Network Security 1.0 part 1: Final Exam

Which statement describes a difference between the Cisco ASA IOS CLI feature and the router IOS CLI feature?

• ASA uses the ? command whereas a router uses the help command to receive help on a brief description and the syntax of a command.

• To complete a partially typed command, ASA uses the Ctrl+Tab key combination whereas a router uses the Tab key.

• To indicate the CLI EXEC mode, ASA uses the % symbol whereas a router uses the # symbol.

• To use a show command in a general configuration mode, ASA can use the command directly whereas a router will need to enter the do command before issuing the show command.

Answer explanation

The ASA CLI is a proprietary OS which has a similar look and feel to the Cisco router IOS. Although it shares some common features with the router IOS, it has its unique features. For example, an ASA CLI command can be executed regardless of the current configuration mode prompt. The IOS do command is not required or recognized. Both the ASA CLI and the router CLI use the # symbol to indicate the EXEC mode. Both CLIs use the Tab key to complete a partially typed command. Different from the router IOS, the ASA provides a help command that provides a brief command description and syntax for certain commands.

Refer to the exhibit. A network administrator is configuring AAA implementation on an ASA device. What does the option link3 indicate?

• the specific AAA server name

• the network name where the AAA server resides

• the interface name

• the sequence of servers in the AAA server group

What provides both secure segmentation and threat defense in a Secure Data Center solution?

• intrusion prevention system
  (IPS)

• Adaptive Security Appliance
  (ASA)

• AAA server

• Cisco Security Manager software
  (CSM)

What are the three core components of the Cisco Secure Data Center solution? (Choose three.)

• secure segmentation

• visibility

• threat defense

• mesh network

• servers

Answer explanation

Secure segmentation is used when managing and organizing data in a data center. Threat defense includes a firewall and intrusion prevention system (IPS). Data center visibility is designed to simplify operations and compliance reporting by providing consistent security policy enforcement.

What are three characteristics of ASA transparent mode? (Choose three.)

• This mode does not support VPNs, QoS, or DHCP Relay.

• NAT can be implemented between connected networks.

• This mode is referred to as a “bump in the wire.”

• The interfaces of the ASA separate Layer 3 networks and require IP addresses in different subnets.

• In this mode the ASA is invisible to an attacker.

What is needed to allow specific traffic that is sourced on the outside network of an ASA firewall to reach an internal network?

• ACL

• NAT

• outside security zone level 0

• dynamic routing protocols

Answer explanation

In order to explicitly permit traffic from an interface with a lower security level to an interface with a higher security level, an ACL must be configured. By default, traffic will only flow from a higher security level to a lower.

What will be the result of failed login attempts if the following command is entered into a router?

login block-for 150 attempts 4 within 90

• All login attempts will be blocked for 4 hours if there are 90 failed attempts within 150 seconds.

• All login attempts will be blocked for 150 seconds if there are 4 failed attempts within 90 seconds.

• All login attempts will be blocked for 90 seconds if there are 4 failed attempts within 150 seconds.

• All login attempts will be blocked for 1.5 hours if there are 4 failed attempts within 150 seconds.

Which two tasks are associated with router hardening? (Choose two.)

• disabling unused ports and interfaces

• using uninterruptible power supplies

• installing the maximum amount of memory possible

• placing the router in a secure room

• securing administrative access

Which threat protection capability is provided by Cisco ESA?

• web filtering

• cloud access security

• spam protection

• Layer 4 traffic monitoring

Answer explanation

Email is a top attack vector for security breaches. Cisco ESA includes many threat protection capabilities for email such as spam protection, forged email detection, and Cisco advanced phishing protection.

What are two security measures used to protect endpoints in the borderless network? (Choose two.)

• Snort IPS

• DMZ

• denylisting

• rootkit

• DLP

Answer explanation

antimalware software - Protect endpoints from malware.

spam filtering - Prevent spam emails from reaching endpoints.

blocklisting - Prevent endpoints from connecting to websites with bad reputations by immediately blocking connections based on the latest reputation intelligence.

data loss prevention (DLP) - Prevent sensitive information from being lost or stolen.