Quiz
CCNA Security Chapter 5 Exam
Perguntas do quiz (23)
1What information must an IPS track in order to detect attacks matching a composite signature?
- Athe total number of packets in the attack
- Bthe attacking period used by the attacker
- Cthe network bandwidth consumed by all packets
- Dthe state of packets related to the attack
2What is a disadvantage of a pattern-based detection mechanism?
- AThe normal network traffic pattern must be profiled first
- BIt cannot detect unknown attacks
- CIt is difficult to deploy in a large network
- DIts configuration is complex
3What is the purpose in configuring an IOS IPS crypto key when enabling IOS IPS on a Cisco router?
- Ato secure the IOS image in flash
- Bto enable Cisco Configuration Professional to be launched securely
- Cto encrypt the master signature file
- Dto verify the digital signature for the master signature file
4Refer to the exhibit. What is the result of issuing the Cisco IOS IPS commands on router R1?
- AAll traffic that is permitted by the ACL is subject to inspection by the IPS
- BA named ACL determines the traffic to be inspected
- CAll traffic that is denied by the ACL is subject to inspection by the IPS
- DA numbered ACL is applied to S0/0/0 in the outbound directio
5Which two benefits does the IPS version 5.x signature format provide over the version 4.x signature format? (Choose two.)
- Asupport for IPX and AppleTalk protocols
- Baddition of signature micro engines
- Csupport for comma-delimited data import
- Dsupport for encrypted signature parameters
- Eaddition of a signature risk rating
6Which type of IPS signature detection is used to distract and confuse attackers?
- Ahoneypot-based detection
- Bpolicy-based detection
- Cpattern-based detection
- Danomaly-based detection
7Which statement is true about an atomic alert that is generated by an IPS?
- AIt is an alert that is used only when a logging attack has begun
- BIt is a single alert sent for multiple occurrences of the same signature
- CIt is an alert that is generated every time a specific signature has been found
- DIt is both a normal alarm and a summary alarm being sent simultaneously at set intervals
8A system analyst is configuring and tuning a recently deployed IPS appliance. By examining the IPS alarm log, the analyst notices that the IPS does not generate alarms for a few known attack packets. Which term describes the lack of alarms by the IPS?
- Atrue negative
- Bfalse positive
- Cfalse negative
- Dtrue positive
9A security specialist configures an IPS so that it will generate an alert when an attack is first detected. Alerts for the subsequent detection of the same attack are suppressed for a pre-defined period of time. Another alert will be generated at the end of the period indicating the number of the attack detected. Which IPS alert monitoring mechanism is configured?
- Acomposite alert
- Batomic alert
- Ccorrelation alert
- Dsummary alert
10In configuring a Cisco router to prepare for IPS and VPN features, a network administrator opens the file realm-cisco.pub.key.txt, and copies and pastes the contents to the router at the global configuration prompt. What is the result after this configuration step?
- AThe router is authenticated with the Cisco secure IPS resource web server
- BA pair of public/secret keys is created for IPsec VPN operation
- CA crypto key is created for IOS IPS to verify the master signature file
- DA pair of public/secret keys is created for the router to serve as an SSH server
11Refer to the exhibit. Based on the configuration, which traffic will be examined by the IPS that is configured on router R1?
- Atraffic that is destined to LAN 1 and LAN 2
- Breturn traffic from the web server
- Ctraffic that is initiated from LAN 1 and LAN 2
- Dno traffic will be inspected
- Ehttp traffic that is initiated from LAN 1
12Refer to the exhibit. Based on the IPS configuration provided, which conclusion can be drawn?
- AThe signatures in all categories will be compiled into memory and used by the IPS
- BThe signatures in all categories will be retired and not be used by the IPS
- COnly the signatures in the ios_ips basic category will be compiled into memory and used by the IPS
- DThe signatures in the ios_ips basic category will be retired and the remaining signatures will be compiled into memory and used by the IPS
13A network administrator is configuring an IOS IPS with the command
R1(config)# ip ips signature-definition
Which configuration task can be achieved with this command?- ARetire or unretire the ios_ips basic signature category
- BRetire or unretire an individual signature
- CRetire or unretire the all signature category
- DRetire or unretire the all atomic signatures category
14What are two disadvantages of using an IDS? (Choose two.)
- AThe IDS analyzes actual forwarded packets
- BThe IDS does not stop malicious traffic
- CThe IDS has no impact on traffic
- DThe IDS works offline using copies of network traffic
- EThe IDS requires other devices to respond to attacks
15What are two shared characteristics of the IDS and the IPS? (Choose two.)
- ABoth use signatures to detect malicious traffic
- BBoth analyze copies of network traffic
- CBoth have minimal impact on network performance
- DBoth rely on an additional network device to respond to malicious traffic
- EBoth are deployed as sensors
16Refer to the exhibit. A network administrator enters the command on a Cisco IOS IPS router. What is the effect?
- AAlert messages are sent in syslog format
- BAlert messages are sent in trace file format
- CAlert messages are sent in Security Device Event Exchange (SDEE) format
- DAlert messages are sent in event log format
17A network administrator suspects the default setting of the ip ips notify sdee command has caused performance degradation on the Cisco IOS IPS router. The network administrator enters the ip sdee events 50 command in an attempt to remedy the performance issues. What is the immediate effect of this command?
- AAll events that were stored in the original buffer are saved, while a new buffer is created to store new events
- BAll events that were stored in the previous buffer are lost
- CThe newest 50 events from the original buffer are saved and all others are deleted
- DThe oldest 50 events of the original buffer are deleted
18True or False?
A Cisco IDS does not affect the flow of traffic when it operates in promiscuous mode- AVerdadeiro
- BFalso
19What is a required condition to enable IPS activity reporting using the SDEE format?
- ACreate an IOS IPS configuration directory in flash
- BEnable an HTTP or HTTPS service on the router
- CConfigure the signature category
- DIssue the ip ips notify log command
20Refer to the exhibit. Which statement best describes how incoming traffic on serial 0/0 is handled?
- ATraffic that is coming from any source other than 172.31.235.0/24 will be scanned and reported
- BTraffic not matching ACL 100 will be dropped
- CTraffic not matching ACL 100 will be scanned and reported
- DTraffic that is sourced from 172.31.235.0/24 will be sent directly to its destination without being scanned or reported
- ETraffic matching ACL 100 will be scanned and reported
- FTraffic that is sourced from 172.31.235.0/24 will be scanned and reported
21What is a disadvantage of network-based IPS as compared to host-based IPS?
- ANetwork-based IPS is less cost-effective
- BNetwork-based IPS should not be used with multiple operating systems
- CNetwork-based IPS cannot examine encrypted traffic
- DNetwork-based IPS does not detect lower level network events
22n IPS sensor has detected the string confidential across multiple packets in a TCP session. Which type of signature trigger and signature type does this describe?
- ATrigger: Policy-based detection
Type: Atomic signature - BTrigger: Policy-based detection
Type: Composite signature - CTrigger: Anomaly-based detection
Type: Atomic signature - DTrigger: Anomaly-based detection
Type: Composite signature - ETrigger: Pattern-based detection
Type: Atomic signatur - FTrigger: Pattern-based detection
Type: Composite signature
- ATrigger: Policy-based detection
23What are two drawbacks to using HIPS? (Choose two.)
- AWith HIPS, the success or failure of an attack cannot be readily determined
- BWith HIPS, the network administrator must verify support for all the different operating systems used in the network.
- CHIPS has difficulty constructing an accurate network picture or coordinating events that occur across the entire network
- DIf the network traffic stream is encrypted, HIPS is unable to access unencrypted forms of the traffic
- EHIPS installations are vulnerable to fragmentation attacks or variable TTL attacks
Informações
- Descrição
- CCNA Security v2.0 Chapter 5 Exam
- Autor
- d94829 d94829
- Idioma
- English
- Visualizações
- 780
- Etiquetas
- Avaliação
- Ainda sem avaliações Avalie este quiz