Quiz
QUIZZ ingles
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (144)
1What are two hashing algorithms used with IPsec AH to guarantee authenticity? (Choose two.)
- ASHA
- BRSA
- CDH
- DMD5
- EAES
2Which command raises the privilege level of the ping command to 7?
- Auser exec ping level 7
- Bauthorization exec ping level 7
- Caccounting exec level 7 ping
- Dprivilege exec level 7 ping
3What is a characteristic of a role-based CLI view of router configuration?
- AA CLI view has a command hierarchy, with higher and lower views.
- BWhen a superview is deleted, the associated CLI views are deleted.
- CA single CLI view can be shared within multiple superviews.
- DOnly a superview user can configure a new view and add or remove commands from the existing views.
4What is a limitation to using OOB management on a large enterprise network?
- AProduction traffic shares the network with management traffic.
- BTerminal servers can have direct console connections to user devices needing management.
- COOB management requires the creation of VPNs.
- DAll devices appear to be attached to a single management network.
5Refer to the exhibit. A corporate network is using NTP to synchronize the time across devices. What can be determined from the displayed output?
- ARouter03 is a stratum 2 device that can provide NTP service to other devices in the network.
- BThe time on Router03 may not be reliable because it is offset by more than 7 seconds to the time server.
- CThe interface on Router03 that connects to the time sever has the IPv4 address 209.165.200.225.
- DRouter03 time is synchronized to a stratum 2 time server.
6Refer to the exhibit. Which two conclusions can be drawn from the syslog message that was generated by the router? (Choose two.)
- AThis message resulted from an unusual error requiring reconfiguration of the interface.
- BThis message indicates that service timestamps have been configured.
- CThis message indicates that the interface changed state five times.
- DThis message is a level 5 notification message.
- EThis message indicates that the interface should be replaced.
7Which two types of hackers are typically classified as grey hat hackers? (Choose two.)
- Ahacktivists
- Bcyber criminals
- Cvulnerability brokers
- Dscript kiddies
- Estate-sponsored hackers
8When describing malware, what is a difference between a virus and a worm?
- AA virus focuses on gaining privileged access to a device, whereas a worm does not.
- BA virus replicates itself by attaching to another file, whereas a worm can replicate itself independently.
- CA virus can be used to launch a DoS attack (but not a DDoS), but a worm can be used to launch both DoS and DDoS attacks.
- DA virus can be used to deliver advertisements without user consent, whereas a worm cannot.
9Which type of packet is unable to be filtered by an outbound ACL?
- Amulticast packet
- BICMP packet
- Cbroadcast packet
- Drouter-generated packet
10Consider the access list command applied outbound on a router serial interface.
- AThe only traffic denied is echo-replies sourced from the 192.168.10.0/24 network. All other traffic is allowed.
- BThe only traffic denied is ICMP-based traffic. All other traffic is allowed.
- CNo traffic will be allowed outbound on the serial interface.
- DUsers on the 192.168.10.0/24 network are not allowed to transmit traffic to any other destination.
11Which command is used to activate an IPv6 ACL named ENG_ACL on an interface so that the router filters traffic prior to accessing the routing table?
- Aipv6 access-class ENG_ACL in
- Bipv6 traffic-filter ENG_ACL out
- Cipv6 traffic-filter ENG_ACL in
- Dipv6 access-class ENG_ACL out
12What technology has a function of using trusted third-party protocols to issue credentials that are accepted as an authoritative identity?
- Adigital signatures
- Bhashing algorithms
- CPKI certificates
- Dsymmetric keys
13What are two methods to maintain certificate revocation status? (Choose two.)
- Asubordinate CA
- BOCSP
- CDNS
- DLDAP
- ECRL
14Which protocol is an IETF standard that defines the PKI digital certificate format?
- ASSL/TLS
- BX.500
- CLDAP
- DX.509
15A network administrator is configuring DAI on a switch. Which command should be used on the uplink interface that connects to a router?
- Aip arp inspection trust
- Bip dhcp snooping
- Cip arp inspection vlan
- Dspanning-tree portfast
16What is the best way to prevent a VLAN hopping attack?
- ADisable trunk negotiation for trunk ports and statically set nontrunk ports as access ports.
- BDisable STP on all nontrunk ports.
- CUse VLAN 1 as the native VLAN on trunk ports.
- DUse ISL encapsulation on all trunk links.
17What would be the primary reason an attacker would launch a MAC address overflow attack?
- Aso that the switch stops forwarding traffic
- Bso that legitimate hosts cannot obtain a MAC address
- Cso that the attacker can see frames that are destined for other hosts
- Dso that the attacker can execute arbitrary code on the switch
18What is the main difference between the implementation of IDS and IPS devices?
- AAn IDS can negatively impact the packet flow, whereas an IPS can not.
- BAn IDS needs to be deployed together with a firewall device, whereas an IPS can replace a firewall.
- CAn IDS would allow malicious traffic to pass before it is addressed, whereas an IPS stops it immediately.
- DAn IDS uses signature-based technology to detect malicious packets, whereas an IPS uses profile-based technology.
19Which attack is defined as an attempt to exploit software vulnerabilities that are unknown or undisclosed by the vendor?
- Azero-day
- BTrojan horse
- Cbrute-force
- Dman-in-the-middle
20What are the three signature levels provided by Snort IPS on the 4000 Series ISR? (Choose three.)
- Asecurity
- Bdrop
- Creject
- Dconnectivity
- Einspect
- Fbalanced
21What are three attributes of IPS signatures? (Choose three.)
- Aaction
- Blength
- Ctrigger
- Dtype
- Edepth
- Ffunction
22Which two features are included by both TACACS+ and RADIUS protocols? (Choose two.)
- ASIP support
- Bpassword encryption
- C802.1X support
- Dseparate authentication and authorization processes
- Eutilization of transport layer protocols
23What function is provided by the RADIUS protocol?
- ARADIUS provides encryption of the complete packet during transfer.
- BRADIUS provides separate AAA services.
- CRADIUS provides separate ports for authorization and accounting.
- DRADIUS provides secure communication using TCP port 49.
24What are three characteristics of the RADIUS protocol? (Choose three.)
- Autilizes TCP port 49
- Buses UDP ports for authentication and accounting
- Csupports 802.1X and SIP
- Dseparates the authentication and authorization processes
- Eencrypts the entire body of the packet
- Fis an open RFC standard AAA protocol
25Which zone-based policy firewall zone is system-defined and applies to traffic destined for the router or originating from the router?
- Alocal zone
- Binside zone
- Cself zone
- Dsystem zone
- Eoutside zone
26What are two benefits of using a ZPF rather than a Classic Firewall? (Choose two.)
- AZPF allows interfaces to be placed into zones for IP inspection.
- BThe ZPF is not dependent on ACLs.
- CMultiple inspection actions are used with ZPF.
- DZPF policies are easy to read and troubleshoot.
- EWith ZPF, the router will allow packets unless they are explicitly blocked.
27How does a firewall handle traffic when it is originating from the private network and traveling to the DMZ network?
- AThe traffic is selectively denied based on service requirements.
- BThe traffic is usually permitted with little or no restrictions.
- CThe traffic is selectively permitted and inspected.
- DThe traffic is usually blocked.
28Which two protocols generate connection information within a state table and are supported for stateful filtering? (Choose two.)
- AICMP
- BUDP
- CDHCP
- DTCP
- EHTTP
29Which type of firewall is supported by most routers and is the easiest to implement?
- Anext generation firewall
- Bstateless firewall
- Cstateful firewall
- Dproxy firewall
30What network testing tool would an administrator use to assess and validate system configurations against security policies and compliance standards?
- ATripwire
- BL0phtcrack
- CNessus
- DMetasploit
31What type of network security test can detect and report changes made to network systems?
- Avulnerability scanning
- Bnetwork scanning
- Cintegrity checking
- Dpenetration testing
32What network security testing tool has the ability to provide details on the source of suspicious network activity?
- ASIEM
- BSuperScan
- CZenmap
- DTripwire
33How do modern cryptographers defend against brute-force attacks?
- AUse statistical analysis to eliminate the most common encryption keys.
- BUse a keyspace large enough that it takes too much money and too much time to conduct a successful attack.
- CUse an algorithm that requires the attacker to have both ciphertext and plaintext to conduct a successful attack.
- DUse frequency analysis to ensure that the most popular letters used in the language are not used in the cipher message.
34How does a Caesar cipher work on a message?
- ALetters of the message are replaced by another letter that is a set number of places away in the alphabet.
- BLetters of the message are rearranged randomly.
- CLetters of the message are rearranged based on a predetermined pattern.
- DWords of the message are substituted based on a predetermined pattern.
35What is the main factor that ensures the security of encryption of modern algorithms?
- Acomplexity of the hashing algorithm
- Bthe use of 3DES over AES
- Csecrecy of the keys
- Dsecrecy of the algorithm
36 What is the next step in the establishment of an IPsec VPN after IKE Phase 1 is complete?
- Anegotiation of the ISAKMP policy
- Bnegotiation of the IPsec SA policy
- Cdetection of interesting traffic
- Dauthentication of peers
37Refer to the exhibit. What algorithm will be used for providing confidentiality?
- ARSA
- BDiffie-Hellman
- CDES
- DAES
38After issuing a show run command, an analyst notices the following command:
- AIt establishes the set of encryption and hashing algorithms used to secure the data sent through an IPsec tunnel.
- BIt defines the default ISAKMP policy list used to establish the IKE Phase 1 tunnel.
- CIt establishes the criteria to force the IKE Phase 1 negotiations to begin.
- DIt indicates that IKE will be used to establish the IPsec tunnel for protecting the traffic.
39Which algorithm can ensure data integrity?
- ARSA
- BAES
- CMD5
- DPKI
40A company implements a security policy that ensures that a file sent from the headquarters office to the branch office can only be opened with a predetermined code. This code is changed every day. Which two algorithms can be used to achieve this task? (Choose two.)
- AHMAC
- BMD5
- C3DES
- DSHA-1
- EAES
41A network technician has been asked to design a virtual private network between two branch routers. Which type of cryptographic key should be used in this scenario?
- Ahash key
- Bsymmetric key
- Casymmetric key
- Ddigital signature
42Which two options can limit the information discovered from port scanning? (Choose two.)
- Aintrusion prevention system
- Bfirewall
- Cauthentication
- Dpasswords
- Eencryption
43An administrator discovers that a user is accessing a newly established website that may be detrimental to company security. What action should the administrator take first in terms of the security policy?
- AAsk the user to stop immediately and inform the user that this constitutes grounds for dismissal.
- BCreate a firewall rule blocking the respective website.
- CRevise the AUP immediately and get all users to sign the updated AUP.
- DImmediately suspend the network privileges of the user.
44If AAA is already enabled, which three CLI steps are required to configure a router with a specific view? (Choose three.)
- ACreate a superview using the parser view view-name command.
- BAssociate the view with the root view.
- CAssign users who can use the view.
- DCreate a view using the parser viewcommand.
- EAssign a secret password to the view.
- FAssign commands to the view.
45Refer to the exhibit. A network administrator configures a named ACL on the router. Why is there no output displayed when the show command is issued?
- AThe ACL is not activated.
- BThe ACL name is case sensitive.
- CThe ACL has not been applied to an interface.
- DNo packets have matched the ACL statements yet.
46ACLs are used primarily to filter traffic. What are two additional uses of ACLs? (Choose two.):
- Aspecifying internal hosts for NAT
- Bidentifying traffic for QoS
- Cspecifying source addresses for authentication
- Dreorganizing traffic into VLANs
- Efiltering VTP packets
47What two features are added in SNMPv3 to address the weaknesses of previous versions of SNMP? (Choose two.)
- Aauthentication
- Bauthorization with community string priority
- Cbulk MIB objects retrieval
- DACL management filtering
- Eencryption
48What network testing tool is used for password auditing and recovery?
- ANessus
- BMetasploit
- CL0phtcrack
- DSuperScan
49Which type of firewall makes use of a server to connect to destination devices on behalf of clients?
- Apacket filtering firewall
- Bproxy firewall
- Cstateless firewall
- Dstateful firewall
50Refer to the exhibit. What will be displayed in the output of the show running-config object command after the exhibited configuration commands are entered on an ASA 5506-X?
- Ahost 192.168.1.4
- Brange 192.168.1.10 192.168.1.20
- Chost 192.168.1.3, host 192.168.1.4, and range 192.168.1.10 192.168.1.20
- Dhost 192.168.1.3
- Ehost 192.168.1.3 and host 192.168.1.4
- Fhost 192.168.1.4 and range 192.168.1.10 192.168.1.20
51Refer to the exhibit. According to the command output, which three statements are true about the DHCP options entered on the ASA? (Choose three.)
- AThe dhcpd address [ start-of-pool ]-[ end-of-pool ] inside command was issued to enable the DHCP server.
- BThe dhcpd address [ start-of-pool ]-[ end-of-pool ] inside command was issued to enable the DHCP client.
- CThe dhcpd enable inside command was issued to enable the DHCP server.
- DThe dhcpd auto-config outside command was issued to enable the DHCP client.
- EThe dhcpd auto-config outside command was issued to enable the DHCP server.
- FThe dhcpd enable inside command was issued to enable the DHCP client.
52Which two statements describe the characteristics of symmetric algorithms? (Choose two.)
- AThey are commonly used with VPN traffic.
- BThey use a pair of a public key and a private key.
- CThey are commonly implemented in the SSL and SSH protocols.
- DThey provide confidentiality, integrity, and availability.
- EThey are referred to as a pre-shared key or secret key.
53A web server administrator is configuring access settings to require users to authenticate first before accessing certain web pages. Which requirement of information security is addressed through the configuration?
- Aavailability
- Bintegrity
- Cconfidentiality
- Dscalability
54The use of 3DES within the IPsec framework is an example of which of the five IPsec building blocks?
- Aauthentication
- Bnonrepudiation
- Cintegrity
- DDiffie-Hellman
- Econfidentiality
55What function is provided by Snort as part of the Security Onion?
- Ato generate network intrusion alerts by the use of rules and signatures
- Bto normalize logs from various NSM data logs so they can be represented, stored, and accessed through a common schema
- Cto display full-packet captures for analysis
- Dto view pcap transcripts generated by intrusion detection tools
- ESnort is a NIDS integrated into Security Onion. It is an important source of the alert data that is indexed in the Sguil analysis tool. Snort uses rules and signatures to generate alerts.
56What are two drawbacks to using HIPS? (Choose two.)
- AWith HIPS, the success or failure of an attack cannot be readily determined.
- BWith HIPS, the network administrator must verify support for all the different operating systems used in the network.
- CHIPS has difficulty constructing an accurate network picture or coordinating events that occur across the entire network.
- DIf the network traffic stream is encrypted, HIPS is unable to access unencrypted forms of the traffic.
- EHIPS installations are vulnerable to fragmentation attacks or variable TTL attacks.
57In an AAA-enabled network, a user issues the configure terminal command from the privileged executive mode of operation. What AAA function is at work if this command is rejected?
- Aauthorization
- Bauthentication
- Cauditing
- Daccounting
58A company has a file server that shares a folder named Public. The network security policy specifies that the Public folder is assigned Read-Only rights to anyone who can log into the server while the Edit rights are assigned only to the network admin group. Which component is addressed in the AAA network service framework?
- Aautomation
- Baccounting
- Cauthentication
- Dauthorization
59What is a characteristic of a DMZ zone?
- ATraffic originating from the inside network going to the DMZ network is not permitted.
- BTraffic originating from the outside network going to the DMZ network is selectively permitted.
- CTraffic originating from the DMZ network going to the inside network is permitted.
- DTraffic originating from the inside network going to the DMZ network is selectively permitted.
60Which measure can a security analyst take to perform effective security monitoring against network traffic encrypted by SSL technology?
- AUse a Syslog server to capture network traffic.
- BDeploy a Cisco SSL Appliance.
- CRequire remote access connections through IPsec VPN.
- DDeploy a Cisco ASA.
61Refer to the exhibit. Port security has been configured on the Fa 0/12 interface of switch S1. What action will occur when PC1 is attached to switch S1 with the applied configuration?
- AFrames from PC1 will be forwarded since the switchport port-security violation command is missing.
- BFrames from PC1 will be forwarded to its destination, and a log entry will be created.
- CFrames from PC1 will be forwarded to its destination, but a log entry will not be created.
- DFrames from PC1 will cause the interface to shut down immediately, and a log entry will be made.
- EFrames from PC1 will be dropped, and there will be no log of the violation.
- FFrames from PC1 will be dropped, and a log message will be created.
62What security countermeasure is effective for preventing CAM table overflow attacks?
- ADHCP snooping
- BDynamic ARP Inspection
- CIP source guard
- Dport security
63What are two examples of DoS attacks? (Choose two.)
- Aport scanning
- BSQL injection
- Cping of death
- Dphishing
- Ebuffer overflow
64Which method is used to identify interesting traffic needed to create an IKE phase 1 tunnel?
- Atransform sets
- Ba permit access list entry
- Chashing algorithms
- Da security association
65When the CLI is used to configure an ISR for a site-to-site VPN connection, which two items must be specified to enable a crypto map policy? (Choose two.)
- Athe hash
- Bthe peer
- Cencryption
- Dthe ISAKMP policy
- Ea valid access list
- FIP addresses on all active interfaces
- Gthe IKE Phase 1 policy
66How does a firewall handle traffic when it is originating from the public network and traveling to the DMZ network?
- ATraffic that is originating from the public network is inspected and selectively permitted when traveling to the DMZ network.
- BTraffic that is originating from the public network is usually permitted with little or no restriction when traveling to the DMZ network.
- CTraffic that is originating from the public network is usually forwarded without inspection when traveling to the DMZ network.
- DTraffic that is originating from the public network is usually blocked when traveling to the DMZ network.
67A client connects to a Web server. Which component of this HTTP connection is not examined by a stateful firewall?
- Athe source IP address of the client traffic
- Bthe destination port number of the client traffic
- Cthe actual contents of the HTTP connection
- Dthe source port number of the client traffic
68Which network monitoring technology uses VLANs to monitor traffic on remote switches?
- AIPS
- BIDS
- CTAP
- DRSPAN
69Which rule action will cause Snort IPS to block and log a packet?
- Alog
- Bdrop
- Calert
- DSdrop
70What is typically used to create a security trap in the data center facility?
- AIDs, biometrics, and two access doors
- Bhigh resolution monitors
- Credundant authentication servers
- Da server without all security patches applied
71A company is concerned with leaked and stolen corporate data on hard copies. Which data loss mitigation technique could help with this situation?
- Astrong PC security settings
- Bstrong passwords
- Cshredding
- Dencryption
72Upon completion of a network security course, a student decides to pursue a career in cryptanalysis. What job would the student be doing as a cryptanalyst?
- Acracking code without access to the shared secret key
- Bcreating hashing codes to authenticate data
- Cmaking and breaking secret codes
- Dcreating transposition and substitution ciphers
73What command is used on a switch to set the port access entity type so the interface acts only as an authenticator and will not respond to any messages meant for a supplicant?
- Adot1x pae authenticator
- Bauthentication port-control auto
- Caaa authentication dot1x default group radius
- Ddot1x system-auth-control
74What are two disadvantages of using an IDS? (Choose two.)
- AThe IDS does not stop malicious traffic.
- BThe IDS works offline using copies of network traffic.
- CThe IDS has no impact on traffic.
- DThe IDS analyzes actual forwarded packets.
- EThe IDS requires other devices to respond to attacks.
75Refer to the exhibit. The ip verify source command is applied on untrusted interfaces. Which type of attack is mitigated by using this configuration?
- ADHCP spoofing
- BDHCP starvation
- CSTP manipulation
- DMAC and IP address spoofing
76Which statement describes a difference between the Cisco ASA IOS CLI feature and the router IOS CLI feature?
- AASA uses the ? command whereas a router uses the help command to receive help on a brief description and the syntax of a command.
- BTo use a show command in a general configuration mode, ASA can use the command directly whereas a router will need to enter the do command before issuing the show command.
- CTo complete a partially typed command, ASA uses the Ctrl+Tab key combination whereas a router uses the Tab key.
- DTo indicate the CLI EXEC mode, ASA uses the % symbol whereas a router uses the # symbol.
77What ports can receive forwarded traffic from an isolated port that is part of a PVLAN?
- Aother isolated ports and community ports
- Bonly promiscuous ports
- Call other ports within the same community
- Donly isolated ports
78A user complains about being locked out of a device after too many unsuccessful AAA login attempts. What could be used by the network administrator to provide a secure authentication access method without locking a user out of a device?
- AUse the login delay command for authentication attempts.
- BUse the login local command for authenticating user access.
- CUse the aaa local authentication attempts max-fail global configuration mode command with a higher number of acceptable failures.
- DUse the none keyword when configuring the authentication method list.
79What are two drawbacks in assigning user privilege levels on a Cisco router? (Choose two.)
- AOnly a root user can add or remove commands.
- BPrivilege levels must be set to permit access control to specific device interfaces, ports, or slots.
- CAssigning a command with multiple keywords allows access to all commands using those keywords.
- DCommands from a lower level are always executable at a higher level.
- EAAA must be enabled.
80Refer to the exhibit. Which conclusion can be made from the show crypto map command output that is shown on R1?
- AThe crypto map has not yet been applied to an interface.
- BThe current peer IP address should be 172.30.2.1.
- CThere is a mismatch between the transform sets.
- DThe tunnel configuration was established and can be tested with extended pings.
81What are two reasons to enable OSPF routing protocol authentication on a network? (Choose two.)
- Ato prevent data traffic from being redirected and then discarded
- Bto ensure faster network convergence
- Cto provide data security through encryption
- Dto prevent redirection of data traffic to an insecure link
- Eto ensure more efficient routing
82Which three functions are provided by the syslog logging service? (Choose three.)
- Agathering logging information
- Bauthenticating and encrypting data sent over the network
- Cretaining captured messages on the router when a router is rebooted
- Dspecifying where captured information is stored
- Edistinguishing between information to be captured and information to be ignored
- Fsetting the size of the logging buffer
83What two ICMPv6 message types must be permitted through IPv6 access control lists to allow resolution of Layer 3 addresses to Layer 2 MAC addresses? (Choose two.)
- Aneighbor solicitations
- Becho requests
- Cneighbor advertisements
- Decho replies
- Erouter solicitations
- Frouter advertisements
84Which three services are provided through digital signatures? (Choose three.)
- Aaccounting
- Bauthenticity
- Ccompression
- Dnonrepudiation
- Eintegrity
- Fencryption
85A technician is to document the current configurations of all network devices in a college, including those in off-site buildings. Which protocol would be best to use to securely access the network devices?
- AFTP
- BHTTP
- CSSH
- DTelnet
86An administrator is trying to develop a BYOD security policy for employees that are bringing a wide range of devices to connect to the company network. Which three objectives must the BYOD security policy address? (Choose three.)
- AAll devices must be insured against liability if used to compromise the corporate network.
- BAll devices must have open authentication with the corporate network.
- CRights and activities permitted on the corporate network must be defined.
- DSafeguards must be put in place for any personal device being compromised.
- EThe level of access of employees when connecting to the corporate network must be defined.
- FAll devices should be allowed to attach to the corporate network flawlessly.
87What is the function of the pass action on a Cisco IOS Zone-Based Policy Firewall?
- Alogging of rejected or dropped packets
- Binspecting traffic between zones for traffic control
- Ctracking the state of connections between zones
- Dforwarding traffic from one zone to another
88Refer to the exhibit. Based on the security levels of the interfaces on ASA1, what traffic will be allowed on the interfaces?
- ATraffic from the Internet and DMZ can access the LAN.
- BTraffic from the Internet and LAN can access the DMZ.
- CTraffic from the Internet can access both the DMZ and the LAN.
- DTraffic from the LAN and DMZ can access the Internet.
89What network testing tool can be used to identify network layer protocols running on a host?
- ASIEM
- BNmap
- CL0phtcrack
- DTripwire
90In the implementation of security on multiple devices, how do ASA ACLs differ from Cisco IOS ACLs?
- ACisco IOS routers utilize both named and numbered ACLs and Cisco ASA devices utilize only numbered ACLs.
- BCisco IOS ACLs are configured with a wildcard mask and Cisco ASA ACLs are configured with a subnet mask.
- CCisco IOS ACLs are processed sequentially from the top down and Cisco ASA ACLs are not processed sequentially.
- DCisco IOS ACLs utilize an implicit deny all and Cisco ASA ACLs end with an implicit permit all.
91Which statement describes an important characteristic of a site-to-site VPN?
- AIt must be statically set up.
- BIt is ideally suited for use by mobile workers.
- CIt requires using a VPN client on the host PC.
- DAfter the initial connection is established, it can dynamically change connection information.
- EIt is commonly implemented over dialup and cable modem networks.
92Which two options are security best practices that help mitigate BYOD risks? (Choose two.)
- AUse paint that reflects wireless signals and glass that prevents the signals from going outside the building.
- BKeep the device OS and software updated.
- COnly allow devices that have been approved by the corporate IT team.
- DOnly turn on Wi-Fi when using the wireless network.
- EDecrease the wireless antenna gain level.
- FUse wireless MAC address filtering.
93Refer to the exhibit. A network administrator configures AAA authentication on R1. Which statement describes the effect of the keyword single-connection in the configuration?
- AR1 will open a separate connection to the TACACS+ server for each user authentication session.
- BThe authentication performance is enhanced by keeping the connection to the TACACS+ server open.
- CThe TACACS+ server only accepts one successful try for a user to authenticate with it.
- DR1 will open a separate connection to the TACACS server on a per source IP address basis for each authentication session.
94A recently created ACL is not working as expected. The admin determined that the ACL had been applied inbound on the interface and that was the incorrect direction. How should the admin fix this issue?
- ADelete the original ACL and create a new ACL, applying it outbound on the interface.
- BAdd an association of the ACL outbound on the same interface.
- CFix the ACE statements so that it works as desired inbound on the interface.
- DRemove the inbound association of the ACL on the interface and reapply it outbound.
95 What characteristic of the Snort term-based subscriptions is true for both the community and the subscriber rule sets?
- ABoth have a 30-day delayed access to updated signatures.
- BBoth use Cisco Talos to provide coverage in advance of exploits.
- CBoth are fully supported by Cisco and include Cisco customer support.
- DBoth offer threat protection against security threats.
96A security analyst is configuring Snort IPS. The analyst has just downloaded and installed the Snort OVA file. What is the next step?
- AVerify Snort IPS.
- BConfigure Virtual Port Group interfaces.
- CEnable IPS globally or on desired interfaces.
- DActivate the virtual services.
97The security policy in a company specifies that employee workstations can initiate HTTP and HTTPS connections to outside websites and the return traffic is allowed. However, connections initiated from outside hosts are not allowed. Which parameter can be used in extended ACLs to meet this requirement?
- Adscp
- Bprecedence
- Ceq
- Destablished
98A researcher is comparing the differences between a stateless firewall and a proxy firewall. Which two additional layers of the OSI model are inspected by a proxy firewall? (Choose two.)
- ALayer 3
- BLayer 4
- CLayer 5
- DLayer 6
- ELayer 7
99Refer to the exhibit. A network administrator is configuring a VPN between routers R1 and R2. Which commands would correctly configure a pre-shared key for the two routers?
- AR1(config)# username R2 password 5tayout!
R2(config)# username R1 password 5tayout! - BR1(config)# crypto isakmp key 5tayout! address 64.100.0.2
R2(config)# crypto isakmp key 5tayout! address 64.100.0.1 - CR1(config)# crypto isakmp key 5tayout! hostname R1
R2(config)# crypto isakmp key 5tayout! hostname R2 - DR1(config-if)# ppp pap sent-username R1 password 5tayout!
R2(config-if)# ppp pap sent-username R2 password 5tayout!
- AR1(config)# username R2 password 5tayout!
100Refer to the exhibit. Which statement is true about the effect of this Cisco IOS zone-based policy firewall configuration?
- AThe firewall will automatically drop all HTTP, HTTPS, and FTP traffic.
- BThe firewall will automatically allow HTTP, HTTPS, and FTP traffic from s0/0/0 to g0/0 and will track the connections. Tracking the connection allows only return traffic to be permitted through the firewall in the opposite direction.
- CThe firewall will automatically allow HTTP, HTTPS, and FTP traffic from s0/0/0 to g0/0, but will not track the state of connections. A corresponding policy must be applied to allow return traffic to be permitted through the firewall in the opposite direction.
- DThe firewall will automatically allow HTTP, HTTPS, and FTP traffic from g0/0 to s0/0/0 and will track the connections. Tracking the connection allows only return traffic to be permitted through the firewall in the opposite direction.
- Ereturn traffic to be permitted through the firewall in the opposite direction.
- FThe firewall will automatically allow HTTP, HTTPS, and FTP traffic from g0/0 to s0/0/0, but will not track the state of connections. A corresponding policy must be applied to allow return traffic to be permitted through the firewall in the opposite direction.
101 Which privilege level has the most access to the Cisco IOS?
- Alevel 0
- Blevel 15
- Clevel 7
- Dlevel 16
- Elevel 1
102Refer to the exhibit. A network administrator has configured NAT on an ASA device. What type of NAT is used?
- Ainside NAT
- Bstatic NAT
- Cbidirectional NAT
- Doutside NAT
103A network analyst is configuring a site-to-site IPsec VPN. The analyst has configured both the ISAKMP and IPsec policies. What is the next step?
- AConfigure the hash as SHA and the authentication as pre-shared.
- BApply the crypto map to the appropriate outbound interfaces.
- CIssue the show crypto ipsec sa command to verify the tunnel.
- DVerify that the security feature is enabled in the IOS.
104When an inbound Internet-traffic ACL is being implemented, what should be included to prevent the spoofing of internal networks?
- AACEs to prevent traffic from private address spaces
- BACEs to prevent broadcast address traffic
- CACEs to prevent ICMP traffic
- DACEs to prevent HTTP traffic
- EACEs to prevent SNMP traffic
105Which two types of attacks are examples of reconnaissance attacks? (Choose two.)
- Abrute force
- Bport scan
- Cping sweep
- Dman-in-the-middle
- ESYN flood
106Which Cisco solution helps prevent ARP spoofing and ARP poisoning attacks?
- ADynamic ARP Inspection
- BIP Source Guard
- CDHCP Snooping
- DPort Security
107When the Cisco NAC appliance evaluates an incoming connection from a remote device against the defined network policies, what feature is being used?
- Aposture assessment
- Bremediation of noncompliant systems
- Cauthentication and authorization
- Dquarantining of noncompliant systems
108Which two steps are required before SSH can be enabled on a Cisco router? (Choose two.)
- AGive the router a host name and domain name.
- BCreate a banner that will be displayed to users when they connect.
- CGenerate a set of secret keys to be used for encryption and decryption.
- DSet up an authentication server to handle incoming connection requests.
- EEnable SSH on the physical interfaces where the incoming connection requests will be received.
109The network administrator for an e-commerce website requires a service that prevents customers from claiming that legitimate orders are fake. What service provides this type of guarantee?
- Aconfidentiality
- Bauthentication
- Cintegrity
- Dnonrepudiation
110What functionality is provided by Cisco SPAN in a switched network?
- AIt mirrors traffic that passes through a switch port or VLAN to another port for traffic analysis.
- BIt prevents traffic on a LAN from being disrupted by a broadcast storm.
- CIt protects the switched network from receiving BPDUs on ports that should not be receiving them.
- DIt copies traffic that passes through a switch interface and sends the data directly to a syslog or SNMP server for analysis.
- EIt inspects voice protocols to ensure that SIP, SCCP, H.323, and MGCP requests conform to voice standards.
- FIt mitigates MAC address overflow attacks.
111Which three statements are generally considered to be best practices in the placement of ACLs? (Choose three.)
- AFilter unwanted traffic before it travels onto a low-bandwidth link.
- BPlace standard ACLs close to the destination IP address of the traffic.
- CPlace standard ACLs close to the source IP address of the traffic.
- DPlace extended ACLs close to the destination IP address of the traffic.
- EPlace extended ACLs close to the source IP address of the traffic.
- FFor every inbound ACL placed on an interface, there should be a matching outbound ACL.
112What function is performed by the class maps configuration object in the Cisco modular policy framework?
- Aidentifying interesting traffic
- Bapplying a policy to an interface
- Capplying a policy to interesting traffic
- Drestricting traffic through an interface
113In an attempt to prevent network attacks, cyber analysts share unique identifiable attributes of known attacks with colleagues. What three types of attributes or indicators of compromise are helpful to share? (Choose three.)
- AIP addresses of attack servers
- Bchanges made to end system software
- Cnetbios names of compromised firewalls
- Dfeatures of malware files
- EBIOS of attacking systems
- Fsystem ID of compromised systems
114What two assurances does digital signing provide about code that is downloaded from the Internet? (Choose two.)
- AThe code is authentic and is actually sourced by the publisher.
- BThe code contains no errors.
- CThe code has not been modified since it left the software publisher.
- DThe code contains no viruses.
- EThe code was encrypted with both a private and public key.
115Refer to the exhibit. What algorithm is being used to provide public key exchange?
- ASHA
- BRSA
- CDiffie-Hellman
- DAES
116Which two statements describe the use of asymmetric algorithms? (Choose two.)
- APublic and private keys may be used interchangeably.
- BIf a public key is used to encrypt the data, a public key must be used to decrypt the data.
- CIf a private key is used to encrypt the data, a public key must be used to decrypt the data.
- DIf a public key is used to encrypt the data, a private key must be used to decrypt the data.
- EIf a private key is used to encrypt the data, a private key must be used to decrypt the data.
117 Which statement is a feature of HMAC?
- AHMAC uses a secret key that is only known to the sender and defeats man-in-the-middle attacks
- BHMAC uses protocols such as SSL or TLS to provide session layer confidentiality.
- CHMAC uses a secret key as input to the hash function, adding authentication to integrity assurance.
- DHMAC is based on the RSA hash function.
118What is the purpose of the webtype ACLs in an ASA?
- Ato inspect outbound traffic headed towards certain web sites
- Bto restrict traffic that is destined to an ASDM
- Cto monitor return traffic that is in response to web server requests that are initiated from the inside interface
- Dto filter traffic for clientless SSL VPN users
119Which two statements describe the effect of the access control list wildcard mask 0.0.0.15? (Choose two.)
- AThe first 28 bits of a supplied IP address will be matched.
- BThe last four bits of a supplied IP address will be matched.
- CThe first 28 bits of a supplied IP address will be ignored.
- DThe last four bits of a supplied IP address will be ignored.
- EThe last five bits of a supplied IP address will be ignored.
- FThe first 32 bits of a supplied IP address will be matched.
120Which type of firewall is the most common and allows or blocks traffic based on Layer 3, Layer 4, and Layer 5 information?
- Astateless firewall
- Bpacket filtering firewall
- Cnext generation firewall
- Dstateful firewall
121Which protocol or measure should be used to mitigate the vulnerability of using FTP to transfer documents between a teleworker and the company file server?
- ASCP
- BTFTP
- CACLs on the file server
- Dout-of-band communication channel
122Refer to the exhibit. The IPv6 access list LIMITED_ACCESS is applied on the S0/0/0 interface of R1 in the inbound direction. Which IPv6 packets from the ISP will be dropped by the ACL on R1?
- AHTTPS packets to PC1
- BICMPv6 packets that are destined to PC1
- Cpackets that are destined to PC1 on port 80
- Dneighbor advertisements that are received from the ISP router
123What tool is available through the Cisco IOS CLI to initiate security audits and to make recommended configuration changes with or without administrator input?
- AControl Plane Policing
- BCisco AutoSecure
- CCisco ACS
- DSimple Network Management Protocol
124Refer to the exhibit. Which pair of crypto isakmp key commands would correctly configure PSK on the two routers?
- AR1(config)# crypto isakmp key cisco123 address 209.165.200.227
R2(config)# crypto isakmp key cisco123 address 209.165.200.226 - BR1(config)# crypto isakmp key cisco123 address 209.165.200.226
R2(config)# crypto isakmp key cisco123 address 209.165.200.227 - CR1(config)# crypto isakmp key cisco123 hostname R1
R2(config)# crypto isakmp key cisco123 hostname R2 - DR1(config)# crypto isakmp key cisco123 address 209.165.200.226
R2(config)# crypto isakmp key secure address 209.165.200.227
- AR1(config)# crypto isakmp key cisco123 address 209.165.200.227
125Which two technologies provide enterprise-managed VPN solutions? (Choose two.)
- ALayer 3 MPLS VPN
- BFrame Relay
- Csite-to-site VPN
- DLayer 2 MPLS VPN
- Eremote access VPN
126What are the three components of an STP bridge ID? (Choose three.)
- Athe date and time that the switch was brought online
- Bthe hostname of the switch
- Cthe MAC address of the switch
- Dthe extended system ID
- Ethe bridge priority value
- Fthe IP address of the management VLAN
127What are two differences between stateful and packet filtering firewalls? (Choose two.)
- AA packet filtering firewall will prevent spoofing by determining whether packets belong to an existing connection while a stateful firewall follows pre-configured rule sets.
- BA stateful firewall provides more stringent control over security than a packet filtering firewall.
- CA packet filtering firewall is able to filter sessions that use dynamic port negotiations while a stateful firewall cannot.
- DA stateful firewall will provide more logging information than a packet filtering firewall.
- EA statefull firewall will examine each packet individually while a packet filtering firewall observes the state of a connection.
128Which portion of the Snort IPS rule header identifies the destination port?
- Aany
- B$HTTP_PORTS
- C$HOME_NET
- Dtcp
129What port state is used by 802.1X if a workstation fails authorization?
- Adisabled
- Bdown
- Cunauthorized
- Dblocking
130Refer to the exhibit. Which two ACLs, if applied to the G0/1 interface of R2, would permit only the two LAN networks attached to R1 to access the network that connects to R2 G0/1 interface? (Choose two.)
- Aaccess-list 3 permit 192.168.10.128 0.0.0.63
- Baccess-list 1 permit 192.168.10.0 0.0.0.127
- Caccess-list 4 permit 192.168.10.0 0.0.0.255
- Daccess-list 2 permit host 192.168.10.9
access-list 2 permit host 192.168.10.69 - Eaccess-list 5 permit 192.168.10.0 0.0.0.63
access-list 5 permit 192.168.10.64 0.0.0.63
131Which two characteristics apply to role-based CLI access superviews? (Choose two.)
- AA specific superview cannot have commands added to it directly.
- BCLI views have passwords, but superviews do not have passwords.
- CA single superview can be shared among multiple CLI views.
- DDeleting a superview deletes all associated CLI views.
- EUsers logged in to a superview can access all commands specified within the associated CLI views.
132What are two security features commonly found in a WAN design? (Choose two.)
- AWPA2 for data encryption of all data between sites
- Bfirewalls protecting the main and remote sites
- Coutside perimeter security including continuous video surveillance
- Dport security on all user-facing ports
- EVPNs used by mobile workers between sites
133Refer to the exhibit. A network administrator is configuring AAA implementation on an ASA device. What does the option link3 indicate?
- Athe network name where the AAA server resides
- Bthe specific AAA server name
- Cthe sequence of servers in the AAA server group
- Dthe interface name
134What provides both secure segmentation and threat defense in a Secure Data Center solution?
- ACisco Security Manager software
- BAAA server
- CAdaptive Security Appliance
- Dintrusion prevention system
135What are the three core components of the Cisco Secure Data Center solution? (Choose three.)
- Amesh network
- Bsecure segmentation
- Cvisibility
- Dthreat defense
- Eservers
- Finfrastructure
136What are three characteristics of ASA transparent mode? (Choose three.)
- AThis mode does not support VPNs, QoS, or DHCP Relay.
- BIt is the traditional firewall deployment mode.
- CThis mode is referred to as a “bump in the wire.”
- DNAT can be implemented between connected networks.
- EIn this mode the ASA is invisible to an attacker.
- FThe interfaces of the ASA separate Layer 3 networks and require IP addresses in different subnets.
137What is needed to allow specific traffic that is sourced on the outside network of an ASA firewall to reach an internal network?
- AACL
- BNAT
- Cdynamic routing protocols
- Doutside security zone level 0
138What will be the result of failed login attempts if the following command is entered into a router?
login block-for 150 attempts 4 within 90- AAll login attempts will be blocked for 150 seconds if there are 4 failed attempts within 90 seconds.
- BAll login attempts will be blocked for 90 seconds if there are 4 failed attempts within 150 seconds.
- CAll login attempts will be blocked for 1.5 hours if there are 4 failed attempts within 150 seconds.
- DAll login attempts will be blocked for 4 hours if there are 90 failed attempts within 150 seconds.
139 Which two tasks are associated with router hardening? (Choose two.)
- Aplacing the router in a secure room
- Bdisabling unused ports and interfaces
- Cinstalling the maximum amount of memory possible
- Dsecuring administrative access
- Eusing uninterruptible power supplies
140Which threat protection capability is provided by Cisco ESA?
- Aweb filtering
- Bcloud access security
- Cspam protection
- DLayer 4 traffic monitoring
141What are two security measures used to protect endpoints in the borderless network? (Choose two.)
- Adenylisting
- BSnort IPS
- CDLP
- DDMZ
- Erootkit
142Which three types of traffic are allowed when the authentication port-control auto command has been issued and the client has not yet been authenticated? (Choose three.)
- ACDP
- B802.1Q
- CIPsec
- DTACACS+
- ESTP
- FEAPOL
143Which statement describes a characteristic of the IKE protocol?
- AIt uses UDP port 500 to exchange IKE information between the security gateways.
- BIKE Phase 1 can be implemented in three different modes: main, aggressive, or quick.
- CIt allows for the transmission of keys directly across a network.
- DThe purpose of IKE Phase 2 is to negotiate a security association between two IKE peers.
144Which action do IPsec peers take during the IKE Phase 2 exchange?
- Aexchange of DH keys
- Bnegotiation of IPsec policy
- Cnegotiation of IKE policy sets
- Dverification of peer identity
Information
- Description
- Quiz on QUIZZ ingles, created by LESLIE JAQUELINE ESPARZA SILVA on 07/05/2024.
- Language
- English
- Views
- 81
- Tags
- Rating
- No ratings yet Rate this quiz