Test: Module 02 — Networking for Security¶

Instructions: Answer all questions. Write your answers directly below each question.

Total Points: 37 pts (Easy: 5 + Medium: 10 + Hard: 12 + Expert: 10) Bonus Available: 5 pts

Section 1: Easy Questions (1 pt each)¶

Q1. At which OSI layer does ARP operate, and what is an ARP spoofing attack?

Q2. What is the difference between a TCP port in the "open", "closed", and "filtered" states as reported by nmap?

Q3. Which common service transmits credentials in cleartext and on which default port?

Q4. What nmap flag enables service version detection?

Q5. What is banner grabbing, and how is it useful in reconnaissance?

Section 2: Medium Questions (2 pts each)¶

Q6. Explain why an attacker finding SNMP running with the community string "public" is significant. What information can they typically extract?

Q7. Compare TCP SYN scanning (-sS) with TCP connect scanning (-sT) in nmap. When would you use each, and which is more "stealthy"?

Q8. A DNS zone transfer returns all the hostnames in a domain. Why is this a security concern, and how should organizations prevent it?

Q9. Explain how network segmentation limits the impact of a successful compromise. Give a specific example of what an attacker could and could not do in a well-segmented network after compromising one host.

Q10. What is the purpose of the Wireshark display filter tcp.flags.syn == 1 && tcp.flags.ack == 0? What activity would you see if you applied this filter during an nmap scan?

Section 3: Hard Questions (3 pts each)¶

Q11. Write the nmap command to perform a comprehensive scan of a target that: scans all ports, detects service versions, runs default NSE scripts, detects the OS, and saves output in all three formats (nmap, gnmap, xml) to a file called "full_scan".

Q12. You run nmap against an authorized target and find port 21 (FTP) open with vsftpd 2.3.4. Research this version and explain: what known vulnerability exists, what an attacker can do if exploited, and what the fix is.

Q13. Explain the TCP three-way handshake (SYN, SYN/ACK, ACK) and describe exactly how a TCP SYN flood attack (DoS) exploits this mechanism. What server-side mitigations exist?

Q14. Write a Python script (20–30 lines) that checks whether a list of hosts (from a file) has port 22 (SSH) open and, if so, grabs the SSH banner to identify the version. The script must include a rate limit and only connect to RFC 1918 addresses.

# Your code here

Section 4: Expert Questions (5 pts each)¶

Q15. Design a network segmentation architecture for a company with: a web application server, a database server, an HR intranet, and a developer workstation network. Draw an ASCII diagram showing the zones, the traffic allowed between them, and explain what a successful web server compromise could and could not reach.

Q16. Analyze the following nmap output and write a professional reconnaissance finding report section for it. Include: what the exposed services are, which represent the highest risk, what you would test next, and what immediate hardening recommendations you would make.

PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         vsftpd 2.3.4
22/tcp   open  ssh         OpenSSH 4.7p1 Debian 4ubuntu1 (protocol 2.0)
23/tcp   open  telnet      Linux telnetd
25/tcp   open  smtp        Postfix smtpd
80/tcp   open  http        Apache httpd 2.2.8 ((Ubuntu) DAV/2)
139/tcp  open  netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
3306/tcp open  mysql       MySQL 5.0.51a-3ubuntu5
5432/tcp open  postgresql  PostgreSQL DB 8.3.0 - 8.3.7
8180/tcp open  http        Apache Tomcat/Coyote JSP engine 1.1

Bonus Question (+5 pts)¶

Bonus 1. IPv6 is increasingly deployed but many security tools and practices lag behind. Explain two IPv6-specific attack techniques (neighbor discovery spoofing, rogue RA, etc.) and what security teams should do to address IPv6 in their network monitoring and penetration testing scope.