Comptia Security + QA

SY0-501

Review Questions

Answer the following review questions. Check your answers with the correct

answers that follow.

1. Which tool would you use if you want to view the contents of a packet?

A. TDR

B. Port scanner

C. Protocol analyzer

D. Loopback adapter

2. The honeypot concept is enticing to administrators because

A. It enables them to observe attacks.

B. It traps an attacker in a network.

C. It bounces attacks back at the attacker.

D. It traps a person physically between two locked doors.

3. James has detected an intrusion in his company network. What should he

check first?

A. DNS logs
B. Firewall logs

C. The Event Viewer

D. Performance logs

4. Which of the following devices should you employ to protect your network?

(Select the best answer.)

A. Protocol analyzer

B. Firewall

C. DMZ

D. Proxy server

5. Which device’s log file will show access control lists and who was allowed

access and who wasn’t?

A. Firewall

B. Smartphone

C. Performance Monitor

D. IP proxy

276 CompTIA Security+ SY0-501 Cert Guide

6. Where are software firewalls usually located?

A. On routers

B. On servers

C. On clients

D. On every computer

7. Where is the optimal place to have a proxy server?

A. In between two private networks

B. In between a private network and a public network

C. In between two public networks

D. On all of the servers

8. A coworker has installed an SMTP server on the company firewall. What

security principle does this violate?

A. Chain of custody
B. Use of a device as it was intended

C. Man trap

D. Use of multifunction network devices

9. You are working on a server and are busy implementing a network intrusion

detection system on the network. You need to monitor the network traffic

from the server. What mode should you configure the network adapter to

work in?

A. Half-duplex mode

B. Full-duplex mode

C. Auto-configuration mode

D. Promiscuous mode

10. Which of the following displays a single public IP address to the Internet

while hiding a group of internal private IP addresses?

A. HTTP proxy

B. Protocol analyzer

C. IP proxy

D. SMTP proxy

E. PAC

Chapter 8: Network Perimeter Security 277

11. If your ISP blocks objectionable material, what device would you guess has

been implemented?

A. Proxy server

B. Firewall

C. Internet content filter

D. NIDS

12. Of the following, which is a collection of servers that was set up to attract

attackers?

A. DMZ

B. Honeypot
C. Honeynet

D. VLAN

13. Which of the following will detect malicious packets and discard them?

A. Proxy server

B. NIDS

C. NIPS

D. PAT

14. Which of the following will an Internet filtering appliance analyze? (Select the

three best answers.)

A. Content

B. Certificates

C. Certificate revocation lists

D. URLs

15. Which of the following devices would detect but not react to suspicious behavior on the network?
(Select the most accurate answer.)

A. NIPS

B. Firewall

C. NIDS

D. HIDS

E. UTM

278 CompTIA Security+ SY0-501 Cert Guide

16. One of the programmers in your organization complains that he can no longer

transfer files to the FTP server. You check the network firewall and see that

the proper FTP ports are open. What should you check next?

A. ACLs

B. NIDS

C. AV definitions

D. FTP permissions

17. Which of the following is likely to be the last rule contained within the ACLs
of a firewall?

A. Time of day restrictions

B. Explicit allow

C. IP allow any

D. Implicit deny

18. Which of the following best describes an IPS?

A. A system that identifies attacks

B. A system that stops attacks in progress

C. A system that is designed to attract and trap attackers

D. A system that logs attacks for later analysis

19. What is a device doing when it actively monitors data streams for malicious

code?

A. Content inspection

B. URL filtering

C. Load balancing

D. NAT

20. Allowing or denying traffic based on ports, protocols, addresses, or direction

of data is an example of what?

A. Port security

B. Content inspection

C. Firewall rules

D. Honeynet

Chapter 8: Network Perimeter Security 279

21. Which of the following should a security administrator implement to limit

web-based traffic that is based on the country of origin? (Select the three best

answers.)

A. AV software

B. Proxy server

C. Spam filter
D. Load balancer

E. Firewall

F. URL filter

G. NIDS

22. You have implemented a technology that enables you to review logs from

computers located on the Internet. The information gathered is used to find

out about new malware attacks. What have you implemented?

A. Honeynet

B. Protocol analyzer

C. Firewall

D. Proxy

23. Which of the following is a layer 7 device used to prevent specific types of

HTML tags from passing through to the client computer?

A. Router

B. Firewall

C. Content filter

D. NIDS

24. Your boss has asked you to implement a solution that will monitor users and

limit their access to external websites. Which of the following is the best

solution?

A. NIDS

B. Proxy server

C. Block all traffic on port 80

D. Honeypot

280 CompTIA Security+ SY0-501 Cert Guide

25. Which of the following firewall rules only denies DNS zone transfers?

A. deny IP any any

B. deny TCP any any port 53

C. deny UDP any any port 53

D. deny all dns packets

Answers and Explanations

1. C. A protocol analyzer has the capability to “drill” down through a packet

and show the contents of that packet as they correspond to the OSI model. A

TDR is a time-domain reflectometer, a tool used to locate faults in cabling.

(I threw that one in for fun. It is a Network+ level concept, so you security

people should know it!) A port scanner identifies open network ports on a

computer or device; we’ll discuss that more in Chapters 12 and 13. A loopback

adapter is a device that can test a switch port or network adapter (depending

on how it is used).

2. A. By creating a honeypot, the administrator can monitor attacks without sustaining damage to a
server or other computer. Don’t confuse this with a honeynet (answer B), which is meant to attract and
trap malicious attackers in an

entirely false network. Answer C is not something that an administrator would

normally do, and answer D is defining a man trap.

3. B. If there was an intrusion, James should check the firewall logs first. DNS

logs in the Event Viewer and the performance logs will most likely not show

intrusions to the company network. The best place to look first is the firewall

logs.

4. B. Install a firewall to protect the network. Protocol analyzers do not help to

protect a network but are valuable as vulnerability assessment and monitoring

tools. Although a DMZ and a proxy server could possibly help to protect a

portion of the network to a certain extent, the best answer is firewall.

5. A. A firewall contains one or more access control lists (ACLs) defining who is

enabled to access the network. The firewall can also show attempts at access

and whether they succeeded or failed. A smartphone might list who called or

e-mailed, but as of the writing of this book does not use ACLs. Performance

Monitor analyzes the performance of a computer, and an IP proxy deals with

network address translation, hiding many private IP addresses behind one

public address. Although the function of an IP proxy is often built into a firewall, the best answer would
be firewall.

Chapter 8: Network Perimeter Security 281

6. C. Software-based firewalls, such as Windows Firewall, are normally running

on the client computers. Although a software-based firewall could also be run

on a server, it is not as common. Also, a SOHO router might have a built-in

firewall, but not all routers have firewalls.

7. B. Proxy servers should normally be between the private network and the

public network. This way they can act as a go-between for all the computers

located on the private network. This applies especially to IP proxy servers but

might also include HTTP proxy servers.

8. B. SMTP servers should not be installed on a company firewall. This is not the

intention of a firewall device. The SMTP server should most likely be installed

within a DMZ.

9. D. To monitor the implementation of NIDS on the network, you should

configure the network adapter to work in promiscuous mode; this forces the

network adapter to pass all the traffic it receives to the processor, not just the

frames that were addressed to that particular network adapter. The other three

answers have to do with duplexing—whether the network adapter can send

and receive simultaneously.

10. C. An IP proxy displays a single public IP address to the Internet while hiding

a group of internal private IP addresses. It sends data back and forth between

the IP addresses by using network address translation (NAT). This functionality is usually built into SOHO
routers and is one of the main functions of

those routers. HTTP proxies store commonly accessed Internet information.

Protocol analyzers enable the capture and viewing of network data. SMTP

proxies act as a go-between for e-mail. PAC stands for proxy auto-config, a file

built into web browsers that allows the browser to automatically connect to a

proxy server.
11. C. An Internet content filter, usually implemented as content-control software,

can block objectionable material before it ever gets to the user. This is common in schools, government
agencies, and many companies.

12. C. A honeynet is a collection of servers set up to attract attackers. A honeypot

is usually one computer or one server that has the same purpose. A DMZ is

the demilitarized zone that is in between the LAN and the Internet. A VLAN

is a virtual LAN.

13. C. A NIPS, or network intrusion prevention system, detects and discards malicious packets. A NIDS
only detects them and alerts the administrator. A proxy

server acts as a go-between for clients sending data to systems on the Internet.

PAT is port-based address translation.

282 CompTIA Security+ SY0-501 Cert Guide

14. A, B, and D. Internet filtering appliances will analyze content, certificates, and

URLs. However, certificate revocation lists will most likely not be analyzed.

Remember that CRLs are published only periodically.

15. C. A NIDS, or network intrusion detection system, will detect suspicious

behavior but most likely will not react to it. To prevent it and react to it, you

would want a NIPS. Firewalls block certain types of traffic but by default do

not check for suspicious behavior. HIDS is the host-based version of an IDS;

it checks only the local computer, not the network. A UTM is an all-inclusive

security product that will probably include an IDS or IPS—but you don’t

know which, so you can’t assume that a UTM will function in the same manner as a NIDS.

16. A. Access control lists can stop specific network traffic (such as FTP transfers)

even if the appropriate ports are open. A NIDS will detect traffic and report

on it but not prevent it. Antivirus definitions have no bearing on this scenario.

If the programmer was able to connect to the FTP server, the password should

not be an issue. FTP permissions might be an issue, but since you are working

in the firewall, you should check the ACL first; then later you can check on

the FTP permissions, passwords, and so on.

17. D. Implicit deny (block all) is often the last rule in a firewall; it is added automatically by the firewall,
not by the user. Any rules that allow traffic will be

before the implicit deny/block all on the list. Time of day restrictions will

probably be stored elsewhere but otherwise would be before the implicit deny

as well.

18. B. An IPS (intrusion prevention system) is a system that prevents or stops

attacks in progress. A system that only identifies attacks would be an IDS.

A system designed to attract and trap attackers would be a honeypot. A system that logs attacks would
also be an IDS or one of several other devices or

servers.

19. A. A device that is actively monitoring data streams for malicious code is

inspecting the content. URL filtering is the inspection of the URL only (for

example, [Link] Load balancing is the act of dividing up

workload between multiple computers; we’ll discuss that more in Chapter 16,

“Redundancy and Disaster Recovery.” NAT is network address translation,

which is often accomplished by a firewall or IP proxy.

20. C. Firewall rules (ACLs) are generated to allow or deny traffic. They can be

based on ports, protocols, IP addresses, or which way the data is headed. Port

security deals more with switches and the restriction of MAC addresses that

Chapter 8: Network Perimeter Security 283

are allowed to access particular physical ports. Content inspection is the filtering of web content,
checking for inappropriate or malicious material. A honeynet is a group of computers or other systems
designed to attract and trap an

attacker.

21. B, E, and F. The security administrator should implement a proxy server, a

firewall, and/or a URL filter. These can all act as tools to reduce or limit the

amount of traffic based on a specific country. AV software checks for, and

quarantines, malware. Spam filters will reduce the amount of spam that an

e-mail address or entire e-mail server receives. A load balancer spreads out

the network load to various switches, routers, and servers. A NIDS is used to
detect anomalies in network traffic.

22. A. A honeynet has been employed. This is a group of computers on the Internet, or on a DMZ (and
sometimes on the LAN), that is used to trap attackers

and analyze their attack methods, whether they are network attacks or malware

attempts. A protocol analyzer captures packets on a specific computer in order

to analyze them but doesn’t capture logs per se. A firewall is used to block

network attacks but not malware. A proxy is used to cache websites and act as a

filter for clients.

23. C. A content filter is an application layer (layer 7) device that is used to prevent

undesired HTML tags, URLs, certificates, and so on, from passing through

to the client computers. A router is used to connect IP networks. A firewall

blocks network attacks. A NIDS is used to detect anomalous traffic.

24. B. You should implement a proxy server. This can limit access to specific websites, and monitor who
goes to which websites. Also, it can often filter various

HTML and website content. A NIDS is used to report potentially unwanted

data traffic that is found on the network. Blocking all traffic on port 80 is

something you would accomplish at a firewall, but that would stop all users

from accessing any websites that use inbound port 80 (the great majority of

them!). A honeypot is a group of computers used to lure attackers in and trap

them for later analysis.

25. B. The firewall rule listed that only denies DNS zone transfers is deny TCP

any any port 53. As mentioned in Chapter 7, “Networking Protocols and

Threats,” DNS uses port 53, and DNS zone transfers specifically use TCP.

This rule will apply to any computer’s IP address initiating zone transfers on

the inbound and outbound sides. If you configured the rule for UDP, other

desired DNS functionality would be lost. Denying IP in general would have

additional unwanted results. When creating a firewall rule (or ACL), you need

to be very specific so that you do not filter out desired traffic