최신 SC0-502 무료덤프 - SCP Security Certified Program (SCP)

A. You decide to take advantage of the features of Microsoft ISA Server and Checkpoint NG. You implement two firewalls, each with two network cards. From one Ethernet interface of the router, you connect to a Checkpoint firewall, and from the other Ethernet interface on the router, you connect to a Microsoft ISA firewall.
The Checkpoint firewall is connected via one NIC to the router, and the other NIC is connected to the Web and FTP Server. The Microsoft ISA Server is connected via one NIC to the router and the other NIC is connected to the LAN switch.
You perform the following steps and configurations to setup the firewalls:
1.First, you configure the IP Address on both network cards of both firewalls.
2.Second, you select the Floodgate-1, SMART Clients, and Policy Server as the only components
to install and complete the installation of Checkpoint.
3.Third, you configure the Checkpoint firewall so only Web and FTP traffic are allowed inbound.
4.Fourth, you select the Cache Mode option during the install of ISA Server and complete the
installation of Microsoft ISA Server.
5.Fifth, you allow all outbound traffic through the ISA Server.
6.Sixth, you allow only inbound traffic through the ISA Server that is in response to outbound
requests.

B. After you analyze the network, you have decided that you are going to implement a firewall using Microsoft ISA Server. The new firewall will have four NICs. You connect the two Ethernet interfaces on the routers to two of the firewall NICs. You connect one NIC to the Web and FTP server and one NIC to the LAN switch.
You perform the following steps and configurations to setup the firewall:
1.First, you format a new hard drive and install a new copy of Windows 2000 Server.
2.Second, you configure the correct IP Addresses on the four network cards.
3.Third, you install ISA Server into Firewall only mode, and complete the installation.
4.Fourth, you configure all inbound traffic to require the SYN flag to be set, all other inbound
network traffic is denied
5.Fifth, you configure the network card towards the Web and FTP server will only allow ports 80,
20, and 21.
6.Sixth, you configure all outbound traffic to be allowed.

C. After you run an analysis on the network and the MegaCorp needs, you decide to implement a firewall using Checkpoint NG. The firewall will have three NICs. One NIC is connected to the router, one NIC is connected to the Web and FTP server and one NIC is connected to the LAN switch.
You perform the following steps and configurations to setup the firewall:
1.First, you install a new version of Checkpoint NG, selecting the VPN-1 and Firewall-1 components, and complete the installation.
2.Second, you configure the inbound rules to allow only SYN packets that are destined for ports
80, 20, and 21 on the Web and FTP server.
3.Third, you disallow all inbound traffic for the internal network, unless it is in response to an
outbound request.
4.Fourth, you configure anti-spoofing rules on the inbound interface and log those connections to a
log server.

D. After you analyze the company, you decide to implement a firewall using Microsoft ISA Server. You create a DMZ with the Web and FTP server on the network segment between the router and the new firewall. The firewall will have two NICs, one connected to the router, and one connected to the LAN switch.
You perform the following steps and configurations to setup the firewall:
1.First, you install a new version of ISA Server, installed in Firewall mode.
2.Second, you configure the inbound network card to disallow all network traffic that did not
originate from inside the network or from the Web and FTP Server.
3.Third, you configure anti-spoofing rules to prevent spoofing attacks.
4.Fourth, you configure all outbound traffic to be allowed.
5.Fifth, you configure inbound traffic with the SYN flag on to be allowed, and to be logged to a
SYSLOG server inside the network.

E. After analysis, you decide to implement a firewall using Checkpoint NG. You begin by installing a new machine, with a fresh hard drive, and the loading of NG. The new firewall will have four NICs. You connect the two Ethernet interfaces on the routers to two of the firewall NICs. You connect one firewall NIC to the Web and FTP server and one firewall NIC to the LAN switch.
You perform the following steps and configurations to setup the firewall:
1.First, you configure the IP Addresses on all four network cards of the Checkpoint firewall.
2.Second, you select only the VPN-1 & Firewall-1 components to install and complete the
installation of Checkpoint.
3.Third, you configure the only new inbound network traffic to be destined for the WWW and FTP
services on the Web and FTP server
4.Fourth, you block all other incoming traffic.
5.Fifth, you create anti-spoofing rules to block inbound traffic that might be spoofed.
6.Sixth, you configure all traffic to be allowed in the outbound direction

A. There is a clear pattern of attack, starting with general reconnaissance to see which systems are up and running to respond to attack inquiries. Next, the attacks show port scans, looking specifically for open ports on a unique host, and then moving to searching out NetBus and SubSeven servers.
To mitigate these attacks, you do not recommend any new technology. You feel that your firewall, IDS, and routers will properly address these types of attacks.

B. There is a clear attack pattern, where the attacker is looking for packets that are formed with a TTL of 128, followed by a TTL of 44. Finally, the attacker is looking to exploit the NOP SackOK vulnerability.
To mitigate these attacks, you recommend implementing a new firewall on the outside of the router, designed with rules to specifically stop these attacks, allowing the rest of the traffic through to your router and the rest of your perimeter defense.

C. There is a clear attack pattern, where the attacker first is checking to see which hosts will reply to sequential packets, followed by vulnerability checking for the IPLen:20 server vulnerability.
To mitigate these attacks, you recommend reconfiguring the access control lists on the routers, specifically to address the IPLen:20 attack, and to address the sequential packet attack. You recommend that with the router configuration change, the threats will be properly addressed.

D. There is a clear pattern of attack, starting with the attacker looking for hosts that will respond to the ID:3 vulnerability. Once identified, the attacker runs a second set of scans, looking for hosts that are vulnerable to a TOS:0x0 attack, and finally running a scan to check for hosts that are vulnerable to the MSS: 1460 NOP attack.
To mitigate these attacks, you recommend implementing a new firewall on the outside of the router, designed with rules to specifically stop these attacks, allowing the rest of the traffic through to your router and the rest of your perimeter defense.

E. Looking at the traffic, you are unable to identify any pattern of attack. You see normal legitimate traffic, the type of which you see every day. The traffic that you have captured provides you no clues as to the current attacks against your network, and as such you make no recommendations to mitigate.

A. You install Snort on a dedicated machine just inside the router. The machine is designed to send alerts to you when appropriate. You do have some concern that the system will have too many rules to operate efficiently. To address this, you decide to pull the critical rules out of the built-in rule sets, and create one simple rule set that is short and will cover all of the serious incidents that the network might experience.
alert udp any 19 <> $HOME_NET 7 (msg:"DOS UDP Bomb"; classtype:attempted-dos; sid:271;
rev:1;)
alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"DOS Teardrop attack"; id:242;
fragbits:M;
classtype:attempted-dos; sid:270; rev:1;) alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"DDOS TFN Probe"; id: 678; itype: 8; content: "1234";
classtype:attempted-recon; sid:221; rev:1;) alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING NMAP"; dsize: 0; itype: 8;
classtype:attempted-recon; sid:469; rev:1;) alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN XMAS";flags:SRAFPU; classtype:attempted-recon; sid:625; rev:1;) alert tcp $HOME_NET 31337 -> $EXTERNAL_NET 80 (msg:"SCAN synscan microsoft"; id: 39426; flags: SF; classtype:attempted-recon; sid:633; rev:1;)

B. You install your IDS on a dedicated machine just inside the router. The machine is designed to send alerts to you when appropriate. You begin the install by performing a new install of Windows on a clean hard drive.
You install ISS Internet Scanner and ISS System Scanner on the new system. System Scanner is configured to do full backdoor testing, full baseline testing, and full password testing. Internet Scanner is configured with a custom policy you made to scan for all vulnerabilities. You configure both scanners to generate automatic weekly reports and to send you alerts when an incident of note takes place on the network.

C. You configure a new dedicated machine just outside the router and install Snort on that machine. The machine logs all intrusions locally, and you will connect to the machine remotely once each morning to pull the log files to your local machine for analysis.
You run snort with the following command: Snort ev \snort\log snort.conf and using the following rule base:
Alert tcp any any <> any 80 Alert tcp any any <> 10.10.0.0\16 any (content: "Password"; msg:"Password transfer Possible";) Log tcp any any <- 10.10.0.0\16 23 Log tcp any any <> 10.10.0.0\16 1:1024

D. You install Snort on a dedicated machine just outside the router. The machine is designed to send alerts to you when appropriate. You implement the following rule set:
Alert udp any any -> 10.10.0.0\16 (msg: "O\S Fingerprint Detected"; flags: S12;) Alert tcp any any -> 10.10.0.0\16 (msg: "Syn\Fin Scan Detected"; flags: SF;) Alert tcp any any -> 10.10.0.0\16 (msg: "Null Scan Detected"; flags: 0;) Log tcp any any -> 10.10.0.0\16 any
You then install Snort on the web and ftp server, also with this system designed to send you alerts when appropriate. You implement the built-in scan.rules ruleset on the server.

E. You install two computers to run your IDS. One will be a dedicated machine that is on the outside of the router, and the second will be on the inside of the router. You configure the machine on the outside of the router to run Snort, and you combine the default rules of several of the built-in rule sets. You combine the ddos.rules, dos.rules, exploit.rules, icmp.rules, and scan.rules.
On the system that is inside the router, running Snort, you also combine several of the built-in rule sets. You combine the scan.rules, web-cgi.rules, ftp.rules, web-misc.rules, and web-iis.rules. You configure the alerts on the two systems to send you email messages when events are identified. After you implement the two systems, you run some external scans and tests using vulnerability checkers and exploit testing software. You modify your rules based on your tests.

A. Since you are aware of the significance of the password problems, you plan to address the
problem using technology. You write up a plan for Blue that includes the following points: 1.You will reconfigure the Testbed.globalcorp.org domain to control the password problem. 2.You will configure AD in this domain so that complex password policies are required. 3.The complex password policies will include:
a.Password length of at least 8 charactersa.
b.Passwords must be alphanumericb.
c.Passwords must meet Gold Standard of complexityc.
d.Passwords must be changed every 30 daysd.
e.Passwords cannot be reusede.

B. Since you are aware of the significance of the password problems, plan to address the problem
using technology. You write up a plan for Blue that includes the following points:
1.For all executives you recommend no longer using passwords, and instead migrating to a
biometric solution.
2.You will install retinal scanners at every user desktop in the executive building.
3.You will personally enroll each user at each desktop.
4.You will instruct each user on the proper positioning and use of the scanner.
5.The biometric system will replace all passwords for authentication into each user Windows
system.

C. Since you are aware of the significance of the password problems, and since you do not have
unlimited funds, you plan to address this problem through education and through awareness. You
write up a plan for Blue that includes the following points:
1.All end users are to be trained on the methods of making strong passwords
2.All end users are instructed that they are to change their password at a minimum of every 30
days.
3.The administrative staff is to run password-checking utilities on all passwords every 30 days.
4.All end users are to be trained on the importance of never disclosing their password to any other
individual.
5.All end users are to be trained on the importance of never writing down their passwords where
they are clearly visible.

D. Since you are aware of the significance of the password problems, you plan to address the
problem using technology. You write up a plan for Blue that includes the following points:
1.For all executives you recommend no longer using passwords, and instead migrating to a token-
based authentication system.
2.You will install the RSA SecurID time-based token system.
3.You will create SecurID user records for each user to match their domain accounts.
4.You will assign each user record a unique token.
5.You will hand deliver the tokens to the correct executive.
6.Users will be allowed to create their own PIN, which will be 4 characters long.
7.The tokens will replace all passwords for authentication into each user Windows system.

E. Since you are aware of the significance of the password problems, you plan to address the
problem using technology. You write up a plan for Blue that includes the following points:
1.For all executives you recommend no longer using passwords, and instead migrating to a token-
based authentication system.
2.You will install the RSA SecurID challenge-response token system.
3.You will create SecurID user records for each user to match their domain accounts.
4.You will assign each user record a unique token.
5.You will hand deliver the tokens to the correct executive.
6.Users will be required to use tokencodes from the One-Time tokencode list. The tokencodes will
be alphanumeric and will be 4 characters long.
7.The tokens will replace all passwords for authentication into each user Windows system.