Chapter 7 - Application Services

In a TLS handshake, what does the server present to prove its identity?

A digital certificate issued by a trusted CA

Why: The certificate contains the server's public key. The client verifies it against a CA it trusts before building the encrypted tunnel.

What does Perfect Forward Secrecy (PFS) provide?

Session keys that are not retained, so captured traffic cannot be decrypted later even if the private key is stolen

Why: With PFS each session uses temporary keys, so compromising the server's private key later does not expose old sessions.

Which protocol and port does NTP use?

UDP 123

Why: NTP runs over UDP 123. Network Time Security (NTS) runs over TCP 4460.

Where does a stratum 1 NTP server get its time?

Directly from an accurate clock source such as GPS or an atomic clock

Why: Stratum 1 servers connect directly to a precise time source. Each network hop away is a higher stratum number.

NTP corrects a clock that is off by only a few seconds. Which method does it use?

Slew

Why: Slewing adjusts the clock a few milliseconds at a time, which is safer. Slamming hard resets the clock when it is off by a lot, and can break some programs.

Which protocol provides nanosecond-level time accuracy and is defined in IEEE 1588?

PTP

Why: Precision Time Protocol is used where timing is critical, such as financial trading, 5G, and industrial processes.

Which statement about HTTP is true?

It is nominally stateless, so servers use cookies to track sessions

Why: HTTP does not require servers to remember clients. Cookies and scripting add session information, but they also increase the attack surface.

In active mode FTP, which port does the server use for the data connection?

TCP 20

Why: Port 21 is the control connection. In active mode the server opens the data connection from port 20 to the client.

Which statement about TFTP is correct?

It uses UDP 69 and has no security

Why: TFTP is connectionless, supports only simple get and put, and has no security. It is mostly used for device configuration files and firmware.

What is the difference between FTPES and FTPS?

FTPES starts unencrypted on port 21 and upgrades with AUTH TLS; FTPS uses implicit TLS, commonly on port 990

Why: Explicit TLS (FTPES) upgrades an existing connection. Implicit TLS (FTPS) negotiates TLS first. FTPES is usually preferred because it works better with firewalls.

Which ports should be blocked at the perimeter firewall to protect SMB file sharing?

TCP 137 to 139 and 445

Why: SMB and NetBIOS ports (137 to 139 and 445) should only be used on trusted local networks. SMB1 should be disabled.

What is a Network Attached Storage (NAS) device?

A dedicated file server appliance accessed over the network using protocols like SMB or FTP

Why: A NAS provides file-level storage and often uses RAID for fault tolerance. Its main drawback is that it shares bandwidth with other traffic.

Which default TCP port does Microsoft SQL Server use?

1433

Why: SQL Server is 1433, Oracle is 1521, MySQL and MariaDB are 3306, and PostgreSQL is 5432.

Which SMTP port is used for client message submission with explicit TLS (STARTTLS) and authentication?

587

Why: Port 587 is submission with STARTTLS. Port 25 is server-to-server relay, and 465 is submission with implicit TLS.

What is the default secure port for IMAP over TLS?

993

Why: IMAPS uses TCP 993. Plain IMAP uses 143, and POP3 over TLS uses 995.

In VoIP, which protocol sets up and manages sessions, and which carries the actual voice media?

SIP sets up sessions; RTP carries media

Why: SIP (UDP/TCP 5060, or 5061 for SIP-TLS) handles session control. RTP, monitored by RTCP, delivers the audio or video stream.

A VoIP phone has a PC plugged into its pass-through port. How are voice and data kept separate?

Separate VLAN IDs for voice and data on the shared link

Why: A voice VLAN lets one physical link carry both traffic types while keeping them logically separate.

A hot site is best described as:

A site with equipment and live data that can fail over almost immediately

Why: Hot sites fail over almost immediately. Warm sites need the latest data loaded, and cold sites take the longest to set up.

A database is destroyed and the RPO is 24 hours. What does this mean?

Up to 24 hours of data loss is acceptable

Why: RPO measures acceptable data loss in time. RTO measures how long a system may be offline.

What relationship must hold between RTO, WRT, and MTD?

RTO + WRT must not exceed MTD

Why: Recovery time plus work recovery time must fit inside the maximum tolerable downtime.

Twenty appliances each run for 100 hours, and 4 fail in total. What is the MTBF?

500 hours per failure

Why: MTBF = total operational time divided by failures: (20 x 100) / 4 = 500 hours per failure.

Which type of load balancer can make forwarding decisions based on a requested URL?

Layer 7 switch (content switch)

Why: Layer 7 balancers use application-level data. Layer 4 balancers use IP addresses and TCP/UDP ports.

Which protocol is an open standard that provides first hop redundancy with a master and backup routers?

VRRP

Why: VRRP is the open standard. HSRP is Cisco proprietary and uses active and standby routers.

Which port does Network Time Security (NTS) use?

TCP 4460

Why: NTS adds TLS protection to time synchronization and uses TCP 4460.

Which protocol provides TLS-style protection for UDP traffic, often used in VPNs?

DTLS

Why: Datagram TLS (DTLS) secures UDP. Regular TLS secures TCP.

Which web hosting option gives a customer a virtual machine on a physical server isolated by a hypervisor?

Virtual private server (VPS)

Why: A VPS is an isolated VM. Shared hosting places sites in directories on one server, and a dedicated server is a whole physical machine.

Which SIP port is used for secure SIP with TLS?

5061

Why: SIP uses 5060 unsecured and 5061 for SIP-TLS.

A cluster has one node processing connections while the other waits to take over. What is this?

Active-passive

Why: In active-passive, performance is not reduced at failover but one node sits idle. In active-active both process traffic, and failover reduces performance.

About how much downtime per year does 99.999% (five nines) availability allow?

About 5 minutes

Why: Five nines is about 5 minutes 15 seconds per year. Four nines is about 52 minutes.

Which recovery site has equipment but needs the latest data loaded before use?

Warm site

Why: A warm site sits between hot (live data) and cold (empty space).

What is a tabletop exercise?

A discussion-based walkthrough of a hypothetical disaster scenario

Why: Tabletop exercises find gaps in plans and communication. Validation tests simulate actual failovers.