Name:
Class:
Date:
A certificate is a digital document verifying that the two parties exchanging data over the Internet are really
1. What is an encryption algorithm?
ANSWER:
An encryption algorithm is a mathematical function or program that works with a key. The algorithm’s
strength and the key’s secrecy determine how secure the encrypted data is. In most cases, the algorithm isn’t a
secret; it’s known to the public. What is secret is the key.
2. What is cryptanalysis?
ANSWER:
As long as people attempt to create encryption algorithms to protect data, others will endeavor to break those
encryption algorithms. This study is called cryptanalysis. It’s taught in universities and by government
organizations, but hackers also find the challenge of breaking an encryption algorithm intriguing and continue
to push the envelope for developers of encryption algorithms. When a new encryption algorithm is developed,
cryptanalysis is performed on it to ensure that breaking the code is impossible or would take so much time and
so many resources to break that it would be impractical for hackers to attempt.
3. What is Triple Data Encryption Standard (3DES)?
ANSWER:
Triple Data Encryption Standard (3DES) served as a quick fix for the vulnerabilities of DES. To make it more
difficult for attackers to crack the encryption code, 3DES performs the original DES computation three times
with different keys. This more complex computation on data makes 3DES much stronger than DES.
4. What is the RC5 algorithm?
ANSWER:
RC5 is a block cipher that can operate on different block sizes: 32, 64, or 128 bits. The key size can reach
2048 bits. The algorithm was created by Ronald L. Rivest in 1994 for RSA Security.
5. What is the difference between a public key and a private key?
ANSWER:
A public key is openly available; in many cases, public keys can be downloaded from Web sites for the public
to use. A private key is a secret key known only by the key owner and should never be shared.
6. How can confidentiality and authentication be achieved using public key cryptography?
ANSWER:
If confidentiality is a major concern for User A, she encrypts the message with the recipient’s public key. That
way, only the recipient can decrypt the message with his private key. If User A wants to assure User B that she
is indeed the person sending the message (authentication), she can encrypt the message with her private key.
After all, she’s the only person who possesses her private key.
7. What is a one-way function? Provide an example or an analogy to help explain the concept.
ANSWER:
A one-way function is a mathematical formula that’s easy to compute in one direction but difficult or nearly
impossible to compute in the opposite direction to generate a key. For example, multiplying two large prime
numbers to determine their product is easy, but when you’re given only the product, determining what
numbers were used in the calculation is difficult. A simple analogy is making a smoothie. It’s easy to blend a
banana, strawberries, and ice cubes in a blender, but if you have to reconstruct the banana, strawberries, and
ice cubes into their original state after blending them, you might find the task impossible.
8. What is a digital signature?
ANSWER:
Asymmetric algorithms have a useful feature that enables a public key to decrypt a message that was
encrypted using a private key, or vice versa. The only way a public key can decrypt a message that has been
encrypted with a private key is when that message was encrypted by the corresponding private key’s holder.
This type of encryption is called a digital signature.
9. What is a certificate?
Name:
Class:
Date:
Name:
Class:
Date:
Page 3
18. A structure consisting of programs, protocols, and security policies for encrypting data and uses public key
cryptography to protect data transmitted over the Internet
ANSWER:
h
19. A sequence of random bits generated from a range of allowable values
ANSWER:
i
20. The use of random data alongside plaintext as an input to a hashing function so that the output is unique
ANSWER:
j
21. Routers operate at the Network layer of the TCP/IP protocol stack.
a.
True
b.
False
ANSWER:
True
22. What configuration mode allows a Cisco administrator to configure router settings that affect the overall
operations of the router?
a.
Security configuration mode
b.
Admin configuration mode
c.
Global configuration mode
d.
Interface configuration mode
ANSWER:
c
23. If a Cisco administrator needs to configure a serial or Fast Ethernet port, which configuration mode should
they use?
a.
Security configuration mode
b.
Admin configuration mode
c.
Global configuration mode
d.
Interface configuration mode
ANSWER:
d
24. To examine the router’s routing table, a Cisco administrator would enter which command?
a.
show running-config
b.
show startup-config
c.
show interfaces
d.
show ip route
ANSWER:
d
25. Which type of Cisco access lists can restrict IP traffic entering or leaving a router’s interface based only on
the source IP address?
a.
Standard IP
b.
Extended IP
Name:
Class:
Date:
Page 4
c.
IP restrict
d.
ACL IP
ANSWER:
a
26. Which of the following sits between the Internet and the internal network and is sometimes referred to as a
perimeter network?
a.
firewall
b.
DMZ
c.
honeypot
d.
IDS
ANSWER:
b
27. Which type of device monitors a network’s hardware so that security administrators can identify attacks in
progress and stop them?
a.
Firewall
b.
DMZ
c.
Router
d.
IDS
ANSWER:
d
28. What type of IDSs/IPSs monitors activity on network segments by sniffing traffic as it flows over the
network and alerting a security administrator when something suspicious occurs?
a.
Passive
b.
Active
c.
Network-based
d.
Host-based
ANSWER:
c
29. What type of IDS/IPS is used to protect a critical network server or database server by installing the IDS or
IPS software on the system you’re attempting to protect?
a.
Passive
b.
Active
c.
Network-based
d.
Host-based
ANSWER:
d
30. What type of an IDS is being used when it does not take any action to stop or prevent an activity occurring?
a.
dormant system
b.
nondynamic system
c.
passive system
d.
active system
ANSWER:
c
Name:
Class:
Date:
Page 5
31. Which of the following is a computer placed on the network perimeter with the main goal of distracting
hackers from attacking legitimate network resources?
a.
IDS
b.
router
c.
honeypot
d.
firewall
ANSWER:
c
32. A large organization that is responsible for sensitive or critical data may elect to create which of the
following to do damage assessment, risk remediation, and legal consultation?
a.
Security Information Center
b.
Security Operations Center
c.
Firewall Team
d.
Security Event Team
ANSWER:
b
33. What specific type of tools can assist teams by identifying attacks and indicators of compromise by
collecting, aggregating, and correlating log and alert data from routers, firewalls, IDS/IPS, endpoint logs, Web
filtering devices, and other security tools?
a.
IOS
b.
DMZ
c.
IDS
d.
SIEM
ANSWER:
d
34. When Web site visitors are involved in downloading malicious code without their knowledge, they may be
unknowingly involved in what type of process?
a.
drive-by download
b.
Web download attack
c.
Web filtering
d.
download filtering
ANSWER:
a
35. Which IDS system uses a baseline of normal activity and then sends an alert if the activity deviates
significantly from this baseline?
a.
System-based IDS
b.
Anomaly-based IDS
c.
Host-based IDS
d.
Network-based IDS
ANSWER:
b
Name:
Class:
Date:
36. What type of firewall inspects network traffic at a higher level in the OSI model than a traditional stateful
packet inspection firewall does?
a.
DMZ firewall
b.
stateless firewall
c.
upper-layer firewall
d.
application-aware firewall
ANSWER:
d
37. What router feature provides basic security by mapping internal private IP addresses to public external IP
addresses, essentially hiding the internal infrastructure from unauthorized personnel?
a.
Port
b.
QoS
c.
NAT
d.
AES
ANSWER:
c
38. What type of function is being performed when a router screens packets based on information in the packet
header?
a.
packet filtering
b.
packet scanning
c.
router screening
d.
IP filtering
ANSWER:
c
39. What type of packet filtering records session-specific information about a network connection, including the
ports a client uses?
a.
Stateful
b.
Stateless
c.
Static
d.
Dynamic
ANSWER:
a
40. What is a Unified Threat Management device?
ANSWER:
A Unified Threat Management (UTM) device is used to describe a single device that combines many network
protection functions, such as those performed by routers, firewalls, intrusion detection and prevention systems,
VPNs, Web-filtering systems, and malware detection and filtering systems. For instance, modern Cisco routers
can perform firewall functions, address translation (Network Address Translation and Port Address
Translation), and intrusion prevention in addition to their router function.
41. What is a link-state routing protocol?
ANSWER:
A router using a link-state routing protocol sends link-state advertisements to other routers; these
advertisements identify the network topology and any changes or paths discovered recently on the network.
For example, if a new router or path becomes available for a packet, this information is sent to all other routers
participating in the network. This method is efficient because only new information is sent over the network.
Name:
Class:
Date:
42. What is a distance-vector routing protocol?
ANSWER:
If a router is using a distance-vector routing protocol, it passes its routing table (containing all possible paths it
has discovered) to all routers participating on the network. These neighbor routers then forward the routing
table to their neighbors. If a router learns one new path, it sends the entire routing table, which isn’t as efficient
as a link-state routing protocol.
43. What is a path-vector routing protocol?
ANSWER:
A path-vector routing protocol uses dynamically updated paths or routing tables to transmit packets from one
autonomous network to another. It isn’t used on LANs because it’s used mainly by ISPs and large
organizations with multiple Internet connections to other ISPs and organizations.The main path-vector routing
protocol is Border Gateway Protocol (BGP), a routing protocol that an ISP uses to transmit packets to their
destinations on the Internet.
44. List the different types of memory and their main function found in Cisco routers?
ANSWER:
Cisco memory types include:
– Random access memory (RAM): Holds the router’s running configuration, routing tables, and buffers.
– Nonvolatile RAM (NVRAM): Holds the router’s configuration file, but the information isn’t lost if the router
is turned off.
– Flash memory: holds the IOS the router is using.
– Read-only memory (ROM): Contains a minimal version of the Cisco IOS to boot the router if flash memory
gets corrupted.
45. How do “Network-based IDSs/IPSs” monitor activity on network segments?
ANSWER:
Essentially, they sniff traffic as it flows over the network and alerts a security administrator when something
suspicious occurs. Some of these systems can also block traffic.
46. What are the interfaces in a Cisco router?
ANSWER:
These components are the hardware connectivity points to the router and are the component you’re most
concerned with. An Ethernet port, for example, is an interface that connects to a local area network (LAN) and
can be configured to restrict any traffic from a specific IP address, subnet, or network.
47. What is the purpose of creating a “Security Operations Center”?
ANSWER:
For large organizations that have sensitive or critical data, normal administrative expertise isn’t enough to
follow up and do damage assessment, risk remediation, and legal consultation. Large organizations need a
permanent team whose members are responsible solely for security-response functions. Another function of a
SOC is monitoring for artifacts left behind by attackers, which indicate that a system or network has been
compromised.
48. What are the advantages and disadvantages of hardware and software firewalls?
ANSWER:
Briefly, the disadvantage of hardware firewalls is that you’re locked into the firewall’s hardware, such as the
number of interfaces it includes. With a software firewall, you can add NICs easily to the server running the
software. A disadvantage of software firewalls is that you might have to worry about configuration problems,
such as memory requirements, hard disk space requirements, number of CPUs supported, and so on. Software
firewalls also rely on the OS on which they’re running. Hardware firewalls are usually faster and can handle a
larger throughput than software firewalls can.
Name:
Class:
Date:
58. IDS systems log events and send alerts, but they can also interoperate with routers and firewalls to stop an
ANSWER:
IDSs are categorized by how they react when they detect suspicious behavior. Systems that don’t take any
action to stop or prevent an activity are called passive systems. They do, of course, send out an alert and log
the activity,much like an underpaid security guard at a shopping mall witnessing an armed robbery. Active
systems also log events and send out alerts, but they can also interoperate with routers and firewalls. For
example, an active IDS can send an access list to a router that closes an interface to prevent attackers from
damaging the network.
Match each item with a statement below.
a.
stateful packet filter
b.
passive systems
c.
NAT
d.
DMZ
e.
stateless packet filter
f.
user mode
g.
privileged mode
h.
indicators of compromise
i.
active systems
j.
application-aware firewall
50. Records session-specific information about a network connection
ANSWER:
a
51. IDS systems that don’t take any action to stop or prevent an activity
ANSWER:
b
52. Internal private IP addresses are mapped to public external IP addresses hiding the internal infrastructure
ANSWER:
c
53. Small network containing resources that a company wants to make available to Internet users and helps
maintain security
ANSWER:
d
54. Handle each packet separately and are not resistant to spoofing or DoS attacks
ANSWER:
e
55. Administrator can perform basic troubleshooting tests and list information stored on the router
ANSWER:
f
56. Administrator can perform full router configuration tasks
ANSWER:
g
57. Indicates that a system or network has been hacked
ANSWER:
h
Name:
Class:
Date:
Page 9
attack
ANSWER:
i
59. Inspects network traffic at a higher level in the OSI model than a traditional stateful packet inspection
ANSWER:
j