Test your basic knowledge |

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Application layer attacks may get through - dialup - VPN - extranet connections may bypass firewalls






2. An attacker recruits zombie systems ahead of time to simultaneously release a flood of traffic at a specific target.






3. Work groups that require additional protection are segmented from the rest of the internal organization - restricting access to critical segments - system of VPNs - internal firewall - VLANs and ACLs






4. Stateful firewalls maintain state of traffic flows






5. Weakness in a system - inherent in a complex system - majority are due to poor coding - gateway by which threats are manifested






6. Very simplistic. All systems are attached to the same cable segment. Rarely used because they're unreliable - low fault tolerance - poor traffic isolation - with limited scalability






7. Wide Area Network - Larger than MAN or LAN - uses public network - phone lines - and leased lines to tie LAN and MAN over a dispersed area






8. logic bomb - trojan horse - trap door






9. Attaches itself to existing program files and activated when the exe is launched






10. Migrate to WPA2 - use strong authentication like PEAP or TTLS - audit network installations - require mutual auth between client and infrastructure equipment






11. Trying to ID modems in a telephone exchange that may be susceptible to compromise






12. Improper deployment can increase attack risk - if production systems aren't sufficiently protected - they can be vulnerable from a honeypot - legal liability






13. An agreement on how different computer will work - protocols define the format and order of messages and what to do upon receipt of the messages - basically the rules of the network






14. 53 - DNS - 67 - BootP - 68 - BootP - 69 - TFTP - 123- NTP - 137-139 NBT - 161 - SNMP - 162 - SNMP - 2049 - NFS






15. FIN 130 - ACK 131 - FIN 570 - ACK 571






16. Spread as an office attachment with executable code programmed using macro facility - targets are data files - visual basic editor and other macro languages - payload executes when the code is launched






17. Four layers - Network Layer - Internet Layer - Transport Layer - Application layer






18. 8 bytes per packet - UDP SRC port - UDP DST Ports - UDP length - UDP Checksum






19. Network scanner.






20. Malware - insider threat - natural disaster - terrorism - pandemic






21. Personal area network - phone tethering - bluetooth - etc






22. Simple attack done by simply browsing available information that's allowed on a local network.






23. Slow - requires stateful data tracking - inspects all fields - including variable-length fields






24. Attacks systems through known vulnerabilities - automatically scans for more systems to attack - lowers system defenses - installs rootkit or root shell - opens up back doors - self contained malware that can copy itself






25. Message in its encrypted form






26. Network traffic to the host - typically listens on all interface - uses signature analysis to identify events of interest






27. Maintains complete TCP connection state and sequencing through 2 connections - address translation built-in by virtue of second connection above






28. Isolates systems when they initially connect to the network - allows systems to be scanned and checked prior to being put on a trusted segment






29. Connects the physical part of the network (cables) with the abstract (packets and datastreams)






30. Uses inclusive or exclusive lists - inclusive analysis utilizes a list of keywords - exclusive analysis utilizes a list of events that can be ignored






31. deployment challenges including topology and access limitations - analyzing encrypted traffic - quantity vs. quality of signatures - performance limitations with extensive analysis techniques - very costly for proper management






32. Handles the network address scheme and connectivity of multiple network segments. It handles communication.






33. Anonymous FTP - FTP passes through clear text - Bounce attacks with the PORT command - user can cause an FTP to open a connection from the FTP's own commands and bypass a firewall






34. Allows admins to remotely access a system for troubleshooting. - E.g VNC - GoToMyPc - PC Anywhere






35. Uses a 1 to 1 substitution of arbitrary numbers - given a one character mapping - you cannot determine the key






36. UDP based infection - infected through vulnerability in SQL server - caused DoS on saturated networks






37. Unencrypted message in its original form






38. Means multiple iterations won't matter. If you encrypt with a key - then re-encrypt - it's the same as using one key.






39. Protects internal/external systems from attack - filters communications based on content - performs NAT - encrypts communications for VPN - logging to aid in intrusion detection






40. Provides insight into the tactics - motives - and attacker tools






41. 53 bytes - 48 bytes for data - 5 bytes for the header






42. Small program triggered by an event that provides an action. E.g. scheduled file removal if countdown isn't reset - ie: employee was fired






43. An appliance that controls access between public internet and a companies private network - or between a PC NIC and the rest of the PC.






44. Handles transmissions across the physical media like wires - fiber - etc






45. open source tool for monitoring - can be used as a NIDS - has quick updates and flexibility for custom rules






46. Intrusion detection system - it reports attacks against monitored systems/networks






47. rules indicate criteria in packets that represent events of interest - rules are applied to packets as they are received - alerts are created when matches are found






48. Syn - Syn/Ack - Ack






49. A list of files is defined that should be monitored for a change - HIDS software calculates a one-way hash for each file - if a change is made to the file - the hash is changed






50. Connection oriented - before systems can communicate over an ATM network - they must establish a virtual circuit between each other - this can span across multiple ATM switches that also handle communications for other systems - at the end of the con