Fazil Malik

VPN Interview Questions and Answers

2017-11-10T08:08:00.000-08:00

What is VPN?
Virtual Private Network (VPN) creates a secure network connection over a public network such as the internet. It allows devices to exchange data through a secure virtual tunnel. It uses a combination of security features like encryption, authentication, tunneling protocols, and data integrity to provide secure communication between participating peers.

What is Authentication, Confidentiality & Integrity?
Authentication - Verifies that the packet received is actually from the claimed sender. It verifies the authenticity of sender. Pre-shared Key, Digital Certificate are some methods that can be used for authentication.
Integrity - Ensures that the contents of the packet has not been altered in between by man-in-middle. Hashing Algorithm includes MD5, SHA.
Confidentiality - Encrypts the message content through encryption so that data is not disclosed to unauthorized parties. Encryption algorithms include DES (Data Encryption Standard), 3DES (Triple-DES), AES (Advanced Encryption Standard).

What is Symmetric and Asymmetric Encryption?
In symmetric encryption, a single key is used both to encrypt and decrypt traffic. It is also referred as shared key or shared secret encryption. Symmetric encryption algorithms include DES, 3DES, AES.
In Asymmetric encryption two keys are used to encrypt and decrypt traffic, one for encryption and one for decryption. The most common asymmetric encryption algorithm is RSA.

What is IPSec VPN?
IP Security Protocol VPN means VPN over IP Security. It allows two or more users to communicate in a secure manner by authenticating and encrypting each IP packet of a communication session. IPsec provides data confidentiality, data integrity and data authentication between participating peers.

At what layer IPsec works?
IPsec secures IP traffic at the Layer 3 (Network Layer) of the OSI model.

Name a major drawback of IPSec?
IPSec only supports unicast IP traffic.

What is the difference between Transport and Tunnel mode?
Tunnel mode - Protects data in network-to-network or site-to-site scenarios. It encapsulates and protects the entire IP packet—the payload including the original IP header and a new IP header (protects the entire IP payload including user data).
Transport mode - Protects data in host-to-host or end-to-end scenarios. In transport mode, IPsec protects the payload of the original IP datagram by excluding the IP header (only protects the upper-layer protocols of IP payload (user data)).
IPSec protocols AH and ESP can operate in either transport mode and tunnel mode.

What are the three main security services that IPSec VPN provides?
IPsec offers the following security services:-
1.Peer Authentication.
2.Data confidentiality.
3.Data integrity.

Define Digital Signatures?
Digital signature is an attachment to an electronic message used for security purposes. It is used to verify the authenticity of the sender.

What is Authorization?
Authorization is a security mechanism used to determine user/client privileges or access levels related to network resources, including firewalls, routers, switches and application features. Authorization is normally preceded by authentication and during authorization, It’s system that verifies an authenticated user’s access rules and either grants or refuses resource access.

What is Site to Site and Remote Access VPN?
A site-to-site VPN allows offices in multiple locations to establish secure connections with each other over a public network such as the Internet.
Remote Access VPN allows Remote users to connect to the Headquarters through a secure tunnel that is established over the Internet. The remote user is able to access internal, private web pages and perform various IP-based network tasks.
There are two primary methods of deploying Remote Access VPN:-
1.Remote Access IPsec VPN.
2.Remote Access Secure Sockets Layer (SSL) VPN.

What are the 3 protocols used in IPSec?
1.Authentication Header (AH).
2.Encapsulating Security Payload (ESP).
3.Internet Key Exchange (IKE).

Explain IPsec Protocol Headers?
1.Encapsulating Security Payload (ESP) - It is an IP-based protocol which uses port 50 for communication between IPsec peers. ESP is used to protect the confidentiality, integrity and authenticity of the data and offers anti-replay protection.
Drawback - ESP does not provide protection to the outer IP Header
2.Authentication Header (AH) - It is also an IP-based protocol that uses port 51 for communication between IPsec peers. AH is used to protect the integrity and authenticity of the data and offers anti-replay protection.
Unlike ESP, AH provides protection to the IP header also.
Drawback - AH does not provide confidentiality protection.

How ESP & AH provides anti-replay protection?
Both ESP and AH protocols provide an anti-reply protection based on sequence numbers. The sender increments the sequence number after each transmission, and the receiver checks the sequence number and reject the packet if it is out of sequence.

What is IKE?
It is a hybrid protocol that implements Oakley and SKEME key exchanges inside the Internet Security Association and Key Management Protocol (ISAKMP) framework. It defines the mechanism for creating and exchanging keys. IKE derives authenticated keying material and negotiates SAs that are used for ESP and AH protocols.

At what protocol does IKE works?
IKE uses UDP port 500.

Explain how IKE/ISAKMP Works?
IKE is a two-phase protocol-
Phase 1
IKE phase 1 negotiates the following:-
1.It protects the phase 1 communication itself (using crypto and hash algorithms).
2.It generates Session key using Diffie-Hellman groups.
3.Peers will authenticate each other using pre-shared, public key encryption, or digital signature.
4.It also protects the negotiation of phase 2 communication.

There are two modes in IKE phase 1:-
Main mode - Total Six messages are exchanged in main mode for establishing phase 1 SA.
Aggressive mode - It is faster than the main mode as only three messages are exchanged in this mode to establish phase 1 SA. It is faster but less secure.

At the end of phase 1, a bidirectional ISAKMP/IKE SA (phase 1 SA) is established for IKE communication.

Phase 2
IKE phase 2 protects the user data and establishes SA for IPsec.
There is one mode in IKE phase 2:-
Quick mode - In this mode three messages are exchanged to establish the phase 2 IPsec SA.
At the end of phase 2 negotiations, two unidirectional IPsec SAs (Phase 2 SA) are established for user data—one for sending and another for receiving encrypted data.

Explain the messages exchange between the peers in IKE/ISAKMP?
Phase 1 - Main Mode

MESSAGE 1: Initiator offers Policy proposal which includes encryption, authentication, hashing algorithms (like AES or 3DES, PSK or PKI, MD5 or RSA).
MESSAGE 2: Responder presents policy acceptance (or not).
MESSAGE 3: Initiator sends the Diffie-Helman key and nonce.
MESSAGE 4: Responder sends the Diffie-Helman key and nonce.
MESSAGE 5: Initiator sends ID, preshare key or certificate exchange for authentication.
MESSAGE 6: Responder sends ID, preshare key or certificate exchange for authentication.
Only First Four messages were exchanged in clear text. After that all messages are encrypted.

Phase 2 - Quick Mode

MESSAGE 7: Initiator sends Hash, IPSec Proposal, ID, nonce.
MESSAGE 8: Responder sends Hash, IPSec Proposal, ID, nonce.
MESSAGE 9: Initiator sends signature, hash, ID.
All messages in Quick mode are encrypted.

What is Diffie-Hellman?
DH is a public-key cryptography protocol which allows two parties to establish a shared secret over an insecure communications channel. Diffie-Hellman is used within IKE to establish session keys and is a component of Oakley.

How Diffie-Hellman works?
Each side have a private key which is never passed and a Diffie-Hellman Key (Public Key used for encryption). When both side wants to do a key exchange they send their Public Key to each other. for example Side A get the Public Key of Side B, then using the RSA it creates a shared key which can only be opened on Side B with Side B's Private Key So, even if somebody intercepts the shared key he will not be able to do reverse engineering to see it as only the private key of Side B will be able to open it.

What are Security Associations?
The SAs define the protocols and algorithms to be applied to sensitive packets and specify the keying material to be used by the two peers. SAs are unidirectional and are established per security protocol (AH or ESP).

What is Transform set?
An IKE transform set is a combination of security protocols and algorithms. During the IPsec SA negotiation, the peers agree to use a particular transform set for protecting a particular data flow.

What are Crypto access lists?
Crypto access lists specifies which IP traffic is protected by crypto and which traffic is not protected by crypto. To protect IP traffic "permit" keyword is used in an access list. If the traffic is not to be protected than "deny" keyword is used in access list.

What are Crypto map?
Crypto map is used to pull together the various parts used to set up IPsec SAs including:-
1.Which traffic should be protected by IPsec (crypto access list).
2.Where IPsec-protected traffic should be sent (remote IPsec peer).
3.What IPsec SA should be applied to this traffic (transform sets).
Multiple interfaces can share the same crypto map set in case we want to apply the same policy to multiple interfaces.
If more than one crypto map is created for a given interface than use the sequence number of each map entry to rank the map entries, the lower the seq-num argument the higher the priority.

How do you check the status of the tunnel’s phase 1 & 2 ?
Use following commands to check the status of tunnel phases:-
Phase 1 - show crypto isakmp sa
Phase 2 - show crypto ipsec sa

What is IPsec Virtual Tunnel Interface?
IPSec VTI is the concept of using a dedicated IPsec interface called IPsec Virtual Tunnel Interface for highly scalable IPsec-based VPNs. IPsec VTI provides a routable interface for terminating IPsec tunnels. VTI also allows the encrypting of multicast traffic with IPsec.

What is the difference between Static Crypto Maps and Dynamic Crypto Maps?
Static Crypto Maps are used when peers are predetermined. It is basically used in IPSec site to site VPNs.
Dynamic crypto maps are used with networks where the peers are not always predetermined. It is basically used in IPSEC Remote Access VPNs.
There are two types of IPsec VTI interfaces:
1.Static VTI (SVTI): This can be used for site-to-site IPsec-based VPNs.
2.Dynamic VTI (DVTI): DVTI replaces dynamic crypto maps. It can be used for remote-access VPNs.

What is Cisco Easy VPN?
Remote Access VPN when implemented with IPsec is called Cisco Easy VPN. The Easy VPN is easy to set up, with minimal configuration required at the remote client site. Cisco Easy VPN allows us to define centralized security policies at the head-end VPN device (VPN Server) which are then pushed to the remote site VPN device upon connection.

What is DMVPN?
DMVPN allows IPsec VPN networks to better scale hub-to-spoke and spoke-to-spoke topologies optimizing the performance and reducing latency for communications between sites.
It offers following benefits:-
1. It Optimizes network performance.
2. It Reduces router configuration on the hub.
3.Support for dynamic routing protocols running over the DMVPN tunnels.
4.Support for multicast traffic from hub to spokes.
5.The capability of establishing direct spoke-to-spoke IPsec tunnels for communication between sites without having the traffic to go through the hub.

What are the three phases of DMVPN?
Phase 1 - In phase 1 we use NHRP so that spokes can register themselves with the hub. Only Hub uses a multipoint GRE interface, all spokes will be using regular point-to-point GRE tunnel interfaces which means that there will be no direct spoke-to-spoke communication, all traffic has to go via hub.
The only advantage of the phase I setup is the fact the hub router’s configuration is much simpler. Summarization is possible in phase 1.

Phase 2 - In phase 2 all spokes routers also use multipoint GRE tunnels so we do have direct spoke to spoke tunneling. When a spoke router wants to communicate to another spoke it will send an NHRP resolution request to the hub to find the NBMA IP address of the other spoke. Summarization is not possible in phase 2.
Full Process
1.Spoke 1 forwards a packet with a next hop which is another spoke (spoke 2). There is no NHRP map entry for this spoke so an NHRP resolution request is sent to the hub.
2.The request from spoke 1 contains the tunnel IP address of the spoke 2 so the hub relays the request to spoke 2.
3.Spoke 2 receives the request, adds its own address mapping to it and sends it as an NHRP reply directly to spoke 1.
4.Spoke 2 then sends its own NHRP resolution request to the hub that relays it to spoke 1.
5.Spoke 1 receives the request from spoke 2 via the hub and replies by adding its own mapping to it and sending it directly to spoke 2.
Spoke to Spoke tunnel is established.

Phase 3 - In phase 3 NHRP redirect configured on the hub tells the initiator spoke to look for a better path to the destination spoke. On receiving the NHRP redirect message the spokes communicate with each other over the hub and they have their NHRP replies for the NHRP Resolution Requests that they sent out.
NHRP Shortcut configured on the spoke updates the CEF table. It basically changes the next-hop value for a remote spoke from the initial hub tunnel IP address to the NHRP resolved tunnel IP address of remote spoke.
Summarization is possible in phase 3.

Explain Next Hop Resolution Protocol (NHRP)?
It is a Layer 2 protocol which is used to map a tunnel IP address to an NBMA address. It functions similar to ARP. Hub maintains NHRP database of the public addresses for each spoke. When the spoke boots up, it registers its real address to the hub and queries the NHRP database for real addresses of other spokes so that they can build direct tunnels.

What is GRE?
Generic Routing Encapsulation Protocol is a tunneling protocol developed by Cisco designed to encapsulate IP unicast, multicast and broadcast packets. It uses IP protocol number 47.

Name a major drawback of both GRE & L2TP?
No encryption.

What is SSL VPN? How it is different from IPsec VPN?
SSL VPN provides remote access connectivity from any internet enabled device through a standard web browser and its native SSL encryption. It does not require any special client software at a remote site.In IPsec VPN connection is initiated using a preinstalled VPN client software so it requires installation of a special client software. In SSL VPN connection is initiated through a web browser so it does not requires any special purpose VPN client software, only a web browser is required.

At which Layer does SSL VPN operates?
SSL is an Application layer (Layer 7) cryptographic protocol that provides secure communications over the Internet for web browsing, e-mail and other traffic. It uses TCP port 443.

What are different SSL VPN Modes?
SSL VPN can be deployed in one of the following three modes:-
1.Clientless mode - It works at Layer 7, Clientless mode provides secure access to web resources and web-based content. This mode can be used for accessing most content that you would expect to access in a web browser such as Internet, databases and online tools. Clientless mode also supports common Internet file system (CIFS). Clientless mode is limited to web-based content only. It does not provide access to TCP connections such as SSH or Telnet.

2.Thin client mode - It works at Layer 7 and is also known as port forwarding. Thin client mode provides remote access to TCP-based services such as Telnet, Secure Shell (SSH), Simple Mail Transfer Protocol (SMTP), Internet Message Access Protocol (IMAP) and Post Office Protocol (POP3) applications. Thin client is delivered via a Java applet that is dynamically downloaded from the SSL VPN appliance upon session establishment.

3.Thick client mode - It works at Layer 3 and is also known as tunnel mode or full tunneling client. The thick client mode provides extensive application support through dynamically downloaded SSL VPN Client software or the Cisco AnyConnect VPN client software from the VPN server appliance. This mode delivers a lightweight, centrally configured, and easy-to-support SSL VPN tunneling client that provides full network layer (Layer 3) access to virtually any application.

Explain SSL Handshake?
1.Client initiates by sending a CLIENT HELLO message which contains SSL version that the client supports, in what order the client prefer the versions, Ciphersuits (Cryptographic Algorithms) supported by the client, Random Number.
2.Server will send back a SERVER HELLO message Which contains Version Number (Server selects SSL version that is supported by both the server and the client), Cipher Suits (selected by server the best cipher suite version that is supported by both of them), Session ID, Random Data.
3.Server also sends PKI certificate for authenticating himself signed and verified by Certificate Authority along with the public key for encryption.
4.Server will than send Server Hello Done indicating that the server has finished sending its hello message, and is waiting for a response from the client.
5.Client will sends its certificate if the server has also requested for client authentication in server hello message.
6.Client will sends Client Key Exchange message after calculating the premaster secret with the help of the random values of both the server and the client. This message is sent by encrypting it with the server's public key which was shared through the hello message.
Server will decrypt the premaster secret with its private key. Now both client and server will perform series of steps to generate session keys (symmetric) which will be used for encryption and decryption of data exchanges during SSL session and also to verify its integrity.
7.Client will send CHANGE CIPHER SUITE message informing the server that future messages will be encrypted using session key.
8.Client will send CLIENT FINISH (DONE) message indicating that client is done.
9.Server will also send CHANGE CIPHER SUITE message.
10.Client will also send CLIENT FINISH (DONE) message.

ASA Firewall Interview Questions and Answers [CCIE]

2017-11-10T08:02:00.001-08:00

What is a Firewall?
Firewall is a device that is placed between a trusted and an untrusted network. It deny or permit traffic that enters or leaves network based on pre-configured policies. Firewalls protect inside networks from unauthorized access by users on an outside network. A firewall can also protect inside networks from each other. For example - By keeping a Management network separate from a user network.

What is the difference between Gateway and Firewall?
A Gateway joins two networks together and a network firewall protects a network against unauthorized incoming or outgoing access. Network firewalls may be hardware devices or software programs.

Firewalls works at which Layers?
Firewalls work at layer 3, 4 & 7.

What is the difference between Stateful & Stateless Firewall?
Stateful firewall - A Stateful firewall is aware of the connections that pass through it. It adds and maintains information about users connections in state table, referred to as a connection table. It than uses this connection table to implement the security policies for users connections. Example of stateful firewall are PIX, ASA, Checkpoint.
Stateless firewalls - (Packet Filtering) Stateless firewalls on the other hand, does not look at the state of connections but just at the packets themselves.
Example of a packet filtering firewall is the Extended Access Control Lists on Cisco IOS Routers.

What information does Stateful Firewall Maintains?
Stateful firewall maintains following information in its State table:-
1.Source IP address.
2.Destination IP address.
3.IP protocol like TCP, UDP.
4.IP protocol information such as TCP/UDP Port Numbers, TCP Sequence Numbers, and TCP Flags.

What are the security-levels in Cisco ASA?
ASA uses Security levels to determine the Trustworthiness of a network attached to the respective interface. The security level can be configured between 0 to 100 where higher numbers are more trusted than lower. By default, the ASA allows traffic from a higher security level to a lower security level only.

How can we allow packets from lower security level to higher security level (Override Security Levels)?
We use ACLs to allow packets from lower security level to higher security level.

Same Security level traffic is allowed or denied in ASA?
By default same security level traffic is not allowed. To allow it we use command:-
ASA(config)# same-security-traffic permit inter-interface.

What is the security level of Inside and Outside Interface by default?
Security Level of Inside interface by default is 100. Security Level of Outside Interface by default is 0.

What protocols are inspected by ASA?
By default, TCP and UDP are inspected by ASA.

Does ASA inspects ICMP?
No, ASA does not inspect ICMP by default.

Explain DMZ (Demilitarized Zone) Server?
If we need some network resources such as a Web server or FTP server to be available to outside users we place these resources on a separate network behind the firewall called a demilitarized zone (DMZ). The firewall allows limited access to the DMZ, but because the DMZ only includes the public servers, an attack there only affects the servers and does not affect the inside network.

How does a firewall process a packet?
When a packet is received on the ingress interface, the ASA checks if it matches an existing entry in the connection table. If it does, protocol inspection is carried out on that packet.
----------------------------------------------------------------------------------------------------------------------
If it does not match an existing connection and the packet is either a TCP-SYN packet or UDP packet, the packet is subjected to ACL checks.The reason it needs to be a TCP-SYN packet is because a SYN packet is the first packet in the TCP 3-way handshake. Any other TCP packet that isn’t part of an existing connection is likely an attack.
----------------------------------------------------------------------------------------------------------------------
If the packet is allowed by ACLs and is also verified by translation rules, the packet goes through protocol inspection.
----------------------------------------------------------------------------------------------------------------------
Then, the IP header is translated if NAT is used and if the NAT rule specifies an egress interface, the ASA will virtually forward the packet to this egress interface and then perform a route lookup.
----------------------------------------------------------------------------------------------------------------------
If a route is found that specifies the egress interface, then the Layer-2 header of the packet is re-written and the packet is forwarded out the egress interface.

What are the values for timeout of TCP session, UDP session, ICMP session?
TCP session - 60 minutes
UDP session - 2 minutes
ICMP session - 2 seconds

Explain TCP Flags?
While troubleshooting TCP connections through the ASA, the connection flags shown for each TCP connection provide information about the state of TCP connections to the ASA.

What is the command to see timeout timers?
# sh run timeout

What is the Difference between ports in ASA 8.4 and ASA 8.2?
In ASA 8.4 all ports are Gig ports and in ASA 8.2 all are Ethernet ports.

What is the command to check connection table?
# sh conn

How ASA works in reference to Traceroute?
ASA does not decrement the TTL value in traceroute because it does not want to give its information to others for security purpose. It forwards it without decrementing the TTL Value.

What if we apply ACL as global in ASA?
It will be applied on all interfaces towards inbound. Global option is only in ASA 8.4 not in ASA 8.2

What is the difference in ACL on ASA than on Router?
In router, if we delete one access-control entry whole ACL will be deleted. In ASA, if we will delete one access-control entry whole ACL will not be deleted.

Name some concepts that cannot be configured on ASA?
Line VTY cannot be configured on ASA.
Wildcard mask concept is not present in ASA.
Loopback cannot be configured on ASA.

What is the command to capture packets in ASA?
To capture packet from inside interface:- # capture abc interfacer inside
To see it:- # sh capture abc

What is the command to enable HTTP on ASA?
# http server enable

How to give static route on ASA?
# route outside <Destination IP> <Subnet Mask> < Next Hop>

How to give default route on ASA?
# route outside 0 0 < Next Hop>

What are the different types of ACL in Firewall?
1.Standard ACL
2.Extended ACL
3.Ethertype ACL (Transparent Firewall)
4.Webtype ACL (SSL VPN)

What is Tranparent Firewall?
In Transparent Mode, ASA acts as a Layer 2 device like a bridge or switch and forwards Ethernet frames based on destination MAC-address.

What is the need of Transparent Firewall?
If we want to deploy a new firewall into an existing network it can be a complicated process due to various issues like IP address reconfiguration, network topology changes, current firewall etc. We can easily insert a transparent firewall in an existing segment and control traffic between two sides without having to readdress or reconfigure the devices.

What are the similarities between switch and ASA (in Transparent mode) ?
Both learns which mac addresses are associated with which interface and store them in local mac address table.

What are the differences between switch and ASA (in Transparent mode) ?
ASA does not floods unknown unicast frames that are not found in mac address table.
ASA does not participate in STP.
Switch process traffic at layer 1 & layer 2 while ASA can process traffic from layer 1 to layer 7.

What are the features that are not supported in Transparent mode?
1.Dynamic Routing.
2.Multicasting.
3.QOS.
4.VPNs like IPSec and WebVPN cannot be terminated.
5.ASA cannot act as DHCP relay agent.

Explain Ether-Type ACL?
In Transparent mode, unlike TCP/IP traffic for which security levels are used to permit or deny traffic all non-IP traffic is denied by default. We create Ether-Type ACL to allow NON-IP traffic. We can control traffic like BPDU, IPX etc with Ether-Type ACL.

What is the command to convert ASA into Transparent mode?
# firewall transparent

What is the command to see mode (routed or transparent)?
# sh firewall

Explain Failover?
Failover is a cisco proprietary feature. It is used to provide redundancy. It requires two identical ASAs to be connected to each other through a dedicated failover link. Health of active interfaces and units are monitored to determine if failover has occurred or not.

What are type of Failover?
1.Active/Standby Failover.
2.Active/Active Failover.

What information is exchanged between ASAs over a Failover link?
1.State - Active or standby.
2.Hello Messages.
3.Network Link Status.
4.Mac Addresses.
5.Configuration Replication and Synchronization.

What is the difference between Stateful failover and Stateless failover?
Stateless Failover - When failover occurs all active connections are dropped. Clients need to re-establish connections when the new active unit takes over.
Stateful Failover - The active unit continually passes per-connection state information to the standby unit. After a failover occurs, the same connection information is available at the new active unit. Clients are not required to reconnect to keep the same communication session.

What Information Active unit passes to the standby unit in Stateful Failover?
NAT translation table, TCP connection states, The ARP table, The Layer 2 bridge table (when running in transparent firewall mode), ICMP connection state etc.

What are the Failover Requirements between two devices?
Hardware Requirements - The two units in a failover configuration must be the same model, should have same number and types of interfaces.
Software Requirements - The two units in a failover configuration must be in the same operating modes (routed or transparent single or multiple context). They must have the same software version.

Explain Active/Standby Failover?
In Active/Standby Failover, one unit is the active unit which passes traffic. The standby unit does not actively pass traffic. When Failover occurs, the active unit fails over to the standby unit, which then becomes active. We can use Active/Standby Failover for ASAs in both single or multiple context mode.

Explain Active/Active Failover?
It is only available for ASAs in multiple context mode. In an Active/Active Failover configuration, both ASAs can pass network traffic. In Active/Active Failover, we divide the security contexts on the ASA into Failover Groups. A Failover Group is simply a logical group of one or more security contexts. Each group is assigned to be active on a specific ASA in the failover pair. When Failover occurs, it occurs at the Failover group level.

What is the command to enable Failover?
# Failover

What is the command to see Failover?
# sh failover

Explain Unit Health Monitoring in Failover? How Failover occurs?
The ASA unit determines the health of the other unit by monitoring the failover link. When a unit does not receive three consecutive hello messages on the failover link, it sends hello messages on each interface, including the failover interface, to find whether or not the other unit is responsive.
Based upon the response from the other unit it takes following actions:-
1.If the ASA receives a response on the failover interface, then it does not failover.
2.If the ASA does not receive a response on the failover link, but it does receive a response on another interface, then the unit does not failover. The failover link is marked as failed.
3.If the ASA does not receive a response on any interface, then the standby unit switches to active mode and classifies the other unit as failed.

How active unit is determined in Active/Standby Failover?
1.If a unit boots and detects another unit already running as active, it becomes the standby unit.
2.If a unit boots and does not detect active unit, it becomes the active unit.
3.If both units boot simultaneously, then the primary unit becomes the active unit, and the secondary
unit becomes the standby unit.

Name some commands replicated to standby unit?
All configuration commands except for mode, firewall, and failover lan unit are replicated to standby unit.
# copy running-config startup-config
# write memory

Name some commands that are not replicated to standby unit?
All forms of the copy command except for # copy running-config startup-config
all forms of the write command except for # write memory

Explain Active/Standby Failover & Active/Active Failover in terms of preemption?
In Active/Standby Failover there is no preemption.
In Active/Active Failover preemption is optional.

Explain Security Context?
We can partition a Single ASA into multiple virtual devices, known as Security Contexts. Each Context acts as an independent device, with its own security policy, interfaces, and administrators. Multiple contexts are similar to having multiple standalone devices.

What features are supported in multiple context mode?
Routing tables, Firewall features, IPS, and Management.

What features are not supported in multiple context mode?
VPN and Dynamic Routing Protocols.

Explain System area?
When we boot up in multiple mode from the CLI, we are taken into the system area. The system area is used to create and manage the contexts, configure the physical properties of the interfaces, create VLANs for trunking, create resource classes to restrict the context system resource usage.

What is the admin context?
When the appliance boots up, one context is automatically created called Admin Context which defaults to being the administrative context. Any context can be made administrative context. One of the contexts on our appliance must be the administrative context. An “*” beside a context name indicates that the context is the administrative context.

How ASA classifies packets?
The packet that enters is to be processed by which context is classified by ASA as follows:-
1.Unique Interfaces - If only one context is associated with the ingress interface, the ASA classifies the packet into that context.
2.Unique MAC Addresses - If multiple contexts share an interface, then the interface MAC address is used as classifier. ASA lets us assign a different MAC address in each context to the same shared interface. By default, shared interfaces do not have unique MAC addresses. We can set the MAC addresses manually or we can automatically generate MAC addresses by # mac-address auto command.
3.NAT Configuration - If we do not use unique MAC addresses, then the mapped addresses in our NAT configuration are used to classify packets.

What is the command to switch to multiple context Mode?
# mode multiple
After entering this command the appliance will reboot itself and our current configuration is automatically backed up to flash in case we want to switch back to single mode. The file is called “old_running.cfg.”

What is the command to switch back to single mode?
# mode single

What are different types of NAT in ASA?
Static NAT - A consistent mapping between a real and mapped IP address. It allows Bidirectional traffic initiation.
Dynamic NAT - A group of real IP addresses are mapped to a (usually smaller) group of mapped IP addresses on a first come first served basis. It allows only Unidirectional traffic initiation.
Dynamic Port Address Translation (PAT) - A group of real IP addresses are mapped to a single IP address using a unique source port of that IP address.
Identity NAT - A real address is statically translated to itself, essentially bypassing NAT.

What is Policy NAT?
Policy NAT allows you to NAT by specifying both the source and destination addresses in an extended access list. We can also optionally specify the source and destination ports. Regular NAT can only consider the source addresses, not the destination address.
In Static NAT it is called as Static Policy NAT.
In Dynamic NAT it is called as Dynamic Policy NAT.

Give the order of preference between different types of NAT?
1.Nat exemption.
2.Existing translation in Xlate.
3.Static NAT
- Static Identity NAT
- Static Policy NAT
- Static NAT
- Static PAT
4.Dynamic NAT
- NAT Zero
- Dynamic Policy NAT
- Dynamic NAT
- Dynamic PAT

What is the difference between Auto NAT & Manual NAT?
Auto NAT (Network Object NAT) - It only considers the source address while performing NAT. So, Auto NAT is only used for Static or Dynamic NAT. Auto NAT is configured within an object.
Manual NAT (Twice NAT) - Manual NAT considers either only the source address or the source and destination address while performing NAT. It can be used for almost all types of NAT like NAT exempt, policy NAT etc.
Unlike Auto NAT that is configured within an object, Manual NAT is configured directly from the global configuration mode.

Give NAT Order in terms of Auto NAT & Manual NAT?
NAT is ordered in 3 sections.
Section 1 – Manual NAT
Section 2 – Auto NAT
Section 3 – Manual Nat After-Auto

Network Security Interview Question (Basic + Advanced)

2017-11-10T07:51:00.002-08:00

What is FW Monitor?

Check Point's FW Monitor is a powerful built-in tool for capturing network traffic at the packet level. The FW Monitor utility captures network packets at multiple capture points along the FireWall inspection chains. These captured packets can be inspected later using the WireShark.

What is HSRP Cisco?

In computer networking, the Hot Standby Router Protocol (HSRP) is a Ciscoproprietary redundancy protocol for establishing a fault-tolerant default gateway

How does HSRP work?

“HSRP is a redundancy protocol developed by Cisco to provide gateway redundancy without any additional configuration on the end devices in the subnet. With HSRP configured between a set of routers, they work in concert to present the appearance of a single virtual router to the hosts on the LAN.

What is the trace route?

Traceroute is a utility that records the route (the specific gateway computers at each hop) through the Internet between your computer and a specified destination computer. It also calculates and displays the amount of time each hop took.

How does a TCP trace route work?

Any IP packet will trigger an ICMP "Time Exceeded" response from an intermediate router when the TTL value reaches zero. This could be TCP, UDP, ICMP, or any other. As long as intervening routers will pass the packet, the trace will work. Traditional traceroute uses ICMP echo requests, but this is just by convention.

What protocol does Traceroute use?

ICMP (Internet Control Message Protocol). In an IP packet header there is a field called TTL or time to live. It actually shows the maximum number of nodes a packet can travel. Each intermediate router decreases its value by one and when its value becomes zero, any router receiving this packet will drop it. While dropping the packet, this router will reply an ICMP msg to report the source node that this packet was dropped.

traceroute works as follows:

It starts by sending a packet with TTL equal to 1. The first router getting this packet will drop it(because after decrementing TTL value becomes zero) and sends ICMP back to source. Using this ICMP packet you know the IP address of first intermediate router.

Then traceroute sends another packet with TTL equal to 2. And from the same process we can know address of second intermediate router. And this is continued till destination is reached. From this seven know the path followed by a packet from source to destination.

Another answer:

It uses a combination of UDP and ICMP as described here: Traceroute - Wikipedia

Max size of UDP

65,507 bytes

However the actual limit for the data length, which is imposed by the underlying IPv4 protocol, is 65,507 bytes (65,535 − 8 byte UDP header − 20 byte IP header). In IPv6 jumbograms it is possible to have UDP packets of size greater than 65,535 bytes.

Min 8 bytes

GARP (Generic Attribute Registration Protocol)

GARP (Generic Attribute Registration Protocol) is a local area network (LAN) protocol that defines procedures by which end stations and switches can register and de-register attributes, such as network identifiers or addresses, with each other.

http://searchnetworking.techtarget.com/definition/GARP-Generic-Attribute-Registration-Protocol

What is MSS in TCP?

The maximum segment size (MSS) is a parameter of the options field of the TCPheader that specifies the largest amount of data, specified in bytes, that a computer or communications device can receive in a single TCP segment.

What is TCP MTU option?

A maximum transmission unit (MTU) is the largest size packet or frame, specified in octets (eight-bit bytes), that can be sent in a packet- or frame-based network such as the Internet. The Internet's Transmission Control Protocol (TCP) uses the MTUto determine the maximum size of each packet in any transmission.

MTU is maximum IP packet size of a given link. MSS is Maximum TCP segment size.

MTU is used for fragmentation i.e packet larger than MTU is fragmented.But in case of MSS, packet larger than MSS is discarded.

MSS is specified during TCP handshake basically in SYN and its value can't be changed after the connection is established.

MSS=MTU-40(IP header(20 bytes) + TCP header(20 bytes) )

What are the OSPF LSA Types

OSPF uses a LSDB (link state database) and fills this with LSAs (link state advertisement). Instead of using 1 LSA packet OSPF has many different types of LSAs and in this tutorial I’m going to show all of them to you. Let’s start with an overview:

· LSA Type 1: Router LSA

· LSA Type 2: Network LSA

· LSA Type 3: Summary LSA

· LSA Type 4: Summary ASBR LSA

· LSA Type 5: Autonomous system external LSA

· LSA Type 6: Multicast OSPF LSA

· LSA Type 7: Not-so-stubby area LSA

· LSA Type 8: External attribute LSA for BGP
https://networklessons.com/ospf/ospf-lsa-types-explained/

What is the Port no. of SYS Log
syslog port no 514

What is sys log?

Syslog is a way for network devices to send event messages to a logging server – usually known as a Syslog server. The Syslog protocol is supported by a wide range of devices and can be used to log different types of events.

What is a DORA Process ?

DORA is the the 4 steps process of assigning and IP Address for clients by the DHCP Server.

1. Discover: Sent by the DHCP client to find a willing DHCP server

2. Offer: Sent by a DHCP server to offer to lease to that client a specific IP address (and inform the client of its other parameters)

3. Request: Sent by the DHCP client to ask the server to lease the IPv4 address listed in the Offer message.

4. Acknowledgment: Sent by the DHCP server to assign the address, and to list the mask, default router, and DNS server IP addresses.

What is Packet-Tracer command in ASA?

The packet-tracer command provides detailed information about the packets and how they are processed by the ASA. Packet-tracer allows a firewall administrator to inject a virtual packet into the security appliance and track the flow from ingress to egress. Along the way, the packet is evaluated against flow and route lookups, ACLs, protocol inspection, NAT, and IDS. The power of the utility comes from the ability to simulate real-world traffic by specifying source and destination addresses with protocol and port information.

Checkpoint - tcpdump and fw monitor

What’s the difference between tcpdump and fw monitor ?

Tcpdump displays traffic coming or leaving to/from a firewall interface while fw monitor would also tell you how the packet is going through the firewall including routing and NAT decisions.

Let’s get deeper

FW MONITOR

It captures traffic at 4 important points in the firewall namely i, I, o & O. You would see them in the capture in the same sequence.
i – Preinbound, just where the packet is received on the interface. If you see only this then the packet is dropped by address spoofing or the access rule.
I – Postinbound, where the packet has gone across the incoming interface. If you don’t see the next line in capture after this at ‘o’, you could infer that it’s a routing issue.
For both i & I the interface is the incoming, where the packet enters the firewall.
o – Preoutbound, the place where the packet is received at the exit interface within the firewall. If this is the point beyond which the capture is not seen, then you may need to check NAT.
O- Postoutbound, If you see this then make you are sure that the packet has left the firewall and the ACL, route and NAT all are working as expected.

fw monitor -e "accept src=10.1.1.201 or dst=10.1.1.201;" -o monitor2.out

TCPDUMP.

It captures at position i & O of firewall monitor, and you can be sure the traffic has left the firewall. This is similar to the way captures work on a Cisco PIX/ASA.

So, which one you use ?

Consider you run tcpdump and see the incoming traffic but don’t see the traffic leaving the exit interface. You can guess it’s a routing or a NAT issue. But to make a sure shot without wasting time by looking in routes or the NAT rules you could run fw monitor and know what the issue is.

ARP Message Format

2017-11-10T07:48:00.001-08:00

ARP Message Format

Address resolution using ARP is accomplished through the exchange of messages between the source device seeking to perform the resolution, and the destination device that responds to it. As with other protocols, a special message format is used containing the information required for each step of the resolution process.

ARP messages use a relatively simple format. It includes a field describing the type of message (its operational code or opcode) and information on both layer two and layer three addresses. In order to support addresses that may be of varying length, the format specifies the type of protocol used at both layer two and layer three and the length of addresses used at each of these layers. It then includes space for all four of the address combinations we saw in the previous topic.

The format used for ARP messages is described fully in Table 42, and illustrated in Figure 49.

**Table 42: Address Resolution Protocol (ARP) Message Format**
Field Name	Size (bytes)	Description
*HRD*	2
*PRO*	2	*Protocol Type:* This field is the complement of the Hardware Type field, specifying the type of layer three addresses used in the message. For IPv4 addresses, this value is 2048 (0800 hex), which corresponds to the EtherType code for the Internet Protocol.
*HLN*	1	*Hardware Address Length:* Specifies how long hardware addresses are in this message. For Ethernet or other networks using IEEE 802 MAC addresses, the value is 6.
*PLN*	1	*Protocol Address Length:* Again, the complement of the preceding field; specifies how long protocol (layer three) addresses are in this message. For IP(v4) addresses this value is of course 4.
OP	2
*SHA*	(Variable, equals value in HLNfield)	*Sender Hardware Address:* The hardware (layer two) address of the device sending this message (which is the IP datagram source device on a request, and the IP datagram destination on a reply, as discussed in the topic on ARP operation).
*SPA*	(Variable, equals value in PLNfield)	*Sender Protocol Address:* The IP address of the device sending this message.
*THA*	(Variable, equals value in HLNfield)	*Target Hardware Address:* The hardware (layer two) address of the device this message is being sent to. This is the IP datagram destination device on a request, and the IP datagram source on a reply)
*TPA*	(Variable, equals value in PLNfield)	*Target Protocol Address:* The IP address of the device this message is being sent to.

Top 7 TCP/IP Utilities Every Networking Pro Should Know

2017-11-10T07:45:00.003-08:00

If you're planning on pursuing a field in networking or just looking to expand your networking knowledge then this article is for you. TCP/IP utilities are essential -- not only will they help you on your networking exams but you'll be able to diagnose most TCP/IP problems and begin working on solutions.

The top 7 tools that I will talk about today include: Ping, Tracert, ARP, Netstat, Nbtstat, NSLookup, and IPconfig. These tools will help you to check the status of your network and allow you to troubleshoot and test connectivity to remote hosts.

You use these utilities in Dos and you get there by clicking on Start, going to Run and typing cmd.

Here are the top 7 TCP/IP utilities and their functions.

1. Ping

The PING utility tests connectivity between two hosts. PING uses a special protocol called the Internet Control Message Protocol (ICMP)to determine whether the remote machine (website, server, etc.) can receive the test packet and reply.

Also a great way to verify whether you have TCP/IP installed and your Network Card is working.

We'll start by Pinging the loopback address (127.0.0.1) to verify that TCP/IP is installed and configured correctly on the local computer.

Type: PING 127.0.0.1

This tells me that TCP/IP is working as well as my Network Card.

To test out connectivity to a website all you have to do is type: ping espn.com

The results should tell you if the connection was successful or if you had any lost packets.

Packet loss describes a condition in which data packets appear to be transmitted correctly at one end of a connection, but never arrive at the other. Why? Well, there are a few possibilities.

The network connection might be poor and packets get damaged in transit or the packet was dropped at a router because of internet congestion. Some Internet Web servers may be configured to disregard ping requests for security purposes.

Note the IP address of espn.com -- 199.181.132.250. You can also ping this address and get the same result.

However, Ping is not just used to test websites. It can also test connectivity to various servers: DNS, DHCP, your Print server, etc. As you get more into networking you'll realize just how handy the Ping utility can be.

2. Tracert

Tracert is very similar to Ping, except that Tracert identifies pathways taken along each hop, rather than the time it takes for each packet to return (ping).

If I have trouble connecting to a remote host I will use Tracert to see where that connection fails. Any information sent from a source computer must travel through many computers / servers / routers (they're all the same thing, essentially) before it reaches a destination.

It may not be your computer but something that is down along the way. It can also tell you if communication is slow because a link has gone down between you and the destination.

If you know there are normally 4 routers but Tracert returns 8 responses, you know your packets are taking an indirect route due to a link being down.

3. ARP

The ARP utility helps diagnose problems associated with the Address Resolution Protocol (ARP).

TCP/IP hosts use ARP to determine the physical (MAC) address that corresponds with a specific IP address. Type arp with the – a option to display IP addresses that have been resolved to MAC addresses recently.

4. Netstat

Netstat (Network Statistics) displays network connections (both incoming and outgoing), routing tables, and a number of network interface statistics.

It is an important part of the Network + exam but it's a helpful tool in finding problems and determining the amount of traffic on the network as a performance measurement.

Netstat –s provides statistics about incoming and outgoing traffic.

5. Nbtstat

Nbtstat (NetBios over TCP/IP) enables you to check information about NetBios names.

It helps us view the NetBios name cache (nbtstat -c) which shows the NetBios names and the corresponding IP address that has been resolved (nbtstat -r) by a particular host as well as the names that have been registered by the local system (nbtstat –n).

6. NSLookup

NSLookup provides a command-line utility for diagnosing DNS problems. In its most basic usage, NSLookup returns the IP address with the matching host name.

7. IPConfig

Not part of the TCP/IP utilities but it is useful to show current TCP/IP settings.

The IPConfig command line utility will show detailed information about the network you are connected to. It also helps with reconfiguration of your IP address through release and renew.

Let's say you want to know what you're IP address is -- ipconfig is what you type in the command prompt.

ipconfig will give a quick view of you IP address, your subnet mask and default gateway.

ipconfig /all will give you more detailed information.

Through ipconfig /all we can find DNS severs, if we have DHCP enabled, MAC Address, along with other helpful information. All good things to know if we have trouble getting connected to the internet.

Other IPConfig tools that are helpful include ipconfig /release and ipconfig /renew. But before I get into this let's discuss how we actually get an IP Address.

There are two ways to obtain an IP address. One way is to have a static IP address which we manually assign. The second one is to have a dynamic IP address obtained through a DHCP server.

If you were to right click on Network Connects, go to Properties, right click on Local Area Connection, scroll down to Internet Protocol (TCP/IP), and select Properties -- you'll see two options:

Obtain an IP address automatically

Use the following IP address

Unless you know your static IP address you'll want to stick to the option for automatically obtaining the IP address. If you have it set to automatic your computer will be issued an IP through a DHCP server.

And just in case you're wondering, Dynamic Host Configuration Protocol (DHCP) is a network protocol that enables a server to automatically assign an IP address to a computer from a defined range of numbers (i.e., a scope) configured for a given network.

In laymen's terms: I have a cable modem at home and I have that modem connected to a wireless router that issues out IP address to anyone that connects to that router. That is DHCP that is issuing out IP addresses.

Your company probably has a server dedicated to this. Understanding this is definitely important for any networking exam.

Let's look at what happens when we release our IP address.

I've just lost internet connection and my IP address is 0.0.0.0. If I type ipconfig /renew this option re-establishes TCP/IP connections on all network adapters and I can resume my internet surfing.

Note: ipconfig /release renew won't work if you manually assigned your IP addresses.

That's about as far as these utilities go. Again not only are they important for any Network exam, they are essential tools used in the field for troubleshooting and diagnosing network problems.

Hopefully they will serve you well.

GOOGLE WEB DESIGNER ASSESSMENT

2017-02-10T22:40:00.003-08:00

D1. What does Google Web Designer offer HTML5 coders in particular?
1. HTML5 syntax highlighting and autocompletion
2. A code sample library
3. See tips from award-winning graphic designers
4. Target ads to specific browsers
D2. What does Google Web Designer help beginners do?
1. Build creatives without HTML5 coding skills
2. Learn HTML5 from experts
3. Consult award-winning graphic designers
4. Test ads on different browsers simultaneously
A3. How can you move an element in Quick mode animation?
1. By adding a scene and moving the element where desired
2. By selecting the element you want to move in the timeline and setting an event marker
3. By moving the element on the stage and clicking the play button at the top of the animation timeline
4. By selecting the keyframe in the transition editor
The correct answer is By adding a scene and moving the element where desired.
A4. How can you add simple animations quickly in Google Web Designer?
1. Use the timeline's Quick mode
2. You can't, animation isn't supported
3. Use the Animation panel
4. Insert one from the Animation library
The correct answer is Use the timeline's Quick mode.
D5. What is a Google Web Designer feature that can accelerate ad creation for HTML5 coders and non-coders alike?
1. Library of advanced ad templates
2. Advanced video rendering
3. Rapid pixelation
4. High-speed publishing technology
The correct answer is Library of advanced ad templates .
D6. Where are the settings you need to make creatives adjust to screen size and orientation?
+1
1. In the Responsive panel
2. The view menu
3. In the timeline
4. In the advanced video editor
A7. How can you add detailed, sophisticated animations in Google Web Designer?
1. Use the timeline's Advanced mode
2. Import them from an animation tool
3. Download them from Google Web Designer's website
4. Choose them in the Animations menu
The correct answer is Use the timeline's Advanced mode.
C8. How do you change the font text in your creative?
1. By choosing the font menu in the text tool
2. By selecting the font in the property inspector
3. By importing the font as an asset and dragging it onto the stage
4. By double clicking on the text tool
The correct answer is By choosing the font menu in the text tool.
B9. How do you build a wider canvas version of your creative for wider screens?
1. By adding a width breakpoint in Landscape rules
2. By targeting the creative for wider screens in the ad server
3. Choose Wide in the Canvas dropdown
4. By marking the All orientation checkbox
The correct answer is By adding a width breakpoint in Landscape rules .
C10. How does Google Web Designer help you build sophisticated creatives quickly?
1. By providing feature-rich templates
2. By rendering videos quickly
3. By pulling reusable code from the web
4. By providing direct uploads for creatives
The correct answer is By providing feature-rich templates.
B11. How do you build a creative in Google Web Designer that restyles to fit larger and smaller screens?
1. By including larger and smaller versions within the same creative
2. By saving two different creatives in Google Web Designer
3. By turning on the creative's auto-adjust
4. By setting the ad server to auto-adjust
The correct answer is By including larger and smaller versions within the same creative.
C12. How do you add a YouTube video to your creative?
1. By adding the video link in the video component Properties panel
2. By importing the original source video as an asset
3. By dragging the video component onto the stage and adding the YouTube video link in the text box
4. By adding a video event in the Events panel
The correct answer was By adding the video link in the video component Properties panel.
C13. How can you get your creative to appear in the template library?
+1
1. Save it as a template
2. Submit it to Google for inclusion
3. Creatives already automatically appear there
4. You cannot add creatives to the library
B14. How do you navigate between the wider canvas version and narrower canvas version of your responsive creative?
+1
1. By clicking left or right of the width breakpoint on the top ruler
2. By targeting the creative for wider screens in the ad server
3. By using the Alt-Tab buttons
4. By choosing Wide or Narrow in the Navigate menu
B15. How do you build a creative in Google Web Designer that restyles to fit portrait and landscape mobile phone orientations?
+1
1. By including portrait and landscape versions within the same creative
2. By saving a different creative for each
3. By marking both landscape and portrait checkboxes
4. Google Web Designer creatives cannot restyle to fit screen orientation

Top Apache Interview Questions And Answers for Interview L2/L3

2017-02-02T00:04:00.000-08:00

QUESTION NO: 1

Jan wants her Apache server to be able to handle multiple requests over a single TCP connection. Which of the following would allow her to do this?

A. Expirations
B. BrowserMatch
C. KeepAlive
D. PersistentConnect
E. ChunkEncode

Answer: C

QUESTION NO: 2

Which of the following HTTP headers will direct a browser to www.site.com after waiting five seconds?

A. Rerwrite 5; URL = http://www.site.com/
B. Location 5; URL = http://www.site.com/
C. Refresh 5; URL = http://www.site.com/
D. Reload http://www.site.com/ -t 5
E. Direct -t 5 http://www.site.com/

Answer: C

QUESTION NO: 3

Cookies can be used by Apache to create a click stream log of user activity. However, for the cookies to work, Apache must be compiled with the _______ module, then the ______ directive must be

added to the httpd.conf file.

A. mod_usertrack; Cookie Tracking on
B. mod_cookies; Cookies on}
C. mod_cookietracking; cookie Tracking on
D. mod_cookielog; Cookielogging on
E. mod_userlog, cookielogging on

Answer: A

QUESTION NO: 4

Which of the following are TRUE regarding contains in httpd.com? (Choose two.)

A. Containers consist of a Paired set of delimiters.
B. If two containers contradict, the first is applied.
C. Containers may only be applied globally.
D. Containers allow individual virtual hosts to have their own settings.

Answer: A,D

QUESTION NO: 5

Which of the following best explains why Apache Web servers are able to handles multiple requests?

A. In addition to port 80, Apache opens ports 8080, 8000, and others to handle the additional requests.
B. Apache is able to spawn child processes that handle requests before they die.
C. Apache uses therenice service to load balance between different system daemons.
D. Upon reaching a set number of requests, Apache uses a raw socket to adjust a system's bandwidth to handle the additional requests.

Answer: B

QUESTION NO: 6

Consider the file "test.html". Which of the following best describes what code does?

<html>
<from>
<INPUT TYPE=" button" VALUE="set cookie"
onClick = "document. Cookie =`first_name=Fred`;">
<INPUT TYPE = "button" VALUE = "display cookie"
onClick = "alert (document.cokkie);">
</from>
</html>

A. When the user clicks on "set cookie," it prompts the user for value. Once the value is entered, it can be displayed using the "display cookie" button.
B. When the user clicks on "set cookie," thefirst_name cookie is set to "Fred." The first_name cookie can be displayed by clicking the "display cookie" button.
C. When the user first loads "test.html,"first_name is automatically set to "Fred." The value of first_name can be seen with the "display cookie" button. The first_name cookie can be reset to " 3
empty ("") by clicking the "set cookie" button.
D. When the user clicks on the "set cookie" button, a new HTML page is loaded that displays the word "Fred". When the user clicks on the "display cookie" button, it alerts the user that it has been

deleted.

Answer: B

QUESTION NO: 7

Which of the following can be used send to used to send a cookie to the http client? (Choose two.)

A. XMLScript
B. Static HTM
C. Java Script
D. CGI scripts
E. GIFScript

Answer: C,D

QUESTION NO: 8

Ralf, a user, wishes to upgrade his existing version of Apache by including mod_ssl as a loadable module. Assuming that the shared object for mod_ssl is libssl. So, that mod_ssl is located in

"/prefix/modules/," which of the following must be present in his httpd, conf file?

A. LoadModule mod_ssl modules/libssl.so
B. Addmodule mod_ssl modules/libssl.so
C. LoadModule /prefix/modules/libssl.so mod_ssl
D. AddModule /prefix/modules/libssl.so mod_ssl

Answer: A

QUESTION NO: 9

Liz has completed an Apache installation on her computer. She did not encounter any errors. Which of the following can she use to see Apache's default index? (Choose two.)

A. http://localserver
B. http://localhost
C. http://index
D. http://192.268.0.0
E. http://127.0.0.1

Answer: B,E

QUESTION NO: 10

One security exploit with Apache is to include a command in a script that lets the scripts execute a command found in one of its variables. For example, a script might contain the who command and

display a list users logged into the server. Which of the following, if included in a CGI script, will run a command with the appropriate permissions?

A. declare
B. fork
C. export
D. eval
E. eacho

Answer: D

QUESTION NO: 11

Which of the following represents a security concern of programming CGI scripts using the C programming language?

A. C programs must be run withsetuid root.
B. If the program receives more data than the amount of memory it has allocated, a buffer overflow can cause the program to exit to a shell on the server.
C. Many early C compile lack the ability to dynamically alter file permissions, which results in many C program running with root permissions.
D. CGI script written in C compile at runtime on the client system, which makes the client vulnerable.
E. If the server and client do not have identical compilerversions, the lesser compiler is used, which may have known exploits.

Answer: B

QUESTION NO: 12

Which of the following best explains the function of the KeepAlive directive in Apache 1.1?

A. It defines the length of time Apache will wait before spawning additional processes.
B. It constantly checks on the Apache service and reports viasyslogd if there is a server problem.
C. It makes a backup by spawning clones ofitself in case the server goes down.
D. It defined how long a server process can keep a connection before shutting down.
E. It tells Apache how long to wait before going into the zombie process state.

Answer: D

QUESTION NO: 13

Which of the following scenarios most accurately describes the Apache initialization sequence?

A. Apache spawns one child process each second untilMaxSpareServer is satisfied or MaxClients is reached.
B. Apache spawns one child, then two, then four, and up to 32 processes per seconds untilMaxClients is reached or Minspare Servers is satisfied.
C. Apache spawns one process then continues to double the number of processes spawned each second indefinitely untilMaxClients is reached or MinSpareServers is satisfied.
D. Apache spawns the needed number of child processes dependent on the incoming requests untilMaxClients is reached or MinSpareServer is satisfied. For example, if three requests come in, Apache

would spawn three processes, and soon.

Answer: B

QUESTION NO: 14

How does Apache enable CGI scripts? (Choose two.)

A. It links source pages to the appropriate client compiler.
B. It implementssuid and makes the script excitable.
C. It defines content types based on the extension.
D. It references directories that contain the scripts.

Answer: C,D

QUESTION NO: 15

Jake has the text below in his httpd conf file. He does NOT have mod_mime_magic compiled as part of the Apache server configuration. Which of the following are TRUE concerning this information?

(Choose two.)

LoadModule vhost_alias_module modules/mod_vhost _alias.so
# LoadModule env_module modules/mod_env.so
# LoadModule agent_log_module modules/mod_log_agent.so
# LoadModule mime_magic_module modules/mod_mime_magic.so
# LoadModule mime_module modules/mod_mime_magic.s
<IFModeule mod_mime_magic.c>
MIOMEMagicFile share/magic
</ifModule>

A. The MIMEMagicFile directive will be processed.
B. The MIMEMagicFile directive will NOT be processed.
C. The server will NOT be able to use hints in share/magic to determine file types.
D. The server will be able to use hints in share/magic to determine file types.

Answer: B,C

QUESTION NO: 16

An administrator needs to set the permissions an Apache Web server to maximize security, while still allowing for full functionality. Which of the following permissions are most appropriate for

Apache configuration files and Apache executables, respectively?

A. 755, 000
B. 755, 111
C. 511, 755
D. 777, 555
E. 755, 511

Answer: E

QUESTION NO: 17

The block of code below is found in the http conf file. Under what conditions would this block of code execute?

<If Module !PHP/4.0>
...
</If Module>

A. If PHP/4.0 is NOT compiled or loaded into Apache when the block of code is called
B. If PHP/4.0 is NOT compiled or loaded in the module's shared library when the block of code is called
C. If PHP/4.0 is compiled or loaded into Apache when the block of code is called
D. If PHP/4.0 is compiled or loaded in the module's shared library when the block of code is called

Answer: A

QUESTION NO: 18

Which of the following is a requirement for IP-based virtual hosting?

A. Separate network devices, each with its own I address.
B. Separate IP addresses for each virtual host
C. Separate configuration files for each virtual host.
D. SeparateIPAlias directives in the httpd.conf file for each virtual host.

Answer: B

QUESTION NO: 19

Tom would like to group all of his CGI scripts to /lib/cgi-bin/. In order to do this, he needs to use the ScriptAlias directive in the httpd.conf file of his Apache server. What modules need to be

compiled in order for this to work? (Choose two.)

A. mod_cgi.c or any module that supports the common gateway interface
B. mod_bin.c
C. mod_negotiation.c or any module that does protocol negotiation
D. mod_alias.c
E. mod_script.c or any module that does script parsing

Answer: A,D

QUESTION NO: 20

The system administrator has configured Apache to write its log files via the system logging daemon. When Apache write its log files to syslog, it will run with the permissions of which user?

A. Always as root
B. Always as nobody
C. Always aswebuser
D. Always as the owner of the http process
E. Always as the owner of thesyslogd process

Answer: B

QUESTION NO: 21

If a user has already defined a log format called "common, "which of the following directives will ALWAYS make Apache log requests to "/var/log/apache/access_log" using the " common" format?

A. TransferLog /var/log/apache/access_log format=common
B. TransferLog /var/log/apache/access_log common
C. CustomLog /var/log/apache/access_log format=common
D. CustomLog /var/log/apache/access_log common
Answer: D

QUESTION NO: 22

The system administrator wishes to make the Web server run with UID "web." Which of the following lines should be added to httpd.conf to allow this?

A. UID web
B. ServerAdmin web
C. Owner web
D. User web
E. RunAs web

Answer: D

QUESTION NO: 23

Which one of the following http conf entries will tell the server which access directive can be overridden by the. Htaccess file?

A. Order Allow. Deny
B. AllowOveride
C. Order Deny, Allow
D. Allow

Answer: B

QUESTION NO: 24

An administrator would like to set up Apache server with multiple IP addresses. Which httpd.conf directives are used to change the port and the IP address on which httpd listens? (Choose two.)

A. Listen
B. Address
C. Bind
D. Active
E. BindAddress

Answer: A,B

QUESTION NO: 25

Amanda is configuring an Internet Web server with server with two virtual host. One of the host server is a time clock, and the other is a Web mail server. Both hosts are configured to provide

service on port 8080. One host is using the IP address 192.168.1.10, and the order is using 192.168.1.20. Which of the following will occur when Amanda tries to run both hosts on the same port

number?

A. Requests to both virtual hosts will be denied.
B. The host listed last in thehttpd.conf configuration file will receive all f the requests on that port number.
C. The underlying IP layer willnondeteministically transfer network packets to either host.
D. Both virtual hosts will function normally.

Answer: D

QUESTION NO: 26

Which statement best describes the outcome of the following commands?

Root@example apache $ bin/htpasswd /etc/httpd/conf/users nobody
Root@example apache $ bin/apache 1restart

A. Create a new and set the password for the Web page
B. Create a new user for the http group file
C. Create a new group and password for the system
D. Create a new alias for all the http users

Answer: A

QUESTION NO: 27

A system administrator has entered the directive below into httpd.conf. Which of the following will she have to type into the browser to get to the aliased page? Assuming the file access

permissions are set correctly.

Alias/html/usr/local/my_dir/my_html/

A. http://localhost/
B. http://localhost/htm/
C. http://localhost/usr/local/html/
D. http://localhost/my_dir/html
Answer: B

QUESTION NO: 28

Joe, a system administrator, wants to allow visitors to sign one of two default usernames and a valid e-mail address. He decides the default names should be "janedoe" and "johndoe". In the.

htsccess file,which module should Joe edit to achieve the desired results, and what information should he enter?

A. anon_auth_module; Anonymous johndoe and johndoe
B. access_module; Anonymous johndoe and johndoe
C. anon_auth_module; Anonymous *doe
D. access_module; Anonymous *doe

Answer: A

QUESTION NO: 29

As a security measure, the system administrator has set the policy that all system logs must be written to a remote system. Which of the following directives should be used to make Apache log in

this fashion?

A. CustomerLog | /sbin/syslogd
B. CustomerLog remotesystem:/var/httpd/access_log
C. TransferLog remotesystem:/var/httpd/access_log
D. TransferLog | /sbin/syslogd

Answer: D

QUESTION NO: 30

The system administrator is setting up Apache to limit access to the directory "/ Linux/example/." Only visitors from linuxsite.org should be able to access the directory. What lines need to be
added to the following entery in the .htaccess file to make this restriction possible? Select the best pair for lines two and four.

1 <Directory "/Linux/example/">
3 Deny from All

5 </Directory>

A. Allow fromlinuxsite.org;End
B. Deny,Allow;Allow from linuxsite.org
C. OrderAllow,Deny; Allow from linuxsite.org
D. OrderDeny,Allow; Allow from linuxsite.org

Answer: D

QUESTION NO: 31

David wants to set up a virtual host that uses the IP address 192.168.2.2, but he wants the server to attain individual settings from the main server. He uses the http.conf file below. David then
restarts httpd and receives an error. What error did he make in the configuration file?

<VirtualHost 192.168.2.2>
ServerAdmin david@davidsvirualhost.com
ServerRoot /www/docs/davidhost2
ServerName davidsvirtualhost.com
TransferLog logs/ davidsvirtualhost.com-access_log
ErrorLog log/ davidsvirtualhost.com-error_log
</VirtuaulHost>

A. The TransferLog directive is improperly formatted.
B. The ServerRoot directive is invalid the VirtualHost container.
C. The VirtualHost containor is not terminated correctly.
D. The TypesConfig directive is missing inside the VirtualHost containe.
E. The MultiViews directive is missing inside the VirtualHost container.

Answer: B

QUESTION NO: 32

Which of the following fields is NOT a part of the CommonLog Format (CLF)?

A. Requesting host
B. Byte length of the request
C. Data of request
D. Time to serve request
E. HTTP status code

Answer: D

QUESTION NO: 33

Jerry has a directory dedicated to JPEG image but does not have the .jpg extension on each file. How can he get the server to inform the client of the content type of the files in the directory?

A. Within a Directory container, use theDefaultType directive to specify the file type.
B. Within a Directory container, use theAddType directive to specify the file type.
C. Within a Directory container, use theAddEncoding directive to specify the file type.
D. Within a Directory container, use theTypeConfig directive to specify the file type.

Answer: A

QUESTION NO: 34

Using a name-based virtual host, how does a client make a request to the desired host?

A. The client listens for a particular IP address that is in thehttpd.conf file.
B. The client requestare command to the server's /etc/hosts file.
C. The client browser provides the host header, the host header, which the server matches against the list of virtual hosts.
D. The client browser provides a virtual hostsctipt that includes the desired port number.

Answer: C

QUESTION NO: 35

Tom has entered the information below in his httpd.comf file. He has no .htaccess file that override these directives. Which of the following is TRUE concerning this files?

ExpiresActive on
Anywhere, .htaccess when Allow Override indexes
ExpiresByType image/gif A1000
Anywhere, .htaccess when Allow Override indexes

A. A GIF image on the server will be active for 1000 seconds after its last modification time.
B. If the file size a GIF image is over 1000Kb,then the GIF image will expire in the server's cache.
C. After the client accesses a GIF image on the server, it will NOT expire in the client's cache for 1000 seconds.
D. The server will hold no more than 1000 GIF image in its cache.

Answer: C

QUESTION NO: 36

Assume the following block of code is placed in the httpd.conf file. What task does it perform?

RewriteCond %{TIME_DAY} !Monday {OR}
RewriteCond %{TIME_HOUR} 10
RewriteCond ^index\.html /index\.html
RewriteCond %{TIME_DAY} Monday
RewriteCond ^index\.html /index\.mon\.html

A. It rewrites the URL http://someserver/index.html to http://somerver/index.mon.html if the day is NOT Monday and the hour is NOT 10.
B. It rewrites the URL http://someserver/index.html to http://somerver/index.mon.html if the day is Monday and the hour is 10.
C. It rewrites the URL http://someserver/index.html to http://somerver/index.mon.html if the day is NOT Monday and the hour is 10.
D. It rewrites the URL http://someserver/index.html to http://somerver/index.mon.html if the day is Monday and the hour is NOT 10.

Answer: C

QUESTION NO: 37

Which of the following MUST Apache 1.1 and higher have in order to run?

A. httpd.conf
B. httpd.conf and srm.conf
C. httpd.conf and access.conf
D. httpd.conf access.conf, srm.conf

Answer: A

QUESTION NO: 38

Paul has placed all images to offered by an Apache Web server in a single directory. The images are to be handled as GIF images, but he does not wants to individually label each of the images with

the ".gif" extension. Which of the following methods could Paul use to efficiently associate all files in the /images directory (and only the /images directory) with the ".gif" .extension?

A. If Paul crates an .htaccess file in /images and uses the Force Type directive in the file, all files classified as images can be given the ".gif" association despite their current association.
B. If Paul crates an .htaccess file in /images and uses the Force Type directive in the file, individual files can be processed and associated with any extension defined in the Add Type filed
located in httpd.conf.
C. Paul must use theRemoveHandler and Addhandler directives to remove current extensions then add new extensions. Both directives must be used in the global container of httpd.conf.
D. Paul must use theRemoveHandler and SetHandler directives to remove current extensions then add new extensions. The RemoveHandler directive must be placed in an. Htaccess file in
/images and the SetHandler directive must be defined in httpd.conf.

Answer: A

QUESTION NO: 39

Which of the following is the main problem with using.htaccess to override directives in httpd.conf?

A. .htaccess must have a per-loaded PAM module that requires extra configuraton.
B. .htaccess is insecure because it requires root permission to access subirectories.
C. .htaccess delays page access by recursively searching subdirectories.
D. .htaccess does not search every directory, possibly leaving subdirectories open.

Answer: C

QUESTION NO: 40

The Web document root directory can be changed by which line in httpd.conf?

A. Root
B. RootDir
C. DocumentRoot
D. WebRoot
E. BaseDir

Answer: C

QUESTION NO: 41

What is the function of the XbitHack directive in the httpd.conf file?

A. To active the X interface for Apache from a remote location
B. To prevent serving requests for executable files
C. To authenticate the requesting client based on user permissions
D. To parse Web files for includes based on their permissions

Answer: D

QUESTION NO: 42

Bad has placed a limit on the maximum requests per child process on his Apache server. To do this, he added the MaxRequestsPerChild directive to httpd.comnf and gave it a value of 800. Which of the

following are TRUE concerning this situation? (Choose two.)

A. It limits the amount of memory that processes can consume in the event of accidental memory leakage.
B. Limiting the number of child processes increases processing done by each child; this increases system load.
C. By giving process a finite lifetime, the number of processes will be reduced when requests decrease; this frees up system resources.
D. Limiting the number of child processes increases mean network packet length; this allows more data to be transferred at once.

Answer: A,B

QUESTION NO: 43

What is the IANA-recommended value for the Port directive?

A. 0
B. 80
C. 255
D. 8080

Answer: B

QUESTION NO: 44

Examine the following block of code. What should be added on line 3 so that the following events occur. If the value of "test" is equal to 100, the Web page will print, "you are our on hundredth

customer," and if the value of "test" is not equal to 100, the Web page will print, "Have a nice day"

1 <!--#if expr= "${test} != ${100]" à
2 Have a nice day
4 you are our one hundredth customer
5 <!--#else -- >
6 Have a nice day
7 <! -- #endif -- >

A. <!-- #elseif expr="${test} = ${100}" -- >
B. <!-- #elseif expr="${test} != ${100}" -- >
C. < !-- elif expr="${test} != ${100}" -- >
D. < !-- #elif expr="${test} = ${100}" -- >

Answer: D

QUESTION NO: 45

A Web site has a standard header that should be included on all Web pages. Which of the following lines would make the server include a eparate file, clled "header.html, " instead of write
the header code for every page on the site?
Assume that "header.html" is in same directory as all other HTML files, which is "/www/htdocs."

A. <!--#include "/www/htdocs/header.html"-- >
B. <!--#include "/www/htdocs/header.html"-- >
C. <!--#nclude file="/www/htdocs/header.html"-- >
D. <!--#virtual "/www/htdocs/header.html"-- >
E. <!--#file="/www/htdocs/header.html"-- >

Answer: B

QUESTION NO: 46

To crate dynamic HTML content, which of the following MUST be included with each CGI script?

A. each $cgi
B. #/bin/bash
C. #nclude cgi
D. #/bin/perl
E. each Content-type

Answer: E

QUESTION NO: 47

Suppose that a user wishes to dynamically include the contents of the file "message.txt" within a Web page. Which of the following lines within the HTML code will allow this to be done?

A. <!--#exec "cat message.txt" -- >
B. <!--#exec cmd "cat message.txt" -- >
C. <!--#exec cmd cat message.txt -- >
D. <!-- exec cmd "cat message.txt" -- >
E. <!-- cat message.txt" -- >

Answer: B

QUESTION NO: 48

Adam has decided to start maintaining status information on current connections by setting the ConnectionStatus directive to "on." Which of the following modules MUST be installed for this

directive to work?

A. mod_status
B. mod_info
C. mod_logging
D. mod_connect
E. mod_reports

Answer: A

QUESTION NO: 49

In order to make the Web server parver parse file with extension ".shtml" for server side includes, which of the following should be added to httpd.conf?

A. AddHandler server-persed .shtml
B. AddHandler Handler .shtml
C. NewHandler server-parsed .shtml
D. NewHandler .shtml

Answer: A

QUESTION NO: 50

John is running multiple virtual server from a single Apache Web server daemon. He has separate log files each virtual server. Some of the error logs start reporting the error "unable to fork."

John's system supports the setrlimit () call. Which of the following can john do to fix this error? (Choose two.)

A. Send each log file to the same partition and compress the partition periodically.
B. Compilemod_fork.c into the Apache source or dynamically load the mod_fork module in httpd.conf.
C. Consolidate all log files into one file.
D. In the Apache startup script, increase the number of available file descriptors with theulimit utility.
E. Edit thehttpd.conf file to include "forking=yes" in the globals section.

Answer: A,B

QUESTION NO: 51

Natalie, the Webmaster for a small company, wishes to log Web server access using a custom log file format. In order to do this, she decides to use the CustomLog directive. However, she neglected

to define the structure of the log entries. Which of the following directives did Natalie fail to place in httpd.conf?

A. LogStructure
B. TransferLog
C. CommonLog
D. LogFormat

Answer: D

QUESTION NO: 52

Given the following exerpt of code from httpd.conf, what function will be performed?

LogFormat"%h %1 %u %t \"%r\" %>s %b \"%{Referer} i\" \"%{User-Agent } i \""\ combined
LogFormat"%h %1 %u %t \"r\" %>a %b" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent
TransferLog /var/log/httpd/access_log

A. The log file /var/log/httpd will be written with the format "agent".
B. The log file /var/log/httpd will be written with the format "combine".
C. The log file /var/log/httpd will be written in common log format.
D. The log file /var/log/httpd will be written, but will only log the IP address.

Answer: A

QUESTION NO: 53

An administrator needs to perform host name lookups on users accessing HTML and SWF files, but no other files. The administrator has added the following lines to the httpd.conf file but is not
getting the desired result. What is the result of the lines added by the administrator?

<Files ^^ "\. (html | svf) $">
HostnameLookups on
</Files>

A. The server performs lookups and all users accessing files other than HTML or SWF and ignores users accessing HTML or SWF files.
B. The server performs lookups for all users accessing all files.
C. The serverperform lookups for some users on the HTML and SWF files.
D. The serverperform lookups on users accessing HTML files, but not on users accessing SWF files.

Answer: D

QUESTION NO: 54

When installing Apache from source, the system administrator adds the line below to the "apacke_1.3.19/src/Configure" file. What does this accomplish?

AddModulemodules/standard/mod_so.o

A. mod_so.o will be loaded into the Apache binary after Apache has been restarted.
B. mod_so.0 will be combined with the Apache binary at run time.
C. mod_so.o will be added, provided it is already built into the binary.
D. mod_so.o will become part of the Apache binary at compile time.

Answer: D

QUESTION NO: 55

If the Web server and the browser use a persistent connection, then multiple requests can occur over the same _________ connection.

A. IP
B. ftpd
C. CGI
D. TCP

Answer: D

QUESTION NO: 56

Which of the following are TRUE concerning directives and Apache? (Choose two)

A. Directives are commands issued throughapachetl.
B. Directives are used to control Apache's runtime configuration.
C. Directives can be used to alter Apache's configuration during runtime.
D. Directives can be used in configuration files other thanhttpd.conf.

Answer: B,D

QUESTION NO: 57

Which of the following is TRUE concerning chunked encoding?

A. It allows the server to grab small bits of dynamically produced data (chunks), determine the content, and sent it to the client.
B. It helps identify a client by dropping chunks of information onto the client's computer and then reading it from the computer later.
C. It divides RAM into chunks so that Apache can better utilize itsRequestsHeader info.
D. It forces a TCP connection into two chunks-one for the client and one for the server.

Answer: A

QUESTION NO: 58

When using persistent connections with HTTP1.1, a server must know the Content-Length of the response it sends back to a client. If a Web page is dynamically created, there is no way for the
server to know the exact size of the content. Which of the following helps to solve this problem?

A. Parsing header protocol
B. Cookies
C. Chunked encoding
D. UDP packet encryption

Answer: C

QUESTION NO: 59

Maynard has recently been places in charge of a large Apache server that may be a target for Denial of Service (DOS) attacks. To increase security, Maynard has decides to modify httpd.conf
and strengthen the server's resistance to attacks. Of the following httpd.conf directives, which can be used as a protection against DOS attacks? (Choose two)

A. LimitRequestFields
B. LimitRequestFieldSize
C. AuthTypeMax
D. AuthBufferLimit
E. AuthOverflow

Answer: A,B

QUESTION NO: 60

The text below is found in your Apache server's error_log file. Which of the following could have caused this error?

/var/run/httpd.pid overwritten - Unclean shutdown of previous Apache run?

A. The Apache server as shut down by an unauthorized user.
B. The graceful shutdown of Apache was overwritten byinetd.
C. Apache was terminated by an unexpected system failure.
D. Another instance ofhttpd was started, which caused the original httpd to shut down.

Answer: C

QUESTION NO: 61

Which of the following can increase Web sever performance? (Choose three)

A. Move all swap space to the same partition as the Web server data.
B. Turn off logging.
C. Place Apache logs on the fastest drive.
D. Add additional RAM to the system.
E. Place Apache logs on the slower drive and the Web data on the faster drive.

Answer: A,B,C

QUESTION NO: 62

Which of the following statements concerning Apache and Secure Socket Layer (SSL) is TRUE?

A. Apache and SSL can only be used if the proper security certificate has been purchased.
B. Themod_ssl module gives SSL functionality to Apache.
C. Apache +SSLis a commercial version of Apache distributed as closed source.
D. Apache +SSLprovides maximum 256 bit encryption.
E. Themod_https module is equivalent to the mod_ssl module.

Answer: B

QUESTION NO: 63

Which of the following will occur if the MaxSpare Servers Apache directive is set to 15?

A. No more than 15 child processes will be left running and unused.
B. No more than 15 requests to the server will be allowed.
C. It will provide for 15 fail-over servers in a cluster.
D. It will provide 15 spare servers for each virtual host request.

Answer: A

QUESTION NO: 64

Recently LinuxCorp upgraded its Web server. In the process, several directories containing Web content were moved. The Webmaster wishes to modify Apache so that when clients access the original

URL, they will be automatically sent to a new directory. Which module will allow Apache to perform this task?

A. mod_url
B. mod_redirect
C. mod_link
D. mod_rewrite
E. mod:urlmanip

Answer: D

QUESTION NO: 65

John has a Web server running Apache, and his Web site has information that is updated periodically. John wants to make sure clients who access his Web site are viewing the most up-todate

information. Which of the following should John use to accomplish this?

A. BrowserMatch 10
B. ExpiresDefault 10
C. ReloadTime 10
D. CacheDocument 10
E. MaxKeepAlive 10

Answer: B

QUESTION NO: 66

George has taken over Web server administration for a colleague. He has located the httpd.conf file, the document root, and the files that Apache servers, but he cannot find the error log files.

They are not in their default location. Which command can he use to find the log files?

A. grep -i errorlog httpd.conf
B. locate -uerrorlog
C. locate -i uvET httpd.conf | grep errorlog
D. find /etc -nameerrorlog

Answer: A

QUESTION NO: 67

George does not want to use the default HTML error page; he wants to customize his version of Apache to handle problems or errors. He creates an HTML page named error.html, with his customized

error message, and saves it in the /cgi-bin/ directory. How can George get Apache to display his customized error message when a page is not found?

A. Use theErrorDocument directive in the following manner: ErrorDocument 404 /cgibin/error.html.
B. Use theErrorLog directives in the following manner: ErrorLog 404 /cgi-bin/error.html.
C. Use theErrorDocument directives in the following manner: ErrorDocument 401 error.html.
D. Use theErrorLog directives in the following manner: ErrorLog 401 error.html.

Answer: A

QUESTION NO: 68

Which of the following are valid options for the ServerType directive? (Choose two)

A. intranet
B. internet
C. inetd
D. httpd
E. stand-alone

Answer: A,B

QUESTION NO: 69

John wants to apply several directives to the following directories: /gardening, /garden_tools, /fertilizers, and /herbs. How can John configure Apache to do this without affecting any of his other
directories, considering the list of his directories below?

/woodshed_tools /fertilizers /decks
/garden_tools /herbs /boat_accessories
/gardening /charcoal_grills /misc

A. Use the <Directory> directive in the following manner:
<Directory ~ [f-h]?.*>... </Directory>
B. Use the <Directory> directive in the following manner:
<Directory> ~ /[f-h]*> ... </Directory>
C. Use the <File> directive in the following manner:
<File ~ [f-h]*> ... </File>
D. Use the <File> directive in the following manner:
<File> ~ /[f-h]?.*> ... </File>

Answer: B

QUESTION NO: 70

Julie has three files in the same directory named index.html, index.htm, and index.shtml, respectively. She wants index.htm to be sent to the client when this directory is accessed. Which
of the following httpd.conf entries will allow her to do this? (Choose two)

A. DirectoryIndex index.htm index.html index.shtml index.cgi
B. DirectoryIndex index-html index.cgi index.shtml index.htm
C. DirectoryIndex index.html index.shtml index.cgi index.htm
D. DirectoryIndex index.htm index.cgi index.shtml index.html

Answer: A,B

QUESTION NO: 71

John is creating multiple virtual Web servers with separate document root directories. John's boss says to keep duplication to a minimum by using the same executable scripts. In which section if
the httpd.conf file would John have to define the path of the executable scripts in order to accomplish this task?

A. Directory environment
B. Virtual host environment
C. Global environment
D. Default environment
E. Local environment

Answer: C

QUESTION NO: 72

Which of the following best describes the relationship between modules and directives in Apache?

A. Modules are the dynamic counterparts of directives.
B. Directives are used to direct the client to load the appropriate modules.
C. Modules contain code to carry out directives specifies inhttpd.conf.
D. Directives contain code to execute static modules.

Answer: C

QUESTION NO: 73

When the httpd.conf file is altered, Apache must re-read the file by stopping and restarting the server. There are two methods of restarting the server when using the apachectl tool. Which command

lies will perform the restart? (Choose two)

A. apachectl reload
B. apachectl reboot
C. apachectl restart
D. apachectl HUP
E. apachectl graceful

Answer: C,E

QUESTION NO: 74

A system administrator wishes to define several separate log file formats to handle different log files within Apache. After defining a block of format definitions, the directive below is

specifies. Which of the following definitions will be used? TransferLog/var/httpd/access_log

A. Common Log Format
B. The first specifiesLogFormat directive line
C. The last specifiedLogFormat directive line.
D. The server will report an error parsing the configuration file.

Answer: C

QUESTION NO: 75

Jamie is running Apache 1.3. He wants different pages with similar content on his Web site to be served to best accommodate each browser that views them. He alters the httpd.conf file and makes the

changes below. Which line still needs to be altered to enable the desired effect?

<Directory /usr/local/httpd/htdocs>
Options All
AllowOverride Authconfig
Order allow.deny
Allow from all

A. He needs to add "MultiViews On" to the "Options All" line.
B. He needs to change "AllowOverride Authconfig" to "AllowOverride None".
C. He needs to change "Orderallow,deny" to "Order deny,allow".
D. He needs to add "localhost" to the "Allow from all" line.

Answer: A

QUESTION NO: 76

You find a Segmentation fault error in one of your Apache error_log files. Which of the following
tools will help you determine what caused this fault?

A. segfind
B. gdb
C. apachectl
D. top

Answer: B

QUESTION NO: 77

Dharma, a system administrator, wants to allow server side includes on the Web server. Which of the following directives would be the most secure way for her to do this?

A. Options +Includes --NOEXEC
B. Options -Include
C. Options +IncludesNOEXEC
D. Options +NOEXEC

Answer: C

QUESTION NO: 78

The following is an example of what type of CGI script?

#1/bin/bash
#Hello, World! Script
echoContent-type: text/html
echo
echo'<html>
<head><title>Hello, World!</title></head>
echo'<body bgcolor=#FFFFFFF">
<h1>Hello, World!</body></html>'

A. PHP script
B. HTMLscipt
C. Shell script
D. JavaScript
E. Perl script

Answer: C

QUESTION NO: 79

Joni, a system administrator, would like to test a Web server to see how it will withstand a load of 100 simultaneous hits. Which command would she most likely use?

A. ab -<100 http://127.0.0.1:80/htdocs
B. ab -L100 http://127.0.0.1:80/htdocs
C. ab 100 http://127.0.0.1:80/htdocs
D. ab http://127.0.0.1:80/htdocs 100
E. ab -n100 http://127.0.0.1:80/htdocs

Answer: E

QUESTION NO: 80

Justin has entered the following lines into httpd.conf, but he is not sure what exactly these new lines will do. Which of the following will be caused by the lines Justin entered? (Choose two)

ExpiresActive on
ExpiresByType text/html M604800
ExpiresByType image/jpg A2592000

A. JPG images will expire after a month in the client's cache.
B. JPG images will expire after a week of non-use.
C. JPG images will expire a month from the time they were changed.
D. HTML documents will remain active for a week from the time they were changed.
E. HTML documents will remain active for a month from the time they were changed.
F. HTML documents will remain active for a week in the client's cache.

Answer: A,B

QUESTION NO: 81

Which of the following will occur if the StartServer Apache directive is set to five?

A. Five instances ofmod_quickstart.o will be started.
B. Five child processes will be started for every request.
C. Five child processes will be started when Apache starts.
D. Five virtual hosts will be started for every request.
Answer: C

QUESTION NO: 82

Which of the following is NOT an option that is supported by the Linux apachectl script?

A. start
B. restart
C. stop
D. graceful
E. kill

Answer: E

QUESTION NO: 83

An administrator wishes to install a new Apache module without recompiling Apache. He wants the modules automatically placed in the proper locations and the appropriate directive added in the

httpd.conf file. Which of the following utilities will allow the administrator to accomplish this task?

A. apmodprobe
B. apxs
C. apachectl
D. apconfig
E. apbuild

Answer: B

QUESTION NO: 84

Using a name-based virtual host, how does a client make a request to the desired host?

A. The client listens for a particular IP address that is set in thehttpd.conf file.
B. The client requests are compared to the server's /etc/hosts file.
C. The client browser provides the host header, which the server matches against the list of virtual hosts.
D. The client browser provides a virtual script that includes the desired port number.

Answer: C

QUESTION NO: 85

Eddy is maintaining a large Apache server used for holding and transferring files via the Web. He has accumulated many archive files with the tar.gz extension and would like to prevent them from

being shown when directories are listed. Which line could he add to either httpd.conf or .htaccess to accomplish this?

A. IndexHide "tar.gz
B. IndexHide "-tar.gz"
C. IndexIgnore *.tar.gz
D. IndexIgnore!.tar.gz
E. IndexList no .tar.gz
F. IndexList !tar.gz off

Answer: C

QUESTION NO: 86

Which of the following modules MUST be compiled into the Apache server?

A. http_core.c
B. apache_so.c
C. charset_so.c
D. tcpip_core.c

Answer: A

QUESTION NO: 87

A system administrator has entered the directive below into httpd.conf. Which of the following will she have to type into the browser to get the aliased page? Assume the file access permissions are
set correctly.

Alias /html/ /user/local/my_dir/my_html/

A. http://localhost/
B. http://localhost/html/
C. http://localhost/usr/local/html
D. http://localhost/my_dir/html

Answer: B

QUESTION NO: 88

Apache servers a document according to certain characteristics provided by the requesting browser.These characteristics of the document are called the document's dimensions. What dimension is used

when Apache serves a request from a browser that has a preference for gzip compressed document?

A. type
B. encoding
C. compression
D. format

Answer: B

QUESTION NO: 89

You are the system administrator of an Apache server that houses the Web site linuxsite.org. This site allows users with normal accounts to have home pages, and it houses several other mission
critical Web sites. A user, Joe, has a home page that requires a change in one of the Apache configuration directives. Joe wants to allow or deny access to his home page based on a

username/password combination. Which of the following is the best way to implement this change?

A. Allow Joe to configure the appropriate .htaccess file.
B. Install themod_runtime_auth module and allow Joe to make the appropriate changes to httpd.conf.
C. Make the appropriate changes tohttpd.conf file and restart httpd.
D. Make the appropriate changes to the global .htaccess file and restart httpd.

Answer: A

QUESTION NO: 90

Which of the following represents a security concern of programming CGI scripts using the C programming language?

A. C programs must run withsetuid root.
B. If the program receives more data then the amount of memory it has allocated, a buffer overflow can cause the program to exit to a shell on the server.
C. Many early C compilers lack the ability to dynamically alter file permissions, which result in many C programs running with root permissions.
D. CGI scripts written in C compile at runtime on the client system, which makes the client vulnerable.
E. If the server and client do not have identical compilerversions, the lesser compiler is used, which may known exploits.

Answer: B

Apache webserver interview questions

2016-09-15T00:13:00.000-07:00

1. What is Apache web server?

Answer : Apache web server HTTP is a most popular, powerful and Open Source to host websites on the web server by serving web files on the networks. It works on HTTP as in Hypertext Transfer protocol, which provides a standard for servers and client side web browsers to communicate. It supports SSL, CGI files, Virtual hosting and many other features.

2. How to check Apache and it’s version?

Answer : First, use the rpm command to check whether Apache installed or not. If it’s installed, then use httpd -v command to check its version.

[root@tecmint ~]# rpm -qa | grep httpd

httpd-devel-2.2.15-29.el6.centos.i686
httpd-2.2.15-29.el6.centos.i686
httpd-tools-2.2.15-29.el6.centos.i686

[root@tecmint ~]# httpd -v

Server version: Apache/2.2.15 (Unix)
Server built:   Aug 13 2013 17:27:11

3. Apache runs as which user? and location of main config file?.

Answer : Apache runs with the user “nobody” and httpd daemon. Apache main configuration file: /etc/httpd/conf/httpd.conf (CentOS/RHEL/Fedora) and /etc/apache2.conf (Ubuntu/Debian).

4. On which port Apache listens http and https both?

Answer : By default Apache runs on http port 80 and https port 443 (for SSL certificate). You can also use netstat command to check ports.

[root@tecmint ~]# netstat -antp | grep http

tcp        0      0 :::80                       :::*                        LISTEN      1076/httpd          
tcp        0      0 :::443                      :::*                        LISTEN      1076/httpd

5. How do you install Apache Server on your Linux machine?

Answer : Simply, you can use any package installer such as yum on (RHEL/CentOS/Fedora) and apt-get on (Debian/Ubuntu) to install Apache server on your Linux machine.

[root@tecmint ~]# yum install httpd

[root@tecmint ~]# apt-get install apache2

6. Where you can find all configuration directories of Apache Web Server?

Answer : By default Apache configuration directories installed under /etc/httpd/ on (RHEL/CentOS/Fedora) and /etc/apache2 on (Debian/Ubuntu).

[root@tecmint ~]# cd /etc/httpd/
[root@tecmint httpd]# ls -l
total 8
drwxr-xr-x. 2 root root 4096 Dec 24 21:44 conf
drwxr-xr-x. 2 root root 4096 Dec 25 02:09 conf.d
lrwxrwxrwx  1 root root   19 Oct 13 19:06 logs -> ../../var/log/httpd
lrwxrwxrwx  1 root root   27 Oct 13 19:06 modules -> ../../usr/lib/httpd/modules
lrwxrwxrwx  1 root root   19 Oct 13 19:06 run -> ../../var/run/httpd

[Root @ tecmint ~] # cd / etc / apache2 
[root @ tecmint apache2] # ls -l 
total 84 
-rw-r - 1 root root 7113 Jul 24 16:15 r-- apache2.conf 
drwxr-xr-x 2 root root 4096 Dec 16 11:48 conf-available 
drwxr-xr-x 2 root root 4096 Dec 16 11:45 conf.d 
drwxr-xr-x 2 root root 4096 Dec 16 11:48 conf-enabled 
-rw-r --r-- 1 root root 1782 Jul 21 02:14 envvars 
-rw-r - 1 root root 31063 Feb 21 02:14 r-- magic 
drwxr-xr-x 2 root root 12288 Dec 16 11:48 mods- Available 
drwxr-xr-x 2 root root 4096 Dec 16 11:48 mods-enabled 
-rw-r - 1 root root 315 Jul 21 02:14 r-- ports.conf 
drwxr-xr-x 2 root root 4096 Dec 16 11:48 bate available 
drwxr-xr-x 2 root root 4096 Nov-6 00:04 bate-enabled

7. Can Apache be secured with TCP wrappers?

Answer : No, It can’t be secured with the TCP wrappers since it doesn’t support libwrap.a library of Linux.

8. How to change default Apache Port and How Listen Directive works in Apache?

Answer : There is a directive “Listen” in httpd.conf file which allows us to change the default Apache port. With the help of Listen directive we can make Apache listen on different port as well as different interfaces.

Suppose you have multiple IPs assigned to your Linux machine and want Apache to receive HTTPrequests on a special Ethernet port or Interface, even that can be done with Listen directive.

To change the Apache default port, please open your Apache main configuration filehttpd.confor apache2.conf file with VI editor.

[root@tecmint ~]# vi /etc/httpd/conf/httpd.conf

[root@tecmint ~]# vi /etc/apache2/apache2.conf

Search for the word ”Listen”, comment the original line and write your own directive below that line.

# Listen 80
Listen 8080

OR

Listen 172.16.16.1:8080

Save the file and restart the web server.

[root@tecmint ~]# service httpd restart

[root@tecmint ~]# service apache2 restart

9. Can we have two Apache Web servers on a single machine?

Answer : Yes, we can run two different Apache servers at one time on a Linux machine, but the condition for that is they should listen on different ports and we can change the ports with Listen directive of Apache.

10. What do you mean by DocumentRoot of Apache?

Answer : DocumentRoot in Apache means, it’s the location of web files are stored in the server, the default DocumentRoot of Apache is /var/www/html or /var/www. This can be changed to anything, by setting up “DocumentRoot” in a virtual host of configuration file of domain.

11. How to host files in different folder and what is Alias directive?

Answer : Yes, this can be achieved by Alias directive in the main Apache configuration file. Alias directive maps resources in File system, it takes a URL path and substitute it with a file or directory path on the system with is set up to redirect.

To use Alias directive, Its the part of mod_alias module of Apache. The default syntax of Alias directive is:

Alias /images /var/data/images/

Here in above example, /images url prefix to the /var/data/images prefix that mean clients will query for “http://www.example.com/images/sample-image.png” and Apache will pick up the “sample-image.png” file from /var/data/images/sample-image.png on the server. It’s also known as URL Mapping.

12. What do you understand by “DirectoryIndex”?

Answer : DirectoryIndex is the name of first file which Apache looks for when a request comes from a domain. For example: http://www.example.com is requested by the client, so Apache will go the document root of that website and looks for the index file (first file to display).

The default setting of DirectoryIndex is .html index.html index.php, if you have different names of your first file, you need to make the changes in httpd.conf or apache2.conf for DirectoryIndex value to display that to your client browser.

#
# DirectoryIndex: sets the file that Apache will serve if a directory
# is requested.
#
# The index.html.var file (a type-map) is used to deliver content-
# negotiated documents.  The MultiViews Option can be used for the
# same purpose, but it is much slower.
#
DirectoryIndex index.html index.html.var index.cgi .exe

13. How to disable Directory listing when an index file is missing?

Answer : If, the main index file is missing in the website root directory, then the Apache will lists all the contents like files and folder of the website on the browser instead of Main website pages.

To stop Apache directory listing, you can set the following rule in the main configuration file globally or in .htaccess file for a particular website.

<Directory /var/www/html>
   Options -Indexes
</Directory>

14. What are different log files of Apache Web Server?

Answer : The default log files of Apache Web Server are access log “/var/log/httpd/access_log” and error log :/var/log/httpd/error_log”.

15. What do you understand by “connection reset by peer” in error logs?

Answer : When the server is serving any ongoing Apache request and end user terminates the connection in between, we see “connection reset by peer” in the Apache error logs.

16. What is Virtual Host in Apache?

Answer : The Virtual Host section contains the information like Website name, Document root, Directory Index, Server Admin Email, ErrorLog File location etc.

You are free to add as many directives you require for your domain, but the two minimal entries for a working website is the ServerName and DocumentRoot. We usually define our Virtual Host section at the bottom of httpd.conf file in Linux machines.

Sample VirtualHost

<VirtualHost *:80>
   ServerAdmin webmaster@dummy-host.example.com
   DocumentRoot /www/docs/dummy-host.example.com
   ServerName dummy-host.example.com
   ErrorLog logs/dummy-host.example.com-error_log
   CustomLog logs/dummy-host.example.com-access_log common
</VirtualHost>

ServerAdmin : Its usually the email address of the website owner, where the error or notification can be sent.
DocumentRoot : location where the web files are located in the server(Necessary).
ServerName : Its the domain name which you want to access from your web browser(Necessary).
ErrorLog : Its the location of the log file where all the domain related logs are being recorded.

17. What’s the difference between <Location> and <Directory>?

Answer :

<Location> is used to set element related to the URL / address bar of the web server.
<Directory> refers that the location of file system object on the server

18. What is Apache Virtual Hosting?

Answer : Apache Virtual hosting is the concept of hosting multiple website on a single web server. There are two types of Virtual hosts can be setup with Apache are Name Based Virtual hosting and IP based virtual hosting.

For more information, read on How to Create Name/IP based Virtual Hosts in Apache.

19. What do you understand by MPM in Apache?

Answer : MPM stands for Multi Processing Modules, actually Apache follows some mechanism to accept and complete web server requests.

20. What is the difference between Worker and Prefork MPM?

Answer : Both MPMs, Worker and prefork has their own mechanism to work with Apache. It totally depends on you that in which mode you want to start your Apache.

Basic difference between Worker and MPM is in their process of spawning the child process. In the Prefork MPM, a master httpd process is started and this master process starts manages all other child processes to serve client requests. Whereas, In the worker MPM one httpd process is active, and it uses different threads to serve client requests.
Prefork MPM uses multiple child processes with one thread each, where worker MPM uses multiple child processes with many threads each.
Connection handling in the Prefork MPM, each process handles one connection at a time, whereas in the Worker mpm each thread handles one connection at a time.
Memory footprints Prefork MPM Large memory footprints, where Worker has smaller memory footprints.

21. What’s the use of “LimitRequestBody” and how to put limit on your uploads?

Answer : LimitRequestBody directive is used to put a limit on the upload size.

For example: I want to put limits of 100000 Bytes in the folder /var/www/html/tecmin/uploads. So, you need to add following directive in Apache configuration file.

<Directory "/var/www/html/tecmint/uploads">
LimitRequestBody 100000
</Directory>

22. What is mod_perl and mod _php?

Answer :

mod_perl is an Apache module which is compiled with Apache for easy integration and to increase the performance of Perl scripts.
mod_php is used for easy integration of PHP scripts by the web server, it embeds the PHP interpreter inside the Apache process. Its forces Apache child process to use more memory and works with Apache only but still very popular.

23. What is Mod_evasive?

Answer : Its a third-party module which helps us to prevent your web server from the web attacks like DDOS because it performs only one task at a time and performs it very well.

For more information, read the article that guides you how to install and configure mod_evasive in Apache.

24. What is Loglevel debug in httpd.conf file?

Answer : With the help of Loglevel Debug option, we can get/log more information in the error logs which helps us to debug a problem.

25. What’s the use of mod_ssl and how SSL works with Apache?

Answer : Mod_ssl package is an Apache module, which allows Apache to establish its connection and transfer all the data in a secure encrypted environment. With the help of SSL certificates, all the Login details and other important secret details get transferred in an encrypted manner over the Internet, which prevents our data from Eavesdropping and IP spoofing.

How SSL works with Apache

Whenever an https requests comes, these three steps Apache follows:

Apache generates its private key and converts that private key to .CSR file (Certificate signing request).
Then Apache sends the .csr file to the CA (Certificate Authority).
CA will take the .csr file and convert it to .crt (certificate) and will send that .crt file back to Apache to secure and complete the https connection request.

Criteria	Linux	Windows
Type of OS	Open Source	Proprietary
Customization	High level of customization	Cannot be changed
Security	Excellent	Cannot be changed