Quiz
Real 200 - 250
This quiz has a time limit, so it opens in the usual player.
Questions in this quiz (50)
1The first layer of defense which provides real-time preventive solutions against malicious traffic
is provided by?- ABanyan Filters
- BExplicit Filters
- COutbreak Filters
2SSL certificates are issued by Certificate Authority(CA) are?
- ATrusted root
- BNot trusted
3SYN flood attack is a form of ?
- AReconnaissance attack
- BDenial of Service attack
- CSpoofing attack
- DMan in the middle attack
4The command debug crypto isakmp results in?
- ATroubleshooting ISAKMP (Phase 1) negotiation problems
- BTroubleshooting ISAKMP (Phase 2) negotiation problems
- CTroubleshooting IPsec negotiation problems
5The stealing of confidential information of a company comes under the scope of:
- AReconnaissance
- BSpoofing attack
- CSocial Engineering
- DDenial of Service
6The NAT traversal definition:
- AIf both peers support NAT-T, and if they detect that they are connecting to each other through a Network Address Translation (NAT) device (translation is happening), they may negotiate that they want to put a fake UDP port 4500 header on each IPsec packet (before the ESP header) to survive a NAT device that otherwise may have a problem tracking an ESP session (Layer 4 protocol 50).
- BPAT
- CDynamic NAT
7Man-in-the-middle attack definition:
- ASomeone or something is between the two devices who believe they are communicating directly with each other.
- B?
8When is "Deny all" policy an exception in Zone Based Firewall?
- Atraffic traverses 2 interfaces in same zone
- Btraffic sources from router via self zone
- Ctraffic terminates on router via self zone
- Dtraffic traverses 2 interfaces in different zones
9What is true about the Cisco IOS Resilient Configuration Feature?
- AThere is additional space required to secure the primary Cisco IOS Image file
- BRemote storage required to save IOS image
- CCan be disabled through a remote session
- DAutomatically detects image or configuration version mismatch
10What are the two characteristics of IPS?
- ACan drop traffic
- BDoes not add delay to traffic
- CIt is cabled directly inline
- DCan`t drop packets on its own
11What can cause the state table of a stateful firewall to update? (choose two)
- Awhen connection is created
- Bconnection timer expired within state table
- Cwhen packet is evaluated against the inbound access list and is ...
- Doutbound packets forwarded to inbound interface
- Ewhen rate limiting is applied
12What IPSec mode is used to encrypt traffic between client and server vpn endpoints?
- Atunnel
- BTrunk
- CAggregated
- DQuick
- ETransport
13Which command is used to verify a VPN connection is operational?
- Ash crypto ipsec sa
- Bsh crypto isakmp sa
- Cdebug crypto isakmp
- Dsh crypto session
14What is the command to authenticate an NTP time source? (something in those lines)
- A#ntp authentication-key 1 md5 141411050D 7
- B#ntp authenticate
- C#ntp trusted-key 1
- D#ntp trusted-key 2
15How can you allow bidirational traffic? (something in those lines)
- Astatic NAT
- Bdynamic NAT
- Cdynamic PAT
- Dmulti-NAT
16Which option is the default value for the DiffieHellman group when configuring a site- to-site
VPN on an ASA device?- AGroup 1
- BGroup 2
- CGroup 7
- DGroup 5
17What two devices are components of the BYOD architecture framework? (Choose two)
- AIdentity Service Engine
- BCisco 3845 Router
- CWireless Access Points
- DNexus 7010 Switch
- EPrime Infrastructure
18Which option is the cloud based security service from Cisco that provides URL filtering web browsing content security, and roaming user protection?
- ACloud web security
- BCloud web Protection
- CCloud web Service
- DCloud advanced malware protection
19Which product can be used to provide application layer protection for TCP port 25 traffic?
- AESA
- BCWS
- CWSA
- DASA
20Which two actions can a zone-based firewall take when looking at traffic? (Choose two)
- AFilter
- BForward
- CDrop
- DBroadcast
- EInspect
21Which label is given to a person who uses existing computer scripts to hack into computers lacking the expertise to write their own?
- Ascript kiddy
- Bwhite hat hacker
- Cphreaker
- Dhacktivist
22Regarding PVLAN diagram question:
All ports on switch 1 have a primary VLAN of 300. Which devices can host 1 reach?- AHost 2 (Host is part of community PVLAN).
- BOther devices on VLAN 303 (VLAN were isolated host is connected, in my case it was Host 1).
- CServer
- DHost 4 (Host is part of community PVLAN)
23################
#nat (inside,outside) dynamic interface
################
Refer to the above. Which translation technique does this configuration result in?- Astatic PAT
- Bstatic NAT
- Cdynamic PAT
- Ddynamic NAT
24Which two characteristics of an application layer firewall are true? (Choose two)
- Aprovides reverse proxy services
- Bis immune to URL manipulation
- Cprovides protection for multiple applications
- Dprovides stateful firewall functionality
- Ehas low processor usage
25Which two functions can SIEM provide? (Choose Two)
- ACorrelation between logs and events from multiple systems.
- Bevent aggregation that allows for reduced log storage requirements
- Cproactive malware analysis to block malicious traffic.
- Ddual-factor authentication.
- Ecentralized firewall management.
26Within an 802.1X enabled network with the Auth Fail feature configured, when does a switch port get placed into a restricted VLAN?
- AWhen user failed to authenticate after certain number of attempts
- BWhen 802.1X is not globally enabled on the Cisco catalyst switch
- CWhen AAA new-model is enabled
- DIf a connected client does not support 802.1X
- EAfter a connected client exceeds a specific idle time
27What is the actual IOS privilege level of User Exec mode?
- A1
- B0
- C5
- D15
28Which option is a weakness in an information system that an attacker might leverage to gain unauthorized access to the system or its data?
- Ahack
- Bmitigation
- Crisk
- Dvulnerability
- Eexploit
29Referring to CIA (confidentiality,Integrity and Availability), where would a hash-only make more
sense.- AData at Rest
- BData on File
30How can you stop reconnaissance attack with CDP?
- Adisable CDP on ports connected to end points (or Disable CPD on edfe ports)
- Benable dot1x on all ports that are connected to other switches
- Cdisable CDP on trunk ports
- Denable dynamic ARP inspection on all untrusted ports
31What is used for p rotecting FMC (Firepower Management Center)?
- AAMP
- B?
32What IPS feature that is less secure among than the other option permit a better throughput ?
- APromiscuous
- BInline
- CActive
33Zone based firewall
- Aenable zones first
- Bzones must be made before applying interfaces.
34What is the effect of the ASA command crypto isakmp nat-traversal?
- AIt opens port 4500 only on the outside interface
- BIt opens port 500 only on the inside interface.
- CIt opens port 500 only on the outside interface.
- DIt opens port 4500 on all interfaces that are IPSec enabled.
35Refer to the exhibit.
####################
local ident (addr/mask/prot/port): ...
remote ident (addr/mask/prot/port): ...
current_peer: x.x.x.x
#pkts encaps: 7065, #pkts encrypt: 7065, #pkts digest: 7065 #pkts decaps: x (I can't remember if it was 0),#pkts decrypt: 0, #pkts verify: 0 .....
local crypto endpt.: x.x.x.x remote crypto endpt.: y.y.y.y
####################
While troubleshooting a VPN, you issued the show crypto ipsec sa command. Why ipsec tunnel is
not working?- Abecause the ASA can't receive packets from remote endpoint
- Bthe peers are not on the same network subnet
- Cudp port 500 it's blocked (or something similar)
36What data is transferred during DH for making public and private key?
- ARandom prime Integer
- BEncrypted data transfer
- CPrime integer
- DRandom number
37Which of the following is a DOS attack that is difficult to discover?
- ASyn-flood attack
- BPeer-to-peer attacks
- CLow-rate dos attack
- DTrojan
38What causes a client to be placed in a guest or restricted VLAN on an 802.1x enabled network?
- Aclient entered wrong credentials multiple times.
- Bclient entered wrong credentials the first time
- CWhen 802.1X is not globally enabled on the Cisco catalyst switch
- DWhen AAA new-model is enabled
39Self zone (2 option)?
- Acan be source or destination zone.
- Bcan be use stateful filtering during multicast.
- Call interfaces will be used for self zone
40Which IDS/IPS is used for monitoring system health and...?
- AHIPS
- BWIPS
- Cvisibility tool
41Which type of Layer 2 attack enables the attacker to intercept traffic that is intended for one specific recipient?
- ABPDU attack
- BDHCP Starvation
- CCAM table overflow
- DMAC address spoofing
42Which command initializes a lawful intercept view?
- Ausername cisco1 view lawful-intercept password cisco
- Bparser view cisco li-view
- Cli-view cisco user cisco1 password cisco
- DParser view li-view inclusive
43Which two NAT types allows only objects or groups to reference an IP address? (choose two)
- Adynamic NAT
- Bdynamic PAT
- Cstatic NAT
- Didentity NAT
44Which IOS command do you enter to test authentication against a AAA server?
- Adialer aaa suffix <suffix> password <password>
- Bppp authentication chap pap test
- Caaa authentication enable default test group tacacs+
- Dtest aaa-server authentication dialergroup username <user> password
45Which option is a characteristic of the RADIUS protocol?
- Auses TCP
- Boffers multiprotocol support
- Ccombines authentication and authorization in one process
- Dsupports bi-directional challenge
46What are characteristics of the Radius Protocol? choose Two
- AUses TCP port 49
- BUses UDP Port 49
- CUses TCP 1812/1813
- DUses UDP 1812/1813
- ECombines authentication and authorization
47Which quantifiable item should you consider when your organization adopts new technologies?
- Atheats
- Bvulnerability
- Crisk
- Dexploits
48Protocols supported in contest aware VRF over VRF lite? (2 choices)
- AEIGRP
- BMulticast
- COSPF
- DUNICAST
49Which two protocols enable Cisco Configuration Professional to pull IPS alerts from a Cisco ISR router? (Choose two.)
- Asyslog
- BSDEE
- CFTP
- DTFTP
- ESSH
- FHTTPS
50Which three options are common examples of AAA implementation on Cisco routers? (Choose three.)
- Aauthenticating remote users who are accessing the corporate LAN through IPsec VPN connections
- Bauthenticating administrator access to the router console port, auxiliary port, and vty ports
- Cimplementing PKI to authenticate and authorize IPsec VPN peers using digital certificates
- Dtracking Cisco NetFlow accounting statistics
- Esecuring the router by locking down all unused services
- Fperforming router commands authorization using TACACS+
Information
- Description
- Real Dump 210-260 Quiz on Real 200 - 250, created by Anthony Rosales Sandoval on 29/11/2018.
- Author
- Anthony Rosales Sandoval
- Language
- Español
- Views
- 0
- Tags
- Rating
- No ratings yet Rate this quiz