Quiz
CCNA Security 210-260 IINS - Exam 2
Perguntas do quiz (50)
1In which three ways does the RADIUS protocol differ from TACACS? (choose two)
- ARADIUS uses UDP to communicate with the NAS
- BRADIUS encrypts only the password field in an authentication packet
- CRADIUS authenticates and authorizes simultaneously, causing fewer packets to be transmitted
- DRADIUS uses TCP to communicate with the NAS
- ERADIUS can encrypt the entire packet that is sent to the NAS
- FRADIUS supports per-command authorization
2Which countermeasures can mitigate ARP spoofing attacks? (Choose two)
- ADHCP Snooping
- BPort Security
- CDynamic ARP inspection
- DIP Source Guard
3In which three cases does the ASA firewall permit inbound HTTP GET requests during normal operations? (Choose three)
- AWhen matching ACL entries are configures
- BWhen the firewall requires strict HTTP inspection
- CWhen matching NAT entries are configured
- DWhen the firewall receives a SYN packet
- EWhen the firewall receives a SYN-ACK packet
- FWhen the firewall requires HTTP inspection
4In which two situations should you use in-band management? (Choose two)
- AWhen management applications need concurrent access to the devices
- BWhen you require administartor access from multiple locations
- CWhen you require ROMMON access
- DWhen a network device fails to forward packets
- EWhen the control plane fails to respond.
5Which components does HMAC use to determine the authenticity and integrity of a message? (Choose two)
- AThe key
- BThe hash
- CThe password
- DThe transform set
6Which security measures can protect the control plane of a Cisco router? (Choose two)
- ACPPr
- BPort security
- CParser views
- DCoPP
- EAccess control lists
7Which RADIUS server authentication protocols are suported on Cisco ASA firewalls? (Choose three)
- AASCII
- BMS-CHAPv1
- CPAP
- DMS-CHAPv2
- EPEAP
- FEAP
8Which TACACS+ server authentication protocols are supported on Cisco ASA firewalls? (Choose three)
- AASCII
- BMS-CHAPv1
- CEAP
- DMS-CHAPv2
- EPAP
- FPEAP
9Which statement about reflexive access lists are true? (Choose three)
- AReflexive access lists can be attached to extended named IP ACLs
- BReflexive access lists support TCP sessions
- CReflexive access lists approximate the session filtering using the established keyword
- DReflexive access lists create a permanent ACE
- EReflexive access lists can be attached to standard named IP ACLs
- FReflexive access lists support UDP sessions
10According to Cisco best practices, which three protocols should the default ACL allow on an access port to enable wired BYOD devices to supply valid credentials and connect to the network? (Choose three)
- AHTTP
- BTFTP
- C802.1x
- DMAB
- EDNS
- FBOOTP
11Which two next-generation encryption algorithms does Cisco recommend? (Choose two)
- ADH-1024
- BSHA-384
- C3DES
- DMD5
- EDES
- FAES
12Which three statements describe DHCP spoofing attacks? (Choose three)
- AThey are used to perform man-in-the-middle attacks
- BThey can physically modify the network gateway
- CThey can access most network devices
- DThey use ARP poisoning
- EThey protect the identity of the attacker by masking the DHCP address
- FThey can modify traffic in transit
13Which three ESP fields can be encrypted during transmission? (Choose three)
- APadding
- BMAC Address
- CSecurity Parameter Index
- DSequence Number
- ENext Header
- FPad Length
14In which three ways does the TACACS protocol differ from RADIUS? (Choose three)
- ATACACS uses UDP to communicate with the NAS
- BTACACS suports per-command authorization
- CTACACS can encrypt the entire packet that is sent to the NAS
- DTACACS encrypts only the password field in an authentication packet
- ETACACS uses TCP to communicate with the NAS
- FTACACS authenticates and authorizes simultaneously, causing fewer packets to be transmitted.
15Which accounting notices are used to send a failed authentication attempt record to a AAA server? (Choose two)
- AStop
- BStop-record
- CStop-only
- DStart-Stop
16Which options are filtering options used to display SDEE message types? (Choose two)
- AAll
- BStop
- CError
- DNone
17Which protocols use encryption to protect the confidentiality of data transmitted between two parties? (Choose two)
- AHTTPS
- BSSH
- CAAA
- DHTTP
- ETelnet
- FFTP
18What are two uses of SIEM software? (Choose two)
- APerforming automatic network audits
- BCollecting and archiving syslog data
- CScanning email for suspicious attachments
- DConfiguring firewall and IDS devices
- EAlerting administrators to security events in real time
19You want to allow all of your company's users to access the Internet without allowing other web servers to collect the IP Addresses of individual users. What two solutions can you use? (Choose two)
- AConfigure a firewall to use Port Address Translation
- BConfigure a proxy server to hide users' local IP Addresses
- CInstall a Web content filter to hide users' local IP Addresses
- DAssign the same IP address to all users
- EAssign unique IP addresses to all users
20A data breach has occurred and your company database has been copied. Which security principle has been violated?
- AAccess
- BControl
- CAvailability
- DConfidentiality
21Which alert protocol is used with Cisco IPS Manager Express to support up to 10 sensors?
- ASDEE
- BCSM
- CSyslog
- DSNMP
22How can you detect a false negative on an IPS?
- AReview the IPS log
- BReview the IPS console
- CUse a third-party to audit the next-generation firewall rules
- DUse a third-party system to perform penetration testing
- EView the alert on the IPS
23Which statement provides the best definition of malware?
- AMalware is tools and applications that remove unwanted programs
- BMalware is software used by nation states to commit cyber crimes
- CMalware is unwanted software that is harmful or destructive
- DMalware is a collection of worms, viruses, and Trojan horses that is distributed as a single package
24How can FirePOWER block malicious email attachments?
- AIt forwards email requrests to an external signature engine.
- BIt scans inbound email messages for known bad URLs
- CIt send an alert to the administrator to verify suspicious email messages
- DIt send the traffic through a file policy
25A clientless SSL VPN user who is connecting on a Windows Vista computer is missing the menu option for Remote Desktop Protocol on the portal web page. Which action should you take to begin troubleshooting?
- AInstruct the user to reconnect to the VPN gateway
- BEnsure that the RDP plug-in is installed on the VPN gateway
- CReboot the VPN gateway
- DEnsure that the RDP2 plug-in is installed on the VPN gateway
26Refer to the following commands:
crypto map mymap match address 201
access-list 201 permit ip 10.10.10.0 255.255.255.0 10.100.100.0 255.255.255.0
What is the effect of the given command sequence?- AIt defines IKE policy for traffic sourced from the 10.100.100.0/24 with a destination of 10.10.10.0/24
- BIt defines IPsec policy for traffic sourced from the 10.100.100.0/24 with a destination of 10.10.10.0/24
- CIt defines IPsec policy for traffic sourced from the 10.10.10.0/24 with a destination of 10.100.100.0/24
- DIt defines IKE policy for traffic sourced from the 10.10.10.0/24 with a destination of 10.100.100.0/24
27Which Cisco Security Manager application collects information about the device status and uses it to generate notifications and alerts?
- AHealth and Performance monitor
- BDevice Manager
- CFlexConfig
- DReport Manager
28You have been tasked with blocking user access to websites that violate company policy, but the sites use dynamic IP addresses. What is the best practice for URL filtering to solve the problem?
- AEnable URL filtering and create a whitelist to block websites that violate company policy.
- BEnable URL filtering and use URL categorization to block the websites that violate company policy.
- CEnable URL filtering and use URL categorization to allow only the websites that company policy allows users to access
- DEnable URL filtering and create a blacklist to block the websites that violate company policy
- EEnable URL filtering and create a whitelist to allow only the websites that company policy allows users to access
29Which Sourcefire event action should you choose if you want to block only malicious traffic from a particular end user?
- AAllow with inspection
- BBlock
- CAllow without inspection
- DMonitor
- ETrust
30You have implemented a Sourcefire IPS and configured it to block certain addresses utilizing Security intelligence iP Address Reputation. A user calls and is not able to access a certain IP Address. What action can you take to allow the user access to the IP address?
- ACreate a user based access control rule to allow the traffic
- BCreate a custom blacklist to allow the traffic
- CCreate a whitelist and add the appropriate IP address to allow the traffic
- DCreate a network based access control rule to allow the traffic
- ECreate a rule to bypass inspection to allow the traffic
31Refer to the following commands:
authentication event fail action next-method
authentication event no-response action authorize vlan 101
authentication order mab dot1x webauth
authentication priority dot1x mab
authentication port-control auto
dot1x pae authenticator
If a supplicant supplies incorrect credentials for all authentication methods configured on the switch, how will the switch respond?- AThe authentication attempt will time out and the switch will place the port into unauthorized state.
- BThe switch will cycle through the configured authentication methods indefinitely.
- CThe authentication attempt will time out and the switch will place the port into VLAN 101.
- DThe supplicant will fail to advance beyond the webauth method
32In which stage on an attack does the attacker discover devices on a target network?
- ACovering tracks
- BMaintaining access
- CGaining access
- DReconnaissance
33Which statement about personal firewalls is true?
- AThey can protect a system by denying probing requests.
- BThey can protect the network against attacks.
- CThey can protect email messages and private documents in a similar way to a VPN.
- DThey are resilient against kernel attacks.
34What is a possible reason for the error message:
Router(config)#aaa server?
% Unrecognized command- AThe router is already running the latest operating system
- BThe command is invalid on the target device
- CThe router is a new device on which the aaa new-model command must be applied before continuing
- DThe command syntax requires a space after the word "server"
35Which command is needed to enable SSH support on a Cisco Router?
- Acrypto key unlock rsa
- Bcrypto key lock rsa
- Ccrypto key generate rsa
- Dcrypto key zeorize rsa
36What is the transition order of STP in states on a Layer 2 switch interface?
- Ablocking, listening, learning, forwarding, disabled
- Bforwarding, listening, learning, blocking, disabled
- Clistening, learning, blocking, forwarding, disabled
- Dlistening, blocking, learning, forwarding, disabled
37Which type of PVLAN port allows hosts in the same VLAN to communicate directly with each other?
- ACommunity for hosts in the PVLAN
- BSpan for hosts in the PVLAN
- CIsolated for hosts in the PVLAN
- DPromiscuous for hosts in the PVLAN
38What is the default timeout interval during which a router waits for responses from a TACACS server before declaring a timeout failure?
- A5 seconds
- B10 seconds
- C15 seconds
- D20 seconds
39Refer to the following output:
R1>show clock detail
.22.22:35.123 UTC Tue Feb 26 2013
Time source is NTP
Which statement about the device time is true?- AThe time is not authoritative
- BNTP is configured incorrectly
- CThe clock is out of sync
- DThe time is authoritative because the clock is in sync
- EThe time is authoritative, but the NTP process has lost contact with its servers
40Refer to the following output:
209.114.111.1 configured, ipv4, sane, valid, stratum 2
ref ID 132.163.4.103 , time D7AD124D.9D6FC576 (03:17:33.614 UTC Sun Aug 31 2014)
our mode client, peer mode server, our poll intvl 64, peer poll intvl 64
root delay 46.34 msec, root disp 23.52, reach 1, sync dist 268.59
delay 63.27msec, offset 7.9817 msec, dispersion 107.56, jitter 2.07 msec
precision 2**23, version 4
204.2.134.164 configured, ipv4, sane, valid, stratum 2
ref ID 10.241.199.164.101, time D7AD1419.9EB5272B (03:25:13.619 UTC Sun Aug 31 2014)
our mode client, peer mode server, our poll intvl 64, peer poll intvl 256
root delay 30.83 msec, root disp 4.88, reach 1, sync dist 223.80
delay 58.68msec, offset 6.4331 msec, dispersion 187.55, jitter 1.38 msec
precision 2**20, version 4
192.168.10.7 configured, ipv4, our_master, sane, valid, stratum 3
ref ID 106.61.73.243 , time D7AD0D8F.AE79A23A (02:57:19.681 UTC Sun Aug 31 2014)
our mode client, peer mode server, our poll intvl 64, peer poll intvl 64
root delay 86.45 msec, root disp 87.82, reach 377, sync dist 134.25
delay 0.89 msec, offset 19.5087 msec, dispersion 1.69, jitter 0.84 msec
precision 2**32, version 4
With which NTP server has the router synchronized?- A204.2.134.164
- B192.168.10.7
- C209.114.111.1
- D132.163.4.103
- E241.199.164.101
- F108.61.73.243
41For what reason would you configure multiple security contexts on the ASA firewall?
- ATo provide redundancy and high availability within the organization.
- BTo enable the use of VRFs on routers that are adjacently connected
- CTo separate different departments and business units
- DTo enable the use of multicast routing and QoS through the firewall
42Which type of encryption technology has the broadest platform support to protect operating systems?
- Afile-level
- Bsoftware
- Chardware
- Dmiddleware
43Which type of security control is defense in depth?
- ABotnet mitigation
- BOvert and covert channels
- CThreat mitigation
- DRisk analysis
44When an IPS detects an attack, which action can the IPS take to prevent the attack from spreading?
- ADeny the connection inline
- BDeploy an antimalware system
- CPerform a Layer 6 reset
- DEnable bypass mode
45Which FirePOWER preprocessor engine is used to prevent SYN attacks?
- AInline Normalization
- BIP Defragmentation
- CRate-Based Prevention
- DPortscan Detection
46What is a potential drawback to leaving VLAN 1 as the native VLAN?
- AThe CAM might be overloaded, effectively turning the switch into a hub.
- BGratititous ARPs might be able to conduct a man-in-the-middle attack.
- CIt may be susceptible to a VLAN hopping attack.
- DVLAN 1 might be vulnerable to IP Address spoofing.
47Which Cisco feature can help mitigate spoofing attacks by verifying symmetry of the traffic path?
- AUnicast Reverse Path Forwarding
- BUnidirectional Link Detection
- CIP Source Guard
- DTrustSec
48If a switch receives a superior BPDU and goes directly into a blocked state, what mechanism must be in use?
- AEtherChannel guard
- BLoop guard
- CPortFast
- DBPDU Guard
49How does the Cisco ASA use Active Directory to authorize VPN users?
- AIt send the username and password to retrieve an ACCEPT or REJECT message from the Active Directory server
- BIt queries the Active Directory server for a specific attribute for the specified user
- CIt downloads and stores the Active Directory database to query for future authorization requests
- DIt redirects requests to the Active Directory server defined for the VPN group.
50What command can you use to verify the binding table status?
- Ashow ip dhcp snooping database
- Bshow ip dhcp snooping statistics
- Cshow ip dhcp pool
- Dshow ip dhcp source binding
- Eshow ip dhcp snooping binding
- Fshow ip dhcp snooping
Informações
- Descrição
- This exam tests the candidate's knowledge of secure network infrastructure, understanding core security concepts, managing secure access, VPN encryption, firewalls, intrusion prevention, web and email content security, and endpoint security using: SIEM Technology Cloud & Virtual Network Topologies BYOD Identity Services Engine 802.1x Authentication Cisco FirePOWER Anti-Malware/Cisco Advanced Malware Protection From Cisco.PracticeTest.210-260.v2016-07-06.by.Noah.154q.vce
- Autor
- Mike M
- Idioma
- English
- Visualizações
- 4.634
- Etiquetas
- Avaliação
- 4,6 de 5 · 9 avaliações Avalie este quiz