EXAMEN 1

1. 11. All 30 users on a single floor of a building are complaining about network slowness. After
   investigating the access switch, the network administrator notices that the MAC address table is
   full (10,000 entries) and all traffic is being flooded out of every port. Which action can the
   administrator take to prevent this from occurring?

   1. AConfigure port-security to limit the number of mac-addresses allowed on each port
   2. BUpgrade the switch to one that can handle 20,000 entries
   3. CConfigure private-vlans to prevent hosts from communicating with one another
   4. DEnable storm-control to limit the traffic rate
   5. EConfigure a VACL to block all IP traffic except traffic to and from that subnet
2. 22. A network printer has a DHCP server service that cannot be disabled. How can a layer 2 switch be
   configured to prevent the printer from causing network issues?

   1. ARemove the ip helper-address
   2. BConfigure a Port-ACL to block outbound TCP port 68
   3. CConfigure DHCP snooping
   4. DConfigure port-security
3. 33. A switch is being configured at a new location that uses statically assigned IP addresses. Which
   will ensure that ARP inspection works as expected?

   1. AConfigure the 'no-dhcp' keyword at the end of the ip arp inspection command
   2. BEnable static arp inspection using the command 'ip arp inspection static vlan vlan-number
   3. CConfigure an arp access-list and apply it to the ip arp inspection command
   4. DEnable port security
4. 44. Which of the following would need to be created to configure an application-layer inspection of
   SMTP traffic operating on port 2525?

   1. AA class-map that matches port 2525 and applying an inspect ESMTP policy-map for that class in
      the global inspection policy
   2. BA policy-map that matches port 2525 and applying an inspect ESMTP class-map for that policy
   3. CAn access-list that matches on TCP port 2525 traffic and applying it on an interface with the
      inspect option
   4. DA class-map that matches port 2525 and applying it on an access-list using the inspect option
5. 55. Which command is used to nest objects in a pre-existing group?

   1. Aobject-group
   2. Bnetwork group-object
   3. Cobject-group network
   4. Dgroup-object
6. 66. Which threat-detection feature is used to keep track of suspected attackers who create
   connections to too many hosts or ports?

   1. Acomplex threat detection
   2. Bscanning threat detection
   3. Cbasic threat detection
   4. Dadvanced threat detection
7. 77. What is the default behavior of an access list on the Cisco ASA security appliance?
   

   1. AIt will permit or deny traffic based on the access-list criteria.
   2. BIt will permit or deny all traffic on a specified interface
   3. CAn access group must be configured before the access list will take effect for traffic control
   4. DIt will allow all traffic.
8. 88. What is the default behavior of NAT control on Cisco ASA Software Version 8.3?

   1. ANAT control has been deprecated on Cisco ASA Software Version 8.3.
   2. BIt will prevent traffic from traversing from one enclave to the next without proper access
      configuration.
   3. CIt will allow traffic to traverse from one enclave to the next without proper access configuration.
   4. DIt will deny all traffic.
9. 99. Which three options are hardening techniques for Cisco IOS routers? (Choose three.)

   1. Alimiting access to infrastructure with access control lists
   2. Benabling service password recovery
   3. Cusing SSH whenever possible
   4. Dencrypting the service password
   5. Eusing Telnet whenever possible
   6. Fenabling DHCP snooping
10. 1010. Which three commands can be used to harden a switch? (Choose three.)

    1. Aswitch(config-if)# spanning-tree bpdufilter enable
    2. Bswitch(config)# ip dhcp snooping
    3. Cswitch(config)# errdisable recovery interval 900
    4. Dswitch(config-if)# spanning-tree guard root
    5. Eswitch(config-if)# spanning-tree bpduguard disable
    6. Fswitch(config-if)# no cdp enable

11. 1111. What are three features of the Cisco ASA 1000V? (Choose three.)

    1. Acloning the Cisco ASA 1000V
    2. Bdynamic routing
    3. Cthe Cisco VNMC policy agent
    4. DIPv6
    5. Eactive/standby failover
    6. FQoS
12. 1212. If the Cisco ASA 1000V has too few licenses, what is its behavior?

    1. AIt drops all traffic
    2. BIt drops all outside-to-inside packets.
    3. CIt drops all inside-to-outside packets.
    4. DIt passes the first outside-to-inside packet and drops all remaining packets
13. 1313. A network administrator is creating an ASA-CX administrative user account with the following
    parameters:
    The user will be responsible for configuring security policies on network devices.
    The user needs read-write access to policies.
    The account has no more rights than necessary for the job.
    What role will the administrator assign to the user?

    1. AAdministrator
    2. BSecurity administrator
    3. CSystem administrator
    4. DRoot Administrator
    5. EExec administrator
14. 1414. What command alters the SSL ciphers used by the Cisco Email Security Appliance for TLS
    sessions and HTTPS access?

    1. Asslconfig
    2. Bsslciphers
    3. Ctlsconifg
    4. Dcertconfig
15. 1515. What is the CLI command to enable SNMPv3 on the Cisco Web Security Appliance?

    1. Asnmpconfig
    2. Bsnmpenable
    3. Cconfigsnmp
    4. Denablesnmp
16. 1616.The Cisco Email Security Appliance can be managed with both local and external users of
    different privilege levels. What three external modes of authentication are supported? (Choose
    three.)

    1. ALDAP authentication
    2. BRADIUS Authentication
    3. CTACAS
    4. DSSH host keys
    5. ECommon Access Card Authentication
    6. FRSA Single use tokens
17. 1717. Which tool provides the necessary information to determine hardware lifecycle and compliance
    details for deployed network devices?

    1. APrime Infrastructure
    2. BPrime Assurance
    3. CPrime Network Registrar
    4. DPrime Network Analysis Module
18. 1818. Which three compliance and audit report types are available in Cisco Prime Infrastructure?
    (Choose three.)

    1. AService
    2. BChange Audit
    3. CVendor Advisory
    4. DTAC Service Request
    5. EValidated Design
    6. FSmart Business Architecture
19. 1919. Cisco Security Manager can manage which three products? (Choose three.)

    1. ACisco IOS
    2. BCisco ASA
    3. CCisco IPS
    4. DCisco WLC
    5. ECisco Web Security Appliance
    6. FCisco Email Security Appliance
    7. GCisco ASA CX
    8. HCisco CRS
20. 2020. Which two web browsers are supported for the Cisco ISE GUI? (Choose two.)

    1. AHTTPS-enabled Mozilla Firefox version 3.x
    2. BNetscape Navigator version 9
    3. CMicrosoft Internet Explorer version 8 in Internet Explorer 8-only mode
    4. DMicrosoft Internet Explorer version 8 in all Internet Explorer modes
    5. EGoogle Chrome (all versions)
21. 2121. When a Cisco ASA is configured in multicontext mode, which command is used to change
    between contexts?

    1. Achangeto config context
    2. Bchangeto context
    3. Cchangeto/config context change
    4. Dchangeto/config context 2
22. 2222. Which statement about the Cisco Security Manager 4.4 NAT Rediscovery feature is true?

    1. AIt provides NAT policies to existing clients that connect from a new switch port.
    2. BIt can update shared policies even when the NAT server is offline.
    3. CIt enables NAT policy discovery as it updates shared polices.
    4. DIt enables NAT policy rediscovery while leaving existing shared polices unchanged.
23. 2323. When you install a Cisco ASA AIP-SSM, which statement about the main Cisco ASDM home page
    is true?

    1. AIt is replaced by the Cisco AIP-SSM home page.
    2. BIt must reconnect to the NAT policies database.
    3. CThe administrator can manually update the page.
    4. DIt displays a new Intrusion Prevention panel.
24. 2424. Which Cisco product provides a GUI-based device management tool to configure Cisco access
    routers?

    1. ACisco ASDM
    2. BCisco CP Express
    3. CCisco ASA 5500
    4. DCisco CP
25. 2525. Which statement about Cisco IPS Manager Express is true?

    1. AIt provides basic device management for large-scale deployments.
    2. BIt provides a GUI for configuring IPS sensors and security modules.
    3. CIt enables communication with Cisco ASA devices that have no administrative access.
    4. DIt provides greater security than simple ACLs.
26. 2626. Which three options describe how SNMPv3 traps can be securely configured to be sent by IOS?
    (Choose three.)

    1. AAn SNMPv3 group is defined to configure the read and write views of the group
    2. BAn SNMPv3 user is assigned to SNMPv3 group and defines the encryption and authentication
       credentials.
    3. CAn SNMPv3 host is configured to define where the SNMPv3 traps will be sent.
    4. DAn SNMPv3 host is used to configure the encryption and authentication credentials for SNMPv3
       traps.
    5. EAn SNMPv3 view is defined to configure the address of where the traps will be sent.
    6. FAn SNMPv3 group is used to configure the OIDs that will be reported
27. 2727. A network engineer is asked to configure NetFlow to sample one of every 100 packets on a
    router's fa0/0 interface. Which configuration enables sampling, assuming that NetFlow is already
    configured and running on the router's fa0/0 interface?

    1. Aflow-sampler-map flow1
       mode random one-out-of 100
       interface fas0/0
       flow-sampler flow1
    2. Bflow monitor flow1
       mode random one-out-of 100
       interface fas0/0
       ip flow monitor flow1
    3. Cflow-sampler-map flow1
       one-out-of 100
       interface fas0/0
       flow-sampler flow1
    4. Dip flow-export source fas0/0 one-out-of 100
28. 2828. What is the default log level on the Cisco Web Security Appliance?

    1. ATrace
    2. BDebug
    3. CInformational
    4. DCritical
29. 2929. Which command sets the source IP address of the NetFlow exports of a device?

    1. Aip source flow-export
    2. Bip source netflow-export
    3. Cip flow-export source
    4. Dip netflow-export source
30. 3030. Which two SNMPv3 features ensure that SNMP packets have been sent securely?" Choose two

    1. Ahost authorization
    2. Bauthentication
    3. Cencryption
    4. Dcompression
31. 3131. Which three logging methods are supported by Cisco routers? (Choose three.)

    1. Aconsole logging
    2. BTACACS+ logging
    3. Cterminal logging
    4. Dsyslog logging
    5. EACL logging
    6. FRADIUS logging
32. 3232. Which three options are default settings for NTP parameters on a Cisco device? (Choose three.)

    1. ANTP authentication is enabled.
    2. BNTP authentication is disabled.
    3. CNTP logging is enabled.
    4. DNTP logging is disabled.
    5. ENTP access is enabled
    6. FNTP access is disabled.
33. 3333. Which two parameters must be configured before you enable SCP on a router? (Choose two.)

    1. ASSH
    2. Bauthorization
    3. CACLs
    4. DNTP
    5. ETACACS+
34. 3434. A network engineer is troubleshooting and configures the ASA logging level to debugging. The
    logging-buffer is dominated by %ASA-6-305009 log messages. Which command suppresses
    those syslog messages while maintaining ability to troubleshoot?

    1. Ano logging buffered 305009
    2. Bmessage 305009 disable
    3. Cno message 305009 logging
    4. Dno logging message 305009
35. 3535. Which option describes the purpose of the input parameter when you use the packet-tracer
    command on a Cisco device?

    1. Ato provide detailed packet-trace information
    2. Bto specify the source interface for the packet trace
    3. Cto display the trace capture in XML format
    4. Dto specify the protocol type for the packet trace
36. 3636. Which two options are two purposes of the packet-tracer command? (Choose two.)

    1. Ato filter and monitor ingress traffic to a switch
    2. Bto configure an interface-specific packet trace
    3. Cto inject virtual packets into the data path
    4. Dto debug packet drops in a production network
    5. Eto correct dropped packets in a production network
37. 3737. Which set of commands enables logging and displays the log buffer on a Cisco ASA?

    1. Aenable logging
       show logging
    2. Blogging enable
       show logging
    3. Cenable logging int e0/1
       view logging
    4. Dlogging enable
       logging view config
38. 3838. Which command displays syslog messages on the Cisco ASA console as they occur?

    1. AConsole logging <level>
    2. BLogging console <level>
    3. CLogging trap <level>
    4. DTerminal monitor
    5. ELogging monitor <level>
39. 3939. Which set of commands creates a message list that includes all severity 2 (critical) messages on a
    Cisco security device?

    1. Alogging list critical_messages level 2
       console logging critical_messages
    2. Blogging list critical_messages level 2
       logging console critical_messages
    3. Clogging list critical_messages level 2
       logging console enable critical_messages
    4. Dlogging list enable critical_messages level 2
       console logging critical_messages
40. 4040. An administrator is deploying port-security to restrict traffic from certain ports to specific MAC
    addresses. Which two considerations must an administrator take into account when using the
    switchport port-security mac-address sticky command? (Choose two.)

    1. AThe configuration will be updated with MAC addresses from traffic seen ingressing the port. The
       configuration will automatically be saved to NVRAM if no other changes to the configuration have
       been made.
    2. BThe configuration will be updated with MAC addresses from traffic seen ingressing the port. The
       configuration will not automatically be saved to NVRAM.
    3. COnly MAC addresses with the 5th most significant bit of the address (the 'sticky' bit) set to 1 will be
       learned.
    4. DIf configured on a trunk port without the 'vlan' keyword, it will apply to all vlans.
    5. EIf configured on a trunk port without the 'vlan' keyword, it will apply only to the native vlan
41. 4141. A Cisco ASA is configured for TLS proxy. When should the security appliance force remote IP
    phones connecting to the phone proxy through the internet to be in secured mode?

    1. AWhen the Cisco Unified Communications Manager cluster is in non-secure mode
    2. BWhen the Cisco Unified Communications Manager cluster is in secure mode only
    3. CWhen the Cisco Unified Communications Manager is not part of a cluster
    4. DWhen the Cisco ASA is configured for IPSec VPN
42. 4242. Which two features are supported when configuring clustering of multiple Cisco ASA appliances?
    (Choose two.)

    1. ANAT
    2. Bdynamic routing
    3. CSSL remote access VPN
    4. DIPSec remote access VPN
43. 4343. When a Cisco ASA is configured in transparent mode, how can ARP traffic be controlled?

    1. ABy enabling ARP inspection; however, it cannot be controlled by an ACL
    2. BBy enabling ARP inspection or by configuring ACLs
    3. CBy configuring ACLs; however, ARP inspection is not supported
    4. DBy configuring NAT and ARP inspection
44. 4444. What are two primary purposes of Layer 2 detection in Cisco IPS networks? (Choose two.)

    1. Aidentifying Layer 2 ARP attacks
    2. Bdetecting spoofed MAC addresses and tracking 802.1X actions and data communication after a
       successful client association
    3. Cdetecting and preventing MAC address spoofing in switched environments
    4. Dmitigating man-in-the-middle attacks
45. 4545. What is the primary purpose of stateful pattern recognition in Cisco IPS networks?

    1. Amitigating man-in-the-middle attacks
    2. Busing multipacket inspection across all protocols to identify vulnerability-based attacks and to
       thwart attacks that hide within a data stream
    3. Cdetecting and preventing MAC address spoofing in switched environments
    4. Didentifying Layer 2 ARP attacks
46. 4646. What are two reasons to implement Cisco IOS MPLS Bandwidth-Assured Layer 2 Services?
    (Choose two.)

    1. Aguaranteed bandwidth and peak rates as well as low cycle periods, regardless of which systems
       access the device
    2. Bincreased resiliency through MPLS FRR for AToM circuits and better bandwidth utilization through
       MPLS TE
    3. Cenabled services over an IP/MPLS infrastructure, for enhanced MPLS Layer 2 functionality
    4. Dprovided complete proactive protection against frame and device spoofing
47. 4747. What is the maximum jumbo frame size for IPS standalone appliances with 1G and 10G fixed or add-on interfaces?

    1. A1024 bytes
    2. B1518 bytes
    3. C2156 bytes
    4. D9216 bytes
48. 4848. Which two statements about Cisco IDS are true? (Choose two.)

    1. AIt is preferred for detection-only deployment
    2. BIt is used for installations that require strong network-based protection and that include sensor
       tuning.
    3. CIt is used to boost sensor sensitivity at the expense of false positives
    4. DIt is used to monitor critical systems and to avoid false positives that block traffic
    5. EIt is used primarily to inspect egress traffic, to filter outgoing threats
49. 4949. What are two reasons for implementing NIPS at enterprise Internet edges? (Choose two.)

    1. AInternet edges typically have a lower volume of traffic and threats are easier to detect.
    2. BInternet edges typically have a higher volume of traffic and threats are more difficult to detect.
    3. CInternet edges provide connectivity to the Internet and other external networks.
    4. DInternet edges are exposed to a larger array of threats.
    5. ENIPS is more optimally designed for enterprise Internet edges than for internal network
       configurations.
50. 5050. Which four are IPv6 First Hop Security technologies? (Choose four.)

    1. ASend
    2. BDynamic ARP Inspection
    3. CRouter Advertisement Guard
    4. DNeighbor Discovery Inspection
    5. ETraffic Storm Control
    6. FPort Security
    7. GDHCPv6 Guard
51. 5151. IPv6 addresses in an organization's network are assigned using Stateless Address
    Autoconfiguration. What is a security concern of using SLAAC for IPv6 address assignment?

    1. AMan-In-The-Middle attacks or traffic interception using spoofed IPv6 Router Advertisements
    2. BSmurf or amplification attacks using spoofed IPv6 ICMP Neighbor Solicitations
    3. CDenial of service attacks using TCP SYN floods
    4. DDenial of Service attacks using spoofed IPv6 Router Solicitations
52. 5252. Which two device types can Cisco Prime Security Manager manage in Multiple Device mode?
    (Choose two.)

    1. ACisco ESA
    2. BCisco ASA
    3. CCisco WSA
    4. DCisco ASA CX
53. 5353. Which technology provides forwarding-plane abstraction to support Layer 2 to Layer 7 network services in Cisco Nexus 1000V?

    1. AVirtual Service Node
    2. BVirtual Service Gateway
    3. CVirtual Service Data Path
    4. DVirtual Service Agent
54. 5454. To which interface on a Cisco ASA 1000V firewall should a security profile be applied when a VM sits behind it?

    1. Aoutside
    2. Binside
    3. Cmanagement
    4. DDMZ
55. 5555. You are configuring a Cisco IOS Firewall on a WAN router that is operating as a Trusted Relay
    Point (TRP) in a voice network. Which feature must you configure to open data-channel pinholes
    for voice packets that are sourced from a TRP within the WAN?

    1. ACAC
    2. BACL
    3. CCBAC
    4. DSTUN
56. 5656. Which two voice protocols can the Cisco ASA inspect? (Choose two.)

    1. AMGCP
    2. BIAX
    3. CSkype
    4. DCTIQBE
57. 5757. You have explicitly added the line deny ipv6 any log to the end of an IPv6 ACL on a router
    interface. Which two ICMPv6 packet types must you explicitly allow to enable traffic to traverse the interface? (Choose two.)

    1. Arouter solicitation
    2. Brouter advertisement
    3. Cneighbor solicitation
    4. Dneighbor advertisement
    5. Eedirect
58. 5858. Enabling what security mechanism can prevent an attacker from gaining network topology
    information from CDP?

    1. AMACsec
    2. BFlex VPN
    3. CControl Plane Protection
    4. DDynamic Arp Inspection
59. 5959. Which log level provides the most detail on the Cisco Web Security Appliance?

    1. ADebug
    2. BCritical
    3. CTrace
    4. DInformational
60. 6060. What is the lowest combination of ASA model and license providing 1 Gigabit Ethernet interfaces?

    1. AASA 5505 with failover license option
    2. BASA 5510 Security+ license option
    3. CASA 5520 with any license option
    4. DASA 5540 with AnyConnect Essentials License option
61. 61With Cisco ASA active/standby failover, by default, how many monitored interface failures will cause failover to occur?

    1. A1
    2. B2
    3. C3
    4. D4
    5. E5
62. 62Which statement about SNMP support on the Cisco ASA appliance is true?

    1. AThe Cisco ASA appliance supports only SNMPv1 or SNMPv2c.
    2. BThe Cisco ASA appliance supports read-only and read-write access
    3. CThe Cisco ASA appliance supports three built-in SNMPv3 groups in Cisco ASDM:
       Authentication and Encryption, Authentication Only, and No Authentication, No Encryption.
    4. DThe Cisco ASA appliance can send SNMP traps to the network management station only using SNMPv2
63. 63Which Cisco ASA object group type offers the most flexibility for grouping different services together based on arbitrary protocols?

    1. Anetwork
    2. BICMP
    3. Cprotocol
    4. DTCP-UDP
    5. Eservice
64. 64Which Cisco ASA show command groups the xlates and connections information together in its output?

    1. Ashow conn
    2. Bshow conn detail
    3. Cshow xlate
    4. Dshow asp
    5. Eshow local-host
65. 65When a Cisco ASA is configured in multiple context mode, within which configuration are the interfaces allocated to the security contexts?

    1. Aeach security context
    2. Bsystem configuration
    3. Cadmin context (context with the "admin" role)
    4. Dcontext startup configuration file (.cfg file)
66. 66By default, not all services in the default inspection class are inspected. Which Cisco ASA CLI command do you use to determine which inspect actions are applied to the default inspection class?

    1. Ashow policy-map global_policy
    2. Bshow policy-map inspection_default
    3. Cshow class-map inspection_default
    4. Dshow class-map default-inspection-traffic
    5. Eshow service-policy global
67. 67When configuring security contexts on the Cisco ASA, which three resource class limits can be set using a rate limit? (Choose three.)

    1. Aaddress translation rate
    2. BCisco ASDM session rate
    3. Cconnections rate
    4. DMAC-address learning rate (when in transparent mode)
    5. Esyslog messages rate
    6. Fstateful packet inspections rate
68. 68The Cisco ASA must support dynamic routing and terminating VPN traffic. Which three Cisco ASA options will not support these requirements? (Choose three.)

    1. Atransparent mode
    2. Bmultiple context mode
    3. Cactive/standby failover mode
    4. Dactive/active failover mode
    5. Erouted mode
    6. Fno NAT-control

Description

Quiz on EXAMEN 1, created by clau wen on 12/11/2016.

Author

clau wen

Language

Español

Views

0

Rating

No ratings yet

Rate this quiz

Rate this quiz

More on Firewalls and Access Control Lists