Quiz
CCNA Security Final Exam v2
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (56)
1Which two types of hackers are typically classified as grey hat hackers? (Choose two.)
- Astate-sponsored hackers
- Bhacktivists
- Ccyber criminals
- Dscript kiddies
- Evulnerability brokers
2Which security implementation will provide management plane protection for a network device?
- Arole-based access control
- Baccess control lists
- Crouting protocol authentication
- Dantispoofing
3Which feature of the Cisco Network Foundation Protection framework prevents a route processor from being overwhelmed by unnecessary traffic?
- AControl Plane Policing
- Bport security
- CIP Source Guard
- Daccess control lists
4Which three areas of router security must be maintained to secure an edge router at the network perimeter? (Choose three.)
- Aflash security
- Boperating system security
- Crouter hardening
- Dzone isolation
- Eremote access security
- Fphysical security
5When configuring SSH on a router to implement secure network management, a network engineer has issued the login local and transport input ssh line vty commands. What three additional configuration actions have to be performed to complete the SSH configuration? (Choose three.)
- AManually enable SSH after the RSA keys are generated.
- BConfigure the correct IP domain name.
- CCreate a valid local username and password database.
- DSet the user privilege levels.
- EGenerate the asymmetric RSA keys.
- FConfigure role-based CLI access.
6What are two drawbacks in assigning user privilege levels on a Cisco router? (Choose two.)
- AOnly a root user can add or remove commands.
- BCommands from a lower level are always executable at a higher level.
- CAssigning a command with multiple keywords allows access to all commands using those keywords.
- DPrivilege levels must be set to permit access control to specific device interfaces, ports, or slots.
- EAAA must be enabled.
7What is a result of enabling the Cisco IOS image resilience feature?
- AThe feature can only be disabled through a console session.
- BImages on a TFTP server can be secured.
- CMultiple primary bootset files can be accessed.
- DSecured files can be viewed in the output of a CLI-issued command.
8What service or protocol does the Secure Copy Protocol rely on to ensure that secure copy transfers are from authorized users?
- AAAA
- BSNMP
- CRADIUS
- DIPsec
9What is a limitation to using OOB management on a large enterprise network?
- ATerminal servers can have direct console connections to user devices needing management.
- BProduction traffic shares the network with management traffic.
- CAll devices appear to be attached to a single management network.
- DOOB management requires the creation of VPNs.
10A syslog server has received the message shown.
*Mar 1 00:07:18.783: %SYS-5-CONFIG_I: Configured from console by vty0 (172.16.45.1)
What can be determined from the syslog message?- AThe message is a normal notification and should not be reviewed.
- BThe message informs the administrator that a user with an IP address of 172.16.45.1 configured this device remotely.
- CThe message is a Log_Alert notification message.
- DThe message description displays that the console line was accessed locally.
11Which service should be disabled on a router to prevent a malicious host from falsely responding to ARP requests with the intent to redirect the Ethernet frames?
- ACDP
- Bproxy ARP
- CLLDP
- Dreverse ARP
12Which three forwarding plane services and functions are enabled by the Cisco AutoSecure feature? (Choose three.)
- Asecure password and login functions
- Btraffic filtering with ACLs
- Clegal notification using a banner
- DCisco IOS firewall inspection
- ECisco Express Forwarding (CEF)
- Fsecure SSH access
13What is the purpose of AAA accounting?
- Ato prove users are who they say they are
- Bto collect and report data usage
- Cto determine which operations the user can perform
- Dto determine which resources the user can access
14What are two protocols that are used by AAA to authenticate users against a central database of usernames and password? (Choose two.)
- ASSH
- BTACACS+
- CRADIUS
- DNTP
- EHTTPS
- FCHAP
15What does the keyword default specify when used with the aaa authentication login command?
- AAuthentication must be specifically set for all lines, otherwise access is denied and no authentication is performed.
- BAuthentication is automatically applied to the con 0, aux, and vty lines.
- CThe local username/password database is accessed for authentication.
- DAuthentication is automatically enabled for the vty lines utilizing the enable password.
16A user complains about not being able to gain access to the network. What command would be used by the network administrator to determine which AAA method list is being used for this particular user as the user logs on?
- Adebug aaa authentication
- Bdebug aaa accounting
- Cdebug aaa protocol
- Ddebug aaa authorization
17What are three characteristics of the RADIUS protocol? (Choose three.)
- Aseparates authentication and authorization processes
- Butilizes TCP port 49
- Cis an open IETF standard AAA protocol
- Dencrypts the entire body of the packet
- Euses UDP ports for authentication and accounting
- Fis widely used in VOIP and 802.1X implementations
18A network administrator is configuring an AAA server to manage RADIUS authentication. Which two features are included in RADIUS authentication? (Choose two.)
- Ahidden passwords during transmission
- Bsingle process for authentication and authorization
- Cencryption for only the data
- Dseparate processes for authentication and authorization
- Eencryption for all communication
19A network administrator is configuring an AAA server to manage TACACS+ authentication. What are two attributes of TACACS+ authentication? (Choose two.)
- Aseparate processes for authentication and authorization
- Bencryption for all communication
- CTCP port 40
- DUDP port 1645
- Esingle process for authentication and authorization
- Fencryption for only the password of a user
20What type of ACL offers greater flexibility and control over network access?
- Anumbered standard
- Bnamed standard
- Cflexible
- Dextended
21Which statement accurately describes Cisco IOS Zone-Based Policy Firewall operation?
- AService policies are applied in interface configuration mode.
- BThe pass action works in only one direction.
- CA router interface can belong to multiple zones.
- DRouter management interfaces must be manually assigned to the self zone.
22How are Intrusion Prevention System (IPS) and Intrusion Detection System (IDS) components used conjunctively?
- AThe IPS will send alert messages when the IDS sends traffic through that is marked as malicious.
- BThe IPS will block all traffic that the IDS does not mark as legitimate.
- CThe IDS blocks offending traffic and the IPS verifies that offending traffic was blocked.
- DThe IDS will send alert messages about "gray area" traffic while the IPS will block malicious traffic.
23What is an advantage of HIPS that is not provided by IDS?
- AHIPS monitors network processes and protects critical files.
- BHIPS provides quick analysis of events through detailed logging.
- CHIPS deploys sensors at network entry points and protects critical network segments.
- DHIPS protects critical system resources and monitors operating system processes.
24Refer to the exhibit. Based on the output generated by the show monitor session 1 command, how will SPAN operate on the switch?
- ANative VLAN traffic transmitted from VLAN 10 or received on VLAN 20 is forwarded to FastEthernet 0/1.
- BAll traffic transmitted from VLAN 10 or received on VLAN 20 is forwarded to FastEthernet 0/1.
- CAll traffic received on VLAN 10 or transmitted from VLAN 20 is forwarded to FastEthernet 0/1.
- DNative VLAN traffic received on VLAN 10 or transmitted from VLAN 20 is forwarded to FastEthernet 0/1.
25What term describes a set of rules used by an IDS or IPS to detect typical intrusion activity?
- Asignature
- Btrigger
- Cevent file
- Ddefinition
26Which router component determines the number of signatures and engines that can be supported in an IPS implementation?
- Aavailable memory
- BUSB availability
- Cnumber of interfaces
- DCPU speed
27A company deploys a network-based IPS. Which statement describes a false negative alarm that is issued by the IPS sensor?
- AAn attack packet passes and no alarm is generated.
- BAn attack packet passes and an alarm is generated
- CA normal user packet passes and an alarm is generated.
- DA normal user packet passes and no alarm is generated.
28Which statement describes the Cisco Cloud Web Security?
- AIt is a secure web server specifically designed for cloud computing.
- BIt is a cloud-based security service to scan traffic for malware and policy enforcement
- CIt is a security appliance that provides an all-in-one solution for securing and controlling web traffic.
- DIt is an advanced firewall solution to guard web servers against security threats.
29What ports can receive forwarded traffic from an isolated port that is part of a PVLAN?
- Aonly isolated ports
- Ball other ports within the same community
- Cother isolated ports and community ports
- Donly promiscuous ports
30Which type of VLAN-hopping attack may be prevented by designating an unused VLAN as the native VLAN?
- ADHCP spoofing
- BVLAN double-tagging
- CDHCP starvation
- DDTP spoofing
31How can DHCP spoofing attacks be mitigated?
- Aby disabling DTP negotiations on nontrunking ports
- Bby implementing DHCP snooping on trusted ports
- Cby implementing port security
- Dby the application of the ip verify source command to untrusted ports
32What is the result of a DHCP starvation attack?
- AClients receive IP address assignments from a rogue DHCP server.
- BThe IP addresses assigned to legitimate clients are hijacked.
- CThe attacker provides incorrect DNS and default gateway information to clients.
- DLegitimate clients are unable to lease IP addresses.
33On what switch ports should PortFast be enabled to enhance STP stability?
- Aonly ports that attach to a neighboring switch
- Bonly ports that are elected as designated ports
- Call trunk ports that are not root ports
- Dall end-user ports
34What can be used as an alternative to HMAC?
- Adigital signatures
- BSHA
- Csymmetric encryption algorithms
- DMD5
35What is a characteristic of asymmetric algorithms?
- AKey management is more difficult with asymmetric algorithms than it is with symmetric algorithms.
- BVery long key lengths are used.
- CBoth the sender and the receiver know the key before communication is shared.
- DAsymmetric algorithms are easier for hardware to accelerate.
36Why is Diffie-Hellman algorithm typically avoided for encrypting data?
- AThe large numbers used by DH make it too slow for bulk data transfers.
- BMost data traffic is encrypted using asymmetrical algorithms.
- CDH runs too quickly to be implemented with a high level of security.
- DDH requires a shared key which is easily exchanged between sender and receiver.
37Which two statements describe the use of asymmetric algorithms? (Choose two.)
- APublic and private keys may be used interchangeably.
- BIf a private key is used to encrypt the data, a private key must be used to decrypt the data.
- CIf a private key is used to encrypt the data, a public key must be used to decrypt the data.
- DIf a public key is used to encrypt the data, a public key must be used to decrypt the data.
- EIf a public key is used to encrypt the data, a private key must be used to decrypt the data.
38A security technician uses an asymmetric algorithm to encrypt messages with a private key and then forwards that data to another technician. What key must be used to decrypt this data?
- AThe public key of the receiver.
- BThe public key of the sender.
- CThe private key of the receiver.
- DThe private key of the sender.
39A company deploys a hub-and-spoke VPN topology where the security appliance is the hub and the remote VPN networks are the spokes. Which VPN method should be used in order for one spoke to communicate with another spoke through the single public interface of the security appliance?
- Ahairpinning
- BMPLS
- Csplit tunneling
- DGRE
40What algorithm is used with IPsec to provide data confidentiality?
- AAES
- BDiffie-Hellman
- CRSA
- DMD5
- ESHA
41What is the function of the Hashed Message Authentication Code (HMAC) algorithm in setting up an IPsec VPN?
- Aguarantees message integrity
- Bcreates a secure channel for key negotiation
- Cprotects IPsec keys during session negotiation
- Dauthenticates the IPsec peers
42What is the next step in the establishment of an IPsec VPN after IKE Phase 1 is complete?
- Anegotiation of the IPsec SA policy
- Bauthentication of peers
- Cdetection of interesting traffic
- Dnegotiation of the ISAKMP policy
43Refer to the exhibit. The ISAKMP policy for the IKE Phase 1 tunnel was configured, but the tunnel does not yet exist. Which action should be taken next before IKE Phase 1 negotiations can begin?
- AConfigure an ACL to define interesting traffic.
- BConfigure the IPsec tunnel lifetime .
- CBind the transform set with the rest of the IPsec policy in a crypto map .
- DConfigure the set of encryption and hashing algorithms that will be used to transform the data sent through the IPsec tunnel.
44Which feature is specific to the Security Plus upgrade license of an ASA 5505 and provides increased availability?
- Arouted mode
- Bredundant ISP connections
- Ctransparent mode
- Dstateful packet inspection
45What is a characteristic of a DMZ zone?
- ATraffic originating from the inside network going to the DMZ network is selectively permitted.
- BTraffic originating from the DMZ network going to the inside network is permitted.
- CTraffic originating from the outside network going to the DMZ network is selectively permitted.
- DTraffic originating from the inside network going to the DMZ network is not permitted.
46What technology is used to separate physical interfaces on the ASA 5505 device into different security zones?
- ANetwork Address Translation
- Bvirtual local-area networks
- Caccess control lists
- Dquality of service
47What is the default preconfigured security level for the outside network interface on a Cisco ASA 5505?
- A0
- B1
- C100
- D255
48What can be configured as part of a network object?
- AIP address and mask
- Bupper layer protocol
- Csource and destination MAC address
- Dinterface type
49Which interface setting can be configured in ASDM through the Device Setup tab?
- Asecurity level
- BNAT
- CEtherChannel
- Dport-security
50What is a characteristic of an ASA site-to-site VPN?
- AThe first echo request packet sent to test the establishment of the tunnel always succeeds.
- BASA site-to-site VPNs can only be established between ASA devices.
- CThe IPsec protocol protects the data transmitted through the site-to-site tunnel.
- DASA site-to-site VPNs create a secure single-user-to-LAN connection.
51Which two end points can be on the other side of an ASA site-to-site VPN configured using ASDM? (Choose two.)
- Aanother ASA
- BISR router
- CFrame Relay switch
- Dmultilayer switch
- EDSL switch
52Which type of ASDM connection would provide secure remote access for remote users into corporate networks?
- AASDM Launcher
- BAnyConnect SSL VPN
- CJava Web Start VPN
- Dsite-to-site VPN
53A security technician is evaluating a new operations security proposal designed to limit access to all servers. What is an advantage of using network security testing to evaluate the new proposal?
- ANetwork security testing proactively evaluates the effectiveness of the proposal before any real threat occurs.
- BNetwork security testing is specifically designed to evaluate administrative tasks involving server and workstation access.
- CNetwork security testing is simple because it requires just one test to evaluate the new proposal.
- DNetwork security testing is most effective when deploying new security proposals.
54What information does the SIEM network security management tool provide to network administrators?
- Adetection of open TCP and UDP ports
- Breal time reporting and analysis of security events
- Cassessment of system security configurations
- Da map of network systems and services
55What three tasks can a network administrator accomplish with the Nmap and Zenmap security testing tools? (Choose three.)
- Apassword recovery
- Boperating system fingerprinting
- Copen UDP and TCP port detection
- Dsecurity event analysis and reporting
- Eassessment of Layer 3 protocol support on hosts
- Fdevelopment of IDS signatures
56Which security document includes implementation details, usually with step-by-step instructions and graphics?
- Aprocedure document
- Bguideline document
- Cstandard document
- Doverview document
Information
- Description
- ccna sec Quiz on CCNA Security Final Exam v2, created by Abdulaziz AlFayyadh on 04/06/2018.
- Author
- Abdulaziz AlFayyadh
- Language
- English
- Views
- 2
- Tags
- Rating
- No ratings yet Rate this quiz