Title: Module Eleven Quiz
Course: CNT 2001 Computer Networks & Communications > Section: Module 11 Basic Network Security

Q: What type of attack is used to flood a website with packets so that it cannot respond to legitimate requests?
- DoS
- smurfing
- rootkitting
- masquerading
A: DoS
If right: Denial of service (DoS) attacks do exactly thatthey attempt to deny computer services in some way or the other. This may sound like a small thing, but in reality, it is quite large. In fact, some of the most financially damaging attacks against computer networks to date have been of this type.

Q: What do you call an attacker’s ability to take over a port that is being used for one purpose and assign it to another purpose?
- bounce attack
- smurf attack
- man-in-the-middle
- port stealing
A: port stealing
If right: Port stealing refers to an attackers ability to take over a port that is being used for one purpose and assign it to another purpose that is detrimental to the system. Hackers use this ability to create a port for malicious software so as to provide illegitimate access to a system.

Q: What do you call when a hacker users multiple guest computers to crack a password?
- macro virus
- Trojan horse
- worm
- botnet
A: botnet
If right: Another malicious problem botnets have been put to use solving is cracking passwords captured from a network. In fact, not too long ago, a rather large financial institution had a large number of accounts and their passwords compromised by a hacker using this method. After the hacker captured a large number of accounts and their passwords from the large financial institution, he used a botnet to crack the passwords on the compromised accounts.

Q: What type of attack uses FTP to indirectly access other ports on the computer where FTP is being used?
- bounce attack
- smurf attack
- man-in-the-middle
- port stealing
A: bounce attack
If right: File Transfer Protocol (FTP) is used to exchange files across the Internet, much like HTTP is used to transfer web pages and SMTP is used to transfer email. In a bounce attack, a hacker can use the PORT command found in FTP to indirectly access other ports on the computer where FTP is being used.

Q: What protocol is used to encrypt web pages?
- SSH
- HTTPS
- FTPS
- POP3S
A: HTTPS
If right: HTTPS is also sometimes referred to as HTTP over SSL. HTTPS is not a protocol by itself; instead, HTTPS is HTTP combined with the SSL/TLS protocol to secure a connection on the Internet, or some other unsecure network, to make sure that the hyper-text data being transferred over that connection is also secured.

Q: What is the term for a group of computers used by hackers to perform attacks on other computers or websites?
- macro virus
- Trojan horse
- worm
- botnet
A: botnet
If right: A botnet is a group of computers that have been compromised by a single hacker or group of hackers. After these computers are compromised, the hacker can use them to do things that the owner would not want it to do, such as send mass emails. The worse thing about a botnet is that it allows multiple computers to work on different pieces of the same problem. This allows much more difficult problems to be solved than what a single computer could do by itself.

Q: What port does HTTPS use?
- 80
- 443
- 43
- 667
A: 443
If right: HTTPS stands for HTTP Secure or Hyper-Text Transfer Protocol Secure. Because HTTPS encrypts web pages that are sent across the HTTPS session, it helps protect against eavesdropping and man-in-the-middle attacks. Generally, HTTPS is assigned port 443 and HTTP is assigned port 80 on a network.

Q: What type of malware is a program that looks like a legitimate or useful program, but will eventually harm computer?
- macro virus
- Trojan horse
- worm
- spyware
A: Trojan horse
If right: Trojan horses are very similar to worms. However, rather than just attempt to enter a computer via some secondary avenue, like worms do, Trojans actively masquerade as legitimate programs that belong on your computer. This way, your computer will run the malicious program without being aware that it should not.

Q: What type of attack positions the hacker between two people communicating with each other?
- hijacking
- masquerading
- man-in-the-middle attack
- smurf attack
A: man-in-the-middle attack
If right: Man-in-the-middle attack is exactly what its name implies. In a man-in-the-middle attack, a person positions him- or herself between two other people and eavesdrops on them. The man-in-the-middle also needs to be able to pass messages from each of the people he is between in such a way that they do not know that they are being eavesdropped on or their data is being retransmitted to their intended recipient.

Q: What do you call a data security infrastructure that contains at least one certificate authority to hand out and verify digital certificates?
- TKIP
- LDAP
- SSL
- PKI
A: PKI
If right: The computer, which is usually a server that issued the certificate, is referred to as a certificate authority. The data security infrastructure that uses digital certificates published with a certificate authority is called the PKI (Public Key Infrastructure).

Q: What type of attack users UDP echo replies to flood a computer?
- man-in-the-middle attack
- smurf attack
- hijacking
- fraggle attack
A: fraggle attack
If right: Another DoS attack is a fraggle attack, which works just like a smurf attack except that it uses UDP echo replies instead of ICMP replies.

Q: What is used to store a public key so that it can be accessed by anyone?
- hash certificate
- SSL
- digital certificate
- digital signature
A: digital certificate
If right: Certificates basically certify that a public key is valid. They are often called public-key certificates or digital certificates. Generally, a certificate is a digital document that is added to public key to certify the public key’s origins and validity. A digital certificate identifies the person who is the owner of the public key (the holder). A certificate also contains the holder’s actual public key.

Q: What type of attack floods a server with ICMP replies?
- man-in-the-middle
- smurf attack
- hijacking
- masquerading
A: smurf attack
If right: A smurf attack is a type of DoS attack in which the target server or network is flooded with ICMP replies. This overloads the inbound lines on a network and can result in bringing it down. This attack is carried out by infiltrating computers that can broadcast IP protocols directly to a specific target.

Q: What type of encryption uses a single key to encrypt and decrypt the data?
- symmetric encryption
- public-key encryption
- hashing
- bounce encryption
A: symmetric encryption
If right: In private-key encryption (also known as symmetric encryption), a person has to have a copy of the original encryption key to decrypt a cipher text.

Q: What do you call a computer that unknowingly is used in part of a DoS attack?
- masqueraded PC
- structured PC
- zombie
- unstructured PC
A: zombie
If right: When a computer becomes part of DoS attack, it will have some form of malware that makes the computer a zombie. As a zombie, it will then accept commands from a hacker to attack or contribute to an attack.

Q: What type of encryption uses one key to encrypt and another key to decrypt?
- symmetric encryption
- public-key encryption
- hashing
- bounce encryption
A: public-key encryption
If right: In public-key encryption, you still start with a secret private key. However, instead of using the private key to encrypt a message, you use it to generate a public key that is then used to encrypt a message. After the public key is generated and used to encrypt a message, it is sent along to the destination computer either before the encrypted message was sent or along with the encrypted message. It can also be accessed from a certificate/key server. This public key is then used on the destination computer to decrypt the message that was sent to it.

Q: Which of the following is not a form of biometrics?
- fingerprint scanning
- PIN
- iris scanning
- face recognition
A: PIN
If right: Biometrics refers to using unique characteristics of a persons body as the basis for securing a network or some other item. A personal identification number (PIN) is a simplified password consisting only of digits.

Q: What authentication protocol is used to secure wireless LANs with a central authentication authority?
- 802.1x
- RADIUS
- Kerberos
- CHAP
A: 802.1x
If right: 802.1X is a standard used to secure wireless LANs (WLANs) that follow the various 802.11 standards. 802.1X allows a user on a WLAN to be authenticated by a central authentication authority. For any messages that need to be exchanged during the authentication process, 802.1X uses EAP.

Q: What authentication technology uses the unique characteristics of a person’s body?
- password substituting
- biometrics
- protocol analyzing
- body scanning
A: biometrics
If right: Biometrics refers to using unique characteristics of a persons body as the basis for securing a network or some other item. Unique characteristics that can be used in this manner include a users fingerprints (fingerprint scanner), the pattern of blood vessels found in a users eye (retina scanner), the pattern of colors and shapes found in a users iris (iris scanner), the shape of a users fingers or hand (finger and hand pattern recognition), and even the shape of a users face (face recognition).

Q: What authentication protocol used with PPP was designed for Windows to improve on CHAP?
- PAP
- NTLM
- MS-CHAP
- Kerberos
A: MS-CHAP
If right: The Microsoft Challenge-Handshake Protocol (MS-CHAP) is very closely related to standard CHAP but is designed to work closely with Microsoft operating systems. MS-CHAP works with the authentication protocols and capabilities built into the various Windows operating systems.

Q: Where should you place your server?
- In a locked room/physically secured room
- In a heated room
- In a well-lighted room near a window
- In a Freon-filled room
A: In a locked room/physically secured room
If right: Physical security is the first area of device security to consider. If a hacker can get physical access to a computer, not much can really be done to protect the data stored on that computer. Make sure that all computers (especially servers) containing important data are located in a locked location.

Q: What industry standard authentication protocol works with PPP to verify a client’s identity after a connection is established and uses a three-way handshake?
- PAP
- CHAP
- MS-CHAP
- MS-CHAPv2
A: CHAP
If right: Challenge-Handshake Authentication Protocol (CHAP) is an authentication method used by Point-to-Point Protocol (PPP) to verify a clients identity after a connection is successfully established. PPP establishes a dedicated connection between two different points that last for the duration of the session being used. CHAP sends the challenge and response in clear text, but still maintains a certain level of security.

Q: What do you call a wireless access point to a network so that the user can connect to the network at any time?
- masquerading access point
- man-in-the-middle access point
- hijacked access point
- rogue access point
A: rogue access point
If right: A rogue access point is often a component used in many man-in-the-middle attacks launched against wireless networks. Simply put, a rouge access point is an unauthorized access point that has been added to a wireless network. Not all rogue access points are created with malicious intent. Often, rouge access point can be added simply because a well-meaning employee wants to access the companys computers via wireless means.

Q: What authentication protocol is commonly used to authentication clients over an unsecured network and includes the Authentication Service, Ticket Granting Service, and Network Services?
- PAP
- Kerberos
- NTLM
- CHAP
A: Kerberos
If right: The Kerberos authentication protocol is commonly used to authenticate clients over an unsecured network, most commonly LANs. Kerberos is the authentication protocol most commonly used by Windows-based client/server networks. A Kerberos system is composed of an Authentication Service (AS), a Ticket Granting Service (TGS), and Network Services (NS). In the case of a Windows domain network, the AS and the TGS are usually located on the same computer, which is also a domain controller.

Q: What protocol is a secure alternative to TELNET?
- SSH
- HTTPS
- FTPS
- POPS
A: SSH
If right: Secure Shell (SSH) was first proposed in 1995 as an alternative to TELNET, which was used to communicate between two different computers in command line terminal mode.

Q: What refers to a protocol’s ability to ensure that the data comes from a valid source or where it claims to have come from?
- confidentiality
- integrity
- authentication
- auditing
A: authentication
If right: Authentication refers to a protocols ability ensure that the data came from a valid source or where the data claims to have come from.

Q: What refers to the protocol’s ability to ensure that data hasn’t been modified in any way?
- confidentiality
- integrity
- authentication
- auditing
A: integrity
If right: Integrity refers to a protocols ability to ensure that the data that arrives at a destination is the same data that left the source. In other words, integrity refers to a protocols ability to ensure that data has not been modified in any way.

Q: What type of attack tries every combination of characters to break a password?
- wordlist attack
- password dump
- password capturing
- brute force attack
A: brute force attack
If right: In a brute force attack, the password cracker keeps substituting letters, numbers, and special characters and encrypting them with the same encryption method used by the computer that originally created the password until it finds a hash that is a perfect match for the hash captured.

Q: What refers to a protocol’s ability to secure a communication to ensure that it is not read by a hacker as it goes by on the network?
- confidentiality
- integrity
- authentication
- auditing
A: confidentiality
If right: For a protocolor anything else for that matterto be considered secure, it needs to provide three things: confidentiality, integrity, and authentication. (If a protocol does not provide these three features, it is considered insecure.) Confidentiality refers to a protocols ability to secure a communication to ensure that it is not read by a hacker as it goes by on the network.

Q: What provides a method of centralized authentication, authorization, and accounting between a computer and a managed network?
- CHAP
- RRAS
- NTFS
- RADIUS
A: RADIUS
If right: Remote Access Dial-In User Service (RADIUS) provides a method of centralized authentication, authorization, and accounting between a computer and a managed network. Despite its name, RADIUS is not limited to dial-in services with a modem.

Q: What is CIA (as related to security) short for?
~ For a protocol to be considered secure, it needs to provide confidentiality, integrity, and authentication. Confidentiality refers to a protocol’s ability to secure a communication to ensure that it is not read by a hacker as it goes by on the network. Integrity refers to a protocol’s ability to ensure that the data that arrives at a destination is the same data that left the source—in other words, integrity refers to a protocol’s ability to ensure that data has not been modified in any way. Finally, authentication refers to a protocol’s ability to ensure that the data came from a valid source or where it claims to have come from.

Q: What three items make a protocol secure?
~ If a protocol does not provide confidentiality, integrity, and authentication, it is considered insecure. On the other hand, if a protocol does provide these three features, it is considered a secure protocol.

Q: What does AAA stand for when discussing security?

Q: What two easy methods would a hacker use to steal a password?
~ If passwords are written somewhere, then they can be found and used by someone else. In point of fact, if you were to go to any place of business where computers and passwords are widely used by the employees, you would be surprised at the number of passwords you would be able to find simply by looking around the premises. In addition, many people will use obvious things like the names of their children or friends, their birthdates, their favorite colors, the names of their pets, and other obvious things. The reason people do this is because it makes it easier for them to remember their passwords.

Q: What is the action called that allows you to read packets on a network?
~ Packet capture, also known as sniffing, is a hacker’s ability to capture a packet and read the information it contains.

Q: What do FTP, SNMPv1, and TELNET have in common?
~ All transmissions coming from FTP are in clear text. In other words, all passwords, usernames, data, and commands are sent in plain text across the network. As a result, anyone who can use packet capture on the network can see everything sent across the network using FTP. The worst part is that anyone can also send data across the network using FTP without having to worry about their packets not working. This means that hackers can essentially highjack any devices running FTP on the network and use them for their own purposes within the limitations of what FTP is capable of doing. Protocols such as TELNET, SMTP, POP, and IMAP suffer from this same problem.

Q: What is the security problem with TELNET?
~ TELNET was used to communicate between two different computers in command-line terminal mode. The problem with TELNET was that it was not secure—it sent passwords across the network in plain text, meaning that no encryption is used to try to conceal the password.

Q: What version of SNMP provides a secure protocol to manage devices?
~ SNMPv3 stands for Simple Network Management Protocol version 3. The SNMP protocol set was developed in the early 1980s and was used to manage and monitor complex network systems. Unlike previous versions of SNMP, SNMP v3 uses encryption to protect data.

Q: ___________ is the process by which a mathematical algorithm is run on a set of data to make it unreadable to someone who does not know the mathematical algorithm used to encode it.
A: Encryption
If right: Encryption is the process by which a mathematical algorithm is run on a set of data to make it unreadable to someone who does not know the mathematical algorithm used to encode it. Encryption can be done on data before it is sent out on a network or on data that is stored on a media of some sort. Either way, the process is intended to make the data that has been encrypted readable only to someone who knows how the data was encrypted in the first place. The reverse of encryption is decryption. Encrypted data is called cipher text.

Q: ________________ is based on the fact that is often easier to trick someone into revealing a password than it is to crack the same system.
A: Social engineering
If right: Social engineers manipulate people to gain access to a network rather than spend the time and effort needed to break into the network in a more traditional manner.