Chapter 12: Network Security

A system that Tony manages sends an SNMP trap. What type of information should Tony expect to receive?

• Notification of a vulnerability

• Notification of a patch being installed

• Notification of an issue

• Notification of a user being created

Answer explanation

Key Phrase: "SNMP trap"

Explanation:
Correct Answer (C): SNMP traps can be configured to provide additional information, but typical SNMP traps provide information about issues such as links going down, authentication failures, and reboots.
Why others are wrong:

• A: Notification of a vulnerability would be identified by a vulnerability management tool, not typically via SNMP traps.

• B: Notification of a patch being installed is not something typically sent via SNMP traps.

• D: Notification of a user being created is not a use case for SNMP traps.

Ben wants to observe malicious behavior targeted at multiple systems on a network. He sets up a variety of systems and instruments to allow him to capture copies of attack tools and to document all the attacks that are conducted. What has he set up?

• A honeypot

• A bear trap

• A honeynet

• A tarpit

Answer explanation

Key Phrase: "observe malicious behavior and capture attack tools"

Explanation:
Correct Answer (C): A honeynet is a group of systems that intentionally exposes vulnerabilities so that defenders can observe attacker behaviors, techniques, and tools to help them design better defenses.
Why others are wrong:

• A: A honeypot is a single system designed to attract attackers, not multiple systems.

• B: A bear trap is not a standard security term related to monitoring or observing attacks.

• D: A tarpit intentionally slows down attackers, but it is not designed for documenting all attacks in a comprehensive way.

Valerie wants to replace the Telnet access that she found still in use in her organization. Which protocol should she use to replace it, and what port will it run on?

• SFTP, port 21

• SSH, port 22

• HTTPS, port 443

• RDP, port 3389

Answer explanation

Key Phrase: "replace Telnet"

Explanation:
Correct Answer (B): SSH (Secure Shell) is the secure alternative to Telnet and runs on port 22. It encrypts the communication, providing a secure way to access systems remotely.
Why others are wrong:

• A: SFTP is a secure file transfer protocol, but it does not replace Telnet for remote command-line access.

• C: HTTPS is used for secure web browsing, not for command-line access.

• D: RDP is used for remote desktop access, not for command-line access.

Jill wants to use DNS filtering to prevent users in her organization from visiting potentially malicious sites. What type of service should she use to obtain this information?

• An OSINT service

• A STP feed

• An ACL monitoring service

• A reputation service

Answer explanation

Key Phrase: "DNS filtering to prevent malicious sites"

Explanation:
Correct Answer (D): DNS reputation services can provide Jill with an automated feed of malicious sites that she can include in her DNS filter.
Why others are wrong:

• A: OSINT (Open Source Intelligence) is typically gathered without scans and won’t provide DNS block lists.

• B: STP (Spanning Tree Protocol) prevents loops in networks but is not related to DNS filtering.

• C: An ACL monitoring service would not provide information about malicious sites.

Chuck wants to provide access to a protected network from a less trusted network. What type of solution is commonly implemented to provide a secure, monitored access method?

• A proxy server

• A jump server

• A VLAN

• An air gap

Answer explanation

Key Phrase: "secure, monitored access"

Explanation:
Correct Answer (B): Jump servers are used to provide secure, monitored access to a protected network. Users log in to the jump server, which then grants access to the network.
Why others are wrong:

• A: Proxies are used to filter or manage traffic and might be used in this scenario, but jump servers are preferred for secure access.

• C: A VLAN logically separates network segments, but it does not directly provide secure, monitored access.

• D: An air gap is a physical disconnection between networks, not a method for providing monitored access.

Kathleen wants to deploy a firewall that can handle large amounts of network traffic while performing advanced firewalling tasks. What type of device should she select?

• An NGFW

• A WAF

• A UTM

• A SD-FW

Answer explanation

Key Phrase: "firewall that handles large traffic and advanced tasks"

Explanation:
Correct Answer (A): An NGFW (Next-Generation Firewall) is designed to provide advanced firewalling tasks such as deep packet inspection and intrusion prevention while being capable of handling high throughput.
Why others are wrong:

• B: A WAF (Web Application Firewall) is specialized for protecting web applications and is not designed for high traffic handling.

• C: A UTM (Unified Threat Management) device provides a broad range of services but may not perform as efficiently as an NGFW for large traffic volumes.

• D: SD-FW is not a common acronym in firewall technology.

Mark wants to prevent DNS poisoning attacks. What technology should he implement to counter them most effectively?

• DNSSEC

• SDNS

• SASE

• SD-WAN

Answer explanation

Key Phrase: "prevent DNS poisoning"

Explanation:
Correct Answer (A): DNSSEC (DNS Security Extensions) validates both the origin of DNS information and ensures that DNS responses have not been modified, making it the best option to prevent DNS poisoning attacks.
Why others are wrong:

• B: SDNS is not a valid technology for DNS security.

• C: SASE (Secure Access Service Edge) is used for securing networks, but it does not specifically prevent DNS poisoning.

• D: SD-WAN provides dynamic wide area networking but does not protect against DNS poisoning.

Casey wants to replace her organization's MPLS-based external connectivity using commodity technologies. What technology should she select to help her manage this?

• IPSec VPN

• SASE

• SD-WAN

• TLS VPN

Answer explanation

Key Phrase: "replace MPLS"

Explanation:
Correct Answer (C): SD-WAN (Software-Defined Wide Area Network) is commonly used to replace MPLS networks, which are higher-cost, with more flexible, software-defined options for connectivity.
Why others are wrong:

• A: IPSec VPN provides encryption over untrusted networks but does not replace MPLS.

• B: SASE (Secure Access Service Edge) combines SD-WAN with additional security functions but is not specifically a replacement for MPLS.

• D: TLS VPN provides secure communication but does not replace MPLS networks.

What protocol is used to securely wrap many otherwise insecure protocols?

• ISAKMP

• SSL

• IKE

• TLS

Answer explanation

Key Phrase: "securely wrap insecure protocols"

Explanation:
Correct Answer (D): TLS (Transport Layer Security) is commonly used to wrap (protect) otherwise insecure protocols. It encrypts the data to ensure confidentiality and integrity.
Why others are wrong:

• A: ISAKMP (Internet Security Association and Key Management Protocol) is used for setting up IPSec VPNs but does not wrap insecure protocols directly.

• B: SSL is an older protocol that has been largely replaced by TLS.

• C: IKE (Internet Key Exchange) is used in the context of IPSec for secure key exchange but not for wrapping insecure protocols.

Valentine wants to deploy a secure version of DHCP for her organization. What should she implement?

• S-DHCP

• DHCP over TLS

• DHCP-S

• There is no secure version of DHCP

Answer explanation

Key Phrase: "secure version of DHCP"

Explanation:
Correct Answer (D): There is no secure version of DHCP (Dynamic Host Configuration Protocol). Protection against DHCP attacks must be handled using detection and response mechanisms rather than a secure version of the protocol.
Why others are wrong:

• A, B, C: There are no recognized secure versions of DHCP, as the protocol itself is inherently not secure.