Quiz
Security 150 - 200
This quiz has a time limit, so it opens in the usual player.
Questions in this quiz (50)
1Which of the following are asymmetric algorithms? (Select 3 choices.)
- ADH
- BAES
- C3DES
- DECC
- ERC4
- FRSA
2Which of the following statements are true regarding class maps on a Cisco ASA? (Select 2 choices.)
- AQoS traffic shaping is not available for all class maps.
- BClass maps apply specific security measures on a persession basis.
- CBy default, no class maps are defined on an ASA.
- DClass maps must use an ACL to match traffic.
- EClass maps can match traffic based on application protocols.
- FClass maps identify the interface to which a policy map is applied.
3Which of the following is true regarding the EAPFAST authentication process? (Select the best answer.)
- AA digital certificate is required only on the client.
- BA digital certificate is required only on the server.
- CDigital certificates are required on both the client and the server.
- DDigital certificates are not required on the client or the server.
4Which of the following security functions is associated with the data plane? (Select 2 choices.)
- Adevice configuration protection
- Bsignaling protection
- Ctraffic conditioning
- Dtraffic filtering
5Which of following capabilities do an IDS and IPS have in common? (Select the best answer.)
- Ablocking a particular connection
- Bblocking traffic from a particular host
- Cmodifying traffic
- Dresetting TCP connections
6Which of the following statements are true regarding RADIUS? (Select 2 choices.)
- AIt encrypts only the password in Access Request packets.
- BIt combines authorization and authentication functions.
- CIt provides more flexible security options than TACACS+.
- DIt uses TCP port 49.
- EIt is a Cisco proprietary standard protocol.
7Which of the following protocols can IPSec use to provide the confidentiality component of the CIA triad? (Select 2 choices.)
- AAES
- BAH
- CDES
- DMD5
- ESHA
8You issue the following commands on a Cisco ASA with no other configured interfaces:
asa(config)#interface gigabitethernet 0/1
asa(configif)#speed 1000 asa(configif)#duplex full asa(configif)#nameif inside
asa(configif)#ip address 10.1.1.1 255.255.255.0 asa(configif)#no shutdown
asa(configif)#exit
asa(config)#telnet 10.1.1.0 255.255.255.0 inside asa(config)#telnet timeout 30
Which of the following statements is true regarding the resulting configuration? (Select the best answer.)- ATelnet sessions will time out after 30 seconds of inactivity.
- BThe ASA will assign the interface a security level of 0.
- CThe ASA will assign the interface a security level of 100.
- DTelnet sessions will be denied until a security level is manually assigned.
9Which of the following vulnerabilities did the Blaster worm exploit on target hosts? (Select the best answer.)
- Aa buffer overflow vulnerability in the DCOM RPC service
- Ba buffer overflow vulnerability in IIS software
- Ca buffer overflow vulnerability in Microsoft SQL Server
- Da remote code execution vulnerability in the printer spooler service
- Ea remote code execution vulnerability in the processing of .lnk files
10Which of the following statements is true regarding the primary bootset when the Cisco IOS Resilient Configuration feature is enabled? (Select the best answer.)
- AThe configuration file can be secured on a TFTP server, but the system image must be secured on local storage.
- BThe system image can be secured on a TFTP server, but the configuration file must be secured on local storage.
- CThe configuration file and the system image must both be secured on local storage.
- DThe configuration file and the system image must both be secured on remote storage.
11Which of the following can be installed on a host to ensure that only specified inbound and outbound connections are permitted? (Select the best answer.)
- Aantivirus software
- Ba IDS
- Ca personal firewall
- Da proxy server
12Which of the following statements are true regarding the FirePOWER inline normalization preprocessor engine? (Select 2 choices.)
- AInline normalization can process IPv4 and ICMPv4 traffic but not IPv6 traffic.
- BInline normalization can process IPv4 and IPv6 traffic but not ICMPv4 traffic.
- CInline normalization cannot detect TCP SYN flood attacks.
- DInline normalization cannot detect TCP session hijacking attacks.
- EInline normalization takes place immediately before decoding by the packet decoder.
13What is the effect of the samesecuritytraffic permit intrainterface command on a Cisco ASA? (Select the best answer.)
- AIt allows communication between different interfaces that share the same security level.
- BIt allows traffic to exit the same interface through which it entered.
- CIt allows outbound traffic and the corresponding return traffic to pass through different ASAs.
- DIt allows traffic destined to unprotected subnets to bypass a VPN tunnel.
14Which of the following statements is not true regarding an IPS device? (Select the best answer.)
- AAn IPS requires that at least one interface be in promiscuous mode.
- BSinglepacket attacks can be mitigated by an IPS.
- CTraffic leaves an IPS on a different interface than it entered.
- DAn IPS cannot route to destinations on different subnets.
15Which of the following statements is true regarding a split ACS deployment? (Select the best answer.)
- ACisco recommends using a dedicated log collector instead of the primary or secondary server.
- BThe split configuration has the drawback of making an administrator less aware of the functional status of each server.
- CThe AAA load is divided between the primary and secondary servers, which produces a lessthanoptimal AAA flow.
- DThe primary and secondary servers can be used for different, specialized operations such as network admission and device administration.
16For which of the following traffic types is stateful inspection not supported in a ZFW configuration? (Select the best answer.)
- ADNS
- BICMP
- CIGMP
- DNetBIOS
- ESun RPC
17Which of the following commands is not available to a user with a privilege level of 0? (Select the best answer.)
- Adisable
- Benable
- Cexit
- Dlogin
- Elogout
18Which of the following is most likely to cause the greatest amount of disruption on a router? (Select the best answer.)
- Aspyware
- Ba Trojan horse
- Ca worm
- Da DDOS attack
19The following partial command output is from the running configuration of an ASA that has been configured to authorize VPN users based on their group membership in AD:
ldap attributemap ExampleMap mapname memberOf GroupPolicy mapvalue memberOf CN=Managers,CN=Users,OU=bsnsw,DC=boson,DC=com Group5 mapvalue memberOf CN=Marketing,CN=Users,OU=bsnsw,DC=boson,DC=com Group4 mapvalue memberOf CN=Employees,CN=Users,OU=bsnsw,DC=boson,DC=com Group3 mapvalue memberOf CN=Engineers,CN=Users,OU=bsnsw,DC=boson,DC=com Group2 mapvalue memberOf CN=Finance,CN=Users,OU=bsnsw,DC=boson,DC=com Group1
An LDAP authorization query for a VPN user returns the following values:
memberOf: value = CN=Managers,CN=Users,OU=bsnsw,DC=boson,DC=com memberOf: value = CN=Marketing,CN=Users,OU=bsnsw,DC=boson,DC=com memberOf: value = CN=Employees,CN=Users,OU=bsnsw,DC=boson,DC=com memberOf: value = CN=Finance,CN=Users,OU=bsnsw,DC=boson,DC=com
Which group policy will the ASA assign to the user in this scenario? (Select the best answer.)- AGrupo 1
- BGrupo 2
- CGrupo 3
- DGrupo 4
- EGrupo 5
20Which of the following descriptions most accurately describes split tunneling? (Select the best answer.)
- AIt enables traffic to exit the same interface through which it entered.
- BIt enables traffic to flow between interfaces that share the same security level.
- CIt enables a VPN tunnel to form through a firewall or NAT device.
- DIt enables a VPN tunnel to determine which traffic flows should be encrypted.
21Which of the following IPS detection types does not require regularly updated definition files? (Select the best answer.)
- Apattern based
- Bprofile based
- Csignature based
- Dreputation based
22Which of the following statements is true regarding the sendlifetime command? (Select the best answer.)
- AThe default duration for sending keys is infinite.
- BYou cannot specify a duration based on a specific start and end time.
- CThe duration must be specified in one minute increments.
- DThe earliest start time value is January 1, 1970.
23Which of the following is a show ntp associations command output symbol that indicates that an IP address is an NTP master and the router is synchronized with the master? (Select the best answer.)
- A#
- B*
- C.
- D~
- E+
24Which of the following impact levels is used by FireSIGHT to indicate that either the source or target host is on a monitored network but has no corresponding entry in the network map? (Select the best answer.)
- A0
- B1
- C2
- D3
- E4
25Which of the following can the FirePOWER IMAP preprocessor extract in clienttoserver traffic? (Select the best answer.)
- AAttachments
- BFile Names
- Caddresses
- Dheader data
26Which of the following routing protocols does not support MD5 authentication for secure route updates? (Select the best answer.)
- ABGP
- BOSPF
- CRIPv1
- DRIPv2
- EEIGRP
27Which of the following is displayed by the show ip dhcp snooping databasecommand? (Select the best answer.)
- Athe DHCP snooping configuration for a switch
- Bdynamic entries in the binding table
- Cthe status of the binding table
- Ddetailed DHCP snooping statistics
28Under normal operating circumstances, which of the following planes sends the least amount of traffic to the route processor of a Cisco router? (Select the best answer.)
- AThe data plane
- BThe control plane
- CThe service plane
- DThe management plane
29Which of the following best describes an external cloud? (Select the best answer.)
- Adecentralized computer resources that can be accessed over the Internet
- Ba network zone between the Internet and a private or trusted network
- Ca portion of a private or trusted network that can be accessed by a business partner
- Dwebsites available only to users inside a private network
30Which of the following statements are true regarding the DfltGrpPolicy group policy? (Select 3 choices.)
- AIt cannot be modified.
- BIt is the default policy used with the DefaultRAGroup connection profile.
- CIt is the default policy used with the DefaultWEBVPNGroup connection profile.
- DIt can be applied to user profiles.
- EIt should be deleted if custom group policies are created.
31Which of the following is accomplished as a result of issuing the groupurl command on an ASA? (Select the best answer.)
- AA list of bookmarks will be created for clientless SSL VPN users.
- BA VPN access method will be created in which the connection profile is automatically selected for VPN users.
- CA webtype ACL will be created for a tunnel group.
- DA list of WebVPN servers will be applied to a user account.
32What is the default modulus size that is used to create a selfsigned certificate for SSL authentication on a Cisco ASA? (Select the best answer.)
- A512 bits
- B768 bits
- C1024 bits
- D2048
33Which of the following statements is true regarding private VLANs? (Select the best answer.)
- AIsolated ports can communicate only with other isolated ports in the same isolated VLAN.
- BOnly a single community VLAN can be associated with a primary VLAN.
- CCommunity VLANs can send traffic to isolated ports but cannot receive traffic from them.
- DEvery port in a private VLAN is a member of the primary VLAN.
34Which of the following examples best describes the SaaS service model? (Select the best answer.)
- AA company moves all companywide policy documents to an Internetbased virtual file system hosted by a service provider.
- BA company hires a service provider to deliver cloudbased processing and storage that will house multiple virtual hosts configured in a variety of ways.
- CA company licenses an office suite, including email service, that is delivered to the end user through a web browser.
- DA company obtains a subscription to use a service provider’s infrastructure, programming tools, and programming languages to develop and serve cloudbased applications.
35You have issued the logging enable command on an ASA with the default configuration.
Which of the following statements is true regarding the syslog messages that will be generated on this ASA by default? (Select the best answer.)- AThe ASA will generate syslog messages that include a date.
- BThe ASA will generate syslog messages that include a time.
- CThe ASA will not generate syslog messages with a severity of 0.
- DThe ASA will not generate syslog messages with a severity of 7.
- EThe ASA will send syslog messages to only the console.
36According to Cisco best practices, which of the following is true about the ideal application of an extended access list? (Select the best answer.)
- AIt should be applied in the inbound direction on the interface that is as close to the destination as possible.
- BIt should be applied in the outbound direction on the interface that is as close to the destination as possible.
- CIt should be applied in the inbound direction on the interface that is as close to the source as possible.
- DIt should be applied in the outbound direction on the interface that is as close to the source as possible.
37Which of the following statements is true regarding network object NAT on an ASA? (Select the best answer.)
- AA single NAT rule can apply to both a source and destination address.
- BA network object or group is a parameter of the NAT configuration.
- CNetwork object NAT is more scalable than twice NAT.
- DNetwork object NAT can use network object groups to specify real and mapped addresses.
- EE. Network object NAT is easier to configure than twice NAT.
38Upon which of the following languages is the Cisco FlexConfig scripting engine based? (Select the best answer.)
- AJava
- BJavaScript
- CActionScript
- DBourne Again Shell
39One of your company’s headquarters routers is not forwarding packets to a branch location. The router is housed in a locked room onsite. A junior administrator has remotely connected to the router to troubleshoot the problem. You have been asked for assistance in interpreting some of the configuration output.
Which of the following methods are you least likely to use to connect to the router? (Select the best answer.)- ATelnet
- BSSH
- Ca console port
- Da serial port
- Ean auxiliar port
40You are troubleshooting IPSec VPN connectivity between two sites. From the local router, you are able to ping the remote tunnel endpoint.
Which of the following steps should you perform next? (Select the best answer.)- AIssue the traceroute command to trace the route to the tunnel endpoint.
- BVerify that the IKE policies match on both peers.
- CVerify that the peers successfully authenticate one another.
- DReboot both devices.
41Which of the following is not a method of mitigating false positives on a Sourcefire device? (Select the best answer.)
- Adisabling unnecessary Snort rules
- Bsuppressing event notifications
- Creporting false positives to Cisco Technical Support
- Dconfiguring an Allow action without inspection
- Econfiguring a Block action
42Which of the following actions is performed by dynamic NAT? (Select the best answer.)
- Amapping an inside local IP address to a specific global IP address
- Bmapping an inside local IP address to a global IP address chosen from a pool
- Cmapping an inside local IP address and port to a global IP address with a specific port
- Dmapping an inside local IP address and port to a global IP address with a randomly selected port
43You are configuring auto NAT on a Cisco Firepower device. The network object contains rules of both static and dynamic types from internal subnets. You have configured the rules in the following order:
1. Dynamic NAT: 172.16.1.0/28
2. Static NAT: 192.168.51.8/29
3. Static NAT: 10.10.10.0/24
4. Dynamic NAT: 192.168.32.0/24
5. Static NAT: 10.10.11.1/32
The Firepower receives internal traffic from the 192.168.51.8/29 subnet.
Which of the rules in this scenario will be processed? (Select 2 choices.)- A1
- B2
- C3
- D4
- E5
44Which of the following fields make up the trailer of an ESP packet? (Select 3 choices.)
- ANext Header
- BPad Length
- CPadding
- DSecurity Parameter Index
- ESequence Number
45You have issued the following commands to modify the 802.1X configuration on a switch port:
switch(configif)#authentication event fail action next-method
switch(configif)#authentication order mab dot1x
switch(configif)#authentication priority dot1x mab
switch(configif)#authentication event noresponse action authorize vlan 1313
A new host is attached to the switch port. The host’s MAC address is not in the authentication database. In addition, the host does not support 802.1X.
Which of the following statements is true regarding the host in this scenario? (Select the best answer.)- AMAB will learn the new host’s MAC address and authorize the host for network
access, and the switch port will ignore the host’s 802.1X authentication attempts. - BMAB will authorize the host for network access? however, the host will lose network access when it attempts to authenticate with 802.1X.
- CThe host will be assigned to VLAN 1313.
- DThe host will fail MAB authentication, and the switch will place the port into an
unauthorized state.
- AMAB will learn the new host’s MAC address and authorize the host for network
46Your supervisor asks you to configure a local CA to help secure digital communications.
Which of the following best describes what your company is most likely implementing? (Select the best answer.)- Aa PKI
- Bsymmetric encryption
- Casymmetric encryption
- Da oneway hash algorithm
47Which of the following authentication methods were invented by Cisco? (Select 2 choices.)
- APEAP
- BEAPFAST
- CEAPTLS
- DEAPMD5
- ELEAD
48You have configured antispoofing ACLs and DHCP snooping.
Which of the following are you most likely securing? (Select the best answer.)- Athe control plane
- Bthe management plane
- Cthe data plane
- Devery network plane
49You issue the following commands on a Cisco ASA. No other interfaces have been configured.
asa(config)#interface gigabitethernet 0/1
asa(configif)#speed 1000
asa(configif)#duplex full
asa(configif)#securitylevel 0
asa(configif)#nameif inside
asa(configif)#ip address 10.1.1.1 255.255.255.0
asa(configif)#no shutdown
asa(configif)#exit
asa(config)#telnet 10.1.1.0 255.255.255.0 inside
asa(config)#telnet timeout 30
Which of the following statements is true regarding the resulting configuration? (Select the best answer.)- ATelnet sessions will time out after 30 seconds of inactivity.
- BThe ASA will deny SSH connections to the interface.
- CThe ASA will reassign the interface a security level of 100.
- DTelnet sessions will be denied because a security level is manually assigned.
50Exam Which of the following vulnerabilities did the Stuxnet worm exploit on target hosts? (Select 2 choices.)
- Aa buffer overflow vulnerability in the DCOM RPC service
- Ba buffer overflow vulnerability in IIS software
- Ca buffer overflow vulnerability in Microsoft SQL Server
- Da remote code execution vulnerability in the printer spooler service
- Ea remote code execution vulnerability in the processing of .lnk files
Information
- Description
- CCNA Security Quiz on Security 150 - 200, created by Anthony Rosales Sandoval on 03/11/2018.
- Author
- Anthony Rosales Sandoval
- Language
- Español
- Views
- 10
- Tags
- Rating
- No ratings yet Rate this quiz