CCNA Security 17

Which of the following are properties directly associated with a signature? (Choose all that apply.) A TVR B SFR C ASR D RR

SFR ASR

What is the name of Cisco cloud-based services for IPS correlation? A SIO B OSI C ISO D EBAY

SIO

Which of the following is not a Next-Generation IPS (NGIPS) solution? A FirePOWER 8000 series appliances B SIO IPS C ASA with FirePOWER D NGIPSv

SIO IPS

Which method of IPS uses a baseline of normal network behavior and looks for deviations from that baseline? A Anomaly-based IPS B Signature-based IPS C Policy-based IPS D Reputation-based IPS

Anomaly-based IPS

Which of the following is not a best practice? A Assign aggressive IPS responses to specific signatures B Use correlation within the enterprise and globally for an improved security posture C Tune the IPS and revisit the tuning process periodically D Assign aggressive IPS responses based on the resulting risk rating generated by the attack

Assign aggressive IPS responses to specific signatures

Which of the micro-engines contains signatures that can only match on a single packet, as opposed to a flow of packets? A Atomic B String C Flood D Other

Atomic

A company has hired you to determine whether attacks are happening against the server farm, and it does not want any additional delay added to the network. Which deployment method should be used? A Appliance-based IPS B IDS C Appliance-based inline D IOS software-based inline

IDS

Which method should you implement when it is not acceptable for an attack to reach its intended victim? A Hardware appliance B Out of band C IPS D IDS

IPS

Which type of implementation requires custom signatures to be created by the administrator? A Policy-based IPS B Reputation-based IPS C Anomaly-based IPS D Engine-based IPS

Policy-based IPS

Which method requires participation in global correlation involving groups outside your own enterprise? A Reputation-based IPS B Policy-based IPS C Signature-based IPS D Anomaly-based IPS

Reputation-based IPS

Why does IPS have the ability to prevent an ICMP-based attack from reaching the intended victim? A Policy-based routing. B The IPS is in promiscuous mode. C The IPS is inline with the traffic. D TCP resets are used.

The IPS is inline with the traffic.