Font size
S
M
L
XL
WorksheetsMCyber_Chap14N15
Total questions: 26
Worksheet time: 24mins
Name
Class
Date
1.
In applying an ACL to a router interface, which traffic is designated as outbound?
a)
Traffic that is leaving the router and going toward the destination host
b)
Traffic that is coming from the source IP address into the router
c)
Traffic for which the router can find no routing table entry
d)
Traffic that is going from the destination IP address into the router
2.
Refer to the exhibit. A network administrator wants to create a standard ACL to prevent network 1 traffic from being transmitted to the Research and Development network. On which router interface and in which direction should the standard ACL be applied?
a)
R1 Gi0/0 inbound
b)
R1 Gi0/0 outbound
c)
R1 S0/0/0 outbound
d)
R2 S0/0/0 inbound
e)
R2 Gi0/0 outbound
3.
Which operator is used in an ACL statement to match packets of a specific application?
a)
established
b)
gt
c)
lt
d)
eq
4.
Which two statements describe appropriate general guidelines for configuring and applying ACLs? (Choose two.)
a)
Standard ACLS are placed closest to the source, whereas extended ACLS are placed closest to the destination.
b)
If an ACL contains no permit statements, all traffic is denied by default.
c)
The most specific ACL statements should be entered first because of the top-down sequential nature of ACLs.
d)
If a single ACL is to be applied to multiple interfaces, it must be configured with a unique number for each interface.
e)
Multiple ACLS per protocol and per direction can be applied to an interface.
5.
Refer to the exhibit. Which statement describes the function of the ACEs?
a)
These ACEs allow for IPv6 neighbor discovery traffic.
b)
These ACEs automatically appear at the end of every IPv6 ACL to allow IPv6 routing to occur.
c)
These are optional ACEs that can be added to the end of an IPv6 ACL to allow ICMP messages that are defined in object groups named nd-na and nd-ns.
d)
These ACEs must be manually added to the end of every IPv6 ACL to allow IPv6 routing to occur.
6.
What wild card mask will match networks 172.16.0.0 through 172.19.0.0?
a)
0.0.3.255
b)
0.252.255.255
c)
0.3.255.255
d)
0.0.255.255
7.
What method is used to apply an IPv6 ACL to a router interface?
a)
The use of the access-class command
b)
The use of the ip access-group command
c)
The use of the ipv6 traffic-filter command
d)
The use of the ipv6 access-list command
8.
Which ICMP message type should be stopped inbound?
a)
Source quench
b)
Echo-reply
c)
Echo
d)
Unreachable
9.
What type of ACL offers greater flexibility and control over network access?
a)
Numbered standard
b)
Named standard
c)
Extended
d)
Flexible
10.
Refer to the exhibit. A network administrator is configuring an IPv6 ACL to allow hosts on the 2001:DB8:CAFÉ:10::/64 network to access remote web servers, except for PC1. However, a user on PC1 can successfully access the web server PC2. Why is this possible?
a)
The IPv6 ACL Deny_WEB is spelled incorrectly when applied to the interface.
b)
The IPv6 ACL Deny_WEB is applied to the wrong interface of router R1.
c)
The IPv6 ACL Deny_WEB is applied in the incorrect direction on router R1.
d)
The IPv6 ACL Deny_WEB is permitting all web traffic before the specific host is blocked.
11.
Which scenario would cause an ACL misconfiguration and deny all traffic?
a)
Apply a standard ACL using the ip access-group out command.
b)
Apply an ACL that has all deny ACE statements.
c)
Apply a standard ACL in the inbound direction.
d)
Apply a named ACL to a VTY line.
12.
What is the quickest way to remove a single ACE from a named ACL?
a)
Use the no keyword and the sequence number of the ACE to be removed.
b)
Copy the ACL into a text editor, remove the ACE, then copy the ACL back into the router.
c)
\Create a new ACL with a different number and apply the new ACL to the router interface.
d)
Use the no access-list command to remove the entire ACL, then recreate it without the ACE.
13.
Which two keywords can be used in an access control list to replace a wildcard mask or address and wildcard mask pair? (Choose two.)
a)
host
b)
most
c)
gt
d)
some
e)
any
14.
Consider the following access list.
access-list 100 permit ip host 192.168.10.1 any
access-list 100 deny icmp 192.168.10.0 0.0.0.255 any echo
access-list 100 permit ip any any
Which two actions are taken if the access list is placed inbound on a router Gigabit Ethernet port that has the IP address 192.168.10.254 assigned? (Choose two.)
a)
Only Layer 3 connections are allowed to be made from the router to any other network device.
b)
A Telnet or SSH session is allowed from any device on the 192.168.10.0 into the router with this access list assigned.
c)
Devices on the 192.168.10.0/24 network are allowed to reply to any ping requests.
d)
Devices on the 192.168.10.0/24 network can sucessfully ping devices on the 192.168.11.0 network.
e)
Only the network device assigned the IP address 192.168.10.1 is allowed to access the router.
15.
Which statement is a characteristic of a packet filtering firewall?
a)
They filter fragmented packets.
b)
They have a high impact on network performance.
c)
They are susceptible to IP spoofing.
d)
They examine each packet in the context of the state of a connection.
16.
What is one benefit of using a next-generation firewall rather than a stateful firewall?
a)
Reactive protection against Internet threats
b)
Support of TCP-based packet filtering
c)
Support of logging
d)
Integrated use of an intrusion prevention system (IPS)
17.
What are two characteristics of an application gateway firewall? (Choose two.)
a)
Provides an integrated intrusion prevention and detection feature.
b)
Performs most filtering and firewall control in software.
c)
Uses a simple policy table look-up to filter traffic based on Layer 3 and Layer 4 information.
d)
Analyzes traffic at Layers 3, 4, 5 and 7 of the OSI model.
e)
Uses connection information maintained in a state table and analyzes traffic at OSI Layers 3, 4, and 5.
18.
What are two benefits of implementing a firewall in a network? (Choose two.)
a)
A firewall will inspect network traffic and forward traffic based solely on the Layer 2 Ethernet MAC address.
b)
A firewall will sanitize protocol flow.
c)
A firewall will prevent unauthorized traffic from being tunneled or hidden as legitimate traffic through an enteprise network.
d)
A firewall will provide accessibility of applications and sensitive resources to external untrusted users.
e)
A firewall will reduce security management complexity.
19.
Which type of firewall is commonly part of a router firewall and allows or blocks traffic based on Layer 3 or 4 information?
a)
Next generation firewall
b)
Stateful firewall
c)
Packet filtering firewall
d)
Proxy firewall
20.
Which three layers of the OSI model include information that is commonly inspected by a stateful firewall? (Choose three.)
a)
Layer 1
b)
Layer 7
c)
Layer 3
d)
Layer 4
e)
Layer 5
21.
Which type of firewall is supported by most routers and is the easiest to implement?
a)
Packet filtering firewall
b)
Next generation firewall
c)
Stateful firewall
d)
Proxy firewall
e)
Application gateway firewall
22.
Which type of firewall generally has a low impact on network performance?
a)
Next generation firewall
b)
Application gateway firewall
c)
Stateful firewall
d)
Stateless firewall
23.
Which two protocols are stateless and do not generate connection information needed to build a state table? (Choose two.)
a)
TCP
b)
HTTP
c)
UDP
d)
FTP
e)
ICMP
24.
Which type of traffic is usually blocked when implementing a demilitarized zone?
a)
Traffic that is returning from the public network and traveling to the DMZ network
b)
Traffic originating from the private network and traveling to the DMZ network
c)
Traffic originating from the DMZ network and traveling to the private network
d)
Traffic that is returning from the DMZ network and traveling to the private network
25.
How does a firewall handle traffic that is originating from the DMZ network and traveling to a private network?
a)
Traffic is usually blocked when it is originating from the DMZ network and traveling to a private network.
b)
Traffic is usually not filtered using firewall rules when it is originating from the DMZ network and traveling to a private network.
c)
Traffic is usually allowed when it is originating from the DMZ network and traveling to a private network.
d)
Traffic is allowed when it is originating from the private network, but the response traffic from the DMZ network will be blocked.
26.
When implementing a ZPF, which statement describes a zone?
a)
A zone is a group of hardened computers known as bastion hosts.
b)
A zone is a group of one or more devices that provide backup and disaster recovery mechanisms.
c)
A zone is a group of administrative devices that protect against rogue access point installations.
d)
A zone is a group of one or more interfaces that have similar functions or features.
Reset
