Networks, Linux and Systems: The Technical Foundations of Cybersecurity Quiz

Quiz: Observing the network

Pass mark: 70%. You can retry as many times as you need.

1 You are capturing traffic and want to see only the first packet of each new TCP connection. Which display filter fits best? Single answer tcp.port == 80 dns tcp.flags.syn == 1 && tcp.flags.ack == 0 arp

2 What is the difference between a capture filter and a display filter in Wireshark? (several answers) Multiple answers possible A capture filter decides what is recorded in the first place. A display filter permanently deletes the packets it hides. A display filter only hides packets from the view; they remain in the capture. Both use exactly the same syntax.

3 Why is ARP considered sensitive from a security point of view? Single answer It transmits passwords in clear text. It has no authentication, so false replies can poison the neighbours' ARP cache. It works across the whole Internet, so anyone in the world can use it. It only works on IPv6 networks.

4 Which measures help limit the risks linked to ARP spoofing on a company network? (several answers) Multiple answers possible Dynamic ARP Inspection together with DHCP snooping on managed switches Disabling HTTPS so that traffic is easier to inspect Segmenting the network into smaller VLANs Encrypting traffic end to end (HTTPS, SSH, VPN)

5 A company filters IPv4 traffic carefully with its firewall, but the firewall has no IPv6 rules and its servers have IPv6 enabled. What is the main problem? Single answer IPv6 traffic is automatically converted to IPv4 and filtered. IPv6 cannot cross a firewall. NAT will protect the servers anyway. Traffic reaching the servers over IPv6 may bypass the filtering policy.