Security 100 - 150

1. 1Which of the following commands should you issue to allow a packet to exit an ASA through the same interface through which it entered the ASA? (Select the best answer.)

   1. Asamesecuritytraffic permit interinterface
   2. Bsamesecuritytraffic permit intrainterface
   3. Csecuritylevel 0
   4. Dsecuritylevel 100
   5. EEstabished
2. 2Which of the following devices requires that a physical interface be in promiscuous mode in order to monitor network traffic? (Select the best answer.)

   1. Aan IPS
   2. Ba firewall
   3. Ca router
   4. Dan IDS
   5. Ean ASA
3. 3Which of the following is typically implemented in a cluster configuration? (Select the best answer.)

   1. AACS
   2. BCSA
   3. CCTA
   4. DSSC
4. 4Which of the following traffic types are blocked by default in a zone-based policy firewall configuration? (Select 2 choices.)
   

   1. Atraffic to or from the self zone
   2. Btraffic between interfaces in the same zone
   3. Ctraffic between interfaces in a zone and interfaces not assigned to any zone
   4. Dtraffic between interfaces in different zones
   5. Etraffic directly to or received from the router
5. 5An inside host has initiated a TCP connection through a Cisco ASA to an outside server. The outside server has responded with a SYN/ACK segment? however, the inside host has not yet responded with an ACK segment.
   Which of the following lines of output from the show conn command best represents the state of the connection in this scenario? (Select the best answer.)
   

   1. ATCP outside 192.0.2.51:22 inside 10.1.1.18:12113 idle 0:00:00, bytes 0, flags SaAB
   2. BTCP outside 192.0.2.51:22 inside 10.1.1.18:12113 idle 0:00:00, bytes 0, flags saA
   3. CTCP outside 192.0.2.51:22 inside 10.1.1.18:12113 idle 0:00:00, bytes 0, flags aB
   4. DTCP outside 192.0.2.51:22 inside 10.1.1.18:12113 idle 0:00:00, bytes 0, flags A
   5. ETCP outside 192.0.2.51:22 inside 10.1.1.18:12113 idle 0:00:00, bytes 0, flags U
   6. FTCP outside 192.0.2.51:22 inside 10.1.1.18:12113 idle 0:00:00, bytes 0, flags UIO
6. 6Which of the following is an IOS privilege level that provides the highest level of access on a Cisco router? (Select the best answer.)

   1. A0
   2. B1
   3. C15
   4. D16
7. 7Which of the following statements is true regarding LDAP attribute maps on an ASA? (Select the best answer.)

   1. AThere is a defined limit on the number of LDAP attribute maps you can configure.
   2. BThere is a defined limit on the number of attributes that can be mapped in each LDAP attribute map.
   3. CThere is a defined limit on the number of LDAP servers to which an LDAP attribute map can be applied.
   4. DThere is a defined limit on the number of AD multivalued attributes matched by an LDAP attribute map.
8. 8Which of the following can be determined from the Route Details tab of the VPN Client Statistics dialog box shown above? (Select the best answer.)
   

   

   1. AThe VPN client cannot access devices on the local LAN.
   2. BThe VPN client is configured to use split tunneling.
   3. CThe VPN client is configured to use transparent tunneling.
   4. DThe VPN client cannot access devices on the 172.16.20.0/24 network.
9. 9Which of the following IPS detection methods is a string pattern-based detection method? (Select the best answer.)

   1. Aanomalybased detection
   2. Bprofilebased detection
   3. Csignaturebased detection
   4. Dpolicybased detection
10. 10You have been asked to add a key to an existing keychain. You issue the following commands to enter key chain key configuration mode:
    RouterA(config)#key chain chain1
    RouterA(configkeychain)#key 2
    RouterA(configkeychainkey)#keystring key2
    The new key should be valid for three hours, and the router should begin sending the key at 9 a.m. on January 13, 2015.
    Which of the following commands should you issue next to achieve your goal? (Select the best answer.)
    

    1. Aaccep-tlifetime 09:00:00 Jan 13 2015 duration 3
    2. Baccep-tlifetime 09:00:00 Jan 13 2015 duration 180
    3. Csend-lifetime 09:00:00 Jan 13 2015 duration 1800
    4. Dsend-lifetime 09:00:00 Jan 13 2015 duration 10800

11. 11Which of the following can be mitigated by installing a personal firewall on a laptop? (Select the best answer.)

    1. Aa SYN flood attack
    2. Ba crosssite scripting attack
    3. Ca portscanning attack
    4. Da session hijacking attack
12. 12When a switch is configured with private VLANs, which of the following ports can an isolated port communicate with? (Select the best answer.)
    

    1. Aports within the same community
    2. Bports within a different community
    3. Cother isolated ports
    4. Dpromiscuous ports
13. 13Which of the following statements is not true regarding the IaaS service model? (Select the best answer.)

    1. AThe consumer has control over the configuration of the OS running on the physical infrastructure in the cloud
    2. BThe consumer has control over the physical infrastructure in the cloud.
    3. CThe consumer has control over the allocation of processing, memory, storage, and network resources within the cloud.
    4. DThe consumer has control over development tools or APIs in the cloud running on the physical infrastructure in the cloud.
14. 14Which of the following emailrelated FirePOWER preprocessors can extract and decode attachments in clienttoserver traffic? (Select the best answer.)

    1. Aonly the IMAP preprocessor
    2. Bonly the POP3 preprocessor
    3. Conly the SMTP preprocessor
    4. Donly the POP3 and SMTP preprocessors
    5. Eonly the IMAP and SMTP preprocessors
    6. Fthe IMAP, POP3, and SMTP preprocessors
15. 15Which of the following authentication methods is not used with OSPFv3? (Select the best answer.)

    1. APlaintext
    2. BMD5
    3. CSHA1
    4. DIPv6 IPSec
16. 16You have configured a Cisco Catalyst switch to store its binding table on a local TFTP server.
    Which of the following commands can you issue to verify the URL that the agent will use to store the binding table on the TFTP server? (Select the best answer.)
    

    1. Ashow ip dhcp snooping
    2. Bshow ip dhcp snooping database
    3. Cshow ip dhcp snooping blinding
    4. Dshow ip dhcp snooping statistics
17. 17You have configured a CoPP policy to mitigate the effects of DoS attacks on the router.
    Which of the following packet types does the CoPP policy affect? (Select the best answer.)
    

    1. Apackets originating from the control plane
    2. Bpackets destined to the control plane
    3. Cpackets originating from the data plane
    4. Dpackets destined to the data plane
18. 18Which of the following is the most likely reason for an organization to implement an extranet? (Select the best answer.)

    1. Ato provide customers with largescale computer services
    2. Bto provide internal departments with independent security policies
    3. Cto provide internal users with a customized website
    4. Dto provide customers with access to the company’s internal network
19. 19Which of the following is the default connection profile that is applied to clientless SSL VPN connections? (Select the best answer.)

    1. ADefaultRAGroup
    2. BDefaultWEBVPNGroup
    3. CDefaultSSLVPNGroup
    4. DDefaultL2LGroup
20. 20You are configuring a connection profile for Cisco AnyConnect SSL VPN users. You have accessed the Add SSL VPN Connection Profile dialog box in ASDM. You want to configure a group URL for the connection profile.
    On which of the following screens of this dialog box will you be able to accomplish your goal? (Select the best answer.)
    

    1. Athe Basic screen
    2. Bthe General screen
    3. Cthe Authorization screen
    4. Dthe SSL VPN screen
21. 21You are configuring a connection profile for clientless SSL VPN connections. You have accessed the Add Clientless SSL VPN Connection Profile dialog box in ASDM.
    Which of the following authentication methods can you configure in this dialog box? (Select the best answer.)
    

    1. Aonly AAA
    2. Bonly OTP
    3. Conly digital certificates
    4. Dboth AAA and OTP
    5. Eboth AAA and digital certificates
22. 22Which of the following can you mitigate by implementing DAI? (Select the best answer.)

    1. AARP poisoning attacks
    2. BMAC poisoning attacks
    3. CMAC flooding attacks
    4. DVLAN hopping attacks
23. 23You have configured a lawful intercept view, five CLI views, and two superviews on a Cisco router. How many additional CLI views can you create? (Select the best answer.)

    1. Aone
    2. Btwo
    3. Csix
    4. Dseven
24. 24Which of the following statements is true regarding the aaa new-modelcommand? (Select the best answer.)

    1. AThe aaa new-model command must be issued prior to enabling AAA accounting on a router.
    2. BThe aaa new-model command must be issued after enabling AAA authentication on a router.
    3. CThe aaa new-model command configures AAA to work only with RADIUS servers.
    4. DThe aaa new-model command configures AAA to work only with TACACS+ servers.
    5. EThe aaa new-model command has been deprecated in Cisco IOS versions 12.3 and later.
25. 25Which of the following signature microengines typically has the greatest effect on Cisco IOS IPS performance? (Select the best answer.)

    1. Aatomic-c
    2. Bnormalizer
    3. Cservice-http
    4. Dservice-smb-advance
    5. Estring-tcp
26. 26You have configured the password management feature for a tunnel group on an ASA. The ASA is using a Cisco Secure ACS RADIUS server for AAA authentication.
    Which of the following actions will occur after a remote user with an expired password attempts to establish a VPN connection? (Select the best answer.)
    

    1. AThe AnyConnect client will display an authentication failed dialog box and will not permit the user to establish the VPN connection until an admin unlocks the user’s account.
    2. BThe AnyConnect client will display a dialog box that prompts the user for a new password.
    3. CThe AnyConnect client will display a dialog box that prompts the user for both their old password and a new password.
    4. DThe AnyConnect client will display a dialog box notifying the user that their password has expired but will permit the user to establish the VPN connection with the expired password.
27. 27You manage your company’s Cisco devices by using Telnet. Your supervisor is concerned about eavesdropping over inband device management and has asked you to recommend a solution that would allow you to disable the Telnet servers on each device.
    Which of the following are you most likely to recommend as a replacement? (Select the best answer.)
    

    1. ASNMPv3
    2. BSSH
    3. CSFTP
    4. DSCP
28. 28Which of the following commands should you issue when troubleshooting basic IKE peering to determine whether PSKs are present and matching on both peers? (Select the best answer.)

    1. Aping
    2. Btraceroute
    3. Cshow crypto isakmp policy
    4. Ddebug crypto isakmp
29. 29Your company has installed and configured a Sourcefire device. You want to reduce falsepositives from a trusted source.
    Which of the following could you do? (Select 2 choices.)
    

    1. AConfigure an Allow action with an Intrusion Policy.
    2. BConfigure an Block action with an Intrusion Policy.
    3. CConfigure a Trust action.
    4. DConfigure an Allow action without an Intrusion Policy.
    5. EConfigure an Block action without an Intrusion Policy.
    6. FConfigure a Monitor action.
30. 30Which of the following is a reason to use the roundrobin assignment feature of dynamic PAT addresses? (Select the best answer.)

    1. AYou want to send traffic to more than one remote device.
    2. BYou want to map a single internal IP address to a single routable IP address.
    3. CYou want to prevent the misinterpretation of traffic as a DoS attack.
    4. DYou want to use a single mapped routable address.
31. 31You are configuring manual NAT on a Cisco Firepower device.
    Which of the following best describes the order in which the NAT rules will be processed? (Select the best answer.)
    

    1. Aon a firstmatch basis in the order that they appear in the configuration
    2. Bthe most general rules first followed by the most specific rules
    3. Cstatic rules first followed by dynamic rules
    4. Dshortest prefix first followed by longer prefixes
32. 32Which of the following is least likely to be considered a form of malware? (Select the best answer.)

    1. Abots
    2. BDDOS
    3. CTrojan horses
    4. Dvirus
33. 33Which of the following occurs when an IDS or IPS does not identify malicious traffic that enters the network? (Select the best answer.)

    1. Aa false positive
    2. Ba false negative
    3. Ca true positive
    4. Da true negative
34. 34Which of the following lost or stolen device options are available to employees when MDM is integrated with ISE? (Select 3 choices.)

    1. Areport device as lost or stolen
    2. Binitiate a PIN lock
    3. Cinitiate a full or corporate wipe
    4. Dquarantine the device
    5. Erevoke the device’s digital certificate
35. 35Which of the following private VLAN port types communicate only with promiscuous ports? (Select the best answer.)

    1. Acommunity ports
    2. Bisolated port
    3. CSPAN port
    4. Dpromiscuous ports
36. 36On which of the following layers of the hierarchical network design model should you implement PortFast, BPDU guard, and root guard? (Select the best answer.)

    1. Aonly on core layer ports
    2. Bonly on distribution layer ports
    3. Conly on access layer ports
    4. Donly on core and distribution layer ports
    5. Eon core, distribution, and access layer ports
37. 37Which of the following is the man-in-the-middle attack that is most likely to be used to cause a workstation to send traffic to a false gateway IP address? (Select the best answer.)

    1. AARP spoofing
    2. BDHCP spoofing
    3. CMAC spoofing
    4. Dswitch spoofing
38. 38On a Cisco ASA, which of the following RADIUS authentication protocols are not supported? (Select 2 choices.)

    1. ACHAP
    2. BEAPMD5
    3. CPAP
    4. DPEAP
    5. EMSCHAPv1F. MSCHAPv2
39. 39Which of the following is the best reason to enforce blacklisting by security zone on a Cisco device that uses the Security Intelligence IP Address Reputation feature? (Select the best answer.)

    1. Ato streamline performance of the IPS device
    2. Bto ensure that local hosts can communicate with a given IP address
    3. Cto validate a blacklist feed that has been obtained from a third party
    4. Dto manually control which networks are blocked by the IPS
40. 40Which of the following is not true of SIM systems? (Select the best answer.)

    1. AThey perform realtime threat detection.
    2. BThey focus on policy and standards compliance.
    3. CThey consolidate logs to a central server.
    4. DThey analyze log data and report findings.
41. 41In the Cisco ISE GUI, you click Administration > Certificates > Certificate Store and notice that a SCEP NDES server RA certificate is installed on the ISE node.
    Which of the following best describes the reason the certificate is there? (Select the best answer.)
    

    1. AThe ISE is a SCEP proxy for a Windows CA.
    2. BThe ISE is a CA for the Windows AD domain.
    3. CThe ISE has been compromised, and the CA chain has been altered.
    4. DThe ISE requires the CA in order to mitigate a Windows Server SCEP bug.
42. 42You issue the following commands on a Cisco router:
    tacacsserver host ts1 timeout 30
    tacacsserver timeout 20
    Which of the following is true about how the Cisco router communicates with the TACACS+ server? (Select the best answer.)
    

    1. AThe router will maintain an open TCP connection.
    2. BThe router will maintain an open TCP connection for no more than 20 seconds.
    3. CThe router will wait 20 seconds for the server to reply before declaring an error.
    4. DThe router will wait 30 seconds for the server to reply before declaring an error.
43. 43You are configuring VPN access for Cisco AnyConnect clients. You finish the configuration by establishing a fail open policy.
    Which of the following is true of AnyConnect clients that fail to establish a VPN session? (Select the best answer.)
    

    1. AThey are granted full access to the local network, but without security.
    2. BThey are granted full access to the local network, including security.
    3. CThey are denied full network access, except for local resources.
    4. DThey are denied full network access, including local resources.
44. 44Which of the following web application threats is not typically mitigated by installing a WAF? (Select the best answer.)

    1. Aexploits related to uncloaked error messages
    2. Bexploits against known vulnerabilities
    3. Cexploits related to directory traversal vulnerabilities
    4. Dexploits against unknown vulnerabilities
    5. Eexploits related to viruses in file uploads
45. 45Which of the following is a set of rules to which a Cisco IPS appliance can compare network traffic to determine whether an attack is occurring? (Select the best answer.)

    1. Aanomaly detection
    2. Bglobal correlation
    3. Creputation filtering
    4. Da signature definition
    5. Ea threat rating
46. 46Which of the following describes the primary difference between PGP and S/MIME? (Select the best answer.)

    1. APGP can be used to encrypt disk drives, but S/MIME cannot.
    2. BPGP can use SHA1 for data integrity, but S/MIME cannot.
    3. CS/MIME can be used to encrypt email messages, but PGP cannot.
    4. DS/MIME can use RSA for digital signatures, but PGP cannot.
47. 47Which of the following failover link configurations can leave an ASA vulnerable to replay attacks? (Select the best answer.)

    1. Aconnecting the active and standby units directly with a crossover cable
    2. Bconnecting the active and standby units to a dedicated VLAN on a switch
    3. Csharing a regular data interface with the stateful failover link
    4. Dsharing the LAN failover link with the stateful failover link
    5. Eusing a dedicated Ethernet interface as the stateful failover link
48. 48Which of the following fields make up the header of an ESP packet? (Select 2 choices.)

    1. ANext Header
    2. BPad Length
    3. CPadding
    4. DSecurity Parameter Index
    5. ESequence Number
49. 49You want to use the authentication event noresponse action authorize vlan 101 command to ensure that network devices incapable of using 802.1X authentication are automatically placed into VLAN 101, which is the guest VLAN.
    Which of the following VLAN types can you specify as an 802.1X guest VLAN? (Select the best answer.)
    

    1. Aa primary private VLAN
    2. Ba secondary private VLAN
    3. Ca voice VLAN
    4. Dan RSPAN VLAN
50. 50Which of the following statements is true about network traffic event logging in Cisco FireSIGHT Management Center? (Select the best answer.)

    1. ABeginningofconnection events contain less information than endofconnection events.
    2. BPerformance is optimized by logging both beginningofconnection events and end ofconnection events.
    3. CYou can log only beginningofconnection events for encrypted connections handled by an SSL policy.
    4. DYou can log only endofconnection events for blocked traffic.

Descripción

CCNA Security Test sobre Security 100 - 150, creado por Anthony Rosales Sandoval el 03/11/2018.

Autor

Anthony Rosales Sandoval

Idioma

Español

Visitas

11

Etiquetas

ccna security

Valoración

Aún sin valoraciones

Valora este test

Valora este test

Más sobre Firewalls and Access Control Lists