AP Cybersecurity: Topic 3.4/3.5 Quiz

Using multiple internet providers

Blocking all traffic between devices

Encrypting all data on the network

Dividing a network into smaller isolated subnetworks

It limits how far an attack can spread

It removes the need for firewalls

It allows attackers to move faster

It increases internet speed

Port forwarding

Network segmentation with different security policies

Packet sniffing

MAC flooding

To host public-facing systems while protecting the internal network

To connect internal computers directly to the internet

To store employee personal files

To encrypt all web traffic

Network printers

Public web servers and email servers

Employee laptops

Internal file servers

It must go through a router or Layer 3 device

It is broadcast to all devices

It stays inside the switch

It is blocked by default

To speed up network traffic

To encrypt Ethernet frames

To prevent MAC flooding by limiting MAC addresses per port

To block IP addresses

To remove the need for firewalls

To apply different protections where needed

To make the network harder to manage

To avoid using IP addresses

Passwords

Software licenses

Logs from devices and network equipment

Usernames

Encrypt network traffic

Create user accounts

Block malicious traffic automatically

Detect and alert on malicious network activity

A NIPS stores log files

A NIPS only sends email alerts

A NIPS can stop attacks by blocking traffic

A NIPS only analyzes servers

To replace firewalls

To collect and analyze logs from many sources and generate alerts

To manage employee passwords

To host websites

Baselining

Signature-based detection

Anomaly-based detection

Hybrid detection

Reduce network size

Update the signature database regularly

Increase the alert threshold

Disable firewalls

It creates too many false positives

It cannot detect new, unknown attacks

It cannot read logs

It is very slow

Scanning malware signatures

Blocking suspicious IPs

Recording normal network behavior for comparison

Deleting old logs

The attacker’s activity may be treated as normal

The firewall will block all traffic

The system will shut down

The baseline will be encrypted

They look for anything unusual compared to the baseline

They only monitor IP addresses

They only scan emails

They use outdated signatures

It does not generate alerts

It requires both signature updates and heavy data processing

It needs only anomaly detection

It needs only signature databases

When systems stop generating alerts

When analysts become less responsive because too many alerts are false

When logs are deleted

When alerts are encrypted