IBM Cybersecurity Analyst Professional Certificate • STUDY MODE
PRACTICE QUIZ
QUESTION 1 OF 62
The binary (base 2) number "0101" is how much in decimal (base 10)?
A
3
B
5Correct Answer
C
9
D
1
QUESTION 2 OF 62
The IP address range goes from 0.0.0.0 to 255.255.255.255 and is known as the "four octets". Why are these 4 numbers called octets?
Correct, it takes up 8 digits in binary.
A
They form a total of 8 subranges.
B
This was the eighth version of the IP address range to be adopted by the Internet Standards Committee (and the first to gain widespread acceptance.)
C
The inventor noted the similarity to the "octives" in piano music.
D
The number 255 in decimal takes up 8 digits in binary.Correct Answer
QUESTION 3 OF 62
How many octets are used to define the network portion of the IP address in a Class C network?
A
0
B
1
C
2
D
3Correct Answer
QUESTION 4 OF 62
True or False: A routable protocol is a protocol whose packets may leave your network, pass through your router, and be delivered to a remote network.
Correct, A routable protocol is a protocol whose packets may leave your network, pass through your router, and be delivered to a remote network.
A
TrueCorrect Answer
B
False
QUESTION 5 OF 62
True or False: The destination address is defined in the packet header but the source address is in the packet footer.
Correct, True or False: The destination address is not defined in the packet header but the source address is in the packet footer.
A
True
B
FalseCorrect Answer
QUESTION 6 OF 62
Which network mask belongs to a Class A network?
Correct, network mask of a Class A network
A
255.255.255.0
B
255.0.0.0Correct Answer
C
255.255.255.255
D
0.0.0.0
QUESTION 7 OF 62
IPv6 changes the IP address from a 32 bit address used in IPv4 to a 128 bit address. This results in which of the following?
Correct, many billions of times as many IP addresses.
A
Many billions of times as many possible IP addresses.Correct Answer
B
Four times as many possible IP addresses.
C
The same number of possible IP addresses, but expressed with greater precision.
D
The same number of possible host addresses but many more network addresses.
QUESTION 8 OF 62
Which IPv4 addressing schema would you use to send a message to select group systems on the network?
TCP/IP LAYER 4, TRANSPORT LAYER OVERVIEW
A
Unicast
B
Broadcast
C
Simulcast
D
MulticastCorrect Answer
QUESTION 9 OF 62
True or False: Utilities such as TFTP, DNS and SNMP utilize the UDP transport protocol.
Correct, Utilities such as TFTP, DNS and SNMP utilize the UDP transport protocol.
A
TrueCorrect Answer
B
False
QUESTION 10 OF 62
True or False: The UDP transport protocol is faster than the TCP transport protocol.
Correct, The UDP transport protocol is faster than the TCP transport protocol.
A
TrueCorrect Answer
B
False
QUESTION 11 OF 62
Which four (4) of these are characteristic of the UDP transport protocol?
Correct, you have 3 more to complete this question
TCP/IP LAYER 5, APPLICATION LAYER OVERVIEW
A
Ordered data; duplicate detection
B
UnreliableCorrect Answer
C
Connection-oriented
D
Flow control
E
Unordered data; duplicates possibleCorrect Answer
F
Reliable
G
ConnectionlessCorrect Answer
H
No flow controlCorrect Answer
QUESTION 12 OF 62
What is the primary function of DNS?
Correct, To translate domain names to IP addresses and vice versa.
A
To convert MAC addresses to domain names and vice versa.
B
To translate domain names to IP addresses and vice versa.Correct Answer
C
To filter out domains not authorized access to the local network.
D
To assign domain names to new endpoints.
QUESTION 13 OF 62
How does a new endpoint know the address of the DHCP server?
Correct, The endpoint sends a DHCP Discover broadcast request to all endpoints on the local network.
A
The endpoint sends an inquiry to the gateway and the gateway responds with the address of the DHCP server.
B
The DHCP server is always located on the gateway.
C
The endpoint sends a DHCP Discover broadcast request to all endpoints on the local network.Correct Answer
D
The administrator must input the IP address of the DHCP server in the endpoint)s network configuration.
QUESTION 14 OF 62
Which Syslog layer contains the actual message contents?
A
Syslog Application
B
Syslog ContentCorrect Answer
C
Syslog Message
D
Syslog Transport
QUESTION 15 OF 62
True or False: Setting the correct Syslog Severity Level on systems helps keep the Syslog server from being flooded by the millions of messages that could be generated by these systems.
Correct, Setting the correct Syslog Severity Level on systems helps keep the Syslog server from being flooded by the millions of messages that could be generated by these systems.
A
TrueCorrect Answer
B
False
QUESTION 16 OF 62
True or False: The Syslog message typically includes the severity level, facility code, originator process ID, a time stamp, and the hostname or IP address of the originator device.
Correct, The Syslog message typically includes the severity level, facility code, originator process ID, a time stamp, and the hostname or IP address of the originator device.
A
TrueCorrect Answer
B
False
QUESTION 17 OF 62
Why is port mirroring used?
Correct, To provide a stream of all data entering or leaving a specific port for debugging or analysis work.
FIREWALLS, INTRUSION DETECTION AND INTRUSION PREVENTION SYSTEMS
A
To provide a stream of all data entering or leaving a specific port for debugging or analysis work.Correct Answer
B
To make the network faster by providing two parallel ports through which data can flow.
C
To make the network more reliable by providing a redundant path for all traffic destined for a specific port.
D
To provide an independent data stream for when two processes must operate on the same incoming data.
QUESTION 18 OF 62
What is the main difference between a Next Generation Firewall (NGFW) and a traditional firewall?
Correct, NGFW use sessions.
A
NGFW do essentially the same thing as traditional firewalls but can handle substantially more network traffic per firewall.
B
NGFW use sessions.
C
NGFW inspect both TCP and UDP traffic while traditional firewalls inspect TCP traffic only.Correct Answer
D
NGFW inspect all 7 network layers.
QUESTION 19 OF 62
True or False: Unlike traditional stateful firewalls, next-generation firewalls drill into traffic to identify the applications traversing the network.
Correct, Unlike traditional stateful firewalls, next-generation firewalls drill into traffic to identify the applications traversing the network.
A
TrueCorrect Answer
B
False
QUESTION 20 OF 62
What are the two (2) primary methods used by Intrusion Prevention Systems (IPS) to discover an exploit?
Partially correct, you need to select one more correct answer.
If your nontechnical manager told you that you must configure your traditional second-generation firewalls to block all users on your network from posting messages on Facebook from their office computers, how would you carry out this request?
CLUSTERING AND HIGH AVAILABILITY SYSTEMS
A
You would have to block all social media access from your network.
B
You would have to block any IP addresses used by Facebook.Correct Answer
C
You would have to block all HTTP traffic from entering or leaving your network.
D
Specific sites cannot be blocked using a traditional firewall.
QUESTION 22 OF 62
Which condition should apply in order to achieve effective clustering and failover among your firewalls?
Correct, all answers are valid.
BASICS OF IP ADDRESSING AND THE OSI MODEL
A
The firewall hardware should be identical.
B
The firewall operating systems should be identical.
C
There should be direct connections between the primary and secondary nodes.
D
All of the above.Correct Answer
QUESTION 23 OF 62
How would you express 15 in binary (base 2)?
A
10000
B
01010
C
01111Correct Answer
D
01001
QUESTION 24 OF 62
How many octets are used to define the network portion of the IP address in a Class A network?
A
0
B
3
C
2
D
1Correct Answer
QUESTION 25 OF 62
The device used to separate the network portion of an IP address from the host portion is called what?
A
The host mask.
B
The network separation filter.
C
The address filter.
D
The subnet mask.Correct Answer
QUESTION 26 OF 62
The IP header contains a time-to-live (TTL) value. How is this value expressed?
A
The number of delivery attempts that may be made before the packet is returned to the source address as undeliverable.
B
The number of seconds a packet may live if not delivered.
C
The number of minutes a packet may live if it is not delivered.
D
The number of Layer 3 devices (hubs, routers, etc.) the packet is allowed to pass through before it is dropped.Correct Answer
QUESTION 27 OF 62
Which is the host portion of this IP address 192.168.52.3/24?
A
192.168.52
B
24
C
168.52.3
D
3Correct Answer
QUESTION 28 OF 62
Which network mask belongs to a Class C network?
A
255.255.255.255
B
255.0.0.0
C
0.0.0.0
D
255.255.255.0Correct Answer
QUESTION 29 OF 62
Which IPv4 addressing schema would you use to send a message to all systems on the network?
A
Unicast
B
Multicast
C
Simulcast
D
BroadcastCorrect Answer
QUESTION 30 OF 62
Which three (3) of the following are legitimate IPv6 addressing schemas?
A
Broadcast
B
MulticastCorrect Answer
C
UnicastCorrect Answer
D
AnycastCorrect Answer
QUESTION 31 OF 62
True or False: Utilities such as TFTP, DNS and SNMP utilize the TCP transport protocol.
A
True
B
FalseCorrect Answer
QUESTION 32 OF 62
Which two (2) of these fields are included in a UDP header?
A
Source PortCorrect Answer
B
Source IP Address
C
Destination IP Address
D
Destination PortCorrect Answer
QUESTION 33 OF 62
Which four (4) of these are characteristic of the TCP transport protocol?
A
Unreliable
B
Connection-orientedCorrect Answer
C
Connectionless
D
Ordered data; duplicate detectionCorrect Answer
E
Flow controlCorrect Answer
F
ReliableCorrect Answer
QUESTION 34 OF 62
How does an endpoint know the address of the DNS server?
A
The endpoint sends out a DNS Discover broadcast request to all endpoints on the local network.
B
The endpoint sends an inquiry to the gateway and the gateway responds with the address of the DNS server.
C
It is manually configured in the network settings by the administrator or obtained from the DHCP server.Correct Answer
D
The DNS server is always located on the gateway.
QUESTION 35 OF 62
What is the primary function of DHCP?
A
To translate domain names to IP addresses and vice versa.
B
To collect host names present on a local network segment.
C
To automatically assign IP addresses to systems.Correct Answer
D
To automatically assign MAC addresses to systems.
QUESTION 36 OF 62
Which Syslog layer handles the routing and storage of a Syslog message?
A
Syslog ApplicationCorrect Answer
B
Syslog Content
C
Syslog Message
D
Syslog Transport
QUESTION 37 OF 62
Which of the following flow data are gathered by utilities such as NetFlow?
A
Packet count and byte count.
B
Source and destination TCP/UDP ports.
C
Source and destination IP addresses.
D
Routing and peering data such as TCP flags and protocol.
E
All of the above.Correct Answer
QUESTION 38 OF 62
When a network interface card in operating in promiscuous mode, what action does it take?
A
The NIC sends out one false, or "promiscuous" packet for every legitimate packet it sends to interfere with eavesdropping operations.
B
The NIC forwards promiscuous packets to the Promiscuous Server.
C
The NIC sends all packets to the CPU for processing instead of only those packets indicated for its MAC address.Correct Answer
D
The NIC filters out dangerous or "promiscuous" packets.
QUESTION 39 OF 62
If a packet is allowed to pass through a NGFW based upon the established firewall rules and a new session is established, how does the NGFW treat the next packet it encounters from the same session?
A
Subsequent packets of the same session are automatically allowed.Correct Answer
B
Subsequent packets that arrive within the Session Interval configured for that firewall will be allowed to pass without inspection. The first packet that arrives after the session interval expires will trigger the creation of a new session.
C
Every packet is inspected and allowed or denied based upon the same firewall rules that applied to the first packet.
D
The subsequent packets are inspected based on session-specific rules, not the packet-specific rules that were used to inspect the first packet in the session.
QUESTION 40 OF 62
If your nontechnical manager told you that you must configure your next generation firewalls (NGFW) to block all users on your network from posting messages on Facebook from their office computers, what would be the consequence of carrying out his order?
A
No serious consequence, application-level inspection and blocking can be configured.Correct Answer
B
You would have to block all social media access from your network.
C
You would have to block all access to Facebook from your network.
D
You would have to block all HTTP traffic from entering or leaving your network.
QUESTION 41 OF 62
Monitoring network traffic and comparing it against an established baseline for normal use is an example of which form of intrusion detection?
A
Signature-based detection
B
Statistical anomaly-based detectionCorrect Answer
C
Traffic Variance Analysis
D
Traffic Impact Analysis
QUESTION 42 OF 62
Which are three (3) characteristics of a highly available system?
A
RedundancyCorrect Answer
B
Independence
C
FailoverCorrect Answer
D
Geographically dispersed
E
MonitoringCorrect Answer
QUESTION 43 OF 62
The binary (base 2) number “0101” is how much in decimal (base 10)?
A
3
B
5Correct Answer
C
9
D
1
QUESTION 44 OF 62
The IP address range goes from 0.0.0.0 to 255.255.255.255 and is known as the “four octets”. Why are these 4 numbers called octets?
A
They form a total of 8 subranges.
B
This was the eighth version of the IP address range to be adopted by the Internet Standards Committee (and the first to gain widespread acceptance.)
C
The inventor noted the similarity to the “octives” in piano music.
D
The number 255 in decimal takes up 8 digits in binary.Correct Answer
QUESTION 45 OF 62
True or False: A routable protocol is a protocol whose packets may leave your network, pass through your router, and be delivered to a remote network.
A
TrueCorrect Answer
B
False
QUESTION 46 OF 62
True or False: The destination address is defined in the packet header but the source address is in the packet footer.
A
True
B
FalseCorrect Answer
QUESTION 47 OF 62
Which network mask belongs to a Class A network?
A
255.255.255.0
B
255.0.0.0Correct Answer
C
255.255.255.255
D
0.0.0.0
QUESTION 48 OF 62
IPv6 changes the IP address from a 32 bit address used in IPv4 to a 128 bit address. This results in which of the following?
A
Many billions of times as many possible IP addresses.Correct Answer
B
Four times as many possible IP addresses.
C
The same number of possible IP addresses, but expressed with greater precision.
D
The same number of possible host addresses but many more network addresses.
QUESTION 49 OF 62
Which IPv4 addressing schema would you use to send a message to select group systems on the network?
A
Unicast
B
Broadcast
C
Simulcast
D
MulticastCorrect Answer
QUESTION 50 OF 62
True or False: Utilities such as TFTP, DNS and SNMP utilize the UDP transport protocol.
A
TrueCorrect Answer
B
False
QUESTION 51 OF 62
True or False: The UDP transport protocol is faster than the TCP transport protocol.
A
TrueCorrect Answer
B
False
QUESTION 52 OF 62
Which four (4) of these are characteristic of the UDP transport protocol?
A
Ordered data; duplicate detection
B
UnreliableCorrect Answer
C
Connection-oriented
D
Flow control
E
Unordered data; duplicates possibleCorrect Answer
F
Reliable
G
ConnectionlessCorrect Answer
H
No flow controlCorrect Answer
QUESTION 53 OF 62
What is the primary function of DNS?
A
To convert MAC addresses to domain names and vice versa.
B
To translate domain names to IP addresses and vice versa.Correct Answer
C
To filter out domains not authorized access to the local network.
D
To assign domain names to new endpoints.
QUESTION 54 OF 62
How does a new endpoint know the address of the DHCP server?
A
The endpoint sends an inquiry to the gateway and the gateway responds with the address of the DHCP server.
B
The DHCP server is always located on the gateway.
C
The endpoint sends a DHCP Discover broadcast request to all endpoints on the local network.Correct Answer
D
The administrator must input the IP address of the DHCP server in the endpoint’s network configuration.
QUESTION 55 OF 62
True or False: Setting the correct Syslog Severity Level on systems helps keep the Syslog server from being flooded by the millions of messages that could be generated by these systems.
A
TrueCorrect Answer
B
False
QUESTION 56 OF 62
True or False: The Syslog message typically includes the severity level, facility code, originator process ID, a time stamp, and the hostname or IP address of the originator device.
A
TrueCorrect Answer
B
False
QUESTION 57 OF 62
Why is port mirroring used?
A
To provide a stream of all data entering or leaving a specific port for debugging or analysis work.Correct Answer
B
To make the network faster by providing two parallel ports through which data can flow.
C
To make the network more reliable by providing a redundant path for all traffic destined for a specific port.
D
To provide an independent data stream for when two processes must operate on the same incoming data.
QUESTION 58 OF 62
What is the main difference between a Next Generation Firewall (NGFW) and a traditional firewall?
A
NGFW do essentially the same thing as traditional firewalls but can handle substantially more network traffic per firewall.
B
NGFW use sessions.
C
NGFW inspect both TCP and UDP traffic while traditional firewalls inspect TCP traffic only.Correct Answer
D
NGFW inspect all 7 network layers.
QUESTION 59 OF 62
True or False: Unlike traditional stateful firewalls, next-generation firewalls drill into traffic to identify the applications traversing the network.
A
TrueCorrect Answer
B
False
QUESTION 60 OF 62
What are the two (2) primary methods used by Intrusion Prevention Systems (IPS) to discover an exploit?
If your nontechnical manager told you that you must configure your traditional second-generation firewalls to block all users on your network from posting messages on Facebook from their office computers, how would you carry out this request?
A
You would have to block all social media access from your network.
B
You would have to block any IP addresses used by Facebook.Correct Answer
C
You would have to block all HTTP traffic from entering or leaving your network.
D
Specific sites cannot be blocked using a traditional firewall.
QUESTION 62 OF 62
Which condition should apply in order to achieve effective clustering and failover among your firewalls?
A
The firewall hardware should be identical.
B
The firewall operating systems should be identical.
C
There should be direct connections between the primary and secondary nodes.
D
All of the above.Correct Answer
Ready to test your recall?
The binary (base 2) number "0101" is how much in decimal (base 10)?