Quiz
Networks
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (121)
1Which two services define cloud networks? (select two)
- AInfrastructure as a Service
- BTenancy as a Service
- CCompute as a Service
- DPlatform as a Service
- ESecurity as a Service
2In which two situations should you use out-of-band management? (select two)
- AWhen a network device fails to forward packets
- BWhen you require ROMMON access
- CWhen management applications need concurrent access to the device
- DWhen you require administrator access from multiple locations
- EWhen the control plane fails to respond
3In which three ways does the TACACS protocol differ from RADIUS?
- ATACACS uses TCP to communicate with the NAS
- BTACACS can encrypt the entire packet that is sent to the NAS
- CTACACS supports per-command authorization
- DTACACS authenticates and authorizes simultaneously, causing fewer packets to be transmitted
- ETACACS uses UDP to communicate with the NAS
- FTACACS encrypts only the password field in an authentication packet
4According to Cisco best practices, which three protocols should the default ACL allow on an access prot to enable wired BYOD devices to supply valid credentials and connect to the network?
- ABOOTP
- BTFTP
- CDNS
- DMAB
- EHTTP
- F802.1x
5Which two next-gen encryption algorithms does Cisco recommend?
- AAES
- B3DES
- CDES
- DMD5
- EHD-1024
- FSHA-384
6Which three ESP fields can be encrypted during transmission?
- ASecurity Parameter Index
- BSequence Number
- CMAC Address
- DPadding
- EPad Length
- FNext Header
7What are two default Cisco IOS privilege levels?
- A0
- B1
- C5
- D7
- E10
- F15
8Which two authentication types does OSPF support?
- Aplaintext
- BMD5
- CHMAC
- DAES-256
- ESHA-1
- FDES
9Which two features do CoPP and CPPr use to protect the control plane?
- AQoS
- Btraffic classification
- Caccess lists
- Dplicy maps
- Eclass maps
- FCisco Express Forwarding
10Which two statements about stateless firewalls are true?
- Athey compare the 5-tuple of each incoming packet agains configurable rules
- Bthey cannot track connections
- Cthey are designed to work most efficiently with stateless protocols such as HTTP or HTTPS
- DCisco IOS cannot implement them because the platform is stateful by nature
- Ethe Cisco ASA is implicitly stateless because it blocks all traffic by default
11Which three statements about host-based IPS are true?
- Ait can view encrypted files
- Bit can have more restrictive policies than network-based IPS
- Cit can generate alerts based on behavior at the desktop level
- Dit can be deployed at the perimeter
- Eit uses signature-based policies
- Fit works with deployed firewalls
12What three actions are limitations when running IPS in promiscuous mode?
- Adeny attacker
- Bdeny packet
- Cmodify packet
- Drequrst block connection
- Erequest block host
- Freset TCP connection
13When an IPS detects an attack, which action can the IPS take to prevent the attack from spreading?
- Adeny the connection inline
- Bperform a Layer 6 reset
- Cdeploy an antimalware system
- Denable bypass mode
14What is an advantage of implementing a Trusted Platform Module for disk encryption?
- Ait provides hardware authentication
- Bit allows the hard disk to be transferred to another device without requiring re-encryption
- Cit supports a more complex encryption algorithm than other disk-encryption technologies
- Dit can protect against single points of failure
15What is the purpose of the integrity component oc the CIA triad?
- Ato ensure that only authorized parties can modify data
- Bto determine whether data is relecant
- Cto create a process for accessing data
- Dto ensure that only authorized parties can view data
16In a security context, which action can you take to address compliance?
- Aimplement rules to prevent a vulnerability
- Bcorrect or counteract a vulnerability
- Creduce the severity of a vulnerability
- Dfollow directions from the security appliance manufacturer to remediate a vulnerability
17Which type of secure connectivity does an extranet provide?
- Aother company networks to your company network
- Bremote branch offices to your company network
- Cyour company network to the internet
- Dnew networks to your company network
18Which tool can an attacker use to attempt a DDoS attack?
- Abotnet
- Btrojan horse
- Cvirus
- Dadware
19What type of security support is provided by the Open Web Application Security Project?
- Aeducation about common web site vulnerabilities
- Ba web site security framework
- Ca security discussion forum for web site developers
- Dscoring of common vulnerabilities and exposures
20What type of attack was the Stuxnet virus?
- Acyber warfare
- Bhacktivism
- Cbotnet
- Dsocial engineering
21What type of algorithm uses the same key to encrypt and decrypt data?
- Aa symmetric algorithm
- Ban asymmetric algorithm
- Ca Public Key Infrastructure algorithm
- Dan IP security algorithm
22How does the Cisco ASA use Active Directory to authorize VPN users?
- Ait queries the Active Directory server for a specific attribute for the specified user
- Bit sends the username and password to retrieve an ACCEPT or REJECT message from the Active Directory server
- Cit downloads and store the Active Directory database to query for future authorization requests
- Dit redirects request to the Active Directory server defined for the VPN group
23Which statement about Cisco ACS authentication and authorization is true?
- AACS srevers can be clustered to provide scalability
- BACS can query multiple Active Directory domains
- CACS uses TACACS to proxy other authentication servers
- DACS can use only one authorization profile to allow or deny requests
24Which EAP method uses Protected Access Credentials?
- AEAP-FAST
- BEAP-TLS
- CEAP-PEAP
- DEAP-GTC
25What is one requirement for locking a wired or wireless device from ISE?
- Athe ISE agent must be installed on the device
- Bthe device must be connected tot he network when the lock command is executed
- Cthe user must approve the locking action
- Dthe organization must implement an acceptable use policy allowing device locking
26What VPN feature allows traffic to exit the security appliance through th same interface it entered?
- Ahairpinning
- BNAT
- CNAT traversal
- Dsplit tunneling
27What VPN feature allows internet traffic and local LAN/WAN traffic to use the same network connection?
- Asplit tunneling
- Bhairpinning
- Ctunnel mode
- Dtransparent mode
28After reloading a router, you issue the dir command to verify the installation and observe that the image file appears to be Missing. For what reason could the image file fail to appear in the dir output?
- Athe secure boot-image command is configured
- Bthe secure boot-comfit command is configured
- Cthe confreg 0x24 command is configured
- Dthe reload command was issued from ROMMON
29What is the effect of the send-lifetime local 23:59:00 31 December 2013 infinite command?
- Ait configures the device to begin transmitting the authentication key to other devices at 00:00:00 local time on January 1, 2014 and continue using the key indefinitely
- Bit configures the device to begin transmitting the authentication key to other devices at 23:59:00 local time on December 31, 2013 and continue using the key indefinitely
- Cit configures the device to begin accepting the authentication key from other devices immediately and stop accepting the at 23:59:00 local time on December 31, 2013 and continue using the key indefinitely
- Dit configures the device to begin accepting the authentication key from other devices at 23:59:00 local time on December 31, 2013 and continue accepting the key indefinitely
- Eit configures the device to begin accepting the authentication key from other devices at 00:00:00 local time on January 1, 2014 and continue accepting the key indefinitely
- Fit configures the device to generate a new authentication key and transmit it to other devices at 23:59:00 local time on December 31, 2013
30What type of packet creates and performs network operations on a network device?
- Acontrol plane packets
- Bdata plane packets
- Cmanagement plane packets
- Dservices plane packets
31An attacker installs a rogue switch that sends superior BPDUs on your network. What is a possible result of this activity?
- Athe switch could offer fake DHCP addresses
- Bthe switch could become the root bridge
- Cthe switch could be allowed to join the VTP domain
- Dthe switch could become a transparent bridge
32In what type of attack does an attacker virtually change a device's burned in address in an attempt to circumvent access lists and mask the device's true identity?
- Agratuitous ARP
- BARP poisoning
- CIP spoofing
- DMAC spoofing
33What command can you use to verify the binding table status?
- Ashow ip dhcp snooping database
- Bshow ip dhcp snooping binding
- Cshow ip dhcp snooping statistics
- Dshow ip dhcp pool
- Eshow ip dhcp source binding
- Fshow ip dhcp snooping
34If a switch receives a superior BPDU and goes directly into a blocked state, what mechanism must be in use?
- Aroot guard
- BEtherChannel guard
- Cloop guard
- DBPDU guard
35Which statement abour a PVLAN isolated port configured on a switch is true?
- Athe isolated port can communicate only with the promiscuous port
- Bthe isolated port can communicate only with other community ports
- Cthe isolated port can communicate with other isolated ports and the promiscuous port
- Dthe isolated port can communicate only with other isolated ports
36If you change the native VLAN on the trunk port to an unused VLAN, what happens if an attacker attempts a double-tagging attack?
- Athe trunk port would go into an error-disabled state
- Ba VLAN hopping attack would be successful
- Ca VLAN hopping attack would be prevented
- Dthe attacked VLAN will be pruned
37What is a reason for an organization to deploy a personal firewall?
- Ato protect endpoints such as desktops from malicious activity
- Bto protect one virtual network segment from another
- Cto determine whether a host meets minimum security posture requirements
- Dto crate a separate, non-persistent virtual environment that can be destroyed after a session
- Eto protect the network from DoS and syn-flood attacks
38Which statement about personal firewalls is true?
- Athey can protect a system by denying probing requests
- Bthey are resilient against kernel attacks
- Cthey can protect email messages and private documents in a similar way to a VPN
- Dthey can protect the network against attacks
39What is the only permitted operation for processing multicast traffic on zone-based firewalls?
- AOnly control plane policing can protect the control plane against multicast traffic
- Bstateful inspection of multicast traffic is supported only for the self-zone
- Cstateful inspection for multicast traffic is supported only between the self-zone and the internal zone
- Dstateful inspection of multicast traffic is supported only for the internal zone
40How does a zone-based firewall implementation handle traffic between interfaces in the same zone?
- Atraffic between two interfaces in the same zone is allowed by defult
- Btraffic between interfaces in the same zone is blocked unless you configure the same-security permit command
- Ctraffic between interfaces in the same zone is always blocked
- Dtraffic between interfaces in the same zone is blocked unless you apply a service policy to the zone pair
41Which two statements about Telnet access tot eh ASA are true?
- Ayou may VPN to the lowest security interface to telnet to an inside interface
- Byou must configure an AAA server to enable Telnet
- Cyou can access all interfaces on an ASA using Telnet
- Dyou must use the command virtual telnet to enable Telnet
- Ebest practice is to disable Telnet and use SSH
42Which statement about communication over failover interfaces is true?
- Aall information that is sent over the failover and stateful failover interfaces is sent as clear text by default
- Ball information that is sent over the failover inerface is sent as clear text, but the stateful failover link is encrypted by default
- Call information that is sent over the failover and stateful failover interfaces is encrypted by default
- DUser names, passwords, and preshared keys are encrypted by default when they are sent over the failover and stateful failover interfaces, but other information is sent as clear text
43If a packet matches more than one class map in an individual feature type's policy map, how does the ASA handle the packet?
- Athe ASA will apply the actions from only the first matching class map it finds for the feature type
- Bthe ASA will apply the actions from only the most specific matching class map it finds for the feature type
- Cthe ASA will apply the actions from all matching class maps it finds for the feature type
- Dthe ASA will apply the actions from only the last matching class map it finds for the feature type
44For what reason would you configure multiple security contexts on the ASA firewall?
- Ato separate different departments and business units
- Bto enable the use of VRFs on routers that are adjacently connected
- Cto provide redundancy and high availability within the organization
- Dto enable the use of multicast routing and QoS through the firewall
45What is an advantage of placing an IPS on the inside of a network?
- Ait can provide higher throughput
- Bit receives traffic that has already been filtered
- Cit receives every inbound packet
- Dit can provide greater security
46What is the FirePOWER impact flag used for?
- Aa value that indicates the potential severity of an attack
- Ba value that the administrator assigns to each signature
- Ca value that sets the priority of a signature
- Da value that measures the application awareness
47Which FirePOWER preprocessor engine is used to prevent SYN attacks?
- ARate-Based Prevention
- BPortscan Detection
- CIP Defragmentation
- DInline Normalization
48Which Sourcefire logging action should you choose to record the most detail about a connection?
- Aenable logging at the end of the session
- Benable logging at the beginning of the session
- Cenable alerts via SNMP to log events off-box
- Denable eStreamer to log events off-box
49What can the SMTP preprocessor in FirePOWER normalize?
- Ait can extract and decode email attachments in client to server traffic
- Bit can look up the email sender
- Cit compares known threats to the email sender
- Dit can forward the SMTP traffic to an email filter server
- Eit uses the Traffic Anomaly Detector
50You want to allow all of your company's users to access the internet without allowing other web servers to collect the IP addresses of individual users. What two solutions can you use?
- Aconfigure a proxy server to hide users' local IP addresses
- Bassign unique IP addresses to all users
- Cassign the same IP address to all users
- Dinstall a web content filter to hie users' local IP addresses
- Econfigure a firewall to use Port Address Translation
51You have implemented a SourceFire IPS and configured it to block certain addresses utilizing Security Intelligence IP Address Reputation. A user calls and is not able to access a certain IP address. What action can you take to allow the user access to the IP address?
- Acreate a whitelist and add the appropriate IP address to allow the traffic
- Bcreate a custom blacklist to allow the traffic
- Ccreate a user based access control rule to allow the traffic
- Dcreate a network based access control rule to allow the traffic
- Ecreate a rule to bypass inspection to allow the traffic
52A specific URL has been identified as containing malware. What action can you take to block users from accidentally visiting the URL and becoming infected with malware?
- Aenable URL filtering on the perimeter router and add the URLs you want to block to the router's local URL list
- Benable URL filtering on the perimeter firewall and add the URLs you want to allow to the router's local URL list
- Cenable URl filtering on the perimeter router and add the URLs you want to allow to the firewall's local URL list
- Dcreate a blacklist that contains the URL you want to block and activate the blacklist on the perimeter router
- Ecreate a white list that contains the URLs you want to allow and activate the wihitelist on the perimeter router
53When is the best time to perform an antivirus signature update?
- Aevery time a new update is available
- Bwhen the locl scanner has detected a new virus
- Cwhen a new virus is discovered in the wild
- Dwhen the system detects a browser hook
54Which statement about application blocking is true?
- Ait blocks access to specific programs
- Bit blocks access to files with specific extensions
- Cit blocks access to specific network addresses
- Dit blocks access to specific network services
55What features can protect the data plane? (choose three)
- Apolicing
- BACLs
- CIPS
- Dantispoofing
- EQoS
- FDHCP snooping
56How many crypto map sets can you apply to a router interface?
- A3
- B2
- C4
- D1
57What is the transition order of STP states on a Layer 2 switch interface?
- Alistening, learning, blocking, forwarding, disabled
- Blistening, blocking, learning, forwarding, disabled
- Cblocking, listening, learning, forwarding, disabled
- Dforwarding, listening, learning, blocking, disabled
58Which sensor mode can deny attackers inline?
- AIPS
- Bfail-close
- CIDS
- Dfail-open
59Which options are filtering options used to display SDEE message types? (choose two)
- Astop
- Bnone
- Cerror
- Dall
60When a comppany puts a security policy in place, what is the effect on the company's business?
- Aminimizing risk
- Bminimizing total cost of ownership
- Cminimizing liability
- Dmaximizing compliance
61Which wildcard mask is associated with a subnet mask of /27?
- A0.0.0.31
- B0.0.0.27
- C0.0.0.224
- D0.0.0.255
62Which statements about reflexive access lists are true? (choose three)
- Areflexive access lists create a permanent ACE
- Breflexive access lists approximate session filtering using the established keyword
- Creflexive access lists can be attached to standard named IP ACLs
- Dreflexive access lists support UDP sessions
- Ereflexive access lists can be attached to extended named IP ACLs
- Freflexive access lists support TCP sessions
63Which actions can a promiscuous IPS take to mitigate an attack? (choose three)
- Amodifying packets
- Brequesting connection blocking
- Cdenying packets
- Dresetting the TCP connection
- Erequesting host blocking
- Fdenying frames
64Which command will configure a Cisco ASA firewall to authenticate users when they enter the enable sysntax using the local database with no failback method?
- Aaaa authentication enable console LOCAL SERVER_GROUP
- Baaa authentication enable console SERVER_GROUP LOCAL
- Caaa authentication enable console local
- Daaa authentication enable console LOCAL
65Which Cisco Security Manager application collects information about device status and uses it to generate notifications and alerts?
- AFlexConfig
- BDevice Manager
- CReport Manager
- DHealth and Performance Monitor
66Which accounting notices are used to send a failed authentication attempt record to a AAA server? (choose two)
- Astart-stop
- Bstop-record
- Cstop-only
- Dstop
67Which command is needed to enable SSH support on a Cisco router?
- Acrypto key lock rsa
- Bcrypto key generate rsa
- Ccrypto key zeroize rsa
- Dcrypto key unlock rsa
68Which protocol provides security to Secure Copy?
- AIPSec
- BSSH
- CHTTPS
- DESP
69A clientless SSL VPN user who is connecting on a Windows Vista computer is missing the menu option for Remote Desktop Protocol on the portal web page. Which action should you take to begin troubleshooting?
- AEnsure that the RDP2 plug-in is installed on the VPN gateway
- Breboot the VPN gateway
- Cinstruct the user to reconnect tot the VPN gateway
- Densure that the RDP plug-in is installed on the VPN gateway
70Which security zone is automatically defined by the system?
- Athe source zone
- Bthe self zone
- Cthe destination zone
- Dthe inside zone
71What are purposes of the Internet Key Exchange in an IPSec VPN? (choose two)
- Athe IKE protocol establishes security associations
- Bthe IKE protocol provides data confidentiality
- Cthe IKE protocol provides replay detection
- Dthe IKE protocol is responsible for mutual authentication
72Which address block is reserved for locally assigned unique local addresses?
- A2002::/16
- BFD00::/8
- C2001::/32
- DFB00::/8
73What is a possible reason for the error message ?Router(config)#aaa server?% Unrecognized command
- Athe command syntax requires a space after the word "server"
- Bthe command is invalid on the target device
- Cthe router is already running the latest operating system
- Dthe router is a new device on which the aaa new-model command must be applied before continuing
74Which statements about smart tunnels on a Cisco firewall are true? (choose two)
- Asmart tunnels can be used by clients that do not have administrator privileges
- Bsmart tunnels support all operating systems
- Csmart tunnels offer better performance than port forwarding
- Dsmart tunnels require the client to have the application installed locally
75If the native VLAN on a trunk is different on each end of the link, what is a potential consequence?
- Athe interface on both switches may shut down
- BSTP loops may occur
- Cthe switch with the higher native VLAN may shut down
- Dthe interface with the lower native VLAN may shut down
76Which option describes information that must be considered when you apply an access list to a physical interface?
- Aprotocol used for filtering
- Bdirection of the access class
- Cdirection of the access group
- Ddirection of the access list
77Which source port does IKE use when NAT has been detected between two VPN gateways?
- ATCP 4500
- BTCP 500
- CUDP 4500
- DUDP 500
78Which of the following are features of IPSec transport mode? (choose three)
- AIPSec transport mode is used between end stations
- BIPSec transport mode is used between gateways
- CIPSec transport mode supports multicast
- DIPSec transport mode supports unicast
- EIPSec transport mode encrypts only the payload
- FIPSeec transport mode encrypts the entire packet
79Which command causes a Layer 2 switch interface to operate as a Layer 3 interface?
- Ano switchport nonnegotiate
- Bswitchport
- Cno switchport mode dynamic auto
- Dno switchport
80Which TACACS+ server authentication protocols are supported on Cisco ASA firewalls? (choose three)
- AEAP
- BASCII
- CPAP
- DPEAP
- EMS-CHAPv1
- FMS-CHAPv2
81Which type of IPS can identify worms that are propagating in a network?
- Apolicy-based IPS
- Banomaly-based IPS
- Creputation-based IPS
- Dsignature-based IPS
82Which command verifies phase 1 of an IPSec VPN on a Cisco router?
- Ashow crypto map
- Bshow crypto ipsec sa
- Cshow crypto isakmp sa
- Dshow crypto engine connection active
83What is the purpose of a honeypot IPS?
- Ato create customized plicies
- Bto detect unknown attacks
- Cto normalize streams
- Dto collect information aboout attacks
84Which type of firewall can act on the behalf of the end device?
- Astateful packet
- Bapplication
- Cpacket
- Dproxy
85Which syslog severity level is number 7?
- AWarning
- BInformational
- CNotification
- DDebugging
86By which kind of threat is the victim tricked into entering username and password information at a disguised website?
- Aspoofing
- Bmalware
- Cspam
- Dphishing
87Which type of mirroring does SPAN technology perform?
- Aremote mirroring over layer 2
- Bremote mirroring over layer 3
- Clocal mirroring over layer 2
- Dlocal mirroring over layer 3
88Which tasks is the session management path responsible for? (choose three)
- Averifying IP checksums
- Bperforming route lookup
- Cperforming session lookup
- Dallocating NAT translations
- Echecking TCP sequence numbers
- Fchecking packets against the access list
89Which network device does NTP authenticate?
- Aonly the time source
- Bonly the client device
- Cthe firewall and the client device
- Dthe client device and the time source
90Which Cisco product can help mitigate web based attacks within a network?
- AAdaptive Security Appliance
- BWeb Security Appliance
- CEmail Security Appliance
- DIdentity Services Engine
91Which statement correctly describes the function of a private VLAN?
- AA private VLAN partitions the Layer 2 broadcast domain of a VLAN into subdomains
- BA private VLAN partitions the Layer 3 broadcast domain of a VLAN into subdomains
- CA private VLAN enables the creation of multiple VLANs using one broadcast domain
- DA private VLAN combines the Layer 2 broadcast domains of many VLANs into one major broadcast domain
92What hash type does Cisco use to validate the integrity of downloaded images?
- ASHA-1
- BSHA-2
- CMD5
- DMD1
93Which Cisco feature can help mitigate spoofing attacks by verifying symmetry of the traffic path?
- AUnidirectional Link Detection
- BUnicast Reverse Path Forwarding
- CTrustSec
- DIP Source Guard
94What is the most common Cisco Discovery Protocol version 1 attack?
- ADenial of Service
- BMAC address spoofing
- CCAM table overflow
- DVLAN hopping
95What is the Cisco preferred countermeasure to mitigate CAM overflows?
- Aport security
- Bdynamic port security
- CIP source guard
- Droot guard
96Which otion is the most effective placement of an IPS device within the infrastructure?
- Ainline, behind the internet router and firewall
- Binline, before the internet router and firewall
- Cpromiscuously, after the internet router and before the firewall
- Dpromiscuously, before the internet router and the firewall
97If a router configuration includes the line aaa authentication login default group tacacs+ enable, which events will occur when the TACACS+ server returns an error? (choose two)
- Athe user will be prompted to authenticate using the enable password
- Bauthentication attempts to the router will be denied
- Cauthentication will use the router's local database
- Dauthentication attempts will be sent to the TACACS server
98Which alert protocol is used with Cisco IPS Manager Express to support up to 10 sensors?
- ASDEE
- BSyslog
- CSNMP
- DCSM
99When a switch has multiple links connected to a downstream swich, what is the first step that STP takes to prevent loops?
- ASTP elects the root bridge
- BSTP selects the root port
- CSTP selects the designated port
- DSTP blocks one of the ports
100Which type of address translation should be used when a Cisco ASA is in transparent mode?
- Astatic NAT
- Bdynamic NAT
- Coverload
- Ddynamic PAT
101Which components does HMAC use to determine the authenticity and integrity of a message? (choose two)
- Athe password
- Bthe hash
- Cthe key
- Dthe transform set
102What is the default timeout interval during which a router waits for responses from a TACACS server before declaring a timeout failure?
- A5 seconds
- B10 seconds
- C15 seconds
- D20 seconds
103Which RADIUS server authentication protocols are supported on Cisco ASA firewalls? (choose three)
- AEAP
- BASCII
- CPAP
- DPEAP
- EMS-CHAPv1
- FMS-CHAPv2
104Which command initializes a lawful intercept view?
- Ausername cisco1 view lawful-intercept password cisco
- Bparser view cisco li-view
- Cli-view cisco user cisco1 password cisco
- Dparser view li-view inclusive
105Which countermeasures can mitigate ARP spoofing attacks? (choose two)
- Aport security
- BDHACP snooping
- CIP source guard
- Ddynamic ARP inspection
106Which of the following statements about access lists are true? (choose three)
- Aextended access lists should be placed as near as possible to the destination
- Bextended access lists should be placed as near as possible to the source
- Cstandard access lists should be placed as near as possible to the destination
- Dstandard access lists should be placed as near as possible to the source
- Estandard access lists filter on the source address
- Fstandard access lists filter on the destination address
107Which statement about extended access lists is true?
- Aextended access lists perform filtering that is based on source and destination and are most effective when applied to the destination
- Bextended access lists perform filtering that is based on source and destination and are most effective when applied to the source
- Cextended access lists perform filtering that is based on destination and are most effective when applied to the source
- Dextended access lists perform filtering that is based on source and are most effective when applied to the destination
108Which security measures can protect the control plane of a Cisco router? (choose two)
- ACCPr
- Bparser views
- Caccess control lists
- Dport security
- ECoPP
109In which stage of an attack does the attacker discover devices on a target network?
- Areconnaissance
- Bcovering tracks
- Cgaining access
- Dmaintaining access
110Which protocols use encryption to protect the confidentiality of data transmitted between two parties? (choose two)
- AFTP
- BSSH
- CTelnet
- DAAA
- EHTTPS
- FHTTP
111What are the primary attack methods of VLAN hopping? (choose two)
- AVoIP hopping
- Bswitch spoofing
- CCAM table overflow
- Ddouble taffing
112How can the administrator enable permanent client installation in a Cisco AnyConnect VPN firewall configuration?
- Aissue the command anyconnect keep-installer under the group policy or username webvpn mode
- Bissue the command anyconnect keep-installer installed in the global configuration
- Cissue the command anyconnect keep-installer installed under the group policy or username webvpn mode
- Dissue the command anyconnect keep-installer installer under the group policy or username webvpn mode
113what type of security control is defense in depth?
- Athreat mitigation
- Brisk analysis
- Cbotnet mitigation
- Dovert and covert channels
114On which Cisco Configuration Professional screen do you enable AAA?
- AAAA summary
- BAAA servers and groups
- Cauthentication policies
- Dauthorization policies
115What are tow uses of SIEM software?
- Acollecting and archiving syslog data
- Balerting administrators to security events in real time
- Cperforming automatic network sudits
- Dconfiguring firewall and IDS devices
- Escanning email for suspicious attachments
116What are the three layers of a hierarchical network design?
- Aaccess
- Bcore
- Cdistribution
- Duser
- Eserver
- Finternet
117In which two situations should you use in-band management?
- Awhen management applications need concurrent access to the device
- Bwhen you require adminstarator access from multiple locations
- Cwhen a network device fails to forward packets
- Dwhen you require ROMMON access
- Ewhen the control plane fails to respond
118What are two ways to prevent eavesdropping when you perform device management tasks?
- Ause an SSH connection
- Buse SNMPv3
- Cuse out-of-band management
- Duse SNMPv2
- Euse in-band management
119In which three ways does the RADIUS protocol differ from TACACS?
- ARADIUS uses UDP to communicate with the HAS
- BRADIUS encrypts only the password field in an authentication packet
- CRADIUS authenticates and authorizes simultaneously, causing fewer packets to be transmitted
- DRADIUS uses TCP to communicate with the NAS
- ERADIUS can encrypt the entire packet that is sent to the NAS
- FRADIUS supports per cammand authorization
120Which three statements describe DHCP spoofng attacks?
- Athey can modify traffic in transit
- Bthey are used to perform man-in-the-middle attacks
- Cthey use ARP poisoning
- Dthey can access most network devices
- Ethey protect the identity of the attacker by masking the DHCP address
- Fthey can physically modify the network gateway
121A data breach has occurred and your company database has been copied. Which security principle has been violated?
- Aconfidentiality
- Bavailability
- Caccess
- Dcontrol
Information
- Description
- Quiz on Networks, created by Mo Miller on 29/08/2016.
- Author
- Mo Miller
- Language
- English
- Views
- 1
- Rating
- No ratings yet Rate this quiz