Final exam cisco LAN

1. 1Which statement describes a difference between the Cisco ASA IOS CLI feature and the router IOS CLI feature?

   1. AASA uses the ? command whereas a router uses the help command to receive help on a brief description and the syntax of a command.
   2. BTo use a show command in a general configuration mode, ASA can use the command directly whereas a router will need to enter the do command before issuing the show command.
   3. CTo complete a partially typed command, ASA uses the Ctrl+Tab key combination whereas a router uses the Tab key.
   4. DTo indicate the CLI EXEC mode, ASA uses the % symbol whereas a router uses the # symbol.
2. 2Refer to the exhibit. A network administrator is configuring AAA implementation on an ASA device. What does the option link3 indicate?

   

   1. Athe network name where the AAA server resides
   2. Bthe specific AAA server name
   3. Cthe sequence of servers in the AAA server group
   4. Dthe interface name
3. 3What provides both secure segmentation and threat defense in a Secure Data Center solution?

   1. ACisco Security Manager software
   2. BAAA server
   3. CAdaptive Security Appliance
   4. Dintrusion prevention system
4. 4What are the three core components of the Cisco Secure Data Center solution? (Choose three.)

   1. Amesh network
   2. Bsecure segmentation
   3. Cvisibility
   4. Dthreat defense
   5. Eservers
   6. Finfrastructure
5. 5What are three characteristics of ASA transparent mode? (Choose three.)

   1. AThis mode does not support VPNs, QoS, or DHCP Relay.
   2. BIt is the traditional firewall deployment mode.
   3. CThis mode is referred to as a “bump in the wire.”
   4. DNAT can be implemented between connected networks.
   5. EIn this mode the ASA is invisible to an attacker.
   6. FThe interfaces of the ASA separate Layer 3 networks and require IP addresses in different subnets.
6. 6What is needed to allow specific traffic that is sourced on the outside network of an ASA firewall to reach an internal network?

   1. AACL
   2. BNAT
   3. Cdynamic routing protocols
   4. Doutside security zone level 0
7. 7What will be the result of failed login attempts if the following command is entered into a router?
   
   login block-for 150 attempts 4 within 90

   1. AAll login attempts will be blocked for 150 seconds if there are 4 failed attempts within 90 seconds.
   2. BAll login attempts will be blocked for 90 seconds if there are 4 failed attempts within 150 seconds.
   3. CAll login attempts will be blocked for 1.5 hours if there are 4 failed attempts within 150 seconds.
   4. DAll login attempts will be blocked for 4 hours if there are 90 failed attempts within 150 seconds.
8. 8Which two tasks are associated with router hardening? (Choose two.)

   1. Aplacing the router in a secure room
   2. Bdisabling unused ports and interfaces
   3. Cinstalling the maximum amount of memory possible
   4. Dsecuring administrative access
   5. Eusing uninterruptible power supplies
9. 9Which threat protection capability is provided by Cisco ESA?

   1. Aweb filtering
   2. Bcloud access security
   3. Cspam protection
   4. DLayer 4 traffic monitoring
10. 10What are two security measures used to protect endpoints in the borderless network? (Choose two.)

    1. Adenylisting
    2. BSnort IPS
    3. CDLP
    4. DDMZ
    5. Erootkit

11. 11Which three types of traffic are allowed when the authentication port-control auto command has been issued and the client has not yet been authenticated? (Choose three.)

    1. ACDP
    2. B802.1Q
    3. CIPsec
    4. DTACACS+
    5. ESTP
    6. FEAPOL
12. 12Which statement describes a characteristic of the IKE protocol?

    1. AIt uses UDP port 500 to exchange IKE information between the security gateways.
    2. BIKE Phase 1 can be implemented in three different modes: main, aggressive, or quick.
    3. CIt allows for the transmission of keys directly across a network.
    4. DThe purpose of IKE Phase 2 is to negotiate a security association between two IKE peers.
13. 13Which action do IPsec peers take during the IKE Phase 2 exchange?

    1. Aexchange of DH keys
    2. Bnegotiation of IPsec policy
    3. Cnegotiation of IKE policy sets
    4. Dverification of peer identity
14. 14What are two hashing algorithms used with IPsec AH to guarantee authenticity? (Choose two.)

    1. ASHA
    2. BRSA
    3. CDH
    4. DMD5
    5. EAES
15. 15Which command raises the privilege level of the ping command to 7?

    1. Auser exec ping level 7
    2. Bauthorization exec ping level 7
    3. Caccounting exec level 7 ping
    4. Dprivilege exec level 7 ping
16. 16What is a characteristic of a role-based CLI view of router configuration?

    1. AA CLI view has a command hierarchy, with higher and lower views.
    2. BWhen a superview is deleted, the associated CLI views are deleted.​
    3. CA single CLI view can be shared within multiple superviews.
    4. DOnly a superview user can configure a new view and add or remove commands from the existing views.​
17. 17What is a limitation to using OOB management on a large enterprise network?

    1. AProduction traffic shares the network with management traffic.
    2. BTerminal servers can have direct console connections to user devices needing management.
    3. COOB management requires the creation of VPNs.
    4. DAll devices appear to be attached to a single management network.
18. 18Refer to the exhibit. A corporate network is using NTP to synchronize the time across devices. What can be determined from the displayed output?

    

    1. ARouter03 is a stratum 2 device that can provide NTP service to other devices in the network.
    2. BThe time on Router03 may not be reliable because it is offset by more than 7 seconds to the time server.
    3. CThe interface on Router03 that connects to the time sever has the IPv4 address 209.165.200.225.
    4. DRouter03 time is synchronized to a stratum 2 time server.
19. 19Refer to the exhibit. Which two conclusions can be drawn from the syslog message that was generated by the router? (Choose two.)

    

    1. AThis message resulted from an unusual error requiring reconfiguration of the interface.
    2. BThis message indicates that service timestamps have been configured.
    3. CThis message indicates that the interface changed state five times.
    4. DThis message is a level 5 notification message.
    5. EThis message indicates that the interface should be replaced.
20. 20Which two types of hackers are typically classified as grey hat hackers? (Choose two.)

    1. Ahacktivists
    2. Bcyber criminals
    3. Cvulnerability brokers
    4. Dscript kiddies
    5. Estate-sponsored hackers
21. 21When describing malware, what is a difference between a virus and a worm?

    1. AA virus focuses on gaining privileged access to a device, whereas a worm does not.
    2. BA virus replicates itself by attaching to another file, whereas a worm can replicate itself independently.
    3. CA virus can be used to launch a DoS attack (but not a DDoS), but a worm can be used to launch both DoS and DDoS attacks.
    4. DA virus can be used to deliver advertisements without user consent, whereas a worm cannot.
22. 22Which type of packet is unable to be filtered by an outbound ACL?

    1. Amulticast packet
    2. BICMP packet
    3. Cbroadcast packet
    4. Drouter-generated packet
23. 23Consider the access list command applied outbound on a router serial interface.
    
    access-list 100 deny icmp 192.168.10.0 0.0.0.255 any echo reply
    
    What is the effect of applying this access list command?

    1. AThe only traffic denied is echo-replies sourced from the 192.168.10.0/24 network. All other traffic is allowed.
    2. BThe only traffic denied is ICMP-based traffic. All other traffic is allowed.
    3. CNo traffic will be allowed outbound on the serial interface.
    4. DUsers on the 192.168.10.0/24 network are not allowed to transmit traffic to any other destination.
24. 24Which command is used to activate an IPv6 ACL named ENG_ACL on an interface so that the router filters traffic prior to accessing the routing table?

    1. Aipv6 access-class ENG_ACL in
    2. Bipv6 traffic-filter ENG_ACL out
    3. Cipv6 traffic-filter ENG_ACL in
    4. Dipv6 access-class ENG_ACL out
25. 25What technology has a function of using trusted third-party protocols to issue credentials that are accepted as an authoritative identity?

    1. Adigital signatures
    2. Bhashing algorithms
    3. CPKI certificates
    4. Dsymmetric keys
26. 26What are two methods to maintain certificate revocation status? (Choose two.)

    1. Asubordinate CA
    2. BOCSP
    3. CDNS
    4. DLDAP
    5. ECRL
27. 27Which protocol is an IETF standard that defines the PKI digital certificate format?

    1. ASSL/TLS
    2. BX.500
    3. CLDAP
    4. DX.509
28. 28A network administrator is configuring DAI on a switch. Which command should be used on the uplink interface that connects to a router?

    1. Aip arp inspection trust
    2. Bip dhcp snooping
    3. Cip arp inspection vlan
    4. Dspanning-tree portfast
29. 29What is the best way to prevent a VLAN hopping attack?

    1. ADisable trunk negotiation for trunk ports and statically set nontrunk ports as access ports.
    2. BDisable STP on all nontrunk ports.
    3. CUse VLAN 1 as the native VLAN on trunk ports.
    4. DUse ISL encapsulation on all trunk links.
30. 30What would be the primary reason an attacker would launch a MAC address overflow attack?

    1. Aso that the switch stops forwarding traffic
    2. Bso that legitimate hosts cannot obtain a MAC address
    3. Cso that the attacker can see frames that are destined for other hosts
    4. Dso that the attacker can execute arbitrary code on the switch
31. 31What is the main difference between the implementation of IDS and IPS devices?

    1. AAn IDS can negatively impact the packet flow, whereas an IPS can not.
    2. BAn IDS needs to be deployed together with a firewall device, whereas an IPS can replace a firewall.
    3. CAn IDS would allow malicious traffic to pass before it is addressed, whereas an IPS stops it immediately.
    4. DAn IDS uses signature-based technology to detect malicious packets, whereas an IPS uses profile-based technology.
32. 32 Which attack is defined as an attempt to exploit software vulnerabilities that are unknown or undisclosed by the vendor?

    1. Azero-day
    2. BTrojan horse
    3. Cbrute-force
    4. Dman-in-the-middle
33. 33What are the three signature levels provided by Snort IPS on the 4000 Series ISR? (Choose three.)

    1. Asecurity
    2. Bdrop
    3. Creject
    4. Dconnectivity
    5. Einspect
    6. Fbalanced
34. 34What are three attributes of IPS signatures? (Choose three.)

    1. Aaction
    2. Blength
    3. Ctrigger
    4. Dtype
    5. Edepth
    6. Ffunction
35. 35Which two features are included by both TACACS+ and RADIUS protocols? (Choose two.)

    1. ASIP support
    2. Bpassword encryption
    3. C802.1X support
    4. Dseparate authentication and authorization processes
    5. Eutilization of transport layer protocols
36. 36What function is provided by the RADIUS protocol?

    1. ARADIUS provides encryption of the complete packet during transfer.
    2. BRADIUS provides separate AAA services.
    3. CRADIUS provides separate ports for authorization and accounting.
    4. DRADIUS provides secure communication using TCP port 49.
37. 37What are three characteristics of the RADIUS protocol? (Choose three.)

    1. Autilizes TCP port 49
    2. Buses UDP ports for authentication and accounting
    3. Csupports 802.1X and SIP
    4. Dseparates the authentication and authorization processes
    5. Eencrypts the entire body of the packet
    6. Fis an open RFC standard AAA protocol
38. 38Which zone-based policy firewall zone is system-defined and applies to traffic destined for the router or originating from the router?

    1. Alocal zone
    2. Binside zone
    3. Cself zone
    4. Dsystem zone
    5. Eoutside zone
39. 39What are two benefits of using a ZPF rather than a Classic Firewall? (Choose two.)

    1. AZPF allows interfaces to be placed into zones for IP inspection.
    2. BThe ZPF is not dependent on ACLs.
    3. CMultiple inspection actions are used with ZPF.
    4. DZPF policies are easy to read and troubleshoot.
    5. EWith ZPF, the router will allow packets unless they are explicitly blocked.
40. 40How does a firewall handle traffic when it is originating from the private network and traveling to the DMZ network?

    1. AThe traffic is selectively denied based on service requirements.
    2. BThe traffic is usually permitted with little or no restrictions.
    3. CThe traffic is selectively permitted and inspected.
    4. DThe traffic is usually blocked.
41. 41Which two protocols generate connection information within a state table and are supported for stateful filtering? (Choose two.)

    1. AICMP
    2. BUDP
    3. CDHCP
    4. DTCP
    5. EHTTP
42. 42Which type of firewall is supported by most routers and is the easiest to implement?

    1. Anext generation firewall
    2. Bstateless firewall
    3. Cstateful firewall
    4. Dproxy firewall
43. 43What network testing tool would an administrator use to assess and validate system configurations against security policies and compliance standards?

    1. ATripwire
    2. BL0phtcrack
    3. CNessus
    4. DMetasploit
44. 44What type of network security test can detect and report changes made to network systems?

    1. Avulnerability scanning
    2. Bnetwork scanning
    3. Cintegrity checking
    4. Dpenetration testing
45. 45What network security testing tool has the ability to provide details on the source of suspicious network activity?

    1. ASIEM
    2. BSuperScan
    3. CZenmap
    4. DTripwire
46. 46How do modern cryptographers defend against brute-force attacks?

    1. AUse statistical analysis to eliminate the most common encryption keys.
    2. BUse a keyspace large enough that it takes too much money and too much time to conduct a successful attack.
    3. CUse an algorithm that requires the attacker to have both ciphertext and plaintext to conduct a successful attack.
    4. DUse frequency analysis to ensure that the most popular letters used in the language are not used in the cipher message.
47. 47How does a Caesar cipher work on a message?

    1. ALetters of the message are replaced by another letter that is a set number of places away in the alphabet.
    2. BLetters of the message are rearranged randomly.
    3. CLetters of the message are rearranged based on a predetermined pattern.
    4. DWords of the message are substituted based on a predetermined pattern.
48. 48What is the main factor that ensures the security of encryption of modern algorithms?

    1. Acomplexity of the hashing algorithm
    2. Bthe use of 3DES over AES
    3. Csecrecy of the keys
    4. Dsecrecy of the algorithm
49. 49What is the next step in the establishment of an IPsec VPN after IKE Phase 1 is complete?

    1. Anegotiation of the ISAKMP policy
    2. Bnegotiation of the IPsec SA policy
    3. Cdetection of interesting traffic
    4. Dauthentication of peers
50. 50Refer to the exhibit. What algorithm will be used for providing confidentiality?

    

    1. ARSA
    2. BDiffie-Hellman
    3. CDES
    4. DAES
51. 51After issuing a show run command, an analyst notices the following command:
    
    crypto ipsec transform-set MYSET esp-aes 256 esp-md5-hmac
    
    What is the purpose of this command?

    1. AIt establishes the set of encryption and hashing algorithms used to secure the data sent through an IPsec tunnel.
    2. BIt defines the default ISAKMP policy list used to establish the IKE Phase 1 tunnel.
    3. CIt establishes the criteria to force the IKE Phase 1 negotiations to begin.
    4. DIt indicates that IKE will be used to establish the IPsec tunnel for protecting the traffic.
52. 52Which algorithm can ensure data integrity?

    1. ARSA
    2. BAES
    3. CMD5
    4. DPKI
53. 53A company implements a security policy that ensures that a file sent from the headquarters office to the branch office can only be opened with a predetermined code. This code is changed every day. Which two algorithms can be used to achieve this task? (Choose two.)

    1. AHMAC
    2. BMD5
    3. C3DES
    4. DSHA-1
    5. EAES
54. 54A network technician has been asked to design a virtual private network between two branch routers. Which type of cryptographic key should be used in this scenario?

    1. Ahash key
    2. Bsymmetric key
    3. Casymmetric key
    4. Ddigital signature
55. 55Which two options can limit the information discovered from port scanning? (Choose two.)

    1. Aintrusion prevention system
    2. Bfirewall
    3. Cauthentication
    4. Dpasswords
    5. Eencryption
56. 56An administrator discovers that a user is accessing a newly established website that may be detrimental to company security. What action should the administrator take first in terms of the security policy?

    1. AAsk the user to stop immediately and inform the user that this constitutes grounds for dismissal.
    2. BCreate a firewall rule blocking the respective website.
    3. CRevise the AUP immediately and get all users to sign the updated AUP.
    4. DImmediately suspend the network privileges of the user.
57. 57If AAA is already enabled, which three CLI steps are required to configure a router with a specific view? (Choose three.)

    1. ACreate a superview using the parser view view-name command.
    2. BAssociate the view with the root view.
    3. CAssign users who can use the view.
    4. DCreate a view using the parser viewcommand.
    5. EAssign a secret password to the view.
    6. FAssign commands to the view.

Descripción

Test sobre Final exam cisco LAN, creado por ALEJANDRO SUSEJ LUJÁN BARRÓN el 23/11/2024.

Autor

ALEJANDRO SUSEJ LUJÁN BARRÓN

Idioma

Español

Visitas

0

Historial

Creado el 23 nov 2024 · actualizado el 23 nov 2024

Valoración

Aún sin valoraciones

Valora este test

Valora este test

Más sobre Firewalls and Access Control Lists