Question 1

A ________ port number designates a specific application running on a server.

Accepted Answer

A)  well-known 
B)  ephemeral 
C)  Both A and B 
D)  Neither A nor B 
A)  well-known 
B)  ephemeral 
C)  Both A and B 
D)  Neither A nor B A

Question 2

A ________ is a persistent conversation between different programs on different computers.

Accepted Answer

A)  connection 
B)  state 
C)  Both A and B 
D)  Neither A nor B 
A)  connection 
B)  state 
C)  Both A and B 
D)  Neither A nor B A

Question 3

Nearly all applications can be proxied effectively.

Accepted Answer

A) True 
 B)False  False

Question 4

Centralized firewall management systems automatically create ACLs from policies.

Accepted Answer

A) True 
 B)False

Question 5

SPI filtering for packets that are part of ongoing communications is usually simple.

Accepted Answer

A) True 
 B)False

Question 6

If you will proxy 8 different applications, you will need ________ proxy programs.

Accepted Answer

A)  2 
B)  4 
C)  6 
D)  8 
A)  2 
B)  4 
C)  6 
D)  8

Question 7

It is better to have an ACL that permits access to a single internal webserver than one that allows access to all internal webservers.

Accepted Answer

A) True 
 B)False

Question 8

In ingress and egress filtering, an SPI firewall always considers its ACL rules when a new packet arrives that does not attempt to open a connection.

Accepted Answer

A) True 
 B)False

Question 9

In ingress filtering, the firewall examines packets entering the network from the outside, typically from the Internet.

Accepted Answer

A) True 
 B)False

Question 10

Antivirus servers can look for ________.

Accepted Answer

A)  viruses 
B)  worms 
C)  Trojan horses 
D)  All of the above 
A)  viruses 
B)  worms 
C)  Trojan horses 
D)  All of the above

Question 11

Which of the following is one of the two simple DEFAULT SPI firewall rules for packets that attempt to open connections?

Accepted Answer

A)  Permit all attempts to open a connection from an internal host to an external host 
B)  Permit all attempts from external hosts to open a connection with an internal host 
C)  Both A and B 
D)  Neither A nor B 
A)  Permit all attempts to open a connection from an internal host to an external host 
B)  Permit all attempts from external hosts to open a connection with an internal host 
C)  Both A and B 
D)  Neither A nor B

Question 12

________ do not drop packets.

Accepted Answer

A)  IDSs 
B)  IPSs 
C)  Firewalls 
D)  All of the above drop packets. 
A)  IDSs 
B)  IPSs 
C)  Firewalls 
D)  All of the above drop packets.

Question 13

What is the SPI firewall rule for packets that only have their TCP ACK bits set but no other flags set?

Accepted Answer

A)  Drop the packet unless it is permitted by an ACL 
B)  Pass the packet unless it is forbidden by an ACL 
C)  Pass the packet if it is part of a previously approved connection 
D)  Either A or B 
A)  Drop the packet unless it is permitted by an ACL 
B)  Pass the packet unless it is forbidden by an ACL 
C)  Pass the packet if it is part of a previously approved connection 
D)  Either A or B

Question 14

Creating ACLs is the most time-consuming part of firewall management.

Accepted Answer

A) True 
 B)False

Question 15

A DoS attack that uses TCP flags is called a ________ attack.

Accepted Answer

A)  half-open 
B)  half-close 
C)  Both A and B 
D)  Neither A nor B 
A)  half-open 
B)  half-close 
C)  Both A and B 
D)  Neither A nor B

Question 16

Firewall policies should govern ________.

Accepted Answer

A)  configuration 
B)  testing 
C)  Both A and B 
D)  Neither A nor B 
A)  configuration 
B)  testing 
C)  Both A and B 
D)  Neither A nor B

Question 17

Which IPS response to an attack can do the most damage?

Accepted Answer

A)  Dropping packets 
B)  Limiting suspicious traffic to a certain percentage of the total bandwidth 
C)  Both A and B do equal amounts of damage 
D)  Neither A nor B 
A)  Dropping packets 
B)  Limiting suspicious traffic to a certain percentage of the total bandwidth 
C)  Both A and B do equal amounts of damage 
D)  Neither A nor B

Question 18

Firewalls do not stop provable attack packets

Accepted Answer

A) True 
 B)False

Question 19

SPI firewalls cannot handle UDP communications because UDP is connectionless.

Accepted Answer

A) True 
 B)False

Question 20

Attacks other than application level attacks usually fail to get through SPI firewalls.

Accepted Answer

A) True 
 B)False

A ________ port number designates a specific application running on a server.

A ________ is a persistent conversation between different programs on different computers.

Nearly all applications can be proxied effectively.

Centralized firewall management systems automatically create ACLs from policies.

SPI filtering for packets that are part of ongoing communications is usually simple.

If you will proxy 8 different applications, you will need ________ proxy programs.

It is better to have an ACL that permits access to a single internal webserver than one that allows access to all internal webservers.

In ingress and egress filtering, an SPI firewall always considers its ACL rules when a new packet arrives that does not attempt to open a connection.

In ingress filtering, the firewall examines packets entering the network from the outside, typically from the Internet.

Antivirus servers can look for ________.

Which of the following is one of the two simple DEFAULT SPI firewall rules for packets that attempt to open connections?

________ do not drop packets.

What is the SPI firewall rule for packets that only have their TCP ACK bits set but no other flags set?

Creating ACLs is the most time-consuming part of firewall management.

A DoS attack that uses TCP flags is called a ________ attack.

Firewall policies should govern ________.

Which IPS response to an attack can do the most damage?

Firewalls do not stop provable attack packets

SPI firewalls cannot handle UDP communications because UDP is connectionless.

Attacks other than application level attacks usually fail to get through SPI firewalls.

The Threat Environment

Planning and Policy

Cryptography

Secure Networks

Access Control

Host Hardening

Application Security

Data Protection

Incident and Disaster Response

Module A: Networking Concepts

Filters

Exam 6: Firewalls

A ________ port number designates a specific application running on a server.

A ________ is a persistent conversation between different programs on different computers.

Nearly all applications can be proxied effectively.

Centralized firewall management systems automatically create ACLs from policies.

SPI filtering for packets that are part of ongoing communications is usually simple.

If you will proxy 8 different applications, you will need ________ proxy programs.

It is better to have an ACL that permits access to a single internal webserver than one that allows access to all internal webservers.

In ingress and egress filtering, an SPI firewall always considers its ACL rules when a new packet arrives that does not attempt to open a connection.

In ingress filtering, the firewall examines packets entering the network from the outside, typically from the Internet.

Antivirus servers can look for ________.

Which of the following is one of the two simple DEFAULT SPI firewall rules for packets that attempt to open connections?

________ do not drop packets.

What is the SPI firewall rule for packets that only have their TCP ACK bits set but no other flags set?

Creating ACLs is the most time-consuming part of firewall management.

A DoS attack that uses TCP flags is called a ________ attack.

Firewall policies should govern ________.

Which IPS response to an attack can do the most damage?

Firewalls do not stop provable attack packets

SPI firewalls cannot handle UDP communications because UDP is connectionless.

Attacks other than application level attacks usually fail to get through SPI firewalls.

The Threat Environment

Planning and Policy

Cryptography

Secure Networks

Access Control

Host Hardening

Application Security

Data Protection

Incident and Disaster Response

Module A: Networking Concepts

Filters