Networks (D325)

Correct Answer

B. Zombies

Explanation

In a DDoS attack, attackers compromise numerous systems and convert them into what are known as "zombies." These zombies are then controlled remotely to simultaneously flood a target system with traffic, overwhelming its resources. The coordinated nature of this attack increases its effectiveness and makes it harder to mitigate. These infected systems operate without the knowledge of the users, allowing attackers to maintain a large attack network.

Why other options are wrong

A. Trojans

Trojans are malicious programs that disguise themselves as legitimate software to trick users into installing them. While Trojans can be used to initiate the infection process, they are not the systems used to carry out the attack. In the context of a DDoS attack, the compromised systems themselves are referred to as zombies, not Trojans. Hence, Trojans are more related to the delivery of malware rather than being part of the attack network.

C. Spyware

Spyware is a type of malicious software designed to gather information from a computer without the user's knowledge. While harmful, spyware’s primary purpose is surveillance, not participating in coordinated network attacks. Spyware typically does not engage in network flooding or coordinated attacks against a single target, so it does not fit the description of infected systems in a DDoS attack.

D. Worms

Worms are self-replicating malware that spread across systems without user intervention. While worms can be used to spread DDoS attack tools, they themselves are not the systems used in the attack. In a DDoS context, the infected machines carrying out the attack are called zombies, regardless of how they were infected. Worms may contribute to the infection process but are not the infected systems used in the actual attack.

Correct Answer

C. Session layer

Explanation

The session layer is responsible for managing sessions between devices, which includes establishing, maintaining, and terminating connections. It ensures that data is properly synchronized and that communication sessions are effectively controlled.

Why other options are wrong

A. Application layer

The application layer provides services directly to the user, like email, web browsing, and file transfer, but it does not manage the establishment, management, or termination of connections between devices.

B. Network layer

The network layer is responsible for routing packets and managing the addressing of devices across networks. It handles the logical addressing (IP addresses) but does not manage the sessions or connections between devices.

D. Physical layer

The physical layer is concerned with transmitting raw bits over a physical medium, including cables and radio waves. It does not handle connections or sessions between devices, which is the role of the session layer.

Correct Answer

A. Authentication, Authorization, Accounting

Explanation

The AAA framework stands for Authentication, Authorization, and Accounting. These are three fundamental security functions used to control access to computer resources, enforce policies, and track user activities.

Authentication verifies the identity of users or devices attempting to access a system.

Authorization determines what resources the authenticated user or device is allowed to access.

Accounting tracks the actions performed by authenticated and authorized users to ensure compliance and generate logs for auditing purposes.

Why other options are wrong

B. Access, Authentication, Accounting

This option is incorrect because while it includes two important components (Authentication and Accounting), it places "Access" in the first position instead of "Authorization." Authorization is a distinct process that follows authentication and determines access levels.

C. Authorization, Access, Accountability

This is incorrect because "Authorization" is not the first step, and "Access" is not a separate term in the AAA framework. The framework uses "Authentication" to verify identity first.

D. Authentication, Access, Accountability

This option is incorrect because "Access" and "Accountability" are not correct terms in the AAA framework. "Access" should be replaced by "Authorization," and "Accountability" refers to tracking, which is captured by "Accounting."

Correct Answer

A. Type 1

Explanation

A Type 1 hypervisor, also known as a bare-metal hypervisor, is installed directly onto the physical hardware and does not require a host operating system. It manages guest operating systems directly, which allows for better performance, scalability, and efficiency. Type 1 hypervisors are typically used in enterprise environments where performance and isolation are critical, such as with VMware ESXi and Microsoft Hyper-V.

Why other options are wrong

B. Type 2

Type 2 hypervisors run on top of a host operating system and depend on it to interact with the hardware. They are generally less efficient than Type 1 hypervisors and are often used for personal or testing environments rather than production. Type 2 hypervisors do not run directly on the hardware, which disqualifies them from being considered "bare metal."

C. Virtual PC

Virtual PC is a Type 2 hypervisor developed by Microsoft. It runs on top of a host operating system and is used to create and manage virtual machines. Since it requires a host OS to function, it is not capable of running directly on bare metal, and thus does not meet the criteria in the question.

D. Windows XP Mode

Windows XP Mode was a virtualization solution offered by Microsoft for running Windows XP applications within Windows 7 using Virtual PC. It is not a hypervisor itself but rather a feature built on top of a Type 2 hypervisor. It relies on the host OS and is not installed directly on hardware, making it unsuitable as a Type 1 hypervisor.

Correct Answer

B. To filter traffic based on IP addresses and port numbers

Explanation

A firewall operating at Layer 4 of the OSI model works at the Transport Layer, where it filters traffic based on both the source and destination IP addresses, as well as port numbers. This allows the firewall to block or allow specific types of network traffic based on the protocols (like TCP/UDP) and ports used by the communication. It is effective in managing and controlling access to services and applications on the network.

Why other options are wrong

A. To encrypt data packets for secure transmission

Encryption typically occurs at higher layers, such as the Presentation Layer (Layer 6). Firewalls do not handle encryption at the Transport Layer but may allow or block encrypted traffic based on its characteristics.

C. To provide user authentication for network access

User authentication typically takes place at the Application Layer (Layer 7), not the Transport Layer. While firewalls can assist with filtering traffic based on security policies, authentication is generally handled by more specialized systems like authentication servers or network access control systems.

D. To manage sessions between applications

Managing sessions between applications is a function of the Session Layer (Layer 5) or even higher layers. While firewalls may track sessions to enforce rules, they do not directly manage application sessions, which typically involve higher-level protocols such as HTTP or FTP.

Correct Answer

D. Ad-hoc

Explanation

An ad-hoc network is a type of wireless network where devices communicate directly with each other, without the need for a wireless access point (WAP). This peer-to-peer communication model allows devices to connect directly to each other, typically for short-range communication, without requiring a central networking device such as a WAP. This is in contrast to traditional Wi-Fi networks, where a WAP is used to manage traffic between devices.

Why other options are wrong

A. Wi-Fi protected access (WPA)

WPA (Wi-Fi Protected Access) is a security protocol designed to protect wireless networks by encrypting data and ensuring secure communication. It does not pertain to the peer-to-peer communication model of an ad-hoc network, which does not require a WAP.

B. WPA2

WPA2 is an improved version of WPA that provides stronger encryption and security for wireless networks. Like WPA, it is used in typical Wi-Fi networks, which require a WAP. It is not related to the peer-to-peer communication characteristic of an ad-hoc network.

C. WPA3

WPA3 is the latest version of the Wi-Fi security protocol, offering improved encryption and security features. While WPA3 strengthens security, it still requires a WAP in standard Wi-Fi networks and does not operate in a peer-to-peer fashion like an ad-hoc network.

Correct Answer

B. Trunk

Explanation

A trunk port is used to connect multiple VLANs on a Layer 2 switch. It allows traffic from all VLANs to pass through the same physical link by tagging each packet with the VLAN identifier. This enables the switch to differentiate between traffic from different VLANs over the same port, providing efficient and scalable network segmentation.

Why other options are wrong

A. Access

An access port is used to connect a device to a single VLAN. It only allows traffic from that specific VLAN and is not designed to carry traffic from multiple VLANs, so it does not fulfill the requirement described in the question.

C. Hybrid

Hybrid ports are used in some network setups to support both access and trunking functionality. However, the term "hybrid" is not commonly used in the context of Layer 2 switching compared to trunk ports, which are the standard for inter-VLAN communication.

D. Management

A management port is typically used for administrative access to network devices, such as switches or routers. It is not used for VLAN traffic and does not support the functionality of carrying traffic from multiple VLANs.

Correct Answer

A. The information/data is not tampered with, in transit from host to client.

Explanation

Data integrity ensures that data remains accurate, consistent, and unaltered during its transmission, storage, or processing. In the context of data transmission, it specifically focuses on preventing unauthorized modifications to the data during transit, ensuring that the data received by the recipient is the same as the data sent by the sender.

Why other options are wrong

B. The information/data is not read by parties other than its intended recipients.

This statement refers to data confidentiality, not integrity. Data confidentiality ensures that data is not read by unauthorized parties, whereas integrity ensures the data remains unaltered.

C. The information/data is never modified.

This is incorrect because data integrity allows for modification of data, but ensures that any modifications are legitimate and authorized. It doesn't imply that data can never be modified, only that it remains accurate and intact throughout its lifecycle.

D. The information/data is accessible only to users who are authenticated.

This statement pertains to data access control or confidentiality, ensuring that only authorized users can access the data. It does not specifically address data integrity, which focuses on the accuracy and unaltered state of data, not access control.

Correct Answer

C. Used to scan a network for network discovery and security auditing

Explanation

Nmap (Network Mapper) is a widely used tool for network discovery and security auditing. It helps security professionals map out a network by identifying active devices, open ports, services running on those ports, and vulnerabilities. Nmap is often employed to assess the security posture of a network by scanning for potential threats, detecting misconfigurations, and identifying vulnerable services.

Why other options are wrong

A. Analyzing network traffic patterns

Nmap is not primarily designed for analyzing network traffic patterns. Tools like Wireshark are used for traffic analysis, which captures and inspects data packets on a network, whereas Nmap is used for scanning networks to discover devices and vulnerabilities.

B. Conducting penetration tests on web applications

While Nmap can be used in a broader penetration testing scope, it is not specifically used for testing web applications. Web application penetration testing typically involves specialized tools like OWASP ZAP or Burp Suite, which are designed for analyzing and exploiting vulnerabilities in web applications.

D. Encrypting communication between networked devices

Nmap does not encrypt communication between devices. Its primary function is scanning networks for discovery and auditing, whereas encryption is handled by other protocols and technologies like SSL/TLS.