CISSP Domain 4

Which of the following best describes the role of a Bastion Host in network security architecture?

• A highly secured computer designed to withstand attacks and provide controlled access to internal systems

• A server placed in a DMZ that typically runs proxy or gateway services for external users.

• Any host that has been hardened with security patches and minimal services to reduce its attack surface.

• A network device that acts as an intermediary between external networks and protected internal resources.

A financial company receives multiple phishing emails that appear to come from its official domain. The emails are sent from unauthorized mail servers, and some of them have been altered during transmission. The company wants to ensure that:

1. 1. Only legitimate mail servers can send emails on behalf of the domain.

2. 2. The integrity of the message is preserved so recipients know it has not been tampered with.

3. 3. Clear policies are enforced so receiving mail servers can reject or quarantine fraudulent emails.

Which combination of technologies should the company implement to achieve these goals?

• Use SPF to restrict authorized senders, DKIM for message integrity, and DMARC for policy enforcement.

• Use SPF to encrypt emails, DKIM to authenticate users, and DMARC to provide end-to-end encryption.

• Use DMARC to filter spam, SPF to provide confidentiality, and DKIM to hide sensitive data.

• Use TLS for authentication, SPF for data integrity, and DMARC for message encryption.

What does a Synchronous (SYN) flood attack do?

• Forces Transmission Control Protocol /Internet Protocol (TCP/IP) connections into a reset state

• Establishes many new Transmission Control Protocol / Internet Protocol (TCP/IP) connections

• Empties the queue of pending Transmission Control Protocol /Internet Protocol (TCP/IP) requests

• Exceeds the limits for new Transmission Control Protocol /Internet Protocol (TCP/IP) connections

In a High Availability (HA) environment, what is the PRIMARY goal of working with a virtual router address as the gateway to a network?

• The second of two routers can periodically check in to make sure that the first router is operational.

• The second of two routers can better absorb a Denial of Service (DoS) attack knowing the first router is present.

• The first of two routers fails and is reinstalled, while the second handles the traffic flawlessly.

• The first of two routers can better handle specific traffic, while the second handles the rest of the traffic seamlessly.

How does Encapsulating Security Payload (ESP) in transport mode affect in the Internet Protocol (IP)?

• Authenticates the IP payload and selected portions of the IP header

• Encrypts and optionally authenticates the complete IP packet

• Encrypts and optionally authenticates the IP header, but not the IP payload

• Encrypts and optionally authenticates the IP payload, but not the IP header

Which of the following type of traffic can easily be filtered with a stateful packet filter by enforcing the context or state of the request?

• ICMP

• TCP

• UDP

• IP

When referring to the data structures of a packet, the term Protocol Data Unit (PDU) is used, what is the proper term to refer to a single unit of TCP data at the transport layer?

• TCP Segment

• TCP Datagram

• TCP Frame

• TCP Packet

How do you distinguish between a bridge and a router?

• A bridge simply connects multiple networks, a router examines each packet to determine which network to forward it to.

• "Bridge" and "router" are synonyms for equipment used to join two networks.

• The bridge is a specific type of router used to connect a LAN to the global Internet.

• The bridge connects multiple networks at the data link layer, while router connects multiple networks at the network layer

ICMP and IGMP belong to which layer of the OSI model?

• Datagram Layer

• Network Layer

• Transport Layer

• Data Link Layer

Which of the following is an IP address that is private (i.e. reserved for internal networks, and not a valid address to use on the Internet)?

• 192.168.42.5

• 192.166.42.5

• 192.175.42.5

• 192.1.42.5