Question 1

A TCP packet with no flags set is referred to as a _________ packet.

Accepted Answer

The answer of A TCP packet with no flags set...

Question 2

Describe the purpose of the CVE and how it works.

Accepted Answer

The Common Vulnerabilities and Exposures...

Question 3

What is signature analysis?

Accepted Answer

Signature analysis is the prac...

Question 4

The signature of a normal FTP connection includes a three-way handshake.

Accepted Answer

A) True 
 B)False

Question 5

What type of attack does a remote-access Trojan attempt to perpetrate?

Accepted Answer

A)   worm
B)   back door
C)   remote denial of service
D)   composite attack

Question 6

Packet fragmentation is not normal,and can only occur if an attack has been initiated.

Accepted Answer

A) True 
 B)False

Question 7

What is the typical packet sequence for closing a TCP session?

Accepted Answer

A)   FIN, FIN ACK, RST
B)   FIN, ACK, FIN ACK, ACK
C)   FIN ACK, FIN, ACK, RST
D)   FIN, FIN ACK

Question 8

Which of the following is NOT a category of suspicious TCP/IP packet?

Accepted Answer

A)   bad header information
B)   single-packet attacks
C)   suspicious data payload
D)   suspicious CRC value

Question 9

An atomic attack is a barrage of hundreds of packets directed at a host.

Accepted Answer

A) True 
 B)False

Question 10

MATCHING
-an undocumented hidden opening through which an attacker can access a computer

Accepted Answer

A)  back door
B)  MTU
C)  ping sweep
D)  scan throttling
E)  packet injectionF) signatureG) vanilla scanH) RPCI) FIN packetJ) RST packet

Question 11

MATCHING
-the maximum packet size that can be transmitted

Accepted Answer

A)  back door
B)  MTU
C)  ping sweep
D)  scan throttling
E)  packet injectionF) signatureG) vanilla scanH) RPCI) FIN packetJ) RST packet

Question 12

List the four categories of suspicious traffic categories.

Accepted Answer

Informational
Reconn...

Question 13

What is the term used when an IDPS doesn't recognize that an attack is underway?

Accepted Answer

A)   false negative
B)   true positive
C)   negative activity
D)   positive signature

Question 14

Under which suspicious traffic signature category would a port scan fall?

Accepted Answer

A)   informational
B)   reconnaissance
C)   denial of service
D)   unauthorized access

Question 15

Which of the following is an element of the TCP header that can indicate that a connection has been established?

Accepted Answer

A)   Flags
B)   Stream index
C)   SEQ/ACK analysis
D)   Sequence number

Question 16

MATCHING
-a set of characteristics that define a type of network activity

Accepted Answer

A)  back door
B)  MTU
C)  ping sweep
D)  scan throttling
E)  packet injectionF) signatureG) vanilla scanH) RPCI) FIN packetJ) RST packet

Question 17

MATCHING
-lets the other computer know it is finished sending data

Accepted Answer

A)  back door
B)  MTU
C)  ping sweep
D)  scan throttling
E)  packet injectionF) signatureG) vanilla scanH) RPCI) FIN packetJ) RST packet

Question 18

What is the sequence of packets for a successful three-way handshake?

Accepted Answer

A)   SYN, ACK, ACK
B)   SYN, SYN ACK, RST
C)   SYN, SYN ACK, ACK
D)   SYN, ACK, FIN

Question 19

All devices interpret attack signatures uniformly.

Accepted Answer

A) True 
 B)False

Question 20

Which of the following is the description of a land attack?

Accepted Answer

A)   the local host source address occurs in the packet
B)   source and destination IP address/port are the same
C)   an illegal TCP flag is found in the segment header
D)   the attacker uses an undefined protocol number

Exam 3: Network Traffic Signatures

What is the sequence of packets for a successful three-way handshake?

Correct AnswerverifiedShow Answer

What is signature analysis?

Correct AnswerverifiedSignature analysis is the prac...View AnswerShow Answer

Which of the following is NOT a category of suspicious TCP/IP packet?

Correct AnswerverifiedShow Answer

MATCHING -lets the other computer know it is finished sending data

Correct AnswerverifiedShow Answer

Packet fragmentation is not normal,and can only occur if an attack has been initiated.

Correct AnswerverifiedShow Answer

An atomic attack is a barrage of hundreds of packets directed at a host.

Correct AnswerverifiedShow Answer

MATCHING -the maximum packet size that can be transmitted

Correct AnswerverifiedShow Answer

List the four categories of suspicious traffic categories.

Correct AnswerverifiedInformationalReconn...View AnswerShow Answer

What is the typical packet sequence for closing a TCP session?

Correct AnswerverifiedShow Answer

Describe the purpose of the CVE and how it works.

Correct AnswerverifiedThe Common Vulnerabilities and Exposures...View AnswerShow Answer

All devices interpret attack signatures uniformly.

Correct AnswerverifiedShow Answer

The signature of a normal FTP connection includes a three-way handshake.

Correct AnswerverifiedShow Answer

A TCP packet with no flags set is referred to as a _________ packet.

Correct AnswerverifiedShow Answer

MATCHING -an undocumented hidden opening through which an attacker can access a computer

Correct AnswerverifiedShow Answer

What type of attack does a remote-access Trojan attempt to perpetrate?

Correct AnswerverifiedShow Answer

Which of the following is the description of a land attack?

Correct AnswerverifiedShow Answer

What is the term used when an IDPS doesn't recognize that an attack is underway?

Correct AnswerverifiedShow Answer

Which of the following is an element of the TCP header that can indicate that a connection has been established?

Correct AnswerverifiedShow Answer

MATCHING -a set of characteristics that define a type of network activity

Correct AnswerverifiedShow Answer

Under which suspicious traffic signature category would a port scan fall?

Correct AnswerverifiedShow Answer

Correct Answer
verified

Correct Answer
verified
Signature analysis is the prac...
View Answer

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified
Informational
Reconn...
View Answer

Correct Answer
verified

Correct Answer
verified
The Common Vulnerabilities and Exposures...
View Answer

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified