Answer: B

Hint: A BNC refers to a Bayonet Nell Concelman RG58 connector for 10Base2. Fiberoptic cable has three basic physical elements: the core, the cladding, and the jacket. The core is the innermost transission medium, which can be glass or plastic. The next outer layer, the cladding, is also made of glass or plastic,but it has different properties and helps to reflect the light back into the core. The outermost layer, the jacket, provides protection from heat, moisture, and other environmental elements.

Answer: C

Hint: Most backup nethods use the Archive file attribute to determine wheather the file should be backed up. The backup software determines which files need to be backed up by checking to see wheather the Archive file attribute has been set and then resets the Archive bit value to null after the backup procedure. The Incremental backup method backs up only files that have been created or modified since the last backup was made because the Archive file attribute is reset. This can result in the backup operator needing several tapes to do a complete restoration, as every tape with changed files as well as the last full backup tape will need to be restored.

Answer: B

Hint: Answer A refers to 10Base-2; answer C refers to 10Base-F; and answer D refers to 100Base-T.

Answer: B

Hint: Answer A, Unicast describes a packet sent from a single source to a single destination. Answer C, Broadcast, describes a packet sent to all nodes on the network segment. Answer D, Anycast, refers to communication between any sender and the nearest of a group of receivers in a network.

Answer: A

Hint: The first three bytes (or first half) of the six-byte MAC address is the manufacture's identifier. This can be a good troubleshooting aid if a network device is acting up, as it will isloate the brand of the failing device. The other answers are distracters.

Answer: B

Hint: Coax consists of a hollow outer cylindrical conductor surrounding a single, inner wire conductor. Answer A describes UTP. Coax requires fixed spacing between connections, and answer D describes liber-optic cable.

Answer: B

Hint: The other three address ranges can be used for Network Address Translation (NAT). While NAT is, in itself, not a very effective security measure, a large network can benefit from using NAT with Dynamic Host Configuration Protocol (DHCP) to help prevent certain internal routing information from being exposed. The address 127.0.0.1 is a called the loopback address.

Answer: B

Hint: The other answers are all properties of analog or digital signals.

Answer: D

Hint: The Secure, Socket Layer (SSL) sits between higher-level application functions and the TCP/IP stack and provides security to applications. It includes a variety of encryption algorithms to secure transmitted data, but the functionality must be integrated into the application. Answer A refers to the Secure/Multipurpose Internet Mail Extension (s/MIME). Most major email clients support S/MIME today. Answer B describes Secure Shell (SSH). Answer C refers to IPSec. IPSec enables security to be built directly into the TCP/IP stack, without requiring application modification.

Answer: A

Hint: IEEE 802.11a specifies high-speed wireless connectivity in the 5 GHz band using Orthogonal Frequency Division Multiplexing with data rates up to 54 Mbps. Answer B, IEEE 802.11b, specifies high-speed wireless connectivity in the 2.4.GHz ISM band up to 11 Mbps. Answer C, IEEE 802.11g, is a proposed standard that offers wireless transmission over relatively short distances at speeds from 20 Mbps up to 54 Mbps and operates in the 2.4 GHz range (and is therefore expected to be backward-compatible with existing 802.11b-based networks). Answer D, IEEE 802.15, defines Wireless Personal Area Networks (WPAN), such as Bluetooth, in the 2.4-2.5 GHz band.

Answer: A

Hint: The Address Resolution Protocol (ARP) sends a broadcast asking for the host with a specified IP address to reply with its MAC, or hardware address. This information is kept in the ARP Cache. Answer B, the Reverse Address Resolution Protocol (RARP) is commonly used on diskless machines when the MAC is known, but not the IP address. It asks a RARP server to provide a valid IP address, which is somewhat the reverse of ARP. Answer C, the Internet Control Message Protocol(ICMP) is a management protocol for IP. Answer D, the Trvial File Transfer Protocol(TFTP), is a stripped-down version of the File Transfer Protocol(FTP).

Answer: B

Hint: IP operates at the Network Layer of the OSI model and at the Internet layer of the TCP/IP model. FTP operates at the Application layer of the TCP/IP model, which is roughly similar to the top three layers of the OSI model: the Application, Presentation, and Session Layers. TCP and UDP both operate at the OSI Transport Layer, which is similar to the TCP/IP host-to-host layer.

Answer: C

Hint: Nodes on an IEEE 802.11b wireless LANs can communicate in one of two modes; ad hoc or infrastructure. In ad hoc mode, the wireless nodes communicate directly with each other, without establishing a connection to an access point on a wired LAN. In infrastructure mode, the wireless nodes communicate to an access point, which operates similarly to a bridge or router and manages traffic between the wireless network and the wired network.

Answer: A

Hint: As opposed to the Transmission Control Protocol (TCP), the User Datagram Protocol (UDP) is a connectionless protocol. It does not sequence the packets or acknowledge the receipt of packets and is referred to as an unreliable protocol.

Answer: C

Hint: Switched Multimegabit Data Service (SMDS) is a high-speed, connectionless, packet-switching public network service that extends LAN-like perforance to a metropolitan area network (MAN) or a wide area network (WAN). It's generally delivered over a SONET ring with a maximum effective service radius of around 30 miles. Answer A, X 25, defines an interface to the first commercially successful connection-oriented packet-switching network, in which the packets travel over virtual circuits. Answer B, Frame Relay, was a siccessor to X.25 and offers a connection-oriented packet-switching network. Answer D, Asynchronous Transfer Mode (ATM) was developed from an outgrowth of ISDN standards and is fast-packet, connection-oriented, cell-switching technology.

Answer: C

Hint: The Trivial File Transfer Protocol (TFTP) is considered less secure than the File Transfer Protocol (FTP) because authentication does not occur during session establishment.

Answer: A

Hint: A virtual local area network (VLAN) allows ports on the same or different switches to be grouped so that traffic is confined to members of that group only, and it restricts broadcast, unicast, and multicast traffic. Answer B is incorrect because a VLAN is segmented logically, rather than physically. Answer C is incorrect. When a VLAN is implemented with private port, or single-user,switching, it provides fairly stringent security because broadcast vulnerabilities are minimized. Answer D is incorrect, as a closed VLAN authenticates a user to an access control list on a central authentication server, where they are assigned authorization parameters to determine their level of network access.

Answer: A

Hint: IPSec-compatible and non-IPSec compatible devices are used to create VPNs. The other three answers are all ways in ehich VPNs can be created.

Answer: B

Hint: C2MYAZZ is a utility that enables server spoofing to implement a session hijacking or man-in-the-middle exploit. It intercepts a client LANMAN authentication logon and obtains the session's logon credentials and password combination transparently to the user. Answer A, DNS poisoning, is also known as cache poisoning. It is the process of distributing incorrect IP address information for a specific host with the intent to divert traffic from its true destination. Answer C, Snort, is a utility used for network sniffing. Network sniffing is the process of gathering traffic from a network by capturing the data as it passes and storing it to analyze later. Answer D, Back Orifice 2000 (BO2K), is an application-level Trojan Horse used to give an attacker backdoor network access.

Answer: B

Hint: A server cluster is a group of servers that appears to be a single server to the user. Answer A refers to redundant servers.

Answer: C

Hint: The Ping of Death exploits the fragmentation vulnerability of large ICMP ECHO request packets by sending an illegal packet with more than 65K of data, creating a buffer overflow. Answer A is a TCP sequence number attack, which exploits the nonrandom predictable pattern of TCP connection sequence numbers to spoof a session. Answer B, a TCP SYN attack, is a DoS attack that exploits the TCP three-way handshake. The attacker rapidly generates randomly sourced SYN packets filling the target's connection queue before the connection can timeout. Answer D, land.c attack, is also a DoS attack that exploits TCP SYN packets. The attacker sends a packet that gives both the source and destination as the target's address and uses the same source and destination port.

Answer: B

Hint: Probing is a procedure whereby the intruder runs programs that scan the network to create a network map for later intrusion. Answer A is spoofing, answer C is the objective of a DoS attack, and answer D describes passive eavesdropping.

Answer: D

Hint: A stateful-inspection firewall intercepts incoming packets at the Network level, and then uses an Inspection Engine to extract stste-related information from upper layers. It maintains the information in dynamic state table and evaluates subsequent connection attempts. Answer A, packet-filtering firewall, is the simplest type of firewall commonly implemented on routers. It operates at the Network layer and offers good performance but is the least secure. Answer B, application-level firewall or application-layer gateway, is more secure because it examines the packet at the Application layer but at the expense of performance. Answer C, circuit-level firewall, is similar to the application-level firewall in that it functions as a proxy server, but it differs in that special proxy application software is not needed.

Answer: B

Hint: Logon abuse entails an otherwise proper user attempting to access areas of the network that are deemed off-limits, Answer A is called network intrusion, and D refers to back-door remote access.

Answer: A

Hint: Like a dual-homed host, a screened-host firewall uses two network cards to connect to the trusted and untrusted networks, but it adds a screening router between the host and the untrusted network. Answer B, dual-homed host, has two NICs but not necessarily a screening router. Answer C, screened-subnet firewall, also uses two NICs but has two screening routers with the host acting as a proxy server on its own network segment. One screening routet controls traffic local to the network while the second monitors and controls incoming and outgoing Internet traffic. Answer D, application-level proxy, is unrelated to this question.

Answer: A

Hint: A covert channel is a connection intentionally created to transmit unauthorized information from inside a trusted network to a partner at an outside, untrusted node. Answer C is called masquerading.

Answer: D

Hint: A dual-homed host uses two NICs to attach to two separate networks, commonly a trusted network and an untrusted network. It's important that the internal routing function of the host be disabled to create an Application-layer chokepoint and filter packets. Many systems come with routing enabled by default, such as IP forwarding, which makes the firewall useless. The other answers are distracters.

Answer: C

Hint: A bridge operates at Layer 2 and therefore does not use IP addressing to make routing decisions.

Answer: D

Hint: The 802.ID spanning tree protocol is an Ehernet link-management protocol that provides link redundancy while preventing routing loops. Because only one active path can exist for an Ethernet network to route properly, the STP algorithm calculates and manages the best loop-free path through the network. Answer A, IEEE 802.5, specifies a token-passing ring access method for LANs. Answer B, IEEE 802.3, specifies an Ethernet bus topology using Carrier Sense Multiple Access Control/Carrier Detect (CSMA/CD). Answer C, IEEE 802.11, is the IEEE standard that specifies 1 Mbps and 2 Mbps wireless connectivity in the 2.4 MHz ISM (Industrial, Scientific, Medical) band.

Answer: B

Hint: Data Encapsulation attaches information from one layer to the packet as it travels from an adjoining layer. The OSI-layered architecture model creates seven layers. The TCP/IP proocol UDP provides best effort packet delivery, and a token-passing transmission scheme creates a deterministic network because it is possible to compute the maximum predictable delay.

Answer: B

Hint: The layer Two Tunneling Protocol (L2TP) is a layer two tunneling protocol that allows a host to establish a virtual connection. Although L2TP, an enhancement to Layer Two Forwarding Protocol (L2F) that supports some features of the Point to Point Tunneling (PPTP), may coexist with IPSec, it is not natively an IPSec component. Answer A, the Authentication Header (AH), is an authenticating protocol that uses a hash signature in the packet header to validate the integrity of the packet data and the authenticity of the sender. Answer C, the Security Association (SA). is a component of the IPSec architecture that contains the information the IPSec device needs to process incoming and outbound IPSec packets. IPSec devices embed a value called the Security Parameter Index (SPI) in the header to associate a datagram with its SA and to store SAs in a Security Association Database (SAD). Answer D, the Encapsulating Security Payload (ESP), is an authenticating and encrypting protocol that provides integrity, source authentication, and confidentiality services.

Answer: C

Hint: A brute force attack is an attempt to use all combinations of key patterns to decipher a message. The other three attacks are commonly used to create a Denial of Service (DoS). Answer A, Ping of Death, exploits ICMP by sending an illegal ECHO packet of >65K octets of data, which can cause an overflow of system variables and lead to a system crash. Answer B, SMURF, is a type of attack using spoofed ICMP ECHO requests to broadcast addresses, which the routers attempt to propagate, congesting the network. Three participants are required for a SMURF attacker, the amplifying network, and the victim. Answer D, a TCP SYN flood attack, generates phony TCP SYN packets from random IP addresses at a rapid rate to fill up the connection queue and stop the system from accepting legitimate users.

Answer: B

Hint: The Encapsulating Security Payload (ESP) is a component of IPSec. Socket Security (SOCKS) is a Transport layer, secure networking proxy protocol. SOCKS replaces the standard network systems calls with its own calls. These calls open connections to a SOCKS proxy server for client authentication, transparently to the user. Common network utilities, like TELNET or FTP, need to be SOCKS-ified or have their network calls altered to recognize SOCKS proxy calls.

Answer: C

Hint: The /etc/passwd file is a Unix system file. The NT Security Accounts Manager, SAM, contains the usernames and encrypted passwords of all local (and domain, if the server is a domain controller) users. The SAM uses an older, weaker LanManager hash that can be broken easily by tools like L0phtcrack. Physical access to the NT server and the rdisks must be controlled. The "Sam-"file in the repair directory must be deleted after creation of an rdisk. Pwdump and pwdump2 are utilities taht allow someone with Administrator rights to target the Local Security Authority Subsystem, isass.exe, from a remote system.

Answer: B

Hint: Distance vector rouing uses the routing information protocol (RIP) to main-tain a dynamic table of routing information that is updated regularly. It is the oldest and most common type of dynamic routing. Answer A, static routing, defines a specific route in a configuration file on the router and does not require the routers to exchange route information dynamically. Answer C, link state routers,functions like distance vector routers, but it uses first-hand information when building routing tables only by maintaining a copy of every other router's Link State Protocol (LSP) frame. This helps to eliminate routing errors and considerably lessens convergence time. Answer D is a distracter.

Answer: B

Hint: Back doors are very hard to trace, as an intruder will often create several avenues into a network to be exploited later. The only real way to be sure these avenues are closed after an attack is to restore the operating system from the original media, apply the patches, and restore all data and applications. Answer A, social engineering, is a technique used to mainpulate users into revealing information like passwords. Answer C refers to a trap door, which is an undocumented hook into an application to assist programmers with debugging. Although intended innocently, these can be exploited by intruders. Answer D is a "honey pot" or "padded cell". A honey pot uses a dummy server with bogus applications as a decoy for intruders.

Answer: B

Hint: Simple Mail Transport Protocol (SMTP) queues and transfers email. SNMP stands for Simple Network Management Protocol. ICMP stands for Internet Control Message Protocol. RARP stands for Reverse Address Resolution Protoco.

Answer: C

Hint: The Challenge Handshake Authentication Protocol (CHAP) is used at the starup of a remote link to verify the identity of a remote node. Answer A, the Simple Mail Transfer Protocol (RFCs 821 and 1869), is used by a server to deliver email over the Internet. Answer B, the Post Office Protocol (RFC 1939), enables users to read their email by downloading it from a remote server on to their local computer. Answer D, the Internet Message Access Protocol (RFC 2060), allows users to read their email on a remote server without downloading the mail locally.

Answer: B

Hint: War walking (or war driving) refers to scanning for 802.11-based wireless network information by either driving or walking with a laptop, a wireless adapter in promiscuous mode, some type of scanning software such as NetStumbler or AiroPeek, and a Global Positioning System (GPS). Answer A, war dialing, is a method used to hack into computers by using a software program to automatically call a large pool of telephone numbers to search for those that have a modem attached. Answer C, demon dialing, similar to war dialing, is a tool used to attack one modem using brute force to guess the password and gain access. Answer D, ToneLoc, was one of the first war-dialing tools used by phone phreakers.

Answer: B

Hint: Redundant Array of Inexpensive Disks (RAID) is a method of enhancing hard disk fault tolerence, which can improve performance. RAID 1 maintains a complete copy of all data by duplicating each hard drive. Performance can suffer in some implementations of RAID 1, and twice as many drives are required. Novell developed a type of disk mirroring called disk duplexing, which uses multiple disk controller cards,increasing both performance and reliability. Answer A, RAID 0, gives some performance gains by striping the data across multiple drives but reduces fault tolerence, as the failure of any single drive disables the whole volume. Answer C, RAID 3, uses a dedicated error-correction disk called a parity drive, and it stripes the data across the other data drives. Answer D, RAID 5, uses all disks in the array for both data and error correction, increasing both storage capacity and performance.

Answer: A

Hint: The Routing Information Proocol (RIP) bases its routing path on the distance (number of hops) to the destination. RIP maintains optimum routing paths by sending out routing update messages if the network topology changes. For example, if a router finds that a particular link is faulty, it will update its routing table and then send a copy of the modified table to each of its neighbors. Answer B, the Open Shortest Path First (OSPF), is a link-state hierarchical routing algorithm intended as a successor to RIP. It features least-cost routing, multipath routing, and load balancing. Answer C, the Internet Gateway Routing Protocol (IGRP), is a Cisco protocol that uses a composite metric as its routing metric, including bandwidth, delay, reliability, loading, and maximum transmission unit. Answer D, the Extensible Authentication Protocol (EAP), is a general protocol for PPP authentication that supports multiple remote authentication mechanisms.

Answer: A

Hint: Although many routers can perform most of the functions above, the OSI Network Layer is primarily responsible for routing. Answer B, bridging, is a Data Link Layer function. Answer C, gateways, most commonly function at the higher layers. Answer D, signal regeneration and repeating, is primarily a Physical Layer function.

Answer: C

Hint: Private addresses are not easily routable.

Answer: B

Hint: In the DoD reference model, the Host-to-Host layer parallels the function of the OSI's Transport Layer. This layer contains the Transmission Control Protocol (TCP), and the User Datagram Protocol (UDP). Answer A, the DoD Process/Application layer, corresponds to the OSI's top three layers, the Application, Presentation, and Session Layers. Answer C, The DoD Internet layer, corresponds to the OSI's Network Layer, and answer D, the DoD Network Access layer, is the equivalent of the Data Link and Physical Layers of the OSI model.

Answer: B

Hint: The class a address range is 1.0.0.0 to 126.255.255.255. The class B address range is 128.0.0.0 to 191.255.255.255. The class C address range is from 192.0.0.0 to 223.255.255.255. The class D address range is 244.0.0.0 to 239.255.255.255 and is used for multicast packets.

Answer: C

Hint: The other acronyms do not exist.