Font size
S
M
L
XL
WorksheetsMCyber_Chap16N18
Total questions: 24
Worksheet time: 24mins
Name
Class
Date
1.
Which statement describes a feature of a zone-based policy firewall?
a)
All traffic through a given interface is subject to the same inspection.
b)
It uses a flat, non-hierarchical data structure making it easier to configure and troubleshoot.
c)
The router security posture is to allow traffic unless explicitly blocked.
d)
It does not depend on ACLs.
2.
Which statement describes a zone when implementing ZPF on a Cisco router?
a)
Only one zone can be attached to a single interface.
b)
A zone is used to define security policies for a unique interface on the router.
c)
A zone is used to implement traffic filtering for either TCP or UDP.
d)
A zone establishes a security border of a network.
3.
Designing a ZPF requires several steps. Which step involves defining boundaries where traffic is subjected to policy restrictions as it crosses to another region of the network?
a)
Determine the zones
b)
Design the physical infrastructure
c)
Identify subsets within zones and merge traffic requirements
d)
Establish policies between zones
4.
Which statement describes one of the rules that govern interface behavior in the context of implementing a zone-based policy firewall configuration?
a)
An administrator can assign interfaces to zones, regardless of whether the zone has been configured.
b)
An administrator can assign an interface to multiple security zones.
c)
By default, traffic is allowed to flow among interfaces that are members of the same zone.
d)
By default, traffic is allowed to flow between a zone member interface and any interface that is not a zone member.
5.
Which three statements describe zone-based policy firewall rules that govern interface behavior and the traffic moving between zone member interfaces? (Choose three.)
a)
To permit traffic to and from a zone member interface, a policy allowing or inspecting traffic must be configured between that zone and any other zone.
b)
If traffic is to flow between all interfaces in a router, each interface must be a member of a zone.
c)
Interfaces can be assigned to a zone before the zone is created.
d)
An interface can be assigned to multiple security zones.
e)
Pass, inspect, and drop options can only be applied between two zones.
6.
In ZPF design, what is described as the self zone?
a)
A predefined cluster of routers with configured interfaces
b)
A predefined cluster of servers with configured interfaces
c)
The outward facing interface on the edge router
d)
The router itself, including all interfaces with assigned IP addresses
7.
How does ZPF handle traffic between an interface that is a zone member and another interface that does not belong to any zone?
a)
Inspect
b)
Allow
c)
Drop
d)
Pass
8.
Which statement describes a factor to be considered when configuring a zone-based policy firewall?
a)
The classic firewall ip inspect command can coexist with ZPF as long as it is used on interfaces that are in the same security zones.
b)
The router always filters the traffic between interfaces in the same zone.
c)
A zone must be configured with the zone security global command before it can be used in the zone-member security command.
d)
An interface can belong to multiple zones.
9.
Which statement accurately describes Cisco IOS Zone-Based Policy Firewall operation?
a)
The pass action works in only one direction.
b)
Service policies are applied in interface configuration mode.
c)
A router interface can belong to multiple zones.
d)
Router management interfaces must be manually assigned to the self zone.
10.
When a Cisco IOS Zone-Based Policy Firewall is being configured, which two actions can be applied to a traffic class? (Choose two.)
a)
Drop
b)
Log
c)
Forward
d)
Inspect
e)
Copy
11.
In what step of zone-based policy firewall configuration is traffic identified for policy application?
a)
Creating policy maps
b)
Configuring class maps
c)
Defining zones
d)
Assigning policy maps to zones
12.
When configuring a class map for zone-based policy firewall, how are the match criteria applied when using the match-all parameter?
a)
Traffic must match all of the match criteria specified in the statement.
b)
Traffic must match the first criteria in the statement.
c)
Traffic must match at least one of the match criteria statements.
d)
Traffic must match according to an exclusive disjunction criteria.
13.
What is the purpose of the DH algorithm?
a)
To provide nonrepudiation support
b)
To generate a shared secret between two hosts that have not communicated before
c)
To encrypt data traffic after a VPN is established
d)
To support email data confidentiality
14.
Which statement is a feature of HMAC?
a)
HMAC uses a secret key that is only known to the sender and defeats man-in-the-middle attacks.
b)
HMAC uses protocols such as SSL or TLS to provide session layer confidentiality.
c)
HMAC uses a secret key as input to the hash function, adding authentication to integrity assurance.
d)
HMAC is based on the RSA hash function.
15.
Which requirement of secure communications is ensured by the implementation of MD5 or SHA hash generating algorithms?
a)
Nonrepudiation
b)
Authentication
c)
Integrity
d)
Confidentiality
16.
Which two statements correctly describe certificate classes used in the PKI? (Choose two.)
a)
A class 0 certificate is for testing purposes.
b)
A class 0 certificate is more trusted than a class 1 certificate.
c)
The lower the class number, the more trusted the certificate.
d)
A class 5 certificate is for users with a focus on verification of email.
e)
A class 4 certificate is for online business transactions between companies.
17.
Which statement describes the use of certificate classes in the PKI?
a)
Email security is provided by the vendor, not by a certificate.
b)
A vendor must issue only one class of certificates when acting as a CA.
c)
A class 5 certificate is more trustworthy than a class 4 certificate.
d)
The lower the class number, the more trusted the certificate.
18.
What technology allows users to verify the identity of a website and to trust code that is downloaded from the Internet?
a)
Encryption
b)
Asymmetric key algorithm
c)
Digital signature
d)
Hash algorithm
19.
What two assurances does digital signing provide about code that is downloaded from the Internet? (Choose two.)
a)
The code is authentic and is actually sourced by the publisher.
b)
The code contains no errors.
c)
The code has not been modified since it left the software publisher.
d)
The code contains no viruses.
e)
The code was encrypted with both a private and public key.
20.
What term is used to describe the technology that replaces sensitive information with a nonsensitive version?
a)
Blanking
b)
Whiteout
c)
Masking
d)
Retracting
e)
Hiding
21.
What term is used to describe concealing data in another file such as a graphic, audio or video file?
a)
Steganography
b)
Hiding
c)
Masking
d)
Obfuscation
22.
What is a strength of using a hashing function?
a)
It is a one-way function and not reversible.
b)
Two different files can be created that have the same output.
c)
It has a variable length output.
d)
It is not commonly used in security.
e)
It can take only a fixed length message.
23.
An investigator finds a USB drive at a crime scene and wants to present it as evidence in court. The investigator takes the USB drive and creates a forensic image of it and takes a hash of both the original USB device and the image that was created. What is the investigator attempting to prove about the USB drive when the evidence is submitted in court?
a)
The investigator found a USB drive and was able to make a copy of it.
b)
An exact copy cannot be made of a device.
c)
The data is all there.
d)
The data in the image is an exact copy and nothing has been altered by the process.
24.
In which way does the use of HTTPS increase the security monitoring challenges within enterprise networks?
a)
HTTPS traffic can carry a much larger data payload than HTTP can carry.
b)
HTTPS traffic is much faster than HTTP traffic.
c)
HTTPS traffic does not require authentication.
d)
HTTPS traffic enables end-to-end encryption.
Reset
