CS 6250 Quiz 10 (All Quizzes) 2026/2027 Latest Update | Verified Questions and Correct Answers

Exam

CS 6250 Quiz 10 (All Quizzes) 2026/2027 Latest Update | Verified Questions and Correct Answers | Complete Study Guide – Georgia Institute of Technology ... 2026/2027 | GRADED A+ | 100 out of 100 Question: What is DNS censorship? Answer Large scale network traffic filtering strategy to suppress material which they deem as objectionable. Question: What are the properties of GFW (Great Firewall of China)? Answer 1) Locality of GFW nodes - majority view is that GFW censorship nodes are present at the edge. 2) Centralized management - blocklists obtained from two distinct GFW locations show a high possibility of a central GFW management entity that orchestrates blocklists. 3) Load balancing - GFW load balances between processes based on source and destination IP address. Question: Censorship Technique 1: DNS injection Answer For DNS requests that are blocked by the GFW, the GFW will respond with a fake DNS record to prevent the client from reaching the requested content. Question: 3 steps of DNS injection Answer 1) DNS probe is sent to a DNS resolver 2) The probe is checked against the blocklist 3) A fake DNS A record response is sent back if the request matches the blocklist. The direct domain can be blocked, or specific domain keywords can be blocked. Question: How many DNS Censorship Techniques are there? Answer 5 Question: 1. Packet dropping Answer all network traffic going to a set of specific IP addresses is discarded Question: Pros: (easy to implement, low cost) Answer Cons: (maintain a long blocklist, overblocking) Question: 2. DNS Poisoning Answer When a DNS receives a query for resolving hostname to IP address - if there is no answer returned or an incorrect answer is sent to redirect or mislead the user request Question: Pros: (No overblocking) Answer Cons: (Blocks the entire domain) Question: 3. Content inspection Answer all traffic traverses a proxy and is inspected for objectionable content, if matches -> dropped Question: Pros: (precise censorship, flexible) Answer Cons: (not scalable) Question: 4. Blocking with reset Answer sends a TCP (RST) to block individual connections that contain requests with objectionable content. Question: 5. Immediate reset Answer suspends traffic coming from a source immediately, for a short period of time Question: What is overblocking? Answer If two websites share the same IP address and the intention is to only block one of them, there's a risk of blocking both Question: Our understanding of censorship around the world is relatively limited. Why is it the case? What are the challenges? Answer 1) Diverse measurements 2) Need for scale 3) Identifying the intent to restrict content access 4) Ethics and minimizing risks Question: What are the limitations of main censorship detection systems? Answer They either no longer exist or rely upon volunteers performing measurements, which can cause them to get in trouble with their local governments. Question: Augur Answer This system focuses on IP-based disruptions, not DNS-based manipulations. Question: IRIS Answer Machine learning model for identifying DNS manipulation Question: How does Iris counter the issue of lack of diversity while studying DNS manipulation? What are the steps associated with the proposed process? Answer Iris uses open DNS resolvers located all over the globe. Question: The two main steps are: Answer 1) Scanning the Internet's IPv4 space for open DNS resolvers 2) Identifying infrastructure DNS resolvers Question: What are the steps involved in the global measurement process using DNS resolvers? Answer 1) Perform global DNS queries 2) Annotating DNS responses with auxiliary information 3) Additional PTR and TLS scanning Question: What metrics does Iris use to identify DNS manipulation once data annotation is complete? Describe the metrics. Under what condition, do we declare the response as being manipulated? Answer 1) Consistency metrics 2) Independent verifiability metrics If neither of these metrics are satisfied, the response is said to be manipulated Question: How is it possible to achieve connectivity disruption using routing disruption approach? Answer Withdrawing previously advertised prefixes or re-advertising them with different properties using BGP Question: How is it possible to achieve connectivity disruption using packet filtering approach? Answer Block packets meeting a certain criteria disrupting the normal forwarding action. Question: IP ID Answer Assigned a unique 16-bit IP identifier ("IP ID"), which the destination host can use to reassemble a fragmented packet. This IP ID should be different for the packets that are generated by the same host. Question: 2 mechanisms used by Augur Answer 1) Probing: a mechanism to monitor the IP ID of a host over time. 2) Perturbation: mechanism which forces a host to increment its IP ID counter by sending traffic from different sources such that the host generates a response packet. Question: Explain a scenario of connectivity disruption detection in case when no filtering occurs. Answer When no filtering occurs, the measurement machine will see an increase of 2 in the IP ID - this means the two hosts communicated Question: Explain a scenario of connectivity disruption detection in case of the inbound blocking. Answer Traffic from the reflector to the site containing objectionable data is blocked. Thus, the IP ID only increases by 1 because the SYN-ACK from the site never reaches the reflector. Question: Explain a scenario of connectivity disruption detection in case of the outbound blocking. Answer Outbound reset packets from the reflector do not reach the site. The site will continue to send SYN-ACK packets until it receives an ACK, causing the reflector's IP ID to increase by 2 each time. Question: DNS censorship Answer A large scale network traffic filtering strategy opted by a network to enforce control and censorship over Internet infrastructure to suppress material which they deem as objectionable. Question: Great Fire Wall properties Answer Locality of GFW nodes Centralized management Load balancing Question: DNS Injection Answer Using a ruleset to determine when to inject DNS replies to censor network traffic. Question: DNS Injection Steps Answer 1. DNS probe is sent to the open DNS resolvers 2. The probe is checked against the blocklist of domains and keywords Fe. or domain level blocking, a fake DNS A record response is sent back. Question: Packet dropping strengths Answer Easy to implement, low cost Question: Packet dropping weaknesses Answer Maintenance of blocking, overblocking Question: DNS poisoning Answer When a DNS receives a query for resolving hostname to IP address, an incorrect answer is sent to redirect or mislead Question: DNS poisoning strength and weakness Answer Strength: No overblocking Weakness: Blocks entire domain Content inspection Answer It allows for all network traffic to pass through a proxy where the traffic is examined for content, and the proxy rejects requests that serve objectionable content. Content inspection strength Answer Precise censorship and flexible Content inspection weakness Answer Not scalable Blocking with resets Send a TCP reset (RST) to block individual connections that contain requests with objectionable content. Immediate reset of connections Blocking rules in addition to inspecting content, to suspend traffic coming from a source immediately, for a short period of time. Why is DNS Manipulation difficult to manage? Diverse Measurements Need for Scale Identifying the intent to restrict content access Ethics and Minimizing Risks Steps to use DNS Resolvers Scanning the Internet's IPv4 space for open DNS resolvers Identifying Infrastructure DNS Resolvers DNS Resolver Measurement Process Performing global DNS queries Annotating DNS responses with auxiliary information Additional PTR and TLS scanning 2 metrics to identify DNS manipulation Consistency metrics and independent verifiability metrics Packet filtering It can be used to block packets matching a certain criteria disrupting the normal forwarding action. This approach can be harder to detect and might require active probing of the forwarding path or monitoring traffic of the impacted network. IP ID Any packet that is sent by a host is assigned a unique 16-bit IP identifier ("IP ID"), which the destination host can use to reassemble a fragmented packet. The global counter is incremented for each packet that is generated and helps in keeping track of the total number of packets generated by that host. Probing A mechanism to monitor the IP ID of a host over time. We use the measurement machine to observe the IP ID generated by the reflector. Pertubation Forces a host to increment its IP ID counter by sending traffic from different sources such that the host generates a response packet. Inbound blocking Filtering occurs on the path from the site to the reflector is termed as inbound blocking. Outbound blocking Filtering imposed on the outgoing path from the reflector. What kind of disruptions does Augur focus on? IP How does Iris counter the lack of diversity while studying DNS manipulation? She uses DNS resolvers Routing disruption The routers share which destinations it can reach and continuously update its forwarding tables to select the best path for an incoming packet. If this communication is disrupted or disabled on critical routers, it could result in unreachability of the large parts of a network.

Preview 2 out of 13 pages