Q&A Hero

Q: Where is a host-based IDPS agent typically placed?a. on a workstation or server c. between remote users and internal networkb. at Internet gateways d. between two subnets

Q: Which of the following is NOT a typical IDPS component?a. network sensors c. database serverb. command console d. Internet gateway

Q: Which method for detecting certain types of attacks uses an algorithm to detect suspicious traffic, is resource intensive, and requires extensive tuning and maintenance?a. brute force c. signatureb. heuristic d. anomaly

Q: Which of the following is an advantage of a signature-based detection system?a. the definition of what constitutes normal traffic changes b. it is based on profiles the administrator creates c. each signature is assigned a number and named. the IDPS must be trained for weeks

Q: Which approach to stateful protocol analysis involves detection of the protocol in use, followed by activation of analyzers that can identify applications not using standard ports?a. Protocol state tracking c. Traffic rate monitoringb. IP packet reassembly d. Dynamic Application layer protocol analysis

Q: What is an advantage of the anomaly detection method?a. makes use of signatures of well-known attacks b. system can detect attacks from inside the network by people with stolen accounts c. easy to understand and less difficult to configure than a signature-based systemd. after installation, the IDPS is trained for several days or weeks

Q: The period of time during which an IDPS monitors network traffic to observe what constitutes normal network behavior is referred to as which of the following?a. training period c. profile monitoringb. baseline scanning d. traffic normalizing

Q: Which of the following is NOT a primary detection methodology?a. signature detection c. anomaly detectionb. baseline detection d. stateful protocol analysis

Q: Which of the following is NOT a network defense function found in intrusion detection and prevention systems?a. prevention c. identificationb. response d. detection

Q: A hybrid IDPS combines aspects of NIDPS and HIDPS configurations.

Q: An NIDPS can tell you whether an attack attempt on the host was successful.

Q: No actual traffic passes through a passive sensor; it only monitors copies of the traffic.

Q: A weakness of a signature-based system is that it must keep state information on a possible attack.

Q: An IDPS consists of a single device that you install between your firewall and the Internet.

Q: Describe 802.1x authentication.

Q: What is a site survey and why should you conduct one?

Q: List four issues that a wireless security policy should address.

Q: What is the purpose of MAC address filtering and how can attackers defeat it?

Q: What are the two authentication methods provided by early 802.11 standards?

Q: Describe forged deauthentication.

Q: List and define the fields in a control frame.

Q: List the four most common types of control frames.

Q: List the three types of MAC frames defined by the 802.11 standard.

Q: How is wireless security different than wired security?

Q: a. active attacks f. request to sendb. association g. site surveyc. clear to send h. sniffingd. pairwise keys i. TKIPe. penetration testing j. WPA21/ any keys used between a pair of devices in TKIP2/ an in-depth examination of a proposed wireless network site3/ the process of using a variety of tools and techniques to attempt to break into a network4/ a two-step process of being accepted into a wireless network5/ a type of control frame that a station sends when it wants to transmit6/ an encryption method devised as a replacement for WEP in WPA7/ attacks that attempt to gather information for subsequent attacks by sending probe request frames on each available channel8/ a type of control frame that gives a station clearance to begin transmitting packets9/ the encryption and authentication architecture based on the final ratified IEEE 802.11i standard10/ capturing network traffic during transmission

Q: MIBs gather data and report it to a(n) ____________________ management station.

Q: ___________ key encryption in WEP uses the RC4 encryption algorithm.

Q: A _____________ device is a wireless device that employees connect and use without authorization or verified configurations.

Q: A ____________ response is sent by a station in response to a request frame and indicates capabilities, supported data rates, and other information.

Q: Each access point has a(n) ______________ that essentially functions as the name of the network.

Q: Which popular wireless sniffer is an IDS that is passive and undetectable in operation?a. Kismet c. AirSnortb. NetStumbler d. Aircrack-ng

Q: Which of the following is true about IEEE 802.11i?a. it uses WEP2 for authentication and encryption b. it uses a symmetric block cipher for encryption c. temporal key integrity protocol is used for encryptiond. it uses PMK to generate data encryption keys

Q: Which EAP protocol requires digital certificates to validate supplicants?a. EAP-TLS c. LEAPb. EAP-TTLS d. FAST

Q: Which of the following is NOT a suggested practice before using a newly configured wireless network?a. change the administrator password b. change the manufacturer's default key c. use the default encryption methodd. alter the default channel

Q: Which of the following is true about MAC addresses in a wireless network?a. MAC address filtering will stop a determined attacker b. MAC addresses are Network layer identities c. you need to configure the MAC address before you use the WNICd. you can change a WNICs MAC address with software

Q: What is considered to be one of the biggest weaknesses of WEP?a. 24-bit initialization vector c. 128-bit keyb. RC4 encryption d. Kerberos authentication

Q: What function does a RADIUS server provide to a wireless network?a. association c. decryptionb. encryption d. authentication

Q: Which of the following is true about the association process?a. it is a three-step process c. a station first send an association requestb. a station first listens for beacons d. the AP transmits an invitation to associate

Q: In which type of attack do attackers intercept the transmissions of two communicating nodes without the user's knowledge?a. rogue device c. man-in-the-middleb. wardriver d. brute force

Q: Which of the following is true about wardriving?a. attackers use RF monitor mode c. the software is very expensiveb. the hardware is very expensive d. their goal is simply to hijack a connection

Q: In which type of wireless attack does the attacker cause valid users to lose their connections by sending a forged deauthentication frame to their stations?a. association flood c. session hijackingb. jamming d. MAC address spoofing

Q: What is a WNIC's equivalent of a NIC's promiscuous mode?a. active scan mode c. passive attack modeb. RF monitor mode d. auto-capture mode

Q: Which of the following is true about the SSID?a. they can be Null c. they are not found in beacon framesb. they are registered d. they are found in control frames

Q: Which of the following is NOT a field in a control frame?a. Duration c. Frame controlb. Sequence control d. Frame check sequence

Q: Which type of control frame does a station send to let the AP know is can transmit buffered frames?a. CTS c. RTSb. ACK d. PS-Poll

Q: Which type of frame advertises services or information on a wireless network?a. Probe request c. Beaconb. Association response d. Probe response

Q: Which management frame type is sent by a station wanting to terminate the connection?a. Deauthentication c. Reassociation requestb. Disassociation d. Probe response

Q: Which of the following is NOT part of a wireless MAC frame?a. 802.11 protocol version c. FCSb. source MAC address d. TTL

Q: Which of the following is performed by the MAC sublayer?a. joining the wireless network c. resolving names to IP addressesb. resolving IP address to MAC address d. determining best path

Q: Which layer does wireless communication rely heavily upon?a. MAC sublayer of the Network layer c. LLC sublayer of the Data Link layerb. MAC sublayer of the Data Link layer d. LLC sublayer of the Transport layer

Q: SNMP requires the installation of an SNMP agent on the device you want to monitor.

Q: Wireless networks are inherently secure because the original IEEE 802.11 standard addressed strong authentication and encryption.

Q: Wireless networks use the CSMA/CD media access method.

Q: A RTS frame is the first step of the two-way handshake before sending a data frame.

Q: Wireless networks are essentially the same as wired networks when it comes to the security threats each faces.

Q: Compare and contrast analog and digital RF signals.

Q: Describe how RF power is measured.

Q: Describe multipath interference.

Q: Why should you use caution when using multiple APs?

Q: What is the difference between directed IR transmission and diffused IR transmission?

Q: a. absorption f. fadingb. amplitude g. free space path lossc. antenna h. Fresnel zoned. chipping code i. hopping codee. diffraction j. polarization1/ a form of interference/power loss in which the signal is reflected or refracted by the atmosphere, ground, or other obstacles, and the reflected path interferes with the direct path2/ a type of loss in which certain materials absorb the RF signal3/ a device used to transmit or receive radio waves4/ the sequence of changing frequencies in FHSS that determines the sequence and speed of frequency hops5/ the loss of signal strength resulting from the dispersion of the signal over distance6/ the bit pattern used in direct sequence spread spectrum7/ the plane on which radio waves propagate, or the orientation of the radio waves as they leave the antenna8/ an area in which you can determine RF signal strength, identify potential obstacles, and determine the potential for multipath distortion9/ a phenomenon tin which a signal bends around objects in its path10/ the maximum departure of a wave from its undisturbed state; the height of the carrier wave

Q: The _____________________ wireless standard will use the 5 GHz band and will provide multistation WLANs with up to 1 Gbps bandwidth.

Q: A wireless _______________ combines management and security into a single appliance and can perform authentication, encryption, intrusion detection, and other functions.

Q: RF transmits a _______________ signal which can change based on the signal's voltage and direction.

Q: A _________________ IR transmission relies on reflected light that can bounce off walls and other objects.

Q: Cosmic objects emit different types of energy, known as _________________ radiation.

Q: Which wireless networking standard uses the 2.4 GHz band and has a maximum bandwidth of 54 MBps?a. 802.11a c. 802.11acb. 802.11b d. 802.11g

Q: What is a Basic Service Set?a. a group of wireless devices served by a single AP b. multiple APs are set up to provide some overlap c. a wireless network that does not use an APd. wireless devices set up as a basic ad-hoc network

Q: What term is given to a device that is designed to generate radio signals, not including those from the antenna?a. oscillator c. intentional radiatorb. conductive medium d. EIRP

Q: Which of the following tasks does an AP typically perform?a. bridges between the wired and wireless network c. routes packets from subnet to subnetb. acts as a hub for a wired network d. divides data into packets

Q: Which wireless transmission method uses a hopping code?a. infrared c. narrowbandb. OFDM d. FHSS

Q: Which RF transmission method uses an expanded redundant chipping code to transmit each bit?a. FHSS c. CDMAb. OFDM d. DSSS

Q: Which digital signal modulation method is a binary modulation technique in which the carrier signal's frequency is changed to represent a 1 or 0 bit?a. ASK c. PSKb. FSK d. FDM

Q: Which binary signaling technique uses a scheme in which zero voltage represents a 0 bit and the voltage for a 1 bit does not drop back to zero before the end of the bit period?a. RTZ c. polar NRZb. NRZ d. polar RTZ

Q: Which type of analog modulation changes the number of waves representing one cycle?a. amplitude modulation c. phase modulationb. frequency modulation d. relative modulation

Q: What is used to convert an analog RF signal into digital format?a. spectrum c. modulatorb. EIRP d. carrier

Q: What does a measurement of +3 dB equal in power measured in mW?a. double the power c. one third the powerb. 3 times the power d. one half the power

Q: Which term is the measurement of the difference between two signals?a. watt c. ampb. decibel d. volt

Q: Which of the following causes of signal loss is defined as differences in density between air masses over distance?a. reflection c. scatteringb. absorption d. refraction

Q: Which of the following is defined as the positive difference in amplitude between two signals?a. fading c. reflectionb. gain d. attenuation