CCNA Security v2.0 Final Exam

What is the default preconfigured security level for the outside network interface on a Cisco ASA 5505?

0

What service or protocol does the Secure Copy Protocol rely on to ensure that secure copy transfers area from authorized users?

AAA

What algorithm is used with IPsec to provide data confidentiality

AES

What is a limitation to using OOB management on a large enterprise network?

All devices appear to be attached to a single management network

On what switch port s should PortFast be enabled to enhance STP stability?

All end-user ports

A company deploys a network-based IPS. Which statement describes a false negative alarm that is issued by the IPS sensor?

An attack packet passes an no alarm is generated

hich two end points can be on the other side of an ASA site-to-site VPN configured using ASDM?

Another ASA ISR Router

Which type of ASDM connection would provide secure remote access for remote users into corporate networks?

AnyConnect SSL VPN

What are two drawbacks in assigning user privilege levels on a Cisco router?

Assigning a command with multiple keywords allows access to all commands using those keywords Commands from a lower level are always executable at a higher level

What does the keyword default specify when used with the aaa authentication login command?

Authentication is automatically applied to the con 0, aux, and the vty lines

Which router component determines the number of signatures and engines that can be support

Available memory

How can DHCP spoofing attacks be mitigated?

By implementing DHCP snooping on trusted ports

Which three forwarding plane services and functions are enabled by the Cisco AutoSecure feature?

Cisco IOS firewall inspection Cisco Express Forwarding (CEF) Traffic filtering with ACLs

Which feature of the Cisco Network Foundation Protection framework prevents a route processor from being overwhelmed by unnecessary traffic?

Control Plane Policing

When configuring SSH on a router to implement secure network management, a network engineer has issued the login local and transport input ssh line vty commands. What three additional configuration actions have to be performed to complete the SSH configuration?

Create a valid local username and password database Generate the asymmetric RSA keys Configure the correct IP domain name

What can be used as an alternative to HMAC

Digital Signatures

A network administrator is configuring an AAA server to manage TACACS+ authentication. What are two attributes of TACACS+ authentication?

Encryption for all communication Separate processes for Authentication and Authorization

What type of ACL offers greater flexibility and control over network access?

Extended

What is the function of the Hashed Message Authentication Code (HMAC) algorithm in setting up an IPsec VPN?

Guarantees message integrity

What is the advantage of HIPS that is not provided by IDS

HIPS protects critical system resources and monitors operating system processes

Which two types of hackers are typically classified as grey hat hackers?

Hacktivists Vulnerability Brokers

A company deploys a hub-and-spoke VPN topology where the security appliance is the hub and the remote VPN networks are the spokes. Which VPN method should be used in order for one spoke to communicate with another spoke through the single public interface of the security appliance?

Hairpinning

What can be configured as part of a network object?

IP address and mask

Which two statements describe the use of asymmetric algorithms?

If a private key is used to encrypt the data, a public key must be used to decrypt the data If a public key is used to encrypt the data, a private key must be used to decrypt the data

What are three characteristics of the RADIUS protocol?

Is an open IETF standard AAA protocol Uses UDP ports for Authentication and Accounting Is widely used in VOIP and 802.1X implementations

Which statement describes the Cisco Cloud Web Security?

It is a cloud-based security service to scan traffic for malware and policy enforcement

What is the result of a DHCP starvation attack?

Legitimate clients are unable to lease IP addresses

What is the next step in the establishment of an IPsec VPN after IKE Phase 1 is complete?

Negotiation of the IPsec SA Policy

A security technician is evaluating a new operations security proposal designed to limit access to all servers. What is an advantage of using network security testing to evaluate the new proposal?

Network security testing proactively evaluates the effectiveness of the proposal before any real threat occurs

What ports can receive forwarded traffic from an isolated port that is part of a PVLAN

Only promiscuous ports

What three tasks can a network administrator accomplish with the Nmap and Zenmap secuirty testing tools?

Open UDP and TCP port detection Operating System Fingerprinting Assessment of Layer 3 protocol support on hosts

Which three areas of router security must be maintained to secure an edge router at the network perimeter?

Physical Security Operating System Security Router Hardening

Which security document includes implementation details, usually with step-by-step instructions and graphics?

Procedure Document

Which service should be disabled on a router to prevent a malicious host from falsely responding to ARP requests with the intent to redirect the Ethernet frames?

Proxy ARP

What are the two protocols that are used by AAA to authenticate users against a central database of usernames and password?

RADIUS TACACS+

What information does the SIEM network security management tool provide to network administrators?

Real time reporting and analysis of security events

Which features is specific to the Security Plus upgrade license of an ASA 5505 and provides increased availability?

Redundant ISP connections

Which security implementation will provide management plane protection for a network device?

Role-Based Access Control

Which interface setting can be configured in ASDM through the Device Setup tab?

Security Level

What term describes a set of rules used by an IDS or IPS to detect typical intrusion activity?

Signature

A network administrator is configuring an AAA server to manage RADIUS authentication. Which two features are included in RADIUS authentication?

Single process for authentication and authorization Hidden passwords during transmission

How are Intrusion Prevention System (IPS) and Intrusion Detection System (IDS) components used conjunctive?

The IDS will send alert messages about "gray area" traffic while the IPS will block malicious traffic

What is a characteristic of an ASA Site-to-Site VPN

The IPsec protocol protects the data transmitted through the site-to-site tunnel

What is a result of enabling the Cisco IOS image resilience feature?

The feature can only be disabled through a console session

Why is Diffie-Hellman algorithm typically avoided for encyption

The large number used by DH makes it too slow for bulk data transfer

A syslog server has received the message shown. *Mar 1 00:07:18.787: %SYS-5-CONFIG_I: Configured from console by vty0 (172.16.45.1) What can be determined from the syslog message?

The message informs the administrator that a user with an IP address of 172.16.45.1 configured this device remotely

Which statement accurately describes Cisco IOS Zone-Based Policy Firewall operation?

The pass action works in only one direction

A security technician uses an asymmetric algorithm to encrypt messages with a private key and then forwards that data to another technician. What key must be used to decrypt this data?

The public key of the sender

What is the purpose of AAA Accounting

To collect and report data usage

What is a characteristic of a DMZ zone?

Traffic originating from the outside network going to the DMZ network is selectively permitted

hich type of VLAN-hopping attack may be prevented by designating an unused VLAN as the native VLAN?

VLAN double-tagging

What is a characteristic of asymmetric algorithms?

Very long key lengths are used

What technology is used to separate physical interfaces on the ASA 5505 device into different security zones?

Virtual local-area networks

A user complains about not being able to gain access to the network. What command would be used by the network administrator to determine which AAA method list is being used for this particular user as the user logs on?

debug aaa authentication