Network Security (NETSEC) 4 Practice Test

These questions are part of the practice quiz. Start practicing

• In an 802.1X deployment, the authenticator is typically the switch. True or False?
• Is it good practice when assigning initial permissions to start with more permissions than strictly necessary and then remove permissions later?
• 802.11i works in ________ mode.
• Which term describes a firewall inside a network that filters traffic between segments?
• Which options are effective in preventing ARP poisoning attacks?
• Biometric authentication is the strongest form of authentication.
• In directory servers, ________.
• Verification is the process where the verifier determines the identity of the supplicant.
• ________ is the process of collecting information about the activities of each individual in log files for immediate and later analysis.
• ARPs are used on local networks to map IPv4 addresses to MAC addresses.
• Some writers prefer to turn off SSID broadcasting.
• Listing your friend's home in the local classifieds at a low price is equivalent to a ________.
• Stateful packet inspection firewalls use relay operation with two connections per client/server pair.
• Wireless IDSs get their data from the company's access points.
• Which of the following are considered good log management practices?
• LDAP can be used ________.
• The verifier itself determines the identity of the supplicant in ________.
• A ________ card stores authentication data.
• Which term describes how directory information is organized?
• Which type of card stores authentication data?
• Which term describes looking over someone's shoulder to capture a password?
• Central authentication servers obtain their authentication information from directory servers.
• Which firewall type is specifically noted as able to stop attacks by employees within the firm against internal site resources?
• The statement 'Users should select very long and complex passwords and use the same password at all sites for auditability' is true.
• Which statement best describes the relationship between authentication and auditing?
• Which entity is described as a common source of assistance when defending against DoS attacks?
• Which device plugs into a standard computer port to identify the owner?
• In a man-in-the-middle attack, an evil twin sends own attacks impersonating the victim. True or False?
• Which of the following describes the capabilities of IPSs when facing an attack?
• Bandwidth limitation for certain types of traffic is less risky than dropping packets.
• Which statement best describes the primary objective of identity management?
• A border firewall sits at the boundary between the corporate site and the external Internet.
• After changes, vulnerability testing should be performed.
• Stateful packet inspection firewalls are ________.
• Which statement correctly differentiates a SYN flood from an HTTP flood?
• In RADIUS central authentication, which item is not one of the devices typically involved?
• Limiting local access to a network can reduce the risk of ARP poisoning. True or False?
• In directory servers, information is organized ________.
• A ________ attack is an attack that is made before attack signatures for the threat are defined.
• All unattended exits should be locked to bar exit.
• Which range corresponds to the typical range of 802.11 networks?
• For packets that are part of an ongoing connection, which rule would apply?
• What type of filtering do IDSs do?
• Which description best matches a 'complex' password?
• Static packet filtering firewalls always examine application messages in depth.
• A ________ is a small device with a display that has a number that changes frequently.
• ______ often get their authentication information from ________.
• In Kerberos, the verifier is explicitly notified that the supplicant has been authenticated.
• A ________ card is an access card that has a built-in microprocessor and memory.
• The statement 'Secure wireless networks can be legally accessed by anyone and are frequently posted as such' is true or false?
• Flooding the frequency of a wireless network is one method attackers use to affect the network. True or False?
• Which of the following should be forbidden in secure areas?
• ______ is the centralized policy based management of all information required for access to corporate systems by people, machines, programs, or other resources.
• A state is a distinct phase in a connection between two applications.
• ________ drop packets.
• Which transport protocols can an application use?
• 802.11i is designed to extend 802.1X operation to WLANs.
• The combination of high safety and low cost makes SPI firewalls extremely popular.
• SPI filtering for packets that are part of ongoing communications is usually simple.
• Which statement best reflects recommended identity management practice?
• The statement 'Going through a company's trash bins outside the premises is legal' is:
• The purpose of egress filtering is to stop attack packets from entering the firm's internal network.
• Which statement about authentication credentials is true?
• A NIC has a MAC address.
• Which statement about IDSs is supported by the material?
• If a firewall drops valid non-attack packets due to high load, this can be described as what?
• The claim that open networks are legally accessible by anyone and frequently posted as such, is this true or false?
• Is the statement 'Creating ACLs is the most time-consuming part of firewall management' true?
• Most central authentication servers are governed by the ________ standard.
• ______ is used by ______ for authentication.
• Which security property prevents unauthorized users from gaining information about the network structure, data flowing across the network, protocols used, or packet header values?
• Password cracking is usually done over the network by trying many passwords to log into an account.
• Which statement is true about the goal of the 802.11i standard?
• An internal firewall sits at the boundary between the corporate site and the Internet.
• Which statement best describes permission for password testing on company systems?
• Which ACL rule aligns with the principle of least privilege?
• Which statement best describes a term 'authorization'?
• Firms can address the increasing ability of attackers to bypass border firewalls by ________.
• Is r%Dv$ considered a strong password according to the text?
• PEAP stands for Protected Extensible Authentication Protocol and is commonly used with TLS to secure credentials.
• The statement 'Death of the perimeter' indicates that creating a 100% secure network is impossible.
• Which of the following is one of the four bases for authentication credentials?
• Which statement about centralized firewall management systems is false?
• Which function records and analyzes what a person or program actually did?
• A Microsoft domain can have multiple domain controllers.
• Which DMZ host type is explicitly named as an example when presented in a different order?
• What term describes an attacker setting up a rogue access point that pretends to be a legitimate one?
• ______ security uses 128-bit AES encryption for confidentiality and AES-CCMP for automatic rekeying.
• The statement 'ARP resolves 48-bit IP addresses into 32-bit local MAC addresses' is true or false?
• What standard is used to transfer security assertions between identity providers and service providers?
• An attacker controlling bots in a coordinated attack against a victim is known as a ________.
• Which statement about antivirus filtering is supported by the material?
• Which of the following is a recommended log-management practice?
• IDSs tend to issue many false negatives.
• Which biometric method is commonly used for door access?
• In Kerberos, which ticket is used to obtain service tickets after initial authentication?
• To detect previously unseen threats, which detection approach should be used?
• In Kerberos, the service ticket is sent to the supplicant rather than to the verifier.
• In Kerberos, to whom is the service ticket typically delivered?
• What is the primary role of RADIUS in EAP deployments?
• Automatic protections for application proxy firewalls include which of the following?
• Which component in an 802.1X architecture handles user credentials and policy decisions?
• Regarding border firewalls in network security, which statement is true?
• The authenticator is the ________.
• Which document classification applies to SBU documents in military security?
• How time-consuming is reading firewall logs in administration?
• Centralized firewall management systems have which capability?
• An attacker could flood wireless clients with which frames?
• After gaining wireless access to a private network, which of the following actions can the attacker take?
• Rerouting traffic via ARP poisoning is an attack on which network properties?
• What does WEP stand for?
• Access control is more of a problem for wired LANs than for wireless LANs. True or False?
• ________ is a form of identification that identifies a person as being a member of a group.
• Which statement is consistent with the idea of 'Death of the perimeter'?
• Which combination of hosts may be placed in the DMZ according to the material?
• Which attack involves flooding a web server with application-layer web requests?
• Which organization is responsible for developing 802.11 standards?
• Which action is specified for a suspicious packet?
• Which detection method is generally better at identifying previously unseen threats by looking for deviations from normal traffic?
• If Directory Server A trusts Directory Server B and Directory Server B trusts Directory Server C then Directory Server A MUST trust Directory Server C.
• Pre-shared key mode was created for homes and small businesses with a single access point.
• Watch list matching is best described as a form of identification aimed at determining whether a person is a member of a predefined list.
• Which statement best describes stateful packet inspection firewalls?
• Password resets in high-risk environments are safer when they require the user's physical presence.
• Antivirus servers can look for which types of malware?
• SPI firewalls can conduct ________ inspection.
• What type of filtering do UTM firewalls provide?
• Wireless 802.11 networks generally have a range of ________.
• A connection opening is a state.
• Which option best describes why firewall policies are preferred over a simple ACL list?
• There is(are) ________ NAT traversal method(s).
• What type of attack involves flooding a victim with SYN packets to exhaust half-open TCP connections?
• Firewall policies should govern which aspects?
• RTS frames tell other wireless clients that you want to transmit for a given amount of time.
• The 802.1X protocol created for wired LANs can work in wireless LANs without significant modification.
• Which of the following is true about password resets?
• CTS frames tell other clients that you have received a RTS frame.
• In which model are access rules centrally controlled and cannot be altered by resource owners?
• If a firewall receives a provable attack packet, the firewall will ________.
• SPI firewalls can handle both ICMP and UDP.
• After antivirus filtering, which outcomes may occur?
• Attackers can exploit WEP weaknesses by ________.
• What is the term for an attack that uses multiple compromised machines to overwhelm a victim?
• Which factor makes ARP spoofing possible?
• In security, which term describes attempts to fool the system?
• Most users who have access to servers use reusable passwords for authentication.
• Static packet filtering firewalls are limited to ________.
• In the context of wireless security, which statement is true regarding an evil twin attack?
• Rogue access points are unauthorized access points set up by individuals or departments. Is this statement true or false?
• A security assertion may contain ________.
• The assertion that many companies continue to use WEP to avoid the cost of reconfiguring all access points and clients to 802.11i and because WEP has not been fully cracked yet is:
• On loading docks, outgoing shipments should be separated from incoming shipments ________.
• The statement 'Wireless attacks avoid the access points to limit detection' is true or false?
• Which term ensures authorized users have access to information, services, and network resources?
• PSK mode was designed for homes and small businesses with a single access point.
• Which method is used to thwart DoS attacks by dropping all IP packets from an attacker?
• ________ firewalls always examine application messages in depth.
• After a change to the firewall policy, which practice is recommended?
• Placing sensitive equipment in secure areas to minimize potential threats and damage is called siting.
• What standard did the 802.11 Working Group create to extend 802.1X operation to WLANs with security for EAP?
• In a firewall policy database, which fields are described as fairly explanatory?
• A Ping flood attack primarily floods a target with what type of packets?
• Which flood targets a web server by overwhelming it with application-layer requests?
• A ________ port number designates a specific application running on a server.
• Which term describes an intermediary system that enables cross-vendor directory data synchronization?
• Which SPI firewall rule applies to packets that only have their TCP ACK bits set but no other flags?
• DoS network attacks are fairly uncommon.
• WEP mandates private keys.
• Which statement about sockets is correct?
• Which statement describes the trust between two entities when both directions are established?
• Which is the role of a certificate authority in PKI?
• In Active Directory, a domain controller contains which of the following?
• On loading docks, separating outgoing from incoming shipments helps with which outcomes?
• In ingress filtering, the firewall examines packets entering the network from the outside.
• Which statement about iris recognition is true?
• Which type of filtering is IDSs known to perform?
• Which is more likely to generate a false acceptance?
• ARP requests and replies do not require authentication.
• ________ firewalls may be able to stop attacks by employees within the firm against internal site resources.
• Which statement correctly describes the role of external providers in defending against DoS as described in the material?
• WEP encrypts each frame with a per-frame key that consists of the shared RC4 key plus a 24-bit initialization vector that is different for each frame.
• The Wi-Fi Alliance calls 802.11i ________.
• In ingress and egress filtering, an SPI firewall always considers its ACL rules when a new packet arrives that does not attempt to open a connection.
• PINs can be much shorter than passwords.
• Which option does not require adding a special reader to a PC for access control?
• The statement 'Authentication is the process of collecting information about the activities of each individual in log files for immediate and later analysis' is
• The template is based on ________ generated during enrollment scan.
• Fingerprint recognition is easily deceived.
• In a smurf flood DoS attack, attackers can benefit from a multiplier effect because multiple ICMP requests are responded to by a single host.
• From a security viewpoint, a false acceptance is worse than a false rejection.
• The amount of money companies should spend on identity management can be measured through risk analysis.
• In 802.1X, the heavy authentication work is done on which component?
• Which statement best describes the WEP security protocol?
• In biometric systems, the stored representation used for future comparisons is called the template.
• Which statement accurately defines a direct flood attack?
• Iris recognition technology is described as which combination?
• What is the primary purpose of access control in network security?
• Ensuring appropriate network ________ means preventing attackers from altering the capabilities or operation of the network.
• Which type of filtering involves inspecting inbound traffic entering the network from external sources?
• In pre-shared key mode, a passphrase should be at least 20 characters long.
• Firms still choose to use WPA in order to
• WEP encryption uses RC4.
• A fundamental critique of WEP is its short initialization vector length.
• If a firewall has to drop packets because it cannot keep up with traffic volume, this is ________.
• Which term describes obscuring the attacker’s source IP address?
• DoS attacks can cause harm by ________.
• Is it best practice to grant the least permissions believed to be necessary initially and then add permissions if appropriate?
• In a firewall policy database, which statement about the fields is most accurate?
• EAP uses RADIUS for authentication.
• Which statement describes the relationship of SPI firewalls in terms of safety and cost?
• If Directory Server A trusts Directory Server B, Directory Server B trusts Directory Server C, and Directory Server A trusts Directory Server C, this is ________ trust.
• WEP uses RC4 for fast and therefore cheap encryption.
• The statement 'The most common attack against a wireless network is a wireless DoS attack' is true or false?
• The original 802.11 core security protocol, ________, was deeply flawed.
• Is iris scanning usually performed surreptitiously?
• Which statement best describes a port commonly used by standard services such as HTTP?
• Self-service identity management should be used to change a ________ in the identity database.
• NAT can stop sniffers from learning anything about the internal IP addresses.
• Should PCs require login screens with complex passwords?
• Which type of card has a built-in microprocessor and memory?
• In access control, which process checks whether a user is allowed to access a resource before access is granted?
• Which statement about backscatter is true?
• Is the statement 'Most DoS attacks are difficult to detect' true or false?
• Fingerprint recognition should be used as a security measure for access to which location?
• A DoS attack that uses TCP flags is called a ________ attack.
• Zero-day attacks might be stopped by ________ detection.
• Long passwords that use several types of keyboard characters are called ________ passwords.
• Which phrase indicates that achieving a completely secure network is infeasible?
• The most time-consuming part of firewall management is which?
• A ________ is an older attack that uses an illegally large IP packet to crash an operating system.
• In watch-list screening, the error where an innocent person is incorrectly categorized as a member of the watch list is called a false acceptance.
• ______ is a social engineering trick where an intruder may follow an authorized user through a door that the authorized user opens with an access device.
• Which best describes how a smurf flood DoS attack operates?
• Giving a user permissions to use a certain resource is ________.
• A network administrator notices extensive damage to wireless packets. This might indicate a ________ attack.
• Which of the following is an example of a wireless attack?
• Before running a password cracking tool on company systems to test for weak passwords, testers should obtain explicit permission.
• Which SPI firewall rule applies to packets that do not attempt to open connections?
• Which of the following is a benefit of using a central authentication server in 802.1X?
• Which statement about botnets is true?
• If a firewall cannot keep up with traffic volume, it will ________.
• Which statement best describes availability in network security?
• Main border firewalls rarely use stateful packet inspection.
• Wire speed is the maximum speed at which a firewall can filter packets.
• For computer access, a false rejection means that a legitimate user is denied access to a resource.
• Application proxy firewalls can always examine application layer content.
• An application proxy firewall needs have multiple proxy programs if it is to filter multiple application protocols.
• Which filtering approach is most commonly associated with border firewall deployments today?
• What is the actual objective of analyzing firewall log files?
• Which practice is recommended after a firewall policy change?
• Which combination of ARP poisoning prevention methods is most effective?
• Which statement is true about how a connection between two programs on different computers is expressed?
• Which of the following is not one of the rules for working in secure areas?
• Antivirus servers can detect which malware types?
• Firewalls stop provable attack packets.
• During enrollment, the scanner sends ________ to the authentication system.
• If a firewall lacks the processing power to handle incoming traffic, it will drop any packets it cannot process. This behavior is called?
• The amount of money companies should spend on identity management can be measured through risk analysis.
• Which statement describes a transitive trust scenario in which A trusts B, B trusts C, and A trusts C?
• Each media access control (MAC) address has a network interface card (NIC).
• Two-factor authentication can be defeated if ________.
• In 802.11i pre-shared key mode, how is the initial key generated?
• Which filtering mechanism is used as the primary filtering mechanism by almost all main border firewalls?
• Which statement is true about password security and cost?
• Today, application proxy firewalls are commonly used to protect internal clients from malicious external servers.
• Which DMZ host type is described as an example when presented in a different order?
• In the context of TCP-based DoS, which statement is true about half-open attacks and border firewalls?
• Focusing electronic attacks on specific high-value targets is known as whaling. True or False?
• Which statement best describes whether the verifier is explicitly notified when the supplicant is authenticated?
• Which types of hosts may be placed in the DMZ?
• CTS frames tell other wireless clients that you want to transmit for a given amount of time.
• Compared to access control based on individual accounts, RBAC is ________.
• Which term refers to the data used to identify or verify a person in biometrics?
• An EAP message begins with an ________ message.
• 802.11i can operate in PSK mode.
• In RADIUS central authentication, which component functions as the network access server that forwards authentication requests to the RADIUS server?
• If you will proxy four different applications, how many proxy programs will you need?
• In a reflected DoS attack, which statement about the direction of responses is correct?
• MAC access control lists (ACLs) are used to permit or deny devices by their MAC addresses.
• LDAP can be used to update and retrieve information from a directory server.
• Which type of detection looks for specific patterns in the network traffic to identify a threat?
• ______ allows a user to authenticate him or herself to the identity management server once; thereafter, whenever the user asks for access to another server, no additional logins are required.
• In biometric, a match occurs when a ________ meets the decision criteria.
• ARP poisoning can enable a man-in-the-middle attack by intercepting traffic between two devices.
• Ingress ACL rules typically permit a specific type of externally originated connection to network resources.
• Which practice is recommended for vulnerability testing in firewall management?
• Which statement about biometrics and passwords aligns with the discussed material?
• A connection between two programs on different computers is represented by its ________.
• Which statement best describes the book's stance on password length and complexity?
• Which of the following is the most common attack against a wireless network?
• Which statement about fingerprint scanning is true?
• According to the book, r%Dv$ is a strong password.
• Attacks other than application level attacks usually fail to get through SPI firewalls.
• In security, what term describes an attacker deliberately trying to fool the system?
• CAs distribute public keys ________.
• Which of the following is a true characteristic of DoS attacks?
• Firewalls do not stop provable attack packets.
• In firewall terminology, a state is best described as which of the following?
• Which type of firewall filters traffic between different parts of a site's network?
• Which best describes the effect of giving unauthorized users access to a local WLAN?
• Which of the following statements about firewalls and SYN traffic is true?
• Which option is an effective method to prevent ARP poisoning attacks?
• Which feature is commonly included in a unified threat management (UTM) firewall besides antivirus and spam filtering?
• In a reflected DoS attack, the responses arrive at the victim, not at the attacker.
• What term describes a DoS attack that does not complete the TCP three-way handshake?
• Which action can be used to limit attack impact, aside from dropping packets?
• Once established, botnets can be leased to other criminals for DoS attacks.
• Which of the following is one of the two simple DEFAULT SPI firewall rules for packets that attempt to open connections?
• Which event results in a legitimate user being denied access?
• An EAP response message may contain ________.
• Which model assigns access rights to roles rather than to individuals?
• A(n) ________ is the set of attributes about a person or resource that must be revealed in a particular context.
• If unauthorized users gain access to a local WLAN, what is their status?
• Which statement about siting is true?
• Directory servers from different vendors are synchronized through ________.
• Which ACL rule is generally more secure?
• In a direct flood attack, the flood originates from which source?
• IDSs drop packets that are merely suspicious.
• For watch lists of criminals, which error means that an innocent person is identified as a criminal?
• The last egress ACL rule in a border firewall is always DENY ALL.
• In pre-shared key mode, a passphrase should be at least ________ characters long?
• In normal ARP traffic, an attacker on the same network cannot see traffic between two hosts.
• The standard for sending security assertions is ________.
• Who forwards EAP messages between the supplicant and the authentication server in 802.1X?
• Which feature describes a firewall that tracks the state of active connections to permit dynamic filtering?
• In a P2P attack, there is a change in traffic pattern but the overall volume of traffic is the same.
• A ________ firewall handling all traditional firewall functions (SPI, ACLs, etc.) as well as additional security functions such as antivirus filtering, spam filtering, application proxy filtering, and so forth.
• In biometric systems, a false rejection occurs when a legitimate user is denied access.
• Which statement is true about traditional Ethernet LAN access security?
• A connection between two programs on different computers is represented by which of the following?
• Which IPS response has the potential to cause the most damage to network services?
• SPI firewalls cannot handle UDP communications because UDP is connectionless.
• Which option is effective if an attack targets a single server because it keeps transmission lines open for other communication?
• An unauthorized access point is called a rogue access point.
• When a new EAP authentication is added, software has to be changed on the ________.
• In 802.11i, outer EAP authentication uses TLS.
• Which statement is true about the most common attack against a wireless network?
• A Ping flood is a type of flood that uses which packets?
• Replication between a domain controller in a child domain and a domain controller in its parent domain is ________.
• Which principle states that each person should only receive the permissions they absolutely need to perform their job?
• Most packets are part of the ________ state.
• Rerouting traffic using ARP poisoning is an attack on which network properties?
• WEP uses a 24-bit initialization vector that is different for each frame.
• When a new EAP authentication is added, software does not have to be changed on the ________.
• DoS flood attacks on Wi-Fi primarily aim to affect which network property?
• Static packet filtering is limited to inspecting packets in isolation from their context.
• Which is the most widely used form of biometrics?
• The statement 'ARP resolves 32-bit IP addresses into 48-bit local MAC addresses' is true or false?
• In federated identity management, firms ________.
• Each network interface card (NIC) has a media access control address (MAC).
• Which term best describes a firewall located at the boundary between the internal network and the Internet?
• In federated identity management, firms do not query one another's identity management databases.
• Evil twin access point attacks are most common in which environment?
• In ingress and egress filtering, an SPI firewall always considers its ACL rules when a new packet arrives that attempts to open a connection.
• Which statement best describes the relationship between identity management and risk management?
• If a firewall receives a suspicious packet, the firewall will ________.
• The IV is transmitted in the clear with the frame in WEP.
• Passwords should be changed frequently.
• Which component does not drop packets?
• ________ are an additional layer of compromised hosts that are used to manage large groups of bots.
• Which statement about MITM attacks is correct?
• 802.11i can operate in which modes?
• What was the first core wireless security standard?
• It is easier to create appropriate ACL rules for server host firewalls than for border firewalls.
• Which of the following is a type of denial-of-service attack that relies on a spoofed IP source to overwhelm a victim with responses?
• A DoS attack makes a server or network unavailable by flooding it with attack packets.
• What is a possible outcome after antivirus filtering?
• What mistake did the 802.11i Working Group make when creating IVs?
• Which statement best aligns identity management budgeting with organizational risk?
• In relation to packet handling, which statement is accurate?
• Which of the following statements about identity management benefits is true?
• In COBIT, entry must be ________.
• According to the material, does stopping DoS attacks typically require assistance from ISPs and upstream providers?
• Which statement about border firewalls is supported by the material?
• In a large organization, WEP rekeying is inexpensive.
• Which mechanism is used for automatic rekeying in 802.11i?
• Which term describes a DoS attack that relies on an incomplete TCP handshake?
• Which statement best describes a metadirectory?
• The statement 'If a firewall receives a packet that is suspicious, it will drop and log the packet' is:
• Which statement about ICMP is true?
• Identity management is really just another form of risk management.
• An unauthorized access point set up by individuals or departments is called a(n) ________ access point.
• Today, application proxy firewalls are commonly used ________.
• Which of the following statements correctly describes Single Sign-On (SSO)?
• A connection designates a specific program designated by a port number on a specific computer's IP address.
• Which statement about bandwidth and packet dropping is correct?
• In federated identity management, what is a key mechanism that enables trust between organizations?
• Which of the following is not one of the AAA controls?
• Which statement about firewall policies versus ACL rules best reflects the material?
• The NAT firewall places only the internal socket in the translation table.
• If Directory Server A trusts Directory Server B and Directory Server B trusts Directory Server A, this is ________ trust.
• The statement 'Rogue access points are authorized access points set up by individuals or departments' is true or false?
• In federated identity management, what is true about cross-organization identity data?
• How long does it typically take to crack WEP today?
• ________ is the process of assessing the identity of each individual claiming to have permission to use a resource.
• A private key/public key pair is usually created by the ________.
• In which access control model does the department have discretion over granting access to individuals within policy standards?
• In 802.11i, EAP outer authentication takes place before inner authentication.
• Which statement best describes the SYN-ACK message?
• Which statement about sockets is correct?
• Authorizations are also called ________.
• For watch lists of criminals, a false acceptance is worse than a false rejection from a security viewpoint.
• Hand geometry recognition is used heavily for which access control?
• A(n) ________ is a statement from Firm A that Firm B should accept as true if Firm B trusts Firm A.
• In a man-in-the-middle attack, which of the following is true?
• Going through a company's external trash bins is illegal.
• ________ can be used to supply power during long power outages.
• What type of filtering do IDSs do?
• Multilevel security in military terms means multifactor security.
• After gaining wireless access to a private network, which of the following actions can the attacker take?
• Verification requires more matches against templates than does identification.
• Which statement reflects the likely need for external coordination in defending against DoS as described in the material?
• Eavesdropping usually is more of a concern for which type of LANs?
• If a system trusts a CA, it can rely on the digital certificates issued by that CA to verify identities.
• Who typically issues digital certificates in PKI?
• ______ is possible today.
• The statement 'Focusing electronic attacks on specific high-value targets is known as promiscuous attacks.' is true or false?
• What is the strongest form of authentication?
• What best describes a rogue access point?
• Which statement about obtaining permission before password testing is correct?
• Which statement describes the typical hardening required for firewall appliances before installation?
• In a smurf flood DoS attack, the multiplier effect can occur because multiple ICMP requests are responded to by a single host.
• Which device is primarily associated with dropping packets in the given material?
• Which encryption method does WPA use according to the material?
• In the TCP three-way handshake, which message is the second step?
• The least permissions principle primarily decreases risk but may require additional approvals.
• Which component drops attack packets when an attack is detected?
• In biometric systems, a false acceptance occurs when an imposter is granted access.
• Which of the following are benefits of using identity management?
• Hand geometry recognition is primarily used for which type of access?
• The ________ gives the verifier a symmetric session key.
• Nearly all wireless access points can support 802.11i.
• Which firewall type is described as examining application messages in depth?
• In Kerberos, which component is the supplicant's proof that it has already authenticated itself with the Kerberos Server?
• Biometric systems promise to replace reusable passwords.
• In Kerberos, which item is sent from the Kerberos server to the verifier?
• In military security, SBU documents are unclassified.
• To use an access point, you must know its SSID.
• What is the recommended practice when no one is in a secure area?
• The statement 'Most firewall database policies include less than 5 rules' is true or false?
• A central authentication server in 802.1X provides consistency in authentication across the network. True or False?
• According to the material, which IPS response is considered most effective in stopping attacks?
• Which biometric is described as expensive with a low false acceptance rate?
• Which statement best describes SAML?
• Internal firewalls are primarily intended to protect against threats originating from where?
• The statement 'Antivirus servers can only find viruses' is true or false?
• A firm can be its own certificate authority for internal users.
• Which term describes centralized auditing of access permissions across a firm?
• In ________, users authenticate themselves to the access point via the use of a single, shared initial key.
• The book recommends that passwords be at least ________ characters long.
• What term describes compromised hosts running malware controlled by the hacker to perform a DDoS?
• Which statement best describes UDP support in SPI firewalls?
• Microsoft's directory server product is ________.
• A practical attack on WEP involves observing two frames that used the same key.
• Which access control model relies on policy to grant access rather than owner discretion?
• The ultimate goal of a DoS attack is to ________.
• Ingress filtering is the process of filtering traffic entering the network from outside.
• The ________ authentication problem is that unless individuals are carefully vetted before being allowed in a system, imposters can simply enroll through social engineering.
• WEP mandates shared keys.
• Which statement is true about the number of template matches required in verification vs identification?
• A router that connects to three subnets is called a ________ router.
• In a biometric system, which process is typically used when a claimed identity is checked against a stored reference to confirm the claim?
• Nearly all main border walls today use ________ filtering.
• Using a shared initial key is dangerous in ________.
• Fingerprint scanning is often deceived; for entry into a non-sensitive cabinet may it be acceptable?
• If a laptop needs to be taken off premises, which actions are recommended?
• Identification is the process where the verifier determines whether the supplicant is a particular person that the supplicant claims who he or she is.
• Regarding iris recognition, which statement is accurate?
• Which process is used to determine whether a presented identity matches a known candidate among many possibilities?
• Ingress ACL rules typically permit a specific type of internally originated connection to outside resources.
• In Kerberos, which item is sent from the Kerberos server to the supplicant?
• In 802.11i, ________ authentication always uses SSL/TLS.
• If you will proxy 8 different applications, you will need ________ proxy programs.
• XML makes SAML platform-dependent.
• Which of the following measures offers strong security?
• Which statements about log files are true?
• Which statement about border firewalls and TCP flag-based DoS attacks is accurate?
• In ______ filtering, the firewall can filter packets when they are entering or leaving the network.
• Buildings should be set back from streets and protected with rolling hill landscaping to reduce threats from ________.
• Which standard is called Port-Based Access Control?
• Auditing primarily serves which purpose?
• There are ________ NAT traversal method(s).
• Identification requires more matches against templates than does verification.
• If an IPS identifies an attack, what actions can it perform?
• In the military, departments do not have the ability to alter access control rules set by higher authorities in ________.
• Which statement about EAP is true?
• Is a connection opening considered a state?
• Directory servers can hold information about ________.
• Which of the following is NOT listed as one of the four bases for authentication credentials?
• Which type of detection looks at traffic patterns for deviations from set norms?
• Which statement best describes SPI firewalls' impact on non-application-layer attacks?
• The ________ is a subnet that contains all of the servers and application proxy firewalls that must be accessible to the outside world.
• ______ security uses the RC4 cipher in encryption for confidentiality and the Temporal Key Integrity Protocol for keying and rekeying.
• 802.11i offers strong security.
• In normal ARP traffic, every host can make ARP requests.
• PEAP is a popular extended EAP protocol.
• ______ servers synchronize directory servers from different vendors.
• Which of the following measures offers strong security?
• The phrase 'Breadth of the perimeter' is used to convey that creating a 100% secure network is possible.
• The 802.11 standards were developed by the IEEE 802.11 Working Group.
• The statement 'Open networks can be legally accessed by anyone and are frequently posted as such' is true or false?
• A magnetic stripe card is an access card that has a built-in microprocessor and memory.
• Which type of attack is most likely indicated by extensive damage to wireless packets?
• Which of the following can be used to gather network information or user data?
• In the context of PKI, ________ is the process of accepting public keys and providing new digital certificates to the users.
• Iris recognition technology is expensive.
• NAT is able to stop ________.
• A common reason WEP is crackable is the reuse of the same initialization vector across frames.
• Enrollment data in biometric systems is typically generated from which element?
• In 802.11i PSK mode, the initial key is generated from a passphrase.
• WLAN DoS attacks are designed to affect the ________ of the network.
• ARP requests and replies do not require authentication.
• In high-risk environments, password reset risks are reduced by requiring the user's physical presence.
• Which statement about indirect attacks is true?
• The main access threat to 802.11 wireless LANs is an attacker plugging into a wall jack. True or False?
• What is the primary function of a digital certificate in PKI?
• Which statement is not one of the two simple DEFAULT SPI firewall rules for packets that attempt to open connections?
• In a P2P attack, there is a change in the overall volume of traffic but the traffic pattern is the same.
• Firewalls will drop ________.