1) State limitations of Firewall.
• Can't stop internal threats – Firewalls can't detect attacks from inside the network.
• No protection against phishing – They can't block fake websites or emails.
• Limited to set rules – Only works based on rules set by the user/admin.
• Can't inspect encrypted data – Encrypted traffic can pass without full checking.
• No virus detection – Firewalls don't scan for viruses or malware.
• Bypass possible – Skilled attackers may find ways to bypass the firewall.
2) Define a firewall. Enlist types of firewalls.
A firewall is a security tool that controls the incoming and outgoing network traffic. It
helps block unauthorized access to or from a private network.
Types of Firewalls:
1. Packet Filtering Firewall – Checks each packet and allows or blocks it based on rules.
2. Stateful Inspection Firewall – Tracks active connections and decides based on state
and rules.
3. Proxy Firewall – Filters traffic through a middle server (proxy).
4. Next-Generation Firewall (NGFW) – Advanced firewall with features like antivirus
and intrusion detection.
5. Software Firewall – Installed on individual devices (like PCs).
6. Hardware Firewall – A physical device used for network protection.
3) Define AS, TGS with respect to Kerberos.
AS(Authenticating Server)
It checks the user's identity and gives a Ticket Granting Ticket (TGT) if the user is
valid.
TGS(Ticket Granting Server)
It uses the TGT to give service tickets, which allow the user to access specific
services securely.
4) State two difference between Firewall and Intrusion Detection System
1. Firewall blocks unwanted traffic; IDS only detects and alerts about suspicious activity.
2. Firewall works as a gatekeeper; IDS works like a security camera watching for threats.
3. Firewall takes action in real-time; IDS only notifies, doesn't stop the attack directly.
5) List any four types of Cybercrime
1. Hacking – Breaking into someone’s computer or network without permission.
2. Phishing – Tricking people to give personal info through fake emails or websites.
3. Identity Theft – Stealing someone's personal details to commit fraud.
4. Cyberbullying – Harassing or threatening someone online.
6) Define AH & ESP with respect to IP security.
AH (Authentication Header):
It provides authentication and data integrity, but does not encrypt the data.
ESP (Encapsulating Security Payload):
It provides encryption, authentication, and data integrity, making the data confidential and
secure.
7) Working of Network-Based IDS and Packet Filter Firewall
Network-Based Intrusion Detection System (NIDS)
1. Monitors Network Traffic: Continuously observes data packets on the network for
suspicious activity.
2. Analyzes Packet Data: Inspects the content and headers of packets for known attack
patterns or anomalies.
3. Generates Alerts: Sends alerts to administrators when potential threats are detected.
4. No Blocking: It only detects and reports threats—it doesn't block them directly.
Packet Filter Firewall
1. Examines Headers: Inspects IP packet headers (source IP, destination IP, port
number, protocol).
2. Applies Rules: Uses pre-defined rules to allow or block packets.
3. Works at Network Layer: Operates mainly at the network layer of the OSI model.
4. Stateless Filtering: Does not track the state of connections—each packet is treated
independently.
8) Describe the host-based intrusion detection system with a suitable diagram.
Host-Based Intrusion Detection System (HIDS):
• HIDS is installed on individual computers or servers (hosts).
• It monitors activities like file changes, login attempts, system logs, etc.
• It checks for unauthorized access, malware, or suspicious behavior on that host.
• Works best for internal threat detection on a specific device.
Key Functions of HIDS:
1. Monitors System Files: Detects unauthorized changes in important system or
application files.
2. Analyzes Logs: Reviews system and application logs for suspicious activity.
3. Detects Unauthorized Access: Alerts when there are unusual login attempts or
privilege escalations.
4. Monitors System Behavior: Keeps an eye on running processes and resource usage
for abnormal behavior.
9) Describe the terms of intellectual property: Copyright, Patent, Trademark
Copyright:
• Protects original creative works like books, music, videos, software, etc.
• Gives the creator the right to copy, distribute, and modify their work.
2. Patent:
• Protects new inventions or processes.
• Gives the inventor exclusive rights to make, use, or sell the invention for a certain
time.
3. Trademark:
• Protects brand names, logos, symbols, or slogans.
• Helps identify and distinguish the source of products or services.
10) Describe COBIT framework with neat sketch for 4m
COBIT Framework (Control Objectives for Information and Related Technology):
• COBIT is a framework for managing and governing IT in an organization.
• It helps align IT goals with business goals.
• Focuses on control, security, risk management, and performance.
• Used to ensure that IT delivers value and minimizes risks.
Main Components of COBIT:
1. Governance – Ensures stakeholder needs are met.
2. Management – Plans, builds, runs, and monitors IT services.
3. Processes – A set of activities for IT control.
4. Enablers – Tools/resources like policies, culture, information, etc.
11) Construct Digital Signature Using Cryptool (4 Marks):
Constructing Digital Signature Using CrypTool
Digital Signature is used to verify the authenticity and integrity of a message.
Steps to Create Digital Signature in CrypTool:
1. Open CrypTool and type the message you want to sign.
2. Go to Digital Signatures → Create/Verify Signature.
3. Select a Private Key (you can generate one if needed).
4. Click on "Sign the Document" – CrypTool will generate the digital signature.
5. Save or view the signature attached to your message.
12) Differences Between Symmetric and Asymmetric Key Cryptography
13) State any two policies of the firewall
Default Deny Policy:
• Blocks all traffic by default and only allows specific traffic that is explicitly
permitted.
.Default Allow Policy:
• Allows all traffic by default and only blocks specific traffic that is considered
harmful.
14) State different Firewall configurations
Different Firewall Configurations:
1. Packet Filtering Firewall:
Filters traffic based on IP address, port, and protocol.
2. Stateful Inspection Firewall:
Tracks the state of active connections and filters accordingly.
3. Proxy Firewall:
Acts as an intermediary between user and the internet, filtering at the application level.
4. Next-Generation Firewall (NGFW):
Combines traditional firewalls with advanced features like deep packet inspection and
intrusion detection.
15) Define & explain :
(i) Circuit Gateway
(ii) Honey Pots
(iii) Application Gateway
i) Circuit Gateway:
1. Works at the session layer to control connections.
2. Creates a virtual connection without checking the actual data.
(ii) Honeypots:
1. A fake system used to attract and trap attackers.
2. Helps in monitoring and studying hacking attempts.
(iii) Application Gateway:
1. Works at the application layer and filters specific app traffic.
2. Acts as a proxy between the user and the internet for better security.
16) Sate IP security modes
IP Security Modes:
1. Transport Mode:
o Encrypts only the payload (data) of the IP packet.
o Used for end-to-end communication (e.g., between two hosts).
2. Tunnel Mode:
o Encrypts the entire IP packet (header + payload).
o Used for network-to-network communication (e.g., VPNs).
17) Explain IPSec protocol
IPSec (Internet Protocol Security)
IPSec is a protocol that secures data over IP networks by providing encryption,
authentication, and integrity.
It works in two modes:
• Transport Mode – Encrypts only the data (payload).
• Tunnel Mode – Encrypts the entire IP packet (used in VPNs).
It uses two main protocols:
• AH (Authentication Header) – for authentication and integrity.
• ESP (Encapsulating Security Payload) – for encryption, authentication, and integrity.
----------------------------------------------------Ice Cream nhi khilayi ab kuch to khila doo ---------
