Q&A Hero

Q: When a firewall policy server is used to manage SPI firewalls, what device creates specific ACL rules? A) the policy server B) the SNMP manager C) individual firewalls D) none of the above

Q: SDN holds the promise of bringing ________. A) lower cost B) lower agility C) both A and B D) neither A nor B

Q: In SDN, which device manages the control function for individual devices? A) SNMP manager console B) forwarding device itself C) SDN policy server D) SDN controller

Q: Control is done on individual switches and routers in ________. A) traditional operation B) SDN C) both A and B D) neither A nor B

Q: Creating switching tables is an example of ________. A) forwarding B) routing complexity C) hardwiring D) control

Q: SNMP agents can initiate ________. A) Get commands B) traps C) both A and B D) neither A nor B

Q: The SNMP manager stores the information it receives from Get commands ________. A) in the MIB B) on the agent C) on the managed device D) in the cloud

Q: SNMP ________ commands can change how managed devices operate. A) Get B) Set C) both A and B D) neither A nor B

Q: SNMP Set commands can ________. A) ask agents for information about the managed device B) reroute traffic C) both A and B D) neither A nor B

Q: In SNMP, the manager communicates directly with the managed device.

Q: To determine if a host is reachable, you would send a(n) ________. A) SNMP SET command B) MIB C) trap D) ping

Q: Policies should drive ________. A) implementation B) oversight C) both A and B D) neither A nor B

Q: Attacking your own firm occurs in ________. A) vulnerability testing B) auditing C) both A and B D) neither A nor B

Q: Oversight activities include ________. A) vulnerability testing B) creating guidelines C) both A and B D) neither A nor B

Q: Which of the following is true? A) Guidelines must be followed. B) Guidelines must be considered. C) both A and B D) neither A nor B

Q: Which of the following must be followed? A) standards B) guidelines C) both A and B D) neither A nor B

Q: Implementation guidance is less specific than ________. A) policy B) implementation C) standards D) none of the above

Q: Policies are separated by implementation to take advantage of ________. A) implementer knowledge B) the delegation of work principle C) minimum permissions

Q: Which of the following specifies what should be done? A) policies B) implementation C) both A and B D) neither A nor B

Q: A policy specifies ________. A) what should be done B) how to do it C) both A and B D) neither A nor B

Q: If someone has been properly authenticated, they should receive ________ permissions. A) all B) no C) maximum D) minimum

Q: Another term for authorization is ________. A) authentication B) token C) establishing the creator of a file D) permission

Q: Actions that people are allowed to take on a resource come under the heading of ________. A) hacks B) authorizations C) exploits D) risks

Q: Companies should ________ single points of takeover. A) eliminate B) pay special attention to C) multiply D) authorize

Q: There is a single countermeasure in ________. A) weakest links B) defense in depth C) both A and B D) neither A nor B

Q: Vulnerabilities are occasionally found in even the best security products. Consequently, companies must ________. A) have comprehensive security B) have defense in depth C) do risk analysis D) only give minimum permissions

Q: An attacker must break through two firewalls to get to a host. This illustrates the principle called ________. (Select the most specific answer.) A) comprehensive security B) risk assurance C) having a DMZ D) defense in depth

Q: Attackers only need to find a single weakness to break in. Consequently, companies must ________. A) have comprehensive security B) have insurance C) do risk analysis D) only give minimum permissions

Q: Balancing threats against protection costs is called ________. A) economic justification B) risk analysis C) comprehensive security D) defense in depth

Q: Which of the following is NOT one of the four major security planning principles? A) perimeter defense B) risk analysis C) comprehensive security D) defense in depth

Q: Which phase of the plan-protect-respond cycle takes the largest amount of work? A) plan B) protect C) respond D) The phases require about equal amounts of effort.

Q: Priority addresses the problem of ________. A) momentary traffic peaks B) chronic under-capacity C) both A and B D) neither A nor B

Q: Which of the following would receive the highest priority? A) video packets B) e-mail packets C) World Wide Web packets D) network management packets

Q: Compared to other methods for reducing problems during momentary traffic peaks, overprovisioning ________. A) increases capital cost B) increases labor costs C) both A and B D) neither A nor B

Q: A packet will definitely get through if it has ________. A) QoS reserved capacity B) priority C) both A and B

Q: Priority is assigning high priority to ________ applications while giving low priority to ________ applications. A) latency-tolerant, latency-intolerant B) latency-intolerant, latency-tolerant

Q: Overprovisioning means ________. A) assigning high priority to latency-intolerant applications while giving low priority to latency-tolerant applications B) adding much more switching and transmission line capacity than will be needed most of the time

Q: Overprovisioning is ________. A) wasteful of capacity B) highly labor-intensive C) both A and B D) neither A nor B

Q: Which of the following is latency intolerant? A) video B) e-mail C) both A and B D) neither A nor B

Q: Momentary traffic peaks can lead to ________. A) latency B) packet loss C) both A and B D) neither A nor B

Q: ISPs usually offer QoS guarantees to ________. A) residential customers B) business customers C) both A and B D) neither A nor B

Q: If throughput falls substantially below a QoS guaranteed speed, the ISP ________. A) always pays a penalty B) may pay a penalty C) does not pay a penalty D) may renegotiate the QoS guarantee for speed

Q: An SLA for jitter should specify a ________. A) maximum jitter B) minimum jitter C) both A and B D) neither A nor B

Q: An SLA for latency should specify a ________. A) maximum latency B) minimum latency C) both A and B D) neither A nor B

Q: An SLA for availability should specify a ________. A) maximum availability B) minimum availability C) both A and B D) neither A nor B

Q: An SLA for speed should specify a ________. A) maximum speed B) minimum speed C) both A and B D) neither A nor B

Q: An SLA should specify the ________. A) best case B) worst case C) both A and B D) neither A nor B

Q: Jitter is a problem for ________. A) downloading a file attached to an e-mail B) e-mail C) both A and B D) neither A nor B

Q: Jitter is a problem for ________. A) voice over IP (VoIP) B) streaming media C) both A and B D) neither A nor B

Q: Variability in delay is called ________. A) jitter B) variance C) a QoS failure D) latency

Q: Latency is usually measured in ________. A) bits per second (bps) B) milliseconds (ms) C) minutes of downtime D) none of the above

Q: When a packet travels through a network, the time it takes to get from the sender to the receiver is called ________. A) latency B) milliseconds C) jitter D) throughput

Q: Errors may substantially reduce throughput in ________. (Pick the standard most affected.) A) IP B) TCP C) UDP D) HTTP

Q: Error rates can soar when the network traffic level ________. A) is at a high level B) is at an average level C) is at a low level D) none of the above

Q: Which of the following usually has higher availability? A) data networks B) Public Switched Telephone Network C) Both of the above usually have equal availability. D) neither A nor B

Q: ________ is the percentage of time that a network is available for use. A) Availability B) Downtime C) QoS D) none of the above

Q: In a coffee shop hot spot, the rated speed is 10 Mbps. Throughput is about half of the rated speed. There are ten people using the hot spot. You and three others are transmitting or receiving at a particular moment. What speed should you expect to get? A) 0.5 Mbps B) 1 Mbps C) 1.25 Mbps D) 2.5 Mbps

Q: Users of an access point share the transmission capacity of the access point. The throughput a user gets is called the ________. A) rated speed B) aggregate throughput C) individual throughput D) all of the above

Q: Throughput is ________. A) the speed a network actually provides to users B) a network's rated speed C) both A and B D) neither A nor B

Q: Transmission speed is normally measured in ________. A) bits per second B) bytes per second C) octet per second D) none of the above

Q: In antivirus filtering, the best ways to filter currently use ________. A) application awareness B) stateful inspection C) signature detection D) behavioral detection

Q: ________ look at ________, and ________ look at ________. A) Antivirus programs, packets, firewalls, packets B) Antivirus programs, files, firewalls, files C) Antivirus programs, packets, firewalls, files D) Antivirus programs, files, firewalls, packets

Q: If a firewall does not have the processing power to filter all of the packets that arrive, ________. A) it will pass some packets without filtering them B) it will drop packets it cannot process C) both A and B D) neither A nor B

Q: In a firewall, VPN traversal ________. A) increases the effectiveness of firewall filtering B) reduces firewall filtering effectiveness C) both A and B D) neither A nor B

Q: If a packet is highly suspicious but not a provable attack packet, a(n) ________ may drop it. A) SPI firewall B) IDS C) IPS D) all of the above

Q: NGFWs ________. A) can implement different rules for different applications B) can detect threats that span multiple packets C) both A and B D) neither A nor B

Q: Which type of firewall filtering looks at application-layer content? A) static packet filtering B) stateful packet inspection C) NGFW D) all of the above

Q: Which type of firewall filtering collects streams of packets to analyze them as a group? A) static packet filtering B) stateful packet inspection C) next-generation D) none of the above

Q: How will a stateful packet inspection (SPI) firewall handle a packet containing a TCP FIN segment? A) process it through the Access Control List (ACL) B) pass it if it is part of an approved connection C) both A and B D) neither A nor B

Q: How will a stateful packet inspection (SPI) firewall handle a packet containing a TCP SYN segment? A) process it through the Access Control List (ACL) B) pass it if it is part of an approved connection C) both A and B D) neither A nor B

Q: How will a stateful packet inspection (SPI) firewall handle a packet containing a TCP segment which is an acknowledgement? A) process it through the Access Control List (ACL) B) pass it if it is part of an approved connection C) both A and B D) neither A nor B

Q: ________ is the dominant firewall filtering method used on main border firewalls today. A) ACL filtering B) Application content filtering C) Stateful packet inspection D) none of the above

Q: Stateful firewalls are attractive because of their ________. A) high filtering sophistication B) ability to filter complex application content C) QoS guarantees D) low cost

Q: When a packet that is not part of an ongoing connection and that does not attempt to open a connection arrives at a stateful inspection firewall, the firewall ________. (Read this question carefully.) A) drops the packet B) passes the packet C) opens a new connection D) does not approve the connection

Q: When a packet that is part of an ongoing connection arrives at a stateful inspection firewall, the firewall usually ________. A) drops the packet B) drops the packet and notifies an administrator C) passes the packet D) passes the packet, but notifies an administrator

Q: ACLs are used for packets in the ________ state. A) connection-opening B) ongoing communication C) both A and B D) neither A nor B

Q: Egress filtering examines packets ________. A) arriving from the outside B) leaving to the outside C) both A and B D) neither A nor B

Q: Firewall log files should be read ________. A) every month B) every day C) every week D) usually only when a serious attack is suspected

Q: A firewall will drop a packet if it ________. A) is a definite attack packet B) is a probable attack packet C) both A and B D) neither A nor B

Q: When a firewall identifies an attack packet, it ________. A) discards the packet B) copies information about the packet into a log file C) both A and B D) neither A nor B