Domain 4 Exam.
A minimum of 70% is required to pass.
Results
Wonderful!
There may be content you haven’t seen yet.
#1. You want to make it clear to developers that application processing and session processing are separate. Which network model should they follow?
〇：OSI reference model
The OSI reference model is a seven-layer classification of network communication. The concepts of application communication and session are separated, which would be clearly communicated based on the OSI reference model. Therefore, the correct answer is “OSI reference model.
×：TCP/IP model
The TCP/IP model is a layer design that is closer to the concept of a system than the OSI reference model; in the TCP/IP model, the application layer, presentation layer, and session layer of the OSI reference model are represented by a single application layer.
×：Data link model
There is no such model.
×：Biba model
Biba model is one of the security models that indicates that data cannot be changed without permission.
#2. Angela wants a computer environment that can be used together in departmental groups while easily sharing network resources. Which computers should logically be used as group computers?
〇：VLAN
Virtual LANs (VLANs) allow logical isolation and grouping of computers based on resource requirements, security, or business needs, despite the standard physical location of the system. Computers in the same department configured on the same VLAN network can all receive the same broadcast messages, allowing all users to access the same types of resources regardless of their physical location.
×：Open Network Architecture
Open network architecture is wrong because it describes the technology that can configure a network; the OSI model provides a framework for developing products that operate within an open network architecture.
×：Intranet
Incorrect because an intranet is a private network used by a company when it wants to use Internet and Web-based technologies in its internal network.
×：VAN
Incorrect because a Value Added Network (VAN) is an electronic data interchange (EDI) infrastructure developed and maintained by a service bureau.
#3. Which DNS extension provides authentication of the origin of DNS data to DNS clients (resolvers) that can reduce DNS poisoning, spoofing, and other attacks?
〇：DNSSEC
DNSSEC is a set of extensions to the DNS that provide DNS clients (resolvers) with authentication of the origin of DNS data to reduce the threat of DNS poisoning, spoofing, and similar attack types. It is an Internet Engineering Task Force (IETF) specification for securing services.
×：Resource Record
DNS servers contain records that map hostnames to IP addresses, called resource records. The answer is incorrect. When a user’s computer needs to resolve a hostname to an IP address, it looks in its network configuration to find its DNS server. The computer then sends a request containing the hostname to the DNS server for resolution; the DNS server looks at its resource records, finds a record with this particular hostname, retrieves the address, and responds to the computer with the corresponding IP address.
×：Zone Transfer
Primary and secondary DNS servers synchronize their information via zone transfers. The answer is incorrect. After changes are made to the primary DNS server, these changes must be replicated to the secondary DNS server. It is important to configure the DNS servers so that zone transfers can take place between specific servers.
×：Resource Transfer
Equivalent to transferring DNS resource records, but the answer is incorrect.
#4. What is the IPSec SA value?
Each IPSec VPN device will have at least one security association (SA) for each secure connection it uses; the SA, which is critical to the IPSec architecture, is the device’s need to support IPSec connections over VPN connections This is a record of the configuration that needs to be in place.
#5. An attacker is attempting a distributed denial of service (DDoS) attack using UDP floods. How does a distributed denial of service (DDoS) attack work at this time?
UDP (User Datagram Protocol) floods are often used in distributed denial of service (DDOS) attacks because they are connectionless and yet allow for easy generation of UDP messages from various scripting and compilation languages. UDP is a datagram protocol.
#6. Encryption can occur at different layers of the operating system and network stack. Where does PPTP encryption occur?
Point-to-Point Tunneling Protocol (PPTP) is a way to implement a virtual private network (VPN). It is Microsoft’s proprietary VPN protocol that operates at the data link layer of the OSI model; PPTP can only provide a single connection and can operate over a PPP connection.
#7. What is the intention of preparing artificially vulnerable network domains?
〇：For early detection or enclosure in the event of an attack.
Attackers will conduct an investigation before launching a substantial attack. In such cases, a vulnerable network can provide preventative information such as where the attacker is accessing the network from. This is because only an attacker would have the incentive to break into the network. Vulnerable network domains, such as honeypots, make this kind of intrusion easier and clarify the attacker’s behavior. Thus, the correct answer is “to detect or enclose them early in the event of an attack.” will be
×：Debugging environment for when a system outage occurs in the current environment.
The answer is not to intentionally create a vulnerable environment. It is only the result of creating an environment that is vulnerable.
×：Aiming to prevent regressions due to old vulnerabilities.
Even if it is an old vulnerability, it should be addressed and there is no point in allowing it to remain.
×：A special environment for running a product with a low version that is no longer supported.
It is not an answer to intentionally create a vulnerable environment. It is merely the result of creating an environment that is vulnerable.
#8. Previously, access was controlled by source IP address, but the behavior of a series of communications indicates that it must be detected. Which firewall is designed to respond to this attack?
〇：Stateful Inspection
Stateful Inspection detects abnormal communication in which the request and response are linked and only the response is returned from a different server. Therefore, the correct answer is “Stateful Inspection.
×：Application Gateway
Commonly referred to as WAF, this is used when filtering is performed based on strings in telegrams, such as SQL injection.
×：Packet Filtering
Used for filtering by IP address or port.
×：Session Gateway
There is no such firewall category.
#9. What are the problems with RADIUS that have been eliminated by Diameter?
Diameter is an authentication protocol that implements the AAA (Authentication, Authorization, Accounting) service, the successor to RADIUS. This can cause performance degradation and data loss. This can lead to performance degradation and data loss.
#10. Which of the following attacks aims to bring down equipment by means of packets whose offsets have been tampered with?
〇：Teardrop
Teardrop is an attack to bring a system to a halt by forging the offset of IP packets when they are returned before splitting.
×：Fraggle attack
Fraggle attack is an attack that uses the CHARGEN function to generate an appropriate string.
×：CHARGEN attack
There is no attack with such a name.
×：War Driving
Wardriving is the act of driving around a city looking for vulnerable wireless LAN access points.
#11. When attackers set up war dialing, what do they try to do?
War Dialing is the indiscriminate and repeated act of cracking dial-ups in search of dial-up lines, such as those for non-public internal networks. It automatically scans a list of telephone numbers, usually dialing all numbers in the local area code, and searches modems, computers, bulletin board systems, and fax machines.
#12. Software-defined network (SDN) technology specifies which of the following?
〇：How routers are centrally managed and control packets based on the controller’s instructions
Software-defined networks (SDN) are intended to facilitate centralized management of routing decisions and to separate the router’s logical functions of passing data between the routing decision and the interface and making its mechanical functions.SDN architecture is a scalable, a programmable, and is intended to be a standard method of providing router control logic. Therefore, the correct answer is “a way for routers to be centrally managed and control packets based on the controller’s instructions.
×：Mapping between MAC and IP addresses.
ARP table.
×：Updating the routing table in a dynamic way.
Explanation of dynamic routing.
×：A method in which routers communicate with each other to update the routing table when an event occurs.
This is an explanation of routing control in case of communication failure.
#13. Layer 2 of the OSI model has two sublayers. What are the two IEEE standards that represent these sublayers and technologies?
The data link layer or Layer 2 of the OSI model adds a header and trailer to the packet to prepare the packet in binary format in local area network or wide area network technology for proper line transmission. Layer 2 is divided into two functional sublayers. The upper sublayer is logical link control (LLC), which is defined in the IEEE 802.2 specification. It communicates with the network layer above the data link layer. Below the LLC is the Media Access Control (MAC) sublayer, which specifies interfaces with the protocol requirements of the physical layer.
#14. Which network line should be used to ensure that traffic always uses the same path?
Circuit switching is a dedicated communication channel through a network. The circuit guarantees full bandwidth. The circuit functions as if the nodes were physically connected by cables.
#15. An IT security team at a small healthcare organization wants to focus on maintaining IDS, firewalls, enterprise-wide anti-malware solutions, data leak prevention technology, and centralized log management. Which of the following types of solutions implement standardized and streamlined security features?
〇：Unified Threat Management
Unified Threat Management (UTM) appliance products have been developed to provide firewall, malware, spam, IDS / IPS, content filtering, data leak prevention, VPN capabilities, and continuous monitoring and reporting in computer networks.
Since this question asks for a definition of Unified Threat Management that is unfamiliar or not even mentioned in the course material, it is inefficient to buy and study a new book just to get this score. To avoid ending up with “I don’t know = I can’t solve it,” be sure to develop the habit of choosing a “better answer.
If you think in terms of the classification Concepts/Standards > Solutions/Implementation Methods, ISCM (NIST SP800-137) and centralized access control systems are the former, while Unified Threat Management and cloud-based security solutions are the latter. Therefore, it is still better to bet on unified threat management and cloud-based security solutions.
×：ISCM (NIST SP800-137)
Because continuous monitoring in the security industry is most commonly Information Security Continuous Monitoring ISCM (NIST SP800-137), which enables companies to gain situational awareness, continuous awareness of information security, vulnerabilities, and threats to support business risk management decisions , is incorrect.
×：Centralized Access Control System
Wrong because a centralized access control system does not attempt to combine all of the security products and capabilities mentioned in the issue. A centralized access control system is used so that its access control can be enforced in a standardized manner across different systems in a network environment.
×：Cloud-based security solutions
Cloud-based security solutions include security managed services that allow an outsourced company to manage and maintain a company’s security devices and solutions, but this is not considered a cloud-based solution. The cloud-based solution provides the infrastructure environment, platform, or application to the customer so that the customer does not have to spend time and money maintaining these items themselves.
#16. One approach to fighting spam mail is to use the Sender Policy Framework, an email validation system. What type of system implements this functionality and receives and responds to requests?
Sender Policy Framework (SPF) is an email verification system that detects email spoofing and prevents spam and malicious email. Attackers typically spoof e-mail addresses to make recipients believe that the messages come from a known and trusted source. SPF allows network administrators to specify which hosts can send mail from a particular domain by implementing SPF records in the Domain Name System (DNS). The e-mail server is configured to check with the DNS server to ensure that e-mail sent from a particular domain was sent from an IP address authorized by the administrator of the sending domain.
#17. Robert is responsible for implementing a common architecture for accessing sensitive information over an Internet connection. Which of the following best describes this type of architecture?
〇：3-tier architecture
The 3-tier architecture clearly distinguishes the three layers: the client has the user interface responsible for input and displaying results, and the server has the functional process logic responsible for data processing and data storage for accessing the database. The user interface role is generally handled by the front-end web server with which the user interacts. It can handle both static and cached dynamic content. The functional process logic is where requests are reformatted and processed. It is typically a dynamic content processing and generation level application server. Data storage is where sensitive data is held. It is the back-end database and holds both the data and the database management system software used to manage and provide access to the data.
×：2-tier architecture
Two-tier, or client/server, is incorrect because it describes an architecture in which a server serves one or more clients that request those services.
×：Screened Subnets
A screen-subnet architecture is for one firewall to protect one server (basically a one-tier architecture). The external, public-side firewall monitors requests from untrusted networks like the Internet. If one layer, the only firewall, is compromised, an attacker can access sensitive data residing on the server with relative ease.
×：Public and Private DNS Zones
Separating DNS servers into public and private servers provides protection, but this is not the actual architecture.
#18. Which of the following are threats to layers 5-7 of the OSI reference model?
Computer worms are standalone malware computer programs that replicate themselves and spread to other computers. They typically operate at OSI reference layers 5-7.
#19. Which of the following is not a network topology?
Matrix is not a network topology. Ring, mesh, and star are network topologies.
#20. Which of the following is the most appropriate relationship between SSL and TLS?
〇：TLS is an open community version of SSL.
Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are cryptographic protocols used to protect communications by encrypting segments of a network connection. SSL is a proprietary protocol and TLS was developed by a standards body, making it an open community protocol.
×：TLS is an open community version of SSL. SSL is a proprietary protocol and TLS was developed by a standards body, making it an open community protocol. x: The SSL protocol can be modified by developers to extend its capabilities.
This is incorrect because SSL is a proprietary protocol developed by Netscape. This means that the technical community cannot easily interoperate and extend SSL to extend to its functionality.
×：SSL is an open community protocol while TLS is a proprietary protocol.
The meaning and matching are reversed.
×：SSL is an extended version and backward compatible with TLS.
Wrong, since TLS is actually more extensible than SSL and is not backward compatible with SSL.
