Quiz
Security 50 - 100
Dieses Quiz hat ein Zeitlimit und öffnet sich deshalb im gewohnten Player.
Fragen in diesem Quiz (50)
1An SNMP readonly community named READONLY is configured on a Cisco router.
Which of the following fields in the output of the show snmp command on the router will increment if an NMS makes a set request to the READONLY community? (Select the best answer.)- AUnknown community name
- Billegal operation for community name supplied
- CInput queue packet drops
- DNo such name errors
2Which of the following statements is true of all firewalls? (Select the best answer.)
- AThey maintain a state table.
- BThey hide the source of network connections.
- CThey operate at Layer 7 of the OSI model.
- DThey are multihomed devices.
3You issue the following block of commands on a Cisco router:
RouterA(config)#privilege exec level 10 show users
RouterA(config)#username boson password cisco
RouterA(config)#username boson privilege 15
RouterA(config)#username boson autocommand show users
RouterA(config)#line vty 0 4
RouterA(configline)#login local
RouterA(configline)#privilege level 7
Which of the following statements accurately describes what happens when the user boson successfully initiates a Telnet session to RouterA? (Select the best answer.)- AThe autocommand command fails, and the user is disconnected.
- BThe autocommand command fails, and the user is not disconnected.
- CThe autocommand command succeeds, and the user is disconnected.
- DThe autocommand command succeeds, and the user is not disconnected.
4You administer the network shown above. SwitchE is the root bridge for the network. You connect SwitchF to a port on SwitchB. SwitchF has a priority value of 0 and the MAC address 0000.0c42.0729.
Which statement is most accurate regarding root bridge selection after SwitchF is connected to SwitchB? (Select the best answer.)- ASwitchB will immediately become the root bridge.
- BSwitchE will remain the root bridge.
- CSwitchF will immediately become the root bridge.
- DSwitchE will remain the root bridge until it is powered down, and then SwitchF will become the root bridge.
5Which of the following statements is true regarding the outbreak control feature of AMP for Endpoints? (Select the best answer.)
- AIt cannot block polymorphic malware.
- BIt must wait for a content update before blocking specific files.
- CIt cannot whitelist specific applications.
- DIt can use application blocking lists to contain compromised applications.
6You want to use ASDM to create an inspection rule that will drop and log SHOUTcast media streams.
Which of the following inspection rules should you configure to achieve your goal? (Select the best answer.)- AH.323 H.225
- BH.323 RAS
- CHTTP
- DRTSP
- EIM
7On which of the following screens in ASDM can you enable users to select which connection profile they will use when they establish a clientless SSL VPN connection? (Select the best answer.)
- Athe Edit User Account dialog box for each user who should be able to select a connection profile
- Bthe Edit Internal Group Policy dialog box for each group policy that is associated with the clientless SSL VPN connection profiles
- Cthe main Connection Profiles pane
- Dthe main Group Policies pane
- Ethe main Local Users pane
8Which of the following can be configured on the General screen of the Add Internal Group Policy dialog box in ASDM when creating a group policy for clientless SSL VPN users? (Select 3 choices.)
- Aa banner message for VPN clients
- Bthe bookmark list to apply to VPN clients
- Cthe tunneling protocols that clients can use to establish a VPN connection
- Dthe name of the group policy
- Ea group URL that VPN users can access
- Fthe portal customization object to apply to VPN connections
9Which of the following show clock command output symbols indicates that time reported by the software clock is authoritative but not synchronized with the configured time source? (Select the best answer.)
- A#
- B*
- C~
- D.
- E+
10Which of the following statements are true regarding policies in Cisco Security Manager? (Select 2 choices.)
- ARule-based policies can contain hundreds of rules containing values for the same set of parameters.
- BSettings-based policies can define only one set of parameters for each settings based policy defined on a device.
- CLocal policies are well-suited to smaller networks and to devices requiring standard configurations.
- DAny changes that you make to a shared policy are not automatically applied to all the devices to which it is assigned.
- EThe Default section of a shared policy contains rules that cannot be overridden by local rules.
11Which of the following authentication methods are supported by both RADIUS and TACACS+ server groups on a Cisco ASA firewall? (Select 3 choices.)
- AASCII
- BCHAP
- CMSCHAPv1
- DMSCHAPv2
- EPAP
12Which of the following statements is true regarding ZFW traffic action characteristics? (Select the best answer.)
- AThe pass action is bidirectional and automatically permits return traffic.
- BThe inspect action is unidirectional and can be used to maintain state information.
- CThe drop action silently discards packets and does not generate ICMP host unreachable messages
- DThe pass action can provide an audit trail including session start, stop, and duration values.
13You have configured an ASA to accept SSL VPN connections. DTLS and DPD are configured on the ASA.
Which of the following is most likely to occur if a Cisco AnyConnect client that is not configured for DTLS attempts to connect to the ASA? (Select the best answer.)- AThe client will be unable to establish a connection to the ASA.
- BThe client will still be able to connect by using DTLS and will be able to communicate on the remote network.
- CThe client will be able to connect by using TLS and will be able to communicate on the remote network.
- DThe client will be able to establish a connection to the ASA but will be unable to communicate on the remote network.
14You want to use network object NAT to configure the ASA to perform PAT on traffic that originates from the 192.168.13.0/24 network attached to the INSIDE interface and that is destined to any networks connected to OUTSIDE interface.
Which of the following blocks of commands should you issue to achieve your goal? (Select the best answer.)- Aasa(config)#object network INSIDENetwork
asa(confignetworkobject)#subnet 192.168.13.0 255.255.255.0
asa(confignetworkobject)#nat (INSIDE,OUTSIDE) dynamic interface - Basa(config)#object network OUTSIDENetwork
asa(confignetworkobject)#subnet 198.51.100.0 255.255.255.0
asa(confignetworkobject)#nat (any,INSIDE) dynamic interface - Casa(config)#object network INSIDENetwork
asa(confignetworkobject)#subnet 192.168.13.0 255.255.255.0
asa(confignetworkobject)#nat (OUTSIDE,INSIDE) dynamic interface - Dasa(config)#object network INSIDENetwork
asa(confignetworkobject)#subnet 192.168.13.0 255.255.255.0
asa(confignetworkobject)#nat (any,OUTSIDE) dynamic interface
- Aasa(config)#object network INSIDENetwork
15Which of the following are inband management tools that do not use encryption? (Select 3 choices.)
- ASNMPv1
- BSNMPv2
- CSNMPv3
- DTelnet
- ESSH
16Your company’s Cisco ISE device and all of its supplicants support EAPFASTv2. A user’s authentication fails. However, the user’s device attempts to authenticate and succeeds.
Which of the following is true? (Select the best answer.)- AThe user will have no access.
- BThe user will have restricted access.
- CThe user will have full access.
- DThe device will have full access but the user will have no access.
17Which of the following features prevent attacks that consume CPU and memory resources? (Select 2 choices.)
- ACoPP
- BCPPr
- CCPU Threshold Notifications
- DMemory Threshold Notifications
18Which of the following can be detected by the Cisco ESA CASE? (Select 2 choices.)
- Asnowshoe spam
- Bphishing attacks
- CDDoS attacks
- DMAC spoofing attacks
- EDNS poisoning attacks
19You are configuring dynamic PAT on a Cisco ASA 5500 using the CLI. The ASA is running software version 8.3.
Which of the following IP addresses must be configured within a network object or object group? (Select the best answer.)- Ainside global
- Boutside global
- Cinside local
- Doutside local
20Which of the following phishing techniques is most likely to occur as a result of DNS poisoning? (Select the best answer.)
- Avishing
- Bpharming
- Cwhaling
- Ddumpster diving
21The Serial 0/0 interfaces on Router1 and Router2 are directly connected on the 192.168.51.48/30 network. You issue the following commands on Router1:
interface serial 0/0
ip ospf messagedigestkey 1 md5 b0s0n
router ospf 1
routerid 1.1.1.1
network 10.10.10.0 0.0.0.255 area 1
network 192.168.51.48 0.0.0.3 area 0
area 0 authentication
You issue the following commands on Router2:
interface serial 0/0
ip ospf authenticationkey b0s0n
router ospf 2
routerid 2.2.2.2
network 10.10.20.0 0.0.0.255 area 2
network 192.168.51.48 0.0.0.3 area 0
area 0 authentication
Router1 and Router2 do not form an OSPF adjacency.
Which of the following is most likely the problem? (Select the best answer.)- Aan OSPF area mismatch
- Ban OSPF authentication mismatch
- Can OSPF process ID mismatch
- Dan OSPF router ID mismatch
22In which of the following authentication protocols is support for TLS 1.2 specifically required? (Select the best answer.)
- AEAPFASTv1
- BEAPFASTv2
- CEAPMD5
- DEAPTLS
- EEAPPEAP
23Router2 is configured to obtain time from three different NTP servers. You want to determine from which of the three servers Router2 is currently synchronizing time.
Which of the following commands would not achieve your goal? (Select the best answer.)- Ashow clock detail
- Bshow ntp associations
- Cshow ntp associations details
- Dshow ntp status
24Which of the following indicates that aggressive mode ISAKMP peers have created SAs? (Select the best answer.)
- AAG_NO_STATE
- BMM_NO_STATEC. AG_AUTH
- CMM_KEY_AUTH
- DQM_IDLE
25Which of the following is least likely to be considered an advanced persistent threat? (Select the best answer.)
- AOperation Aurora
- BHeartbleed
- Cthe 2011 RSA breach
- DStuxnet
26Which of the following best describes the purpose of SNMP? (Select the best answer.)
- Ato manage network devices
- Bto send email
- Cto create VPNs
- Dto transfer files
27You create a static pointtopoint VTI tunnel on RouterA. Afterward, you issue the show runningconfig command and receive the following output:
Which of the following is the authentication transform that will be used by the static VTI tunnel? (Select the best answer.)
- AESP with 128bit AES
- BESP with 256bit AES
- CESP with 56bit DES
- DESP with 168bit 3DES
- EESP with MD5
- FESP with SHA
- GAH with MD5
- HAH with SHA
28To ease administrative overhead, you want to add a third party feed to a Security Intelligence device so that the IP addresses of known malicious hosts are automatically blacklisted. However, you have not determined whether the feed is valid.
Which of the following are you most likely to do? (Select the best answer.)- AImplement the feed, and add IP addresses to a custom whitelist as necessary.
- BEnforce Security Intelligence filtering by Security Zone.
- CConfigure the monitor-only setting, and examine the logs.
- DConfigure a custom blacklist that contains only malicious IP addresses.
29Which of the following is primarily true of SEM systems? (Select the best answer.)
- AThey perform real-time analysis and detection.
- BThey focus on policy and standards compliance.
- CThey consolidate logs to a central server.
- DThey analyze log data and report findings.
30You want to configure Cisco ISE as a SCEP proxy to a Microsoft Windows 2008 R2 Server root CA. Which of the following also needs to be configured? (Select the best answer.)
- AAD on the CA
- Ba root CA on the Cisco ISE
- Ca manually installed certificate on the connecting BYOD device
- DNDES on a CA or domain member server
31You issue the following commands on a Cisco router:
tacacsserver host ts1 single-connection timeout 20
tacacsserver timeout 30
Which of the following are true about how the Cisco router communicates with the TACACS+ server? (Select 2 choices.)- AThe router will maintain an open TCP connection.
- BThe router will maintain an open TCP connection for no more than 20 seconds.
- CThe router will maintain an open TCP connection for no more than 30 seconds.
- DThe router will wait 20 seconds for the server to reply before declaring an error.
- EThe router will wait 30 seconds for the server to reply before declaring an error.
32You want to implement a VPN with an alwayson fail close policy for Cisco AnyConnect clients.
Which of the following does Cisco recommend that you do? (Select the best answer.)- AStart with a fail open policy, and implement fail close in phases.
- BStart with the fail close policy, and implement fail open as necessary.
- CImplement always-on, and leave the failure policy at the default setting.
- DImplement always-on with a fail open policy, and enable the Disconnect button.
33Your company is using a shopping cart web application that is known to be vulnerable to a code injection attack. Your company has no support agreement for the application, and the application is no longer updated by its author. Modifying the code would require the hiring of additional help and an extensive interview process.
Which of the following should your company do in the meantime to most quickly mitigate the threat? (Select the best answer.)- AUse the grep command to examine web logs for evidence of an attack.
- BShut down the site.
- CReplace the shopping cart application with a different one.
- DImplement a WAF.
34Which of the following is a Cisco IPS appliance feature that analyzes normal network activity to detect hosts that are infected with worms? (Select the best answer.)
- Aanomaly detection
- Bglobal correlation
- Creputation filtering
- Da signature definition
- Ea threat rating
35Which of the following can be used to encrypt email messages, files, and disk drives? (Select the best answer.)
- AL2TP
- BPEM
- CPGP
- DS/MIME
36According to the branch location ACL design guidelines in the Cisco BYOD Design Guide, which protocols should not be permitted by the default ACL that is applied to the access ports of a Layer 2 switch? (Select 2 choices.)
- ABOOTP
- BDNS
- CHTTP
- DHTTPS
- EICMP
- FTFTP
37You have issued the following commands to modify the 802.1X configuration on a switch port:
switch(configif)#authentication order mab dot1x
switch(configif)#authentication priority dot1x mab
switch(configif)#authentication event fail action nextmethod switch(configif)#authentication event noresponse action authorize vlan 1313
A new host is attached to the switch port. The host’s MAC address is in the authentication database, but the host’s certificate for 802.1X authentication is expired.
Which of the following statements is true regarding the host in this scenario? (Select the best answer.)- AMAB will authorize the host for network access, and the switch port will ignore the host’s 802.1X authentication attempts.
- BMAB will authorize the host for network access? however, the host will lose network access when it attempts to authenticate with 802.1X.
- CThe host will fail 802.1X authentication and will be assigned to VLAN 1313.
- DThe host will fail 802.1X authentication, and the switch will place the port into an unauthorized state.
38Which of the following are symmetric encryption algorithms? (Select 3 choices.)
- AAES
- BRC4
- C3DES
- DECC
- EDH
- FDSA
39Which of the following statements is correct regarding the traffic types that can be matched in a class map on a Cisco ASA? (Select the best answer.)
- AA class map can match traffic by TCP port number but not by UDP port number.
- BA class map can match traffic by UDP port number but not by IP precedence.
- CA class map can match traffic by TCP port number but not by IP precedence.
- DA class map can match traffic by UDP port number but not by TCP port number.
- EA class map can match traffic by TCP port number, by UDP port number, and by IP precedence.
40Which of the following EAP authentication protocols requires both a client and a server digital certificate? (Select the best answer.)
- ALEAP
- BPEAP
- CEAP-FAST
- DEAP-TLS
41The system software on a Cisco Catalyst 3750 series switch was corrupted during a failed upgrade, and now the switch no longer passes the POST on restart. You want to use the Xmodem Protocol to recover the system software.
To which of the following ports on the switch could you connect? (Select the best answer.)- Aan Ethernet port in the management VLAN
- Bthe auxiliary port
- Cthe console port
- Dthe highest numbered Ethernet port on the switch
- Ethe lowest numbered Ethernet port on the switch
42Which of the following security functions is associated with the control plane? (Select the best answer.)
- Adevice configuration protection
- Bdevice resource protection
- Ctraffic accounting
- Dtraffic filtering
43Which of the following statements are true regarding IDS devices? (Select 2 choices.)
- AThey can send alerts.
- BThey do not sit inline with the flow of network traffic.
- CThey can directly block a virus before it infiltrates the network.
- DThey can detect malicious traffic only by signature matching
- EThey function identically to IPS devices.
44Which of the following statements are true regarding TACACS+? (Select 2 choices.)
- AIt encrypts the entire body of a packet.
- BIt combines authorization and authentication functions
- CIt provides router command authorization capabilities.
- DIt uses UDP for packet delivery.
- EIt was developed as an IETF standard protocol.
45Which of the following protocols can IPSec use to provide the integrity component of the CIA triad? (Select 2 choices.)
- AGRE
- BAH
- CAES
- DESP
- EDES
46RouterA is configured to establish an IKE tunnel with RouterB. You issue the show crypto isakmp sa command on RouterA and receive the following output:
dst src state connid slot
10.1.2.3 10.1.2.4 MM_SA_SETUP 1 0
Which of the following statements is true? (Select the best answer.)- ARouterA has negotiated ISAKMP SA parameters with RouterB.
- BRouterA has exchanged keys with RouterB.
- CRouterA has generated a shared secret.
- DRouterA uses three transactions to negotiate an ISAKMP SA.
- ERouterA has established an active IKE SA.
47Which of the following worms was used in an act of cyber warfare against Iranian ICSs? (Select the best answer.)
- ABlaster
- BNachi
- CStuxnet
- DWelchia
48Which of the following statements is true regarding the Cisco IOS Resilient Configuration feature? (Select the best answer.)
- AExtra space is not required to secure the primary IOS image file.
- BImage or configuration mismatches are not automatically detected.
- COnly remote storage can be used for securing configuration files.
- DThe feature can be disabled remotely.
49Which of the following can be installed on a host to analyze and prevent malicious traffic on that host? (Select the best answer.)
- Aantivirus software
- Ba HIPS
- Ca persona firewall
- Da proxy server
50Which of the following traffic types can be detected by the FirePOWER ratebased prevention preprocessor engine? (Select the best answer.)
- ABack Orifice traffic
- Bdistributed port scan traffic
- Cport sweep traffic
- DSYN flood traffic
Informationen
- Beschreibung
- CCNA Security Quiz am Security 50 - 100, erstellt von Anthony Rosales Sandoval am 03/11/2018.
- Sprache
- Español
- Aufrufe
- 13
- Schlagwörter
- Bewertung
- Noch keine Bewertungen Bewerte dieses Quiz