|
所在平台: Udemy |
课程主页: https://www.udemy.com/course/sc0-451-tactical-perimeter-defense-certified-practice-exam/
课程评论：没有评论
本课程（SC0-451 战术边界防御认证实践考试）旨在帮助学员掌握网络安全防御的关键技能。课程内容涵盖了多种网络攻击的防范措施以及入侵检测系统的配置和管理。 **核心内容包括：** * **路由器配置与攻击防范：** 通过禁用“IP 有损广播”（no ip directed broadcast）配置，可以防范 Smurf 攻击等利用广播地址进行放大攻击的威胁。 * **Snort 规则编写：** 学习如何编写 Snort 规则来检测和记录特定类型的网络流量，例如日志所有从任何 IP 地址到 10.0.10.0/24 网络中端口 1 到 1024 的 TCP 流量。 * **防火墙策略结构：** 理解防火墙策略文档通常包含哪些关键部分，例如“可接受使用声明”、“网络连接声明”等，这些部分共同构成了网络安全策略的基础。 * **入侵检测系统（IDS）的局限性：** 了解 IDS 在管理硬件故障方面的局限性，例如 IDS 通常无法直接响应硬件故障，而是通过 SNMP 陷阱等方式通知管理员。 * **防火墙策略制定原则：** 探讨制定防火墙策略的两种基本立场：默认拒绝所有流量并仅允许必需流量（Deny All, Permit by Exception），或默认允许所有流量并拒绝已知危险流量（Permit All, Deny by Exception）。 * **防火墙的“购买”与“自建”：** 分析购买商业防火墙相较于自建防火墙的优势，例如易用的管理界面、良好的日志记录和告警功能、实时监控能力等。 本课程通过模拟实际场景和命令配置，帮助学员理解和实践网络边界防御技术，为应对日益复杂的网络安全挑战做好准备。
Sample Questions:You are concerned about attacks against your network, and have decided to implement some defensive measure on your routers. If you have 3 interfaces, S1, S0, and E0, and you implement the following configuration, what attack will you be defending against? Router# config terminal Router(config)# Interface Ethernet 0 Router(config-if)#no ip directed broadcast Router(config-if)#Interface Serial 0 Router (config-if) #no ip directed broadcast Router(config-if)#Interface Serial 1 Router(config-if)#no ip directed broadcast Router(config)#^Z Router#SmurfBO2KSub SevenAny TrojanAny WormYou are configuring your new IDS machine, where you have recently installed Snort. While you are working with this machine, you wish to create some basic rules to test the ability to log traffic as you desire. Which of the following Snort rules will log any tcp traffic from any IP address to any port between 1 and 1024 on any host in the 10.0.10.0/24 network?log tcp 0.0.0.0/24 -> 10.0.10.0/24 11024log tcp any any -> 10.0.10.0/24 11024log tcp any any -> 10.0.10.0/24 1:1024log tcp 0.0.0.0/24 -> 10.0.10.0/24 1:1024log udp any any -> 10.0.10.0/24 1:1024You are in the process of configuring your network firewall policy. As you begin building the content of the policy you start to organize the document into sections. Which of the following are sections found in the firewall policy?The Acceptable Use StatementThe Firewall Administrator StatementThe Network Connection StatementThe Incident Handling StatementThe Escalation Procedures StatementYou have just installed a new Intrusion Detection System in your network. You are concerned that there are functions this system will not be able to perform. What is a reason an IDS cannot manage hardware failures?The IDS can only manage RAID 5 failures.The IDS cannot be programmed to receive SNMP alert messages.The IDS cannot be programmed to receive SNMP trap messages.The IDS cannot be programmed to respond to hardware failures.The IDS can only inform you that an event happened.At a policy meeting you have been given the task of creating the firewall policy. What are the two basic positions you can take when creating the policy?To deny all traffic and permit only that which is required.To permit only IP traffic and filter TCP trafficTo permit only TCP traffic and filter IP trafficTo permit all traffic and deny that which is required.To include your internal IP address as blocked from incoming to prevent spoofing.Your company has created it's security policy and it's time to get the firewall in place. Your group is trying to decide whether to build a firewall or buy one. What are some of the benefits to purchasing a firewall rather than building one?They usually have a good management GUI.They offer good logging and alerting.You do not need to configure them.The OS doesn't need to be hardened before installing the vendor's firewall on it.They often do real time monitoring.
