FINALExamination

CSE50
March 12, 2020

Instructions:

1. You may use any sources, including books, online sources, lecture slides, or
lecture notes to answer the questions.

2. If you use statements or data from any source directly in your answers, you
must add a reference to the source.

3. This is a test of your knowledge. As such your answers must be your own

work. No collaboration with other students is allowed.

4. A Declaration of Own Work, in which you formally confirm that the answers
you submit are entirely your own work, is included with this final exam. You
must sign this Declaration and submit it with your answers to the exam. If
you do not submit this Declaration, your submission will not be graded and
you will receive 0 points for the final exam.

5. Submit your answers and your Declaration of Own Work on the Canvas class

website in pdf format by 23:59:59 on March 17, 2020. Ensure that your name
and “CSE50 W20 Final Exam” are clearly visible on every page you submit.
Late submissions will automatically lose 10 points.

6. Read the iPremier case study below about the sequence of events during a

denial of service attack, and then answer the questions following the case
study. The approximate time that each question is likely to require is
indicated at the end of the introduction to each question.

Total points: 100

Question 1: (10 minutes)
Exhibit 1 illustrates the services provided by QData. Which of the three primary cloud
computing models does this QData service represent? Justify your answer in no more than
150 words. [5 points]

Question 2: (15 minutes)
2.1) In 3 or 4 sentences, describe the failure mechanism in the TCP layer that caused the
iPremier router running iPremier’s firewall to no longer respond to a potential customer’s
web access attempt during the DDoS attack. [5 points]

2.2) In 2 or 3 sentences, explain why the hackers could force the failure to occur at the
iPremier firewall/router and not at other compute or networking elements that an
attacker’s web request traverses and that also include the TCP layer (such as the QData
router)? [5 points]

Question 3: (10 minutes)
In 3 or 4 sentences, describe the function of the Domain Name Servers (DNS servers) in
Exhibit 1. Why were the DNS servers not the cause of failure during the attack?[5 points]

Question 4: (10 minutes)
The database server in Exhibit 1 contains a MySQL database management system. Among
the tables in the database are 2 tables: “Customers” and “Orders”. Each table contains a field
called “name”. Describe the result of each of the following queries (this will require you to
do some research on the “Inner Join” and “Outer Join” key words in SQL):

SELECT * FROM Customers
INNER JOIN Orders
ON Customers.name=Orders.name

SELECT * FROM Customers
LEFT OUTER JOIN Orders
ON Customers.name=Orders.name
[5 points]

Question 5: (30 minutes)
5.1) Describe the TCP/IP Reference Model layers that are traversed by a web page access
request as it progresses from entering the QData facility on the internet to the iPremier web
server, for each of the following networking and compute components: 1) the internet
router at the QData facility, 2) the router/firewall in the iPremier “cage” at QData, 3) the
ethernet switch and 4) an iPremier web server in the web server cluster. [10 points]

5.2) Illustrate your answer to 5.1) with a diagram showing the OSI layers implemented in
each of these four components and the path of the web request through these layers. [10
points]

Question 6: (20 minutes)
6.1) In 2 or 3 sentences each, describe four business processes that were poorly
implemented at iPremier and that directly or indirectly enabled this cyber attack to
succeed. [10 points]

6.2) If you were CIO at iPremier, what actions would you take to correct each of these
business process failures? Describe your proposed actions in 2 or 3 sentences for each
business process. [10 points]

Question 7: (25 minutes)
As the new CIO at iPremier, you decide that it is necessary replace the QData facility and
services. You have narrowed your options down to three choices: 1) Migrate your entire
data center to IaaS cloud provider Amazon Web Services; 2) Migrate your entire data center
to PaaS cloud provider Microsoft Azure; 3) Build and provision your own data center.
Identify two key advantages and 2 key disadvantages for each option. Describe each
advantage and disadvantage in 1 or 2 sentences. Which option would you choose? Justify
your answer in 150 words or less. [15 points]

Question 8: (30 minutes)
You have presented your proposal for replacing the QData facility (Question 7) to the CEO
and Board of Directors and they have approved it, with one major caveat: they required you
to ensure that the transition is seamless so that no lost business is incurred. You agree to
describe your implementation plan at a special meeting of the Board within 1 week.

8.1) In preparation for that meeting, identify and list the team that you need to implement
this transition (both internal to the company, by business function, and external – hint:
review the Cisco case study) [5 points]

8.2) Identify a countermeasure that you recommend the company deploys as part of this
project that would significantly reduce the likelihood of a SYN Flood attack. Describe how
the countermeasure would prevent SYN Flood attacks in 2 -3 sentences. [5 points]

8.3) You plan to use Lean Disciplined Agile Development (Scrum) to implement your
proposal. In 150 words or less, describe to the Board of Directors how the Scrum process
will enable you to accurately determine the time required to complete the project. [10
points]

CSE50 Final Examination
March 12, 2020

DECLARATION OF OWN WORK

I hereby declare that all answers I have submitted for the CSE50 Winter 2020 Final

Examination are entirely my own work. I further declare that I have not

collaborated in any way with any other student in the CSE50 Winter 2020 class in

preparing my answers to the CSE50 Winter 2020 Final examination.

Name: _________________________________________________________

Signature: _____________________________________________________

Date: ___________________________________________________________