Test
CCNA Security 210-260 IINS - Exam 1
Preguntas del test (50)
1What type of packet creates and performs network operations on a network device?
- AControl plane packets
- BData plane packets
- CManagement plane packets
- DServices plane packets
2What is an advantage of implementing a Trusted Platform Module for disk encryption?
- AIt provides hardware authentication
- BIt allows the hard disk to be transferred to another device with requiring re-encryption
- CIt supports a more complex encryption algorithm than other disk encryption technologies
- DIt can protect against single points of failure
3In what type of attach does an attacker virtually change a device's burned-in address in an attempt to circumvent access lists and mask the device's true identity?
- AGratuitous ARP
- BARP poisoning
- CIP Spoofing
- DMAC Spoofing
4What is the effect of the
send-lifetime local 23:59:00 Dec 31 2013 infinite
command?- AIt configures the device to begin transmitting the authentication key to other devices at the 00:00:00 local time on January 1, 2014 and continue using the key indefinitely.
- BIt configures the device to begin transmitting the authentication key to other devices at the 23:59:00 local time on December 31, 2013 and continue using the key indefinitely.
- CIt configures the device to begin accepting the authentication key from other devices immediately and stop accepting the key at the 23:59:00 local time on December 31, 2013.
- DIt configures the device to generate a new authentication key and transmit it to other devices at 23:59:00 local time on December 31, 2013.
- EIt configures the device to begin accepting the authentication key from other devices at the 23:59:00 local time on December 31, 2013 and continue accepting the key indefinitely.
- FIt configures the device to begin accepting the authentication key from other devices at the 00:00:00 local time on January 1, 2014 and continue accepting the key indefinitely.
5What type of algorithm uses the same key to encrypt and decrypt data?
- AA symmetric algorithm
- BAn asymmetric algorithm
- CA Public Key Infrastructure algorithm
- DAn IP Security algorithm
6What type of security support is provided by the Open Web Application Security Project?
- AEducation about common website vulnerabilities
- BA Web site security framework
- CA security discussion forum for Web site developers
- DScoring of common vulnerabilities and exposures
7What is one requirement for locking a wired or wireless device from the ISE?
- AThe ISE agent must be installed on the device
- BThe device must be connected to the network when the lock command is executed
- CThe user must approve the locking action
- DThe organization must implement an acceptable use policy allowing device locking
8What is the FirePOWER impact flag used for?
- AA value that indicates the potential severity of an attack
- BA value that the administrator assigns to each signature
- CA value that sets the priority of a signature
- DA value that measures the application awareness
9What method does asymmetric cryptography use to secure data?
- AA public/private key pair
- BShared secret keys
- CAn RSA nonce
- DAn MD5 hash
10Which statement about IOS priviledge levels is true?
- AEach privilege level supports the commands at its own level and all levels below it.
- BEach privilege level supports the commands at its own level and all levels above it.
- CPrivilege-level commands are set explicitly for each user.
- DEach privilege level is independent of all other privilege levels.
11Which Cisco product can help mitigate web-based attacks within a network?
- AAdaptive Security Appliance
- BWeb Security Appliance
- CE-mail Security Appliance
- DIdentity Services Engine
12A proxy firewall protects against which type of attack?
- Across-site scripting attack
- Bworm traffic
- Cport scanning
- DDDoS attacks
13Refer to the following command output:
crypto ikev1 policy 1
encryption aes
hash md5
authentication-preshare
group 2
lifetime 14400
What is the effect of the given command sequence?- AIt configures IKE Phase1
- BIt configures a site-to-site VPN tunnel
- CIt configures a crypto policy with a key size of 14400
- DIt configures IPSec Phase2
14When an administrator initiates a device wipe command from the ISE, what is the immediate effect?
- AIt requests the administrator to choose between erasing all device data or only managed corporate data.
- BIt requests the administrator to enter the device PIN or password before proceeding with the operation.
- CIt notifies the device user and proceeds with the erase option.
- DIt immediately erases all data on the device.
15What is an advantage of placing an IPS on the inside of a network?
- AIt can provide higher throughput
- BIt receives traffic that has already been filtered
- CIt receives every inbound packet
- DIt can provide greater security
16What improvement does EAP-FASTv2 provide over EAP-FAST
- AIt allow multiple credentials to be passed in a single EAP exchange.
- BIt supports more secure encryption protocols.
- CIt allows faster authentication by using fewer packets.
- DIt addresses security vulnerabilities found in the original protocol.
17What type of attack was the Struxnet virus?
- ACyber warfare
- BHacktivism
- CBotnet
- DSocial Engineering
18Which statement about communication over failover interfaces is true?
- AAll information that is sent over the failover and stateful failover interface is sent as clear text by default.
- BAll information that is sent over the failover interface is sent as clear text but the stateful failover link is encrypted by default.
- CAll information that is sent over the failover and stateful failover interfaces is encrypted by default.
- DUser names, passwords, and preshared keys are encrypted by default when they are sent over the failover and stateful failover interfaces, but other information is sent as clear text.
19Which sensor mode can deny attackers inline?
- AIPS
- BFail-close
- CIDS
- DFail-open
20What is the only permitted operation for processing multicast traffic on zone-based firewalls?
- AOnly control-plane policing can protect the control plane against multi-cast traffic.
- BStateful inspection of multicast traffic is supported only for the self-zone
- CStateful inspection for multicast traffic is supported only between the self-zone and the internal zone.
- DStateful inspection of multi-cast traffic is supported only for the internal zone.
21Which option is the most effective placement of an IPS device within the infrastructure?
- AInline, behind the internet router and firewall.
- BInline, before the internet router and firewall.
- CPromiscously, after the internet router and before the firewall.
- DPromiscously, before the internet router and the firewall
22Which statement about Cisco ACS authentication and authorization is true?
- AACS servers can be clustered to provide scalability
- BACS can query multiple Active Directory domains
- CACS can use only one authorization profile to allow or deny requests
- DACS uses TACACS to proxy other authentication servers
23An attacker installs a rogue switch that sends superior BPDUs on your network. What is a possible result of this activity?
- AThe switch could become the root bridge.
- BThe switch could offer fake DHCP addresses.
- CThe switch could be allowed to join the VTP domain.
- DThe switch could become a transparent bridge.
24Which type of address translation should be used when a Cisco ASA is in transparent mode?
- ADynamic PAT
- BDynamic NAT
- CStatic NAT
- DOverload
25Which command will configure a Cisco ASA firewall to authenticate users when they enter the enable syntax using the local database with no fallback method?
- Aaaa authentication enable console LOCAL
- Baaa authentication enable console SERVER_GROUP LOCAL
- Caaa authentication enable console local-case
- Daaa authentication enable console LOCAL SERVER_GROUP
26What hash type does Cisco use to validate the integrity of downloaded images?
- AMD5
- BSHA1
- CMD1
- DSHA2
27Which NAT option is executed first in case of multiple NAT translations?
- ADynamic NAT with shortest prefix
- BDynamic NAT with longest prefix
- CStatic NAT with shortest prefix
- DStatic NAT with longest prefix
28How can firepower block malicious e-mail attachments?
- AIt forwards email requests to an external signature engine.
- BIt sends the traffic through a file policy.
- CIt scans inbound e-mail messages for known bad URLs.
- DIt send an alert to the administrator to verify suspicious email messages.
29What PAT configuration command allows it to use the next IP in the dynamic pool instead of the next port?
- ANext IP
- BRound Robin
- CDynamic rotation
- DDynamic PAT rotation
30In this simulation, you have access to ASDM only. Review the various ASA configurations using ASDM five multiple choice questions about the ASA SSL VPN configurations.
To access ASDM, click the ASA icon in the topology diagram.
Note: Not all ASDM functionalities are enabled in this simulation.
To see all the menu options available on the left navigation pane, you may also need to unexpand the expanded menu first:
Which two statements regarding the ASA VPN configurations are correct? (choose two)- AThe ASA has a certificate issued by an external Certificate Authority associated to the ASDM_TrustPoint1
- B*Correct*The DefaultWEBVPNGroup Connection Profile is using the AAA with RADIUS server method
- CThe inside-SRV bookmark references the https://192.168.1.2 URL
- D*Correct* Only clientless SSL VPN access is allowed with the Sales group policy
- EAnyConnect, IPSec IKEv1, and IPSec IKEv2 VPN access is enabled on the outside interface
- FThe Inside-SRV bookmark has not been applied to the Sales group policy
31In this simulation, you have access to ASDM only. Review the various ASA configurations using ASDM five multiple choice questions about the ASA SSL VPN configurations.
To access ASDM, click the ASA icon in the topology diagram.
Note: Not all ASDM functionalities are enabled in this simulation.
To see all the menu options available on the left navigation pane, you may also need to unexpand the expanded menu first:
Which user authentication method is used when users login to the Clientless SSLVPN portal using https://209.165.201.2/test?- A*Correct* AAA with LOCAL database
- BAAA with RADIUS server
- CCertificate
- DBoth Certificate with AAA with LOCAL database
- EBoth Certificate and AAA with RADIUS server
32Scenario:
Given the new additional connectivity requirements and the topology diagram, use ASDM to accomplish the required ASA configurations to meet the requirements.
New additional connectivity requirements:
Once the correct ASA configurations have been configured:
To access ASDM, click the ASA icon in the topology diagram.
To access the Firefox Browser on the Outside PC, click the Outside PC icon in the topology diagram.
To access the Command prompt on the Inside PC, click the Inside PC icon in the topology diagram.
Note:
After you make the configuration changes in ASDM, remember to click Apply to apply the configuration changes.
Not all ASDM screens are enabled in this simulation, if some screen is not enabled, try to use different methods to configure the ASA to meet the requirements.
In this simulation, some of the ASDM screens may not look and function exactly like the real ASDM.- A*Correct* A
- BB
- CC
- DD
33In this simulation, you have access to ASDM only. Review the various ASA configurations using ASDM five multiple choice questions about the ASA SSL VPN configurations.
To access ASDM, click the ASA icon in the topology diagram.
Note: Not all ASDM functionalities are enabled in this simulation.
To see all the menu options available on the left navigation pane, you may also need to unexpand the expanded menu first:
Which four tunneling protocols are enabled in the DfltGrpPolicy group policy? (Choose four)- AClientless SSL VPN *Correct*
- BSSL VPN Client
- CPPTP
- DL2TP/IPSec *Correct*
- EIPSec IKEv1 *Correct*
- FIPSec IKEv2 *Correct*
34In this simulation, you have access to ASDM only. Review the various ASA configurations using ASDM five multiple choice questions about the ASA SSL VPN configurations.
To access ASDM, click the ASA icon in the topology diagram.
Note: Not all ASDM functionalities are enabled in this simulation.
To see all the menu options available on the left navigation pane, you may also need to unexpand the expanded menu first:
When users login to the Clientless SSLVPN using https://209.165.201.2/test, which group policy will be applied?- ATest
- BClientless
- CSales *Correct*
- DDfltGrpPolicy
- EDefaultRAGroup
- FDefaultWEBVPNGroup
35Your security team has discovered a malicious program that has been harvesting the CEO's e-mail messages and the company's user database for the last 6 months. What type of attack did your team discover? (Choose two)
- AAdvanced persistent threat
- BTargeted malware
- CDrive-by spyware
- DSocial activism
- EEmail harvesting
36Refer to the following command:
crypto ipsec transform-set myset esp-md5-hmac esp-aes-256
What is the effect of the given command? (Choose two)- AIt merges authentication and encryption methods to protect traffic that matches an ACL.
- BIt configures the network to use a different transform set between peers.
- CIt configures encryption for MD5-HMAC
- DIt configures authentication as AES 256
37Which two statements about stateless firewalls are true? (choose two)
- AThey compare the 5-tuple of each incoming packet against configurable tables
- BThey cannot track connections
- CThey are designed to work most efficiently with stateless protocols such as HTTP or HTTPS.
- DCisco IOS cannot implement them because the platform is stateful by nature
- EThe Cisco ASA is implicitly stateless because it blocks all traffic by default
38What is the purpose of Internet Key Exchange in an IPSec VPN? (Choose two)
- AThe Internet Key Exchange protocol establishes security associations.
- BThe Internet Key Exchange protocol provides data confidentiality.
- CThe Internet Key Exchange protocol provides replay detection.
- DThe Internet Key Exchange protocol is responsible for mutual authentication.
39Which actions can a promiscuous IPS take to mitigate an attack? (Choose three)
- AModifying packets
- BRequesting connection blocking
- CDenying packets
- DResetting the TCP connection
- ERequesting host blocking
- FDenying frames
40What are the primary attack methods of VLAN hopping? (Choose two)
- AVoIP hopping
- BSwitch spoofing
- CCAM-table overflow
- DDouble tagging
41Which two services define cloud networks? (Choose two.)
- AInfrastructure as a Service
- BPlatform as a Service
- CSecurity as a Service
- DCompute as a Service
- ETenancy as a Service
42Which of the following are features of IPsec transport mode? (Choose three)
- AIPsec transport mode is used between end stations.
- BIPsec transport mode is used between gateways.
- CIPsec transport mode supports multi-cast
- DIPsec transport mode supports unicast
- EIPsec transport mode encrypts only the payload
- FIPsec transport mode encrypts the entire packet
43What features can protect the data plane? (Choose three)
- Apolicing
- BACLs
- CIPS
- Dantispoofing
- EQoS
- FDHCP-snooping
44What are the three layers of a hierarchical network design? (Choose three)
- AAccess
- BCore
- CDistribution
- DUser
- EServer
- FInternet
45Which two statements about Telnet access to the ASA are true? (Choose two)
- AYou may VPN to the lowest security interface to telnet to an inside interface
- BYou must configure a AAA server to enable Telnet
- CYou can access all interfaces on an ASA using telnet
- DYou must use the command virtual telnet to enable Telnet
- EBest practice is to disable Telnet and use SSH
46Which three statements about host-based iPS are true? (Choose three)
- AIt can view encrypted files
- BIt can have more restrictive policies than network based IPS
- CIt can generate alerts based on behavior at the desktop level.
- DIt can be deployed at the perimeter
- EIt uses signature-based policies
- FIt works with deployed firewalls
47If a router configuration includes the line
aaa authentication login default group tacacs+ enable
which events will occur when the TACACS+ server returns an error? (choose two)- AThe user will be prompted to authenticate using the enable password
- BAuthentication attempts to the router will be denied
- CAuthentication will use the router's local database
- DAuthentication attempts will be sent to the TACACS+ server
48Which statements about smart tunnels on a Cisco firewall are true? (Choose two)
- ASmart tunnels can be used by clients that do not have administrator privileges.
- BSmart tunnels support all operating systems.
- CSmart tunnels offer better performance than port forwarding.
- DSmart tunnels require the client to have the application locally.
49What three actions are limitations when running an IPS in promiscuous mode? (Choose three)
- ADeny attacker
- BDeny Packet
- CModify Packet
- DRequest Block Connection
- ERequest Block Host
- FReset TCP Connection
50What are two ways to prevent eavesdropping when you preform device-management tasks? (Choose two)
- AUse an SSH connection.
- BUse SNMPv3.
- CUse out-of-band management
- DUse SNMPv2
- EUse in-band management
Información
- Descripción
- This exam tests the candidate's knowledge of secure network infrastructure, understanding core security concepts, managing secure access, VPN encryption, firewalls, intrusion prevention, web and email content security, and endpoint security using: SIEM Technology Cloud & Virtual Network Topologies BYOD Identity Services Engine 802.1x Authentication Cisco FirePOWER Anti-Malware/Cisco Advanced Malware Protection From Cisco.PracticeTest.210-260.v2016-07-06.by.Noah.154q.vce
- Autor
- Mike M
- Idioma
- English
- Visitas
- 4.173
- Historial
- Creado el 24 ago 2016 · actualizado el 6 abr 2018
- Etiquetas
- Valoración
- 4,6 de 5 · 9 valoraciones Valora este test