A Firewall log showing an attack is shown in Figure Q5. Answer the following questions basedon the log.July 20 14:45:11 % PIX-4-400034: IDS: 6050 DNS host info request from ATTACK.123 to BANK.7on interface outsideJuly 20 14:42:01 %PIX-4-400036: IDS: 6052 DNS high zone transfer request from ATTACK.123 toBANK.7 on interface outsideFigure Q5 Firewall log.(a)(b)(c)(d)Explain why firewall plays a central role in network forensic investigation?What attack is detected by the firewall as shown in Figure Q5? Why a hacker wouldlike to launched this attack?Based on the alert as shown in the figure, did the firewall block the attack? Why or whynot?Based on the alert as shown in the figure, did the DNS misconfigured? Explain youranswer.

Below I have provided the solution of the given question:

A Firewall log showing an attack is shown in Figure Q5. Answer the following questions based on the log. July 20 14:45:11 %PIX-4-400034: IDS: 6050 DNS host info request from ATTACK.123 to BANK.7 on interface outside July 20 14:42:01 %PIX-4-400036: IDS: 6052 DNS high zone transfer request from ATTACK.123 to BANK.7 on interface outside Figure Q5 Firewall log. (a) Explain why firewall plays a central role in network forensic investigation? (b) (c) (d) What attack is detected by the firewall as shown in Figure Q5? Why a hacker would like to launched this attack? Based on the alert as shown in the figure, did the firewall block the attack? Why or why not? Based on the alert as shown in the figure, did the DNS misconfigured? Explain your answer.

A Firewall log showing an attack is shown in Figure Q5. Answer the following questions based on the log. July 20 14:45:11 %PIX-4-400034: IDS: 6050 DNS host info request from ATTACK.123 to BANK.7 on interface outside July 20 14:42:01 %PIX-4-400036: IDS: 6052 DNS high zone transfer request from ATTACK.123 to BANK.7 on interface outside Figure Q5 Firewall log. (a) Explain why firewall plays a central role in network forensic investigation? (b) (c) (d) What attack is detected by the firewall as shown in Figure Q5? Why a hacker would like to launched this attack? Based on the alert as shown in the figure, did the firewall block the attack? Why or why not? Based on the alert as shown in the figure, did the DNS misconfigured? Explain your answer.

Database System Concepts

7th Edition

ISBN:9780078022159

Author:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan

Publisher:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan

Chapter1: Introduction

Section: Chapter Questions

Problem 1PE

See similar textbooks

Similar questions

1) What is the difference between a basic packet filtering firewall and a stateful packet filteringfirewall?2) Which network traffic uses TCP protocol and which uses UDP protocol? Can someone take the time to answer these for me? I'm doing a HW and am stumped.
The HSBC.COM server on the other end of your TCP session hijacking attempt has received a valid connection from your desktop PC. You were attempting to establish a connection to the HSBC.COM server, but an attack stopped that from happening. In light of the relevant security standards, please elaborate on how the existence of this attach might endanger the security of your connection.
Which of these would be a filtering mechanism found in a firewall rule? All of these direction protocol source address
The HSBC.COM server on the other end of your TCP session hijacking attempt has received a valid connection from your desktop PC. You were attempting to establish a connection to the HSBC.COM server, but an attack stopped that from happening. In light of the relevant security standards, please elaborate on how the existence of this attach might endanger the security of your connection.
If a malicious traffic redirection occurs between two VLANs, it has the potential to result in a network intruder being compromised. Identify the tactics used by the assailant Exist any further measures that can be put in place to ensure that this does not happen again in the future?
Question 37 A sophisticated firewall that can implement any programmable set of conditions is called a O guard Obastion host Ⓒircuit level gateway O packet filter O None of the above Question 38 This IDs infers attacks by tracking suspicious activity over multiple packets O heuristic Osignature based O network based pattern based O None of the above Question 39 The most important and versatile tool (control) for network security practitioner is: O encryption O firewall Ⓒintrusion detection system O canary value paging O segmentation O Nore of the above Question 40 A network security strategy that conceals real, internal IP addresses so that they cannot be directly accessed outside the secure perimeter is called Ⓒ NAT ⒸIEEE 763.5 O Address Spoofing OIP injection O None of the above Question 41 An IPS O can take protective responses to detected attacks O make preventative recommendations when attacks are detected O make proscriptive recommendations when attacks are detected All of the…
Remember that TCP/IP's transport stage reassembly and reordering packets. Internet or data layer firewalls may be used if needed. Stateful inspection firewalls cannot detect damaged or missing communication streams.
Your firm has entered into a data-sharing agreement with another business. Both firms' management has determined that they wish to communicate data across their networks through FTP. Data exchange will take place between already-established servers on both sides of the network. You have been tasked with the responsibility of developing a firewall-specific strategy to enable this new connection. What is your strategy? Which would you suggest, and why?
If a network administrator wants to block unwanted incoming SYN-ACK packets then, should he use stateless or stateful filter for the firewall? And why?
Question 26 18 The Web-enabled Mode SSL. VPN installation downloads the Cisco AnyConnect client from a specified network server. 21 True False 24 Question 27 27 Reverse Routing Injection (RRI) is supported when a Csco ASA is configured as a transparent firewall mode 30 True 2. False Question 28 36 Cisco ASA uses an inheritance mndel that pull network & security policies from end-user sessions. 39 True False
The diversion of malicious traffic from one VLAN to another is one method for infiltrating a network. Determine the pattern of attack used by the attacker. Can anything be done to prevent this from occurring?
Explain why using a DNS resolver out on the Internet (i.e., open resolver) can result in poor choice of CDN servers.