Cybersecurity · Unit 3 · Paper 3

Securing Networks unit test

A test on this unit alone, marked as a percentage and a letter grade — for the test your class is actually sitting, rather than for May. Answer everything, then submit once: seeing the answer to question 3 before attempting question 4 makes the final percentage meaningless.

Paper 1 Paper 2 Paper 3

Each paper is built from this unit’s 40 terms and is the same for everyone, so a teacher can assign “Unit 3, Paper 3” and every student sits the identical test. Multiple choice is marked objectively; the written sections you mark yourself against the model answer and rubric.

Suggested time 33 min 30 points0/17 attempted

Distributed denial-of-service (DDoS)

Next-generation firewall

ARP poisoning

Stateful firewall

Port scanning

SIEM

Rogue access point

DNS poisoning

DMZ (screened subnet)

SSID broadcast

Lateral movement

Access control list (ACL)

Short answer 1. Define or explain: On-path (man-in-the-middle) attack

3 pts

Short answer 2. Define or explain: Network segmentation

3 pts

Short answer 3. Define or explain: Deauthentication attack

3 pts

Short answer 4. Define or explain: Botnet

3 pts

Free response

6 pts

A company operates a single flat network. Guest Wi-Fi, employee workstations, printers, and the finance database server all share one address range, and the perimeter firewall contains a rule permitting any source to reach any destination on any port, which was added during a troubleshooting session two years ago.

Explain network segmentation and describe how VLANs would be applied in this environment.

Explain the default-deny principle and what is wrong with the existing firewall rule.

Explain the difference between a stateless access control list and a stateful firewall.

Explain what a DMZ is and identify what kind of system belongs in one.

Explain how a zero trust model differs from a traditional perimeter model.

Explain the difference between an intrusion detection system and an intrusion prevention system.