Chapter 10 – Firewall Design and Management
TRUE/FALSE
1. A dual-homed host has a single NIC with two MAC addresses.
2. A screened host has a router as part of the configuration.
3. Reverse firewalls allow all incoming traffic except what the ACLs are configured to deny.
4. Proxy servers take action based only on IP header information.
5. The TCP normalization feature forwards abnormal packets to an administrator for further inspection.
MULTIPLE CHOICE
1. Which of the following is true about a screening router?
a.
it examines the data in the packet to make
filtering decisions
c.
it maintains a state table to determine
connection information
b.
it can stop attacks from spoofed addresses
d.
it should be combined with a firewall for
better security
2. Which of the following is true about a dual-homed host?
a.
serves as a single point of entry to the
network
c.
uses a single NIC to manage two network
connections
b.
its main objective is to stop worms and
viruses
d.
it is used as a remote access server in
some configurations
3. Which of the following best describes a DMZ?
a.
a network of computers configured with
robust firewall software
c.
a private subnet that is inaccessible to both
the Internet and the company network
b.
a subnet of publicly accessible servers
placed outside the internal network
d.
a proxy server farm used to protect the
identity of internal servers
4. What do you call a firewall that is connected to the Internet, the internal network, and the DMZ?
a.
multi-homed proxy
c.
three-way packet filter
b.
three-pronged firewall
d.
multi-zone host
5. Which of the following is best described as software that prioritizes and schedules requests and then
distributes them to servers based on each server’s current load and processing power.
a.
server pooling software
c.
priority server farm
b.
traffic distribution filter
d.
load-balancing software
6. Where should network management systems generally be placed?
a.
out of band
c.
on the perimeter
b.
in the DMZ
d.
in the server farm
7. In what type of attack are zombies usually put to use?
a.
buffer overrun
c.
DDoS
b.
virus
d.
spoofing
8. What should you consider installing if you want to inspect packets as they leave the network?
a.
security workstation
c.
filtering proxy
b.
RIP router
d.
reverse firewall
9. Which type of firewall configuration protects public servers by isolating them from the internal
network?
a.
screened subnet DMZ
c.
screening router
b.
dual-homed host
d.
reverse firewall
10. Which type of security device can speed up Web page retrieval and shield hosts on the internal
network?
a.
caching firewall
c.
caching-only DNS server
b.
proxy server
d.
DMZ intermediary
11. Which network device works at the Application layer by reconstructing packets and forwarding them
to Web servers?
a.
Layer 7 switch
c.
proxy server
b.
translating gateway
d.
ICMP redirector
12. Which of the following is a disadvantage of using a proxy server?
a.
shields internal host IP addresses
c.
may require client configuration
b.
slows Web page access
d.
can’t filter based on packet content
13. Which of the following best describes a bastion host?
a.
a host with two or more network
interfaces
c.
a computer running a standard OS that
also has proxy software installed
b.
a computer on the perimeter network that
is highly protected
d.
a computer running only embedded
firmware
14. What is a critical step you should take on the OS you choose for a bastion host?
a.
ensure all security patches are installed
c.
choose an obscure OS with which
attackers are unfamiliar
b.
make sure it is the latest OS version
d.
customize the OS for bastion operation
15. What is a step you can take to harden a bastion host?
a.
enable additional services to serve as
honeypots
c.
configure several extra accounts with
complex passwords
b.
open several ports to confuse attackers
d.
remove unnecessary services
16. What is the term used for a computer placed on the network perimeter that is meant to attract
attackers?
a.
bastion host
c.
proxy decoy
b.
honeypot
d.
virtual server
17. Why is a bastion host the system most likely to be attacked?
a.
it has weak security
c.
it is available to external users
b.
it contains company documents
d.
it contains the default administrator
account
18. Which of the following is true about private IP addresses?
a.
they are assigned by the IANA
c.
they are targeted by attackers
b.
they are not routable on the Internet
d.
NAT was designed to conserve them
19. Which type of NAT is typically used on devices in the DMZ?
a.
one-to-one NAT
c.
one-to-many NAT
b.
port address translation
d.
many-to-one NAT
20. Which type of translation should you use if you need 50 computers in the corporate network to be able
to access the Internet using a single public IP address?
a.
one-to-one NAT
c.
one-to-many NAT
b.
port address translation
d.
DMZ proxy translation
COMPLETION
1. A _______________ router determines whether to allow or deny packets based on their source and
destination IP addresses.
2. In a screened ____________ setup, a router is added between the host and the Internet to carry out IP
packet filtering.
3. A DMZ is a subnet of _____________ accessible servers placed outside the internal network.
4. A primary goal of proxy servers is to provide security at the _______________ layer.
5. You can ______________ a bastion host by removing unnecessary accounts and services.
MATCHING
a.
dual-homed host
f.
reverse firewall
b.
load-balancing software
g.
screened host
c.
many-to-one NAT
h.
screening router
d.
one-to-one NAT
i.
server farm
e.
proxy server
j.
three-pronged firewall
1. a process that uses the source and destination TCP and UDP port addresses to map traffic between
internal and external hosts
2. a device that filters outgoing connections
3. a group of servers connected in a subnet that work together to receive requests
4. the process of mapping one internal IP address to one external IP address
5. a firewall with separate interfaces connected to an untrusted network, a semitrusted network, and a
trusted network
6. a computer configured with more than one network interface
7. a host in which one interface is connected to an internal network and the other interface is connected to
a router to an untrusted network
8. software that forwards packets to and from the network being protected and
caches Web pages to speed up network performance
9. software that prioritizes and schedules requests and then distributes them to servers in a server cluster
based on each server’s current load and processing power
10. a router placed between an untrusted network and an internal network
SHORT ANSWER
1. Describe the setup in which a dual-homed host is used. What are the limitations of this configuration?
2. How does a screened host setup differ from a dual-homed host configuration? Why might you choose
this configuration?
3. How does a server farm and load-balancing software figure into the multiple DMZ/firewall
configuration?
4. How can using two firewalls help in protecting your network?
5. What is a reverse firewall and why would you use one?
6. What are the primary and secondary goals of modern proxy servers?
7. What is a bastion host and how is one typically configured?
8. What are the 8 general steps for creating a bastion host?
9. What is a honeypot and how is one used to help protect the network?
10. Describe the process of network address translation. What are the two primary types of NAT?