Which of the following names represents inbound filtering?
Answer(s): D
Ingress filtering is a method used in network security to ensure that incoming packets are allowed or blocked based on a set of security rules.This type of filtering is often implemented at the boundaries of networks to prevent unwanted or harmful traffic from entering a more secure internal network. The term "ingress" refers to traffic that is entering a network boundary, whereas "egress" refers to traffic exiting a network.ReferenceCisco Networking Academy Program: Network Security."Understanding Ingress and Egress Filtering," Network Security Guidelines, TechNet.
Which of the following are required functions of information management?
Answer(s): A
Information management within the context of network security involves several critical functions that ensure data is correctly handled for security operations. These functions include:Normalization: This process standardizes data formats from various sources to a common format, making it easier to analyze systematically.Correlation: This function identifies relationships between disparate pieces of data, helping to identify patterns or potential security incidents.Data enrichment: Adds context to the collected data, enhancing the information with additional details, such as threat intelligence.All these functions are essential to effective information management in security systems, allowing for more accurate monitoring and faster response to potential threats.Reference"Data Enrichment and Correlation in SIEM Systems," Security Information Management Best Practices."Normalization Techniques for Security Data," Journal of Network Security.
What type of protocol is considered connection-oriented?
Answer(s): B
TCP (Transmission Control Protocol) is a connection-oriented protocol used in the majority of internet communications.Connection-oriented protocols like TCP require a connection to be established between the communicating devices before data is transmitted. This ensures reliable and ordered delivery of data.TCP manages this by establishing a handshake mechanism (TCP three-way handshake) to set up the connection prior to transmitting data and properly terminating the connection once the communication session has completed.Reference"TCP/IP Illustrated, Volume 1: The Protocols" by W. Richard Stevens. Postel, J., "Transmission Control Protocol," RFC 793.
Which of the following steps is used to reveal the IP addressing?
Enumeration is a step in the information-gathering phase of a penetration test or cyber attack where an attacker actively engages with the target to extract detailed information, including IP addressing. Enumeration: During enumeration, the attacker interacts with network services to gather information such as user accounts, network shares, and IP addresses. Techniques: Common techniques include using tools like Nmap, Netcat, and Nessus to scan for open ports, services, and to identify the IP addresses in use. Purpose: The goal is to map the network's structure, find potential entry points, and understand the layout of the target environment.Because enumeration involves discovering detailed information including IP addresses, it is the correct answer.Reference"Enumeration in Ethical Hacking," GeeksforGeeks, Enumeration. "Network Enumeration," Wikipedia, Network Enumeration.
Which of the following are not a part of the temporal score in the CVSS? (Select all that apply.)
Answer(s): A,B
The Common Vulnerability Scoring System (CVSS) provides a way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity. The temporal score in CVSS adjusts the base score of a vulnerability based on factors that change over time, such as the availability of exploits or the existence of patches.The temporal score includes:Remediation LevelReport ConfidenceAttack Vector and User Interaction are part of the base score, not the temporal score, as they describe the fundamental characteristics of the vulnerability and do not typically change over time.ReferenceCommon Vulnerability Scoring System v3.1: Specification Document. "Understanding CVSS," by FIRST (Forum of Incident Response and Security Teams).
Post your Comments and Discuss EC-Council ICS-SCADA exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the ICS-SCADA content, but please register or login to continue.