CHAPTER 6 – FIREWALLS AND BORDER SECURITY
TRUE/FALSE
1. TCP/IP consists of nearly 200 nonproprietary protocols that interconnect computer systems efficiently
and reliably.
2. UDP does not provide the same level of reliability and error checking as TCP, because it relies only on
the checksum to ensure reliability.
3. IP is a connection-oriented protocol because its primary mission is to provide network-to-network
addressing and routing information, and to change the size of packets when the size varies from
network to network.
4. The payload data within the IP packet is actually the TCP header and the application data when
connection-oriented services are used.
5. There are six IP address classes, Class A through Class F, each used with a different type of network.
6. Class D addresses do not reflect the network size, but only tell you that the communication is a
multicast.
7. One element in border security is to configure security policies on each firewall so that access is
automatically allowed, except for those who are manually configured to have access blocked through
the firewall.
8. Packet filtering is accomplished using one of two techniques: stateless filtering and stateful filtering.
9. A router performs packet filtering and is often used as a firewall on a network, in addition to the other
functions it performs.
10. Routers that use a single protocol (such as TCP/IP) maintain multiple address databases.
MODIFIED TRUE/FALSE
1. With CIDR, the number after the slash is the number of bits in the address that are allocated for the
host identifier. _________________________
2. The border router is a firewall that is configured with security policies to control the traffic that is
permitted to cross a border in either direction. _________________________
3. Stateless filtering does not filter on the basis of the context of the communication, and so it has limited
value in a firewall. _________________________
4. Network redundancy translation is used when there is a limited number of decoy addresses available,
or when there are more computers on the internal network than decoy addresses.
_________________________
5. Some proxies are able to provide caching services as a way to reduce the load on servers within the
internal network. _________________________
6. A route map is used to determine the best route through a network. _________________________
7. Routers can isolate portions of a network to prevent areas of heavy traffic from reaching the broader
network system. _________________________
8. In Windows Server 2003, Radius is a set of services that enable or manage remote access to Windows
Server 2003, for instance, through dial-up or telecommunications lines.
______________________________
9. The simplest way to configure a firewall in Red Hat Linux 9.x is by using the Security Level
Configuration tool. _________________________
10. IPTables is a powerful tool that can be used to implement network security in many ways; it is
configured through a terminal window using the iptables command. _________________________
MULTIPLE CHOICE
1. Which of the following protocols both sequences and acknowledges frames?
a.
IP
c.
TCP
b.
UDP
d.
ICMP
2. In the OSI model, what layer is the network layer?
a.
1
c.
3
b.
2
d.
4
3. What is the minimum length of a TCP header?
a.
8 bytes
c.
20 bytes
b.
16 bytes
d.
32 bytes
4. Which TCP ports are considered to be “well-known” ports?
a.
0-511
c.
1-512
b.
0-1023
d.
1-1024
5. Which port does SMTP use for communication?
a.
23
c.
110
b.
25
d.
443
6. What is the length of the sequence number that TCP uses to ensure that all frames are received?
a.
16 bits
c.
32 bytes
b.
32 bits
d.
64 bytes
7. Which TCP field is used when there is too little or no optional data to complete the required header
length, which must be divisible by 32?
a.
Checksum
c.
Padding
b.
Options
d.
Window
8. Which of the following TCP/UDP ports is used for DNS server applications?
a.
53
c.
139
b.
80
d.
443
9. Which of the following TCP/UDP ports is used for NetBIOS applications?
a.
23
c.
119
b.
53
d.
139
10. Which of the following can port-scanning software be used for?
a.
To collect information about a target computer
b.
To crash a system
c.
To intercept and decrypt data sent from a target computer
d.
Both a and b
e.
Both b and c
11. Which of the following applications use UDP for network communications?
a.
DNS
c.
Streaming audio applications
b.
NetBIOS naming functions
d.
All of the above
12. Which of the following is performed by UDP to provide communication reliability?
a.
Flow control
d.
Both a and b
b.
Sequencing
e.
Both a and c
c.
Checksum
13. What is the length of the MAC address on a host system?
a.
32 bits
c.
64 bits
b.
48 bits
d.
128 bits
14. IPv6 has a(n) _____ address capability and a 40-byte header.
a.
32 bit
c.
128 bit
b.
64 bit
d.
256 bit
15. Which field in an IP packet contains the network address and the address of the receiving device?
a.
Source address
c.
Version
b.
Identification
d.
Destination address
16. When using classful addressing, the IP address 122.16.232.4 belongs to which network class?
a.
A
c.
C
b.
B
d.
D
17. When using Class B addressing, which portion of the IP address 140.26.23.48 is the network address?
a.
140
c.
140.26.23
b.
140.26
d.
26.23
18. How many station addresses are available in a Class B network?
a.
254
c.
65,534
b.
65,232
d.
63,535
19. Which of the following is the proper range for a Class D network?
a.
1.0.0.0 – 126.255.255.255
c.
192.0.0.0 – 223.255.255.255
b.
128.0.0.0 – 191.255.255.255
d.
224.0.0.0 to 239.255.255.255
20. What is the default subnet mask for a Class D network?
a.
255.0.0.0
d.
255.255.255.224
b.
255.255.0.0
e.
None of the above
c.
255.255.255.0
21. Which of the following is the loopback address?
a.
127.0.0.0
c.
172.0.0.0
b.
172.0.0.1
d.
127.0.0.1
22. If you required 1000 IP host identities for your network, which of the following CIDR addresses
would be valid if you want to make the best use of IP addressing?
a.
161.15.37.16/12
c.
161.15.37.16/22
b.
161.15.37.16/20
d.
161.15.37.16/25
23. What protocol was used extensively for versions of NetWare prior to version 5?
a.
UDP
c.
TCP/IP
b.
IPX
d.
NetBEUI
24. You have configured a firewall to block Telnet and SSH communications by blocking the TCP and
UDP ports 22 and 80. Will this accomplish the job?
a.
Yes
b.
No, because it is also necessary to block port 443 for FTP
c.
No, because SSH is still not blocked
d.
No, because Telnet is still not blocked
25. Which type of packet filtering tracks information about a communication session, such as which ports
are in use, drawing from the contents of multiple packets?
a.
Ingress
c.
Stateless
b.
Stateful
d.
Source route
26. Which type of NAT is used when the firewall is connected to multiple public networks or Internet
service providers, and thus there is a range of different decoy addresses used for each external
network?
a.
Network redundancy translation
c.
Static translation
b.
Dynamic translation
d.
Load balancing
27. Which type of proxy stores recently made service requests, allowing them to fulfill an individual
client’s request without needing to contact the server on the internal network?
a.
Application-level gateway
c.
Caching
b.
Circuit-level gateway
d.
Firewall
28. Which of the following can be used to calculate a metric?
a.
Number of hops
d.
Both a and b
b.
Size of the packet
e.
a, b, and c
c.
Bandwidth
29. What is the only metric used by the RIP routing protocol?
a.
Bandwidth
b.
Size of the packet
c.
Number of incoming packets waiting to be processed
d.
Number of hops
30. If you had configured a firewall in Windows XP and were concerned that you had been the victim of
an attack, where would you look to be able to find out this information?
a.
In the Registry of your workstation
b.
In the \Windows\pfirewall.log file
c.
In the ICS properties under the View log tab
d.
In the System event log
31. When using the Red Hat Linux 9.x Security Level Configuration tool, which security level only allows
connections for using DNS and DHCP services?
a.
High
c.
Low
b.
Medium
d.
No Firewall
32. IPTables is used to configure firewall and NAT activities in which of the following operating systems?
a.
Windows 2000 Server
c.
Mac OS X
b.
Windows Server 2003
d.
Red Hat Linux
33. In the figure above, which letter indicates the portion of the TCP/IP packet that is the TCP segment?
a.
A
c.
B and C
b.
A and B
d.
C and D
34. What is displayed in the figure above?
a.
Proxy firewall as an application-level gateway
b.
Firewall proxy as a circuit-level gateway
c.
OSPF border areas
d.
Implementing border security
35. What is displayed in the figure above?
a.
OSPF border areas
b.
Using NAT on a small office network
c.
Proxy firewall as an application-level gateway
d.
Firewall proxy as a circuit-level gateway
YES/NO
1. When two devices communicate using connection-oriented methods, do they establish sequence
numbers for each frame that is transmitted and place the sequence number in the frame header?
2. Does UDP provide the same level of reliability and error checking as TCP?
3. Are network classes A through C intended for unicast addressing methods?
4. Does NetBEUI use the type of addressing that would enable it to be forwarded or routed to networks
other than the one on which it is used?
5. Does dynamic NAT translate a range of addresses on the internal network to a range of specific decoy
addresses?
6. Is one function of a proxy to screen application requests that go across a firewall placed between an
internal network and an external or public network?
7. Do routers maintain information about network station addresses and network status in databases?
8. Does RIP have the ability to send only routing updates to other routers instead of the entire routing
table?
9. Can routers filter packets on the basis of information associated with each port (inbound and outbound
connections) to control network traffic?
10. Is Internet Connection Firewall available in Windows Server 2003, Enterprise Edition?
COMPLETION
1. When a server is set up for ______________________________, it performs address translation
between the local network clients (including the server as an Internet user) and the Internet.
2. Red Hat Linux 9.x offers the ____________________ interface for configuring NAT and complex
firewall security from the command line in a terminal window.
3. Connection-oriented services occur between the ____________________ sublayer of the data-link
layer (layer 2) and the network layer (layer 3) in the OSI model.
4. In TCP communications, the number of data bytes transmitted in a frame is called the
____________________ because the number can be increased or decreased from one moment to the
next by mutual agreement of the two communicating stations.
5. In a TCP header, the ____________________ is a 16-bit CRC that is computed by adding the length
of all header fields plus the length of the data payload field.6
6. TCP (and UDP) ____________________ software may be used to simply collect information about a
target, without the target’s knowledge; it may be used to gain access to a system, or it may be used to
crash a system.
7. UDP does not provide the same level of reliability and error checking as TCP, because it relies only on
the ____________________ to ensure reliability.
8. When a TCP segment is formatted with the additional IP header information, the entire unit is called
a(n) ____________________ or packet.
9. When an application on a network station uses a(n) ____________________ packet (which is the most
typical packet used by an application), one copy of each packet in a transmission is sent to each
destination intended to receive the packet.
10. A newer way to ignore address class designation is by using ______________________________
addressing, which puts a slash (/) after the dotted decimal notation.
MATCHING
Match the following terms to the appropriate definition.
a.
Border gateway
f.
IPX
b.
Circuit-level gateway
g.
NetBEUI
c.
CRC
h.
RIP
d.
DMZ
i.
TCP
e.
ICMP
j.
UDP
1. Provides for reliable end-to–end delivery of data by controlling data flow
2. A portion of a network that exists between two or more networks that have different security measures
in place
3. Used to communicate the entire contents of routing tables to other routers
4. A calculated value used to determine if a transmission error has occurred
5. A protocol that incorporates NetBIOS for communications across a network
6. Creates a secure virtual circuit through an internal network to a client computer on an external network
7. Developed by Novell for use with its NetWare server operating system
8. Configured to control the traffic that is permitted across a border
9. Provides for low-overhead connectionless communications
10. Used for building tables of information about the computers on a network
SHORT ANSWER
1. What are the three component protocols within the TCP/IP protocol suite?
2. What four fields does a UDP header contain?
3. What five border points should be protected by a strong border security design?
4. Firewalls provide border security by using three different approaches. What are they?
5. What are the four ways to perform network address translation?
6. What four tasks can a proxy fulfill?
7. What six tasks do routers perform?
8. What are the six ways that a metric can be calculated?
9. What four tasks is Windows XP Internet Connection Firewall designed to handle?
10. What five services are part of Windows Server 2003 Routing and Remote Access Services?