Class 9 August 2018

1.

In your own word, describe the meaning of firewall

2.

A vulnerability assessment is the most effective method for security professionals to find weaknesses in systems and networks. The vulnerability assessment is passive and does not cause damage to a system. It’s important to address any vulnerabilities discovered through a vulnerability assessment. Attackers have access to the same tools and if you can discover the weakness, they can too. Some common tools used for vulnerability assessments include Nmap and Nessus. List how the tool of Nessus is function for vulnerability assessment tools.

3.

Amar has been monitoring his IDS and sees that there are a huge number of ICMP Echo Reply packets that are being received on the external gateway interface. Further inspection reveals that they are not responses from the internal hosts' requests but simply responses coming from the Internet. Analyze this type of attack likely cause.

4.

A firewall is a crucial component of securing your network and is designed to address the issues of data integrity or traffic authentication. Our network gains these benefits from a firewall by receiving all transmitted traffic through the firewall. The importance of including a firewall in your security strategy is apparent; however, firewalls do have the limitations. Identify TWO(2) limitation of firewall.

5.

In keeping with the best practices of layered security, determine the best places to place intrusion detection and intrusion prevention systems. Explain your answer.

6.

Roni has configured his network to provide strong perimeter security. As part of his network architecture, he has included a host that is fully exposed to attack. The system is on the public side of the demilitarized zone, unprotected by a firewall or filtering router. Identify the device and illustrate how the device can protect Roni network.

7.

Shayla is an IT security consultant, specializing in social engineering and external penetration tests. Shayla has been hired on by Treks Avionics, a subcontractor for the Department of Defense. Shayla has been given authority to perform any and all tests necessary to audit the company's network security. No employees for the company, other than the IT director, know about Shayla's work she will be doing. Shayla's first step is to obtain a list of employees through company website contact pages. Then she befriends a female employee of the company through an online chat website. After meeting with the female employee numerous times, Shayla is able to gain her trust and they become friends. One day, Shayla steals the employee's access badge and uses it to gain unauthorized access to the Treks Avionics offices. Discuss the type of threat the Shayla involve.

8.

Network layer firewall works as a

A.

Frame filter
B.

Packet filter
C.

Both Frame as well as Packet filter
D.

None of the mentioned

Correct Answer
B. Packet filter

Explanation
A network layer firewall functions as a packet filter. This means that it examines the header and the content of each packet that passes through it and makes decisions based on predetermined rules. It filters packets based on criteria such as source and destination IP addresses, port numbers, and protocol types. By analyzing packets at the network layer, the firewall can determine whether to allow or block specific packets from entering or leaving the network. Therefore, the correct answer is "Packet filter."

Rate this question:

9.

Network layer firewall has two sub-categories as

A.

State full firewall and stateless firewall
B.

Bit oriented firewall and byte oriented firewall
C.

Frame firewall and packet firewall
D.

None of the mentioned

Correct Answer
A. State full firewall and stateless firewall

Explanation
The correct answer is "State full firewall and stateless firewall." A network layer firewall is a type of firewall that operates at the network layer of the OSI model. It can be further classified into two sub-categories: stateful firewall and stateless firewall. A stateful firewall keeps track of the state of network connections and can make decisions based on the context of the connection. On the other hand, a stateless firewall does not keep track of the state of network connections and makes decisions based on individual packets.

Rate this question:

10.

A firewall is installed at the point where the secure internal network and untrusted external network meet which is also known as __________

A.

Chock point
B.

Meeting point
C.

Firewall point
D.

Secure point

Correct Answer
A. Chock point

Explanation
A firewall is installed at the point where the secure internal network and untrusted external network meet, which is also known as a "choke point". This term refers to a strategic location where the flow of network traffic can be controlled and monitored, allowing the firewall to filter and block potentially harmful or unauthorized data packets. The choke point acts as a barrier between the internal network and the external network, ensuring that only authorized and safe traffic is allowed to pass through.

Rate this question:

11.

Which of the following is / are the types of firewall?

A.

Packet Filtering Firewall
B.

Dual Homed Gateway Firewall
C.

Screen Host Firewall
D.

All of the mentioned

Correct Answer
A. Packet Filtering Firewall

Explanation
Packet Filtering Firewall is one of the types of firewalls. It filters network packets based on predetermined criteria such as source and destination IP addresses, port numbers, and protocol types. It examines each packet and either allows or denies its passage based on the defined rules. This type of firewall is efficient and commonly used as the first line of defense in network security. It helps in protecting the network from unauthorized access and potential threats by controlling the flow of traffic.

Rate this question:

12.

A proxy firewall filters at?

A.

Physical layer
B.

Data link layer
C.

Network layer
D.

Application layer

Correct Answer
D. Application layer

Explanation
A proxy firewall filters at the application layer. This means that it examines the contents of the data packets being transmitted to determine if they meet certain criteria or rules set by the firewall. By filtering at the application layer, the firewall can inspect specific protocols and applications, such as HTTP or FTP, and make decisions based on the content of those protocols. This allows for more granular control and protection against specific types of threats or unauthorized access attempts.

Rate this question:

13.

What is one advantage of setting up a DMZ with two firewalls?

A.

You can control where traffic goes in three networks
B.

You can do stateful packet filtering
C.

You can do load balancing
D.

Improved network performance

Correct Answer
C. You can do load balancing

Explanation
Setting up a DMZ with two firewalls allows for load balancing. This means that network traffic can be distributed evenly across multiple servers, preventing any one server from becoming overwhelmed with traffic. Load balancing can improve network performance by ensuring that resources are efficiently utilized and preventing bottlenecks.

Rate this question:

14.

A stateful firewall maintains a ___________ which is a list of active connections?

A.

Routing table
B.

Bridging table
C.

State table
D.

Connection table

Correct Answer
A. Routing table

15.

A(n) ____ is a fancy term for a computer that has two network interfaces.

A.

Proxy gateway
B.

Duel-homed host
C.

Routing workstation
D.

NAT server

Correct Answer
B. Duel-homed host

Explanation
A duel-homed host refers to a computer that is equipped with two network interfaces. This allows the computer to connect to two different networks simultaneously, enabling it to act as a bridge or gateway between the two networks. It can facilitate communication and data transfer between the networks, making it a useful tool for network administrators.

Rate this question:

16.

The ____ server in the DMZ needs only list a limited number of public IP addresses.

A.

DNS
B.

NAT
C.

Proxy
D.

Firewall

Correct Answer
A. DNS

Explanation
The DNS server in the DMZ needs only list a limited number of public IP addresses because its main function is to resolve domain names to IP addresses. It does not perform network address translation (NAT), act as a proxy, or enforce firewall rules. Its primary role is to maintain a database of domain names and their corresponding IP addresses, allowing clients to access websites and other network resources using human-readable names. Therefore, the DNS server does not require a large number of public IP addresses to fulfill its purpose.

Rate this question: