SC0-502 무료 덤프문제 온라인 액세스

Now that you have MegaCorp somewhat under control, you are getting ready to go home for the night. You have made good progress on the network recently, and things seem to be going smoothly. On your way out, you stop by the CEO office and say good night. You are told that you will be meeting in the morning, so try to get in a few minutes early.
The next morning, you get to the office 20 minutes earlier than normal, and the CEO stops by your office, "Thanks for coming in a bit early. No problem really, I just wanted to discuss with you a current need we have with the network."
"OK, go right ahead." You know the network pretty well by now, and are ready for whatever is thrown your way.
"We are hiring 5 new salespeople, and they will all be working from home or on the road. I want to be sure that the network stays safe, and that they can get access no matter where they are."
"Not a problem," you reply. "Il get the plan for this done right away."
"Thanks a lot, if you have any questions for me, just let me know."
You are relieved that there was not a major problem and do some background work for integrating the new remote users. After talking with the CEO more, you find out that the users will be working from there home nearly all the time, with very little access from on the road locations.
The remote users are all using Windows 2000 Professional, and will be part of the domain. The CEO has purchased all the remote users brand new Compaq laptops, just like the one used in the CEO office, and which the CEO takes home each night; complete with DVD\CD-burner drives, built-in WNICs, 17" LCD widescreen displays, oversized hard drives, a gig of memory, and fast processing. wish I was on the road to get one of those, you think.
You start planning and decide that you will implement a new VPN Server next to the Web and FTP Server. You are going to assign the remote users IP Addresses: 10.10.60.100~10.10.60.105, and will configure the systems to run Windows 2000 Professional.
Based on this information, and your knowledge of the MegaCorp network up to this point, choose the best solution for the secure remote user needs:}

• A.You configure the VPN clients first, by installing the VPN High Encryption Service Pack. With this installed, you configure the clients to use RSA, with 1024-bit keys. You configure a shortcut on the desktop that automatically uses the private\public key pair to communicate with the VPN Server, regardless of where the user is locally connected.
  On the VPN Server, you also install the VPN High Encryption Service Pack, and configure 1024bit RSA encryption. You create five new user accounts, and grant them all remote access rights, using Active Directory Sites and Services. You configure the VPN service to send the server public key to the remote users upon the request to configure the tunnel. Once the request is made, the VPN server will build the tunnel, from the server side, to the client.
• B.You begin with configuring the VPN server, which is running Windows 2000 Server. You create five new accounts on that system, granting each of them the Allow Virtual Private Connections right in Active Directory Users and Computers. You then configure the range of IP Addresses to provide to the clients as: 10.10.60.100 through 10.10.60.105. Next, you configure five IPSec Tunnel endpoints on the server, each to use L2TP as the protocol.
  Then, you configure the clients. On each system, you configure a shortcut on the desktop to use to connect to the VPN. The shortcut is configured to create an L2TP IPSec tunnel to the VPN server. The connection itself is configured to exchange keys with the user ISP to create a tunnel between the user ISP endpoint and the MegaCorp VPN Server.
• C.You choose to configure the VPN server first, by installing the VPN High Encryption Service Pack and the HISECVPN.INF built-in security template through the Security Configuration and Analysis Snap-In. Once the Service pack and template are installed, you configure five user accounts and a static pool of IP Addresses for each account.
  You then configure the PPTP service on the VPN server, without using inbound or outbound filters ?due to the protection of the Service Pack. You grant each user the right to dial into the server remotely, and move on to the laptops.
  On each laptop, you install the VPN High Encryption Service Pack, to bring the security level of the laptops up to the same level as the VPN server. You then configure a shortcut on each desktop that controls the direct transport VPN connection from the client to the server.
• D.To start the project, you first work on the laptops you have been given. On each laptop, you configure the system to make a single Internet connection to the user ISP. Next, you configure a shortcut on the desktop for the VPN connection. You design the connection to use L2TP, with port filtering on outbound UDP 500 and UDP 1701. When a user double-clicks the desktop icon you have it configured to make an automatic tunnel to the VPN server.
  On the VPN server, you configure the system to use L2TP with port filtering on inbound UDP 500 and UDP 1701. You create a static pool of assigned IP Address reservations for the five remote clients. You configure automatic redirection on the VPN server in the routing and remote access MMC, so once the client has connected to the VPN server, he or she will automatically be redirected to the inside network, with all resources available in his or her Network Neighborhood.
• E.You decide to start the configuration on the VPN clients. You create a shortcut on the desktop to connect to the VPN Server. Your design is such that the user will simply double-click the shortcut and the client will make the VPN connection to the server, using PPTP. You do not configure any filters on the VPN client systems.
  On the VPN Server, you first configure routing and remote access for the new accounts and allow them to have Dial-In access. You then configure a static IP Address pool for the five remote users. Next, you configure the remote access policy to grant remote access, and you implement the following PPTP filtering:
  Inbound Protocol 47 (GRE) allowed Inbound TCP source port 0, destination port 1723 allowed Inbound TCP source port 520, destination port 520 allowed Outbound Protocol 47 (GRE) allowed Outbound TCP source port 1723, destination port 0 allowed Outbound TCP source port 520, destination port 520 allowed

GlobalCorp is a company that makes state of the art aircraft for commercial and government use. Recently GlobalCorp has been working on the next generation of low orbit space vehicles, again for both commercial and governmental markets.
GlobalCorp has corporate headquarters in Testbed, Nevada, USA. Testbed is a small town, with a population of less than 50,000 people. GlobalCorp is the largest company in town, where most families have at least one family member working there.
The corporate office in Testbed has 4,000 total employees, on a 40-acre campus environment. The largest buildings are the manufacturing plants, which are right next to the Research and Development labs. The manufacturing plants employee approximately 1,000 people and the R&D labs employ 500 people. There is one executive building, where approximately 500 people work. The rest of the employees work in Marketing, Accounting, Press and Investor Relations, and so on. The entire complex has a vast underground complex of tunnels that connect each building.
All critical functions are run from the Testbed office, with remote offices around the world. The remote offices are involved in marketing and sales of GlobalCorp products. These offices also perform maintenance on the GlobalCorp aircraft and will occasionally perform R&D and on-site manufacturing.
There are 5 remote offices, located in: New York, California, Japan, India, and England. Each of the remote offices has a dedicated T3 line to the GlobalCorp HQ, and all network traffic is routed through the Testbed office the remote offices do not have direct Internet connections.
You had been working for two years in the New York office, and have been interviewing for the lead security architect position in Testbed. The lead security architect reports directly to the Chief Security Officer (CSO), who calls you to let you know that you got the job. You are to report to Testbed in one month, just in time for the annual meeting, and in the meantime you review the overview of the GlobalCorp network.

Your first day in GlobalCorp Testbed, you get your office setup, move your things in place, and about the time you turn on your laptop, there is a knock on your door. It is Blue, the Chief Security Officer, who informs you that there is a meeting that you need to attend in a half an hour.
With your laptop in hand, you come to the meeting, and are introduced to everyone. Blue begins the meeting with a discussion on the current state of security in GlobalCorp.
"For several years now, we have constantly been spending more and more money on our network defense, and I feel confident that we are currently well defended." Blue, puts a picture on the wall projecting the image of the network, and then continues, "We have firewalls at each critical point, we have separate Internet access for our public systems, and all traffic is routed through our controlled access points. So, with all this, you might be wondering why I have concern."
At this point a few people seem to nod in agreement. For years, GlobalCorp has been at the forefront of perimeter defense and security. Most in the meeting are not aware that there is much else that could be done.
Blue continues, "Some of you know this, for the rest it is new news: MassiveCorp is moving their offices to the town right next to us here. Now, as you all know, MassiveCorp has been trying to build their orbital systems up to our standards for years and have never been able to do so. So, from a security point of view, I am concerned."
Blue responds, "I suggest trust. Not with MassiveCorp, but in our own systems. We must build trusted networks. We must migrate our network from one that is well-defended to one that is well-defended and one that allows us to trust all the network traffic."
The meeting continues for some time, with Blue leading the discussion on a whole new set of technologies currently not used in the network. After some time, it is agreed upon that GlobalCorp will migrate to a trusted networking environment.
The following week, Blue informs you that you will be working directly together on the development of the planning and design of the trusted network. The network is going to run a full PKI, with all clients and servers in the network using digital certificates. You are grateful that in the past two years, Blue has had all the systems changed to be running only Windows 2000, both server and professional systems, running Active Directory. You think the consistent platform will make the PKI roll out easier.
The entire GlobalCorp network is running Active Directory, with the domain structure as in the following list:
Testbed.globalcorp.org
Newyork.globalcorp.org
California.globalcorp.org
Japan.globalcorp.org
India.globalcorp.org
England.globalcorp.org
Although you will be working in the Testbed office, the plan you develop will need to include the entire GlobalCorp organization. Based on this information, select the solution that describes the best plan for the new trusted network of GlobalCorp:}

• A.You design the plan for two weeks, and then you present it to Blue. Your plan follows these critical steps:
  1.Draft a Certification Practice Statement (CPS) to define what users will be allowed to do with
  their certificates, and a Certificate Policy (CP) to define the technology used to ensure the users
  are able to use their certificates as per the CPS.
  2.Draft a CPF based on your own guidelines, including physical and technology controls.
  3.Design the system to be a full mesh, with the Root CA located in the executive building.
  4.Design the mesh with each remote office and building having it own Root CA.
  5.Build a small test pilot program, to test the hierarchy, and integration with the existing network.
  6.Implement the CA mesh in the executive office, and get all users acclimated to the system.
  7.Implement the CA mesh in each other campus building in Testbed, and get all users acclimated
  to the system.
  8.One at a time, implement the CA mesh in each remote office; again getting all users acclimated
  to the system.
  9.Test the team in each location on proper use and understanding of the overall PKI and their
  portion of the trusted network.
  10.Evaluate the rollout, test, and modify as needed to improve the overall security of the
  GlobalCorp trusted network.
• B.You design the plan for two weeks, and then you present it to Blue. Your plan follows these critical steps:
  1.Draft a Certificate Policy (CP) document to define what users will be allowed to do with their
  certificates, and a Certification Practice Statement (CPS) document to define the technology used
  to ensure the users are able to use their certificates as per the CPS.
  2.Draft a Certificate Practices Framework (CPF) document based on RFC 2527, including every
  primary component.
  3.Design the system to be a full mesh, with the Root CA located in the executive building.
  3.Design the system to be a full mesh, with the Root CA located in the executive building.
  4.Design the mesh with each remote office and building having it own Root CA.
  5.Build a small test pilot program, to test the hierarchy, and integration with the existing network.
  6.Implement the CA mesh in the executive office, and get all users acclimated to the system.
  7.Implement the CA mesh in each other campus building in Testbed, and get all users acclimated
  to the system.
  8.One at a time, implement the CA mesh in each remote office; again getting all users acclimated
  to the system.
  9.Test the team in each location on proper use and understanding of the overall PKI and their
  portion of the trusted network.
  10.Evaluate the rollout, test, and modify as needed to improve the overall security of the
  GlobalCorp trusted network.
• C.You design the plan for two weeks, and then you present it to Blue. Your plan follows these critical steps:
  1.Draft a Certificate Policy (CP) document to define what users will be allowed to do with their
  certificates, and a Certification Practice Statement (CPS) document to define the technology used
  to ensure the users are able to use their certificates as per the CPS.
  2.Draft a Certificate Practices Framework (CPF) document based on RFC 2527, including every
  primary component.
  3.Design the system to be a full hierarchy, with the Root CA located in the executive building.
  Every remote office will have a subordinate CA, and every other building on the campus in
  Testbed will have a subordinate CA.
  4.Design the hierarchy with each remote office and building having it own enrollment CA.
  5.Build a small test pilot program, to test the hierarchy, and integration with the existing network.
  6.Implement the CA hierarchy in the executive office, and get all users acclimated to the system.
  7.Implement the CA hierarchy in each other campus building in Testbed, and get all users
  acclimated to the system.
  8.One at a time, implement the CA hierarchy in each remote office; again getting all users
  acclimated to the system.
  9.Test the team in each location on proper use and understanding of the overall PKI and their
  portion of the trusted network.
  10.Evaluate the rollout, test, and modify as needed to improve the overall security of the
  GlobalCorp trusted network.
• D.You design the plan for two weeks, and then you present it to Blue. Your plan follows these critical steps:
  1.Draft a Certification Practice Statement (CPS) to define what users will be allowed to do with
  their certificates, and a Certificate Policy (CP) to define the technology used to ensure the users
  are able to use their certificates as per the CPS.
  2.Draft a CPF based on your own guidelines, including physical and technology controls.
  3.Design the system, outside of the executive office, to be a full hierarchy, with the Root CA for the
  hierarchy located in the executive building. Every remote office will have a subordinate CA, and
  every other building on the campus in Testbed will have a subordinate CA.
  4.In the executive building, you design the system to be a mesh CA structure, with one CA per
  floor of the building.
  5.Design the hierarchy with each remote office and building having it own enrollment CA.
  6.Build a small test pilot program, to test the hierarchy, and integration with the existing network.
  7.Implement the CA hierarchy in the executive office, and get all users acclimated to the system.
  8.Implement the CA hierarchy in each other campus building in Testbed, and get all users
  acclimated to the system.
  9.One at a time, implement the CA hierarchy in each remote office; again getting all users
  acclimated to the system.
  10.Test the team in each location on proper use and understanding of the overall PKI and their
  portion of the trusted network.
  11.Evaluate the rollout, test, and modify as needed to improve the overall security of the
  GlobalCorp trusted network.
• E.You design the plan for two weeks, and then you present it to Blue. Your plan follows these critical steps:
  1.Draft a Certification Practice Statement (CPS) to define what users will be allowed to do with
  their certificates, and a Certificate Policy (CP) to define the technology used to ensure the users
  are able to use their certificates as per the CPS.
  2.Draft a CPF based on your own guidelines, including physical and technology controls.
  3.Design the system to be a full hierarchy, with the Root CA located in the executive building.
  Every remote office will have a subordinate CA, and every other building on the campus in
  Testbed will have a subordinate CA.
  4.Design the hierarchy with each remote office and building having it's own enrollment CA.
  5.Build a small test pilot program, to test the hierarchy, and integration with the existing network.
  6.Implement the CA hierarchy in the executive office, and get all users acclimated to the system.
  7.Implement the CA hierarchy in each other campus building in Testbed, and get all users
  acclimated to the system.
  8.One at a time, implement the CA hierarchy in each remote office; again getting all users
  acclimated to the system.
  9.Test the team in each location on proper use and understanding of the overall PKI and their
  portion of the trusted network.
  10.Evaluate the rollout, test, and modify as needed to improve the overall security of the
  GlobalCorp trusted network.

GlobalCorp is a company that makes state of the art aircraft for commercial and government use. Recently GlobalCorp has been working on the next generation of low orbit space vehicles, again for both commercial and governmental markets.
GlobalCorp has corporate headquarters in Testbed, Nevada, USA. Testbed is a small town, with a population of less than 50,000 people. GlobalCorp is the largest company in town, where most families have at least one family member working there.
The corporate office in Testbed has 4,000 total employees, on a 40-acre campus environment. The largest buildings are the manufacturing plants, which are right next to the Research and Development labs. The manufacturing plants employee approximately 1,000 people and the R&D labs employ 500 people. There is one executive building, where approximately 500 people work. The rest of the employees work in Marketing, Accounting, Press and Investor Relations, and so on. The entire complex has a vast underground complex of tunnels that connect each building.
All critical functions are run from the Testbed office, with remote offices around the world. The remote offices are involved in marketing and sales of GlobalCorp products. These offices also perform maintenance on the GlobalCorp aircraft and will occasionally perform R&D and on-site manufacturing.
There are 5 remote offices, located in: New York, California, Japan, India, and England. Each of the remote offices has a dedicated T3 line to the GlobalCorp HQ, and all network traffic is routed through the Testbed office the remote offices do not have direct Internet connections.
You had been working for two years in the New York office, and have been interviewing for the lead security architect position in Testbed. The lead security architect reports directly to the Chief Security Officer (CSO), who calls you to let you know that you got the job. You are to report to Testbed in one month, just in time for the annual meeting, and in the meantime you review the overview of the GlobalCorp network:

Your first day in GlobalCorp Testbed, you get your office setup, move your things in place, and about the time you turn on your laptop, there is a knock on your door. It is Orange, the Chief Security Officer, who informs you that there is a meeting that you need to attend in a half an hour.
With your laptop in hand, you come to the meeting, and are introduced to everyone. Orange begins the meeting with a discussion on the current state of security in GlobalCorp.
"For several years now, we have constantly been spending more and more money on our network defense, and I feel confident that we are currently well defended." Orange, puts a picture on the wall projecting the image of the network, and then continues, "We have firewalls at each critical point, we have separate Internet access for our public systems, and all traffic is routed through our controlled access points. So, with all this, you might be wondering why I have concern."
At this point a few people seem to nod in agreement. For years, GlobalCorp has been at the forefront of perimeter defense and security. Most in the meeting are not aware that there is much else that could be done.
Blue continues, "Some of you know this, for the rest it is new news: MassiveCorp is moving their offices to the town right next to us here. Now, as you all know, MassiveCorp has been trying to build their orbital systems up to our standards for years and have never been able to do so. So, from a security point of view, I am concerned."
This is news to most people, Yellow, the Vice President of Research asks, "We have the best in firewalls, we have the best in you and your systems, what are you suggesting?"
The meeting continues for some time, with Orange leading the discussion on a whole new set of technologies currently not used in the network. After some time, it is agreed upon that GlobalCorp will migrate to a trusted networking environment.
The following week, Orange informs you that you will be working directly together on the development of the planning and design of the trusted network. The network is going to run a full PKI, with all clients and servers in the network using digital certificates. You are grateful that in the past two years, Orange has had all the systems changed to be running only Windows 2000, both server and professional systems, running Active Directory. You think the consistent platform will make the PKI roll out easier.
The entire GlobalCorp network is running Active Directory, with the domain structure as in the following list:
Testbed.globalcorp.org
Newyork.globalcorp.org
California.globalcorp.org
Japan.globalcorp.org
India.globalcorp.org
England.globalcorp.org
Although you will be working in the Testbed office, the plan you develop will need to include the entire GlobalCorp organization. Based on this information, select the solution that describes the best plan for the new trusted network of GlobalCorp:}

• A.You design the plan for two weeks, and then you present it to Orange. Your plan follows these
  critical steps:
  1.Draft a Certificate Policy (CP) document to define what users will be allowed to do with their
  certificates, and a Certification Practice Statement (CPS) document to define the technology used
  to ensure the users are able to use their certificates as per the CPS.
  2.Draft a Certificate Practices Framework (CPF) document based on RFC 2527, including every
  primary component.
  3.Design the system to be a full hierarchy, with the Root CA located in the executive building.
  Every remote office will have a subordinate CA, and every other building on the campus in
  Testbed will have a subordinate CA.
  4.Design the hierarchy with each remote office and building having it own enrollment CA.
  5.Build a small test pilot program, to test the hierarchy, and integration with the existing network.
  6.Implement the CA hierarchy in the executive office, and get all users acclimated to the system.
  7.Implement the CA hierarchy in each other campus building in Testbed, and get all users
  acclimated to the system.
  8.One at a time, implement the CA hierarchy in each remote office; again getting all users
  acclimated to the system.
  9.Test the team in each location on proper use and understanding of the overall PKI and their
  portion of the trusted network.
  10.Evaluate the rollout, test, and modify as needed to improve the overall security of the
  GlobalCorp trusted network.
• B.You design the plan for two weeks, and then you present it to Orange. Your plan follows these
  critical steps:A.
  1.Draft a Certification Practice Statement (CPS) to define what users will be allowed to do with
  their certificates, and a Certificate Policy (CP) to define the technology used to ensure the users
  are able to use their certificates as per the CPS.
  2.Draft a CPF based on your own guidelines, including physical and technology controls.
  3.Design the system to be a full hierarchy, with the Root CA located in the executive building.
  Every remote office will have a subordinate CA, and every other building on the campus in
  Testbed will have a subordinate CA.
  4.Design the hierarchy with each remote office and building having it own enrollment CA.
  5.Build a small test pilot program, to test the hierarchy, and integration with the existing network.
  6.Implement the CA hierarchy in the executive office, and get all users acclimated to the system.
  7.Implement the CA hierarchy in each other campus building in Testbed, and get all users
  acclimated to the system.
  8.One at a time, implement the CA hierarchy in each remote office; again getting all users
  acclimated to the system.
  9.Test the team in each location on proper use and understanding of the overall PKI and their
  portion of the trusted network.
  10.Evaluate the rollout, test, and modify as needed to improve the overall security of the
  GlobalCorp trusted network.
• C.You design the plan for two weeks, and then you present it to Orange. Your plan follows these
  critical steps:
  1.Draft a Certification Practice Statement (CPS) to define what users will be allowed to do with
  their certificates, and a Certificate Policy (CP) to define the technology used to ensure the users
  are able to use their certificates as per the CPS.
  2.Draft a CPF based on your own guidelines, including physical and technology controls.
  3.Design the system, outside of the executive office, to be a full hierarchy, with the Root CA for the
  hierarchy located in the executive building. Every remote office will have a subordinate CA, and
  every other building on the campus in Testbed will have a subordinate CA.
  4.In the executive building, you design the system to be a mesh CA structure, with one CA per
  floor of the building.
  5.Design the hierarchy with each remote office and building having it own enrollment CA.
  6.Build a small test pilot program, to test the hierarchy, and integration with the existing network.
  7.Implement the CA hierarchy in the executive office, and get all users acclimated to the system.
  8.Implement the CA hierarchy in each other campus building in Testbed, and get all users
  acclimated to the system.
  9.One at a time, implement the CA hierarchy in each remote office; again getting all users
  acclimated to the system.
  10.Test the team in each location on proper use and understanding of the overall PKI and their
  portion of the trusted network.
  11.Evaluate the rollout, test, and modify as needed to improve the overall security of the
  GlobalCorp trusted network.
• D.You design the plan for two weeks, and then you present it to Orange. Your plan follows these
  critical steps:
  1.Draft a Certificate Policy (CP) document to define what users will be allowed to do with their
  certificates, and a Certification Practice Statement (CPS) document to define the technology used
  to ensure the users are able to use their certificates as per the CPS.
  2.Draft a Certificate Practices Framework (CPF) document based on RFC 2527, including every
  primary component.
  3.Design the system to be a full mesh, with the Root CA located in the executive building.
  4.Design the mesh with each remote office and building having it own Root CA.
  5.Build a small test pilot program, to test the hierarchy, and integration with the existing network.
  6.Implement the CA mesh in the executive office, and get all users acclimated to the system.
  7.Implement the CA mesh in each other campus building in Testbed, and get all users acclimated
  to the system.
  8.One at a time, implement the CA mesh in each remote office; again getting all users acclimated
  to the system.
  9.Test the team in each location on proper use and understanding of the overall PKI and their
  portion of the trusted network.
  10.Evaluate the rollout, test, and modify as needed to improve the overall security of the
  GlobalCorp trusted network.
• E.You design the plan for two weeks, and then you present it to Orange. Your plan follows these
  critical steps:
  1.Draft a Certification Practice Statement (CPS) to define what users will be allowed to do with
  their certificates, and a Certificate Policy (CP) to define the technology used to ensure the users
  are able to use their certificates as per the CPS.
  2.Draft a CPF based on your own guidelines, including physical and technology controls.
  3.Design the system to be a full mesh, with the Root CA located in the executive building.
  4.Design the mesh with each remote office and building having it own Root CA.
  5.Build a small test pilot program, to test the hierarchy, and integration with the existing network.
  6.Implement the CA mesh in the executive office, and get all users acclimated to the system.
  7.Implement the CA mesh in each other campus building in Testbed, and get all users acclimated
  to the system.
  8.One at a time, implement the CA mesh in each remote office; again getting all users acclimated
  to the system.
  9.Test the team in each location on proper use and understanding of the overall PKI and their
  portion of the trusted network.
  10.Evaluate the rollout, test, and modify as needed to improve the overall security of the
  GlobalCorp trusted network.

You go back through your notes to the day that you recommended that the company get a firewall in place. Purple had been convinced that the ISP protected the network, and that a firewall was too much technology on top of the router. Now that you have been given this responsibility, and since you have configured the router already, you wish to get the firewall in place as quickly as possible.
You meet quickly with the CEO and mention that the network currently has no firewall, a serious problem. You inform the CEO that this must be fixed immediately, and that you have several firewall options. For this one instance, the CEO tells you to build the best solution; the decision is not going to be based on direct cost.
Based on your knowledge of and the information you have from MegaCorp, select the best solution to the organization firewall problem:}

• A.After you analyze the company, you decide to implement a firewall using Microsoft ISA Server. You create a DMZ with the Web and FTP server on the network segment between the router and the new firewall. The firewall will have two NICs, one connected to the router, and one connected to the LAN switch.
  You perform the following steps and configurations to setup the firewall:
  1.First, you install a new version of ISA Server, installed in Firewall mode.
  2.Second, you configure the inbound network card to disallow all network traffic that did not
  originate from inside the network or from the Web and FTP Server.
  3.Third, you configure anti-spoofing rules to prevent spoofing attacks.
  4.Fourth, you configure all outbound traffic to be allowed.
  5.Fifth, you configure inbound traffic with the SYN flag on to be allowed, and to be logged to a
  SYSLOG server inside the network.
• B.After you run an analysis on the network and the MegaCorp needs, you decide to implement a firewall using Checkpoint NG. The firewall will have three NICs. One NIC is connected to the router, one NIC is connected to the Web and FTP server and one NIC is connected to the LAN switch.
  You perform the following steps and configurations to setup the firewall:
  1.First, you install a new version of Checkpoint NG, selecting the VPN-1 and Firewall-1 components, and complete the installation.
  2.Second, you configure the inbound rules to allow only SYN packets that are destined for ports
  80, 20, and 21 on the Web and FTP server.
  3.Third, you disallow all inbound traffic for the internal network, unless it is in response to an
  outbound request.
  4.Fourth, you configure anti-spoofing rules on the inbound interface and log those connections to a
  log server.
• C.After analysis, you decide to implement a firewall using Checkpoint NG. You begin by installing a new machine, with a fresh hard drive, and the loading of NG. The new firewall will have four NICs. You connect the two Ethernet interfaces on the routers to two of the firewall NICs. You connect one firewall NIC to the Web and FTP server and one firewall NIC to the LAN switch.
  You perform the following steps and configurations to setup the firewall:
  1.First, you configure the IP Addresses on all four network cards of the Checkpoint firewall.
  2.Second, you select only the VPN-1 & Firewall-1 components to install and complete the
  installation of Checkpoint.
  3.Third, you configure the only new inbound network traffic to be destined for the WWW and FTP
  services on the Web and FTP server
  4.Fourth, you block all other incoming traffic.
  5.Fifth, you create anti-spoofing rules to block inbound traffic that might be spoofed.
  6.Sixth, you configure all traffic to be allowed in the outbound direction
• D.You decide to take advantage of the features of Microsoft ISA Server and Checkpoint NG. You implement two firewalls, each with two network cards. From one Ethernet interface of the router, you connect to a Checkpoint firewall, and from the other Ethernet interface on the router, you connect to a Microsoft ISA firewall.
  The Checkpoint firewall is connected via one NIC to the router, and the other NIC is connected to the Web and FTP Server. The Microsoft ISA Server is connected via one NIC to the router and the other NIC is connected to the LAN switch.
  You perform the following steps and configurations to setup the firewalls:
  1.First, you configure the IP Address on both network cards of both firewalls.
  2.Second, you select the Floodgate-1, SMART Clients, and Policy Server as the only components
  to install and complete the installation of Checkpoint.
  3.Third, you configure the Checkpoint firewall so only Web and FTP traffic are allowed inbound.
  4.Fourth, you select the Cache Mode option during the install of ISA Server and complete the
  installation of Microsoft ISA Server.
  5.Fifth, you allow all outbound traffic through the ISA Server.
  6.Sixth, you allow only inbound traffic through the ISA Server that is in response to outbound
  requests.
• E.After you analyze the network, you have decided that you are going to implement a firewall using Microsoft ISA Server. The new firewall will have four NICs. You connect the two Ethernet interfaces on the routers to two of the firewall NICs. You connect one NIC to the Web and FTP server and one NIC to the LAN switch.
  You perform the following steps and configurations to setup the firewall:
  1.First, you format a new hard drive and install a new copy of Windows 2000 Server.
  2.Second, you configure the correct IP Addresses on the four network cards.
  3.Third, you install ISA Server into Firewall only mode, and complete the installation.
  4.Fourth, you configure all inbound traffic to require the SYN flag to be set, all other inbound
  network traffic is denied
  5.Fifth, you configure the network card towards the Web and FTP server will only allow ports 80,
  20, and 21.
  6.Sixth, you configure all outbound traffic to be allowed.

You are well along your way to getting the MegaCorp security up to what you consider an acceptable level. You feel the security is now solid enough that you can go ahead and some new tests and perform analysis on the network. You plug in your laptop and fire up Snort to see the traffic coming into the network.
You plug in on the outside of the router, to see the unfiltered traffic that the network must deal with. In full promiscuous mode, you collect data for an hour, to filter through it later. Since you captured quite a bit of data, you filter out a few specific lines to analyze.
10\27-23:48:42.126886 0:D0:9:7E:E5:E9 -> 0:D0:9:7F:C:9B type:0x800 len:0x3C
10.0.10.237 -> 10.0.10.234 ICMP TTL:128 TOS:0x0 ID:1185 IpLen:20 DgmLen:36 Type:8 Code:0 ID:3 Seq:289 ECHO =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ 10\27-23:48:42.137906 0:D0:9:7E:E5:E9 -> 0:2:B3:2D:1:4A type:0x800 len:0x3C
10.0.10.237 -> 10.0.10.235 ICMP TTL:128 TOS:0x0 ID:1186 IpLen:20 DgmLen:36 Type:8 Code:0 ID:3 Seq:290 ECHO =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ 10\27-23:48:42.148642 0:D0:9:7E:E5:E9 -> 0:D0:9:7E:F9:DB type:0x800 len:0x3C
10.0.10.237 -> 10.0.10.236 ICMP TTL:128 TOS:0x0 ID:1187 IpLen:20 DgmLen:36 Type:8 Code:0 ID:3 Seq:291 ECHO =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ 10\27-23:48:42.167031 0:D0:9:7E:E5:E9 -> 0:D0:9:68:87:2C type:0x800 len:0x3C
10.0.10.237 -> 10.0.10.238 ICMP TTL:128 TOS:0x0 ID:1190 IpLen:20 DgmLen:36 Type:8 Code:0 ID:3 Seq:292 ECHO =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ 10\27-23:48:42.177247 0:D0:9:7E:E5:E9 -> 0:D0:9:69:48:E3 type:0x800 len:0x3C
10.0.10.237 -> 10.0.10.239 ICMP TTL:128 TOS:0x0 ID:1191 IpLen:20 DgmLen:36 Type:8 Code:0 ID:3 Seq:293 ECHO
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ 10\28-19:09:07.387953 0:D0:9:7E:F9:DB -> 0:2:B3:2D:1:4A type:0x800 len:0x3C 10.0.10.236:57228 -> 10.0.10.235:1 TCP TTL:44 TOS:0x0 ID:24652 IpLen:20 DgmLen:40 ******** Seq: 0x0 Ack: 0x0 Win: 0x400 TcpLen: 20 =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ 10\28-19:09:07.320917 0:D0:9:7E:F9:DB -> 0:2:B3:2D:1:4A type:0x800 len:0x3C 10.0.10.236:57228 -> 10.0.10.235:2 TCP TTL:44 TOS:0x0 ID:52330 IpLen:20 DgmLen:40 ******** Seq: 0x0 Ack: 0x0 Win: 0x400 TcpLen: 20 =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ 10\28-19:09:07.377933 0:D0:9:7E:F9:DB -> 0:2:B3:2D:1:4A type:0x800 len:0x3C 10.0.10.236:57228 -> 10.0.10.235:3 TCP TTL:44 TOS:0x0 ID:10807 IpLen:20 DgmLen:40 ******** Seq: 0x0 Ack: 0x0 Win: 0x400 TcpLen: 20 =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ 10\28-19:09:07.328200 0:D0:9:7E:F9:DB -> 0:2:B3:2D:1:4A type:0x800 len:0x3C 10.0.10.236:57228 -> 10.0.10.235:4 TCP TTL:44 TOS:0x0 ID:40192 IpLen:20 DgmLen:40 ******** Seq: 0x0 Ack: 0x0 Win: 0x400 TcpLen: 20 =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ 10\28-19:09:07.363859 0:D0:9:7E:F9:DB -> 0:2:B3:2D:1:4A type:0x800 len:0x3C 10.0.10.236:57228 -> 10.0.10.235:5 TCP TTL:44 TOS:0x0 ID:20497 IpLen:20 DgmLen:40 ******** Seq: 0x0 Ack: 0x0 Win: 0x400 TcpLen: 20 =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ 10\28-19:09:07.391163 0:D0:9:7E:F9:DB -> 0:2:B3:2D:1:4A type:0x800 len:0x3C 10.0.10.236:57228 -> 10.0.10.235:6 TCP TTL:44 TOS:0x0 ID:30756 IpLen:20 DgmLen:40 ******** Seq: 0x0 Ack: 0x0 Win: 0x400 TcpLen: 20 =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ 10\28-19:09:07.300794 0:D0:9:7E:F9:DB -> 0:2:B3:2D:1:4A type:0x800 len:0x3C 10.0.10.236:57228 -> 10.0.10.235:7 TCP TTL:44 TOS:0x0 ID:3946 IpLen:20 DgmLen:40 ******** Seq: 0x0 Ack: 0x0 Win: 0x400 TcpLen: 20 =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ 10\28-01:52:16.979681 0:D0:9:7E:E5:E9 -> 0:D0:9:7F:C:9B type:0x800 len:0x3E 10.0.10.237:1674 -> 10.0.10.234:31337 TCP TTL:128 TOS:0x0 ID:5277 IpLen:20 DgmLen:48 ******S* Seq: 0x3F2FE2CC Ack: 0x0 Win: 0x4000 TcpLen: 28 TCP Options (4) => MSS: 1460 NOP NOP SackOK =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ 10\28-01:52:16.999652 0:D0:9:7E:E5:E9 -> 0:2:B3:2D:1:4A type:0x800 len:0x3E 10.0.10.237:1675 -> 10.0.10.235:31337 TCP TTL:128 TOS:0x0 ID:5278 IpLen:20 DgmLen:48 ******S* Seq: 0x3F30DB1F Ack: 0x0 Win: 0x4000 TcpLen: 28 TCP Options (4) => MSS: 1460 NOP NOP SackOK =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ 10\28-01:52:17.019680 0:D0:9:7E:E5:E9 -> 0:D0:9:7E:F9:DB type:0x800 len:0x3E 10.0.10.237:1676 -> 10.0.10.236:31337 TCP TTL:128 TOS:0x0 ID:5279 IpLen:20 DgmLen:48 ******S* Seq: 0x3F3183AE Ack: 0x0 Win: 0x4000 TcpLen: 28 TCP Options (4) => MSS: 1460 NOP NOP SackOK =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ 10\28-01:52:17.059669 0:D0:9:7E:E5:E9 -> 0:D0:9:68:87:2C type:0x800 len:0x3E 10.0.10.237:1678 -> 10.0.10.238:31337 TCP TTL:128 TOS:0x0 ID:5282 IpLen:20 DgmLen:48 ******S* Seq: 0x3F332EC2 Ack: 0x0 Win: 0x4000 TcpLen: 28 TCP Options (4) => MSS: 1460 NOP NOP SackOK =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ 10\28-01:52:17.079821 0:D0:9:7E:E5:E9 -> 0:D0:9:69:48:E3 type:0x800 len:0x3E 10.0.10.237:1679 -> 10.0.10.239:31337 TCP TTL:128 TOS:0x0 ID:5283 IpLen:20 DgmLen:48 ******S* Seq: 0x3F3436FA Ack: 0x0 Win: 0x4000 TcpLen: 28 TCP Options (4) => MSS: 1460 NOP NOP SackOK =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ 10\28-01:45:18.733562 0:D0:9:7E:E5:E9 -> 0:D0:9:7F:C:9B type:0x800 len:0x3E 10.0.10.237:1646 -> 10.0.10.234:12345 TCP TTL:128 TOS:0x0 ID:4974 IpLen:20 DgmLen:48 ******S* Seq: 0x38E326F7 Ack: 0x0 Win: 0x4000 TcpLen: 28 TCP Options (4) => MSS: 1460 NOP NOP SackOK =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ 10\28-01:45:18.753691 0:D0:9:7E:E5:E9 -> 0:2:B3:2D:1:4A type:0x800 len:0x3E 10.0.10.237:1647 -> 10.0.10.235:12345 TCP TTL:128 TOS:0x0 ID:4975 IpLen:20 DgmLen:48 ******S* Seq: 0x38E3D2D0 Ack: 0x0 Win: 0x4000 TcpLen: 28 TCP Options (4) => MSS: 1460 NOP NOP SackOK =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ 10\28-01:45:18.773781 0:D0:9:7E:E5:E9 -> 0:D0:9:7E:F9:DB type:0x800 len:0x3E 10.0.10.237:1648 -> 10.0.10.236:12345 TCP TTL:128 TOS:0x0 ID:4976 IpLen:20 DgmLen:48 ******S* Seq: 0x38E4CF5C Ack: 0x0 Win: 0x4000 TcpLen: 28 TCP Options (4) => MSS: 1460 NOP NOP SackOK =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ 10\28-01:45:18.813837 0:D0:9:7E:E5:E9 -> 0:D0:9:68:87:2C type:0x800 len:0x3E 10.0.10.237:1650 -> 10.0.10.238:12345 TCP TTL:128 TOS:0x0 ID:4979 IpLen:20 DgmLen:48 ******S* Seq: 0x38E692B6 Ack: 0x0 Win: 0x4000 TcpLen: 28 TCP Options (4) => MSS: 1460 NOP NOP SackOK =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ 10\28-01:45:18.833772 0:D0:9:7E:E5:E9 -> 0:D0:9:69:48:E3 type:0x800 len:0x3E 10.0.10.237:1651 -> 10.0.10.239:12345 TCP TTL:128 TOS:0x0 ID:4980 IpLen:20 DgmLen:48 ******S* Seq: 0x38E7211C Ack: 0x0 Win: 0x4000 TcpLen: 28 TCP Options (4) => MSS: 1460 NOP NOP SackOK =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
Looking at the types of traffic that are hitting your network, what types of attacks are you dealing with, and what is the best solution for mitigating those attacks?}

• A.There is a clear attack pattern, where the attacker first is checking to see which hosts will reply to sequential packets, followed by vulnerability checking for the IPLen:20 server vulnerability.
  To mitigate these attacks, you recommend reconfiguring the access control lists on the routers, specifically to address the IPLen:20 attack, and to address the sequential packet attack. You recommend that with the router configuration change, the threats will be properly addressed.
• B.Looking at the traffic, you are unable to identify any pattern of attack. You see normal legitimate traffic, the type of which you see every day. The traffic that you have captured provides you no clues as to the current attacks against your network, and as such you make no recommendations to mitigate.
• C.There is a clear attack pattern, where the attacker is looking for packets that are formed with a TTL of 128, followed by a TTL of 44. Finally, the attacker is looking to exploit the NOP SackOK vulnerability.
  To mitigate these attacks, you recommend implementing a new firewall on the outside of the router, designed with rules to specifically stop these attacks, allowing the rest of the traffic through to your router and the rest of your perimeter defense.
• D.There is a clear pattern of attack, starting with general reconnaissance to see which systems are up and running to respond to attack inquiries. Next, the attacks show port scans, looking specifically for open ports on a unique host, and then moving to searching out NetBus and SubSeven servers.
  To mitigate these attacks, you do not recommend any new technology. You feel that your firewall, IDS, and routers will properly address these types of attacks.
• E.There is a clear pattern of attack, starting with the attacker looking for hosts that will respond to the ID:3 vulnerability. Once identified, the attacker runs a second set of scans, looking for hosts that are vulnerable to a TOS:0x0 attack, and finally running a scan to check for hosts that are vulnerable to the MSS: 1460 NOP attack.
  To mitigate these attacks, you recommend implementing a new firewall on the outside of the router, designed with rules to specifically stop these attacks, allowing the rest of the traffic through to your router and the rest of your perimeter defense.