ISC2 SSCP: NETWORK AND
COMMUNICATIONS SECURITY EXAM
DNSSEC (Domain Name System Security Extensions) - Correct Answers -A suite of
specifications used to protect the integrity of DNS records and prevent DNS poisoning
attacks.
Network Port Numbers - Correct Answers -16 bit binary number
65536 possible values
Port Ranges - Correct Answers -0-1023: Well-known ports
1021 - 49151: Registered ports
49152-65536: dynamic ports
EXAM TIP: Memorize the list of common ports before taking the exam - Correct
Answers -
Port 3389 - Correct Answers -Remote Desktop Protocol (RDP)
Ports 137,138,139 - Correct Answers -NetBIOS
Port 143 - Correct Answers -IMAP (Internet Message Access Protocol)
ICMP - Correct Answers -Internet Control Message Protocol. Used for diagnostics such
as ping. Many DoS attacks use ICMP. It is common to block ICMP at firewalls and
routers. If ping fails, but other connectivity to a server succeeds, it indicates that ICMP is
blocked.
Bus Network - Correct Answers -A network consisting of a central cable to which all
network devices are attached.
Ring network - Correct Answers -Each device is connected directly to its neighbors, and
messages are forwarded from device to device until the proper destination is reached.
Star Topology - Correct Answers -A topology with one central node that has each
computer or network device attached to the central node. All data first goes into the
central node and then is sent out to its destination. (Think of it like a bicycle wheel with
spokes.)
,Mesh Network - Correct Answers -A network that uses multiple access points to link a
series of devices that speak to each other to form a network connection across a large
area.
Tree Network Topology - Correct Answers -A tree topology is essentially a combination
of bus topology and star topology.
Client/Server Model - Correct Answers -a distributed approach in which a client makes
requests of a server and the server responds
Peer-to-Peer Model - Correct Answers -A decentralized communications model where
each party have similar capabilities acting as both client and server on a shared network
and either party can imitate a communication session.
What technology provides the translation that assigns public IP addresses to privately
addressed systems that wish to communicate on the Internet? - Correct Answers -NAT
Dennis would like to capture the DNS traffic on his network using Wireshark. What port
should he use in his capture filter to restrict his capture to DNS queries and responses?
- Correct Answers -UDP 53
What TCP flag indicates that a packet is requesting a new connection? - Correct
Answers -SYN
DMZ Network - Correct Answers -a physical or logical sub-network that contains and
exposes an organization's external-facing services to a larger and untrusted network,
usually the Internet.
Stateless Firewall - Correct Answers -A firewall that manages each incoming packet as
a stand-alone entity without regard to currently active connections. Stateless firewalls
are faster than stateful firewalls, but are not as sophisticated.
stateful firewall - Correct Answers -A stateful firewall performs packet inspection, which
checks the contents of packets to see if they pose threats.
Stateful firewalls monitor all aspects of the traffic streams, their characteristics and
communication channels.
NGFW (Next Generation
Firewall) - Correct Answers -Advances in firewall technology, from app awareness,
user-based filtering, and intrusion prevention to cloud inspection. Also known as layer 7
firewall.
Other firewall roles - Correct Answers -NAT
Content or URL filtering
Web application firewall
, proxy server (proxy) - Correct Answers -software server that handles all
communications originating from or being sent to the Internet, acting as a spokesperson
or bodyguard for the organization
- provides anonymity
- performance boosting
- content filtering
Forward Proxy - Correct Answers -A computer or an application program that intercepts
user requests from the internal secure network and then processes those requests on
behalf of the users.
Reverse Proxy - Correct Answers -A computer or an application program that routes
incoming requests to the correct server.
Transparent Proxy Server - Correct Answers -A proxy server that does not modify
requests
Load Balancer - Correct Answers -A dedicated network device that can direct requests
to different servers based on a variety of factors.
Load Balancer Security Functions - Correct Answers -- SSL certificate management
- URL filtering
- Other web application security tasks
Round Robin Scheduling - Correct Answers -sends requests to servers using a
predefined order.
Session Persistence - Correct Answers -routes an individual user's requests to the
same server
Active/active load balancing - Correct Answers -two load balancers run on the network
and each actively routes a poor of the inbound traffic to web servers. In this approach,
you may use the full capacity of both devices. If one device fails, the other handles the
entire load without disrupting user sessions, but with diminished capacity
Active-Passive load balancing - Correct Answers -one load balancer handles all of the
inbound traffic while the others sits and monitors those connections. If the active load
balancer fails, the passive load balancer immediately takes over and continues routing
traffic. In this approach, you have no loss of capacity during a failure event, but most of
the time the passive load balancer sits unused.
Site-to-Site VPN - Correct Answers -Interconnects two sites, as an alternative to a
leased line, at a reduced cost.
COMMUNICATIONS SECURITY EXAM
DNSSEC (Domain Name System Security Extensions) - Correct Answers -A suite of
specifications used to protect the integrity of DNS records and prevent DNS poisoning
attacks.
Network Port Numbers - Correct Answers -16 bit binary number
65536 possible values
Port Ranges - Correct Answers -0-1023: Well-known ports
1021 - 49151: Registered ports
49152-65536: dynamic ports
EXAM TIP: Memorize the list of common ports before taking the exam - Correct
Answers -
Port 3389 - Correct Answers -Remote Desktop Protocol (RDP)
Ports 137,138,139 - Correct Answers -NetBIOS
Port 143 - Correct Answers -IMAP (Internet Message Access Protocol)
ICMP - Correct Answers -Internet Control Message Protocol. Used for diagnostics such
as ping. Many DoS attacks use ICMP. It is common to block ICMP at firewalls and
routers. If ping fails, but other connectivity to a server succeeds, it indicates that ICMP is
blocked.
Bus Network - Correct Answers -A network consisting of a central cable to which all
network devices are attached.
Ring network - Correct Answers -Each device is connected directly to its neighbors, and
messages are forwarded from device to device until the proper destination is reached.
Star Topology - Correct Answers -A topology with one central node that has each
computer or network device attached to the central node. All data first goes into the
central node and then is sent out to its destination. (Think of it like a bicycle wheel with
spokes.)
,Mesh Network - Correct Answers -A network that uses multiple access points to link a
series of devices that speak to each other to form a network connection across a large
area.
Tree Network Topology - Correct Answers -A tree topology is essentially a combination
of bus topology and star topology.
Client/Server Model - Correct Answers -a distributed approach in which a client makes
requests of a server and the server responds
Peer-to-Peer Model - Correct Answers -A decentralized communications model where
each party have similar capabilities acting as both client and server on a shared network
and either party can imitate a communication session.
What technology provides the translation that assigns public IP addresses to privately
addressed systems that wish to communicate on the Internet? - Correct Answers -NAT
Dennis would like to capture the DNS traffic on his network using Wireshark. What port
should he use in his capture filter to restrict his capture to DNS queries and responses?
- Correct Answers -UDP 53
What TCP flag indicates that a packet is requesting a new connection? - Correct
Answers -SYN
DMZ Network - Correct Answers -a physical or logical sub-network that contains and
exposes an organization's external-facing services to a larger and untrusted network,
usually the Internet.
Stateless Firewall - Correct Answers -A firewall that manages each incoming packet as
a stand-alone entity without regard to currently active connections. Stateless firewalls
are faster than stateful firewalls, but are not as sophisticated.
stateful firewall - Correct Answers -A stateful firewall performs packet inspection, which
checks the contents of packets to see if they pose threats.
Stateful firewalls monitor all aspects of the traffic streams, their characteristics and
communication channels.
NGFW (Next Generation
Firewall) - Correct Answers -Advances in firewall technology, from app awareness,
user-based filtering, and intrusion prevention to cloud inspection. Also known as layer 7
firewall.
Other firewall roles - Correct Answers -NAT
Content or URL filtering
Web application firewall
, proxy server (proxy) - Correct Answers -software server that handles all
communications originating from or being sent to the Internet, acting as a spokesperson
or bodyguard for the organization
- provides anonymity
- performance boosting
- content filtering
Forward Proxy - Correct Answers -A computer or an application program that intercepts
user requests from the internal secure network and then processes those requests on
behalf of the users.
Reverse Proxy - Correct Answers -A computer or an application program that routes
incoming requests to the correct server.
Transparent Proxy Server - Correct Answers -A proxy server that does not modify
requests
Load Balancer - Correct Answers -A dedicated network device that can direct requests
to different servers based on a variety of factors.
Load Balancer Security Functions - Correct Answers -- SSL certificate management
- URL filtering
- Other web application security tasks
Round Robin Scheduling - Correct Answers -sends requests to servers using a
predefined order.
Session Persistence - Correct Answers -routes an individual user's requests to the
same server
Active/active load balancing - Correct Answers -two load balancers run on the network
and each actively routes a poor of the inbound traffic to web servers. In this approach,
you may use the full capacity of both devices. If one device fails, the other handles the
entire load without disrupting user sessions, but with diminished capacity
Active-Passive load balancing - Correct Answers -one load balancer handles all of the
inbound traffic while the others sits and monitors those connections. If the active load
balancer fails, the passive load balancer immediately takes over and continues routing
traffic. In this approach, you have no loss of capacity during a failure event, but most of
the time the passive load balancer sits unused.
Site-to-Site VPN - Correct Answers -Interconnects two sites, as an alternative to a
leased line, at a reduced cost.
