CS6250 COMPUTER NETWORK EXAM 2
COMPREHENSIVE EXAMINATION TEST
SOLVED QUESTIONS AND ANSWERS
GRADED A+
⩥ What is the purpose of Round Robin DNS?
Answer: - distribute load of requests to several servers at 1
location
- purpose is to distribute traffic evenly across destination IPs
(9)
⩥ How does round robin work? (RRDNS)
Answer: DNS client chooses record with a strategy
Record has a time to live (TTL) - validity of response
if lookup is repeated while mapping is active, dns client will
receive set of records in different order
(9)
,⩥ How does DNS content-based delivery work?
Answer: DNS returns IP that represents "nearest edge" server to
the client
nearest server is calculated based on network topo and
characteristics of link
TTL is LOWER than RRDNS
(9)
⩥ Why do CDNs react quicker to changes in link characteristics
than RRDNS?
Answer: Their time to live is shorter
(9)
⩥ How do CDNs and RRDNS benefit scammers?
Answer: - Harder to shut down online scams because if just one
IP is functional, it still works
(9)
,⩥ How do fast flux service networks work?
Answer: DNS records are short lived (low TTL)
They return a set of records that are only a small percentage of
the available IP addresses for that domain
they belong to compromised machines to act as proxies
they form a resilient one-hop overlay network
(9)
⩥ What has the shortest TTL?
Answer: Fast flux SN
(9)
⩥ What happens when a TTL expires with FFSN? Why?
Answer: After TTL expires, it returns a different set of records
from a larger set of compromised machines
- machines act as proxies between request and control node
(9)
, ⩥ What is the purpose of FIRE?
Answer: Finding Rogue Networks
- monitors internet for rogue networks
(9)
⩥ What is a rogue network?
Answer: Network with purpose of malicious activity
(9)
⩥ what are the 3 main data sources of FIRE to identify hosts that
belong to rogue networks?
Answer: 1. botnet command and control providers - they rely on
a centralized C&C
2. drive-by download hosting providers - malware installs
without interaction
3. phish housing providers - URLs that host phishing pages - up
for a short period of time
COMPREHENSIVE EXAMINATION TEST
SOLVED QUESTIONS AND ANSWERS
GRADED A+
⩥ What is the purpose of Round Robin DNS?
Answer: - distribute load of requests to several servers at 1
location
- purpose is to distribute traffic evenly across destination IPs
(9)
⩥ How does round robin work? (RRDNS)
Answer: DNS client chooses record with a strategy
Record has a time to live (TTL) - validity of response
if lookup is repeated while mapping is active, dns client will
receive set of records in different order
(9)
,⩥ How does DNS content-based delivery work?
Answer: DNS returns IP that represents "nearest edge" server to
the client
nearest server is calculated based on network topo and
characteristics of link
TTL is LOWER than RRDNS
(9)
⩥ Why do CDNs react quicker to changes in link characteristics
than RRDNS?
Answer: Their time to live is shorter
(9)
⩥ How do CDNs and RRDNS benefit scammers?
Answer: - Harder to shut down online scams because if just one
IP is functional, it still works
(9)
,⩥ How do fast flux service networks work?
Answer: DNS records are short lived (low TTL)
They return a set of records that are only a small percentage of
the available IP addresses for that domain
they belong to compromised machines to act as proxies
they form a resilient one-hop overlay network
(9)
⩥ What has the shortest TTL?
Answer: Fast flux SN
(9)
⩥ What happens when a TTL expires with FFSN? Why?
Answer: After TTL expires, it returns a different set of records
from a larger set of compromised machines
- machines act as proxies between request and control node
(9)
, ⩥ What is the purpose of FIRE?
Answer: Finding Rogue Networks
- monitors internet for rogue networks
(9)
⩥ What is a rogue network?
Answer: Network with purpose of malicious activity
(9)
⩥ what are the 3 main data sources of FIRE to identify hosts that
belong to rogue networks?
Answer: 1. botnet command and control providers - they rely on
a centralized C&C
2. drive-by download hosting providers - malware installs
without interaction
3. phish housing providers - URLs that host phishing pages - up
for a short period of time
