IT & Computer Studies — C172 Network and Security Foundations Version 1
1. Which layer of the OSI model includes IP addresses?
Answer: B
The Network layer of the OSI model includes IP addresses.
IP addresses are utilized at the Network layer of the OSI model, which is responsible for routing packets of data across different networks.
A) Application
The Application layer is the topmost layer of the OSI model and is responsible for providing network services directly to end-user applications. It does not handle IP addresses; instead, it deals with high-level protocols like HTTP, FTP, and SMTP.
B) Network
The Network layer is where IP addresses are defined and utilized for routing data packets between devices across different networks. This layer manages the addressing and routing of packets, making it essential for data transmission over the internet.
C) Session
The Session layer is responsible for establishing, managing, and terminating sessions between applications. It does not involve IP addressing or routing; rather, it focuses on maintaining communication sessions and ensuring that data is properly synchronized.
D) Transport
The Transport layer is responsible for ensuring reliable data transfer between devices. It deals with data segmentation and flow control, but it does not utilize IP addresses, which are specific to the Network layer for routing purposes.
Conclusion
The Network layer is definitively the correct answer as it is specifically responsible for the use of IP addresses in routing data. In contrast, the Application, Session, and Transport layers serve different functions and do not involve IP addressing, thus reinforcing the importance of the Network layer in the OSI model.
Answer: A
Enable MAC address filtering to increase Wi-Fi security.
Implementing MAC address filtering allows the company to specify which devices can connect to the Wi-Fi network, thereby enhancing its security by limiting access to authorized devices only.
A) Enable MAC address filtering
This option is correct because MAC address filtering restricts network access to devices with specific MAC addresses, thus preventing unauthorized devices from connecting to the network. It adds an additional layer of security by ensuring that only pre-approved devices can communicate on the network.
B) Trust local hosts by default
This option is incorrect as trusting local hosts by default can lead to security vulnerabilities. It assumes that all devices within the local network are safe, which is not always the case. This could allow malicious devices to access network resources without proper checks.
C) Add more access points
This option is also incorrect because simply adding more access points does not inherently improve security. In fact, it could potentially expose the network to more vulnerabilities if not properly secured. More access points increase the surface area for potential attacks without implementing security measures.
D) Implement wired equivalent privacy (WEP)
This option is incorrect as WEP is considered an outdated and insecure protocol for Wi-Fi security. It has numerous vulnerabilities that can be easily exploited, thus failing to provide adequate protection for the network.
Conclusion
The most effective method for increasing Wi-Fi security is enabling MAC address filtering, as it directly restricts access to authorized devices. Other options either fail to improve security or introduce additional risks, reinforcing the need for robust access control measures in network security.
Answer: C
Zero trust
The security principle being applied is zero trust, which emphasizes the need for continuous verification of user identity and access rights based on real-time risk assessments. This approach ensures that access is not granted automatically and is contingent upon current conditions.
A) Least privilege
Least privilege refers to the principle of providing users with the minimum level of access necessary to perform their duties. While this concept is related to security, it does not encompass the dynamic and continuous assessment of user behavior and network activity that zero trust entails.
B) Separation of privilege
Separation of privilege involves requiring multiple components or actions to gain access to sensitive resources, thereby reducing the risk of unauthorized access. Although it enhances security, it does not specifically address the ongoing monitoring and adjustment of authentication requirements based on risk, which is central to the zero trust model.
C) Zero trust
Zero trust is characterized by its focus on continuous monitoring and validation of user access and behavior, ensuring that permissions are dynamically adjusted based on real-time assessment of risk factors. This principle fundamentally changes the assumption of trust in network environments, making it the correct answer in this context.
D) Psychological acceptability
Psychological acceptability refers to designing security measures in a way that they are user-friendly and do not hinder productivity. While important for user compliance, this principle does not relate to the continuous monitoring and risk-based adjustments inherent in the zero trust framework.
Conclusion
Zero trust is the definitive correct answer as it encapsulates the principle of continuously monitoring user behavior and dynamically adjusting access requirements based on risk. In contrast, the other options focus on static access controls or user experience, which do not address the proactive and adaptive nature of security that zero trust embodies.
Answer: C
Brute-force attack
The attack being attempted is a brute-force attack, where an automated script is used to systematically guess passwords until the correct one is found.
A) Spoofing attack
A spoofing attack involves impersonating another device or user to gain unauthorized access or information. This does not align with the scenario of multiple login attempts aimed at guessing passwords; hence, it is not applicable.
B) SQL injection attack
An SQL injection attack targets databases by injecting malicious SQL queries to manipulate or retrieve sensitive data. This type of attack does not involve guessing passwords, making it irrelevant to the situation described.
C) Brute-force attack
A brute-force attack is characterized by the use of automated scripts to repeatedly attempt various password combinations until successful login is achieved. This accurately describes the situation, as the attacker is exploiting the system by guessing employee passwords.
D) Phishing attack
A phishing attack typically involves tricking users into providing sensitive information, such as passwords, through deceptive communication. This is not the method being employed in the scenario, which specifically involves automated password attempts rather than user deception.
Conclusion
The brute-force attack is definitively the correct answer as it directly involves the automated guessing of passwords from a single IP address. In contrast, all other options describe different types of cyber threats that do not apply to the scenario presented, thus reinforcing the nature of the attempted attack.
Answer: C
Operational efficiency
This scenario illustrates operational efficiency as the company migrates to the cloud to lower IT costs, improve agility, and enhance remote collaboration. These outcomes directly reflect the benefits of optimizing operations through cloud computing solutions.
A) Community cloud
Community cloud refers to a cloud infrastructure shared by several organizations with similar requirements or concerns, such as compliance or security. While it may provide some benefits for collaboration, it does not specifically address the cost reduction, agility, or operational enhancements that the scenario highlights.
B) Virtualization
Virtualization is a technology that allows multiple virtual instances to run on a single physical server, which can lead to cost savings and improved resource utilization. However, the scenario focuses on broader operational efficiencies and benefits from cloud adoption, rather than just the technical aspect of virtualization.
C) Operational efficiency
Operational efficiency encompasses the ability to streamline processes, reduce costs, and enhance collaboration, all of which are explicitly mentioned in the scenario. The migration to the cloud supports these goals by providing scalable resources and flexibility in operations, making this the most accurate benefit illustrated.
D) Hybrid deployment
Hybrid deployment combines both on-premises and cloud resources, offering flexibility but not directly addressing the specific benefits outlined in the scenario. The focus is on the operational efficiencies gained through complete cloud migration rather than a mixed approach.
Conclusion
Operational efficiency is the definitive correct answer as it encapsulates the core benefits of cost reduction, agility, and remote collaboration mentioned in the scenario. Other options fail to align with the overall intent of the company's migration goals, focusing instead on specific technologies or deployment models that do not inherently provide the same broad advantages.
Answer: D
nslookup is the command to use for testing DNS resolution.
The technician should use the nslookup command to test DNS resolution, as it specifically queries DNS servers to obtain domain name or IP address mapping information.
A) arp
The arp command is used to view and manipulate the Address Resolution Protocol cache, which maps IP addresses to MAC addresses. It does not test or resolve domain names, making it irrelevant for diagnosing DNS issues.
B) tracert
The tracert command is used to trace the route packets take to reach a destination host. While it can help identify network path issues, it does not perform DNS resolution or directly test DNS functionality.
C) ping
The ping command tests connectivity to a specified IP address or hostname by sending ICMP echo requests. Although it can indirectly indicate DNS issues by failing to resolve a hostname, it does not provide detailed information on DNS resolution itself.
D) nslookup
The nslookup command is specifically designed for querying DNS servers to resolve domain names to IP addresses and vice versa. It provides detailed information about the DNS records and is the most appropriate tool for diagnosing DNS resolution problems.
Conclusion
Nslookup is the definitive choice for testing DNS resolution issues due to its direct functionality in querying DNS servers. Other options, while useful for network diagnostics, do not serve the purpose of resolving domain names, thus failing to address the technician's need effectively.
Answer: D
Role-based access control (RBAC) applies to Authorization.
Role-based access control (RBAC) is a security mechanism that restricts system access to authorized users. This is a clear application of the Authorization category within the AAA framework, as it determines what resources a user can access based on their assigned roles.
A) Authentication
Authentication is the process of verifying the identity of a user before granting access to a system. While it is a crucial part of security, it does not involve controlling access to specific resources based on job duties, making it incorrect in this context.
B) Accounting
Accounting refers to tracking user activities and resource usage within a system. Although it plays a role in security management, it does not dictate access permissions, which is the focus of the question regarding access control based on job roles.
C) Auditing
Auditing involves reviewing and analyzing records of user activity to ensure compliance and detect anomalies. While important for security oversight, it does not pertain to the proactive control of access rights, which is central to the concept of RBAC.
D) Authorization
Authorization is the process of granting or denying access to resources based on established permissions. In the context of RBAC, it is specifically about controlling what information employees can access based on their roles, making it the correct answer.
Conclusion
The correct answer is Authorization, as it directly relates to the principles of role-based access control in determining user access to resources. Authentication, Accounting, and Auditing, while important components of the AAA framework, do not involve the direct assignment of access rights based on job responsibilities, thus failing to meet the requirements of the question.
Answer: D
Encrypting data before uploading ensures confidentiality
Encrypting data before uploading it to the cloud storage provider guarantees that even if the provider is compromised, the data remains confidential and inaccessible to unauthorized parties.
A) Deploying a firewall
Deploying a firewall is a network security measure that controls incoming and outgoing traffic based on predetermined security rules. While it can help protect the network from external threats, it does not specifically ensure the confidentiality of data stored in the cloud, especially if the provider is compromised.
B) Using a VPN connection
Using a VPN connection enhances security by creating a secure tunnel for data transmission between the user and the cloud provider. However, while it protects data in transit, it does not secure the data once it is stored in the cloud, meaning that confidentiality could still be at risk if the provider is compromised.
C) Implementing a web filter
Implementing a web filter is primarily aimed at controlling access to web content and preventing exposure to harmful sites. This measure does not address data confidentiality in cloud storage, as it does not encrypt or protect the data itself once stored.
D) Encrypting data before uploading
Encrypting data before uploading is a critical security measure that transforms the data into a coded format, making it unreadable to anyone who does not possess the decryption key. This ensures that even if the cloud storage provider is compromised, the data remains confidential and protected from unauthorized access.
Conclusion
Encrypting data before uploading is the definitive measure that protects the confidentiality of customer data in cloud storage, effectively rendering it inaccessible even in the event of a security breach at the provider. Other options, while useful for different aspects of security, do not provide the same level of protection for data at rest in the cloud.
Answer: C
Confidentiality
The principle being upheld in this scenario is confidentiality, as the encryption of payment information ensures that sensitive financial data remains private and protected from unauthorized access during transmission.
A) Redundancy
Redundancy refers to the inclusion of extra components or systems to increase reliability and availability, rather than protecting the privacy of data. Therefore, it is not applicable in this context where the focus is on securing sensitive information.
B) Availability
Availability ensures that information and resources are accessible when needed. While important, it does not relate to the protection of data from unauthorized access, which is the primary concern in this scenario.
C) Confidentiality
Confidentiality is the principle that protects sensitive information from being accessed by unauthorized individuals. The use of encryption directly supports this principle by ensuring that payment information remains secure during transmission, making this the correct choice.
D) Integrity
Integrity involves maintaining the accuracy and completeness of data. While encryption can contribute to data integrity by preventing unauthorized alterations, the primary focus in this scenario is on protecting the confidentiality of payment information.
Conclusion
Confidentiality is the key principle upheld by encrypting payment information, as it prevents unauthorized access to sensitive financial data. In contrast, the other options—redundancy, availability, and integrity—do not directly address the security of data transmission in this context. Thus, confidentiality is the clear and definitive answer.
Answer: D
Disabling ESSID broadcasting enhances Wi-Fi security.
Disabling ESSID broadcasting prevents the wireless network's name from being publicly visible, making it less susceptible to unauthorized access and attacks.
A) Implement wired equivalent privacy (WEP)
WEP is an outdated security protocol with known vulnerabilities that can be easily exploited by attackers. Therefore, implementing WEP would not effectively harden Wi-Fi security and could expose the network to further risks.
B) Add more access points
While adding more access points can improve coverage, it does not inherently enhance security. In fact, it may increase the attack surface if not properly secured, making the network more vulnerable to unauthorized access.
C) Trust local hosts by default
Trusting local hosts by default is a risky strategy that can lead to security breaches. This approach assumes all local devices are secure, which is often not the case, especially in environments where devices may be compromised.
D) Disable ESSID broadcasting
Disabling ESSID broadcasting is a proactive measure that reduces the visibility of the network to potential attackers. By making the network less detectable, it discourages unauthorized access attempts and enhances overall security.
Conclusion
Disabling ESSID broadcasting is the most effective strategy for Wi-Fi hardening among the options provided, as it minimizes the network's exposure to potential threats. Other options either introduce vulnerabilities or do not significantly contribute to enhancing security, making them less suitable for protecting against cyberattacks.