Network Security - Modules 8-10

1. When creating an ACL, which keyword should be used to document and interpret the purpose of the ACL statement on a Cisco device?

• remark

• • description

• established

• • eq

2. Which two pieces of information are required when creating a standard access control list? (Choose two.)

• access list number between 1 and 99

• source address and wildcard mask

• • destination address and wildcard mask

• • subnet mask and wildcard mask

• • access list number between 100 and 199

3. What two steps provide the quickest way to completely remove an ACL from a router? (Choose two.)

• • Removal of the ACEs is the only step required.

• • Modify the number of the ACL so that it doesn’t match the ACL associated with the interface.

• • Copy the ACL into a text editor, add no before each ACE, then copy the ACL back into the router.

• Remove the inbound/outbound reference to the ACL from the interface.

• Use the no access-list command to remove the entire ACL.

4. Which two types of addresses should be denied inbound on a router interface that attaches to the Internet? (Choose two.)

• private IP addresses

• any IP address that starts with the number 127

• • any IP address that starts with the number 1

• • NAT translated IP addresses

• • public IP addresses

5. In the creation of an IPv6 ACL, what is the purpose of the implicit final command entries, permit icmp any any nd-na and permit icmp any any nd-ns ?

• • to allow forwarding of ICMPv6 packets

• • to allow automatic address configuration

• to allow IPv6 to MAC address resolution

• • to allow forwarding of IPv6 multicast packets

6. What two statements describe characteristics of IPv6 access control lists? (Choose two.)

• • They permit ICMPv6 router advertisements by default.

• • They can be named or numbered.

• They include two implicit permit statements by default.

• • They are applied to an interface with the ip access-group command.

• They use prefix lengths to indicate how much of an address to match.

7. Refer to the exhibit. A network administrator created an IPv6 ACL to block the Telnet traffic from the 2001:DB8:CAFE:10::/64 network to the 2001:DB8:CAFE:30::/64 network. What is a command the administrator could use to allow only a single host 2001:DB8:CAFE:10::A/64 to telnet to the 2001:DB8:CAFE:30::/64 network?

• • permit tcp 2001:DB8:CAFE:10::A/64 2001:DB8:CAFE:30::/64 eq 23

• • permit tcp 2001:DB8:CAFE:10::A/64 eq 23 2001:DB8:CAFE:30::/64

• • permit tcp host 2001:DB8:CAFE:10::A eq 23 2001:DB8:CAFE:30::/64

• permit tcp host 2001:DB8:CAFE:10::A 2001:DB8:CAFE:30::/64 eq 23 sequence 5

8. When implementing components into an enterprise network, what is the purpose of a firewall?

• • A firewall is a system that inspects network traffic and makes forwarding decisions based solely on Layer 2 Ethernet MAC addresses.

• • A firewall is a system that is designed to secure, monitor, and manage mobile devices, including corporate-owned devices and employee-owned devices.

• • A firewall is a system that stores vast quantities of sensitive and business-critical information.

• A firewall is a system that enforces an access control policy between internal corporate networks and external networks.

9. What are two possible limitations of using a firewall in a network? (Choose two.)

• • It provides accessibility of applications and sensitive resources to external untrusted users.

• • It increases security management complexity by requiring off-loading network access control to the device.

• A misconfigured firewall can create a single point of failure.

• Network performance can slow down.

• • It cannot sanitize protocol flows.

10. Which type of firewall makes use of a proxy server to connect to remote servers on behalf of clients?

• • stateful firewall

• • stateless firewall

• • packet filtering firewall

• application gateway firewall