperviousness to countermeasures D. Evaluation of target systems against a database of known security risks and vulnerabilities E. Categorization of discovered risks

202 Chapter 2

93. In testing and evaluating his existing system John should? (Choose 3): *A. Use hacker tools an techniques *B. Consult server logs C. Be neurotic *D. Do not become complacent

Explanation: In testing and evaluating his existing system, John should use hacker tools an techniques; consult server logs; and avoid complacency. Network Security and Firewalls, Lesson 7: Securing Resources

94. Hank uses network security scanning software such as Webtrends Security Analyzer. What benefits does Hank derive? *A. Convenience *B. Automation C. Imperviousness to countermeasures *D. Evaluation of target systems against a database of known security risks and vulnerabilities *E. Categorization of discovered risks

Explanation: Network security scanners feature convenience and automation. They evaluate target systems against a database of known security risks and vulnerabilities and categorize the potential severity of the discovered vulnerabilities. Network Security and Firewalls, Lesson 7: Securing Resources


95. Dee is purchasing a firewall for MeteredResponse.com She is surprised that firewalls are much more capable nowadays. What roles can a firewall fulfill? A. Enforcing security policy B. Enforcing password policy C. Creating a choke point D. Logging Internet activity E. Limiting network exposure

96. As part of it's security policy, WestBuys.com wants to accept and reject packets based on the source and destination IP addresses and source and destination port numbers. BestWestBuys.com wants the firewall to have as little an impact on network performance as possible and for the firewall to be as inexpensive as possible, perhaps doing double duty with some other network function. What type of firewall should WestBuys.com implement? A. A packet filter on a router B. A circuit-level gateway on a bridge C. An application-layer gateway on a combination proxy server/Web server D. A bastion host on a file server.

204 Chapter 2

95. Dee is purchasing a firewall for MeteredResponse.com She is surprised that firewalls are much more capable nowadays. What roles can a firewall fulfill? *A. Enforcing security policy B. Enforcing password policy *C. Creating a choke point *D. Logging Internet activity *E. Limiting network exposure Explanation: A firewall has enpnded from being box to being a "bastion host" with multiple functions. Network Security and Firewalls, Lesson 8: Firewalls

96. As part of it's security policy, WestBuys.com wants to accept and reject packets based on the source and destination IP addresses and source and destination port numbers. BestWestBuys.com wants the firewall to have as little an impact on network performance as possible and for the firewall to be as inexpensive as possible, perhaps doing double duty with some other network function. What type of firewall should WestBuys.com implement? *A. A packet filter on a router B. A circuit-level gateway on a bridge C. An application-layer gateway on a combination proxy server/Web server D. A bastion host on a file server.

Explanation: A packet filter on a router should be implemented. Network Security and Firewalls, Lesson 8: Firewalls


97. Brandon wants to hide internal network addresses and only pay for one public IP address. Additionally, Brandon wants to filter traffic by IP addresses and port numbers. Finally. Brandon want to cache Web pages. What kind of firewall should Brandon implement? A. NAT B. Proxy server C. Packet filter D. Gateway E. Circuit level gateway

98. Brandon wants to hide internal network addresses and only pay for one public IP address. He want to use internal network numbers that will not be accessible on the Internet. What address ranges would work? (Choose three): A. 131.107.0.0 to 131.107.255.255 B. 10.0.0.0 - 10.255.255.255 C. 172.16.0.0 - 172.31.255.255 D. 192.168.0.0 - 192.168.255.255 E. 100.0.0.0 to 100.255.255.255

206 Chapter 2

97. Brandon wants to hide internal network addresses and only pay for one public IP address. Additionally, Brandon wants to filter traffic by IP addresses and port numbers. Finally. Brandon want to cache Web pages. What kind of firewall should Brandon implement? A. NAT *B. Proxy server C. Packet filter D. Gateway E. Circuit level gateway

Explanation: Brandon should implement a proxy server. Network Security and Firewalls, Lesson 8: Firewalls

98. Brandon wants to hide internal network addresses and only pay for one public IP address. He want to use internal network numbers that will not be accessible on the Internet. What address ranges would work? (Choose three): A. 131.107.0.0 to 131.107.255.255 *B. 10.0.0.0 - 10.255.255.255 *C. 172.16.0.0 - 172.31.255.255 *D. 192.168.0.0 - 192.168.255.255 E. 100.0.0.0 to 100.255.255.255

Explanation: Brandon should use NAT with 10.0.0.0 - 10.255.255.255 or 172.16.0.0 172.31.255.255 or 192.168.0.0 - 192.168.255.255 Network Security and Firewalls, Lesson 8: Firewalls


99. Brandon wants to divide up the firewall function between a screening router and an application firewall so if one host is compromised, the other host may stem the breech. What type of firewall does Brandon want to implement? A. gateway B. Double dragon C. Packet filter D. Circuit-level gateway E. Application-level gateway.

100. Mike wants to implement NAT. One what devices can Mike implement NAT and provide security? A. Proxy server B. Dual-homed host C. Single-homed host D. Router E. Bridge

208 Chapter 2

99. Brandon wants to divide up the firewall function between a screening router and an application firewall so if one host is compromised, the other host may stem the breech. What type of firewall does Brandon want to implement? A. gateway B. Double dragon C. Packet filter *D. Circuit-level gateway E. Application-level gateway.

Explanation: Brandon wants to implement a circuit-level gateway. Network Security and Firewalls, Lesson 8: Firewalls

100. Mike wants to implement NAT. One what devices can Mike implement NAT and provide security? *A. Proxy server *B. Dual-homed host C. Single-homed host *D. Router E. Bridge

Explanation: NAT should be implemented on a dual-homed host such as a proxy server or a router. Network Security and Firewalls, Lesson 8: Firewalls


101. Jake reads a computer magazine that extols the virtues of a bastion host. What are the features of a bastion host? (Choose 2): A. A bastion host is a secure computer placed between a trusted network and an untrusted one such as the Internet. B. Application layer gateways that function as bastion hosts use a separate daemon to inspect and route traffic from the outside to the internal network. C. A packet-filtering router cannot act as a bastion host. D. Circuit layer gateways that function as bastion hosts use a separate daemon to inspect and route traffic from the outside to the internal network.

102. Marty is considering the cost of buying a firewall appliance or a firewall package such as Axent Raptor or Checkpoint Firewall-1. What are some considerations? A. With a firewall package you pay a licensing fee to the firewall vendor, and you also have to provide a box with a licensed OS such as NT, or Unix. B. With a firewall package, the extra cost of the OS (such as NT) is offset by the additional functions that the OS can perform such as file and print sharing. C. With a firewall appliance you pay one price for a firewall box. D. The box that serves as a firewall should be hardened by removing unnecessary protocols and applications.

210 Chapter 2

101. Jake reads a computer magazine that extols the virtues of a bastion host. What are the features of a bastion host? (Choose 2): *A. A bastion host is a secure computer placed between a trusted network and an untrusted one such as the Internet. *B. Application layer gateways that function as bastion hosts use a separate daemon to inspect and route traffic from the outside to the internal network. C. A packet-filtering router cannot act as a bastion host. D. Circuit layer gateways that function as bastion hosts use a separate daemon to inspect and route traffic from the outside to the internal network.

Explanation: A packet-filtering router can act as a bastion host, in which case it simply filters packets based on IP addresses and ports as opposed to inspecting the higher layers of the packets. Network Security and Firewalls, Lesson 8: Firewalls

102. Marty is considering the cost of buying a firewall appliance or a firewall package such as Axent Raptor or Checkpoint Firewall-1. What are some considerations? *A. With a firewall package you pay a licensing fee to the firewall vendor, and you also have to provide a box with a licensed OS such as NT, or Unix. B. With a firewall package, the extra cost of the OS (such as NT) is offset by the additional functions that the OS can perform such as file and print sharing. *C. With a firewall appliance you pay one price for a firewall box. *D. The box that serves as a firewall should be hardened by removing unnecessary protocols and applications.

Explanation: Boxes with firewalls should serve only that function and should be hardened. Network Security and Firewalls, Lesson 8: Firewalls


103. Marty wants to provide a higher level of security to his Internal network resources that his Web servers, but he wants to provide some protection to his Web servers. What should Marty implement? (Choose 3): A. A DMZ B. A screening router and a choke router C. A service network D. An application-level gateway

104. Mike installs Microsoft Proxy server 2.0. Now, Internet users complain that they cannot get to the corporate Web site. What is the problem? A. By default, Microsoft Proxy Server 2.0 does not listen on inbound service ports. B. By default, Microsoft Proxy Server 2.0 does not listen on outbound service ports. C. By default, Microsoft Proxy Server 2.0 does not talk on inbound service ports. D. By default, Microsoft Proxy Server 2.0 does not talk on outbound service ports.

212 Chapter 2

103. Marty wants to provide a higher level of security to his Internal network resources that his Web servers, but he wants to provide some protection to his Web servers. What should Marty implement? (Choose 3): *A. A DMZ *B. A screening router and a choke router *C. A service network D. An application-level gateway

Explanation: Marty should implement a DMZ/service network between a screening router/packet-filtering router and a chock router. Network Security and Firewalls, Lesson 8: Firewalls

104. Mike installs Microsoft Proxy server 2.0. Now, Internet users complain that they cannot get to the corporate Web site. What is the problem? *A. By default, Microsoft Proxy Server 2.0 does not listen on inbound service ports. B. By default, Microsoft Proxy Server 2.0 does not listen on outbound service ports. C. By default, Microsoft Proxy Server 2.0 does not talk on inbound service ports. D. By default, Microsoft Proxy Server 2.0 does not talk on outbound service ports.

Explanation: Port 80 has to be opened up to inbound traffic. Network Security and Firewalls, Lesson 8: Firewalls


105. Hanks FTP server uses passive FTP. Hank wants to allow internal users to hit external FTP servers; and external users that come in from any address on Port 20 to be able to access only the FTP server at on the 192.168.2.0 network; and on those FTP servers to only be able to access the standard control port and valid data transfer ephemeral ports. Which three rules should Hank implement on his packet filtering router that is acting as a firewall? A. Rule 1: Allow from IP 192.168.2.0 to IP * from port * to port 21 using TCP B. Rule 1: Allow from IP 192.168.2.0 to IP * from port * to port 80 using TCP C. Rule 2: Block from IP * to IP 192.168.2.0 from port 20 to port 1024 using TCP E. Rule 3: Allow from IP * to IP 192.168.2.0 from port 20 to port * using TCP ACK=1

106. Mark wants defense-in-depth for his network. What is normally the first line of defense for a firewall system? A. User training B. Packet filters/screening router C. Proxy server/NAT D. Choke router

214 Chapter 2

105. Hanks FTP server uses passive FTP. Hank wants to allow internal users to hit external FTP servers; and external users that come in from any address on Port 20 to be able to access only the FTP server at on the 192.168.2.0 network; and on those FTP servers to only be able to access the standard control port and valid data transfer ephemeral ports. Which three rules should Hank implement on his packet filtering router that is acting as a firewall? *A. Rule 1: Allow from IP 192.168.2.0 to IP * from port * to port 21 using TCP B. Rule 1: Allow from IP 192.168.2.0 to IP * from port * to port 80 using TCP *C. Rule 2: Block from IP * to IP 192.168.2.0 from port 20 to port 1024 using TCP *E. Rule 3: Allow from IP * to IP 192.168.2.0 from port 20 to port * using TCP ACK=1

Explanation: Rule 1: Allow from IP 192.168.2.0 to IP * from port * to port 21 using TCP Rule 2: Block from IP * to IP 192.168.2.0 from port 20 to port

Examwise for Ciw Security Professional: Exam 1d0-470

ExamWise For Exam 1D0-470 CIW Security Professional Certification (With Online Exam) (Examwise S.)

ExamWise For Exam 1D0-460 CIW Internetworking Professional Certification (With Online Exam)

CIW: Security Professional Study Guide (Exam 1D0-470)

ExamWise For Exam 1D0-420 CIW Site Designer Certification (With Online Exam)

CIW, internetworking professional: study guide

CIW: Foundations Study Guide (Exam 1D0-410)

PREPARING FOR THE PROJECT MANAGEMENT PROFESSIONAL EXAM

NYSTCE (Professional Licensing Exam Preparation)

Internet security professional reference

Professional Cocoa Application Security

CCIE Security Exam Certification Guide

CCIE Security Exam Certification Guide

MCSE Windows XP Professional Exam Cram 2 (Exam 70-270)

ExamWise For MCP MCSE Certification: Microsoft Internet Security and Acceleration (ISA) Server 2000, Enterprise Edition Exam 70-227 (With Online Exam)

Preparing for the Project Management Professional (PMP) Certification Exam

Preparing For The Project Management Professional (PMP) Certification Exam(pmp

Preparing For The Project Management Professional (PMP) Certification Exam(pmp

Preparing for the Project Management Professional (PMP) Certification Exam

Preparing for the Project Management Professional (PMP Certification Exam)

Preparing For The Project Management Professional (PMP) Certification Exam(pmp

CCNA Security Exam Cram (Exam IINS 640-553)

PMP Exam Cram 2: Project Management Professional

ExamInsight For CompTIA Security+ Certification Exam SY0-101 (ExamInsight)

CIW:Internetworking Professional: Study Guide. Exam 1D0-460

PMP Project Management Professional Exam Review Guide

Security+ Exam Cram 2 Lab Manual

Security Certification All-In-One Exam Guide

CCNA Security Study Guide: Exam 640-553

CompTIA Security+ All-in-One Exam Guide

CIW server administrator: study guide

Examwise for Ciw Security Professional: Exam 1d0-470

ExamWise For Exam 1D0-470 CIW Security Professional Certification (With Online Exam) (Examwise S.)

ExamWise For Exam 1D0-460 CIW Internetworking Professional Certification (With Online Exam)

CIW: Security Professional Study Guide (Exam 1D0-470)

ExamWise For Exam 1D0-420 CIW Site Designer Certification (With Online Exam)

CIW, internetworking professional: study guide

CIW: Foundations Study Guide (Exam 1D0-410)

PREPARING FOR THE PROJECT MANAGEMENT PROFESSIONAL EXAM

NYSTCE (Professional Licensing Exam Preparation)

Internet security professional reference

Professional Cocoa Application Security

CCIE Security Exam Certification Guide

CCIE Security Exam Certification Guide

MCSE Windows XP Professional Exam Cram 2 (Exam 70-270)

ExamWise For MCP MCSE Certification: Microsoft Internet Security and Acceleration (ISA) Server 2000, Enterprise Edition Exam 70-227 (With Online Exam)

Preparing for the Project Management Professional (PMP) Certification Exam

Preparing For The Project Management Professional (PMP) Certification Exam(pmp

Preparing For The Project Management Professional (PMP) Certification Exam(pmp

Preparing for the Project Management Professional (PMP) Certification Exam

Preparing for the Project Management Professional (PMP Certification Exam)

Preparing For The Project Management Professional (PMP) Certification Exam(pmp

CCNA Security Exam Cram (Exam IINS 640-553)

PMP Exam Cram 2: Project Management Professional

ExamInsight For CompTIA Security+ Certification Exam SY0-101 (ExamInsight)

CIW:Internetworking Professional: Study Guide. Exam 1D0-460

PMP Project Management Professional Exam Review Guide

Security+ Exam Cram 2 Lab Manual

Security Certification All-In-One Exam Guide

CCNA Security Study Guide: Exam 640-553

CompTIA Security+ All-in-One Exam Guide

CIW server administrator: study guide

Recommend Documents