NETWORK-AND-SECURITY-FOUNDATION Practice Questions

A broadband router is a networking device designed for home and small office (SOHO) environments. Its primary function is to share a single broadband internet connection among multiple computers. It integrates the capabilities of a router (to connect to the internet), a network switch (to connect local computers together via Ethernet cables), and often a wireless access point. This single device fulfills both requirements of connecting computers to each other on a local network and connecting that entire network to the internet.

A. Inter-provider border router: This router is used by Internet Service Providers (ISPs) to connect their network to other ISP networks, not for end-user local networking.

B. Subscriber edge router: This is typically the router on the ISP's side of the network that connects directly to the customer's premises equipment.

D. Core router: This is a high-capacity router that operates within the backbone of a large network, forwarding traffic between major network segments, not connecting end-user devices.

1. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 1

Section 1.3

the text describes the typical home network architecture where a "home router" (a common broadband router) connects internal devices to each other and to the ISP's modem for internet access.

2. Cisco. (n.d.). What Is a Router?. Cisco.com. This official vendor documentation distinguishes between different router types

describing small business or home routers (i.e.

broadband routers) as devices that connect multiple devices to the internet

contrasting them with high-performance service provider core and edge routers.

3. Comer

D. E. (2015). Computer Networks and Internets (6th ed.). Pearson. Chapter 19

"Internet Routing

" discusses the hierarchy of routers. It implicitly differentiates between the large

powerful routers forming the internet's core and the small routers used at the edge to connect a site or home to an ISP. The device in the question is an edge device

specifically a broadband router.

The User Datagram Protocol (UDP) operates at the Transport layer of the TCP/IP model. This layer is responsible for providing end-to-end communication services for applications. UDP offers a connectionless, unreliable datagram service, which is suitable for applications where speed is prioritized over reliability, such as video streaming or online gaming. It functions directly on top of the Internet Protocol (IP) to transmit datagrams between hosts. The Transport layer encapsulates application data into segments (for TCP) or datagrams (for UDP) and passes them down to the Internet layer for routing.

A. Application: The Application layer contains protocols that applications use to communicate (e.g., HTTP, DNS), but it relies on the Transport layer for data delivery.

B. Network or internet: The Network or Internet layer is responsible for logical addressing and routing using protocols like the Internet Protocol (IP), not for end-to-end data transport.

C. Physical or network access: This layer deals with the physical transmission of data over the network medium and hardware addressing (MAC addresses), not transport-level protocols like UDP.

1. Braden

R. (Ed.). (1989). Requirements for Internet Hosts -- Communication Layers. RFC 1122. Internet Engineering Task Force (IETF). Section 4

"TRANSPORT LAYER -- TCP and UDP

" explicitly defines both TCP and UDP as the primary protocols of the Transport Layer.

2. Postel

J. (1980). User Datagram Protocol. RFC 768. Internet Engineering Task Force (IETF). The document abstract describes UDP as a "datagram mode of packet-switched computer communication in the environment of an interconnected set of computer networks

" placing it as a transport mechanism above the Internet Protocol.

3. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. Chapter 3

"Transport Layer

" Section 3.3

"Connectionless Transport: UDP

" details the function and placement of UDP within the Transport layer of the network stack.

Disabling the Extended Service Set Identifier (ESSID) broadcast is a Wi-Fi hardening technique known as network cloaking. This action prevents the access point from openly advertising the network's name, making it invisible to casual observers scanning for available Wi-Fi networks. While determined attackers can still discover the network using specialized tools, this measure hardens the network by reducing its visibility and protecting it from unsophisticated, opportunistic attacks. It is a layer in a defense-in-depth security strategy.

A. Trust local hosts by default: This practice violates the principle of least privilege and the zero-trust security model. It inherently weakens security by assuming internal devices are not a threat.

C. Add more access points: This action expands network coverage and capacity but does not inherently improve security. In fact, it can increase the attack surface if not configured securely.

D. Implement wired equivalent privacy (WEP): WEP is a deprecated and highly insecure encryption protocol with well-known vulnerabilities that can be exploited in minutes. Using WEP would severely weaken, not harden, network security.

1. National Institute of Standards and Technology (NIST). (2012). Special Publication 800-153

Guidelines for Securing Wireless Local Area Networks (WLANs).

Section 3.2.3

"Service Set Identifier (SSID) Management

" discusses SSID cloaking (disabling the broadcast) as a technique that "can hide the presence of a WLAN from casually snooping attackers."

Section 3.3.1

"WLAN Cryptography

" explicitly states

"WEP has been found to have significant security flaws and should not be used."

2. Saltzer

J. H.

& Schroeder

M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE

63(9)

1278–1308. https://doi.org/10.1109/PROC.1975.9939

Section I.A.3

"Principle of Least Privilege

" establishes the foundational security concept that is violated by option A ("Trust local hosts by default"). This principle dictates that any entity should only have the bare minimum privileges necessary to perform its function.

3. Cisco. (2021). Wireless LAN Security Best Practices. Cisco Press.

In guides on WLAN security

adding access points (Option C) is discussed in the context of network design for coverage and capacity

not as a primary security hardening measure. Secure configuration of each AP is the focus for hardening.

The netstat (network statistics) command is a command-line utility used to display network connections, routing tables, and various network interface statistics. Its primary function is to show active TCP and UDP connections, listening ports, and the processes using them. Running netstat (often with flags like -a for all sockets, -t for TCP, -u for UDP, -n for numeric addresses) directly provides the list of active connections that the user requires for troubleshooting. While newer tools like ss are often recommended, netstat remains a fundamental and widely available tool for this task.

A. nslookup: This is a utility for querying Domain Name System (DNS) servers to resolve hostnames, not for listing active connections.

C. dig: Like nslookup, dig (Domain Information Groper) is a tool for interrogating DNS servers and does not display network connections.

D. ifconfig: This command is used to display or configure a system's network interfaces (e.g., IP address, netmask), not to list active connections.

---

1. The Linux man-pages project. netstat(8) — Linux manual page. "netstat - Print network connections

routing tables

interface statistics

masquerade connections

and multicast memberships." Retrieved from https://man7.org/linux/man-pages/man8/netstat.8.html (Section: NAME).

2. Red Hat Customer Portal. RHEL 7 Networking Guide. "Chapter 33. Displaying Network Sockets with ss and netstat". This official vendor documentation describes netstat as a tool for displaying "information about network connections

routing tables

and network interfaces."

3. Stanford University

CS 144: Introduction to Computer Networking. Lab 0: Networking Warmup. The course materials introduce fundamental networking tools

describing netstat -pant as the command to "list all listening and established TCP sockets with the associated process name." This confirms its use for viewing active connections in an academic context.

Pharming is a cyberattack that redirects a website's traffic to a fraudulent, malicious site. The scenario describes a common pharming technique where an attacker compromises a Domain Name Server (DNS) and alters a legitimate website's DNS record to point to a malicious IP address. When users attempt to access the legitimate site by typing its domain name, the poisoned DNS server returns the attacker's IP address, transparently redirecting the user to the fake site. This method is effective because the user interacts with the correct domain name, making the deception difficult to spot.

B. Brute-force attack: This is an authentication attack that involves systematically guessing passwords or cryptographic keys until the correct one is found. It does not involve DNS manipulation or traffic redirection.

C. IP address spoofing: This involves forging the source IP address in a packet's header to conceal the sender's identity or impersonate another system, often used in denial-of-service attacks.

D. Session hijacking: This attack involves stealing a user's valid session token or cookie to gain unauthorized access to a system or service after the user has already authenticated.

1. Stallings

W.

& Brown

L. (2018). Computer Security: Principles and Practice (4th ed.). Pearson. In Chapter 7.3

"Phishing and Pharming

" the text states: "A more sophisticated attack is pharming

in which a DNS server is compromised and its tables modified so that requests for a legitimate Web site are redirected to a fraudulent site." (p. 229).

2. Al-Houri

Y.

Al-Hassan

M.

& Al-Shdaifat

A. (2021). A comprehensive survey on pharming attack detection and prevention techniques. Journal of Information Security and Applications

59

102831. Section 2

"Pharming Attack

" defines the attack: "Pharming is a type of cyberattack that redirects a website’s traffic to another

fake site. This is accomplished by poisoning the DNS server or by changing the hosts file on the victim’s computer." https://doi.org/10.1016/j.jisa.2021.102831

3. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. Chapter 8

"Security in Computer Networks

" describes IP spoofing as the act of creating a packet with a false source address (Section 8.6.1) and session hijacking as taking over an ongoing TCP session (Section 8.7.2)

distinguishing them from DNS-based redirection.

The TCP/IP model is a conceptual framework that standardizes network communication functions. The Network layer, also known as the Internet layer, is responsible for logical addressing, packet forwarding, and routing across different networks. The Internet Protocol (IP) is the principal communications protocol in this layer. It defines the format of packets, called datagrams, and the addressing system (IP addresses) used to deliver them from a source host to a destination host based on their addresses. All other layers rely on the Network layer's IP protocol for this fundamental packet delivery service.

A. The Physical or network access layer handles the physical transmission of data over the network medium and hardware addressing (e.g., MAC addresses), not logical IP addressing.

B. The Application layer provides network services directly to end-user applications, using protocols like HTTP, FTP, and SMTP.

D. The Transport layer is responsible for host-to-host communication, segmentation, and error control, using protocols like TCP and UDP, which in turn use IP for delivery.

1. Internet Engineering Task Force (IETF) RFC 1122: Braden

R. (Ed.). (1989). Requirements for Internet Hosts -- Communication Layers. RFC 1122. Section 1.3.2

"The TCP/IP Reference Model

" explicitly states

"Below the transport layer is the internetwork layer... The internetwork layer in the TCP/IP protocol suite is the IP layer. Its function is to route datagrams to their destination."

2. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 1

Section 1.5.2

"The Internet Protocol Stack

" the authors describe the Network Layer: "The Internet’s network layer is responsible for moving network-layer packets known as datagrams from one host to another. The Internet network layer includes the celebrated IP Protocol..."

3. MIT OpenCourseWare

6.033 Computer System Engineering

Spring 2018. In the course textbook

Saltzer

J. H.

& Kaashoek

M. F. (2009)

Principles of Computer System Design: An Introduction

Chapter 6

"Networking

" Section 6.1.2

"The Internet Protocol stack

" describes the Network layer as the layer that "routes packets from their source to their destination" and identifies IP as the primary protocol for this function.

A disaster recovery plan (DRP) is fundamentally designed to restore information systems and data access following a disruptive event, such as a natural disaster or major system failure. The primary objective is to minimize downtime and ensure that services are accessible and usable by authorized users as quickly as possible. This directly aligns with the principle of Availability from the CIA triad, which ensures timely and reliable access to and use of information and systems.

A. Innovation: This is not a component of the CIA security triad (Confidentiality, Integrity, Availability) and is irrelevant to the core principles of information security.

B. Confidentiality: This principle focuses on preventing the unauthorized disclosure of information. While a DRP may include measures to protect data, its primary goal is restoration of service, not secrecy.

D. Integrity: This principle ensures that data is trustworthy and has not been subject to unauthorized modification. A DRP aims to restore systems, which is a prerequisite for ensuring data integrity.

1. National Institute of Standards and Technology (NIST) Special Publication 800-34 Rev. 1

Contingency Planning Guide for Federal Information Systems.

Section 1

Introduction

Page 1: "Contingency planning supports this effort by establishing thorough plans

procedures

and technical measures to enable the recovery of information systems

operations

and data after a disruption. The primary goal... is to restore normal operations as quickly as possible and protect the assets of the organization

thereby ensuring the availability of critical resources..."

2. Pfleeger

C. P.

Pfleeger

S. L.

& Margulies

J. (2015). Security in Computing (5th ed.). Pearson Education.

Chapter 1

Section 1.2

"The Meaning of Computer Security"

Page 6: The text defines availability as the ability for authorized entities to use a system or resource. It explicitly states

"An object or service is available if... it is present in a usable form... and it is not denied to authorized users." Disaster recovery directly addresses threats to this property.

3. Whitman

M. E.

& Mattord

H. J. (2019). Principles of Information Security (6th ed.). Cengage Learning.

Chapter 2

"The Need for Security"

Section on "CIA Triad": This section explains that disaster recovery and business continuity plans are the primary controls that support the principle of availability. It describes availability as enabling authorized users—persons or computer systems—to access information without interference or obstruction and to receive it in the required format.

A Wireless Local Area Network (WLAN) is a type of local area network that uses high-frequency radio waves to communicate and transmit data, providing wireless connectivity within a limited geographic area like an office building, home, or library. The scenario describes patrons using mobile devices to connect to the internet within a library, which is the primary use case for a WLAN. This network infrastructure, commonly known as Wi-Fi, is based on the IEEE 802.11 standards and allows multiple users to access network resources without physical cables.

A. SAN: A Storage Area Network is a dedicated, high-speed network for connecting servers to storage devices, not for providing general internet access to end-users.

B. MAN: A Metropolitan Area Network covers a large geographic area like a city or a large campus, which is a much larger scale than a single library building.

C. PAN: A Personal Area Network connects devices within an individual's immediate workspace, typically using technologies like Bluetooth, not a building-wide access network.

1. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Section 1.3.1

the text describes wireless LANs (based on IEEE 802.11 technology) as a prevalent access network technology in "universities

business offices

cafes

airports

homes

and... libraries."

2. IEEE Computer Society. (2021). IEEE Standard for Information Technology--Telecommunications and information exchange between systems Local and metropolitan area networks--Specific requirements Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications (IEEE Std 802.11™-2020). The standard's scope (Section 1.1) defines its purpose as providing "wireless connectivity for fixed

portable

and moving stations within a local area."

3. Cisco. (n.d.). What Is a WLAN (Wireless Local Area Network)? Cisco.com. Retrieved from Cisco's official documentation

which defines a WLAN as "a wireless computer network that links two or more devices using wireless communication to form a local area network (LAN) within a limited area such as a home

school

computer laboratory

campus

or office building."

4. Forouzan

B. A. (2013). Data Communications and Networking (5th ed.). McGraw-Hill. In Chapter 1

Section 1.3

the text distinguishes between network types

defining a LAN as being "usually privately owned and links the devices in a single office

building

or campus

" with WLAN being its wireless variant. It defines a MAN as covering an "entire city."

Monitor mode, also known as RFMON mode, allows a wireless network interface card (WNIC) to capture all wireless traffic within its range, not just the traffic addressed to it. This is the fundamental mechanism used by Wireless Intrusion Detection Systems (WIDS) and network administrators to detect rogue access points. By scanning the airwaves and analyzing beacon frames from all broadcasting APs, the system can compare the detected APs against a whitelist of authorized devices. Any AP not on the list is flagged as a potential rogue, allowing for investigation and removal.

A. Require complex passwords: This strengthens authentication for legitimate network access but does not prevent an unauthorized device from being physically connected to the network and broadcasting.

C. Use server-side validation: While crucial for authenticating legitimate users and devices (e.g., via RADIUS/802.1X), it does not actively scan the radio frequency spectrum to discover unauthorized APs.

D. Disallow ICMP packets on the firewall: This is a network hardening technique to limit reconnaissance (like ping sweeps) and has no direct impact on detecting or preventing rogue wireless access points.

1. National Institute of Standards and Technology (NIST). (2012). Special Publication 800-153

Guidelines for Securing Wireless Local Area Networks (WLANs).

Section 3.2.1

"Rogue Access Points

" p. 16: This section states

"Rogue APs are typically detected by continuously monitoring the wireless medium for unauthorized devices." This continuous monitoring is achieved by placing wireless sensors or APs into a scanning or monitor mode to capture all nearby wireless frames.

2. Cisco. (2023). Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide

IOS XE Dublin 17.12.x - Security Configuration Guide.

Chapter: "Configuring Rogue Detection and Management": The guide explains that Cisco APs can operate in different modes

including monitor mode

specifically to listen on all channels to detect rogue devices

interference

and intrusion attempts. It details how APs perform "off-channel scanning

" which is a functional application of monitor mode principles to discover unauthorized APs.

3. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson.

Chapter 7.3

"WiFi: 802.11 Wireless LANs": In the security subsection

the text discusses threats to wireless networks

including rogue access points. The countermeasures described involve Wireless Intrusion Detection Systems (WIDS)

which operate by scanning 802.11 channels to identify and report unauthorized APs. This scanning process requires the ability to capture all management frames

a function of monitor mode.

Role-Based Access Control (RBAC) is fundamentally a mechanism to enforce policies that restrict access to information and system resources. The primary driver for this is Confidentiality, which is the principle of preventing the unauthorized disclosure of information. RBAC achieves this by assigning permissions to roles based on job functions rather than to individual users. This ensures that users can only access the specific information necessary to perform their duties, thereby upholding the principle of least privilege and protecting data from unauthorized viewing.

A. Integrity: While RBAC supports integrity by controlling who can modify data, its primary function is to control access itself, which is the core of confidentiality.

B. Availability: RBAC is an access control mechanism and is not primarily designed to ensure systems are operational or accessible to authorized users when needed.

D. Consistency: Consistency is not a component of the CIA triad. It is more closely related to the concept of data integrity.

1. National Institute of Standards and Technology (NIST) Special Publication 800-53

Revision 5. Security and Privacy Controls for Information Systems and Organizations.

Reference: Appendix F

Section F.2

Page F-5.

Details: This document defines Confidentiality as "Preserving authorized restrictions on information access and disclosure..." The entire Access Control (AC) family of security controls

of which RBAC is a model

is designed to directly support this objective by enforcing access rules.

2. Ferraiolo

D. F.

& Kuhn

D. R. (1992). Role-Based Access Control. 15th National Computer Security Conference.

Reference: Section 1

"Introduction

" Paragraph 1.

Details: This foundational NIST paper on RBAC introduces it as a method to "control access to information" based on "the roles individual users take on as part of an organization." This directly aligns with the goal of confidentiality

which is centered on controlling access.

3. Sandhu

R. S.

Coyne

E. J.

Feinstein

H. L.

& Youman

C. E. (1996). Role-Based Access Control Models. IEEE Computer

29(2)

38-47.

Reference: Section I

"Introduction

" Paragraph 2.

DOI: https://doi.org/10.1109/2.485845

Details: This seminal academic paper describes RBAC as a "means of restricting access to authorized users." This restriction is the essential mechanism for enforcing confidentiality within an organization's security policy.