sec150 Chapter 7 ALL

preprocessors

IPS pattern matching is almost impossible because of the different protocols and their intricacies. For example, matching a file pattern in SMTP traffic is not performed the same way as matching it when flowing through HTTP with compression enabled. For that reason, the Cisco NGIPS offers a variety of --- that normalize traffic so that it dan be matched against the defined Snort rules.

a private key

If an asymmetric algorithm uses a public key to encrypt data, what is used to decrypt it? DH a private key a digital certificate a different public key

Making an online purhcase

In what situation would an asymmetric algorithm most likely be used?

A TAXII server.

Which of the following can be deployed to generate, transport, and consume threat intelligence info?

They are relatively slow because they are based on difficult computational algorithms

Which statement describes asymmetric encryption algorithms?

Generator Prime modulus

Which two non-secret numbers are initially agreed upon when the Diffie-Hellman algorithm is used? (Choose two.)

Asymmetric

Which type of encryption algorithm uses public and private keys to provide authentication, integrity, and confidentiality?

Auto NAT

You are tasked to configure NAT and translate the source address of an object regardless of the destination address. Which of the following NAT configuration features would you deploy to accomplish this task?

Balanced Security and Connectivity

You are tasked to deploy an intrusion policy designed to balance overall network performance with network infrastructure security> Which of the following base policies would you deploy in situations where you want to apply intrusion prevention?

Multiple context mode.

You were hired to deploy a Cisco ASA to provide separation of management and policies on a shared appliance. Which operational mode is best for this scenario?

The ____ MPF command configures security or QoS policies.

policy-map

IPS pattern matching is almost impossible because of the different protocols and their intricacies. For example, matching a file pattern in SMTP email traffic is not performed the same way as matching it when flowing through HTTP with compression enabled. For that reason, the Cisco NGIPS offers a variety of ___________ that normalize traffic so that it can be matched against the defined Snort rules.

preprocessors

nonrepudiation of the transaction

A customer purchases an item from an e-commerce site. The e-commerce site must maintain proof that the data exchange took place between the site and the customer. Which feature of digital signatures is required? authenticity of digitally signed data integrity of digitally signed data nonrepudiation of the transaction confidentiality of the public key

Implement CBC mode.

A network administrator is forced to use DES on aging equipment. What is one thing the administrator should do in this situation? Use ECC instead of parity.​ Increase the key length. Implement CBC mode. Increase the number of bits used for encryption.​

When you add a Cisco FTD or Firepower device to FMC, what information is required?

A registration key

Symmetric

A shared secret is a key used in a _________ encryption algorithm.

Cisco ASA provides the Modular Policy Framework (MPF) to provide application security or perform Quality of Service (QoS) functions. The MPF offers a consistent and flexible way to configure the Cisco ASA application inspection and other features in a manner similar to that used for the Cisco IOS Software Modular QoS CLI. Which of the following are commands associated with the MPF?

ALL

In Cisco ASA deployments, an access control list (ACL) is a collection of security rules or policies that allows or denies packets after looking at the packet headers and other attributes. Each permit or deny statement in the ACL is referred to as an access control entry (ACE). These ACEs classify packets by inspecting Layer 2 through Layer 7 headers for a number of parameters, including which of the following?

ALL

Variables are used in multiple locations in Cisco Firepower NGIPS. IPS rules use preconfigured variables representing networks and ports. Which of the following are system default variables that are preconfigured in Cisco Firepower devices?

ALL

Which of the following are requirements for failover configurations?

ALL

The digital signatures

An online retailer needs a service to support the nonrepudiation of the transaction. Which component is used for this service?

Match the feature with the following description: Cisco Firepower NGIPS offers deep inspection and control of application-specific information for better efficacy.

Application visibility

Integrity

Authentication,_________________ , and confidentiality are the three objectives of secure communications.

- class-map - policy-map - service-policy

Cisco ASA provides the Modular Policy Framework (MPF) to provide application security or perform Quality of Service (QoS) functions. The MPF offers a consistent and flexible way to configure the Cisco ASA application inspection and other features in a manner similar to that used for the Ciso IOS Software Modular QoS CLI. Which of the following are commands associated with the MPF? ALL of these

Which of the following Cisco firewalls is designed for very large enterprises and service providers?

Cisco Firepower 9300 appliances

Zone-based firewalls cannot be implemented in an SD-WAN solution.

Cisco IOS Zone-Based Firewall (ZBFW) can be deployed to provide firewall services in small and medium-sized organizations. Which of the following is NOT true about zone-based firewalls?

- Layer 2 protocol info such as EtherTypes - Layer 3 header info such as source and destination IP addresses. - Layer 4 header info such as source and destination TCP or UDP ports.

In Cisco ASA deployments, an ACL is a collection of security rules or policies that allows or denies packets after looking at the packet headers and other attributes. Each permit or deny statement in the ACL is referred to as an access control entry (ACE). These ACEs classify packets by inspecting Layer 2 through Layer 7 headers for a number of parameters, including which of the following? All of these

A network administrator connects to a Cisco router with SSH

In which situation is an asymmetric key algorithm used?

It authenticates a website and establishes a secure connection to exchange confidential data

What is the purpose of a digital certificate?

To ensure that the source of the communications is confirmed

What is the purpose of a nonrepudiation service in secure communications?

Integrity of source .EXE files

What is the purpose of code signing?

to generate a shared secret between two hosts that have not communicated before

What is the purpose of the DH algorithm? to provide nonrepudiation support to support email data confidentiality to encrypt data traffic after a VPN is established to generate a shared secret between two hosts that have not communicated before

to provide authentication

What is the reason for HMAC to use an additional secret key as input to the hash function? to provide encryption to provide authentication to provide integrity verification to prevent DoS attack

PKI

What is the service framework that is needed to support large-scale public key-based technologies? HMAC PKI RSA

Shared secret

What type of encryption algorithm uses the same key to encrypt and decrypt data?

Cisco Firepower 9300 appliances.

Which of the following Cisco firewalls is designed for very large enterprises and service providers?

- The 2 participant devices must be configured in the same firewall mode (eg. routed or transparent). - The 2 participant devices must be running the same software version. - You can configure different Cisco FTD devices in groups (or domain) in the Cisco FMC. Devices configured for failover must be in the same domain or group on on the Cisco FMC.

Which of the following are requirements for failover configurations? ALL of these

After the master boots, it creates a logical interface and assigns an IP address to that interface to communicate to the other units in the cluster.

Which of the following is NOT a step in the Cisco FTD cluster unit transition?

The default security intelligent update frequency is 2 hours. In some scenarios, you may want to reduce this for more agile blacklisting.

Which of the following is a best practice for security intelligence updates?

- Both network analysis and intrusion policies are invoked by a parent access control policy, but at different times. - As the system analyzes traffic, the network analysis (decoding and preprocessing) phase occurs before and separately from the intrusion prevention (additional preprocessing and intrusion rules) phase. - The Cisco FTD has several similarly named network analysis and intrusion policies (eg. Balance Security and Connectivity).

Which of the following is true about Cisco Firepower Intrusion Policies? ALL of these

Threat Grid.

Which of the following sandboxing technologies provides a dynamic analysis that includes an external kernel monitor, dynamic disk analysis that illuminates any modifications to the physical disk (such as the master boot record), monitoring user interaction, video capture and playback, process information, artifacts, and network traffic?

- Inline sets and passive interfaces are only supported on physical interfaces and EtherChannels. - Inline sets cannot use redundant interfaces or VLANs. - Inline sets and passive interfaces are supported in intra-chassis and inter-chassis clustering.

Which of the following statements are true about the inline interface sets and passive interfaces in Cisco FTD deployments? ALL of these

Layer 3 firewalls support EtherType ACLs.

Which of the following statements is NOT true about firewalls deployed in Layer 3 (routed) mode?

Standard ACLs provide a way to group similar items together to reduce the number of ACEs.

Which of the following statements is NOT true about standard ACLs?

integrity

Which requirement of secure communications is ensured by the implementation of MD5 or SHA hash generating algorithms?​ confidentiality authentication integrity nonrepudiation

SEAL is a stream cipher

Which statement describes the Software-Optimized Encryption Algorithm (SEAL)?

A class 0 certificate is for testing purposes A class 4 certificate is for online business transactions between companies.

Which two statements correctly describe certificate classes used in the PKI? (Choose two.) A class 0 certificate is for testing purposes. A class 0 certificate is more trusted than a class 1 certificate. The lower the class number, the more trusted the certificate. A class 5 certificate is for users with a focus on verification of email. A class 4 certificate is for online business transactions between companies.

man-in-the-middle

Which type of attack does the use of HMACs protect against? DoS DDoS brute force man-in-the-middle

One of the keys can be made public

Why is asymmetric algorithm key management simpler than symmetric algorithm key management?

3DES is more trusted because it has been proven secure for a longer period than AES

Why is the 3DES algorithm often preferred over the AES algorithm?

# access-list MY-LIST extended permit tcp 192.168.88.0 255.255.255.128 host 10.2.2.2 eq 25

You were asked to configure a Cisco ASA to permit SMTP traffic from hosts in 192.168.88.0/25 to an email server (10.2.2.2). Which of the following access control entries (ACEs) in an ACL will accomplish this task?

Cisco IOS Zone-Based Firewall (ZBFW) can be deployed to provide firewall services in small- and medium-sized organizations. Which of the following is not true about zone-based firewalls?

Zone-based firewalls cannot be implemented in an SD-WAN solution.

In ZBFW deployments, an interface can be assigned to _____ security zone(s).

one

A Cisco ASA device also can be implemented as a traditional Layer _____ firewall.

Layer 2 or 3

Use a keyspace large enough that it takes too much money and too much time to conduct a successful attack

How do modern cryptographers defend against brute-force attacks?

56 bits

How many bits does the Data Encryption Standad (DES) use for data encryption?

In a multimode transparent firewall (MMTF), Cisco ASA acts in a similar fashion to how it performs in single mode, with two major exceptions

B. Packets are handled in different contexts. C. An interface cannot be shared between multiple contexts in this mode.

At which OSI Layer are ACE EtherTypes packets found?

Layer 3

3DES

Refer to the exhibit. Which encryption algorithm is described in the exhibit?

On an ISR G2, _____ is a Peripheral Component Interconnect Express (PCIe) internal interface, and on a UCS E-Series, _____ is a switched interface connected to the backplane Multi Gigabit Fabric (MGF).

Slot0, Slot1

A registration key

When you add a Cisco FTD or Firepower device to FMC, what info is required?

SHA-2

The SHA-224, SHA-256, SHA-384, and SHA-512 hash functions are known collectively as ________________ algorithms.

defend the castle

The following message was encrypted using a Caesar cipher with a key of 2: fghgpf vjg ecuvng What is the plaintext message?​ defend the region invade the castle defend the castle invade the region

Match the feature with the following description: Cisco Firepower NGIPS provides protection against known and new threats.

Threat containment and remediation

AES

Which algorithm can ensure data confidentiality?

DH

Which encryption algorithm is an asymmetric algorithm?

IPsec protocol suite

Which encryption protocol provides network layer confidentiality?

Confidentiality

Which objective of secure communications is achieved by encrypting data?

$FILE_DATA_PORTS $HOME_NET $HTTP_SERVERS

Variables are used in multiple locations in Cisco Firepower NGIPS. IPS rules use preconfigured variables representing networks and ports. Which of the following are system default variables that are preconfigured in Cisco Firepower devices? ALL of these

certificate authority digital certificates

What are the two important components of a public key infrastructure (PKI) used in network security? (Choose two.) intrusion prevention system certificate authority digital certificates pre-shared key generation symmetric encryption algorithms

3DES AES

What are two symmetric encryption algorithms? (Choose two.) 3DES MD5 AES HMAC SHA

Symmetric encryption algorithms use pre-shared keys. Asymmetric encryption algorithms use different keys to encrypt and decrypt data.

What is a difference between symmetric and asymmetric encryption algorithms? Symmetric algorithms are typically hundreds to thousands of times slower than asymmetric algorithms. Symmetric encryption algorithms are used to authenticate secure communications. Asymmetric encryption algorithms are used to repudiate messages. Symmetric encryption algorithms are used to encrypt data. Asymmetric encryption algorithms are used to decrypt data. Symmetric encryption algorithms use pre-shared keys. Asymmetric encryption algorithms use different keys to encrypt and decrypt data.

Breaking encrypted codes

What is the focus of cryptanalysis?

To secure the exchange of keys used to encrypt data

What is the most common use of the Diffie-Helman algorithm in communications security?

The ____ MPF command classifies the traffic to be inspected.

class-map