A Firewall log showing an attack is shown in Figure Q5. Answer the following questions basedon the log.July 20 14:45:11 % PIX-4-400034: IDS: 6050 DNS host info request from ATTACK.123 to BANK.7on interface outsideJuly 20 14:42:01 %PIX-4-400036: IDS: 6052 DNS high zone transfer request from ATTACK.123 toBANK.7 on interface outsideFigure Q5 Firewall log.(a)(b)(c)(d)Explain why firewall plays a central role in network forensic investigation?What attack is detected by the firewall as shown in Figure Q5? Why a hacker wouldlike to launched this attack?Based on the alert as shown in the figure, did the firewall block the attack? Why or whynot?Based on the alert as shown in the figure, did the DNS misconfigured? Explain youranswer.

Below I have provided the solution of the given question:

A Firewall log showing an attack is shown in Figure Q5. Answer the following questions based on the log. July 20 14:45:11 %PIX-4-400034: IDS: 6050 DNS host info request from ATTACK.123 to BANK.7 on interface outside July 20 14:42:01 %PIX-4-400036: IDS: 6052 DNS high zone transfer request from ATTACK.123 to BANK.7 on interface outside Figure Q5 Firewall log. (a) Explain why firewall plays a central role in network forensic investigation? (b) (c) (d) What attack is detected by the firewall as shown in Figure Q5? Why a hacker would like to launched this attack? Based on the alert as shown in the figure, did the firewall block the attack? Why or why not? Based on the alert as shown in the figure, did the DNS misconfigured? Explain your answer.

A Firewall log showing an attack is shown in Figure Q5. Answer the following questions based on the log. July 20 14:45:11 %PIX-4-400034: IDS: 6050 DNS host info request from ATTACK.123 to BANK.7 on interface outside July 20 14:42:01 %PIX-4-400036: IDS: 6052 DNS high zone transfer request from ATTACK.123 to BANK.7 on interface outside Figure Q5 Firewall log. (a) Explain why firewall plays a central role in network forensic investigation? (b) (c) (d) What attack is detected by the firewall as shown in Figure Q5? Why a hacker would like to launched this attack? Based on the alert as shown in the figure, did the firewall block the attack? Why or why not? Based on the alert as shown in the figure, did the DNS misconfigured? Explain your answer.

Principles of Information Security (MindTap Course List)

6th Edition

ISBN:9781337102063

Author:Michael E. Whitman, Herbert J. Mattord

Publisher:Michael E. Whitman, Herbert J. Mattord

Chapter6: Security Technology: Access Controls, Firewalls, And Vpns

Section: Chapter Questions

Problem 2E

See similar textbooks

Similar questions

Write down two firewall rules on the router using the format below (network interface, protocol, flag, source IP or CIDR, source port, destination IP or CIDR, destination port, action) Rule1: block all of the incoming pings sent to the 172.20.241.0/24 subnet; Rules2: block all of the outgoing pings to any computers outside of the 172.20.241.0/24 subnet. What network attacks can the above firewall rules potentially protect against? Please identify one example of these attacks. Explain how this attack can be conducted and how this attack can be blocked using the rules above. For the file rules in Q4.1, is it for stateful inspection or non-stateful inspection (2pts)? Can a non-stateful inspection firewall detect TCP SYN Flood attack? Why or Why not?
The network address for an organisation’s network is 54.33.112.0/23. Provide the subset of the filter table for a stateless firewall that includes the following rules:- Allows all internal users to establish HTTP with any external hosts but blocks FTP.- Allows external users to browse the company web page at 54.33.112.4- Allow incoming TELNET requests to all organisation hosts apart from those in subnet 54.33.112.0/24THIS IS ALL INFORMATION PROVIDED PLEASE
The network address for an organisation’s network is 54.33.112.0/23. Provide the subset of the filter table for a stateless firewall that includes the following rules: - Allows all internal users to establish HTTP with any external hosts but blocks FTP. - Allows external users to browse the company web page at 54.33.112.4 - Allow incoming TELNET requests to all organisation hosts apart from those in subnet 54.33.112.0/24 THIS IS ALL INFORMATION PROVIDED PLEASE My last question about has not been responded correctly, please you must provide the subset of the filter table for a stateless firewall that includes the following rules.
Your firewall is configured to allow traffic to flow in and out of your network. GIVEN THE SETTING BELOW FOR THE FIREWALL RULE: Rule Name: DNS Rule Source IP: DNS / Source Port: 53 Destination IP: Any / Destination Port: * Protocol: Any What traffic flows through the firewall? IF SOME ACTIVE ATTACKS ARE ADDED FROM THE LIST. Is the rule sufficient to allow traffic to flow for a typical network? Why or why not? Do any of the active attacks now work against machines behind the firewall?
Create a firewall rule for sales to block a specific port. Which port are you blocking? Which protocol uses that port? Provide a screenshot of your work
In addition to source and destination address and port information, stateful firewalls use a state flag to identify the current status of a connection. Which of the following possible state values indicates that the third step in the three-way handshake has been completed and a connection between two hosts has been created?SYN_RECVESTABLISHEDFIN_WAIT1CLOSED
A Smurf attack could be described using which of the following statements? Very large email attachments are sent to the victim’s email address Continually polling all possible Transmission Control Protocol and User Datagram Protocol ports to prevent legitimate connections Sending numerous SYN packets to a server and not replying to the resultant SYN/ACK packets An ICMP Type 8 (ECHO) packet with a spoofed source address is sent to the broadcast address of a large network; each member of that large network responds with an echo response packet to the spoofed source address, which floods the victim
Stateful inspection firewalls forward subsequent packets (non-first packets) mainly based on what? A. MAC address table B. Session table C. Routing table D. FIB tabl
Which of the following is the most crucial function performed by a firewall?Presently, I am working on a packet-filtering program. Please tell me where I may get a set of guidelines to follow.
Can you please help with these questions: What is the difference in detail captured between NetFlow, firewall logs, and raw packet captures? Which would be more useful in investigating malware? Which types of network logs/capture would take more storage space? What kinds of things could firewall and NetFlow logs be useful for over raw packet captures?.
COM Assume a web browser at a client host (212.13.14.16) wants to send a message to a web server (156.10.10.2) but a firewall at the client's gateway (212.13.14.1) is configured to block all outgoing packets to 156.10.10.2. The client does have access to a VPN application (similar to the one used in the labs) and can use it to connect to a VPN server (130.16.10.2). Describe how the client should set up a tunnel to bypass the firewall so that the web browser can send a message to the web server (156.10.10.2). You must trace the pathway of the message originating at the web browser on the client host and headed to the VPN server explaining how it traverses through different layers (application, transport, network etc.) in the client host and finally reaches the VPN server application. You must also trace the relevant hops (i.e., the IP addresses) the packet navigates through along the way. You need not trace the reply message and you also don't need to focus on the encryption details.…
There are events from different web server logs (see below). What can you tell about each row? What is happening in each row? What might be interesting in case of incident investigation? timestamp="09/Mar/2016:11:14:34 +0300" client_ip="73.9.84.166" user_agent="Debian APT-HTTP/1.3 (0.8.16~exp12ubuntu10.26)" url="/precise-security/stable/amd64/Packages.bz2"[09/Mar/2016:11:14:35 +0300] wiki-api.company-realm.ru 25.255.240.122 "GET /_api/frontend/.is_readonly?=&__uid=1120000000006167 HTTP/1.1" 200 "-" "-" "ivanovaa" "companyuid=5986251411438764783" - 717 0.022 0.022[09/Mar/2016:11:14:35 +0300] fml.company-realm.ru 202a:6b8:b010:2048:0:d0c0:5:12 "GET /rest/v2/call/collectPoolFromQueriesRatings/32b86116-e409-11e5-bdc7-0025909427cc?ticket=3201127 HTTP/1.1" 414 "-" "Apache CXF 3.0.4" "-"[09/Mar/2016:11:14:35 +0300] 127.0.0.1:443 127.0.0.1 "GET /ping HTTP/1.0" 200 "-" "KeepAliveClient" "-" "companyuid=-" - 273 0.146 0.146[09/Mar/2016:11:14:34 +0300] st.company-realm.ru 127.0.0.1 "GET…