Quiz
cisco1
Dieses Quiz enthält Fragetypen, die sich im gewohnten Player öffnen.
Fragen in diesem Quiz (118)
1What method can be used to mitigate ping sweeps?
- Ausing encrypted or hashed authentication protocols
- Binstalling antivirus software on hosts
- Cdeploying antisniffer software on all network devices
- Dblocking ICMP echo and echo-replies at the network edge
2What are the three major components of a worm attack? (Choose three.)?
- Aa penetration mechanism
- Ban infecting vulnerability
- Ca payload
- Dan enabling vulnerability
- Ea probing mechanism
- Fa propagation mechanism
3Which statement accurately characterizes the evolution of threats to network security?
- AInternal threats can cause even greater damage than external threats
- BThreats have become less sophisticated while the technical knowledge needed by an attacker has grown.
- CEarly Internet users often engaged in activities that would harm other users.
- DInternet architects planned for network security from the beginning.
4What causes a buffer overflow?
- Alaunching a security countermeasure to mitigate a Trojan horse
- Bsending repeated connections such as Telnet to a particular device, thus denying other data sources.
- Cdownloading and installing too many software updates at one time
- Dattempting to write more data to a memory location than that location can hold
- Esending too much information to two or more interfaces of the same device, thereby causing dropped packets
5What commonly motivates cybercriminals to attack networks as compared to hactivists or state-sponsored hackers?
- Astatus among peers
- Bfame seeking
- Cfinancial gain
- Dpolitical reasons
6Which two network security solutions can be used to mitigate DoS attacks? (Choose two.)
- Avirus scanning
- Bintrusion protection systems
- Capplying user authentication
- Dantispoofing technologies
- Edata encryption
77. Which two statements characterize DoS attacks? (Choose two.)
- AExamples include smurf attacks and ping of death attacks
- BThey attempt to compromise the availability of a network, host, or application
8An attacker is using a laptop as a rogue access point to capture all network traffic from a targeted user. Which type of attack is this?
- Atrust exploitation
- Bbuffer overflow
- Cman in the middle
- Dport redirection
9What functional area of the Cisco Network Foundation Protection framework is responsible for device-generated packets required for network operation, such as ARP message exchanges and routing advertisements?
- Adata plane
- Bcontrol plane
- Cmanagement plane
- Dforwarding plane
10What are the three components of information security ensured by cryptography? (Choose three.)
- Athreat prevention
- Bauthorization
- Cconfidentiality
- Dcountermeasures
- Eintegrity
- Favailability
11What is the primary method for mitigating malware?
- Ausing encrypted or hashed authentication protocols
- Binstalling antivirus software on all hosts
- Cblocking ICMP echo and echo-replies at the network edge
- Ddeploying intrusion prevention systems throughout the network
12What is an objective of a state-sponsored attack?
- Ato gain financial prosperity
- Bto sell operation system vulnerabilities to other hackers
- Cto gain attention
- Dto right a perceived wrong
13What role does the Security Intelligence Operations (SIO) play in the Cisco SecureX architecture?
- Aidentifying and stopping malicious traffic
- Bauthenticating users
- Cenforcing policy
- Didentifying applications
14What worm mitigation phase involves actively disinfecting infected systems[blank_start]?[blank_end]
- ATreatment
15How is a smurf attack conducted?
- Aby sending a large number of packets to overflow the allocated buffer memory of the target device
- Bby sending a large number of ICMP requests to directed broadcast addresses from a spoofed source address on the same network
- Cby sending a large number of TCP SYN packets to a target device from a spoofed source address
- Dby sending an echo request in an IP packet larger than the maximum packet size of 65,535 bytes
16What is a characteristic of a Trojan horse as it relates to network security?
- AMalware is contained in a seemingly legitimate executable program.
- BExtreme quantities of data are sent to a particular network device interface
- CAn electronic dictionary is used to obtain a password to be used to infiltrate a key network device.
- DToo much information is destined for a particular memory block causing additional memory areas to be affected.
17What is the first step in the risk management process specified by the ISO/IEC?
- ACreate a security policy.
- BConduct a risk assessment.
- CInventory and classify IT assets
- DCreate a security governance model.
18What is the significant characteristic of worm malware?
- AA worm can execute independently
- BA worm must be triggered by an event on the host system
- CWorm malware disguises itself as legitimate software
- DOnce installed on a host system, a worm does not replicate itself.
19Which condition describes the potential threat created by Instant On in a data center?
- Awhen the primary firewall in the data center crashes
- Bwhen an attacker hijacks a VM hypervisor and then launches attacks against other devices in the data center
- Cwhen the primary IPS appliance is malfunctioning
- Dwhen a VM that may have outdated security policies is brought online after a long period of inactivity
20What are the three core components of the Cisco Secure Data Center solution? (Choose three.)
- Amesh network
- Bsecure segmentation
- Cvisibility
- Dthreat defense
- Eservers
- Finfrastructure
21A disgruntled employee is using Wireshark to discover administrative Telnet usernames and passwords. What type of network attack does this describe?
- Atrust exploitation
- Bdenial of service
- Creconnaissance
- Dport redirection
2222. Which two statements describe access attacks? (Choose two.)
- ATrust exploitation attacks often involve the use of a laptop to act as a rogue access point to capture and copy all network traffic in a public location, such as a wireless hotspot.
- BTo detect listening services, port scanning attacks scan a range of TCP or UDP port numbers on a host
- CBuffer overflow attacks write data beyond the hallocated buffer memory to overwrite valid data or to exploit systems to execute malicious code.
- DPassword attacks can be implemented by the use os brute-force attack methods, Trojan horse, or packet sniffers
- EPort redirection attacks use a network adapter card in promiscuous mode to capture all network packets that are sent across a LAN.
23What is a ping sweep?
- Aa scanning technique that examines a range of TCP or UDP port numbers on a host to detect listening services.
- Ba software application that enables the capture of all network packets that are sent across a LAN.
- Ca query and response protocol that identifies information about a domain, including the addresses that are assigned to that domain
- Da network scanning technique that indicates the live hosts in a range of IP addresses.
24As a dedicated network security tool, an intrusion system can provide detection and blocking of attacks in real time[blank_start]?[blank_end]
- A? Protection
25An administrator defined a local user account with a secret password on router R1 for use with SSH. Which three additional steps are required to configure R1 to accept only encrypted SSH connections? (Choose three.)
- AEnable inbound vty SSH sessions.
- BGenerate two-way pre-shared keys.
- CConfigure DNS on the router.
- DConfigure the IP domain name on the router.
- EEnable inbound vty Telnet sessions.
- FGenerate the SSH keys.
26Which set of commands are required to create a username of admin, hash the password using MD5, and force the router to access the internal username database when a user attempts to access the console?
- AR1(config)# username admin password Admin01pa55
R1(config)# line con 0
R1(config-line)# login local - BR1(config)# username admin secret Admin01pa55
R1(config)# line con 0
R1(config-line)# login local - CR1(config)# username admin Admin01pa55 encr md5
R1(config)# line con 0
R1(config-line)# login local - DR1(config)# username admin password Admin01pa55
R1(config)# line con 0
R1(config-line)# login - ER1(config)# username admin secret Admin01pa55
R1(config)# line con 0
R1(config-line)# login
- AR1(config)# username admin password Admin01pa55
27Refer to the exhibit. Which statement about the JR-Admin account is true?
- AJR-Admin can issue only ping commands
- BJR-Admin can issue show, ping, and reload commands.
- CJR-Admin cannot issue any command because the privilege level does not match one of those defined
- DJR-Admin can issue debug and reload commands.
- EJR-Admin can issue ping and reload commands
28Which three areas of router security must be maintained to secure an edge router at the network perimeter? (Choose three.)
- Aremote access security
- Bzone isolation
- Crouter hardening
- Doperating system security
- Eflash security
- Fphysical security
29.Which recommended security practice prevents attackers from performing password recovery on a Cisco IOS router for the purpose of gaining access to the privileged EXEC mode?
- ALocate the router in a secure locked room that is accessible only to authorized personnel
- BConfigure secure administrative control to ensure that only authorized personnel can access the router
- CKeep a secure copy of the router Cisco IOS image and router configuration file as a backup.
- DProvision the router with the maximum amount of memory possible.
- EDisable all unused ports and interfaces to reduce the number of ways that the router can be accessed
30Refer to the exhibit. Based on the output of the show running-config command, which type of view is SUPPORT?
- ACLI view, containing SHOWVIEW and VERIFYVIEW commands
- Bsuperview, containing SHOWVIEW and VERIFYVIEW views
- Csecret view, with a level 5 encrypted password
- Droot view, with a level 5 encrypted secret password
31.Which two characteristics apply to role-based CLI access superviews? (Choose two.)
- AA specific superview cannot have commands added to it directly.
- BCLI views have passwords, but superviews do not have passwords.
- CA single superview can be shared among multiple CLI views
- DDeleting a superview deletes all associated CLI views.
- EUsers logged in to a superview can access all commands specified within the associated CLI views.
32Which three types of views are available when configuring the role-based CLI access feature? (Choose three.)
- Asuperview
- Badmin view
- Croot view
- Dsuperuser view
- ECLI view
- Fconfig view
33.If AAA is already enabled, which three CLI steps are required to configure a router with a specific view? (Choose three.)
- ACreate a superview using the parser view view-name command.
- BAssociate the view with the root view
- CAssign users who can use the view
- DCreate a view using the parser view view-name command.
- EAssign a secret password to the view.
- FAssign commands to the view
34What occurs after RSA keys are generated on a Cisco router to prepare for secure device management?
- AThe keys must be zeroized to reset Secure Shell before configuring other parameters.
- BAll vty ports are automatically configured for SSH to provide secure management.
- CThe general-purpose key size must be specified for authentication with the crypto key generate rsa
- Dgenerate rsa general-keys moduluscommand
- EThe generated keys can be used by SSH
35Which three statements describe limitations in using privilege levels for assigning command authorization? (Choose three.)
- ACreating a user account that needs access to most but not all commands can be a tedious process
- BViews are required to define the CLI commands that each user can access.
- CCommands set on a higher privilege level are not available for lower privilege users.
- DIt is required that all 16 privilege levels be defined, whether they are used or not.
- EThere is no access control to specific interfaces on a router.
- FThe root user must be assigned to each privilege level that is defined.
36What command must be issued to enable login enhancements on a Cisco router?
- Aprivilege exec level
- Blogin delay
- Clogin block-for
- Dbanner motd
37What is the default privilege level of user accounts created on Cisco routers?
- A0
- B1
- C15
- D16
38A network administrator notices that unsuccessful login attempts have caused a router to enter quiet mode. How can the administrator maintain remote access to the networks even during quiet mode?
- AQuiet mode behavior can be enabled via an ip access-group command on a physical interface.
- BQuiet mode behavior will only prevent specific user accounts from attempting to authenticate.
- CQuiet mode behavior can be overridden for specific networks by using an ACL.
- DQuiet mode behavior can be disabled by an administrator by using SSH to connect.
39What is a characteristic of the Cisco IOS Resilient Configuration feature?
- AIt maintains a secure working copy of the bootstrap startup program.
- BOnce issued, the secure boot-config command automatically upgrades the configuration archive to a newer version after new configuration commands have been entered.
- CA snapshot of the router running configuration can be taken and securely archived in persistent storage
- DThe secure boot-image command works properly when the system is configured to run an image from a TFTP server.
40What is a requirement to use the Secure Copy Protocol feature?
- AAt least one user with privilege level 1 has to be configured for local authentication.
- BA command must be issued to enable the SCP server side functionality.
- CA transfer can only originate from SCP clients that are routers.
- DThe Telnet protocol has to be configured on the SCP server side.
41What is a characteristic of the MIB?
- AThe OIDs are organized in a hierarchical structure.
- BInformation in the MIB cannot be changed.
- CA separate MIB tree exists for any given device in the network.
- DInformation is organized in a flat manner so that SNMP can access it quickly.
42Which three items are prompted for a user response during interactive AutoSecure setup? (Choose three.)
- AIP addresses of interfaces
- Bcontent of a security banner
- Cenable secret password
- Dservices to disable
- Eenable password
- Finterfaces to enable
43A network engineer is implementing security on all company routers. Which two commands must be issued to force authentication via the password 1A2b3C for all OSPF-enabled interfaces in the backbone area of the company network? (Choose two.)
- Aarea 0 authentication message-digest
- Bip ospf message-digest-key 1 md5 1A2b3C
- Cusername OSPF password 1A2b3C
- Denable password 1A2b3C
- Earea 1 authentication message-digest
44What is the purpose of using the ip ospf message-digest-key key md5 password command and the area area-id authentication message-digest command on a router?
- Ato configure OSPF MD5 authentication globally on the router
- Bto enable OSPF MD5 authentication on a per-interface basis
- Cto facilitate the establishment of neighbor adjacencies
- Dto encrypt OSPF routing updates
45What are two reasons to enable OSPF routing protocol authentication on a network? (Choose two.)
- Ato provide data security through encryption
- Bto ensure faster network convergence
- Cto ensure more efficient routing
- Dto prevent data traffic from being redirected and then discarded
- Eto prevent redirection of data traffic to an insecure link
46Which two options can be configured by Cisco AutoSecure? (Choose two.)
- Aenable secret password
- Binterface IP address
- CSNMP
- Dsecurity banner
- Esyslog
47Which three functions are provided by the syslog logging service? (Choose three.)
- Asetting the size of the logging buffer
- Bspecifying where captured information is stored
- Cgathering logging information
- Dauthenticating and encrypting data sent over the network
- Edistinguishing between information to be captured and information to be ignored
- Fretaining captured messages on the router when a router is rebooted
48What is the Control Plane Policing (CoPP) feature designed to accomplish?
- Adisable control plane services to reduce overall traffic
- Bprevent unnecessary traffic from overwhelming the route processor
- Cdirect all excess traffic away from the route process
- Dmanage services provided by the control plane
49.Which three actions are produced by adding Cisco IOS login enhancements to the router login process? (Choose three.)
- Apermit only secure console access
- Bcreate password authentication
- Cautomatically provide AAA authentication
- Dcreate syslog messages
- Eslow down an active attack
- Fdisable logins from specified hosts
50.Because of implemented security controls, a user can only access a server with FTP. Which AAA component accomplishes this?
- Aaccounting
- Baccessibility
- Cauditing
- Dauthorization
- Eauthentication
51Why is authentication with AAA preferred over a local database method?
- AIt provides a fallback authentication method if the administrator forgets the username or password.
- BIt uses less network bandwidth
- CIt specifies a different password for each line or port.
- DIt requires a login and password combination on the console, vty lines, and aux ports.
52Which authentication method stores usernames and passwords in ther router and is ideal for small networks.
- Alocal AAA over TACACS+
- Bserver-based AAA over TACACS+
- Clocal AAA
- Dlocal AAA over RADIUS
- Eserver-based AAA over RADIUS
- Fserver-based AAA
53Which component of AAA allows an administrator to track individuals who access network resources and any changes that are made to those resources?
- Aaccounting
- Baccessibility
- Cauthentication
- Dauthorization
54Refer to the exhibit. Router R1 has been configured as shown, with the resulting log message. On the basis of the information that is presented, which two statements describe the result of AAA authentication operation? (Choose two.)
- AThe locked-out user stays locked out until the clear aaa local user lockout username Admin command is issued
- BThe locked-out user stays locked out until the interface is shut down then re-enabled.
- CThe locked-out user is locked out for 10 minutes by default.
- DThe locked-out user should have used the username admin and password Str0ngPa55w0rd.
- EThe locked-out user failed authentication
55A user complains about being locked out of a device after too many unsuccessful AAA login attempts. What could be used by the network administrator to provide a secure authentication access method without locking a user out of a device?
- AUse the login delay command for authentication attempts
- BUse the login local command for authenticating user access
- CUse the aaa local authentication attempts max-fail global configuration mode command with a higher number of acceptable failures
- DUse the none keyword when configuring the authentication method list.
56A user complains about not being able to gain access to a network device configured with AAA. How would the network administrator determine if login access for the user account is disabled?
- AUse the show aaa local user lockout command.
- BUse the show running-configuration command
- CUse the show aaa sessions command
- DUse the show aaa user command.
57When a method list for AAA authentication is being configured, what is the effect of the keywordlocal?
- AThe login succeeds, even if all methods return an error.
- BIt uses the enable password for authentication.
- CIt accepts a locally configured username, regardless of case.
- DIt defaults to the vty line password for authentication.
58Which solution supports AAA for both RADIUS and TACACS+ servers?
- AImplement Cisco Secure Access Control System (ACS) only.
- BRADIUS and TACACS+ servers cannot be supported by a single solution.
- CImplement a local database
- DImplement both a local database and Cisco Secure
- EAccess Control System (ACS).
59.What difference exists when using Windows Server as an AAA server, rather than Cisco Secure ACS?
- AWindows Server requires more Cisco IOS commands to configure
- BWindows Server only supports AAA using TACACS
- CWindows Server uses its own Active Directory (AD) controller for authentication and authorization.
- DWindows Server cannot be used as an AAA server.
60What is a characteristic of TACACS+?
- ATACACS+ uses UDP port 1645 or 1812 for authentication, and UDP port 1646 or 1813 for accounting.
- BTACACS+ is backward compatible with TACACS and XTACACS
- CTACACS+ is an open IETF standard.
- DTACACS+ provides authorization of router commands on a per-user or per-group basis.
61Which two features are included by both TACACS+ and RADIUS protocols? (Choose two.)
- A802.1X support
- Bseparate authentication and authorization processes
- CSIP support
- Dpassword encryption
- Eutilization of transport layer protocols
62Which server-based authentication protocol would be best for an organization that wants to apply authorization policies on a per-group basis?
- ASSH
- BRADIUS
- CACS
- DTACACS+
63Refer to the exhibit. Which statement describes the configuration of the ports for Server1?
- AThe configuration using the default ports for a Cisco router.
- BThe configuration of the ports requires 1812 be used for the authentication and the authorization ports
- CThe configuration will not be active until it is saved and Rtr1 is rebooted
- DThe ports configured for Server1 on the router must be identical to those configured on the RADIUS server.
64The single-connection keyword prevents the configuration of multiple TACACS+ servers on a AAA-enabled router.
- ARichtig
- BFalsch
65Why would a network administrator include a local username configuration, when the AAA-enabled router is also configured to authenticate using several ACS servers?
- ABecause ACS servers only support remote user access, local users can only authenticate using a local username database.
- BA local username database is required when configuring authentication using ACS servers.
- CThe local username database will provide a backup for authentication in the event the ACS servers become unreachable.
- DWithout a local username database, the router will require successful authentication with each ACS server.
66.Which debug command is used to focus on the status of a TCP connection when using TACACS+ for authentication?
- Adebug tacacs events
- Bdebug tacacs
- Cdebug tacacs accounting
- Ddebug aaa authentication
67Which characteristic is an important aspect of authorization in an AAA-enabled network device?
- AThe authorization feature enhances network performance.
- BUser access is restricted to certain services
- CUser actions are recorded for use in audits and troubleshooting events.
- DA user must be identified before network access is granted
68What is the result of entering the aaa accounting network command on a router?
- AThe router collects and reports usage data related to network-related service requests.
- BThe router outputs accounting data for all EXEC shell sessions.
- CThe router provides data for only internal service requests.
- DThe router outputs accounting data for all outbound connections such as SSH and Telnet.
69What is a characteristic of AAA accounting?
- APossible triggers for the aaa accounting exec default command include start-stop and stop-only.
- BAccounting can only be enabled for network connections
- CAccounting is concerned with allowing and disallowing authenticated users access to certain areas and programs on the network.
- DUsers are not required to be authenticated before AAA accounting logs their activities on the network
70When using 802.1X authentication, what device controls physical access to the network, based on the authentication status of the client?
- Athe router that is serving as the default gateway
- Bthe authentication server
- Cthe switch that the client is connected to
- Dthe supplicant
71What device is considered a supplicant during the 802.1X authentication process?
- Athe client that is requesting authentication
- Bthe switch that is controlling network access
- Cthe router that is serving as the default gateway
- Dthe authentication server that is performing client authentication
72What protocol is used to encapsulate the EAP data between the authenticator and authentication server performing 802.1X authentication?
- ASSH
- BMD5
- CTACACS+
- DRADIUS
73Which command is used to activate an IPv6 ACL named ENG_ACL on an interface so that the router filters traffic prior to accessing the routing table?
- Aipv6 access-class ENG_ACL in
- Bipv6 traffic-filter ENG_ACL out
- Cipv6 traffic-filter ENG_ACL in
- Dipv6 access-class ENG_ACL out
74Which statement describes a typical security policy for a DMZ firewall configuration?
- ATraffic that originates from the inside interface is generally blocked entirely or very selectively permitted to the outside interface.
- BTraffic that originates from the DMZ interface is selectively permitted to the outside interface.
- CTraffic that originates from the outside interface is permitted to traverse the firewall to the inside interface with few or no restrictions.
- DReturn traffic from the inside that is associated with traffic originating from the outside is permitted to traverse from the inside interface to the outside interface.
- EReturn traffic from the outside that is associated with traffic originating from the inside is permitted to traverse from the outside interface to the DMZ interface.
75.Refer to the exhibit. Which statement describes the function of the ACEs?
- AThese ACEs allow for IPv6 neighbor discovery traffic
- BThese ACEs automatically appear at the end of every IPv6 ACL to allow IPv6 routing to occur
- CThese are optional ACEs that can be added to the end of an IPv6 ACL to allow ICMP messages that are defined in object groups named nd-na and nd-ns
- DThese ACEs must be manually added to the end of every IPv6 ACL to allow IPv6 routing to occur
76When an inbound Internet-traffic ACL is being implemented, what should be included to prevent the spoofing of internal networks?
- AACEs to prevent traffic from private address spaces
- BACEs to prevent broadcast address traffic
- CACEs to prevent ICMP traffic
- DACEs to prevent HTTP traffic
- EACEs to prevent SNMP traffic
77In addition to the criteria used by extended ACLs, what conditions are used by a classic firewall to filter traffic?
- ATCP/UDP source and destination port numbers
- BTCP/IP protocol numbers
- CIP source and destination addresses
- Dapplication layer protocol session information
78A router has been configured as a classic firewall and an inbound ACL applied to the external interface. Which action does the router take after inbound-to-outbound traffic is inspected and a new entry is created in the state table?
- AWhen traffic returns from its destination, it is reinspected, and a new entry is added to the state table.
- BThe internal interface ACL is reconfigured to allow the host IP address access to the Internet
- CThe entry remains in the state table after the session is terminated so that it can be reused by the host
- DA dynamic ACL entry is added to the external interface in the inbound direction.
79If the provided ACEs are in the same ACL, which ACE should be listed first in the ACL according to best practice?
- Apermit udp 172.16.0.0 0.0.255.255 host 172.16.1.5 eq snmptrap
- Bdeny udp any host 172.16.1.5 eq snmptrap
- Cdeny tcp any any eq telnet
- Dpermit ip any any
- Epermit udp any any range 10000 20000
- Fpermit tcp 172.16.0.0 0.0.3.255 any established
80A company is deploying a new network design in which the border router has three interfaces. Interface Serial0/0/0 connects to the ISP, GigabitEthernet0/0 connects to the DMZ, and GigabitEthernet/01 connects to the internal private network. Which type of traffic would receive the least amount of inspection (have the most freedom of travel)?
- Atraffic that is going from the private network to the DMZ
- Btraffic that is returning from the DMZ after originating from the private network
- Ctraffic that originates from the public network and that is destined for the DMZ
- Dtraffic that is returning from the public network after originating from the private network
81Refer to the exhibit. The ACL statement is the only one explicitly configured on the router. Based on this information, which two conclusions can be drawn regarding remote access network connections? (Choose two.)
- ASSH connections from the 192.168.2.0/24 network to the 192.168.1.0/24 network are allowed.
- BTelnet connections from the 192.168.1.0/24 network to the 192.168.2.0/24 network are allowed.
- CTelnet connections from the 192.168.1.0/24 network to the 192.168.2.0/24 network are blocked.
- DSSH connections from the 192.168.1.0/24 network to the 192.168.2.0/24 network are allowed.
- ESSH connections from the 192.168.1.0/24 network to the 192.168.2.0/24 network are blocked.
- FTelnet connections from the 192.168.2.0/24 network to the 192.168.1.0/24 network are allowed.
82Consider the following
access list.access-list 100 permit ip host 192.168.10.1 any
access-list 100 deny icmp 192.168.10.0 0.0.0.255 any echo
access-list 100 permit ip any any
Which two actions are taken if the access list is placed inbound on a router Gigabit Ethernet port that has the IP address 192.168.10.254 assigned? (Choose two.)- AOnly the network device assigned the IP address 192.168.10.1 is allowed to access the router.
- BDevices on the 192.168.10.0/24 network are not allowed to reply to any ping requests
- COnly Layer 3 connections are allowed to be made from the router to any other network device
- DDevices on the 192.168.10.0/24 network are not allowed to ping other devices on the 192.168.11.0 network
- EA Telnet or SSH session is allowed from any device on the 192.168.10.0 into the router with this access list assigned
83What is one benefit of using a stateful firewall instead of a proxy server?
- Aability to perform user authentication
- Bbetter performance
- Cability to perform packet filtering
- Dprevention of Layer 7 attacks
84What is one limitation of a stateful firewall?
- Aweak user authentication
- Bcannot filter unnecessary traffic
- Cnot as effective with UDP- or ICMP-based traffic
- Dpoor log information
85When a Cisco IOS Zone-Based Policy Firewall is being configured via CLI, which step must be taken after zones have been created?
- AAssign interfaces to zones.
- BEstablish policies between zones.
- CIdentify subsets within zones.
- DDesign the physical infrastructure
86A network administrator is implementing a Classic Firewall and a Zone-Based Firewall concurrently on a router. Which statement best describes this implementation?
- AAn interface must be assigned to a security zone before IP inspection can occur.
- BBoth models must be implemented on all interfaces.
- CThe two models cannot be implemented on a single interface.
- DA Classic Firewall and Zone-Based Firewall cannot be used concurrently.
87Which two rules about interfaces are valid when implementing a Zone-Based Policy Firewall? (Choose two.)
- AIf one interface is a zone member, but the other is not, all traffic will be passed
- BIf neither interface is a zone member, then the action is to pass traffic
- CIf both interfaces are members of the same zone, all traffic will be passed
- DIf one interface is a zone member and a zone-pair exists, all traffic will be passed.
- EIf both interfaces belong to the same zone-pair and a policy exists, all traffic will be passed.
88.Which command will verify a Zone-Based Policy Firewall configuration?
- Ashow interfaces
- Bshow zones
- Cshow running-config
- Dshow protocols
89Refer to the exhibit. The network “A” contains multiple corporate servers that are accessed by hosts from the Internet for information about the corporation. What term is used to describe the network marked as “A”?
- Ainternal network
- Buntrusted network
- Cperimeter security boundary
- DDMZ
90Which type of packet is unable to be filtered by an outbound ACL?
- Amulticast packet
- BICMP packet
- Cbroadcast packet
- Drouter-generated packet
91When a Cisco IOS Zone-Based Policy Firewall is being configured, which two actions can be applied to a traffic class? (Choose two.)
- Adrop
- Blog
- Cforward
- Dhold
- Einspect
- Fcopy
92A firewall monitors the state of connections as network traffic flows into and out of the organization[blank_start].?[blank_end]
- A?stateful
93The action in a Cisco IOS Zone-Based Policy Firewall is similar to a permit statement in an ACL.[blank_start]?[blank_end]
- A? pass
94Refer to the exhibit. If a hacker on the outside network sends an IP packet with source address 172.30.1.50, destination address 10.0.0.3, source port 23, and destination port 2447, what does the Cisco IOS firewall do with the packet?
- AThe initial packet is dropped, but subsequent packets are forwarded
- BThe packet is forwarded, and an alert is generated.
- CThe packet is forwarded, and no alert is generated
- DThe packet is dropped.
95To facilitate the troubleshooting process, which inbound ICMP message should be permitted on an outside interface?
- Aecho request
- Btime-stamp request
- Cecho reply
- Dtime-stamp reply
- Erouter advertisement
96What information must an IPS track in order to detect attacks matching a composite signature?
- Athe total number of packets in the attack
- Bthe attacking period used by the attacker
- Cthe network bandwidth consumed by all packets
- Dthe state of packets related to the attack
97What is a disadvantage of a pattern-based detection mechanism?
- AThe normal network traffic pattern must be profiled first.
- BIt cannot detect unknown attacks.
- CIt is difficult to deploy in a large network.
- DIts configuration is complex.
98What is the purpose in configuring an IOS IPS crypto key when enabling IOS IPS on a Cisco router?
- Ato secure the IOS image in flash
- Bto enable Cisco Configuration Professional to be launched securely
- Cto encrypt the master signature file
- Dto verify the digital signature for the master signature file
99Refer to the exhibit. What is the result of issuing the Cisco IOS IPS commands on router R1?
- AAll traffic that is permitted by the ACL is subject to inspection by the IPS
- BA named ACL determines the traffic to be inspected
- CAll traffic that is denied by the ACL is subject to inspection by the IPS.
- DA numbered ACL is applied to S0/0/0 in the outbound directio
100Which two benefits does the IPS version 5.x signature format provide over the version 4.x signature format? (Choose two.)
- Asupport for IPX and AppleTalk protocols
- Baddition of signature micro engines
- Csupport for comma-delimited data import
- Dsupport for encrypted signature parameters
- Eaddition of a signature risk rating
101Which type of IPS signature detection is used to distract and confuse attackers?
- Ahoneypot-based detection
- Bpolicy-based detection
- Cpattern-based detection
- Danomaly-based detection
102Which statement is true about an atomic alert that is generated by an IPS?
- AIt is an alert that is used only when a logging attack has begun.
- BIt is a single alert sent for multiple occurrences of the same signature.
- CIt is an alert that is generated every time a specific signature has been found.
- DIt is both a normal alarm and a summary alarm being sent simultaneously at set intervals
103.A system analyst is configuring and tuning a recently deployed IPS appliance. By examining the IPS alarm log, the analyst notices that the IPS does not generate alarms for a few known attack packets. Which term describes the lack of alarms by the IPS?
- Atrue negative
- Bfalse positive
- Cfalse negative
- Dtrue positive
104A security specialist configures an IPS so that it will generate an alert when an attack is first detected. Alerts for the subsequent detection of the same attack are suppressed for a pre-defined period of time. Another alert will be generated at the end of the period indicating the number of the attack detected. Which IPS alert monitoring mechanism is configured?
- Acomposite alert
- Batomic alert
- Ccorrelation alert
- Dsummary alert
105In configuring a Cisco router to prepare for IPS and VPN features, a network administrator opens the file realm-cisco.pub.key.txt, and copies and pastes the contents to the router at the global configuration prompt. What is the result after this configuration step?
- AThe router is authenticated with the Cisco secure IPS resource web server
- BA pair of public/secret keys is created for IPsec VPN operation
- CA crypto key is created for IOS IPS to verify the master signature file
- DA pair of public/secret keys is created for the router to serve as an SSH server
106Refer to the exhibit. Based on the configuration, which traffic will be examined by the IPS that is configured on router R1?
- Atraffic that is destined to LAN 1 and LAN 2
- Breturn traffic from the web server
- Ctraffic that is initiated from LAN 1 and LAN 2
- Dno traffic will be inspected
- Ehttp traffic that is initiated from LAN 1
107Refer to the exhibit. Based on the IPS configuration provided, which conclusion can be drawn?
- AThe signatures in all categories will be compiled into memory and used by the IPS.
- BThe signatures in all categories will be retired and not be used by the IPS
- COnly the signatures in the ios_ips basic category will be compiled into memory and used by the IPS.
- DThe signatures in the ios_ips basic category will be retired and the remaining signatures will be compiled into memory and used by the IPS
108A network administrator is configuring an IOS IPS with the command
R1(config)# ip ips signature-definition
Which configuration task can be achieved with this command?- ARetire or unretire the ios_ips basic signature category.
- BRetire or unretire an individual signature
- CRetire or unretire the all signature category
- DRetire or unretire the all atomic signatures category
109What are two disadvantages of using an IDS? (Choose two.)
- AThe IDS analyzes actual forwarded packets.
- BThe IDS does not stop malicious traffic.
- CThe IDS has no impact on traffic.
- DThe IDS works offline using copies of network traffic.
- EThe IDS requires other devices to respond to attacks.
110What are two shared characteristics of the IDS and the IPS? (Choose two.)
- ABoth use signatures to detect malicious traffic.
- BBoth analyze copies of network traffic.
- CBoth have minimal impact on network performance.
- DBoth have minimal impact on network performance
- EBoth rely on an additional network device to respond to malicious traffic.
- FBoth are deployed as sensors.
111Refer to the exhibit. A network administrator enters the command on a Cisco IOS IPS router. What is the effect?
- AAlert messages are sent in syslog format.
- BAlert messages are sent in trace file format.
- CAlert messages are sent in Security Device Event Exchange (SDEE) format.
- DAlert messages are sent in event log format
112A network administrator suspects the default setting of the ip ips notify sdee command has caused performance degradation on the Cisco IOS IPS router. The network administrator enters the ip sdee events 50 command in an attempt to remedy the performance issues. What is the immediate effect of this command?
- AAll events that were stored in the original buffer are saved, while a new buffer is created to store new events
- BAll events that were stored in the previous buffer are lost.
- CThe newest 50 events from the original buffer are saved and all others are deleted
- DThe oldest 50 events of the original buffer are deleted.
113A Cisco IDS does not affect the flow of traffic when it operates in promiscuous mode
- ARichtig
- BFalsch
114What is a required condition to enable IPS activity reporting using the SDEE format?
- ACreate an IOS IPS configuration directory in flash
- BEnable an HTTP or HTTPS service on the router
- CConfigure the signature category
- DIssue the ip ips notify log command
115Refer to the exhibit. Which statement best describes how incoming traffic on serial 0/0 is handled?
- ATraffic that is coming from any source other than 172.31.235.0/24 will be scanned and reported
- BTraffic not matching ACL 100 will be dropped
- CTraffic not matching ACL 100 will be scanned and reported
- DTraffic that is sourced from 172.31.235.0/24 will be sent directly to its destination without being scanned or reported.
- ETraffic matching ACL 100 will be scanned and reported
- FTraffic that is sourced from 172.31.235.0/24 will be scanned and reported
116What is a disadvantage of network-based IPS as compared to host-based IPS?
- ANetwork-based IPS is less cost-effective
- BNetwork-based IPS should not be used with multiple operating systems
- CNetwork-based IPS cannot examine encrypted traffic.
- DNetwork-based IPS does not detect lower level network events.
117An IPS sensor has detected the string confidential across multiple packets in a TCP session. Which type of signature trigger and signature type does this describe?
- ATrigger: Policy-based detection
Type: Atomic signature - BTrigger: Policy-based detection
Type: Composite signature - CTrigger: Anomaly-based detection
Type: Atomic signature - DTrigger: Anomaly-based detection
Type: Composite signature - ETrigger: Pattern-based detection
Type: Atomic signature - FTrigger: Pattern-based detection
Type: Composite signature
- ATrigger: Policy-based detection
118What are two drawbacks to using HIPS? (Choose two.)
- AWith HIPS, the success or failure of an attack cannot be readily determined
- BWith HIPS, the network administrator must verify support for all the different operating systems used in the network
- CHIPS has difficulty constructing an accurate network picture or coordinating events that occur across the entire network.
- DIf the network traffic stream is encrypted, HIPS is unable to access unencrypted forms of the traffic
- EHIPS installations are vulnerable to fragmentation attacks or variable TTL attacks
Informationen
- Beschreibung
- Quiz am cisco1, erstellt von kevin martinez am 15/04/2018.
- Autor
- kevin martinez
- Sprache
- Español
- Aufrufe
- 1
- Bewertung
- Noch keine Bewertungen Bewerte dieses Quiz