Chapter 9 – Firewalls
TRUE/FALSE
1. Firewalls can protect against employees copying confidential data from within the network.
2. Software firewalls are usually more scalable than hardware firewalls.
3. Stateless packet filtering keeps a record of connections that a host computer has made with other
computers.
4. Generally, connections to instant-messaging ports are harmless and should be allowed.
5. Since ICMP messages use authentication, man-in-the-middle attacks cannot be successful.
MULTIPLE CHOICE
1. The Cisco PIX line of products is best described as which of the following?
a.
software firewall
c.
firewall appliance
b.
PC with firewall installed
d.
VPN gateway
2. Which of the following is a typical drawback of a free firewall program?
a.
cannot monitor traffic in real time
c.
have centralized management
b.
oversimplified configuration
d.
more expensive than hardware firewalls
3. Which of the following is an advantage of hardware firewalls?
a.
not scalable compared to software
firewalls
c.
less expensive than software firewalls
b.
not dependent on a conventional OS
d.
easy to patch
4. Which of the following is NOT a criteria typically used by stateless packet filters to determine whether
or not to block packets.
a.
IP address
c.
data patterns
b.
ports
d.
TCP flags
5. What type of attack are stateless packet filters particularly vulnerable to?
a.
attempts to connect to ports above 1023
c.
IP spoofing attacks
b.
attempts to connect to the firewall
d.
attempts to connect to ports below 1023
6. What should a company concerned about protecting its data warehouses and employee privacy might
consider installing on the network perimeter to prevent direct connections between the internal
network and the Internet?
a.
router
c.
ICMP monitor
b.
VPN server
d.
proxy server
7. At what layer of the OSI model do proxy servers generally operate?
a.
Application
c.
Transport
b.
Session
d.
Network
8. Which element of a rule base conceals internal names and IP addresses from users outside the
network?
a.
tracking
c.
NAT
b.
filtering
d.
QoS
9. Which of the following is NOT among the common guidelines that should be reflected in the rule base
to implement an organization’s security policy?
a.
only authenticated traffic can access the
internal network
c.
the public can access the company Web
servers
b.
employees can use instant-messaging only
with external network users
d.
employees can have restricted Internet
access
10. What is a suggested maximum size of a rule base?
a.
30 rules
c.
10 rules
b.
300 rules
d.
100 rules
11. What is considered the ‘cleanup rule’ on a Cisco router?
a.
explicit allow all
c.
explicit prompt
b.
implicit deny all
d.
implicit allow
12. Which of the following is described as the combination of an IP address and a port number?
a.
portal
c.
datagram
b.
subnet
d.
socket
13. Which of the following is NOT a protocol,port pair that should be filtered when an attempt is made to
make a connection from outside the company network?
a.
TCP,80
c.
UDP,138
b.
TCP,139
d.
TCP,3389
14. Which of the following is a general practice for a rule base?
a.
begin by blocking all traffic and end by
allowing selective services
c.
allow all access to the firewall
b.
permit access to public servers in the
DMZ
d.
allow direct access from the Internet to
computers behind the firewall
15. Which two ports should packet-filtering rules address when establishing rules for Web access?
a.
143, 80
c.
80, 443
b.
25, 110
d.
423, 88
16. What service uses UDP port 53?
a.
SMTP
c.
ICMP
b.
DNS
d.
TFTP
17. What are the two standard ports used by FTP along with their function?
a.
UDP 23 control, TCP 20 data
c.
TCP 21 control, TCP 20 data
b.
UDP 20 data, TCP 21 control
d.
TCP 23 data, TCP 21 control
18. What type of ICMP packet can an attacker use to send traffic to a computer they control outside the
protected network?
a.
Source Quench
c.
Destination Unreachable
b.
Echo Request
d.
Redirect
19. Which of the following is a method for supporting IPv6 on IPv4 networks until IPv6 is universally
adopted?
a.
Teredo tunneling
c.
IPsec tunneling
b.
ICMPv6 encapsulation
d.
SMTP/S tunneling
20. Which of the following is NOT an ICMPv6 packet type that you should allow within your
organization but never outside the organization?
a.
Destination unreachable
c.
Time Exceeded
b.
Packet too big
d.
Packet Redirect
COMPLETION
1. A firewall can consist of all devices positioned on the network _____________.
2. ACLs filter packets by using a __________ base to determine whether to allow a packet to pass.
3. The ACK flag is normally sent at the end of the three-way ______________ to indicate that a
connection is established.
4. A primary objective of a rule base is to ______________ communications based on complex rules.
5. The rule base should permit access to public servers in the _________ and enable users to access the
Internet.
MATCHING
a.
cleanup rule
f.
rule base
b.
firewall
g.
socket
c.
firewall appliance
h.
state table
d.
firewall policy
i.
stateful packet filters
e.
proxy server
j.
stateless packet filters
1. software that forwards network packets and caches Web pages to speed up
network performance
2. the end point of a computer-to–computer connection defined by an IP address and port address
3. a packet-filtering rule that comes last in a rule base and covers any packets
that have not been covered by preceding rules
4. hardware devices with firewall functionality
5. filters that are similar to stateless packet filters, except that they also determine whether to allow or
block packets based on information about current connections
6. hardware or software configured to block unauthorized access to a network
7. simple filters that determine whether to allow or block packets based on information in protocol
headers
8. the collection of rules that filter traffic at an interface of a firewall
9. an addition to a security policy that describes how firewalls should handle
application traffic, such as Web or e-mail applications
10. a file maintained by stateful packet filters that contains a record of all current
connections
SHORT ANSWER
1. Discuss what a firewall is and its role in a company’s overall security scheme.
2. Describe a software firewall and include one or more advantages and disadvantages.
3. Describe a hardware firewall and include one or more advantages and disadvantages.
4. What are the most common features of IP protocol headers that stateless packet filters base their
filtering decisions on?
5. What is stateful packet filtering?
6. Describe a packet-filtering scenario that works with the DMZ.
7. What makes an effective rule base? List three points to consider.
8. Describe a firewall policy for application traffic.
9. What is a cleanup rule? Provide an example.
10. What happens when a packet hits a firewall? Discuss the possible actions that are taken.