Quiz
Security 200 - 250
This quiz has a time limit, so it opens in the usual player.
Questions in this quiz (50)
1Which of the following security applications is least likely to be included in a vendor’s desktop security suite? (Select the best answer.)
- Aantivirus software
- Ba HIPS
- Ca personal firewall
- Da proxy server
2Which of the following commands should you issue to allow communication between different ASA interfaces that share the same security level? (Select the best answer.)
- Asamesecuritytraffic permit interinterface
- Bsamesecuritytraffic permit intrainterface
- Csecuritylevel 0
- Dsecuritylevel 100
- Eestablished
3Which of the following facilitates the use of one authentication framework for connecting to both wired and wireless devices on a Cisco Unified Wireless Network? (Select the best answer.)
- AACS
- BCSA
- CCTA
- DSSC
4An outside host has established an SSH connection with an inside host. Both hosts have sent and received data over the SSH session.
Which of the following lines of output from the show conn command best represents the state of the connection in this scenario? (Select the best answer.)- ATCP outside 192.0.2.51:22 inside 10.1.1.18:12113 idle 0:00:00, bytes 0, flags SaAB
- BTCP outside 192.0.2.51:22 inside 10.1.1.18:12113 idle 0:00:00, bytes 0, flags saA
- CTCP outside 192.0.2.51:22 inside 10.1.1.18:12113 idle 0:00:00, bytes 0, flags aB
- DTCP outside 192.0.2.51:22 inside 10.1.1.18:12113 idle 0:00:00, bytes 0, flags A
- ETCP outside 192.0.2.51:22 inside 10.1.1.18:12113 idle 0:00:00, bytes 0, flags U
- FTCP outside 192.0.2.51:22 inside 10.1.1.18:12113 idle 0:00:00, bytes 0, flags UIOB
5Which of the following is a term used to describe a network of tools that are used to gather information about attack methods that are used by malicious users? (Select the best answer.)
- Abotnet
- Bhoneynet
- Choneypot
- Dsinkhole
- Eblack hole
6Which of the following most accurately describes transparent mode tunneling? (Select the best answer.)
- AIt enables traffic to exit the same interface through which it entered.
- BIt enables traffic to flow between interfaces that share the same security level.
- CIt enables a VPN tunnel to form through a firewall or NAT device.
- DIt enables a VPN tunnel to determine which traffic flows should be encrypted.
7Which of the following would you most likely configure on a host to alert you about possible attacks without filtering traffic? (Select the best answer.)
- Aa botnet
- Ba honeypot
- Ca personal firewall
- Da HIDS
8Which of the following forms of malware are typically standalone software that appear to be legitimate applications? (Select the best answer.)
- Abots
- BTrojan horses
- Cviruses
- Dworms
9The IPS on your company's network is blocking normal web traffic.
Which of the following best describes what the IPS has identified? (Select the best answer.)- Aa false positive
- Ba false negative
- Ca true positive
- Da true negative
10Which of the following EAP methods requires digital certificates to be installed on the server but not on the client? (Select the best answer.)
- AEAPFAST
- BEAPPEAP
- CEAPTLS
- DLEAP
11Which of the following lost or stolen device options are not available to employees when MDM is integrated with ISE? (Select 2 choices.)
- Areport device as lost or stolen
- Binitiate a PIN lock
- Cinitiate a full or corporate wipe
- Dquarantine the device
- Erevoke the device’s digital certificate
12Which of the following private VLAN port types can communicate with promiscuous private VLAN ports but not with isolated private VLAN ports? (Select 2 choices.)
- Acommunity ports
- Bisolated ports
- CSPAN ports
- Dpromiscuous ports
- Etrunk ports
13In which layer of the campus network hierarchy are ACLs and interVLAN routing typically implemented? (Select the best answer.)
- Aaccess
- Bcore
- Cdistribution
- Dtransport
14Which of the following is a VLAN hopping attack that uses DTP to negotiate a trunk link? (Select the best answer.)
- AARP spoofing
- BDHCP spoofing
- CMAC spoofing
- Dswitch spoofing
15On a Cisco ASA, which of the following authentication protocols is not supported by the TACACS+ server? (Select the best answer.)
- AASCII
- BCHAP
- CPAP
- DMSCHAPv1
- EMSCHAPv2
16Which of the following are true of ARP traffic on a Cisco zonebased firewall in transparent mode? (Select 2 choices.)
- AIt is denied by default.
- BIt is permitted only in the inbound direction.
- CIt is permitted only in the outbound direction.
- DIt is permitted in both inbound and outbound directions.
- EIt can be controlled by ARP inspection but not by access rules.
17Which of the following statements about the test aaa group command is not true? (Select the best answer.)
- AIt does not work with a RADIUS server configuration.
- BIt can be used to verify a AAA server configuration.
- CIt can generate a "User rejected" message if the server is alive.
- DIt associates a DNIS or CLID named user profile with a record sent to the server.
18Which of the following tasks does CASE on an ESA not perform when detecting a possible threat? (Select the best answer.)
- Achecking the reputation of the email sender
- Bscanning the content of the email message
- Canalyzing the email message's call to action
- Danalyzing how the message is constructed
- Echecking the reputation of the email receiver
19You upload a file named isitbad.docx to AMP for analysis. While reviewing the AMP logs, you receive the following output:
Wed Feb 17 12:41:05 2015 Info: File reputation query initiating. File Name =
'isitbad.docx', MID = 856, File Size = 174401 bytes, File Type = application/msword
Wed Feb 17 12:41:10 2015 Info: Response received for file reputation query from Cache.
File Name = 'isitbad.docx', MID = 856, Disposition = file unknown, Malware = None, Reputation Score = 0, sha256 = 78d80f8fb0e6eaa2988d11607ec6a00840147f8188f6db8b7d00d907440d7aaa, upload_action = 1
Which of the following is true? (Select the best answer.)- AThe file was uploaded to the cloud and determined to be clean.
- BThe file was not uploaded to the cloud, and its disposition is unknown.
- CThe file was uploaded to the cloud, but its disposition is unknown.
- DThe file was uploaded to the cloud and was determined to be malware.
- EThe file was not uploaded to the cloud but was determined to be clean.
- FThe file was not uploaded to the cloud but was determined to be malware.
20Which of the following commands should you issue when troubleshooting basic IKE peering to determine whether PSKs are present and matching on both peers? (Select the best answer.)
- Aping
- Btraceroute
- Cshow crypto isakmp policy
- Ddebug crypto isakmp
21You have configured a Cisco ESA URL filtering with a URL Category action that redirects the URLs of adult content sites and sites that have not been categorized to the Cisco Cloud Web Security proxy service. However, you receive a report that users are successfully accessing adult content sites from the company network.
Which of the following could be the problem? (Select the best answer.)- AYou did not specify any text to replace the URL.
- BYou did not defang the URL so that it cannot be clicked.
- CThe connection to the Cisco Cloud Web Security proxy service timed out.
- DThe adult content sites being visited are uncategorized.
22An inbound TCP SYN packet arrives at the ingress interface of a Cisco ASA 8.2 firewall. The packet is not part of an established session. The packet reaches the interface’s internal buffer and the input counter is incremented.
Which of the following actions will occur next? (Select the best answer.)- AThe packet will be processed by interface ACLs.
- BThe packet is forwarded to the outbound interface.
- CThe packet is subjected to an inspection check.
- DThe packet's IP header is translated by NAT/PAT.
23Which of the following can be used by Cisco IPS devices to report intrusion alerts? (Select 2 choices.)
- ASDEE
- BSNMPv1
- CSNMPv2
- DSNMPv3
- ESyslog
24Which of the following statements is true regarding security contexts on a new Cisco ASA in multiple context mode? (Select the best answer.)
- AYou cannot delete the current admin context.
- BYou can delete a single security context with the clear configure context command.
- CYou can delete all security contexts with the no context command.
- DYou cannot delete a security context from the active unit in a failover configuration.
- EYou can delete a security context only by editing the system configuration.
25Which of the following commands can be used to determine the SPI that a router will use to reach an active IPSec peer? (Select the best answer.)
- Ashow crypto ipsec sa
- Bshow crypto session
- Cshow crypto isakmp sa active
- Dshow crypto ipsec securityassociation
26Which of the following can be installed on a host to analyze and prevent malicious traffic on that host? (Select the best answer.)
- AHIDS
- BHIPS
- CNIPS
- DNIDS
27Which of the following is an open framework used to guide an organization in making software security decisions that are in alignment with the organization’s risk profile? (Select the best answer.)
- ASAMM
- BZAP
- CWTE
- DOWTF
28Which of the following attacks involves overwhelming a switch's CAM table? (Select the best answer.)
- AARP poisoning
- BARP spoofing
- CMAC flooding
- DMAC spoofing
29Which of the following statements are true regarding a ZFW? (Select 2 choices.)
- AA zone can contain more than one interface.
- BAn interface can reside in more than one zone.
- CThe firewall can operate in transparent mode.
- DStateful packet inspection is supported for multicast traffic.
- EStateful packet inspection is supported for IPv6 traffic.
30Which of the following is true regarding loop guard? (Select the best answer.)
- ALoop guard should be used in conjunction with root guard.
- BLoop guard should be used in conjunction with PortFast.
- CLoop guard places inconsistent ports into the blocking state.
- DLoop guard is used to disable ports that receive BPDUs.
31What is the minimum DH modulus size recommended by Cisco to provide acceptable security when DH must be used instead of an NGE algorithm? (Select the best answer.)
- A768 bits
- B1,024 bits
- C2,048 bits
- D3,072 bits
32Which of the following is a QoS feature that can apply policies to individual controlplane subinterfaces? (Select the best answer.)
- ACoPP
- BCPPr
- CMPP
- DuRPF
33Which of the following is an independent cryptographic processor that provides hardware based authentication services for PCs? (Select the best answer.)
- ATPM
- BTNC
- CMTM
- DTMI
34Which of the following statements is true regarding the SA lifetime specified in a matching IKE policy? (Select the best answer.)
- AThe value specified by the remote peer must be equal to the value specified by the local peer.
- BThe value specified by the remote peer must be less than or equal to the value specified by the local peer.
- CThe value specified by the remote peer must be greater than or equal to the value specified by the local peer.
- DThe value specified by the remote peer must be less than the value specified by the local peer.
- EThe value specified by the remote peer must be greater than the value specified by the local peer.
35Implementing which of the following features provides a cloudbased subscription method of URL filtering that can be used with Cisco's ZFW? (Select the best answer.)
- AWebsense
- BTrend Micro TRPS
- CSecure Computing SmartFilter
- Dblacklists and whitelists
36Which of the following best describes how an IPS is similar to an IDS? (Select the best answer.)
- AThey both sit in the path of network traffic.
- BNeither sits in the path of network traffic.
- CThey both prevent malicious traffic from infiltrating the network.
- DThey can both use signatures to detect malicious traffic.
37Which of the following statements is true regarding traditional stateful packetfiltering firewalls? (Select the best answer.)
- AThey are more efficient than stateless packetfiltering firewalls.
- BThey can operate at Layers 3, 4, 5, and 7 of the OSI model.
- CThey prevent more types of attacks than Application layer firewalls do.
- DThey can defend against DoS attacks.
38You are analyzing recent intrusion events in FireSIGHT Defense Center and notice several events with blue icons.
To which of the following vulnerability classifications do the blue icons correspond? (Select the best answer.)- Aunknown target
- Bvulnerable
- Cpotentially vulnerable
- Dnot vulnerable
39Which of the following SNMP actions are used by an NMS to extract information from an SNMP agent? (Select 2 choices.)
- Aget
- BgetNext
- Cset
- Dinform
- Etrap
40Which of the following statements is true regarding stateful firewalls? (Select the best answer.)
- ATheir primary purpose is to hide the source of a network connection.
- BThey operate at the Application layer of the OSI model.
- CThey allow traffic into a network only if a corresponding request was sent from inside the network.
- DThey can block traffic that contains specific web content.
41Which of the following statements is true regarding the autocommand keyword when used with the username command on Cisco routers? (Select the best answer.)
- AThe specified command cannot exceed 255 characters.
- BThe autocommand keyword must be the username command’s last argument.
- CThe specified command cannot contain embedded spaces.
- DThe user session is not terminated if the autocommand keyword fails to execute its specified command.
42Which of the following is a Cisco AMP for Endpoints feature that can prevent specific programs from running on managed endpoints? (Select the best answer.)
- Afile reputation
- Bdevice trajectory
- Cfile trajectory
- Doutbreak control
43You have been asked to use ASDM to change the global application inspection settings on an ASA at the edge of your network.
Which of the following panes in the firewall configuration navigation tree can you use to achieve this task? (Select the best answer.)- AAccess Rules
- BService Policy Rules
- CFilter Rules
- DAdvanced
44Which of the following configuration parameters is not displayed on the Connection Profiles pane for clientless SSL VPN connections in ASDM? (Select the best answer.)
- Athe authentication method to use
- Bthe login page settings to use
- Cthe interfaces to use
- Dthe tunneling protocols to use
45You are configuring a group policy for Cisco AnyConnect VPN connections. You have accessed the Add Internal Group Policy dialog box for the group policy.
On what pane will you be able to configure a VLAN restriction? (Select the best answer.)- Athe Customization pane
- Bthe Servers pane
- Cthe General pane
- Dthe SSL VPN Client pane
46Which of the following are transmitted by SDEE? (Select the best answer.)
- ASDFs
- BTFTP data
- CIPS events
- DSNMP traps
47You want to configure a WSA to permit access to a particular social media site? however, you also want to deny access to some of the features on that site, such as uploading files and liking posts.
Which of the following WSA features should you configure to achieve your goal (Select the best answer.)- AAMP
- BAVC
- CDCA
- DDLP
48Which of the following statements are true regarding ACLs? (Select 3 choices.)
- AIf a packet is permitted by one entry, it cannot be denied by a more specific entry later in the ACL.
- BIf a packet is denied by one entry, it cannot be permitted by a more specific entry later in the ACL.
- CIf a packet does not match any entries in the ACL, it is permitted.
- DAn ACL cannot contain two conflicting entries that refer to the same source address.
- EAn ACL cannot contain two conflicting entries that refer to the same destination address.
- FIf a packet does not match any entries in the ACL, it is denied.
49Which of the following NAT types effectively exempts one or more addresses from translation? (Select the best answer.)
- Adynamic NAT
- Bdynamic PAT
- Cidentity NAT
- Dstatic NAT
50What are two reasons to recommend SNMPv3 over SNMPv2? (Choose two.)
- ASNMPv3 is secure because you can configure authentication and privacy
- BSNMPv3 is a Cisco proprietary protocol
- CSNMPv2 is secure because you can configure authentication and privacy
- DSNMPv2 is insecure because it sends information in clear text
- ESNMPv3 is insecure because it sends information in clear text
Information
- Description
- CCNA Security Quiz on Security 200 - 250, created by Anthony Rosales Sandoval on 08/11/2018.
- Author
- Anthony Rosales Sandoval
- Language
- Español
- Views
- 4
- Tags
- Rating
- No ratings yet Rate this quiz