Worksheetsmodule-8-17
Total questions: 140
Worksheet time: 1hrs 20mins
When creating an ACL, which keyword should be used to document and interpret the purpose of the ACL statement on a Cisco device?
remark
description
established
eq
Which two pieces of information are required when creating a standard access control list? (Choose two.)
access list number between 1 and 99
source address and wildcard mask
destination address and wildcard mask
subnet mask and wildcard mask
access list number between 100 and 199
What two steps provide the quickest way to completely remove an ACL from a router? (Choose two.)
Modify the number of the ACL so that it doesn’t match the ACL associated with the interface.
Copy the ACL into a text editor, add no before each ACE, then copy the ACL back into the router.
Remove the inbound/outbound reference to the ACL from the interface.
Use the no access-list command to remove the entire ACL.
Use the no keyword and the sequence number of every ACE within the named ACL to be removed.
Which two types of addresses should be denied inbound on a router interface that attaches to the Internet? (Choose two.)
private IP addresses
any IP address that starts with the number 127
any IP address that starts with the number 1
NAT translated IP addresses
public IP addresses
In the creation of an IPv6 ACL, what is the purpose of the implicit final command entries, permit icmp any any nd-na and permit icmp any any nd-ns ?
to allow forwarding of ICMPv6 packets
to allow automatic address configuration
to allow IPv6 to MAC address resolution
to allow forwarding of IPv6 multicast packets
What two statements describe characteristics of IPv6 access control lists? (Choose two.)
They permit ICMPv6 router advertisements by default.
They can be named or numbered.
They include two implicit permit statements by default.
They are applied to an interface with the ip access-group command .
They use prefix lengths to indicate how much of an address to match.
Refer to the exhibit. A network administrator created an IPv6 ACL to block the Telnet traffic from the 2001:DB8:CAFE:10::/64 network to the 2001:DB8:CAFE:30::/64 network. What is a command the administrator could use to allow only a single host 2001:DB8:CAFE:10::A/64 to telnet to the 2001:DB8:CAFE:30::/64 network?
permit tcp 2001:DB8:CAFE:10::A/64 2001:DB8:CAFE:30::/64 eq 23
permit tcp 2001:DB8:CAFE:10::A/64 eq 23 2001:DB8:CAFE:30::/64
permit tcp host 2001:DB8:CAFE:10::A eq 23 2001:DB8:CAFE:30::/64
permit tcp host 2001:DB8:CAFE:10::A 2001:DB8:CAFE:30::/64 eq 23 sequence 5
When implementing components into an enterprise network, what is the purpose of a firewall?
A firewall is a system that inspects network traffic and makes forwarding decisions based solely on Layer 2 Ethernet MAC addresses.
A firewall is a system that is designed to secure, monitor, and manage mobile devices, including corporate-owned devices and employee-owned devices.
A firewall is a system that stores vast quantities of sensitive and business-critical information.
A firewall is a system that enforces an access control policy between internal corporate networks and external networks.
What are two possible limitations of using a firewall in a network? (Choose two.)
It provides accessibility of applications and sensitive resources to external untrusted users.
It increases security management complexity by requiring off-loading network access control to the device.
A misconfigured firewall can create a single point of failure.
Network performance can slow down.
It cannot sanitize protocol flows.
Which type of firewall makes use of a proxy server to connect to remote servers on behalf of clients?
stateful firewall
stateless firewall
packet filtering firewall
application gateway firewall
How does a firewall handle traffic when it is originating from the public network and traveling to the private network?
Traffic that is originating from the public network is not inspected when traveling to the private network.
Traffic that is originating from the public network is usually blocked when traveling to the private network.
Traffic that is originating from the public network is usually permitted with little or no restrictions when traveling to the private network.
Traffic that is originating from the public network is selectively permitted when traveling to the private network.
Which two statements describe the two configuration models for Cisco IOS firewalls? (Choose two.)
ZPF must be enabled in the router configuration before enabling an IOS Classic Firewall.
The IOS Classic Firewall and ZPF cannot be combined on a single interface.
IOS Classic Firewalls and ZPF models can be enabled on a router concurrently.
Both IOS Classic Firewall and ZPF models require ACLs to define traffic filtering policies.
IOS Classic Firewalls must be enabled in the router configuration before enabling ZPF.
Designing a ZPF requires several steps. Which step involves dictating the number of devices between most-secure and least-secure zones and determining redundant devices?
determine the zones
design the physical infrastructure
establish policies between zones
identify subsets within zones and merge traffic requirements
When a Cisco IOS zone-based policy firewall is being configured, which three actions can be applied to a traffic class? (Choose three.)
pass
reroute
queue
inspect
drop
When using Cisco IOS zone-based policy firewall, where is the inspection policy applied?
to a global service policy
to a zone
to an interface
to a zone pair
What is the first step in configuring a Cisco IOS zone-based policy firewall via the CLI?
Define traffic classes.
Assign router interfaces to zones.
Define firewall policies.
Assign policy maps to zone pairs.
Create zones.
What is one benefit of using a stateful firewall instead of a proxy server?
ability to perform user authentication
better performance
ability to perform packet filtering
prevention of Layer 7 attacks
Which statement describes a typical security policy for a DMZ firewall configuration?
Traffic that originates from the DMZ interface is selectively permitted to the outside interface.
Return traffic from the inside that is associated with traffic originating from the outside is permitted to traverse from the inside interface to the outside interface.
Return traffic from the outside that is associated with traffic originating from the inside is permitted to traverse from the outside interface to the DMZ interface.
Traffic that originates from the inside interface is generally blocked entirely or very selectively permitted to the outside interface.
Traffic that originates from the outside interface is permitted to traverse the firewall to the inside interface with few or no restrictions.
What is one limitation of a stateful firewall?
weak user authentication
cannot filter unnecessary traffic
not as effective with UDP- or ICMP-based traffic
poor log information
Which statement describes Cisco IOS Zone-Based Policy Firewall operation?
The pass action works in only one direction.
Router management interfaces must be manually assigned to the self zone.
A router interface can belong to multiple zones.
Service policies are applied in interface configuration mode.
What is the result in the self zone if a router is the source or destination of traffic?
No traffic is permitted.
All traffic is permitted.
Only traffic that originates in the router is permitted.
Only traffic that is destined for the router is permitted.
What are two characteristics of ACLs? (Choose two.)
Extended ACLs can filter on destination TCP and UDP ports.
Standard ACLs can filter on source TCP and UDP ports.
Extended ACLs can filter on source and destination IP addresses.
Standard ACLs can filter on source and destination IP addresses.
Standard ACLs can filter on source and destination TCP and UDP ports.
Which three statements describe ACL processing of packets? (Choose three.)
An implicit deny any rejects any packet that does not match any ACE.
A packet can either be rejected or forwarded as directed by the ACE that is matched.
A packet that has been denied by one ACE can be permitted by a subsequent ACE.
A packet that does not match the conditions of any ACE will be forwarded by default.
Each statement is checked only until a match is detected or until the end of the ACE list.
A network administrator configures an ACL with the command R1(config)# access-list 1 permit 172.16.0.0 0.0.15.255. Which two IP addresses will match this ACL statement? (Choose two.)
172.16.0.255
172.16.15.36
172.16.16.12
172.16.31.24
172.16.65.21
What single access list statement matches all of the following networks?
192.168.16.0
192.168.17.0
192.168.18.0
192.168.19.0
access-list 10 permit 192.168.16.0 0.0.3.255
access-list 10 permit 192.168.16.0 0.0.0.255
access-list 10 permit 192.168.16.0 0.0.15.255
access-list 10 permit 192.168.0.0 0.0.15.255
Which two characteristics are shared by both standard and extended ACLs? (Choose two.)
Both kinds of ACLs can filter based on protocol type.
Both can permit or deny specific services by port number.
Both include an implicit deny as a final statement.
Both filter packets for a specific destination host IP address.
Both filter packets for a specific destination host IP address.
What are two characteristics of both IPS and IDS sensors? (Choose two.)
neither introduce latency or jitter
both use signatures to detect patterns
both are deployed inline in the data stream
both can stop trigger packets
both can detect atomic patterns
What is an advantage of using an IPS?
It is installed outside of the data traffic flow.
It does not impact network traffic if there is a sensor overload.
It can stop trigger packets.
It has no impact on network latency.
What is a characteristic of an IDS?
It can affect network performance by introducing latency and jitter.
It often requires assistance from other network devices to respond to an attack.
It is installed inline with the network traffic flow.
It can be configured to drop trigger packets that are associated with a connection.
What are two characteristics of an IPS operating in promiscuous mode? (Choose two.)
It can stop malicious traffic from reaching the intended target for all types of attacks.
It sits directly in the path of the traffic flow.
It requires the assistance of another network device to respond to an attack.
It does not impact the flow of packets in forwarded traffic.
It sends alerts and drops any malicious packets.
Which tool can perform real-time traffic and port analysis, and can also detect port scans, fingerprinting and buffer overflow attacks?
SIEM
Nmap
Snort
Netflow
What is a minimum system requirement to activate Snort IPS functionality on a Cisco router?
at least 4 GB RAM
at least 4 GB flash
ISR 2900 or higher
K9 license
What is PulledPork?
an open source network IPS that performs real-time traffic analysis and generates alerts when threats are detected on IP networks
a centralized management tool to push the rule sets based on preconfigured policy, to Cisco routers
a virtual service container that runs on the Cisco ISR router operating system
a rule management application that can be used to automatically download Snort rule updates
What are two actions that an IPS can perform whenever a signature detects the activity for which it is configured? (Choose two.)
disable the link
reconverge the network
drop or prevent the activity
allow the activity
restart the infected device
Which IPS signature trigger category uses a decoy server to divert attacks away from production devices?
honey pot-based detection
policy-based detection
pattern-based detection
anomaly-based detection
What situation will generate a true negative IPS alarm type?
normal traffic that generates a false alarm
a verified security incident that is detected
a known attack that is not detected
normal traffic that is correctly being ignored and forwarded
Match each intrusion protection service with the description.
1. an IPS solution that requires a promiscuous port and an external Snort IDS/IPS
2. an IPS service enabled on a second generation ISR
3. an IPS service enabled on first generation ISRs that is no longer supported
4. a dedicated inline threat prevention appliance
A. External Snort IPS Server
B. Cisco IOS IPS
C. Cisco Snort IPS
D. Cisco Firepower Next-Generation IPS
(a)
Match each Snort IPS rule action with the description.
1. ingores the packet
2. blocks and logs the packet and sends a TCP reset or ICMP port unreachable message
3. blocks and logs the packet
4. blocks but does not log the packet
A. Sdrop
B. Pass
C. Drop
D. Reject
(a)
What is provided by the fail open and close functionality of Snort IPS?
provides the ability to automatically disable problematic signatures that routinely cause false positives and pass traffic
blocks the traffic flow or bypasses IPS checking in the event of an IPS engine failure
keeps Snort current with the latest threat protection and term-based subscriptions
keeps track of the health of the Snort engine that is running in the service container
What is a characteristic of the Community Rule Set type of Snort term-based subscriptions?
it has 60-day delayed access to updated signatures
it uses Cisco Talos to provide coverage in advance of exploits
it is fully supported by Cisco
it is available for free
What is a characteristic of the connectivity policy setting when configuring Snort threat protection?
it attempts to balance network security with network performance
it prioritizes security over connectivity
it provides the lowest level of protection
it enables the highest number of signatures to be verified
What is contained in an OVA file?
a current compilation of known threats and prevention mechanisms
an installable version of a virtual machine
a list of atomic and composite signatures
a set of rules for an IDS or IPS to detect intrusion activity
What is a network tap?
a Cisco technology that provides statistics on packets flowing through a router or multilayer switch
a technology used to provide real-time reporting and long-term analysis of security events
a feature supported on Cisco switches that enables the switch to copy frames and forward them to an analysis device
a passive device that forwards all traffic and physical layer errors to an analysis device
Which statement describes the function of the SPAN tool used in a Cisco switch?
It is a secure channel for a switch to send logging to a syslog server.
It provides interconnection between VLANs over multiple switches.
It supports the SNMP trap operation on a switch.
It copies the traffic from one switch port and sends it to another switch port that is connected to a monitoring device.
A network administrator is trying to download a valid file from an internal server. However, the process triggers an alert on a NMS tool. What condition describes this alert?
false negative
false positive
true negative
true positive
What is an advantage of HIPS that is not provided by IDS?
HIPS provides quick analysis of events through detailed logging.
HIPS deploys sensors at network entry points and protects critical network segments.
HIPS monitors network processes and protects critical files.
HIPS protects critical system resources and monitors operating system processes.
What information must an IPS track in order to detect attacks matching a composite signature?
the total number of packets in the attack
the state of packets related to the attack
the attacking period used by the attacker
the network bandwidth consumed by all packets
Why are traditional network security perimeters not suitable for the latest consumer-based network endpoint devices?
These devices are not managed by the corporate IT department.
These devices pose no risk to security as they are not directly connected to the corporate network.
These devices connect to the corporate network through public wireless networks.
These devices are more varied in type and are portable.
What two internal LAN elements need to be secured? (Choose two.)
edge routers
IP phones
fiber connections
switches
cloud-based hosts
What are two examples of traditional host-based security measures? (Choose two.)
host-based IPS
NAS
802.1X
antimalware software
host-based NAC
In an 802.1x deployment, which device is a supplicant?
RADIUS server
access point
switch
end-user station
A company implements 802.1X security on the corporate network. A PC is attached to the network but has not authenticated yet. Which 802.1X state is associated with this PC?
err-disabled
disabled
unauthorized
forwarding
An 802.1X client must authenticate before being allowed to pass data traffic onto the network. During the authentication process, between which two devices is the EAP data encapsulated into EAPOL frames? (Choose two.)
data nonrepudiation server
authentication server (TACACS)
supplicant (client)
authenticator (switch)
ASA Firewall
Which command is used as part of the 802.1X configuration to designate the authentication method that will be used?
dot1x system-auth-control
aaa authentication dot1x
aaa new-model
dot1x pae authenticator
What is involved in an IP address spoofing attack?
A rogue node replies to an ARP request with its own MAC address indicated for the target IP address.
Bogus DHCPDISCOVER messages are sent to consume all the available IP addresses on a DHCP server.
A rogue DHCP server provides false IP configuration parameters to legitimate DHCP clients.
A legitimate network IP address is hijacked by a rogue node.
At which layer of the OSI model does Spanning Tree Protocol operate?
Layer 1
Layer 2
Layer 3
Layer 4
A network administrator uses the spanning-tree loopguard default global configuration command to enable Loop Guard on switches. What components in a LAN are protected with Loop Guard?
All Root Guard enabled ports.
All PortFast enabled ports.
All point-to-point links between switches.
All BPDU Guard enabled ports.
Which procedure is recommended to mitigate the chances of ARP spoofing?
Enable DHCP snooping on selected VLANs.
Enable IP Source Guard on trusted ports.
Enable DAI on the management VLAN.
Enable port security globally.
Which two ports can send and receive Layer 2 traffic from a community port on a PVLAN? (Choose two.)
community ports belonging to other communities
promiscuous ports
isolated ports within the same community
PVLAN edge protected ports
community ports belonging to the same community
Which protocol should be used to mitigate the vulnerability of using Telnet to remotely manage network devices?
SNMP
TFTP
SSH
SCP
How can DHCP spoofing attacks be mitigated?
by disabling DTP negotiations on nontrunking ports
by implementing port security
by the application of the ip verify source command to untrusted ports
by implementing DHCP snooping on trusted ports
Refer to the exhibit. The network administrator is configuring the port security feature on switch SWC. The administrator issued the command show port-security interface fa 0/2 to verify the configuration. What can be concluded from the output that is shown? (Choose three.)
Three security violations have been detected on this interface.
This port is currently up.
Security violations will cause this port to shut down immediately.
The switch port mode for this interface is access mode.
There is no device currently connected to this port.
Two devices that are connected to the same switch need to be totally isolated from one another. Which Cisco switch security feature will provide this isolation?
PVLAN Edge
DTP
SPAN
BPDU guard
What is the behavior of a switch as a result of a successful CAM table attack?
The switch will drop all received frames.
The switch interfaces will transition to the error-disabled state.
The switch will forward all received frames to all other ports.
The switch will shut down.
Which protocol defines port-based authentication to restrict unauthorized hosts from connecting to the LAN through publicly accessible switch ports?
RADIUS
TACACS+
802.1x
SSH
What device is considered a supplicant during the 802.1X authentication process?
the router that is serving as the default gateway
the authentication server that is performing client authentication
the client that is requesting authentication
the switch that is controlling network access
Which term describes the role of a Cisco switch in the 802.1X port-based access control?
agent
supplicant
authenticator
authentication server
What type of data does the DLP feature of Cisco Email Security Appliance scan in order to prevent customer data from being leaked outside of the company?
inbound messages
outbound messages
messages stored on a client device
messages stored on the email server
What is the goal of the Cisco NAC framework and the Cisco NAC appliance?
to ensure that only hosts that are authenticated and have had their security posture examined and approved are permitted onto the network
to monitor data from the company to the ISP in order to build a real-time database of current spam threats from both internal and external sources
to provide anti-malware scanning at the network perimeter for both authenticated and non-authenticated devices
to provide protection against a wide variety of web-based threats, including adware, phishing attacks, Trojan horses, and worms
Which Cisco solution helps prevent MAC and IP address spoofing attacks?
Port Security
DHCP Snooping
IP Source Guard
Dynamic ARP Inspection
What Layer 2 attack is mitigated by disabling Dynamic Trunking Protocol?
VLAN hopping
DHCP spoofing
ARP poisoning
ARP spoofing
What is the result of a DHCP starvation attack?
Legitimate clients are unable to lease IP addresses.
Clients receive IP address assignments from a rogue DHCP server.
The attacker provides incorrect DNS and default gateway information to clients.
The IP addresses assigned to legitimate clients are hijacked.
A network administrator is configuring DAI on a switch with the command ip arp inspection validate dst-mac. What is the purpose of this configuration command?
to check the destination MAC address in the Ethernet header against the MAC address table
to check the destination MAC address in the Ethernet header against the user-configured ARP ACLs
to check the destination MAC address in the Ethernet header against the target MAC address in the ARP body
to check the destination MAC address in the Ethernet header against the source MAC address in the ARP body
Which algorithm can ensure data integrity?
RSA
AES
MD5
PKI
What is the keyspace of an encryption algorithm?
the set of all possible values used to generate a key
the set of procedures used to calculate asymmetric keys
the set of hash functions used to generate a key
the mathematical equation that is used to create a key
Alice and Bob are using a digital signature to sign a document. What key should Alice use to sign the document so that Bob can make sure that the document came from Alice?
private key from Bob
private key from Alice
public key from Bob
username and password from Alice
Which three security services are provided by digital signatures? (Choose three.)
provides nonrepudiation using HMAC functions
guarantees data has not changed in transit
provides data encryption
authenticates the source
provides confidentiality of digitally signed data
What is another name for confidentiality of information?
consistency
trustworthiness
accuracy
privacy
As data is being stored on a local hard disk, which method would secure the data from unauthorized access?
a duplicate hard drive copy
deletion of sensitive files
two factor authentication
data encryption
What popular encryption algorithm requires that both the sender and receiver know a pre-shared key?
PKI
MD5
AES
HMAC
In which method used in cryptanalysis does the attacker know a portion of the plaintext and the corresponding ciphertext?
meet-in-the-middle
brute-force
chosen-plaintext
ciphertext
Match the disciplines or roles to the descriptions.
1. individuals who try to crack secret codes
2. the science of making and breaking secret codes
3. testing the strength of security by breaking secret codes
4. the development and use of codes
A. cryptanalyst
B. cryptology
C cryptography
D. cryptanalysis
(a)
What technology supports asymmetric key encryption used in IPsec VPNs?
3DES
IKE
SEAL
AES
What are two symmetric encryption algorithms? (Choose two.)
3DES
MD5
AES
HMAC
SHA
Which two items are used in asymmetric encryption? (Choose two.)
a token
a TPM
a private key
a DES key
a public key
What are two properties of a cryptographic hash function? (Choose two.)
Complex inputs will produce complex hashes.
Hash functions can be duplicated for authentication purposes.
The hash function is one way and irreversible.
The input for a particular hash algorithm has to have a fixed size.
The output is a fixed length.
Which statement describes asymmetric encryption algorithms?
They have key lengths ranging from 80 to 256 bits.
They include DES, 3DES, and AES.
They are also called shared-secret key algorithms.
They are relatively slow because they are based on difficult computational algorithms.
An IT enterprise is recommending the use of PKI applications to securely exchange information between the employees. In which two cases might an organization use PKI applications to securely exchange information between users? (Choose two.)
HTTPS web service
802.1x authentication
local NTP server
FTP transfers
file and directory access permission
Two users must authenticate each other using digital certificates and a CA. Which option describes the CA authentication procedure?
The users must obtain the certificate of the CA and then their own certificate.
The CA is always required, even after user verification is complete.
CA certificates are retrieved out-of-band using the PSTN, and the authentication is done in-band over a network.
After user verification is complete, the CA is no longer required, even if one of the involved certificates expires.
The following message was encrypted using a Caesar cipher with a key of 2:
fghgpf vjg ecuvng
What is the plaintext message?
invade the castle
defend the castle
defend the region
invade the region
In a hierarchical CA topology, where can a subordinate CA obtain a certificate for itself?
from the root CA or another subordinate CA at a higher level
from the root CA or another subordinate CA at the same level
from the root CA or from self-generation
from the root CA only
from the root CA or another subordinate CA anywhere in the tree
What is the purpose for using digital signatures for code signing?
to establish an encrypted connection to exchange confidential data with a vendor website
to verify the integrity of executable files downloaded from a vendor website
to authenticate the identity of the system with a vendor website
to generate a virtual ID
What technology has a function of using trusted third-party protocols to issue credentials that are accepted as an authoritative identity?
digital signatures
hashing algorithms
PKI certificates
symmetric keys
Which requirement of secure communications is ensured by the implementation of MD5 or SHA hash generating algorithms?
nonrepudiation
authentication
integrity
confidentiality
What is an example of the one-time pad cipher?
RC4
rail fence
Caesar
Vigenère
A company is developing a security policy for secure communication. In the exchange of critical messages between a headquarters office and a branch office, a hash value should only be recalculated with a predetermined code, thus ensuring the validity of data source. Which aspect of secure communications is addressed?
data integrity
non-repudiation
data confidentiality
origin authentication
What is the purpose of a digital certificate?
It guarantees that a website has not been hacked.
It provides proof that data has a traditional signature attached.
It ensures that the person who is gaining access to a network device is authorized.
It authenticates a website and establishes a secure connection to exchange confidential data.
Which two statements describe the IPsec protocol framework? (Choose two.)
AH uses IP protocol 51.
AH provides integrity and authentication.
AH provides encryption and integrity.
ESP uses UDP protocol 51.
AH provides both authentication and encryption.
What technology is used to negotiate security associations and calculate shared keys for an IPsec VPN tunnel?
PSK
SHA
3DES
IKE
What are the two modes used in IKE Phase 1? (Choose two.)
passive
primary
main
secondary
aggressive
What takes place during IKE Phase 2 when establishing an IPsec VPN?
Traffic is exchanged between IPsec peers.
IPsec security associations are exchanged.
ISAKMP security associations are exchanged.
Interesting traffic is identified.
A site-to-site IPsec VPN is to be configured. Place the configuration steps in order.
1. Configure a Crypto Map for the IPsec Policy
2. Configure the ISAKMP policies for the IKE Phase 2
3. Apply the IPsec Policy
4. Configure the ISAKMP policies for IKE Phase 1
5. Verify that the IPsec Tunnel is operational.
(a)
Refer to the exhibit. A VPN tunnel is configured on the WAN between R1 and R2. On which R1 interface(s) would a crypto map be applied in order to create a VPN between R1 and R2?
G0/0 and G0/1
G0/0
all R1 interfaces
S0/0/0
Router R1 has configured ISAKMP policies numbered 1, 5, 9, and 203. Router R2 only has default policies. How will R1 attempt to negotiate the IKE Phase 1 ISAKMP tunnel with R2?
R1 and R2 cannot match policies because the policy numbers are different.
R1 will attempt to match policy #1 with the most secure matching policy on R2.
R1 will try to match policy #203 with the most secure default policy on R2.
R1 will begin to try to match policy #1 with policy #65514 on R2.
When the CLI is used to configure an ISR for a site-to-site VPN connection, what is the purpose of the crypto map command in interface configuration mode?
to configure the transform set
to bind the interface to the ISAKMP policy
to force IKE Phase 1 negotiations to begin
to negotiate the SA policy
Which statement describes the effect of key length in deterring an attacker from hacking through an encryption key?
The length of a key does not affect the degree of security.
The shorter the key, the harder it is to break.
The length of a key will not vary between encryption algorithms.
The longer the key, the more key possibilities exist.
Which two statements describe a remote access VPN? (Choose two.)
It may require VPN client software on hosts.
It requires hosts to send TCP/IP traffic through a VPN gateway.
It connects entire networks to each other.
It is used to connect individual hosts securely to a company network over the Internet.
It requires static configuration of the VPN tunnel.
Which protocol creates a virtual point-to-point connection to tunnel unencrypted traffic between Cisco routers from a variety of protocols?
IKE
IPsec
OSPF
GRE
How is “tunneling” accomplished in a VPN?
New headers from one or more VPN protocols encapsulate the original packets.
All packets between two hosts are assigned to a single physical medium to ensure that the packets are kept private.
Packets are disguised to look like other types of traffic so that they will be ignored by potential attackers.
A dedicated circuit is established between the source and destination devices for the duration of the connection.
Which two scenarios are examples of remote access VPNs? (Choose two.)
All users at a large branch office can access company resources through a single VPN connection.
A small branch office with three employees has a Cisco ASA that is used to create a VPN connection to the HQ.
A toy manufacturer has a permanent VPN connection to one of its parts suppliers.
A mobile sales agent is connecting to the company network via the Internet connection at a hotel.
An employee who is working from home uses VPN client software on a laptop in order to connect to the company network.
Which statement accurately describes a characteristic of IPsec?
IPsec works at the application layer and protects all application data.
IPsec is a framework of standards developed by Cisco that relies on OSI algorithms.
IPsec is a framework of proprietary standards that depend on Cisco specific algorithms.
IPsec works at the transport layer and protects data at the network layer.
IPsec is a framework of open standards that relies on existing algorithms.
Which is a requirement of a site-to-site VPN?
It requires hosts to use VPN client software to encapsulate traffic.
It requires the placement of a VPN server at the edge of the company network.
It requires a VPN gateway at each end of the tunnel to encrypt and decrypt traffic.
It requires a client/server architecture.
Consider the following configuration on a Cisco ASA:
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
What is the purpose of this command?
to define the ISAKMP parameters that are used to establish the tunnel
to define the encryption and integrity algorithms that are used to build the IPsec tunnel
to define what traffic is allowed through and protected by the tunnel
to define only the allowed encryption algorithms
What is needed to define interesting traffic in the creation of an IPsec tunnel?
security associations
hashing algorithm
access list
transform set
What is a function of the GRE protocol?
to configure the set of encryption and hashing algorithms that will be used to transform the data sent through the IPsec tunnel
to encapsulate multiple OSI Layer 3 protocol packet types inside an IP tunnel
to configure the IPsec tunnel lifetime
to provide encryption through the IPsec tunnel
Refer to the exhibit. What HMAC algorithm is being used to provide data integrity?
MD5
AES
SHA
DH
Two corporations have just completed a merger. The network engineer has been asked to connect the two corporate networks without the expense of leased lines. Which solution would be the most cost effective method of providing a proper and secure connection between the two corporate networks?
Cisco AnyConnect Secure Mobility Client with SSL
Cisco Secure Mobility Clientless SSL VPN
Frame Relay
remote access VPN using IPsec
site-to-site VPN
Refer to the exhibit. What show command displays whether the securityk9 software is installed on the router and whether the EULA license has been activated?
show running-config
show version
show interfaces s0/0/0
show crypto isakmp policy 1
What type of traffic is supported by IPsec?
IPsec supports all IPv4 traffic.
IPsec supports layer 2 multicast traffic.
IPsec supports all traffic permitted through an ACL.
IPsec only supports unicast traffic.
A network analyst wants to monitor the activity of all new interns. Which type of security testing would track when the interns sign on and sign off the network?
vulnerability scanning
password cracking
network scanning
integrity checker
What are three characteristics of SIEM? (Choose three.)
can be implemented as software or as a service
Microsoft port scanning tool designed for Windows
examines logs and events from systems and applications to detect security threats
consolidates duplicate event data to minimize the volume of gathered data
uses penetration testing to determine most network vulnerabilities
What testing tool is available for network administrators who need a GUI version of Nmap?
SuperScan
SIEM
Nessus
Zenmap
What is the goal of network penetration testing?
determining the feasibility and the potential consequences of a successful attack
detecting potential weaknesses in systems
detecting configuration changes on network systems
detecting weak passwords
How does network scanning help assess operations security?
It can detect open TCP ports on network systems.
It can detect weak or blank passwords.
It can simulate attacks from malicious sources.
It can log abnormal activity.
What are three characteristics of the ASA routed mode? (Choose three.)
This mode is referred to as a “bump in the wire.”
In this mode, the ASA is invisible to an attacker.
The interfaces of the ASA separate Layer 3 networks and require different IP addresses in different subnets.
It is the traditional firewall deployment mode.
NAT can be implemented between connected networks.
In which two instances will traffic be denied as it crosses the ASA 5505 device? (Choose two.)
traffic originating from the inside network going to the DMZ network
traffic originating from the inside network going to the outside network
traffic originating from the outside network going to the DMZ network
traffic originating from the DMZ network going to the inside network
traffic originating from the outside network going to the inside network
Refer to the exhibit. Based on the security levels of the interfaces on the ASA, what statement correctly describes the flow of traffic allowed on the interfaces?
Traffic that is sent from the LAN and the Internet to the DMZ is considered inbound.
Traffic that is sent from the DMZ and the Internet to the LAN is considered outbound.
Traffic that is sent from the LAN to the DMZ is considered inbound.
Traffic that is sent from the LAN to the DMZ is considered is considered inbound.
Traffic that is sent from the DMZ and the LAN to the Internet is considered outbound.
Refer to the exhibit. A network administrator is configuring the security level for the ASA. Which statement describes the default result if the administrator tries to assign the Inside interface with the same security level as the DMZ interface?
The ASA allows inbound traffic initiated on the Internet to the DMZ, but not to the Inside interface.
The ASA console will display an error message.
The ASA will not allow traffic in either direction between the Inside interface and the DMZ.
The ASA allows traffic from the Inside to the DMZ, but blocks traffic initiated on the DMZ to the Inside interface.
What can be configured as part of a network object?
interface type
IP address and mask
upper layer protocol
source and destination MAC address
What is the function of a policy map configuration when an ASA firewall is being configured?
binding a service policy to an interface
binding class maps with actions
identifying interesting traffic
using ACLs to match traffic
What is the purpose of configuring an IP address on an ASA device in transparent mode?
management
routing
NAT
VPN connectivity
Which license provides up to 50 IPsec VPN users on an ASA 5506-X device?
the most commonly pre-installed Base license
a purchased Security Plus upgrade license
a purchased Base license
a purchased AnyConnect Premium license
What mechanism is used by an ASA device to allow inspected outbound traffic to return to the originating sender who is on an inside network?
access control lists
Network Address Translation
security zones
stateful packet inspection
When configuring interfaces on an ASA, which two pieces of information must be included? (Choose two.)
group association
security level
name
access list
service level
Refer to the exhibit. A network administrator is verifying the security configuration of an ASA. Which command produces the exhibited output?
show vlan
show ip interface brief
show interface ip brief
show switch vlan
What interface configuration command is used on an ASA to request an IP address from an upstream DSL device?
ip address ip-address netmask
ip address dhcp setroute
dhcpd address IP_address1 [ -IP_address2 ] if_name
ip address pppoe
Refer to the exhibit. What kind of NAT is configured on the ASA device?
dynamic NAT
Twice NAT
dynamic PAT
static NAT
What is the purpose of the Tripwire network testing tool?
to perform vulnerability scanning
to provide information about vulnerabilities and aid in penetration testing and IDS signature development
to assess configuration against established policies, recommended best practices, and compliance standards
to detect unauthorized wired network access
A network analyst is testing the security of the systems and networks of a corporation. What tool could be used to audit and recover passwords?
L0phtCrack
SuperScan
Nessus
Metasploit
