Security+ Ch 6

Isabella is a security support manager for a large enterprise. In a recent meeting, she was asked which of the standard networking devices already present on the network could be configured to supplement the specific network security hardware devices that were recently purchased. Which of these standard networking devices would Isabella recommend?

• Router
• Hub
• Virtual private network
• SIEM device

Ximena noticed that Sofia had created a network bridge on her new laptop between the unsecured wireless network and the organization's secure intranet. Ximena explained to Sofia the problem associated with setting up the bridge. What did Ximena tell Sofia?

• A bridge will block packets between two different types of networks.
• A bridge cannot be used on any Internet connection.
• A bridge would block packets from reaching the Internet.
• A bridge could permit access to the secured wired network from the unsecured wireless network.

Which of these would NOT be a filtering mechanism found in a firewall ACL rule?

• Source address

• Direction

• Date

• Protocol

Which of the following devices can identify the application that send packets and then make decisions about filtering based on it?

• Internet content filter
• Application-based firewall
• Reverse proxy
• Web security gateway

Which function does an Internet content filter NOT perform?

• Intrusion detection

• URL filtering

• Malware inspection

• Content inspection

How does network address translation (NAT) improve security?

• It filters based on protocol
• It discards unsolicited packets
• It masks the IP address of the NAT device
• NATs do not improve security

Francisco was asked by a student intern to explain the danger of MAC flooding attack on a switch. What would Francisco say?

• Once the MAC address table is full the switch functions like a network hub.
• A MAC flooding attack will filter to the local host computer's MAC-to-IP address tables and prevent these hosts from reaching the network.
• In a defense of a MAC flooding attack network routers will freeze and not permit any incoming traffic.
• A MAC flooding attack will prevent load balancers from identifying the correct VIP of the servers.

Which device is easiest for an attacker to take advantage of to capture and analyze packets?

• Router
• Hub
• Switch
• Load balancer

Sebastian was explaining to his supervisor why the enterprise needed to implement port security. His supervisor asked what security action a flood guard could do when a MAC flooding attack occurred? Which of the following was NOT an answer that was given by Sebastian?

• Ignore the new MAC addresses while allowing normal traffic from the single pre-approved MAC address.

• Cause the device to enter a fail-open mode

• Record new MAC addresses up to a specific limit

• Block the port entireley

Which statement regarding a demilitarized zone (DMZ) is NOT true?

• It can be configured to have one or two firewalls.
• It typically includes an email or web server.
• It provides an extra degree of security.
• It contains servers that are used only by internal network users.