WorksheetsNetwork Security Quiz
Total questions: 30
Worksheet time: 15mins
Which iptables chain processes packets originating from the local system?
INPUT
FORWARD
OUTPUT
PREROUTING
Which command sets the default policy of INPUT chain to DROP?
iptables -A INPUT DROP
iptables -P INPUT DROP
iptables -D INPUT DROP
iptables -F INPUT DROP
A firewall rule allows SSH only from 192.168.1.10. Which rule is correct?
iptables -A INPUT -p tcp --dport 22 ACCEPT
iptables -A INPUT -s 192.168.1.10 --dport 22 -j ACCEPT
iptables -A INPUT -s 192.168.1.10 -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -s 192.168.1.10 -j ACCEPT
Which iptables table is consulted first during packet traversal?
filter
nat
mangle
raw
NAT masquerading for internet sharing is done using:
filter table – INPUT chain
nat table – POSTROUTING chain
mangle table – PREROUTING chain
raw table – OUTPUT chain
Which command enables IP forwarding in Linux?
ifconfig eth0 up
sysctl net.ipv4.ip_forward=1
iptables -F
route add default
DROP vs REJECT — correct statement:
DROP sends ICMP error
REJECT silently discards
DROP silently discards packets
Both behave the same
Stateful firewall tracks:
MAC addresses
User identities
Connection state
Packet payload only
Which match allows ESTABLISHED and RELATED traffic?
-m tcp
-m state --state NEW
-m conntrack --ctstate ESTABLISHED,RELATED
-m limit
Fail2ban primarily reads:
Packet headers
Netfilter queues
Log files
DNS cache
Fail2ban blocks attackers by:
Shutting down services
Modifying iptables rules dynamically
Restarting SSH
Blocking subnets permanently
Wireshark capture filters use:
Display filter syntax
BPF syntax
Regex
iptables rules
Correct Wireshark display filter for HTTP traffic:
tcp.port == 80
http traffic
port 80
ip.port == 80
DMZ is best described as:
Fully trusted zone
Fully untrusted zone
Semi-trusted isolated network
Internal LAN
A reverse proxy mainly helps with:
Client anonymity
Server protection and load balancing
Packet inspection
VPN tunneling
Squid primarily operates at:
Transport layer
Network layer
Application layer
Data link layer
UTM combines which features?
Routing + Switching
IDS + SIEM
Firewall + IDS/IPS + VPN
Load balancer only
VPN Tunnel mode encrypts:
Payload only
Entire IP packet
TCP headers only
Application data only
Split tunneling is risky because:
It increases encryption overhead
All traffic bypasses VPN
Some traffic bypasses VPN security
VPN disconnects
Which VPN protocol uses UDP port 1194 by default?
IPsec
L2TP
OpenVPN
PPTP
IDS differs from IPS because IDS:
Works inline
Drops malicious packets
Only detects and alerts
Blocks traffic
Snort operates primarily as:
Host-based IDS
Network-based IDS
SIEM
Firewall
OSSEC is classified as:
NIDS
IPS
HIDS
Proxy
Correct Snort rule action for logging only:
drop
reject
alert
pass
Defence-in-depth means:
One strong firewall
Multiple layered controls
IDS only
VPN only
Threat hunting focuses on:
Known signatures
Rule-based detection
Proactive anomaly detection
Antivirus scanning
DoS attack mainly targets:
Confidentiality
Integrity
Availability
Authentication
Rate limiting in iptables is done using:
state module
limit module
conntrack module
nat module
SIEM performs which core function?
Packet forwarding
Log correlation and alerting
NAT translation
Encryption
IDS evasion commonly uses:
Strong encryption
Packet fragmentation and obfuscation
MAC spoofing only
Port forwarding
