Test
CCNA Security 210-260 IINS - Exam 3
Preguntas del test (54)
1Which command verifies phase 1 of an IPsec VPN on a Cisco router
- Ashow crypto ipsec sa
- Bshow crypto map
- Cshow crypto isakmp sa
- Dshow crypto engine connection active
2What is a benefit of a web application firewall?
- AIt blocks known vulnerabilities without patching applications
- BIt supports all networking protocols.
- CIt accelerates web traffic
- DIt simplifies troubleshooting
3Refer to the following output:
dst src state conn-id slot
10.10.10.2 10.1.1.5 QM_IDLE 1 0
While troubleshooting site-to-site VPN, you issued the show crypto isakmp sa command. What does the given output show?- AIPsec Phase 1 is down due to a QM_IDLE state
- BIPsec Phase 1 is established between 10.10.10.2 and 10.1.1.5
- CIPsec Phase 2 is down due to a QM_IDLE state
- DIPsec Phase 2 is established between 10.10.10.2 and 10.1.1.5
4Which statement about PVLAN isolated port configured on a switch is true?
- AThe isolated port can communicate only with community ports
- BThe isolated port can communicate only with other isolated ports
- CThe isolated port can communicate with other isolated ports and the promiscuous port
- DThe isolated port can communicate only with the promiscuous port
5What can the SMTP preprocessor in FirePOWER normalize?
- AIt can lookup the email sender
- BIt can extract and decode email attachments in client to server traffic
- CIt compares known threats to the email sender
- DIt uses Traffic Anomaly Detector
- EIt can forward the SMTP traffic to an email filter server
6When a switch has multiple links connected to a downstream switch, what is the first step that STP takes to prevent loops?
- ASTP selects the designated port
- BSTP elects the root bridge
- CSTP selects the root port
- DSTP blocks one of the ports
7Which statement correctly describes the function of a private VLAN?
- AA private VLAN enables the creation of multiple VLANs using one broadcast domain.
- BA private VLAN partitions the Layer 3 broadcast domain of a VLAN into subdomains.
- CA private VLAN combines the Layer 2 broadcast domains of many VLANs into one major broadcast domain
- DA private VLAN partitions the Layer 2 broadcast domain of a VLAN into subdomains
8What is the purpose of a honeypot IPS?
- ATo create customized policies
- BTo detect unknown attacks
- CTo normalize streams
- DTo collect information about attacks
9Which protocol provides security to Secure Copy?
- AESP
- BHTTPS
- CSSH
- DIPsec
10Which address block is reserved for locally assigned unique local addresses?
- AFD00::/8
- B2002::/16
- CFB00::/8
- D2001::32
11Which tool can an attacker use to attempt a DDoS attack?
- ABotnet
- BTrojan horse
- CVirus
- DAdware
12How does a device on a network using ISE receive its digital certificate during the new device registration process?
- AISE acts as a SCEP proxy to enable the device to receive a certificate from a central CA server
- BISE issues a certificate from its internal CA server
- CISE issues a pre-defined certificate from a local database
- DThe device requests a new certificate directly from a central CA
13Refer to the following output for R1 and R2:
R1
interface GigabitEthernet 0/0
ip address 10.20.20.4 255.255.255.0
crypto isakmp policy 1
authenticaiton pre-share
lifetime 84600
crypto isakmp key test67890 address 10.20.20.4
R2
interface GigabitEthernet 0/0
ip address 10.20.20.4 255.255.255.0
crypto isakmp policy 10
authentication pre-share
lifetime 84600
crypto isakmp key test12345 address 10.30.30.5
You have configured R1 and R2 as shown but the routers are unable to establish a site-to-site VPN tunnel. What action can you take to correct the problem?- AEdit the crypto keys on R1 and R2 to match
- BEdit the ISAKMP policy sequence numbers on R1 and R2 to match
- CSet a valid value for the crypto key lifetime on each router
- DEdit the crypto isakmp key command on each router with the address value of it's own interface
14Refer to the following output:
current_peer: 10.1.1.5
PERMIT, flags={origin_is_acl,)
#pkts encaps: 1205, #pkts encrypt: 1205, #pkts digest 1205
#pkts decaps: 1168, #pkts decrypt 1168, #pkts verify 1168
#pkts compressed: 0, #pkts decompressed: 0
#pkts not complressed: 0, #pkts compr. failed: 0
#pkts decompress failed: 0, #send errors 0, #recv errors 0
local crypto endpt.: 10.1.1.1, remote crypto endpt.: 10.1.1.5
While troubleshooting site-to-site VPN, you issued the show crypto ipsec sa command. What does the given output show?- AIPsec Phase 2 is established between 10.1.1.1 and 10.1.1.5
- BISAKMP security associations are established between 10.1.1.5 and 10.1.1.1
- CIKE version 2 security associations are established between 10.1.1.1 and 10.1.1.5
- DIPsec Phase 2 is down due to a mismatch between encrypted and descrypted packets
15In a security context, which action can you take to address compliance?
- AImplement rules to prevent a vulnerability
- BCorrect or counteract a vulnerability
- CReduce the severity of a vulnerability
- DFollow directions from the security appliance manufacturer to remediate a vulnerability
16Which IPS mode provides the maximum number of actions?
- AInline
- BPromiscuous
- CSpan
- DFailover
- EBypass
17By which kind of threat the victim is tricked into entering username and password information at a disguised website?
- ASpoofing
- BMalware
- CSpam
- DPhishing
18Which technology can be used to rate data fidelity and provide and authenticated hash for data?
- AFile reputation
- BFile analysis
- CSignature updates
- DNetwork blocking
19In which type of attack does an attacker send email messages that ask the recipient to click a link such as https://www.cisco.net.cc/securelogon?
- APhishing
- BPharming
- CSolicitation
- DSecure transaction
20What configuration allows AnyConnect to automatically establish a VPN session when a user logs into the computer?
- AAlways-on
- BProxy
- CTransparent Mode
- DTrusted Network Detection
21Which source port does IKE use when NAT has been detected between two VPN gateways?
- ATCP 4500
- BTCP 500
- CUDP 4500
- DUDP 500
22Refer to the following commands:
Username Engineer privilege 9 password 0 configure
Username Monitor privilege 8 password 0 watcher
Username HelpDesk privilege 6 password help
Privilege exec level 6 show running
Privilege exec level 7 show start-up
Privilege exec level 9 configure terminal
Privilege exec level 10 interface
Which line in this configuration prevents the HelpDesk user from modifying the interface configuration- APrivilege exec level 9 configure terminal
- BPrivilege exec level 10 interface
- CUsername HelpDesk privilege 6 password help
- DPrivilege exec level 7 show start-up
23Which statement about extended access lists is true?
- AExtended access lists perform filtering that is based on source and destination and are most effective when applied closest to the destination.
- BExtended access lists perform filtering that is based on source and destination and are most effective when applied to the source.
- CExtended access lists perform filtering that is based on destination and are most effective when applied to the source.
- DExtended access lists perform filtering that is based on source and are most effective when applied to the destination,
24What is the Cisco preferred countermeasure to mitigate CAM overflows?
- APort security
- BDynamic port security
- CIP source guard
- DRoot guard
25A specific URL has been identified as containing malware. What action can you take to block users from accidentally visiting the URL and becoming infected with malware?
- AEnable URL filtering on the perimeter router and add the URLs you want to block to the router's local URL list.
- BEnable URL filtering on the perimeter firewall and add the URLs you want to allow to the router's local URL list.
- CEnable URL filtering on the perimeter router and add the URLs you want to allow to the firewall's local URL list
- DCreate a blacklist that contains the URL you want to block and activate the blacklist on the perimeter router.
- ECreate a whitelist that contains the URLs you want to allow and activate the whitelist on the perimeter router.
26Which feature filters CoPP packets?
- AAccess control lists
- BClass maps
- CPolicy maps
- DRoute maps
27Refer to the following output:
dst src state conn-id slot
10.10.10.2 10.1.1.5 MM_NO_STATE 1 0
While troubleshooting site-to-site VPN, you issued the show crypto isakmp sa command. What does the given output show?- AIKE Phase 1 main mode was created on 10.1.1.5, but failed to negotiate with 10.10.10.2
- BIKE Phase 1 main mode has successfully negotiated between 10.1.1.5 and 10.10.10.2
- CIKE Phase 1 aggressive mode was created on 10.1.1.5, but it failed to negotiate with 10.10.10.2
- DIKE Phase 1 aggressive has successfully negotiated between 10.1.1.5 and 10.10.10.2
28Refer to the following output:
R1#show snmp
0 SNMP packets input
6 Bad SNMP version errors
3 Unknown community name
9 Illegal operation for community name supplied
4 Encoding errors
2 Number of requested variables
0 Number of altered variables
98 Get-request PDUs
12 Get-next PDUs
2 Set-request PDUs
0 Input queue packet drops (Maximum queue size 1000)
0 SNMP packets output
0 Too big errors (Maximum packet size 1500)
0 No such name errors
0 Bad values errors
0 General errors
31 Response PDUs
1 Trap PDUs
How many times was a read-only string used to attempt a write operation?- A9
- B6
- C4
- D3
- E2
- F0
29After reloading a router, you issue the dir command to verify the installation and observe that the image file appears to be missing. For what reason could the image file fail to appear in the dir output?
- AThe secure boot-image command is configured
- BThe secure boot-comfit command is configured
- CThe confreg 0x24 command is configured
- DThe reload command was issued from ROMMON
30When a company puts a security policy in place, what is the effect on the company's business?
- AMinimizing risk
- BMinimizing total cost of ownership
- CMinimizing liability
- DMaximizing compliance
31What security feature allows a private IP address to access the internet by translating it to a public address?
- ANAT
- BHairpinning
- CTrusted Network Detection
- DCertification Authority
32Which type of mirroring does SPAN technology perform?
- ARemote mirroring over Layer 2
- BRemote mirroring over Layer 3
- CLocal mirroring over Layer 2
- DLocal mirroring over Layer 3
33If you change the native VLAN on the trunk port to an unused VLAN, what happens if an attacker attempts a double-tagging attack?
- AThe trunk port would go into an error-disabled state
- BA VLAN hopping attack would be successful
- CA VLAN hopping attack would be prevented
- DThe attacker VLAN will be pruned
34What is the most common Cisco Discovery Protocol version 1 attack?
- ADenial of Service
- BMAC-Address spoofing
- CCAM-table overflow
- DVLAN hopping
35Refer to the following commands:
Username HelpDesk privilege 9 password 0 helpdesk
Username Monitor privilege 8 password 0 watcher
Username Admin password checkme
Username Admin privilege 6 autocommand show running
Privilege exec level 6 configure terminal
The Admin user is unable to enter configuration mode on a device with the given configuration. What change can you make to the configuration to correct the problem?- ARemove the autocommand keyword and arguments from the username admin privilege line.
- BChange the Privilege exec level value to 15
- CRemove the two Username Admin lines
- DRemove the Privilege exec line
36On which Cisco Configuration Professional screen do you enable AAA?
- AAAA Summary
- BAAA Servers and Groups
- CAuthentication Policies
- DAuthorization Policies
37Which type of IPS can identify worms that are propagating in a network?
- APolicy-based IPS
- BAnomaly-based IPS
- CReputation-based IPS
- DSignature-based IPS
38In the following command:
router OSPF 200
What does the value 200 stand for?- AProcess ID
- BArea ID
- CAdministrative Distance Value
- DABR ID
39Which statement about the communication between interfaces of the same security level is true?
- AInterfaces on the same security level require additional configuration to permit interface communication.
- BConfiguring interfaces on the same security level can use asymmetric routing.
- CAll traffic is allowed by default between interfaces on the same security level.
- DYou can configure only one interface on an individual security level.
40Which wildcard mask is associated with a subnet mask of /27
- A0.0.0.31
- B0.0.0.27
- C0.0.0.224
- D0.0.0.255
41Which option describes information that must be considered when you apply an access list to a physical interface?
- AProtocol used for filtering
- BDirection of the access class
- CDirection of the access group
- DDirection of the access list
42What is the purpose of the integrity component of the CIA triad?
- ATo ensure that only authorized parties can modify data
- BTo determine whether data is relevant
- CTo create a process for accessing data
- DTo ensure that only authorized parties can view the data
43How does PEAP protect the EAP exchange?
- AIt encrypts the exchange using the server certificate
- BIt encrypts the exchange using the client certificate
- CIt validated the server-supplied certificate, and then encrypts the exchange using the client side certificate.
- DIt validates the client-supplied certificate, and then encrypts the exchange using the server certificate.
44If the native VLAN on a trunk is different on each end of the link, what is a potential consequence?
- AThe interface on both switches may shut down
- BSTP loops may occur
- CThe switch with the higher native VLAN may shut down
- DThe switch with the lower native VLAN may shut down
45How does a zone-based firewall implementation handle traffic between interfaces in the same zone?
- ATraffic between two interfaces in the same zone is allowed by default.
- BTraffic between interfaces in the same zone is blocked unless you configure the same security permit command,
- CTraffic between interfaces in the same zone is always blocked.
- DTraffic between interfaces in the same zone is blocked unless you apply a service policy to the zone pair.
46Refer to the following commands:
tacacs server tacacs1
address ipv4 1.1.1.1
timeout 20
single-connection
tacacs server tacacs2
address ipv4 2.2.2.2
timeout 20
single-connection
tacacs server tacacs3
address ipv4 3.3.3.3
timeout 20
single-connection
Which statement about the given configuration is true?- AThe single-connection command causes the device to establish one connection for all TACACS translations.
- BThe single-connection command causes the device to process one TACACS request and then move to the next server.
- CThe timeout command causes the device to move to the next server after 20 seconds of TACACS inactivity
- DThe router communicates with the NAS on the default port, TCP 1645
47In which type of attack does the attacker attempt to overload the CAM table on a switch so that the switch acts as a hub?
- AMAC spoofing
- BGratuitous ARP
- CMAC flooding
- DDoS
48Which syslog severity level is level number 7?
- AWarning
- BInformational
- CNotification
- DDebugging
49Refer to the following output:
UDP outside 205.165.201.225:53 inside 10.0.0.10:52464, idle 0:00:01, bytes 266, flags -
What type of firewall would use the given configuration line?- AA stateful firewall
- BA personal firewall
- CA proxy firewall
- DAn application firewall
- EA stateless firewall
50Which feature of the Cisco Email Security Appliance can mitigate the impact of snowshoe spam and sophisticated phishing attacks?
- AContextual analysis
- BHolistic understanding of threats
- CGraymail management and filtering
- DSignature-based IPS
51Which Sourcefire logging action should you choose to record the most detail about a connection?
- AEnable logging at the end of the session
- BEnable logging at the beginning of the session
- CEnable alerts via SNMP to log events off-box
- DEnable eStreamer to log events off-box
52When is the best time to perform an anti-virus signature update?
- AEvery time a new update is available
- BWhen the local scanner has detected a new virus
- CWhen a new virus is discovered in the wild
- DWhen the system detects a browser hook
53Which command initializes a lawful intercept view?
- Ausername cisco1 view lawful-intercept password cisco
- Bparser view cisco li-view
- Cli-view cisco user cisco1 password cisco
- Dparser view li-view inclusive
54Which type of firewall can act on behalf of the end device?
- AStateful packet
- BApplication
- CPacket
- DProxy
Información
- Descripción
- This exam tests the candidate's knowledge of secure network infrastructure, understanding core security concepts, managing secure access, VPN encryption, firewalls, intrusion prevention, web and email content security, and endpoint security using: SIEM Technology Cloud & Virtual Network Topologies BYOD Identity Services Engine 802.1x Authentication Cisco FirePOWER Anti-Malware/Cisco Advanced Malware Protection From Cisco.PracticeTest.210-260.v2016-07-06.by.Noah.154q.vce
- Autor
- Mike M
- Idioma
- English
- Visitas
- 6.187
- Etiquetas
- Valoración
- 4,6 de 5 · 13 valoraciones Valora este test