Question 1

What statement correctly describes a stateless firewall?

Accepted Answer

A)  A stateless firewall manages each incoming packet as a stand-alone entity, without regard to currently active connections. 
B)  A stateless firewall inspects each incoming packet to determine whether it belongs to a currently active connection. 
C)  A stateless firewall blocks designated types of traffic based on application data contained within packets. 
D)  A stateless firewall filters packets based on source and destination IP addresses. 
A)  A stateless firewall manages each incoming packet as a stand-alone entity, without regard to currently active connections. 
B)  A stateless firewall inspects each incoming packet to determine whether it belongs to a currently active connection. 
C)  A stateless firewall blocks designated types of traffic based on application data contained within packets. 
D)  A stateless firewall filters packets based on source and destination IP addresses.

Question 2

In a network access control (NAC) system, what are the two different types of software agents that are commonly used?

Accepted Answer

Two types of agents that are commonly us

Question 3

In Open System Authentication, how does authentication occur?

Accepted Answer

A)  The client sends a pre-shared key along with the access point's SSID. 
B)  The client requests an encrypted tunnel, after which, the client's MAC serves as the authentication. 
C)  The access point forces the client to authenticate via a captive portal, after which all communication is encrypted. 
D)  The client "authenticates" using only the SSID name. In other words, no real authentication occurs. 
A)  The client sends a pre-shared key along with the access point's SSID. 
B)  The client requests an encrypted tunnel, after which, the client's MAC serves as the authentication. 
C)  The access point forces the client to authenticate via a captive portal, after which all communication is encrypted. 
D)  The client "authenticates" using only the SSID name. In other words, no real authentication occurs.

Question 4

By far the most popular AAA service, what open-source service runs in the Application layer and can use UDP or TCP in the Transport layer?

Accepted Answer

A)  Google Authenticator 
B)  RADIUS 
C)  TACACS+ 
D)  Kerberos 
A)  Google Authenticator 
B)  RADIUS 
C)  TACACS+ 
D)  Kerberos

Question 5

What scenario might be ideal for the use of root guard in configuring a switch?

Accepted Answer

A)  You wish to block BPDUs on an access port serving network hosts. 
B)  You wish to disable STP on a port connected to a partnered company's switch. 
C)  You wish to prevent switches beyond a certain port from becoming the root bridge, but still wish to use STP. 
D)  You wish to prevent a rogue switch or computer from hijacking the network's STP paths. 
A)  You wish to block BPDUs on an access port serving network hosts. 
B)  You wish to disable STP on a port connected to a partnered company's switch. 
C)  You wish to prevent switches beyond a certain port from becoming the root bridge, but still wish to use STP. 
D)  You wish to prevent a rogue switch or computer from hijacking the network's STP paths.

Question 6

When using a host-based intrusion detection system, what additional feature might be available to alert the system of any changes made to files that shouldn't change?

Accepted Answer

A)  file integrity monitoring (FIM) 
B)  file change management (FCM) 
C)  file access auditing (FA
A)  
D)  file checksum watching (FCW) 
A)  file integrity monitoring (FIM) 
B)  file change management (FCM) 
C)  file access auditing (FA
A)  
D)  file checksum watching (FCW)

Question 7

You have been asked by your superior to configure all Cisco network switches to allow only acceptable MAC addresses through switch access ports. How is this accomplished?

Accepted Answer

A)  Use the switchport port-security command to enable MAC filtering. 
B)  Use the mac-limit command to prevent more than one MAC from being accepted. 
C)  Use the allowed-mac command to filter by MAC address. 
D)  Use the secure port mac-address command to limit the port to learned addresses only. 
A)  Use the switchport port-security command to enable MAC filtering. 
B)  Use the mac-limit command to prevent more than one MAC from being accepted. 
C)  Use the allowed-mac command to filter by MAC address. 
D)  Use the secure port mac-address command to limit the port to learned addresses only.

Question 8

When using Kerberos, what is the purpose of a ticket?

Accepted Answer

A)  It is the name for a Kerberos client or user. 
B)  It is a key used by the client to gain access to services that are protected by the key on the network. 
C)  It is a temporary set of credentials that a client uses to prove to other servers that its identity has been validated. 
D)  It is the event that is generated when auditing a resource and unauthorized access is attempted. 
A)  It is the name for a Kerberos client or user. 
B)  It is a key used by the client to gain access to services that are protected by the key on the network. 
C)  It is a temporary set of credentials that a client uses to prove to other servers that its identity has been validated. 
D)  It is the event that is generated when auditing a resource and unauthorized access is attempted.

Question 9

Proxy servers and ACLs on network devices are examples of non-security devices with security features, while firewalls and IDS/IPS systems are the network's specialized security devices.

Accepted Answer

A) True 
 B)False

Question 10

Which of the following terms is used to describe the configuration of a port to copy all traffic passing through the switch to the device at the other end of the port?

Accepted Answer

A)  port supertrunking 
B)  port mirroring 
C)  port shadowing 
D)  port lurking 
A)  port supertrunking 
B)  port mirroring 
C)  port shadowing 
D)  port lurking

What statement correctly describes a stateless firewall?

In a network access control (NAC) system, what are the two different types of software agents that are commonly used?

In Open System Authentication, how does authentication occur?

By far the most popular AAA service, what open-source service runs in the Application layer and can use UDP or TCP in the Transport layer?

What scenario might be ideal for the use of root guard in configuring a switch?

When using a host-based intrusion detection system, what additional feature might be available to alert the system of any changes made to files that shouldn't change?

You have been asked by your superior to configure all Cisco network switches to allow only acceptable MAC addresses through switch access ports. How is this accomplished?

When using Kerberos, what is the purpose of a ticket?

Proxy servers and ACLs on network devices are examples of non-security devices with security features, while firewalls and IDS/IPS systems are the network's specialized security devices.

Which of the following terms is used to describe the configuration of a port to copy all traffic passing through the switch to the device at the other end of the port?

Introduction to Networking

Network Infrastructure and Documentation

Addressing on Networks

Network Protocols and Routing

Network Cabling

Wireless Networking

Virtualization and Cloud Computing

Subnets and VLANs

Network Risk Management

Network Performance and Recovery

Wide Area Networks

Filters

Exam 10: Security in Network Design

What statement correctly describes a stateless firewall?

In a network access control (NAC) system, what are the two different types of software agents that are commonly used?

In Open System Authentication, how does authentication occur?

By far the most popular AAA service, what open-source service runs in the Application layer and can use UDP or TCP in the Transport layer?

What scenario might be ideal for the use of root guard in configuring a switch?

When using a host-based intrusion detection system, what additional feature might be available to alert the system of any changes made to files that shouldn't change?

You have been asked by your superior to configure all Cisco network switches to allow only acceptable MAC addresses through switch access ports. How is this accomplished?

When using Kerberos, what is the purpose of a ticket?

Proxy servers and ACLs on network devices are examples of non-security devices with security features, while firewalls and IDS/IPS systems are the network's specialized security devices.

Which of the following terms is used to describe the configuration of a port to copy all traffic passing through the switch to the device at the other end of the port?

Introduction to Networking

Network Infrastructure and Documentation

Addressing on Networks

Network Protocols and Routing

Network Cabling

Wireless Networking

Virtualization and Cloud Computing

Subnets and VLANs

Network Risk Management

Network Performance and Recovery

Wide Area Networks

Filters