Which component is designed to protect against unauthorized communications to and from a computer?

• security center

• port scanner

• antimalware

• antivirus

• firewall

Which command will block login attempts on RouterA for a period of 30 seconds if there are 2 failed login attempts within 10 seconds?

• RouterA(config)# login block-for 10 attempts 2 within 30

• RouterA(config)# login block-for 30 attempts 2 within 10

• RouterA(config)# login block-for 2 attempts 30 within 10

• RouterA(config)# login block-for 30 attempts 10 within 2

What is the purpose of the network security accounting function?

• to require users to prove who they are

• to determine which resources a user can access

• to keep track of the actions of a user

• to provide challenge and response questions

What type of attack may involve the use of tools such as nslookup and fping?

• access attack

• reconnaissance attack

• denial of service attack

• worm attack

Which example of malicious code would be classified as a Trojan horse?

• malware that was written to look like a video game

• malware that requires manual user intervention to spread between systems

• malware that attaches itself to a legitimate program and spreads to other programs when launched

• malware that can automatically spread from one system to another by exploiting a vulnerability in the target

Answer explanation

Explanation: A Trojan horse is malicious code that has been written specifically to look like a legitimate program. This is in contrast to a virus, which simply attaches itself to an actual legitimate program. Viruses require manual intervention from a user to spread from one system to another, while a worm is able to spread automatically between systems by exploiting vulnerabilities on those devices.

What is the difference between a virus and a worm?

• Viruses self-replicate but worms do not

• Worms self-replicate but viruses do not

• Worms require a host file but viruses do not

• Viruses hide in legitimate programs but worms do not

Answer explanation

Explanation: Worms are able to self-replicate and exploit vulnerabilities on computer networks without user participation.

Which attack involves a compromise of data that occurs between two end points?

• denial-of-service

• man-in-the-middle attack

• extraction of security parameters

• username enumeration

Answer explanation

Explanation: Threat actors frequently attempt to access devices over the internet through communication protocols. Some of the most popular remote exploits are as follows:

Man-In-the-middle attack (MITM) – The threat actor gets between devices in the system and intercepts all of the data being transmitted. This information could simply be collected or modified for a specific purpose and delivered to its original destination.

Eavesdropping attack – When devices are being installed, the threat actor can intercept data such as security keys that are used by constrained devices to establish communications once they are up and running.

SQL injection (SQLi) – Threat actors uses a flaw in the Structured Query Language (SQL) application that allows them to have access to modify the data or gain administrative privileges.

Routing attack – A threat actor could either place a rogue routing device on the network or modify routing packets to manipulate routers to send all packets to the chosen destination of the threat actor. The threat actor could then drop specific packets, known as selective forwarding, or drop all packets, known as a sinkhole attack.

Which type of attack involves an adversary attempting to gather information about a network to identify vulnerabilities?

• reconnaissance

• Dos

• dictionairy

• man-in-the-middle

Answer explanation

Explanation: Reconnaissance is a type of attack where the intruder is looking for wireless network vulnerabilities.

What is the purpose of the network security authentication function?

• to require users to prove who they are

• to determine which resources a user can access

• to keep track of the actions of a user

• to provide challenge and response questions

Answer explanation

Explanation: Authentication, authorization, and accounting are network services collectively known as AAA. Authentication requires users to prove who they are. Authorization determines which resources the user can access. Accounting keeps track of the actions of the user.

Which firewall feature is used to ensure that packets coming into a network are legitimate responses to requests initiated from internal hosts?

• stateful packet inspection

• URL filtering

• application filtering

• packet filtering

Answer explanation

Explanation: Stateful packet inspection on a firewall checks that incoming packets are actually legitimate responses to requests originating from hosts inside the network. Packet filtering can be used to permit or deny access to resources based on IP and MAC address. Application filtering can permit or deny access based on port number. URL filtering is used to permit or deny access based on URL or on keywords.