CPSA COMPREHENSIVE EXAM UPDATED QUESTIONS AND
ANSWERS GUARANTEE A+
✔✔B2) Cat 5 Characteristics - ✔✔1) Performance up to 100MHz 2) Suitable for
10BASE-T, 100BASE-TX (Fast Ethernet), 1000BASE-T (Gigabit Ethernet). 3) Category
5 enhanced (Cat 5e) supersedes Cat 5. Category 6 cable (Cat 6) is a cable standard for
Gigabit Ethernet. 4) Normally use RJ45 connectors.
✔✔B2) What are 10/100/1000baseT (Ethernet) - ✔✔1) They are standards that carry
traffic on physical layers.
✔✔B2) 10base - ✔✔T characteristics - 1) Also known as ethernet over twisted pair or
IEEE 802.3i 2)10base-T transmits at speed of 10Mbit/s using baseband transmission
using twisted pair cables
✔✔B2) 100base - ✔✔TX characteristics - 1) 100base-TX (IEEE 802.3u) is most
common of the Fast Ethernet standard. Fast Ethernet covers copper (100base-TX,
100base-T4, 100base-T2) and fibre-optic (100base-FX,
✔✔100base - ✔✔SX, 100base-BX, 100base-LX10) technologies.
✔✔B2) 1000base - ✔✔T characteristics - 1000base-T (IEEE 802.3ab) is a standard for
gigabit Ethernet over copper wiring.
✔✔B2) Token Ring. Where? How fast? Describe? Cabling? - ✔✔1) LAN technology
which resides in the Data Link Layer (DLL) of the OSI, similar to ethernet. 2) Token Ring
Network operates at 4mbps and 16mbps. 16mbps Token Ring a.k.a. Fast Token Ring.
3) Token is passed along the cyclic network. No collision. Each node has timeslice to
perform processing. Special token frame circles the network when no station
transmitting. Station converts token into data frame for transmission. Token Priority has
8 levels to assign to stations. Token Ring standardised with IEEE 802.5. 4) Token Ring
cabling uses IBM "Type-1" shielded twisted pair with unique genderless connector
(a.k.a. Boy George connector)
✔✔B2) What is a WLAN? What OSI layer? - ✔✔1) A wireless local area network
(WLAN) links two or more devices using some wireless distribution method (typically
spread-spectrum or OFDM radio). WLAN usually provides a connection through an
access point to the wider Internet. 2) WLAN is a data link layer protocol. WIFI Data Link
similar to ethernet. Uses radio spectrum (shared like a hub). Usually has link layer
Encryption with Authentication protocol.
✔✔B2) 802.11 standards (4) - ✔✔1) 802.11a = 50mb/s 5GHz 2) 802.11b = 11mb/s
2.4GHz 3) 802.11g = 50mb/s 2.4GHz 4) 802.11n = MIMO (multiple in multiple out)
,✔✔B2) Other data link technologies? (5) - ✔✔Direct connection (invisible), Serial
Protocol (RS-232), Point-to-point (PPP), Asymmetric Digital Subscriber Line (ASDL),
High-Level Data Link Control (HDLC)
✔✔B2) Bridges - ✔✔Bridge connects two networks together. Operates on Data Link
Layer (over ethernet). Bridge learns who is on what segment. Stores MAC addresses.
Repeater sends data on without interpreting it
✔✔B2) Hubs (3) - ✔✔1) Hubs are a form of repeater for an Ethernet LAN, which has
multiple ports. (Sometimes known as "multi-port repeaters" or "active star networks"). 2)
A hub is a shared network device. When sniffing a hub, can see all traffic. 4) A hub
duplicates data packets received on one port, making it available to all other ports.
Allows data sharing between all devices connected to the hub.
✔✔B2) Switches (6) - ✔✔1) Switch is like a device with multiple bridges. 2) Unlike a
standard hub, a switch keeps a record of the MAC addresses of the devices attached to
it. 3) When a switch receives a data packet, it forwards the packet directly to the
recipient device by looking up the MAC address. 4) Switch is a network device does
packet inspection and identifies where to send data. 5) Switch ports are segmented
from each other. Switch ports can run at different speeds. 6) When sniffing a switch, can
only see broadcast traffic.
✔✔B2) MAC Flooding Switches - ✔✔1) Different forged source MAC addresses can be
set on devices connecting to a switch. 2) The Content Addressable Memory Table
(CAM) stores the MAC address to Physical Port translations. When CAM fills up, it
causes a memory overflow / timeout. Overflow forces switch to fallback into
broadcast/hub mode. 3) Early switches with limited memory had this issue. Restarting
switch is a temporal measure to reset the state. 4) Fixes include: Limit MAC addresses
on each port; Rate Limit to 10 requests/second; More memory in switch.
✔✔B2) VLAN (7) - ✔✔1) Virtual Local Area Network (VLAN) is a concept of partitioning
aphysical network so that distinct broadcast domains are created. 2) Achieved on
switches and routers. 3) VLANs splits ethernet up. Can assign different ports to different
networks. 4) Using a switch for different segments on network and handling firewalls
and segregation of routers and protected systems is not a certified solution. 5) For traffic
to be sent to specific VLANs, packets are tagged with 802.1Q tag. 6) VLANs are local to
switch's database and VLAN information not passed between switches. 7) Do not use
VLANs with Wireless
✔✔B2) VLAN Trunking (4) - ✔✔1) Trunking provides VLAN identification for frames
travelling between switches. 2) Trunk port allows traffic from any VLAN to through the
switch. 3) Trunk port uses 802.1Q tagging. Tagged for backward compatbility. 4)
Trunking must be configured on both ends of the link.
,✔✔B2) VLAN Security Implications - ✔✔As an example of a double tagging attack,
consider a secure web server on a VLAN called VLAN1. Hosts on VLAN1 are allowed
access to the web server; hosts from outside the VLAN are blocked by layer 3 filters. An
attacking host on a separate VLAN, called VLAN2, creates a specially formed packet to
attack the web server. It places a header tagging the packet as belonging to VLAN2 on
top of another header tagging the packet as belonging to VLAN1. When the packet is
sent, the switch on VLAN2 sees the VLAN2 header and removes it, and forwards the
packet. The VLAN2 switch expects that the packet will be treated as a standard TCP
packet by the switch on VLAN1. However, when the packet reaches VLAN1, the switch
sees a tag indicating that the packet is part of VLAN1, and so bypasses the layer 3
handling, treating it as a layer 2 packet on the same logical VLAN. The packet thus
arrives at the target server as though it was sent from another host on VLAN1, ignoring
any layer 3 filtering that might be in place.
✔✔B2) Switched Security Implications (5) - ✔✔SNMP weak password. Switch
misconfiguration. VLAN Hopping vulnerability. No logging. No stateful inspection.
Mitigated with firewalls
✔✔B2) Baseband vs Broadband - ✔✔Both baseband and broadband describe how
data is transmitted between two nodes. Baseband technology transmits a single data
signal/stream/channel at a time while broadband technology transmits multiple data
signals/streams/channels simultaneously at the same time.
✔✔B4) Tool for seeing what is present? (6) - ✔✔Ping, nmap -sP, arp-scan, icmpscan,
sing, fping
✔✔B4) Tool for DNS hostnames (4 + 1) - ✔✔dig, host, nslookup, ldapsearch. resolve
adresses to names
✔✔B4) Tool for NetBIOS hostnames (3 +2) - ✔✔nbtscan, nbtstat, lservers. Obtain
names from IP addresses. Uses Name Service UDP/137
✔✔B4) Tool for OS fingerprinting (5) - ✔✔nmap -A, xprobe2, ARP, ICMP echo reply
TTL can indicate OS, port scans can reveal OS specific host
✔✔B4) Tool for services/ports (2) - ✔✔nmap -sS, -nmap -sU
✔✔B4) Tool for application fingerprinting (2) - ✔✔telnet, openssl
✔✔B4) Tool for network sniffing (2) - ✔✔Wireshark, TCPDump
✔✔B4) Tool for route (2) - ✔✔Tracert / traceroute, ping -r
✔✔B4) Windows and Linux only ports (5 + 1 ) - ✔✔TCP/135, UDP/137, UDP/138,
TCP/139, TCP/445 . Linux (TCP/111)
, ✔✔B4) nmap scan types (6) - ✔✔Full/Vanilla Connect (-sT), Xmas (-sX), FIN (-sF),
NULL (-sN), SYN/Stealth/Halfway (-sS), ACK Flag probing (-sA/-sW)
✔✔B4) High priority targets vs low priority - ✔✔High Priority: Servers and AD (Active
Directory), Firewalls, Routers, etc. Less Priority: Printers and Workstations. If only
conducting a sample, try and have diversity of systems types to test.
✔✔B4) Stealth Scanning Technique (Inverse TCP Flag) - ✔✔Inverse TCP flag scanning
= send with another flag (not SYN) knowing that only closed ports will respond. Flags
include FIN, XMAS and NULL. Getting no response is open, getting RST/ACK is closed.
Effective against Unix but not Windows
✔✔B4) Stealth Scanning Technique (ACK Flag probing) - ✔✔Identify open TCP ports
by sending ACK probe packets and analyzing the header information of the RST
packets received from the target host. Analysis of the time-to-live (TTL) field of received
packets or Analysis of the WINDOW field of received packets.
✔✔B5) Arp Scanning Characteristics - ✔✔Scan a network to find active hosts.
Limitation: Only works on a local network. No routable. Very fast, simple protocol. Does
not use TCP and can scan a class B network. Very reliable. Never blocked. Not
possible for firewall to block unless it is host-based firewall. Disadvantage: IP requires
ARP.
✔✔B5) Arp Scan tools - ✔✔arp-scan runs on Unix/Linux. Not available for Windows
because of pcap. arp-scan works on Ethernet and Wifi.
✔✔B5) Ping sweep tools - ✔✔fping is more flexible/presentable than ping. icmp-scan.
nmap -sP
✔✔B5) TCP Connection to Filtered Port? - ✔✔SYN packet doesn't get any response.
This is different to Closed which is when it gets a RST back
✔✔B5) UDP Scanning via ICMP - ✔✔Can be done with ICMP packets as if it sends
back ICMP Unreachable/Port unreachable if it is open. No response sent if it is not
listening. Can get false positives
✔✔B5) Network sniffing of broadcast protocols? (1+ 4) - ✔✔If plugged into a switched
network you'll only be able to see the broadcast traffic. Spanning Tree Protocol (STP) is
a regular protocol. Cisco Discovery Protocol (CDP) is a broadcast protocol. Only used
by Cisco devices. ARP Requests will tell you potential IP addresses. Map IP address
and MAC address. NetBIOS runs on Windows only, normally giving some information
like system name and IP address.
ANSWERS GUARANTEE A+
✔✔B2) Cat 5 Characteristics - ✔✔1) Performance up to 100MHz 2) Suitable for
10BASE-T, 100BASE-TX (Fast Ethernet), 1000BASE-T (Gigabit Ethernet). 3) Category
5 enhanced (Cat 5e) supersedes Cat 5. Category 6 cable (Cat 6) is a cable standard for
Gigabit Ethernet. 4) Normally use RJ45 connectors.
✔✔B2) What are 10/100/1000baseT (Ethernet) - ✔✔1) They are standards that carry
traffic on physical layers.
✔✔B2) 10base - ✔✔T characteristics - 1) Also known as ethernet over twisted pair or
IEEE 802.3i 2)10base-T transmits at speed of 10Mbit/s using baseband transmission
using twisted pair cables
✔✔B2) 100base - ✔✔TX characteristics - 1) 100base-TX (IEEE 802.3u) is most
common of the Fast Ethernet standard. Fast Ethernet covers copper (100base-TX,
100base-T4, 100base-T2) and fibre-optic (100base-FX,
✔✔100base - ✔✔SX, 100base-BX, 100base-LX10) technologies.
✔✔B2) 1000base - ✔✔T characteristics - 1000base-T (IEEE 802.3ab) is a standard for
gigabit Ethernet over copper wiring.
✔✔B2) Token Ring. Where? How fast? Describe? Cabling? - ✔✔1) LAN technology
which resides in the Data Link Layer (DLL) of the OSI, similar to ethernet. 2) Token Ring
Network operates at 4mbps and 16mbps. 16mbps Token Ring a.k.a. Fast Token Ring.
3) Token is passed along the cyclic network. No collision. Each node has timeslice to
perform processing. Special token frame circles the network when no station
transmitting. Station converts token into data frame for transmission. Token Priority has
8 levels to assign to stations. Token Ring standardised with IEEE 802.5. 4) Token Ring
cabling uses IBM "Type-1" shielded twisted pair with unique genderless connector
(a.k.a. Boy George connector)
✔✔B2) What is a WLAN? What OSI layer? - ✔✔1) A wireless local area network
(WLAN) links two or more devices using some wireless distribution method (typically
spread-spectrum or OFDM radio). WLAN usually provides a connection through an
access point to the wider Internet. 2) WLAN is a data link layer protocol. WIFI Data Link
similar to ethernet. Uses radio spectrum (shared like a hub). Usually has link layer
Encryption with Authentication protocol.
✔✔B2) 802.11 standards (4) - ✔✔1) 802.11a = 50mb/s 5GHz 2) 802.11b = 11mb/s
2.4GHz 3) 802.11g = 50mb/s 2.4GHz 4) 802.11n = MIMO (multiple in multiple out)
,✔✔B2) Other data link technologies? (5) - ✔✔Direct connection (invisible), Serial
Protocol (RS-232), Point-to-point (PPP), Asymmetric Digital Subscriber Line (ASDL),
High-Level Data Link Control (HDLC)
✔✔B2) Bridges - ✔✔Bridge connects two networks together. Operates on Data Link
Layer (over ethernet). Bridge learns who is on what segment. Stores MAC addresses.
Repeater sends data on without interpreting it
✔✔B2) Hubs (3) - ✔✔1) Hubs are a form of repeater for an Ethernet LAN, which has
multiple ports. (Sometimes known as "multi-port repeaters" or "active star networks"). 2)
A hub is a shared network device. When sniffing a hub, can see all traffic. 4) A hub
duplicates data packets received on one port, making it available to all other ports.
Allows data sharing between all devices connected to the hub.
✔✔B2) Switches (6) - ✔✔1) Switch is like a device with multiple bridges. 2) Unlike a
standard hub, a switch keeps a record of the MAC addresses of the devices attached to
it. 3) When a switch receives a data packet, it forwards the packet directly to the
recipient device by looking up the MAC address. 4) Switch is a network device does
packet inspection and identifies where to send data. 5) Switch ports are segmented
from each other. Switch ports can run at different speeds. 6) When sniffing a switch, can
only see broadcast traffic.
✔✔B2) MAC Flooding Switches - ✔✔1) Different forged source MAC addresses can be
set on devices connecting to a switch. 2) The Content Addressable Memory Table
(CAM) stores the MAC address to Physical Port translations. When CAM fills up, it
causes a memory overflow / timeout. Overflow forces switch to fallback into
broadcast/hub mode. 3) Early switches with limited memory had this issue. Restarting
switch is a temporal measure to reset the state. 4) Fixes include: Limit MAC addresses
on each port; Rate Limit to 10 requests/second; More memory in switch.
✔✔B2) VLAN (7) - ✔✔1) Virtual Local Area Network (VLAN) is a concept of partitioning
aphysical network so that distinct broadcast domains are created. 2) Achieved on
switches and routers. 3) VLANs splits ethernet up. Can assign different ports to different
networks. 4) Using a switch for different segments on network and handling firewalls
and segregation of routers and protected systems is not a certified solution. 5) For traffic
to be sent to specific VLANs, packets are tagged with 802.1Q tag. 6) VLANs are local to
switch's database and VLAN information not passed between switches. 7) Do not use
VLANs with Wireless
✔✔B2) VLAN Trunking (4) - ✔✔1) Trunking provides VLAN identification for frames
travelling between switches. 2) Trunk port allows traffic from any VLAN to through the
switch. 3) Trunk port uses 802.1Q tagging. Tagged for backward compatbility. 4)
Trunking must be configured on both ends of the link.
,✔✔B2) VLAN Security Implications - ✔✔As an example of a double tagging attack,
consider a secure web server on a VLAN called VLAN1. Hosts on VLAN1 are allowed
access to the web server; hosts from outside the VLAN are blocked by layer 3 filters. An
attacking host on a separate VLAN, called VLAN2, creates a specially formed packet to
attack the web server. It places a header tagging the packet as belonging to VLAN2 on
top of another header tagging the packet as belonging to VLAN1. When the packet is
sent, the switch on VLAN2 sees the VLAN2 header and removes it, and forwards the
packet. The VLAN2 switch expects that the packet will be treated as a standard TCP
packet by the switch on VLAN1. However, when the packet reaches VLAN1, the switch
sees a tag indicating that the packet is part of VLAN1, and so bypasses the layer 3
handling, treating it as a layer 2 packet on the same logical VLAN. The packet thus
arrives at the target server as though it was sent from another host on VLAN1, ignoring
any layer 3 filtering that might be in place.
✔✔B2) Switched Security Implications (5) - ✔✔SNMP weak password. Switch
misconfiguration. VLAN Hopping vulnerability. No logging. No stateful inspection.
Mitigated with firewalls
✔✔B2) Baseband vs Broadband - ✔✔Both baseband and broadband describe how
data is transmitted between two nodes. Baseband technology transmits a single data
signal/stream/channel at a time while broadband technology transmits multiple data
signals/streams/channels simultaneously at the same time.
✔✔B4) Tool for seeing what is present? (6) - ✔✔Ping, nmap -sP, arp-scan, icmpscan,
sing, fping
✔✔B4) Tool for DNS hostnames (4 + 1) - ✔✔dig, host, nslookup, ldapsearch. resolve
adresses to names
✔✔B4) Tool for NetBIOS hostnames (3 +2) - ✔✔nbtscan, nbtstat, lservers. Obtain
names from IP addresses. Uses Name Service UDP/137
✔✔B4) Tool for OS fingerprinting (5) - ✔✔nmap -A, xprobe2, ARP, ICMP echo reply
TTL can indicate OS, port scans can reveal OS specific host
✔✔B4) Tool for services/ports (2) - ✔✔nmap -sS, -nmap -sU
✔✔B4) Tool for application fingerprinting (2) - ✔✔telnet, openssl
✔✔B4) Tool for network sniffing (2) - ✔✔Wireshark, TCPDump
✔✔B4) Tool for route (2) - ✔✔Tracert / traceroute, ping -r
✔✔B4) Windows and Linux only ports (5 + 1 ) - ✔✔TCP/135, UDP/137, UDP/138,
TCP/139, TCP/445 . Linux (TCP/111)
, ✔✔B4) nmap scan types (6) - ✔✔Full/Vanilla Connect (-sT), Xmas (-sX), FIN (-sF),
NULL (-sN), SYN/Stealth/Halfway (-sS), ACK Flag probing (-sA/-sW)
✔✔B4) High priority targets vs low priority - ✔✔High Priority: Servers and AD (Active
Directory), Firewalls, Routers, etc. Less Priority: Printers and Workstations. If only
conducting a sample, try and have diversity of systems types to test.
✔✔B4) Stealth Scanning Technique (Inverse TCP Flag) - ✔✔Inverse TCP flag scanning
= send with another flag (not SYN) knowing that only closed ports will respond. Flags
include FIN, XMAS and NULL. Getting no response is open, getting RST/ACK is closed.
Effective against Unix but not Windows
✔✔B4) Stealth Scanning Technique (ACK Flag probing) - ✔✔Identify open TCP ports
by sending ACK probe packets and analyzing the header information of the RST
packets received from the target host. Analysis of the time-to-live (TTL) field of received
packets or Analysis of the WINDOW field of received packets.
✔✔B5) Arp Scanning Characteristics - ✔✔Scan a network to find active hosts.
Limitation: Only works on a local network. No routable. Very fast, simple protocol. Does
not use TCP and can scan a class B network. Very reliable. Never blocked. Not
possible for firewall to block unless it is host-based firewall. Disadvantage: IP requires
ARP.
✔✔B5) Arp Scan tools - ✔✔arp-scan runs on Unix/Linux. Not available for Windows
because of pcap. arp-scan works on Ethernet and Wifi.
✔✔B5) Ping sweep tools - ✔✔fping is more flexible/presentable than ping. icmp-scan.
nmap -sP
✔✔B5) TCP Connection to Filtered Port? - ✔✔SYN packet doesn't get any response.
This is different to Closed which is when it gets a RST back
✔✔B5) UDP Scanning via ICMP - ✔✔Can be done with ICMP packets as if it sends
back ICMP Unreachable/Port unreachable if it is open. No response sent if it is not
listening. Can get false positives
✔✔B5) Network sniffing of broadcast protocols? (1+ 4) - ✔✔If plugged into a switched
network you'll only be able to see the broadcast traffic. Spanning Tree Protocol (STP) is
a regular protocol. Cisco Discovery Protocol (CDP) is a broadcast protocol. Only used
by Cisco devices. ARP Requests will tell you potential IP addresses. Map IP address
and MAC address. NetBIOS runs on Windows only, normally giving some information
like system name and IP address.
