Quiz
Security
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (151)
1Which statement about communication over failover interfaces is true?
- AAll information that is sent over the failover interface is sent as clear text, but the stateful failover link is encrypted by default.
- BAll information that is sent over the failover and stateful failover interfaces is encrypted by default.
- CAll information that is sent over the failover and stateful failover interfaces is sent as clear text by default.
- DUsernames, password and preshared keys are encrypted by default when they are sent over the failover and stateful failover interfaces, but other information is sent as clear text.
2Which three ESP fields can be encrypted during transmission?
- ASecurity Parameter Index
- BSequence Number
- CMAC Address
- DPadding
- EPad Length
- FNext Header
3According to Cisco best practices, which three protocols should the default ACL allow an access port to enable wired BYOD devices to supply valid credentials and connect to the network?
- ABOOTP
- BTFTP
- CDNS
- DMAB
- EHTTP
- F802.1x
4Which SOURCEFIRE logging action should you choose to record the most detail about a connection.
- AEnable logging at the beginning of the session
- BEnable logging at the end of the session
- CEnable alerts via SNMP to log events off-box
- DEnable eStreamer to log events off-box
5What type of algorithm uses the same key to encryp and decrypt data?
- Aa symmetric algorithm
- Ban asymetric algorithm
- Ca Public Key infrastructure algorithm
- Dan IP Security algorithm
6If a packet matches more than one class map in an individual feature type's policy map, how does the ASA handle the packet?
- AThe ASA will apply the actions from only the most specific matching class map it finds for the feature type.
- BThe ASA will apply the actions from all matching class maps it finds for the feature type.
- CThe ASA will apply the actions from only the last matching class map it finds for the feature type.
- DThe ASA will apply the actions from only the first matching class map it finds for the feature type.
7You have implemented a Sourcefire IPS and configured it to block certain addresses utilizing Security Intelligence IP address Reputation. A user calls and is not able to access a certain IP address. What action can you take to allow the user access to the IP address?
- ACreate a custom blacklist to allow traffic.
- BCreate a whitelist and add the appropriate IP address to allow traffic.
- CCreate a user based access control rule to allo the traffic.
- DCreate a network based access control rule to allow the traffic.
- ECreate a rule to bypass inspection to allow the traffic.
8Which EAP method uses protected Access Credentials?
- AEAP-TLS
- BEAP-PEAP
- CEAP-FAST
- DEAP-GTC
9In which two situations should you use out-of-band management?
- Awhen a network device fails to forward packets
- Bwhen management applications need concurrent access to the device
- Cwhen you require ROMMON access
- Dwhen you require administrator's access from multiple locations
- Ewhen the control plane fails to respond
10What features can protect the data plane? (Choose three.)
- Apolicing
- BACLs
- CIPS
- Dantispoofing
- EQoS
- FDHCP-snooping
11How many crypto map sets can you apply to a router interface?
- A3
- B2
- C4
- D1
12What is the transition order of STP states on a Layer 2 switch interface?
- Alistening, learning, blocking, forwarding, disabled
- Blistening, blocking, learning, forwarding, disabled
- Cblocking, listening, learning, forwarding, disabled
- Dforwarding, listening, learning, blocking, disabled
13Which sensor mode can deny attackers inline?
- AIPS
- Bfail-close
- CIDS
- Dfail-open
14Which options are filtering options used to display SDEE message types?
- Astop
- Bnone
- Cerror
- Dall
15When a company puts a security policy in place, what is the effect on the company's business?
- AMinimizing risk
- BMinimizing total cost of ownership
- CMinimizing liability
- DMaximizing compliance
16Which wildcard mask is associated with a subnet mask of /27?
- A0.0.0.31
- B0.0.0.27
- C0.0.0.224
- D0.0.0.255
17Which statements about reflexive access lists are true?
- AReflexive access lists create a permanent ACE
- BReflexive access lists approximate session filtering using the established keyword
- CReflexive access lists can be attached to standard named IP ACLs
- DReflexive access lists support UDP sessions
- EReflexive access lists can be attached to extended named IP ACLs
- FReflexive access lists support TCP sessions
18Which actions can a promiscuous IPS take to mitigate an attack?
- Amodifying packets
- Brequesting connection blocking
- Cdenying packets
- Dresetting the TCP connection
- Erequesting host blocking
- Fdenying frames
19Which Cisco Security Manager application collects information about device status and uses it to generate notifications and alerts?
- AFlexConfig
- BDevice Manager
- CReport Manager
- DHealth and Performance Monitor
20Which command is needed to enable SSH support on a Cisco Router?
- Acrypto key lock rsa
- Bcrypto key generate rsa
- Ccrypto key zeroize rsa
- Dcrypto key unlock rsa
21In which three ways does the TACACS protocol differ from RADIUS?
- ATACACS uses TCP to communicate with the NAS
- BTACACS can encrypt the entire packet that is sent to the NAS
- CTACACS authenticates and authorizes simultaneously, causing fewer packets to be transmitted
- DTACACS uses UDP to communicate with the NAS
- ETACACS encrypts only the password field in an authentication packet
- FTACACS support per-command authorization
22What is the purpose of the Integrity component of the CIA triad?
- Ato ensure that only authorized parties can modify data
- Bto determine whether data is relevant
- Cto create a process for accessing data
- Dto ensure that only authorized parties can view data
23Which two statements about Telnet access to the ASA are true?
- AYou may VPN to the lowest security interface to telnet to an inside interface.
- BYou must configure an AAA server to enable Telnet.
- CYou can access all interfaces on an ASA using Telnet.
- DYou must use the command virtual telnet to enable Telnet.
- EBest practice is to disable Telnet and use SSH.
24Which protocol provides security to Secure Copy?
- AIPsec
- BSSH
- CHTTPS
- DESP
25A clientless SSL VPN user who is connecting on a Windows Vista computer is missing the menu option for Remote Desktop Protocol on the portal web page. Which action should you take to begin troubleshooting?
- AEnsure that the RDP2 plug-in is installed on the VPN gateway
- BReboot the VPN gateway
- CInstruct the user to reconnect to the VPN gateway
- DEnsure that the RDP plug-in is installed on the VPN gateway
26Which security zone is automatically defined by the system?
- AThe source zone
- BThe self zone
- CThe destination zone
- DThe inside zone
27What are purposes of the Internet Key Exchange in an IPsec VPN? (Choose two.)
- AThe Internet Key Exchange protocol establishes security associations
- BThe Internet Key Exchange protocol provides data confidentiality
- CThe Internet Key Exchange protocol provides replay detection
- DThe Internet Key Exchange protocol is responsible for mutual authentication
28Which address block is reserved for locally assigned unique local addresses?
- A2002::/16
- BFD00::/8
- C2001::/32
- DFB00::/8
29What is a possible reason for the error message? Router(config)#aaa server?
% Unrecognized command- AThe command syntax requires a space after the word "server"
- BThe command is invalid on the target device
- CThe router is already running the latest operating system
- DThe router is a new device on which the aaa new-model command must be applied before continuing
30Which statements about smart tunnels on a Cisco firewall are true? (Choose two.)
- ASmart tunnels can be used by clients that do not have administrator privileges
- BSmart tunnels support all operating systems
- CSmart tunnels offer better performance than port forwarding
- DSmart tunnels require the client to have the application installed locally
31Which option describes information that must be considered when you apply an access list to a physical interface?
- AProtocol used for filtering
- BDirection of the access class
- CDirection of the access group
- DDirection of the access list
32Which source port does IKE use when NAT has been detected between two VPN gateways?
- ATCP 4500
- BTCP 500
- CUDP 4500
- DUDP 500
33Which of the following are features of IPsec transport mode? (Choose three.)
- AIPsec transport mode is used between end stations
- BIPsec transport mode is used between gateways
- CIPsec transport mode supports multicast
- DIPsec transport mode supports unicast
- EIPsec transport mode encrypts only the payload
- FIPsec transport mode encrypts the entire packet
34Which command causes a Layer 2 switch interface to operate as a Layer 3 interface?
- Ano switchport nonnegotiate
- Bswitchport
- Cno switchport mode dynamic auto
- Dno switchport
35Which command verifies phase 1 of an IPsec VPN on a Cisco router?
- Ashow crypto map
- Bshow crypto ipsec sa
- Cshow crypto isakmp sa
- Dshow crypto engine connection active
36What is the purpose of a honeypot IPS?
- ATo create customized policies
- BTo detect unknown attacks
- CTo normalize streams
- DTo collect information about attacks
37Which type of firewall can act on the behalf of the end device?
- AStateful packet
- BApplication
- CPacket
- DProxy
38What type of attack was the Stuxnet virus?
- Acyber warfare
- Bhactivism
- Cbotnet
- Dsocial engineering
39Which type of secure connectivity does an extranet provide?
- Aremote branch offices to your company network
- Byour company network to the Internet
- Cnew networks to your company network
- Dother company networks to your company network
40After reloading a router, you issue the dir command to verify the installation and observe that the image file appears to be missing. For what reason could the image file fail to appear in the dir output?
- AThe secure boot-image command is configured.
- BThe secure boot-comfit command is configured.
- CThe confreg 0x24 command is configured.
- DThe reload command was issued from ROMMON.
41What is a reason for an organization to deploy a personal firewall?
- ATo protect endpoints such as desktops from malicious activity
- BTo protect one virtual network segment from another
- CTo determine whether a host meets minimum security posture requirements
- DTo create a separate, non-persistent virtual environment that can be destroyed after a session
- ETo protect the network from DoS and syn-flood attacks
42Which FirePOWER preprocessor engine is used to prevent SYN attacks?
- ARate-Based Prevention
- BPortscan Detection
- CIP Defragmentation
- DInline Normalization
43What VPN feature allows traffic to exit the security appliance through the same interface it entered?
- AHairpinning
- BNAT
- CNAT traversal
- Dsplit tunneling
44When an IPS detects an attack, which action can the IPS take to prevent the attack from spreading?
- APerform a Layer 6 reset
- BDeploy an antimalware system
- CEnable bypass mode
- DDeny the connection inline
45Which statement about Cisco ACS authentication and authorization is true?
- AACS servers can be clustered to provide scalability
- BACS can query multiple Active Directory domains
- CACS uses TACACS to proxy other authentication servers
- DACS can use only one authorization profile to allo or deny requests
46What is the only permitted operation for processing multicast traffic on zone-based firewalls?
- AStateful inspection of multicast traffic is supported only for the self zone
- BStateful inspection for multicast traffic is supported only between the self-zone and the internal zone
- COnly control plane policing can protect the control plane against multicast traffic
- DStateful inspection of multicast traffic is supported only for the internal zone
47What is one requirement for locking a wired or wireless device from ISE?
- AThe ISE agent must be installed on the device
- BThe device must be connnected to the network when the lock command is executed
- CThe user must approve the locking action
- DThe organization must implement an acceptable use policy allowing device locking
48What are two default Cisco IOS privilege levels?
- A0
- B5
- C1
- D7
- E10
- F15
49Which tool can an attacker use to attempt a DDos attack?
- Abotnet
- BTrojan horse
- Cvirus
- Dadware
50How does the Cisco ASA use Active Directory to authorize VPN users?
- AIt queries the Active Directory server for a Specfic attribute for the specific user
- BIt sends the username and password to retire an ACCEPT or Reject message from the Active Directory server
- CIt downloads and stores the Active Directory database to query for future authorization
- DIt redirects requests to the Active Directory server defined for the VPN group
51Which statement about application blocking is true?
- AIt blocks access to files with specific extensions
- BIt blocks access to specific network addresses
- CIt blocks access to specific programs
- DIt blocks access to specific network services.
52For what reason would you configure multiple security contexts on the ASA firewall?
- ATo enable the use of VFRs on routers that are adjacently connected
- BTo provide redundancy and high availability within the organization
- CTo enable the use of multicast routing and QoS through the firewall
- DTo seperate different departments and business units
53What VPN feature allows Internet traffic and local LAN/WAN traffic to use the same network connection.
- Asplit tunneling
- Bhairpinning
- Ctunnel mode
- Dtransparent mode
54When is the best time to perform an anti-virus signature update?
- AWhen the local scanner has detected a new virus
- BWhen a new virus is discovered in the wild
- CEvery time a new update is available
- DWhen the system detects a browser hook
55What is the effect of the send-lifetime local 23:59:00 31 December 31 2013 infinite command?
- AIt configures the device to begin transmitting the authentication key to other devices at 00:00:00 local time on January 1, 2014 and continue using the key indefinitely.
- BIt configures the device to begin transmitting the authentication key to other devices at 23:59:00 local time on December 31, 2013 and continue using the key indefinitely.
- CIt configures the device to begin accepting the authentication key from other devices immediately and stop accepting the key at 23:59:00 local time on December 31, 2013.
- DIt configures the device to generate a new authentication key and transmit it to other devices at 23:59 00 local time on December 31, 2013.
- EIt configures the device to begin accepting the authentication key from other devices at 23:59:00 local time on December 31, 2013 and continue accepting the key indefinitely.
- FIt configures the device to begin accepting the authentication key from other devices at 00:00:00 local time on January 1, 2014 and continue accepting the key indefinitely.
56Which Statement about personal firewalls is true?
- AThey are resilient against kernal attacks
- BThey can protect email messages and private documents in a similar way to a VPN
- CThey can protect the network against attacks
- DThey can protect a system by denying probing requests
57Which statement about a PVLAN isolated port configured on a switch is true?
- AThe isolated port can communicate only with the promiscous port
- BThe isolated port can communicate with other isolated ports and the promiscuous port
- CThe isolated port can communicate only with community ports
- DThe isolated port can communicate only with other isolated ports
58Which three statements about host-based IPS are true?
- AIt can view encrypted files
- BIt can be deployed at the perimeter
- CIt uses signature-based policies
- DIt can have more restrictive policies than network-based IPS
- EIt works with deployed firewalls
- FIt can generate alerts based on behavior at the desktop level
59What type of security support is provided by the Open Web Application Security Project?
- AEducation about common Web site vulnerabilities
- BA wb site security framework
- CA security discussion forum for Web site developers
- DScoring of common vulnerabilities and exposures
60In what type of attack does an attacker virtually change a devices burned in address in an attempt to circumvent access lists and mask the device's true identity?
- Agratuitous ARP
- BARP poisoning
- CIP Spoofing
- DMAC Spoofing
61How does a zone-based firewall implementation handle traffic between Interfaces in the same Zone?
- Atraffic between interfaces in the same zone is blocked unless yoc configure the same-security permit command
- BTraffic between interfaces in the same zone is always blocked
- CTraffic between two interfaces in the same zone is allowed by default
- DTraffic between interfaces in the same zone is blocked unless you apply a service policy to the zone pair
62An attacker installs a rogue switch that sends superior BPDUs on your network. What is a possible result of this activity?
- AThe switch could offer fake DHCP addresses.
- BThe switch could become the root bridge.
- CThe switch could be allowed to join the VTP domain.
- DThe switch could become a transparent bridge.
63Which two next generation encrytption algorithms does Cisco recommend?
- AAES
- B3DES
- CDES
- DMD5
- EDH-1024
- FSHA-384
64What three actions are limitations when running IPS in promiscous mode?
- Adeny attacker
- Brequest block connection
- Cdeny packet
- Dmodify packet
- Erequest block host
- Freset TCP connection
65Which two features do CoPP and CPPr use to protect the control plane?
- AQoS
- Btraffic classification
- Caccess lists
- Dpolicy maps
- Eclass maps
- FCisco Express Forwarding
66What is an advantage of implementing a Trusted Platform Module for disk encryption?
- AIt provides hardware authentication
- BIt allows the hard disk to be transferred to another device without requiring re-encryption.dis
- Cit supports a more complex encryption algorithm than other disk-encryption technologies
- Dit can protect against single poins of failure
67A specific URL has been identified as containing malware. What action can you take to block users from accidentaly visiting the URL and becoming infected with malware?
- AEnable URL filtering on the perimeter firewall and add the URLs you want to allow to the routers local URL list.
- BEnable URL filtering on the perimeter router and add the URLs you want to allow to the firewalls local URL list.
- CCreate a blacklist that contains the URL you want to block and activate the blacklist on the perimeter router.
- DEnable URL filtering on the perimeter router and add the URLs you want to block to the routers local URL list.
- ECreate a whitelist that contains the URls you want to allow and activate the whitelist on the perimeter router.
68If you change the native VLAN on the port to an unused VLAN, what happens if an attacker attempts a double tagging attack?
- AThe trunk port would go into an error-disable state
- BA VLAN hopping attack would be successful
- CA VLAN hopping attack would be prevented
- Dthe attacked VLAN will be pruned
69What is an advantage of placing an IPS on the inside of a network?
- AIt can provide higher throughput.
- BIt receives traffic that has already been filtered.
- CIt receives every inbound packet.
- DIt can provide greater security.
70Which three statements about host-based IPS are true?
- AIt can view encrypted files.
- BIt can have more restrictive policies than network-based IPS.
- CIt can generate alerts based on behavior at the desktop level.
- DIt can be deployed at the perimeter.
- EIt uses signature-based policies.
- FIt works with deployed firewalls.
71Which syslog severity level is level number 7?
- AWarning
- BInformational
- CNotification
- DDebugging
72Which type of mirroring does SPAN technology perform?
- ARemote mirroring over Layer 2
- BRemote mirroring over Layer 3
- CLocal mirroring over Layer 2
- DLocal mirroring over Layer 3
73Which tasks is the session management path responsible for?
- AVerifying IP checksums
- BPerforming route lookup
- CPerforming session lookup
- DAllocating NAT translations
- EChecking TCP sequence numbers
- FChecking packets against the access list
74Which network device does NTP authenticate?
- AOnly the time source
- BOnly the client device
- CThe firewall and the client device
- DThe client device and the time source
75What hash type does Cisco use to validate the integrity of downloaded images?
- ASha1
- BSha2
- CMd5
- DMd1
76Which option is the most effective placement of an IPS device within the infrastructure?
- AInline, behind the internet router and firewall
- BInline, before the internet router and firewall
- CPromiscuously, after the Internet router and before the firewall
- DPromiscuously, before the Internet router and the firewall
77If a router configuration includes the line aaa authentication login default group tacacs+ enable, which events will occur when the TACACS+ server returns an error? (Choose two.)
- AThe user will be prompted to authenticate using the enable password
- BAuthentication attempts to the router will be denied
- CAuthentication will use the router`s local database
- DAuthentication attempts will be sent to the TACACS+ server
78Which alert protocol is used with Cisco IPS Manager Express to support up to 10 sensors?
- ASDEE
- BSyslog
- CSNMP
- DCSM
79Which type of address translation should be used when a Cisco ASA is in transparent mode?
- AStatic NAT
- BDynamic NAT
- COverload
- DDynamic PAT
80Which components does HMAC use to determine the authenticity and integrity of a message?
- AThe password
- BThe hash
- CThe key
- DThe transform set
81What is the default timeout interval during which a router waits for responses from a TACACS server before declaring a timeout failure?
- A5 seconds
- B10 seconds
- C15 seconds
- D20 seconds
82Which RADIUS server authentication protocols are supported on Cisco ASA firewalls? (Choose three.)
- AEAP
- BASCII
- CPAP
- DPEAP
- EMS-CHAPv1
- FMS-CHAPv2
83Which command initializes a lawful intercept view?
- Ausername cisco1 view lawful-intercept password cisco
- Bparser view cisco li-view
- Cli-view cisco user cisco1 password cisco
- Dparser view li-view inclusive
84Which security measures can protect the control plane of a Cisco router? (Choose two.)
- ACCPr
- BParser views
- CAccess control lists
- DPort security
- ECoPP
85Which statement about extended access lists is true?
- AExtended access lists perform filtering that is based on source and destination and are most effective when applied to the destination
- BExtended access lists perform filtering that is based on source and destination and are most effective when applied to the source
- CExtended access lists perform filtering that is based on destination and are most effective when applied to the source
- DExtended access lists perform filtering that is based on source and are most effective when applied to the destination
86Which protocols use encryption to protect the confidentiality of data transmitted between two parties? (Choose two.)
- AFTP
- BSSH
- CTelnet
- DAAA
- EHTTPS
- FHTTP
87What are the primary attack methods of VLAN hopping? (Choose two.)
- AVoIP hopping
- BSwitch spoofing
- CCAM-table overflow
- DDouble tagging
88How can the administrator enable permanent client installation in a Cisco AnyConnect VPN firewall configuration?
- AIssue the command anyconnect keep-installer under the group policy or username webvpn mode
- BIssue the command anyconnect keep-installer installed in the global configuration
- CIssue the command anyconnect keep-installer installed under the group policy or username webvpn mode
- DIssue the command anyconnect keep-installer installer under the group policy or username webvpn mode
89What type of security support is provided by the Open Web Application Security Project?
- AEducation about common Web site vulnerabilities.
- BA Web site security framework.
- CA security discussion forum for Web site developers.
- DScoring of common vulnerabilities and exposures.
90What is the FirePOWER impact flag used for?
- AA value that indicates the potential severity of an attack.
- BA value that the administrator assigns to each signature.
- CA value that sets the priority of a signature.
- DA value that measures the application awareness.
91Which two services define cloud networks?
- AInfrastructure as a Service
- BPlatform as a Service
- CCompute as a Service
- DSecurity as a Service
- ETenancy as a Service
92In a security context, which action can you take to address compliance?
- AImplement rules to prevent a vulnerability
- BCorrect or counteract a vulnerability
- CReduce the severity of a vulnerability
- DFollow directions from the security appliance manufacturer to remediate a vulnerability
93What can the SMTP preprocessor in a FirePOWER normalize?
- AIt can extract and decode email attachments in client to server traffic
- BIt can look up the email sender
- Cit compares known threats to the email sender
- DIt can forward the SMTP traffic to an email filter server
- EIt uses the Traffic Anomaly Detector
94You want to allow all of your companies users to access the Internet without allowing other Web servers to collect the IP addresses of individual users. What two solutions can you use? (Choose two).
- AConfigure a proxy server to hide users local IP addresses
- BAssign unique IP addresses to all users.
- CAssign the same IP addresses to all users
- DInstall a Web content filter to hide users local IP addresses
- EConfigure a firewall to use Port Address Translation
95Which two authentication types does OSPF support?
- Aplaintext
- BMD5
- CHMAC
- DAES 256
- ESHA-1
- FDES
96What command can you use to verify the binding table status?
- AShow ip dhcp snooping binding
- BShow ip dhcp snooping database
- Cshow ip dhcp snooping statistics
- Dshow ip dhcp pool
- Eshow ip dhcp source binding
- Fshow ip dhcp snooping
97If a switch receives a superior BPDU and goes directly into a blocked state, what mecanism must be in use?
- AEtherchannel guard
- Broot guard
- Cloop guard
- DBPDU guard
98What type of packet creates and performs network operations on a network device?
- Adata plane packets
- Bmanagement plane packets
- Cservices plane packets
- Dcontrol plane packets
99Which two statements about stateless firewalls are true?
- AThey compare the 5-tuple of each incoming packet against configurable rules.
- BThey cannot track connections.
- CThey are designed to work most efficiently with stateless protocols such as HTTP or HTTPS.
- DCisco IOS cannot implement them because the platform is stateful by nature.
- EThe Cisco ASA is implicitly stateless because it blocks all traffic by default.
100What three actions are limitations when running IPS in promiscuous mode?
- Adeny attacker
- Bdeny packet
- Cmodify packet
- Drequest block connection
- Erequest block host
- Freset TCP connection
101Which command will configure a Cisco ASA firewall to authenticate users when they enter the enable syntax using the local database with no fallback method?
- Aaaa authentication enable console LOCAL SERVER_GROUP
- Baaa authentication enable console SERVER_GROUP LOCAL
- Caaa authentication enable console local
- Daaa authentication enable console LOCAL
102Which accounting notices are used to send a failed authentication attempt record to a AAA server? (Choose two.)
- Astart-stop
- Bstop-record
- Cstop-only
- Dstop
103If the native VLAN on a trunk is different on each end of the link, what is a potential consequence?
- AThe interface on both switches may shut down
- BSTP loops may occur
- CThe switch with the higher native VLAN may shut down
- DThe interface with the lower native VLAN may shut down
104Which type of IPS can identify worms that are propagating in a network?
- APolicy-based IPS
- BAnomaly-based IPS
- CReputation-based IPS
- DSignature-based IPS
105By which kind of threat is the victim tricked into entering username and password information at a disguised website?
- ASpoofing
- BMalware
- CSpam
- DPhishing
106Which Cisco product can help mitigate web-based attacks within a network?
- AAdaptive Security Appliance
- BWeb Security Appliance
- CEmail Security Appliance
- DIdentity Services Engine
107Which statement correctly describes the function of a private VLAN?
- AA private VLAN partitions the Layer 2 broadcast domain of a VLAN into subdomains
- BA private VLAN partitions the Layer 3 broadcast domain of a VLAN into subdomains
- CA private VLAN enables the creation of multiple VLANs using one broadcast domain
- DA private VLAN combines the Layer 2 broadcast domains of many VLANs into one major broadcast domain
108Which Cisco feature can help mitigate spoofing attacks by verifying symmetry of the traffic path?
- AUnidirectional Link Detection
- BUnicast Reverse Path Forwarding
- CTrustSec
- DIP Source Guard
109What is the most common Cisco Discovery Protocol version 1 attack?
- ADenial of Service
- BMAC-address spoofing
- CCAM-table overflow
- DVLAN hopping
110What is the Cisco preferred countermeasure to mitigate CAM overflows?
- APort security
- BDynamic port security
- CIP source guard
- DRoot guard
111When a switch has multiple links connected to a downstream switch, what is the first step that STP takes to prevent loops?
- ASTP elects the root bridge
- BSTP selects the root port
- CSTP selects the designated port
- DSTP blocks one of the ports
112Which countermeasures can mitigate ARP spoofing attacks? (Choose two.)
- APort security
- BDHCP snooping
- CIP source guard
- DDynamic ARP inspection
113Which of the following statements about access lists are true? (Choose three.)
- AExtended access lists should be placed as near as possible to the destination
- BExtended access lists should be placed as near as possible to the source
- CStandard access lists should be placed as near as possible to the destination
- DStandard access lists should be placed as near as possible to the source
- EStandard access lists filter on the source address
- FStandard access lists filter on the destination address
114In which stage of an attack does the attacker discover devices on a target network?
- AReconnaissance
- BCovering tracks
- CGaining access
- DMaintaining access
115Which type of security control is defense in depth?
- AThreat mitigation
- BRisk analysis
- CBotnet mitigation
- DOvert and covert channels
116On which Cisco Configuration Professional screen do you enable AAA?
- AAAA Summary
- BAAA Servers and Groups
- CAuthentication Policies
- DAuthorization Policies
117Which three statements about Cisco host-based IPS solution are true?
- AIt work with deployed firewalls
- BIt can be deployed at the perimeter
- CIt uses signature-based policies
- DIt can have more restrictive policies than network-based IPS
- EIt can generate alerts based on behavior at the desktop level
- FIt can view encrypted files
118What are two users of SIEM software?
- Aperforming automatic network audits
- Bconfiguring firewall and IDS devices
- Calerting administrators to security events in real time
- Dscanning emails for suspicious attachments
- Ecollecting and archiving syslog data
119If a packet matches more than one class map in an individual feature type's policy map, how does the ASA handle the packet?
- Athe ASA will apply the actions from only the last matching class maps it finds for the feature type.
- Bthe ASA will apply the actions from all matching class maps it finds for the feature type.
- Cthe ASA will apply the actions from only the most specific matching class map it finds for the feature type.
- Dthe ASA will apply the actions from only the first matching class maps it finds for the feature type.
120What statement provides the best definition of malware?
- AMalware is tools and applications that remove unwanted programs.
- BMalware is a software used by nation states to commit cyber-crimes.
- CMalware is unwanted software that is harmful or destructive.
- DMalware is a collection of worms, viruses and Trojan horses that is distributed as a single package.
121What command can you use to verify the binding table status?
- Ashow ip dhcp snooping statistics
- Bshow ip dhcp snooping database
- Cshow ip dhcp snooping binding
- Dshow ip dhcp pool
- Eshow ip dhcp snooping
- Fshow ip dhcp source binding
122Which FirePOWER preprocessor engine is used to prevent SYN attacks?
- AAnomaly.
- BRate-Based Prevention
- CPortscan Detection
- DInline Normalization
123What is the only permitted operation for processing multicast traffic on zone-based firewalls?
- AStateful inspection of multicast traffic is supported only for the self-zone.
- BStateful inspection of multicast traffic is supported only between the self-zone and the internal zone.
- COnly control plane policing can protect the control plane against multicast traffic.
- DStateful inspection of multicast traffic is supported only for the internal zone.
124Which of encryption technology has the broadcast platform support to protect operating systems?
- AMiddleware
- BHardware
- Csoftware
- Dfile-level
125Which feature of the Cisco Email Security Appliance can mitigate the impact of snowshoe spam and sophisticated phishing attack?
- Aholistic understanding of threats
- Bgraymail management and filtering
- Csignature-based IPS
- Dcontextual analysis
126Which Sourfire secure action should you choose if you want to block only malicious traffic from a particular end-user?
- ATrust
- BBlock
- CAllow without inspection
- DMonitor
- EAllow with inspection
127Which two next-generation encryption algorithms does Cisco recommends?
- ASHA-384
- BMD5
- CDH-1024
- DDES
- EAES
- F3DES
128When an administrator initiates a device wipe command from the ISE, what is the immediate effect?
- AIt requests the administrator to choose between erasing all device data or only managed corporate data.
- BIt requests the administrator to enter the device PIN or password before proceeding with the operation.
- CIt immediately erases all data on the device.
- DIt notifies the device user and proceeds with the erase operation.
129How does a device on a network using ISE receive its digital certificate during the new-device registration process?
- AISE acts as a SCEP proxy to enable the device to receive a certificate from a central CA server
- BThe device request a new certificate directly from a central CA
- CISE issues a pre-defined certificate from a local database
- DISE issues a certificate from its internal CA server
130How can you detect a false negative on an IPS?
- AView the alert on the IPS
- BUse a third-party to audit the next-generation firewall rules
- CReview the IPS console
- DReview the IPS log
- EUse a third-party system to perform penetration testing
131Which two statement about stateless firewalls is true?
- Athe Cisco ASA is implicitly stateless because it blocks all traffic by default.
- BThey compare the 5-tuple of each incoming packets against configurable rules.
- CThey cannot track connections.
- DThey are designed to work most efficiently with stateless protocols such as HTTP or HTTPS.
- ECisco IOS cannot implement them because the platform is Stateful by nature.
132Which three ESP fields can be encrypted during transmission?
- ANext Header
- BMAC Address
- CPadding
- DPad Length
- ESequence Number
- FSecurity Parameter Index
133Which type of PVLAN port allows host in the same VLAN to communicate directly with the other?
- Apromiscuous for hosts in the PVLAN
- Bspan for hosts in the PVLAN
- CCommunity for hosts in the PVLAN
- Disolated for hosts in the PVLAN
134Which type of secure connectivity does an extranet provide?
- ARemote branch offices to your company network
- BYour company network to the internet
- Cnew networks to your company network
- Dother company networks to your company network
135What is a valid implicit permit rule for traffic that is traversing the ASA firewall?
- AUnicast IPv6 traffic from a higher security interface to a lower security interface is permitted in transparent mode only.
- BOnly BPDUs from a higher security interface to a lower security interface are permitted in routed mode.
- CARPs in both directions are permitted in transparent mode only.
- DUnicast IPv4 traffic from a higher security interface to a lower security interface is permitted in routed mode only.
- EOnly BPDUs from a higher security interface to a lower security interface are permitted in transparent mode.
136You have been tasked with blocking user access to website that violate company policy, but the site use dynamic IP Addresses. What is the best practice URL filtering to solve the problem?
- AEnable URL filtering and create a blacklist to block the websites that violate company policy.
- BEnable URL filtering and create a whitelist to allow only the websites the company policy allow users to access.
- CEnable URL filtering and use URL categorization to allow only the websites the company policy allow users to access.
- DEnable URL filtering and create a whitelist to block the websites that violate company policy.
- EEnable URL filtering and use URL categorization to block the websites that violate company policy.
137What is the potential drawback to leaving VLAN 1 as the native VLAN?
- AGratuitous ARPs might be able to conduct a man-in-the-middle attack.
- BThe CAM might be overloaded, effectively turning the switch into hub.
- CVLAN 1 might be vulnerable to IP address spoofing.
- DIt may be susceptible to a VLAN hopping attack.
138Which IPS mode provides the maximum number of actions?
- AInline
- Bbypass
- Cspan
- Dfailover
- Epromiscuous
139In which three cases does the ASA firewall permit inbound HTTP GET requests during normal operations?
- AWhen matching ACL entries are configured
- Bwhen matching NAT entries are configured
- CWhen the firewall requires strict HTTP inspection
- DWhen the firewall requires HTTP inspection
- EWhen the firewall receives a SYN-ACK packet
- FWhen the firewall receives a SYN packet
140Which technology can be used to rate data fidelity and to provide an authenticated hash for data?
- ANetwork blocking
- Bsignature updates
- Cfile analysis
- Dfile reputation
141What configuration allows AnyConnect to authenticate automatically establish a VPN session when a user logs in to the computer?
- Aproxy
- BTrusted Network Detection
- Ctransparent mode
- Dalways-on
142Which three statements about Cisco host-based IPS solution are true?
- AIt work with deployed firewalls.
- BIt can be deployed at the perimeter
- CIt uses signature-based policies
- DIt can have more restrictive policies than network-based IPS
- EIt can generate alerts based on behavior at the desktop level
- FIt can view encrypted files
143What are two users of SIEM software?
- Aperforming automatic network audits
- Bconfiguring firewall and IDS devices
- Calerting administrators to security events in real time
- Dscanning emails for suspicious attachments
- Ecollecting and archiving syslog data
144If a packet matches more than one class map in an individual feature type's policy map, how does the ASA handle the packet?
- Athe ASA will apply the actions from only the last matching class maps it finds for the feature type.
- Bthe ASA will apply the actions from all matching class maps it finds for the feature type.
- Cthe ASA will apply the actions from only the most specific matching class map it finds for the feature type.
- Dthe ASA will apply the actions from only the first matching class maps it finds for the feature type
145What statement provides the best definition of malware?
- AMalware is tools and applications that remove unwanted programs.
- BMalware is a software used by nation states to commit cyber-crimes.
- CMalware is unwanted software that is harmful or destructive
- DMalware is a collection of worms, viruses and Trojan horses that is distributed as a single.....
146What command can you use to verify the binding table status?
- Ashow ip dhcp snooping statistics
- Bshow ip dhcp snooping database
- Cshow ip dhcp snooping binding
- Dshow ip dhcp pool
- Eshow ip dhcp snooping
- Fshow ip dhcp source binding
147Which FirePOWER preprocessor engine is used to prevent SYN attacks?
- AAnomaly.
- BRate-Based Prevention
- CPortscan Detection
- DInline Normalization
148What is the only permitted operation for processing multicast traffic on zone-based firewalls?
- AStateful inspection of multicast traffic is supported only for the self-zone.
- BStateful inspection of multicast traffic is supported only between the self-zone and the internal zone.
- COnly control plane policing can protect the control plane against multicast traffic.
- DStateful inspection of multicast traffic is supported only for the internal zone
149Which of encryption technology has the broadcast platform support to protect operating systems?
- AMiddleware
- BHardware
- CSoftware
- DFile-level
150Which feature of the Cisco Email Security Appliance can mitigate the impact of snowshoe spam and sophisticated phishing attack?
- Aholistic understanding of threats
- Bgraymail management and filtering
- Csignature-based IPS
- Dcontextual analysis
151Which Sourfire secure action should you choose if you want to block only malicious traffic from a particular end-user?
- ATrust
- BBlock
- CAllow without inspection
- DMonitor
- EAllow with inspection
Information
- Description
- Engineering Quiz on Security, created by Mr Mooo on 24/12/2016.
- Author
- Mr Mooo
- Language
- English
- Views
- 0
- History
- Created on 24 Dec 2016 · updated on 6 Apr 2018
- Tags
- Rating
- No ratings yet Rate this quiz