IKM Network Engineering and Security 2 — Questions and Answers
Question 1: What is the primary purpose of a firewall?
- Speed up traffic
- Monitor and control traffic based on security rules (Correct answer)
- Compress data packets
- Assign IP addresses
Correct answer: Monitor and control traffic based on security rules
A firewall examines traffic against security rules and permits or blocks accordingly.
Types: packet filters (Layer 3-4), stateful (track connections), application (Layer 7), next-generation (combine all with IPS). Rules processed top-to-bottom with default deny.
Question 2: What is a man-in-the-middle attack?
- Brute force password attack
- Attacker intercepts and potentially alters communications between two parties (Correct answer)
- Denial-of-service attack
- Social engineering call
Correct answer: Attacker intercepts and potentially alters communications between two parties
In MITM, the attacker positions between two parties, intercepting and possibly modifying data.
Methods include ARP spoofing, DNS spoofing, SSL stripping, and rogue Wi-Fi. Prevention includes TLS with certificate pinning, HSTS, and mutual authentication.
Question 3: Which wireless encryption standard is currently recommended?
- WEP
- WPA
- WPA2-AES
- WPA3 (Correct answer)
Correct answer: WPA3
WPA3 provides stronger encryption and protection against brute-force attacks.
WPA3 uses SAE replacing WPA2's 4-way handshake, providing forward secrecy. WEP is broken, WPA was temporary. WPA3 addresses KRACK and other WPA2 vulnerabilities.
Question 4: What is the purpose of an IDS?
- Block all traffic
- Monitor traffic for suspicious activity and generate alerts (Correct answer)
- Encrypt data in transit
- Manage passwords
Correct answer: Monitor traffic for suspicious activity and generate alerts
IDS monitors for malicious behavior and generates alerts but does not actively block.
NIDS monitors network traffic; HIDS monitors system files. Detection methods: signature-based, anomaly-based, heuristic. IDS is passive; IPS is active (blocks).
Question 5: What is network segmentation?
- Dividing a network to contain breaches and reduce attack surface (Correct answer)
- Combining networks for efficiency
- Compressing traffic
- Rotating encryption keys
Correct answer: Dividing a network to contain breaches and reduce attack surface
Segmentation divides a network into isolated segments to limit lateral movement during breaches.
Uses VLANs, subnets, and firewalls. Common segments: DMZ, management, guest, PCI zone. Microsegmentation uses SDN for individual workload isolation.
Question 6: What is the function of a VPN?
- Increase internet speed
- Create an encrypted tunnel over public networks (Correct answer)
- Block malware
- Manage DNS records
Correct answer: Create an encrypted tunnel over public networks
A VPN creates an encrypted tunnel ensuring data confidentiality and integrity.
Protocols include IPsec, OpenVPN, WireGuard. Site-to-site connects networks; remote access connects users. Split vs full tunneling determines which traffic goes through the VPN.
IKM Network Engineering and Security 2
What is the primary purpose of a firewall?