Summer Sale Coupon - 60% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: c4sbfdisc

Note! SCNS has been withdrawn.

SCNS Practice Exam Questions with Answers SCNS Tactical Perimeter Defense Certification

Question # 6

When installing a firewall, what is the process by which you remove un-needed services and features from a machine to reduce the risk of vulnerabilities to the underlying OS called?

A.

Tightening

B.

Cascading

C.

Streamlining

D.

Cleansing

E.

Hardening

Full Access
Question # 7

Your company has recently become security conscious and wishes to protect it's electronic assets.

What is the first thing you should have in place before configuring rules for your company's firewall?

A.

A Security Policy

B.

AN IDS

C.

A DNS server

D.

An Email server

E.

A WINS server

Full Access
Question # 8

After installing Snort on your Windows machine that is destined to be your IDS, you need to edit the configuration file to customize it to your needs. What is the name of that configuration file?

A.

Snort.cfg

B.

Config.snt

C.

Snort.config

D.

Snort.conf

E.

Config.snort

Full Access
Question # 9

After a meeting between the IT department leaders and a security consultant, they decide to implement

a new IDS in your network. You are later asked to explain to your team the type of IDS that is going to be implemented. Which of the following best describes the process of Host-Based Intrusion Detection Systems?

A.

In a Host-Based IDS sensors are installed in key positions throughout the network, and they all report to the command console. The sensors in this case, are full detection engines that have the ability to sniff network packets, analyze for known signatures, and notify the console with an alert if an intrusion is detected.

B.

Host-Based IDS uses what are known as agents (also called sensors). These agents are in fact small programs running on the hosts that are programmed to detect intrusions upon the host. They communicate with the command console, or a central computer controlling the IDS.

C.

In Host-Based IDS, the agents on the hosts are the ones that perform the analysis of the network traffic.

The intrusion data can be monitored in real-time.

D.

In a Host-Based IDS sensors (also called agents) are placed on each key host throughout the network analyzing the network packets for intrusion indicators. Once an incident is identified the sensor notifies the command console.

E.

In Host-Based IDS, the network traffic data is gathered and sent from the host to a centralized location.

There is no significant performance drop on the hosts because the agents simply gather information and send them elsewhere for analysis. However, due to the nature of the design, there is no possibility of real-time detection and response.

Full Access
Question # 10

Your organization has extensive resources that you must make available to authorized users, through your ISA Server 2006. From the following answers, select the one that is not a feature of ISA Server Content Publishing:

A.

Secure Sockets Layer (SSL) Bridging

B.

Web Caching and Delivery

C.

Web Publishing Load Balancing

D.

Enhanced Multi-factor Authentication

E.

Robust Logging and Reporting

Full Access
Question # 11

You are configuring a L2TP solution between your office and your primary branch office. The CEO has requested a report on the benefits of using this technology. Which of the following benefits does L2TP (with IPSec) provide?

A.

Bandwidth Management

B.

Encryption

C.

User Authentication

D.

Packet Authentication

E.

Key Management

Full Access
Question # 12

You have been hired at a large company to manage network security issues. Prior to your arrival, there was no one dedicated to security, so you are starting at the beginning. You hold a meeting and are discussing the main functions and features of network security. One of your assistants asks what the function of Confidentiality in network security is. Which of the following best describes Confidentiality?

A.

Confidentiality verifies users to be who they say they are. In data communications, authenticating the sender is necessary to verify that the data came from the right source.

B.

Data communications as well as emails need to be protected for privacy and confidentiality. Network security must provide a secure channel for the transmission of data and email that does not allow eavesdropping by unauthorized users. Data confidentiality ensures the privacy of data on the network system.

C.

The security must limit user privileges to minimize the risk of unauthorized access to sensitive information and areas of the network that only authorized users should only be allowed to access.

D.

Security must be established to prevent parties in a data transaction from denying their participation after the business transaction has occurred. This establishes Confidentiality for the transaction itself for all parties involved in the transaction.

E.

Confidentiality is a security principle that ensures the continuous accuracy of data and information stored within network systems. Data must be kept from unauthorized modification, forgery, or any other form of corruption either from malicious threats or corruption that is accidental in nature.

Full Access
Question # 13

You are a host in a network segment that has IP addresses in the range of 10.0.16.1~10.0.31.254. You need to create an access control list that will filter your segment of addresses. Which of the following is the wildcard mask that will be used to filter your network segment?

A.

0.0.15.255

B.

0.0.16.254

C.

255.240.0.0

D.

0.0.240.0

E.

10.0.16.1/20

Full Access
Question # 14

There are several options available to you for your new wireless networking technologies, and you are examining how different systems function. What transmission system uses short bursts combined together as a channel?

A.

Frequency Hopping Spread Spectrum (FHSS)

B.

Direct Sequence Spread Spectrum (DSSS)

C.

Lamar Anthell Transmission (LAT)

D.

Digital Band Hopping (DBH)

E.

Digital Channel Hopping (DCH)

Full Access
Question # 15

The main reason you have been hired at a company is to bring the network security of the organization up to current standards. A high priority is to have a full security audit of the network as soon as possible. You have chosen an Operational Audit and are describing it to your coworkers. Which of the following best describes an Operational audit?

A.

This type of audit is typically done by a contracted external team of security experts who check for policy compliance.

B.

This type of audit is usually done by internal resources to examine the current daily and on-going activities within a network system for compliance with an established security policy.

C.

This type of audit is typically done by an internal team who ensures the security measures are up to international standards.

D.

This type of audit is usually done by the current network administrators who ensure the security measures are up to international standards.

E.

This type of audit is usually conducted by external resources and may be a review or audit of detailed audit logs.

Full Access
Question # 16

You have decided to implement SSH for communicating to your router. What does SSH use to establish a secure channel of communication?

A.

RSA Public Key Cryptography

B.

DES Public Key Cryptography

C.

MD5 Private Key Cryptography

D.

MD5 Public Key Cryptography

E.

RSA Private Key Cryptography

Full Access
Question # 17

Network Monitor was run on a Windows Server 2003. The exhibit shows the actual contents of a Network

Monitor capture file.

SCNS question answer

What are the IP addresses of the source and destination hosts involved in this communication? To help you determine the two hosts, they have been outlined within the captured content.

A.

10.18.10.211 & 10.18.71.12

B.

10.28.33.131 & 10.28.64.20

C.

172.16.30.1 & 172.16.30.2

D.

17.26.30.1 & 19.26.30.2

E.

212.168.15.1 & 192.168.15.2

Full Access
Question # 18

You have been chosen to manage the new security system that is to be implemented next month in your network. You are determining the type of access control to use. What are the two types of Access Control that may be implemented in a network?

A.

Regulatory Access Control

B.

Mandatory Access Control

C.

Discretionary Access Control

D.

Centralized Access Control

E.

Distributed Access Control

Full Access
Question # 19

Your network is going to implement a new IPSec solution. Which of the following IPSec components is used to define the security environment in which the two hosts communicate?

A.

Management Tools

B.

Security Association API

C.

IPSec Driver

D.

IP Policy Agent

E.

IP Security Policy and Security Association

Full Access
Question # 20

What is the function of the following configuration fragment?

Router#configure terminal

Router(config)#line vty 0 4

Router(config-line)#transport input ssh telnet

Router(config-line)#^Z

Router#

A.

The router will attempt to use SSH first, then use Telnet

B.

The router will attempt to use Telnet first, then use SSH

C.

The router will accept only SSH on VTY 0 4

D.

The router will accept both Telnet and SSH connections

E.

The router will accept only Telnet on VTY 0 4

Full Access
Question # 21

For the new Snort rules you are building, it will be required to have Snort examine inside the content of the packet. Which keyword is used to tell Snort to ignore a defined number of bytes before looking inside the packet for a content match?

A.

Depth

B.

Offset

C.

Nocase

D.

Flow_Control

E.

Classtype

Full Access
Question # 22

If you configure an access-list to block the following networks, what are you trying to protect against?

Network 127.0.0.0/8, Network 0.0.0.0/0 Network 10.0.0.0/8 Network 172.16.0.0/16, and Network 168.0.0/16.

A.

You are trying to protect against hijacking

B.

You are trying to protect against spoofing

C.

You are trying to protect against sniffing

D.

You are trying to protect against splicing

E.

You are trying to protect against capturing

Full Access
Question # 23

In order to add to your layered defense, you wish to implement some security configurations on your router. If you wish to have the router work on blocking TCP SYN attacks, what do you add to the end of an ACL statement?

A.

The IP addresses for allowed networks

B.

The port range of allowed applications

C.

The word Established

D.

The word Log

E.

The string: no service udp-small-servers

Full Access
Question # 24

You are considering your options for a new firewall deployment. At which three layers of the OSI model does a stateful packet filtering firewall operate?

A.

Presentation

B.

Data Link

C.

Network

D.

Application

E.

Transport

Full Access
Question # 25

During a network capture in Wireshark, you capture some IP traffic. In the IP Datagram, what is the function of the Protocol field?

A.

This field is used to tell the upper layer protocols that IP is being used.

B.

This field is used to tell the lower layer protocols that IP is being used.

C.

This field is used to define the lower layer protocol to IP.

D.

This field is used to define the upper layer protocol to IP.

E.

This field is used to identify the version of the IP Protocol in use.

Full Access
Question # 26

The main reason you have been hired at a company is to bring the network security of the organization up to current standards. A high priority is to have a full security audit of the network as soon as possible. You have chosen an Independent Audit and are describing it to your coworkers. Which of the following best describes an Independent Audit?

A.

An independent audit is usually conducted by external or outside resources and may be a review or audit of detailed audit logs.

B.

The independent audit is usually done by the current network administrators who ensure the security measures are up to international standards.

C.

The independent audit is typically done by an internal team who ensures the security measures are up to international standards.

D.

The independent audit is usually done by internal resources to examine the current daily and on-going activities within a network system for compliance with an established security policy.

E.

The independent audit is typically done by a contracted outside team of security experts who check for policy compliance.

Full Access
Question # 27

You are monitoring the network traffic on your Frame-Relay Internet connection. You notice a large amount of unauthorized traffic on port 21. You examine the packets, and notice there are no files being transferred. Traffic on what other port must be examined to view any file contents?

A.

20

B.

119

C.

23

D.

80

E.

2021

Full Access
Question # 28

You have just installed a new IDS and are creating the analysis options. Since you wish for your options to be based on time, which of the following will be able to meet your analysis needs?

A.

Interval Analysis

B.

Real-time Analysis

C.

Statistical Analysis

D.

Signature Analysis

E.

Behavioral Use Analysis

Full Access
Question # 29

You have recently been contracted to implement a new firewall solution at a client site. What are the two basic forms of firewall implementations?

A.

Chaining

B.

Stateful

C.

DMZ

D.

Stateless

E.

KMZ

Full Access
Question # 30

You are evaluating the security of different wireless media, and are considering an infrared solution. If an attacker is trying to gain access to an infrared transmission, what will the attacker need?

A.

Powered light source

B.

Beam Integrator

C.

Beam Collider

D.

Beam Splitter

E.

Photon Analyzer

Full Access
Question # 31

You are configuring your new IDS machine, and are creating new rules. You enter the following rule:

Alert tcp any any -> 10.0.10.0/24 any (msg: "SYN-FIN scan detected"; flags: SF;)

What is the effect of this rule?

A.

This is an alert rule, designed to notify you of SYN-FIN scans of the network in one direction.

B.

This is an alert rule, designed to notify you of SYN-FIN scans of the network in either direction.

C.

This is a logging rule, designed to capture SYN-FIN scans.

D.

This is a logging rule, designed to notify you of SYN-FIN scans.

E.

This is an alert rule, designed to notify you of SYN-FIN scans originating from the 10.0.10.0/24 network.

Full Access
Question # 32

You have decided to install Snort on your Windows Server 2003 and are making changes to the default configuration file. You see the following two lines:

include classification.config

include reference.config

What should these two lines read, after you make your changes, on a default installation?

A.

include C:\Snort\etc\classification.config

B.

include C:\Snort\etc\reference.config

C.

include \classification.config

D.

include \reference.config

E.

include //classification.config

F.

include //reference.config

Full Access
Question # 33

You are reconfiguring your networks firewall to create a DMZ using three network interfaces. After configuring the addresses on the interfaces, you are making the required changes in ISA Server 2006. You are going to use Network Template during this configuration change. What Network Template is designed for this firewall topology?

A.

DMZ-Mode

B.

Multi-NIC

C.

3-Node Firewall

D.

3-Leg Perimeter

E.

DMZ-Mode, then select three as the number of NICs to configure

Full Access
Question # 34

You are a host in a network segment that has IP addresses in the range of 168.16.1~192.168.31.254. You need to create an access control list that will filter your segment of addresses. Which of the following is the wildcard mask that will be used to filter your network segment?

A.

10.0.16.1/20

B.

0.0.16.254

C.

255.240.0.0

D.

0.0.240.0

E.

0.0.15.255

Full Access