Domain 2 Quiz

Decide where things go.

WAF on web server.

DLP on firewall. In a later quiz I say DLP goes either at a perimeter firewall or on endpoints, or workstations. But we have just two. Putting DLP on just one or two workstations is wrong. The idea is really "On what type of place does this go?", it's all or none. I don't have two workstations, or two border firewalls, so I picked firewall and file server on the exam, and I think it was graded as correct.

DLP on file server.

3 802.1x on 3 switches.

ACL on router.

Rules on firewall.

RADIUS on spare server.
The content management group is considering the use of DNS Round Robin technology. What benefit could this provide?
1. Load balancing
2. Transparent proxying
3. Anti-spoofing
4. Certificate sharing
The DNS server returns a list of IP addresses, rotating the last one to the head of the list at each additional response. The clients will distribute their activity across the multiple servers, which hold identical data sets, in roughly equal amounts.

As a practical example, at one time www.jpl.nasa.gov resolved to a list of IP addresses, one server at each major NASA facility in the US. The list you got was in an arbitrary order, and your browser used the first on in the list. It worked, you saw the images from the current mission, and all NASA web servers had roughly equal loads.
Gina has been asked by her manager to set up wireless connectivity for the new software development team. They will be working in a small remote facility. What would be the best choice? Pick two.
1. Fat
2. Thin
3. Controller-based
4. Standalone
A fat or standalone controller (two terms for the same thing) has enough capability to do every needed on its own. There is no central server managing it, as there is with thin or controller-based systems. One fat/standalone controller is the simplest, thus best, solution for that setting.

Users are reporting that they can't access the financial department's secure web page. The following command output is observed. What is wrong?

$ netstat -an
Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address          Foreign Address        (state)
tcp4       0      0 10.138.0.3:22          184.16.205.240:50966   ESTABLISHED
tcp4       0      0 127.0.0.1:9000         127.0.0.1:37632        TIME_WAIT
tcp4       0      0 127.0.0.1:11628        127.0.0.1:9000         TIME_WAIT
tcp4       0      0 127.0.0.1:12042        127.0.0.1:9000         TIME_WAIT
tcp4       0      0 10.138.0.3:80          130.15.4.209:46944     TIME_WAIT
tcp4       0      0 10.138.0.3:80          46.229.168.70:15234    TIME_WAIT
tcp4       0      0 10.138.0.3:80          173.187.65.22:50598    ESTABLISHED
tcp4       0      0 10.138.0.3:80          212.3.84.1:55989       ESTABLISHED
tcp4       0      0 10.138.0.3:80          212.3.84.1:55987       ESTABLISHED
tcp4       0      0 10.138.0.3:80          212.3.84.1:55988       TIME_WAIT
tcp4       0      0 10.138.0.3:80          212.3.84.1:55986       TIME_WAIT
tcp4       0      0 *:80                   *.*                    LISTEN
tcp4       0      0 127.0.0.1:9000         *.*                    LISTEN
tcp4       0      0 *:22                   *.*                    LISTEN
tcp4       0      0 127.0.0.1:25           *.*                    LISTEN
udp4       0      0 127.0.0.1:123          *.*                    
udp4       0      0 10.138.0.3:123         *.*                    
udp4       0      0 *:123                  *.*                    
udp4       0      0 *:514                  *.*

The web server is down
The server is up but its web service isn't running
The certificate is expired
The certificate has been revoked
HTTPS isn't enabled
A firewall is blocking connections

Read the output. There are multiple TCP services, all with either 127.0.0.1 (localhost), or 10.138.0.3 (apparently the Ethernet interface address), or "*" (meaning "on all interfaces") in the "Local Address" column, and some of those are less than 1024 (22, 80, 25, 123, 514). The "Foreign Address" column has a variety of IP addresses at high-number ports. So, this command ran on the server. Now look at the listening TCP services: just 22 (SSH), 25 (SMTP), 80 (HTTP), and whaever that it on TCP/9000. So the server OS is running, and it is running HTTP, but it is not running HTTPS. One small omission in the web server configuration file.

This is real output, copy and paste from a connection to my web server, but with listening HTTPS removed and all instances of TCP/443 changed to TCP/80. My server is at Google, in a 10.38.0.0/24 VLAN.

You observe this data.

11:43:57.293662 IP 192.168.1.1 > 192.168.1.7: ICMP echo request, id 5331, seq 1, length 64
11:43:57.294143 IP 192.168.1.7 > 192.168.1.1: ICMP echo reply, id 5331, seq 1, length 64
11:43:58.294308 IP 192.168.1.1 > 192.168.1.7: ICMP echo request, id 5331, seq 2, length 64
11:43:58.294730 IP 192.168.1.7 > 192.168.1.1: ICMP echo reply, id 5331, seq 2, length 64
11:43:59.322328 IP 192.168.1.1 > 192.168.1.7: ICMP echo request, id 5331, seq 3, length 64
11:43:59.322645 IP 192.168.1.7 > 192.168.1.1: ICMP echo reply, id 5331, seq 3, length 6

Which tool or defensive measure was involved? Select two.

Wireshark
ping
nmap
tcpdump
netstat
arp
ifconfig

That's the output from tcpdump, which you could also get by saving Wireshark output to a text file (or running the text-output version, tshark). Yes, a ping command was running to generate this traffic, but its output is different.

You observe this data.

www.google.com (172.217.6.4) 56(84) bytes of data.
64 bytes from ord38s01-in-f4.1e100.net (172.217.6.4): icmp_seq=1 ttl=116 time=26.9 ms
64 bytes from ord38s01-in-f4.1e100.net (172.217.6.4): icmp_seq=2 ttl=116 time=28.2 ms
64 bytes from ord38s01-in-f4.1e100.net (172.217.6.4): icmp_seq=3 ttl=116 time=27.2 ms
64 bytes from ord38s01-in-f4.1e100.net (172.217.6.4): icmp_seq=4 ttl=116 time=27.2 ms
64 bytes from ord38s01-in-f4.1e100.net (172.217.6.4): icmp_seq=5 ttl=116 time=28.5 ms

--- www.google.com statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4005ms
rtt min/avg/max/mdev = 26.976/27.673/28.568/0.621 ms