Questions MPLS and IPSec

QUESTION 1

The different Enterprise locations are connected via an MPLS network. Which device is responsible for attaching a VPN label to a packet traversing an MPLS network?

A. The customer (C) router

B. The provider (P) router

C. The customer edge (CE) router

D. The provider edge (PE) router

E. None of the above

Answer: D

QUESTION 2

Leading the way in IT testing and certification tools, www.Enterprise.com If enterprise Label Switch Router (LSR) is properly configured, which three combinations are possible? (Select three)

A. An IP destination exists in the IP forwarding table. A received labeled packet is dropped because the label is not found in the LFIB table.

B. A received labeled packet is forwarded based on the label. After the label is swapped, the newly labeled packet is sent.

C. There is an MPLS label-switched path toward the destination. A received IP packet is dropped because the destination is not found in the IP forwarding table.

D. A received IP packet is forwarded based on the IP destination address and the packet is sent as an IP packet.

E. A received labeled IP packet is forwarded based on both the label and the IP address.

F. A received IP packet is forwarded based on the IP destination address and the packet is sent as a labeled packet.

G. None of the above are possible

Answer: BDF

QUESTION 3

Enterprise uses frame-mode MPLS in a portion of its WAN. Which statement is true about the default operation of frame-mode MPLS?

A. LSRs must wait to get the next-hop label from their downstream neighbors before propagating information.

B. LSRs will only propagate label mappings to their neighbors by request.

C. Labels are sequentially generated for neighbors.

D. Interfaces can share the same labels.

E. None of the above

Answer: D

QUESTION 4

Enterprise uses a frame-mode MPLS WAN. Which three statements about frame-mode MPLS are true? (Select three)

Leading the way in IT testing and certification tools, www.Enterprise.com

A. The MPLS data plane takes care of forwarding based on either destination addresses or labels.

B. MPLS has three distinct components consisting of the data plane, the forwarding plane, and the control plane.

C. Whenever a router receives a packet that should be CEF-switched, but the destination is not in the FIB, the packet is dropped.

D. The CEF FIB table contains information about outgoing interfaces and their corresponding Layer 2 header.

E. The control plane is a simple label-based forwarding engine that is independent of the type of routing protocol or label

exchange protocol.

F. To exchange labels, the control plane requires protocols such as Tag Distribution Protocol (TDP) or MPLS Label Distribution Protocol (LDP).

G. None of the above

Answer: ACF

Section: (none)

QUESTION 5

You are responsible for managing and maintaining the Enterprise MPLS network.

What is the function of the MPLS data plane?

A. The data plane exchanges Layer 3 routing information using OSPF, EIGRP, IS-IS, and BGP protocols.

B. The data plane exchanges label using the label exchange protocols TDP, LDP, BGP, and RSVP.

C. The data plane uses the Forwarding Information Base (FIB) to forward packets based on the routing information.

D. The data plane uses Label Forwarding Information Base (LFIB) to forwards packets based on the labels.

Answer: D

Section: (none)

QUESTION 6

While troubleshooting a problem the Enterprise network administrator used a protocol analyzer to capture the contents of an MPLS

label. What are the four fields in an MPLS label? (Select four)

Leading the way in IT testing and certification tools, www.Enterprise.com

A. TTL

B. Version

C. Label

D. Bottom-of-stack indicator

E. Experimental

F. Protocol

Answer: ACDE

Section: (none)

QUESTION 7

Enterprise is an MPLS network provider connecting multiple customer networks. In an MPLS VPN implementation, how are overlapping customer prefixes propagated?

A. A route target is attached to each customer prefix.

B. Because customers have their own interfaces, distributed CEFs keep the forwarding tables separate.

C. Separate BGP sessions are established between each customer edge LSR.

D. A separate instance of the core IGP is used for each customer.

E. Because customers have their own unique LSPs, address space is kept separate.

F. None of the above.

Answer: A

Section: (none)

QUESTION 8

The Enterprise network administrator is trying to optimize the convergence time in their MPLS network. Which statement is true about convergence in an MPLS network?

A. MPLS convergence will take place at the same time as the routing protocol convergence.

B. MPLS convergence will take place after the routing protocol convergence.

C. MPLS must be reconfigured after the routing protocol convergence.

D. MPLS convergence will take place before the routing protocol convergence.

E. None of the above.

Answer: B

Section: (none)

QUESTION 9

Enterprise is an MPLS provider connecting multiple customer VPNs. Which three statements below are correct concerning

MPLS-based VPNs? (Select three)

A. A VPN client is required for client-initiated deployments.

B. An MPLS-based VPN is highly scalable because no site-to-site peering is required.

C. Scalability becomes challenging for a very large, fully meshed deployment.

D. Route Targets (RTs) are attributes attached to a VPNv4 BGP route to indicate its VPN membership.

E. A VPN client is not required for users to interact with the network.

F. Authentication is done using a digital certificate or pre-shared key.

Answer: BDE

Section: (none)

QUESTION 10

All Enterprise remote locations connected via a fully meshed MPLS WAN. Which three statements regarding MPLS are true? (Select

three)

A. Frame-mode MPLS inserts a 32-bit label between the Layer 3 and Layer 4 headers.

B. The control plane is responsible for forwarding packets.

C. The two major components of MPLS include the control plane and the data plane.

D. Cisco Express Forwarding (CEF) must be enabled as a prerequisite to running MPLS on a Cisco router.

E. MPLS is designed for use with frame-based Layer 2 encapsulation protocols such as Frame Relay but is not supported by ATM because of ATM fixed-length cells.

F. OSPF, EIGRP, IS-IS, RIP, and BGP can be used in the control plane.

Answer: CDF

Section: (none)

QUESTION 11

Many Enterprise remote offices use DSL for their connectivity. Which four features are usually required for an 827 ADSL router to support a home ADSL broadband Internet connection with multiple end-user PCs? (Choose four)

A. IPSec

B. Bridging (IRB or RBE)

C. PPPoE client

D. PAT

E. DHCP server

F. Static default route

Answer: CDEF

Section: (none)

QUESTION 12

You need to set up the Cisco VPN client software on a new Enterprise laptop. When configuring the Cisco VPN Client with transparent tunneling, what is true about the IPSec over TCP option?

Leading the way in IT testing and certification tools, www.Enterprise.com

A. The port number is negotiated automatically.

B. Clients will have access to the secured tunnel and local resources.

C. Packets are encapsulated using Protocol 50 (Encapsulating Security Payload, or ESP).

D. The port number must match the configuration on the secure gateway.

Answer: D

Section: (none)

QUESTION 13

Two Enterprise routers are configured as IPSec VPN peers. Which IPsec VPN term describes a policy contract that specifies how two peers will use IPsec security services to protect network traffic?

A. Encapsulation security payload

B. Security Association

C. Transform set

D. Authentication Header

E. None of the above

Answer: B

QUESTION 14

Enterprise uses GRE tunnels over an IPSec VPN. Which three statements are correct about a GRE over IPsec VPN tunnel configuration on Cisco IOS routers? (Select three)

A. Crypto maps must specify the use of IPsec transport mode.

B. A crypto ACL will dictate the GRE traffic to be encrypted between the two IPsec peers.

C. A crypto ACL will dictate the ISAKMP and IPsec traffic to be encrypted between the two IPsec peers.

D. A dynamic routing protocol can be configured to run over the tunnel interface.

E. The crypto map must be applied to the tunnel interface.

F. The crypto map must be applied to the physical interface.

Answer: BDF                                                       

Section: (none)

QUESTION 15

You have been tasked with configuring a new router to be added to te Enterprise IPSec VPN. What are the four main steps in configuring an IPsec site-to-site VPN tunnel on Cisco routers? (Choose four)

A. Create a crypto access list to define which traffic should be sent through the tunnel.

B. Create a crypto map and apply it to the outgoing interface of the VPN device.

C. Define the ISAKMP policy.

D. Define the pre-shared key used in the DH (Diffie-Hellman) exchange.

E. Define the IPsec transform set.

F. Configure dynamic routing over the IPsec tunnel interface.

Answer: ABCE

Section: (none)

QUESTION 16

Enterprise uses IPSec technology throughout their network. Which three benefits do IPsec VPNs provide? (Select three)

A. Data integrity

B. QoS

C. Confidentiality

D. Adaptive threat defense

E. Origin authentication

F. A fully-meshed topology with low overhead

Answer: ACE

QUESTION 17

The branch Enterprise locations are connected via an IPSec VPN. Which three IPsec VPN statements are true? (Select three)

A. The main mode is the method used for the IKE phase two security association negotiations.

B. To establish IKE SA, the main mode utilizes six packets while aggressive mode utilizes only three packets.

C. IKE keepalives are unidirectional and sent every ten seconds.

D. Quick mode is the method used for the IKE phase one security association negotiations.

E. IKE uses the Diffie-Hellman algorithm to generate symmetrical keys to be used by IPsec peers.

F. IPsec uses the Encapsulating Security Protocol (ESP) or the Authentication Header (AH) protocol for exchanging keys.

Answer: BCE

QUESTION 18

Leading the way in IT testing and certification tools, www.Enterprise.com Enterprise uses GRE tunnels over their IPSec VPN. Which three features are benefits of using GRE tunnels in conjunction with IPsec for building site-to-site VPNs? (Select three)

A. It supports multi-protocol (non-IP) traffic over the tunnel

B. It uses Virtual Tunnel Interface (VTI) to simplify the IPsec VPN configuration

C. It allows dynamic routing over the tunnel

D. It reduces IPsec headers overhead since tunnel mode is used

E. It simplifies the ACL used in the crypto map

Answer: ACE

QUESTION 19

Enterprise uses GRE tunnels to pass routing protocol traffic across its IPSec VPN. Which IPsec mode will encrypt a GRE tunnel to provide multiprotocol support and reduced overhead?

A. Transport

B. Tunnel

C. Multipoint GRE

D. 3DES

E. None of the above

Answer: A

QUESTION 20

Two Enterprise IPsec routers use DH to establish a VPN connection. Which feature is an accurate description of the Diffie-Hellman (DH) exchange between two IPsec peers?

A. It allows the two peers to communicate its digital certificate to each other during IKE phase 1

B. It allows the two peers to jointly establish a shared secret key over an insecure communications channel

C. It allows the two peers to negotiate its IPsec transforms during IKE phase 2

D. It allows the two peers to communicate the pre-shared secret key to each other during IKE phase 1

E. It allows the two peers to authenticate each other over an insecure communications channel

F. None of the above

Answer: B

Section: (none)

QUESTION 21

Enterprise uses GRE tunnels over their IPSec VPN to pass routing information. Which statement is true about an IPsec/GRE tunnel?

A. Crypto map ACL is not needed to match which traffic will be protected.

B. GRE encapsulation occurs before the IPsec encryption process.

C. The GRE tunnel source and destination addresses are specified within the IPsec transform set.

D. An IPsec/GRE tunnel must use IPsec tunnel mode.

E. None of the above.

Answer: B

Section: (none)

QUESTION 22

AN IPSec secure tunnel is being built between routers TK1 and TK2. In IPSec, what are the common services provided by

Authentication Header (AH) and Encapsulation Security Payload (ESP)?

A. Data origin authentication, confidentiality, and anti-replay service Leading the way in IT testing and certification tools,

www.Enterprise.com

B. Confidentiality, data integrity, and anti-replay service

C. Data integrity, data origin authentication, and anti-replay service

D. Confidentiality, data integrity, and data origin authentication

E. Confidentiality, data integrity and authorization.

Answer: C

Section: (none)

QUESTION 23

IPSec is being used for the Enterprise VPN. In the IPSec protocol; what are the responsibilities of the Internet Key Exchange (IKE)?

(Choose all that apply)

A. Negotiating protocol parameters

B. Integrity checking user hashes

C. Authenticating both sides of a connection

D. Implementing tunnel mode

E. Exchanging public keys

F. Packet encryption

Answer: ACE

Section: (none)

Explanation/Reference:

QUESTION 24

IPSec is being used for the Enterprise VPN. Which of the IPSEC protocols is capable of negotiating security associations?

Leading the way in IT testing and certification tools, www.Enterprise.com

A. AH

B. ESP

C. IKE

D. SSH

E. MD5

F. None of the above

Answer: C

Section: (none)

QUESTION 25

IPSec is being used for the Enterprise VPN. Which of the phrases below are true about IPSec IKE Phase 2? (Choose all that apply)

A. It determines the key distribution method

B. It identifies IPSec peer details

C. It selects manual or IKE-initiated SAs

D. It determines the authentication method

E. It negotiates ISAKMP policies for peers

Leading the way in IT testing and certification tools, www.Enterprise.com

F. It selects the IPSec algorithms and parameters for optimal security and performance

Answer: CEF

QUESTION 26

IPSec is being used for the Enterprise VPN. What is true about the security protocol ESP (Encapsualtion Security Payload) in IPSec?

(Choose three)

A. IP packet is expanded by transport mode: 37 bytes (3DES) or 63 bytes (AES); tunnel mode: 57bytes (3DES) or 83

bytes (AES).

B. IP packet is expanded by: transport mode 56 bytes: tunnel mode 128 bytes.

C. Authentication is mandatory and the whole packet as well as the header is authenticated.

D. Authentication is optional and the outer header is not authenticated.

E. The ESP security protocol provides data confidentiality.

F. The ESP security protocol provides no data confidentiality.

Answer: ACE

QUESTION 27

What is true about the security protocol AH (Authentication Header) used in a secure IPSec tunnel? (Choose three)

A. Authentication is mandatory.

B. Authentication is optional.

C. The IP packet is expanded by transport mode 37 bytes(3DES( or 63 bytes(AES); tunnel mode 57 bytes(3DES) or 83

bytes(AES).

D. The IP packet is expanded by transport mode 56 bytes; tunnel mode 128 bytes.

E. The IPSec AH security protocol does provide data confidentiality.

F. The IPSec AH security protocol does not provide data confidentiality.

Answer: ACF

Section:

QUESTION 28

Which of the following statements is true about IPSec security associations (SAs)?

A. SAs contain unidirectional specifications only.

B. SAs describe the mechanics if implementing a key exchange protocol.

C. A single SA ca be used for both AH and ESP encapsulation protocols.

D. A single SA is negotiated by peers requesting secure communication.

E. Active SAs are stored in a local database called the IPSec database.

Answer: A

Section: (none)

QUESTION 29

Leading the way in IT testing and certification tools, www.Enterprise.com You need to configure a GRE tunnel on a Enterprise IPSec

router. When you are using the SDM to configure a GRE tunnel over IPsec, which two parameters are required when defining the

tunnel interface information? (Select two)

A. The crypto ACL number

B. The IPSEC mode (tunnel or transport)

C. The GRE tunnel interface IP address

D. The GRE tunnel source interface or IP address, and tunnel destination IP address

E. The MTU size of the GRE tunnel interface

Answer: CD

Section:

QUESTION 30

You want to use dynamic routing protocols over the Enterprise IPSec WAN using GRE tunnels. Which three routing protocols can be

configured when configuring a site-to-site GRE over IPsec tunnel using SDM? (Select three)

A. IGRP

Leading the way in IT testing and certification tools, www.Enterprise.com

B. EIGRP

C. BGP

D. OSPF

E. RIP

F. IS-IS

Answer: BDE

Section: (none)

QUESTION 31

A new Enterprise router must be added to the IPSec VPN. When configuring a site-to-site IPsec VPN tunnel on this router, which configuration must be the exact reverse of the other IPsec peer?

A. The crypto map

B. The crypto ACL

C. The IPsec transform

D. The pre-shared key

E. The ISAKMP policy

F. None of the above

Answer: B

Section: (none)

QUESTION 32

Two Enterprise locations are trying to connect to each other over a VPN, but the connection is failing. Which common problem causes an IPSEC VPN to fail?

A. ACLs configured in the IPSEC traffic path blocking ISAKMP, ESP, and AH traffic.

B. Multiple transform sets configured but only one transform set is specified in the crypto map entry.

C. Crypto ACL configuration errors where permit is used to specify that matching packets must be encrypted.

D. Multiple interfaces sharing the same crypto map set.

E. None of the above

Answer: A

Section: (none)

QUESTION 33

An IPSec tunnel has just been created on the Enterprise network, and you wish to verify it. Which command will display the

configured IKE policies?

A. show crypto isakmp policy

B. show crypto ipsec

C. show crypto isakmp

D. show crypto map

E. None of the above

Answer: A

Section: (

QUESTION 34

EIGRP is being used in the Enterprise IPSev VPN. When configuring an IPsec VPN to backup a WAN connection, what can be configured to influence the EIGRP routing process to select the primary WAN link over the backup IPsec tunnel?

A. Configure the EIGRP variance to 2.

B. Configure a longer delay value on the tunnel interface.

C. Configure the EIGRP variance to 1.

D. Configure a longer EIGRP hello interval on the tunnel interface.

E. Configure a lower clock rate value on the tunnel interface.

F. Configure a higher bandwidth value on the tunnel interface.

G. None of the above

Answer: B

QUESTION 35

In order to increase the uptime of the network, you have been tasked with designing and configuring a fault tolerant IPSec WAN.

What can be configured to provide resiliency when using SDM to configure a site-to-site GRE over IPsec VPN tunnel?

A. A backup GRE over IPsec tunnel

B. Redundant dynamic crypto maps

C. HSRP

D. Load balancing using two GRE over IPsec tunnels

E. Stateful IPsec failover

Leading the way in IT testing and certification tools, www.Enterprise.com

Answer: A

Section: (

QUESTION 36

You need to increase the network availability of the Enterprise IPSec WAN. Which high availability option uses the concept of a

virtual IP address to ensure that the default IP gateway for an IPsec site-to-site tunnel is always reachable?

A. Reverse Route Injection (RRI)

B. Dynamic Crypto Map

C. Backup IPsec peer

D. HSRP

E. GRE over IPsec

F. None of the above

Answer: D

Section: (none)

QUESTION 37

You have been assigned the task of setting up Easy VPN connection in the Enterprise network. During the Easy VPN Remote connection process, which phase involves pushing the IP address, Domain Name System (DNS), and split tunnel attributes to the

client?

A. The VPN client establishment of an ISAKMP SA

B. Mode configuration

C. VPN client initiation of the IKE phase 1 process

D. IPsec quick mode completion of the connection

E. None of the above

Answer: B

Section: (

QUESTION 38

You need to configure Easy VPN on a new Enterprise router using the SDM. Which two statements are true about the use of SDM to

configure the Cisco Easy VPN feature on a router? (Select two)

Leading the way in IT testing and certification tools, www.Enterprise.com

A. The Easy VPN server address must be configured when configuring the SDM Easy VPN Server wizard.

B. An Easy VPN connection is a connection that is configured between two Easy VPN clients.

C. The SDM Easy VPN Server wizard displays a summary of the configuration before applying the VPN configuration.

D. The SDM Easy VPN Server wizard recommends using the Quick setup feature when configuring a dynamic multipoint

VPN.

E. The SDM Easy VPN Server wizard can be used to configure user XAuth authentication locally on the router or

externally with a RADIUS server.

F. The SDM Easy VPN Server wizard can be used to configure a GRE over IPSec site-to-site VPN or a dynamic

multipoint VPN (DMVPN).

Answer: CE

Section: (none)

QUESTION 39

The Enterprise security administrator is concerned about reconnaissance attacks. Which two protocols can be used to prevent a reconnaissance attack? (Select two)

A. IPsec

B. NTP

C. SNMP

D. SSH

E. Telnet

F. FTP

Answer: AD

Section: (none)

QUESTION 40

The Enterprise security administrator wants to increase the security of all the routers within the network. Which three techniques

should be used to secure management protocols in Cisco routers? (Select three)

A. Synchronize the NTP master clock with an Internet atomic clock.

B. Configure SNMP with only read-only community strings.

C. Implement RFC 2827 filtering at the perimeter router when allowing syslog access from devices on the outside of a

firewall.

D. Encrypt TFTP and Syslog traffic in an IPSec tunnel.

E. Use SNMP version 2.

F. Use TFTP version 3 or above because these versions support a cryptographic authentication mechanism between

peers.

Answer: BCD

QUESTION 41

Based on the information provided above, which peer authentication method and which IPSEC mode is used to connect to the branch locations? (Select two)

A. Digital Certificate

B. GRE/IPSEC Transport Mode

C. Transport Mode

D. GRE/IPSEC Tunnel Mode

E. Tunnel Mode

F. Pre-Shared Key

Answer: EF

Section: (none)

QUESTION 42

Based on the information provided above, which IPSec rule is used for the enterprise branch and what does it define? (Select two)

A. IP traffic sourced from 10.10.10.0/24 destined to 10.8.28.0/24 will use the VPN.

B. 127

C. IP traffic sourced from 10.10.10.0/24 destined to 10.5.15.0/24 will use the VPN.

D. IP traffic sourced from 10.10.10.0/24 destined to 10.5.33.0/24 will use the VPN.

E. 102

F. 116

Answer: AF

Section: (none)

Key Encrypting Key

Proteja as chaves usadas para proteger os dados do titular do cartão contra a divulgação e uso indevido

Um fortificado controle de acesso, auditoria e registro de suas chaves. As chaves devem ser armazenadas em um local que seja seguro e "ausente" dos dados criptografados. Isso significa que os dados principais não devem ser armazenados em servidores web, servidores de banco de dados, etc.

O acesso às chaves deve ser restrito à menor quantidade possível de usuários. Este grupo de usuários será, idealmente, usuários que são altamente confiáveis ​​e treinados para desempenhar os deveres do Custodiante. Obviamente, haverá um requisito para que as contas do sistema / serviço acessem os dados-chave para executar criptografia / descriptografia de dados.

As próprias chaves não devem ser armazenadas na versão em pleno texto, mas criptografadas com um KEK (Key Encrypting Key). O KEK não deve ser armazenado no mesmo local que as chaves de criptografia que está criptografando.

Totalmente documentar e implementar todos os processos e procedimentos de gerenciamento de chaves para chaves criptográficas usadas para criptografia de dados do titular do cartão

Crypto questions

R1. Describe four types of secrecy practiced by enterprises.

Company’s secrecy falls into four categories those are obligations, trade secrets, managing publicity and secrecy culture. The obligation is when a company has the legal or contractual obligations to keep certain types of information a secret like health care records, or any information that might affect the company’s stock. A trade secret is when a company keeps the certain information a secret that might give their competitors a commercial advantage. Like items that might be getting a patent or some items that cannot get a patent. Managing publicity speaks for itself withholding information from the public. Secrecy culture is when some companies have a tradition of keeping their internal activities a secret, even without compelling the business or legal reasons to do so.

R2. Describe two techniques to help decrease the insider threat.

Monitoring people is a way to get them to behave especially if they think someone is always watching them. Cashiers in retail stores know this all too well, they know that someone is always watching that drawer of cash every time it opens and if you’re missing a certain amount of money at the end of the day you will be watched carefully until they find where the money went. Job rotation this is when you switch job titles and duties on a regular basis so that you can’t find glitches and expose them in large quantities or at all in time.

R3. Which headers are left in plaintext when we use link encryption? Network encryption? Application encryption? 

 A network encryption because it is the only way you can route a packet through protocol stacks is if the appropriate packet headers remain in plaintext.

R4. Explain how key wrapping works on a network. Compare network-based key wrapping with file-based key wrapping.

Key wrapping uses a KEK to encrypt the key you would distribute. When you encrypt the contents of a certain file you would encrypt it with a content encrypting key ”CEK”. Then you wrap the CEK with a key that is encrypting key to share it. When you want to encrypt the network traffic, you might choose to use something a bit different like encrypting network traffic with a traffic encrypting key and then you wrap the TEK with a key encrypting key to share it.

R1. Describe four types of secrecy practiced by enterprises.

Company secrecy falls roughly into four categories:

1.        Obligations. Companies may have legal or contractual obligations to keep certain types of information secret. Legal obligations address employee privacy, health records privacy, and information that could affect a public company’s stock price. Contractual obligations may include trade secrets shared with others, licensed software management, and rules for handling credit card transactions.

2.        Trade secrets. Companies keep information secret that would give competitors a commercial advantage. These include inventions and processes that may be subject to patent or unpatentable techniques that would benefit competitors. Other trade secrets include business details that might help competitors anticipate price decisions or identify customers that a competitor might try to lure away.

3.        Managing publicity. As noted previously, companies may keep things secret that might not yield positive publicity.

4.        Secrecy culture. Some companies have a tradition of keeping their internal activities secret, even without compelling business or legal reasons to do so.

 (Smith 569-570)

R2. Describe two techniques to help reduce the insider threat.

There are three strategies for reducing the risks of insider threats:

1. Monitoring. People are more likely to behave if they think they are being watched. Monitoring may double-check periodic results, like the cash held by cashiers, or may scan for unauthorized activity, like access to nonbusiness websites during business hours.

2. Two-person or multiperson control. Most employee misbehavior is by individuals, not conspiracies. Companies can greatly reduce the risk by involving two or more people in important transactions. This may be procedural, as with checks for accounts payable, in which one person makes the list of checks, another print the checks, and third signs them. This also may be implemented with automated systems, as with nuclear missile launching or automated workflow systems.

This “Two person concept” is also used to work on nuclear weapons it also called the “no lone zone”.

R3. Which headers are left in plaintext when we use link encryption? Network encryption? Application encryption?

The only way we can route a packet through protocol stacks is if the appropriate packet headers remain in plaintext. (Smith 623)

Lower application layer encryption with SSL. The security boundary includes the user’s computer, the server’s computer, and the application processes that handle plaintext, encryption, or decryption. (Smith 666)

With 802.11 link encryption, the Link Header and WPA2 Header are left in plaintext.

In network encryption with IPsec protection the Link Header, IP Header, and IPsec Header are left in plaintext.

Application encryption has the Link Header, IP Header, TCP/UDP Header, Application Header and Crypto Header all in plaintext.

R4. Explain how key wrapping works on a network. Compare network-based key wrapping with file-based key wrapping.

Key wrapping uses a KEK to encrypt the key we distribute. When encrypting the contents of a file, we encrypt it with a content encrypting key (CEK). We then wrap the CEK with a key encrypting key (KEK) when sharing it. When encrypting network traffic, we use slightly different terms; we encrypt network traffic with a traffic encrypting key (TEK). We then wrap the TEK with a KEK when sharing it. 

O que é um nonce?

Comunicação típica entre cliente-servidor durante um processo de autenticação, ou seja, um nonce é um número arbitrário que só pode ser usado uma vez.

Muitas vezes é um número aleatório ou pseudo-aleatório emitido em um protocolo de autenticação para garantir que as comunicações antigas/repetitivas não possam ser reutilizadas em ataques de repetição.

Eles também podem ser úteis como vetores de inicialização (IV) e em funções de hash criptográficas.

Transport Layer Security: SSL / TLS

• Secure Sockets Layer (SSL)
- Desenvolvido pela Netscape em 1994
- Parte do pacote comercial cliente / servidor
- Primeiro aplicativo de chave pública bem sucedido
• Herdado pelo IETF
- Agora chamado Transport Layer Security (TLS)
• Protocolo de três partes
- Handshake - troca de chaves
- Gravação - troca de dados
- Alerta - erros e encerramento da sessão

The Illusion of Net Neutrality - Bob Zelnick and Eva Zelnick

abertos no firewall

Durante um teste de penetração da Internet, Jane, o administrador do sistema, conseguiu estabelecer uma conexão com um roteador interno, mas não logar com sucesso. Quais portas e protocolos são mais prováveis ​​de serem abertos no firewall? (Selecionar 4).

 21
 22
 23
 69
 3389
SSH
Rlogin
Rsync
Telnet

A pergunta afirma que Jane conseguiu estabelecer uma conexão com um roteador interno. Portas típicas e protocolos usados ​​para conectar a um roteador incluem: Porta 22 que é usada por SSH (Secure Shell). Porto 23, que é usado pela Telnet. O SSH e o Telnet fornecem interfaces de linha de comando para administrar dispositivos de rede, como roteadores e switches.

Respostas Incorretas:
A porta 21 é usada por FTP (File Transfer Protocol). Ele é usado para baixar e fazer o upload de arquivos através de uma rede usando uma conexão TCP. Não é usado para conexão a dispositivos de rede, como roteadores ou switches.
O Port 69 é usado pelo TFTP (Trivial File Transfer Protocol). Ele é usado para baixar e fazer o upload de arquivos através de uma rede usando uma conexão UDP. Não é usado para conexão a dispositivos de rede, como roteadores ou switches.
O Port 3389 é usado pelo Remote Desktop Protocol (RDP). RDP é usado para conectar-se a computadores Windows. Não é usado para conectar-se a dispositivos de rede, como roteadores ou
comuta.
Os Serviços de Terminal são um nome anterior para Serviços de Área de Trabalho Remota. Os Serviços de Terminal usam Remote Desktop Protocol (RDP) na porta 3389. Não é usado para conectar-se à rede
dispositivos como roteadores ou switches.
O Rlogin (Login Remoto) usa a porta 513 e é usado para conectar-se a computadores Linux ou Unix. Não é usado para conexão a dispositivos de rede, como roteadores ou switches.
RSync é um protocolo de sincronização de arquivos que usa a porta 873. Ele é usado para sincronizar arquivos entre computadores Linux ou Unix. Não é usado para conexão a dispositivos de rede, como roteadores ou switches.

funcionalidade sniffer?

Qual dos seguintes elementos de arquitetura de segurança também possui funcionalidade sniffer? (Selecione dois).

HSM
IPS
Acelerador de SSL
WAP
IDS


A funcionalidade Sniffer significa a capacidade de capturar e analisar o conteúdo dos pacotes de dados à medida que são transmitidos pela rede. Os sistemas IDS e IPS executam suas funções capturando e analisando o conteúdo dos pacotes de dados.
Um sistema de detecção de intrusão (IDS) é um dispositivo ou aplicativo de software que monitora atividades de rede ou sistema para atividades maliciosas ou violações de políticas e produz relatórios para uma estação de gerenciamento. IDS vem em varios tipos e aborda o objetivo de detectar o tráfego suspeito de diferentes maneiras. 

Existem sistemas de detecção de intrusão baseados em rede (NIDS) e host (HIDS). Alguns sistemas podem tentar parar uma tentativa de intrusão, mas isso não é exigido nem esperado de um sistema de monitoramento.

Os sistemas de detecção e prevenção de intrusão (IDPS) são focados principalmente na identificação de possíveis incidentes, informações de registro e tentativas de relatórios. Além disso, as organizações usam IDPSes para outros fins, como identificar problemas com políticas de segurança, documentar ameaças existentes e impedir que pessoas violem políticas de segurança. Os IDPSs tornaram-se um complemento necessário para a infra-estrutura de segurança de quase todas as organizações. Os IDPSs geralmente gravam informações relacionadas aos eventos observados, notificam os administradores de segurança de eventos observados importantes e produzem relatórios. Muitos IDPSs também podem responder a uma ameaça detectada, tentando impedir que ela seja bem sucedida. Eles usam várias técnicas de resposta, que envolvem o IDPS interrompendo o próprio ataque, alterando o ambiente de segurança (por exemplo, reconfigurando um firewall) ou alterando o conteúdo do ataque.

Respostas Incorretas:
Um módulo de segurança de hardware (HSM) é um dispositivo de computação física que protege e gerencia chaves digitais para autenticação forte e fornece processamento de criptografia. Esses módulos tradicionalmente vêm na forma de um cartão plug-in ou um dispositivo externo que se anexa diretamente a um computador ou servidor de rede. Um HSM não possui funcionalidade de sniffer.
SSL é um método que ativa os algoritmos de criptografia de chave pública envolvidos em transações SSL para um acelerador de hardware. Um acelerador SSL não possui funcionalidade de sniffer.
Um WAP (Wireless Access Point) é um dispositivo usado para criar uma rede sem fio. Um WAP recebe e transmite pacotes de dados através de uma conexão de rede sem fio. No entanto, um WAP não possui funcionalidade sniffer.

802.1X e Filtragem de MAC address

Um novo servidor virtual foi criado para o departamento de marketing. O servidor foi instalado em um host. Os usuários no departamento de marketing informam que não conseguem se conectar ao servidor. Os técnicos verificam se o servidor possui um endereço IP na mesma VLAN que os usuários do departamento de marketing e os usuários estão presentes na VLAN. Qual das seguintes razões é o principal motivo pelo qual os usuários não conseguem se conectar ao servidor?

O endereço MAC do novo servidor virtual não foi adicionado à ACL no switch

O endereço MAC do novo servidor virtual desencadeou uma violação de segurança da porta no switch

 O endereço MAC do novo servidor virtual desencadeou uma negação implícita no switch

 O endereço MAC do novo servidor virtual não foi adicionado às regras de firewall no switch

Configurar a opção para permitir que somente o tráfego de computadores com base em seu endereço físico é chamado filtragem de MAC. O endereço físico é conhecido como o endereço MAC. Cada adaptador de rede possui um endereço MAC exclusivo codificado no adaptador.

Você pode configurar as portas de uma opção para permitir conexões de computadores com endereços MAC específicos e bloquear todos os outros endereços MAC.

Em redes de computadores, a filtragem de MAC (ou filtragem de GUI ou filtragem de endereços de camada 2) refere-se a um método de controle de acesso de segurança pelo qual o endereço de 48 bits atribuído a cada placa de rede é usado para determinar o acesso à rede.

Os endereços MAC são atribuídos de forma exclusiva a cada cartão, de modo que o uso de filtragem de MAC em uma rede permite e nega o acesso à rede em dispositivos específicos através do uso de listas negras e listas brancas. Embora a restrição do acesso à rede através do uso de listas seja direta, uma pessoa individual não é identificada por um endereço MAC, sim apenas um dispositivo, de modo que uma pessoa autorizada precisará ter uma entrada na lista branca para cada dispositivo que ele ou ela usaria para acessar a rede.

Respostas Incorretas:

O endereço MAC do novo servidor virtual de ser adicionado e se o endereço MAC não foi adicionado ao ACL no switch, ocorre a interrupção. No entanto, a violação da segurança da porta não é a verdadeira causa de os usuários serem incapazes de se conectar ao servidor. O endereço MAC que não está sendo adicionado à ACL no switch é o que impedirá os usuários conectados ao servidor. Portanto, esta resposta está incorreta.

O endereço MAC do novo servidor virtual que desencadeia uma negação implícita no switch aconteceria se o endereço MAC preenchesse uma condição que causasse a negação. Isso é improvável. O endereço MAC não foi adicionado à ACL no switch para permitir o acesso se for mais provável. Portanto, esta resposta está incorreta.

 Os switches de rede dedicados não tendem a ter firewalls. Um roteador sem fio doméstico típico pode funcionar como um switch e um firewall. No entanto, mesmo neste caso, o firewall normalmente não impedirá as comunicações entre os dispositivos conectados ao switch. Esta resposta é muito improvável e, portanto, incorreta.

--

Qual dos seguintes controles permitiria que uma empresa reduza a exposição de sistemas sensíveis a dispositivos não gerenciados em redes internas?

802.1x

Criptografia de dados

Senha fortificada

BGP

IEEE 802.1X (também conhecido como Dot1x) é um padrão IEEE para controle de acesso à rede baseado em porta (PNAC). Faz parte do grupo de protocolos de rede IEEE 802.1. Fornece um mecanismo de autenticação aos dispositivos que desejam anexar a uma LAN ou WLAN.

A autenticação 802.1X envolve três partes: um suplicante, um autenticador e um servidor de autenticação. O suplicante é um dispositivo cliente (como um laptop) que deseja anexar à LAN / WLAN - embora o termo "suplicante" também seja usado indistintamente para se referir ao software que está sendo executado no cliente que fornece credenciais ao autenticador. O autenticador é um dispositivo de rede, como um switch Ethernet ou ponto de acesso sem fio; e o servidor de autenticação normalmente é um host executando o software que suporta os protocolos RADIUS e EAP.

O autenticador age como um guarda de segurança para uma rede protegida. O suplicante (ou seja, o dispositivo cliente) não tem acesso permitido pelo autenticador ao lado protegido da rede até que a identidade do suplicante tenha sido validada e autorizada. Uma analogia com isso é fornecer um visto válido na chegada da chegada do aeroporto antes de poder entrar no país. Com a autenticação baseada em porta 802.1X, o suplicante fornece credenciais, como nome de usuário / senha ou certificado digital, ao autenticador, e o autenticador encaminha as credenciais para o servidor de autenticação para verificação. Se o servidor de autenticação determina que as credenciais são válidas, o suplicante (dispositivo cliente) pode acessar recursos localizados no lado protegido da rede.

Respostas Incorretas:

 A criptografia de dados criptografa os dados, seja em trânsito em uma rede ou armazenada em um disco rígido ou outro armazenamento. Não é usado para impedir o acesso a switches de rede ou outros dispositivos de rede.

Senha fortificada  determina o comprimento ou a complexidade de uma senha. Não é usado para impedir o acesso a switches de rede ou outros dispositivos de rede.

BGP (Border Gateway Protocol) é um protocolo de roteamento. Não é usado para impedir o acesso a switches de rede ou outros dispositivos de rede.