Module 12 CCNASEC

Which IPS signature trigger category uses the simplest triggering mechanism and searches for a specific and pre-defined atomic or composite pattern?

• Pattern-Based Detection
• Honey Pot-Based Detection
• Policy-Based Detection
• Anomaly-Based Detection

What term describes a set of rules used by an IDS or IPS to detect typical intrusion activity?

• event file
• trigger
• signature
• definition

Which type of alert is generated when an IPS incorrectly identifies normal network user traffic as attack traffic?

• true positive
• true negative
• false negative
• false positive

What is a characteristic of the Snort subscriber rule set term-based subscription?

• It is available for a fee
• It provides 30-day delayed access to updated signatures
• It focuses on reactive responses to security threats
• It does not provide access to Cisco support

Which classification indicates that an alert is verified as an actual security incident?

• false positive
• true positive
• false negative
• true negative

Which intrusion prevention service was available on first-generation ISR routers and is no longer supported by Cisco?

• Cisco IOS IPS
• Cisco Firepower Next-Generation
• External Snort IPS Server
• Cisco Snort IPS

Which statement correctly describes the configuration of a Snort VPG interface?

• The VPG0 interface must have a routable address with access to the internet
• The VPG1 interface must be configured with a public IP address
• The VPG1 interface must use a routable static IP address
• The VPG1 interface must receive an address from DHCP

What are three actions that can be performed by Snort in IDS mode? (Choose three.)

• log
• pass
• alert
• reject
• drop

Which device is a dedicated inline threat prevention appliance that is effective against both known and unknown threats?

• Cisco IOS IPS
• Cisco ASA
• Cisco Snort IPS
• Cisco FirePOWER NGIPS

Which rule action will cause Snort IPS to block a packet without logging it?

• Sdrop
• alert
• Drop
• reject